Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BUG: Removing payloads does not clear cachedUUIDInfoMap #424

Open
XCVYN6UGT85JywuH opened this issue Oct 18, 2024 · 2 comments
Open

BUG: Removing payloads does not clear cachedUUIDInfoMap #424

XCVYN6UGT85JywuH opened this issue Oct 18, 2024 · 2 comments

Comments

@XCVYN6UGT85JywuH
Copy link

payload.Deleted = true
deletedPayloadIDs = append(deletedPayloadIDs, payload.ID)
if _, err := database.DB.Exec(`UPDATE payload SET deleted=true WHERE id=$1`, payload.ID); err != nil {
logging.LogError(err, "Failed to update payload deleted status")
}

As you can see we doesn't clear cachedUUIDInfoMap when removing payload.

func LookupEncryptionData(c2profile string, messageUUID string, updateCheckinTime bool) (*cachedUUIDInfo, error) {
	//logging.LogTrace("Looking up information for new message", "uuid", messageUUID)
	//logging.LogDebug("Getting encryption data", "cachemap", cachedUUIDInfoMap)
	cachedUUIDInfoMapMutex.Lock()
	defer cachedUUIDInfoMapMutex.Unlock()
	if _, ok := cachedUUIDInfoMap[messageUUID+c2profile]; ok {
		// we found an instance of the cache info with c2 profile encryption data
		if cachedUUIDInfoMap[messageUUID+c2profile].UUIDType == "callback" {
			if updateCheckinTime {
				UpdateCallbackEdgesAndCheckinTime(cachedUUIDInfoMap[messageUUID+c2profile])
			}

		}
		return cachedUUIDInfoMap[messageUUID+c2profile], nil
	} else if _, ok := cachedUUIDInfoMap[messageUUID]; ok {
		// we found an instance of the cache info with payload encryption data
		if cachedUUIDInfoMap[messageUUID].UUIDType == "callback" {
			if updateCheckinTime {
				UpdateCallbackEdgesAndCheckinTime(cachedUUIDInfoMap[messageUUID])
			}

		}
		return cachedUUIDInfoMap[messageUUID], nil
	}

But the first part of LookupEncryptionData function check only cachedUUIDInfoMap.

As a result, new callbacks appear even if payload was deleted.

Possible solution: clear cachedUUIDInfoMap when removing payloads.

@its-a-feature
Copy link
Owner

Try pulling the latest:

git pull
sudo make
sudo ./mythic-cli restart

I just made a push to help address this - now when payloads are deleted, the cache map is invalidated for entries that start with the payload uuid that was deleted.

@its-a-feature
Copy link
Owner

Were you ever able to confirm that this is fixed for you?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants