Jump to content
Sign in to follow this  
zenn1999

Cannot Delete the Loot

Recommended Posts

This weekend I had been trying to get my screen crab online and connected to my c2 instance. I had been trying to recreate an issue i had so i let it run all weekend. Which would have been fine except it is on a VPS with 20 gig hdd space. I realize this morning that i filled 18 of my 20 gigs with screen grabs. So I tried to delete one file and it stays. I then tried the delete all button which locked up the server and deleted nothing that i could tell. Is there a way to do this manually or if I remove that device does it also remove the loot?

Share this post


Link to post
Share on other sites

I tried deleting the device and the loot but all it did was lock up the vps. I then figured i would just start over with a bigger instance and so i loaded it up and ran the install command after installing unzip and this is what i get:

 

ubuntu@ip-172-26-1-197:~$ sudo apt install unzip
Reading package lists... Done
Building dependency tree       
Reading state information... Done

c2.zip                  c2_community-linux-armv5  c2_community-windows-32.exe
c2_community-darwin-64  c2_community-linux-armv6  c2_community-windows-64.exe
c2_community-linux-32   c2_community-linux-armv7  sha256sums
c2_community-linux-64   c2_community-linux-armv8


ubuntu@ip-172-26-1-197:~$ IP=$(curl -s https://checkip.amazonaws.com) && echo "Copy the be
low setup toke and browse to http://$IP:8080" && ./c2_community-linux-64 -hostname $IP -li
stenip $IP
Copy the below setup toke and browse to http://IPAddress:8080
[*] Initializing Hak5 Cloud C2
[*] Initial setup detected. Setup token: HX8V-4C62-YYNU-67E0
[!] Error starting SSH server

 

It no longer starts. Stops at Error starting ssh server. I thought maybe it was the c2 update so i coppied an old version that is running on my home server to the vps and it does the same thing. So then i thought it might just be a bad instance so i dumped it and setup another one and the same thing happened. I even tried updating ubuntu but that did not work either. Any suggestions?

Share this post


Link to post
Share on other sites

Can you please provide the error log? It will help us understand what exactly is going on.

Share this post


Link to post
Share on other sites

I did take a snapshot of the instance with the full drive so instead of continuing to try and troubleshoot why the instance is not allowing ssh to start i went a different direction. I have a test server at home so a made another instance with the snapshot and downloaded the binary and database to my server at home. I fired it up on my home server and was then able to delete the crab's loot files. I suspected i could not delete them since i maxed out the drive on the vps. But now as i am looking at the database It does not seem to have decreased in size? Maybe even got a bit bigger??? Did I miss something again.

Share this post


Link to post
Share on other sites

I moved the db back to the instance from my test server and tried starting it but it threw permission errors with every try. I finally decided to just delete the db and try running the bin again manually to start over. This also did not work in any folder and did not throw any errors. It just went back to the prompt with no cloud c2 output at all. 

To break it down, only the first install in the amazon lightsail instance worked and every other try to install again following the same steps resulted in a failure to start the ssh server. This appeared more to do with amazon lightsail than anything else so i scrapped all instances and ip's and went back to a server i own. Everything installed and ran with no effort on my server. Seems it would be a better plan anyway.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...