Linux Server: panic: runtime error: invalid memory address or nil pointer dereference

[robpot891]

Prerequisite

• I have read the README
• I have search the opened & closed issues
• I have search the WIKI and its FAQ page

Environment Data

• Merlin Version: 0.6.0 Beta
• Merlin Build: Linux Agent + Server
• Go Version: go1.10.3 linux/amd64
• GOPATH Environment Variable: "/root/go"
• GOROOT Environment Variable: "/usr/lib/go-1.10"
• Operating System: 4.17.0-kali1-amd64

Expected Behavior

Sending commands to agent and recieve response (error message or otherwise)

Actual Behavior

Sending any module to agent produces the following error:

Merlin Server:

Merlin[module][LinEnum]» set agent all
[+]agent set to ffffffff-ffff-ffff-ffff-ffffffffffff
Merlin[module][LinEnum]» run
**panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x80 pc=0x725936]

goroutine 20 [running]:
github.com/Ne0nd0g/merlin/pkg/agents.AddJob(0xffffffffffffffff, 0xffffffffffffffff, 0x832567, 0x3, 0xc42029c0f0, 0xa, 0xf, 0x0, 0x0, 0x0, ...)
/root/go/src/github.com/Ne0nd0g/merlin/pkg/agents/agents.go:366 +0x506
github.com/Ne0nd0g/merlin/pkg/cli.Shell()
/root/go/src/github.com/Ne0nd0g/merlin/pkg/cli/cli.go:169 +0x21c6
created by main.main
/opt/merlin/cmd/merlinserver/main.go:66 +0x44e**

The above error also happens on Linux Mint with GO path = /home/user/go and go root = /usr/lib/go-1.10

Merlin Agent:

[-]Agent version: 0.6.0 Beta
[-]Agent build: nonRelease
[-]Connecting to web server at https://127.0.0.1:443 for initial check in.
[-]Sleeping for 30.271s at 2018-08-30 02:51:02.860022733 -0400 EDT m=+0.008732155
[-]Checking in
[-]Connecting to web server at https://127.0.0.1:443 for status check in.
[+]ServerOk Message Type Received!

Sending upload/download command produces the following error:

2018/08/30 02:59:29 http2: **panic serving 127.0.0.1:56328: runtime error: index out of range
goroutine 134 [running]:
net/http.(*http2serverConn).runHandler.func1(0xc42000e0d8, 0xc4202cdfaf, 0xc42034a380)
/usr/lib/go-1.10/src/net/http/h2_bundle.go:5753 +0x190
panic(0x7b26e0, 0xa94710)
/usr/lib/go-1.10/src/runtime/panic.go:502 +0x229
github.com/Ne0nd0g/merlin/pkg/agents.GetMessageForJob(0xfa4ee829dcfa8d68, 0x13fe7659137ecfac, 0xc4203f0580, 0xa, 0x832e4e, 0x6, 0x833146, 0x7, 0xc42031f350, 0x1, ...)
/root/go/src/github.com/Ne0nd0g/merlin/pkg/agents/agents.go:503 +0x1a62
github.com/Ne0nd0g/merlin/pkg/agents.StatusCheckIn(0xdcfa8d683f800000, 0x137ecfacfa4ee829, 0x13fe7659, 0xc42026a7e0, 0xd, 0x7b3920, 0xc42026c220, 0xc4204b0000, 0x1000, 0x0, ...)
/root/go/src/github.com/Ne0nd0g/merlin/pkg/agents/agents.go:208 +0x3b8
github.com/Ne0nd0g/merlin/pkg/servers/http2.agentHandler(0x8898a0, 0xc42000e0d8, 0xc42016e800)
/root/go/src/github.com/Ne0nd0g/merlin/pkg/servers/http2/http2.go:248 +0xcaf
net/http.HandlerFunc.ServeHTTP(0x852418, 0x8898a0, 0xc42000e0d8, 0xc42016e800)
/usr/lib/go-1.10/src/net/http/server.go:1947 +0x44
net/http.(*ServeMux).ServeHTTP(0xc4200a16b0, 0x8898a0, 0xc42000e0d8, 0xc42016e800)
/usr/lib/go-1.10/src/net/http/server.go:2337 +0x130
net/http.serverHandler.ServeHTTP(0xc4200a3c70, 0x8898a0, 0xc42000e0d8, 0xc42016e800)
/usr/lib/go-1.10/src/net/http/server.go:2694 +0xbc
net/http.initNPNRequest.ServeHTTP(0xc42017ca80, 0xc4200a3c70, 0x8898a0, 0xc42000e0d8, 0xc42016e800)
/usr/lib/go-1.10/src/net/http/server.go:3260 +0x9a
net/http.(Handler).ServeHTTP-fm(0x8898a0, 0xc42000e0d8, 0xc42016e800)
/usr/lib/go-1.10/src/net/http/h2_bundle.go:5475 +0x4d
net/http.(http2serverConn).runHandler(0xc42034a380, 0xc42000e0d8, 0xc42016e800, 0xc42031f500)
/usr/lib/go-1.10/src/net/http/h2_bundle.go:5760 +0x89
created by net/http.(http2serverConn).processHeaders
/usr/lib/go-1.10/src/net/http/h2_bundle.go:5494 +0x46b

Steps to Reproduce Behavior

Any task sent to agent crashes the server with one of the above messages. I have the same response with pre-compiled binaries with the default https://127.0.0.1:443 url.

Misc Information

I have tried to recreate the certs but it didn't help. Firewall is turned off and theres no competing listeners on other ports. I suspect it may be a go issue and not a merlin issue but if you have some insight it would be much appreciated.

[Ne0nd0g]

Thanks for reporting this error @robpot891 . I believe I fixed it in the dev branch. Please let me know if you have any additional bugs or obstacles.

[robpot891]

Hey, I didn't want to start a new thread so I came across this error in latest version:

Merlin[module][SharpUp]» run
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x80 pc=0x726326]

goroutine 6 [running]:
github.com/Ne0nd0g/merlin/pkg/agents.AddJob(0xffffffffffffffff, 0xffffffffffffffff, 0x832567, 0x3, 0xc420222120, 0x9, 0x9, 0x0, 0x0, 0x0, ...)
/home/silas/go/src/github.com/Ne0nd0g/merlin/pkg/agents/agents.go:366 +0x506
github.com/Ne0nd0g/merlin/pkg/cli.Shell()
/home/silas/go/src/github.com/Ne0nd0g/merlin/pkg/cli/cli.go:169 +0x21c6
created by main.main
/home/silas/merlin/cmd/merlinserver/main.go:67 +0x44e

Seems to be same error as last time. The new version is a lot more stable though and I only get this error on a few modules (csharp modules mostly).

[Ne0nd0g]

I wasn't able to reproduce the error you reported. I have the output of how I configured and executed the module. Could you please share with me all the steps you took to get the error so I can reproduce it?

[-]Starting h2 listener on 127.0.0.1:443
Merlin» use module windows/x64/csharp/privesc/SharpUp
Merlin[module][SharpUp]» set agent all
[+]agent set to ffffffff-ffff-ffff-ffff-ffffffffffff
Merlin[module][SharpUp]» run
[!]there are 0 available agents, no jobs were created
Merlin[module][SharpUp]» [+]Received new agent checkin from 7e9bf7b3-6aaf-4629-ab17-c26d7db89a7b
Merlin[module][SharpUp]» run
[-]Created job uxMFyYztOG for agent ffffffff-ffff-ffff-ffff-ffffffffffff
Merlin[module][SharpUp]» [+]Results for job uxMFyYztOG
[+]Microsoft (R) Visual C# Compiler version 4.7.3056.0
for C# 5
Copyright (C) Microsoft Corporation. All rights reserved.

This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language 
<snip>
Merlin[module][SharpUp]» set agent 7e9bf7b3-6aaf-4629-ab17-c26d7db89a7b
[+]agent set to 7e9bf7b3-6aaf-4629-ab17-c26d7db89a7b
Merlin[module][SharpUp]» run
[-]Created job DKudToisLJ for agent 7e9bf7b3-6aaf-4629-ab17-c26d7db89a7b
Merlin[module][SharpUp]» [+]Results for job DKudToisLJ
[+]Microsoft (R) Visual C# Compiler version 4.7.3056.0
for C# 5
<snip>

[robpot891]

I made the agents (sudo make all) and started the server (sudo ./merlinServer-Linux). No command line arguments on the server, but I used -url on agents to connect to listening server.

When I start the server, sometimes I get the banner then the listener drops and I'm back to the cli. However, when I type the words don't appear on the terminal. I have to close terminal to retry. This is strange but it's a separate issue (maybe not?).

I managed to recreate the error today when I tried upload a file from server to agent:

**Merlin[agent][f22083b0-4a99-4907-931d-38dec9c5c07a]» upload merlinAgent-Windows-x64.exe
[-]Created job hAugknuCDA for agent f22083b0-4a99-4907-931d-38dec9c5c07a
2018/09/09 00:19:24 http2: panic serving 192.168.0.147:53230: runtime error: index out of range
goroutine 464 [running]:
net/http.(*http2serverConn).runHandler.func1(0xc42000e058, 0xc4204b1faf, 0xc4204e2380)
/usr/lib/go-1.10/src/net/http/h2_bundle.go:5753 +0x190
panic(0x7b26e0, 0xa94710)
/usr/lib/go-1.10/src/runtime/panic.go:502 +0x229
github.com/Ne0nd0g/merlin/pkg/agents.GetMessageForJob(0x749994ab08320f2, 0x7ac0c5c9de381d93, 0xc42018b760, 0xa, 0x832e4e, 0x6, 0x83314d, 0x7, 0xc4202c0e90, 0x1, ...)
/home/silas/go/src/github.com/Ne0nd0g/merlin/pkg/agents/agents.go:503 +0x1a62
github.com/Ne0nd0g/merlin/pkg/agents.StatusCheckIn(0xb08320f23f800000, 0xde381d930749994a, 0x7ac0c5c9, 0xc42018b8b0, 0xd, 0x7b3920, 0xc420164640, 0xc420252000, 0x1000, 0x0, ...)
/home/silas/go/src/github.com/Ne0nd0g/merlin/pkg/agents/agents.go:208 +0x3b8
github.com/Ne0nd0g/merlin/pkg/servers/http2.agentHandler(0x8899a0, 0xc42000e058, 0xc4204e0600)
/home/silas/go/src/github.com/Ne0nd0g/merlin/pkg/servers/http2/http2.go:248 +0xcaf
net/http.HandlerFunc.ServeHTTP(0x852458, 0x8899a0, 0xc42000e058, 0xc4204e0600)
/usr/lib/go-1.10/src/net/http/server.go:1947 +0x44
net/http.(*ServeMux).ServeHTTP(0xc4200a56b0, 0x8899a0, 0xc42000e058, 0xc4204e0600)
/usr/lib/go-1.10/src/net/http/server.go:2337 +0x130
net/http.serverHandler.ServeHTTP(0xc4200a7e10, 0x8899a0, 0xc42000e058, 0xc4204e0600)
/usr/lib/go-1.10/src/net/http/server.go:2694 +0xbc
net/http.initNPNRequest.ServeHTTP(0xc4200b2700, 0xc4200a7e10, 0x8899a0, 0xc42000e058, 0xc4204e0600)
/usr/lib/go-1.10/src/net/http/server.go:3260 +0x9a
net/http.(Handler).ServeHTTP-fm(0x8899a0, 0xc42000e058, 0xc4204e0600)
/usr/lib/go-1.10/src/net/http/h2_bundle.go:5475 +0x4d
net/http.(http2serverConn).runHandler(0xc4204e2380, 0xc42000e058, 0xc4204e0600, 0xc4202c1040)
/usr/lib/go-1.10/src/net/http/h2_bundle.go:5760 +0x89
created by net/http.(http2serverConn).processHeaders
/usr/lib/go-1.10/src/net/http/h2_bundle.go:5494 +0x46b

Didn't do anything out of the ordinary. I think this may be an issue with my computer specifically.

[Ne0nd0g]

It looks like the error is caused because you did not provide a path for the file to uploaded to on the host where the agent is running. That is my fault for not checking to make sure there are 3 arguments. I'll get it updated.