Not capturing STDOUT/STDERR

When running certain PE files, the STDOUT/STDERR is not be captured approximately.

RunPE Version: Latest
OS: Windows 10
Build: OS Version: 10.0.19045 N/A Build 19045

Example running Mimikatz (latest):

[…snippet…]

As you can see, the execution of the PE works, however no output is pushed to the redirection pipe handlers.

I am using our C2 to wrap this functionality and when I try to get the output, there is nothing that is returned (https://github.com/nettitude/RunPE/blob/main/RunPE/Program.cs#L107)

I have also tried the CheekyBlinders (https://github.com/br-sn/CheekyBlinder) PE file, which results in the same issue of no output being collected.

[benpturner]

Nice find, we’ve definitely seen some of this in the past, e.g. static vs dynamic linking when running in memory. Must have had this configuration our side, i’ll check and confirm as well 🙌

[aconite33]

Anndddd boom goes the dynamite.

Any program you want to run within RunPE needs this changed when compiling with Visual Studio:

Project -> Properties -> C/C++ -> Code Generation -> RunTime Library -> Multi-Threaded Debug

Thanks to @kerrymilan for debugging it.

Here is CheekyBlinders running:

Reason for the fix might be due to static compilation?

https://learn.microsoft.com/en-us/cpp/build/reference/md-mt-ld-use-run-time-library?view=msvc-170