module "implant.pam" error

Bug Description

when i execute the module "implant.pam him returns an error

pwncat version

$ pwncat-cs --version
0.5.4

Target System (aka “victim”)

the targets are the machine “admirertoo” in hackthebox and my own machine, in both i have the same error

my machine specifications

$ uname -a       
Linux kali2 5.8.0-kali2-amd64 #1 SMP Debian 5.8.10-1kali1 (2020-09-22) x86_64 GNU/Linux

Steps to Reproduce

Steps to reproduce the behavior:

1. after getting a root shell, execute:

run implant.pam password=s3cr3ts

1. Get the error:

Expected Behavior

The execution of the module without error.

Screenshots

These screenshots are a continuation of the error commented on in topic 2 of “steps to reproduce”.

[sierghart]

sorry @calebstewart , probably i expressed of a manner in that i left some things out

the /snap shows because i retired the grep of the command find to see if him returns something, when i did this, the /snap has been shown

then, i understand that the session.platform.run is running In a way that the command find don’t returns the /usr/lib/x86_64-linux-gnu/security only the /snap/core18/2284/lib/x86_64-linux-gnu/security

what i go say now probably is wrong, because i don’t understand ed the functionality behind the code…

i guess that the problem is in how the session.platform.run the find command. because how i showed in the last commentary, when i execute the module (that execute the find with session.platform.run) he only returns the /snap/, when i change to shell in pwncat the and execute the find in shell, the /usr/lib/x86_64-linux-gnu/security is showed

[calebstewart]

Sorry, I merged the PR, which auto-closed this issue. 👀

I’ll see if I can get this replicated on my end. For the record, the exit code you would get from that shell command would be the exit code from grep not find, but it should still be valid. I’m not sure why it’s failing. It’s even more odd that @sierghart 's output shows a /snap/ entry when grep should have filtered that out. Very weird.