0/n occurrences replaced with obfuscate meterpreter script

[t3hbb]

Think it is set up correctly - appears to run without issue - the only problem is the output indicates nothing is to be replaced.

INFO:root:Found 514 files with strings.
INFO:root:Found 36 files with suspicious API calls.
INFO:root:0/52 occurrences of WriteProcessMemory replaced.
INFO:root:0/8 occurrences of NtCreateSection replaced.
INFO:root:0/8 occurrences of NtMapViewOfSection replaced.
INFO:root:0/10 occurrences of CreateRemoteThread replaced.
INFO:root:0/4 occurrences of NtQueueApcThread replaced.
INFO:root:0/18 occurrences of ReadProcessMemory replaced.
INFO:root:0/8 occurrences of NtUnmapViewOfSection replaced.
INFO:root:0/2 occurrences of GetTempFileNameA replaced.
INFO:root:0/16 occurrences of SamEnumerateDomainsInSamServer replaced.
INFO:root:0/4 occurrences of SamRidToSid replaced.
INFO:root:0/10 occurrences of SamConnect replaced.
INFO:root:0/8 occurrences of SamLookupDomainInSamServer replaced.
INFO:root:0/12 occurrences of SamOpenDomain replaced.
INFO:root:0/6 occurrences of SamOpenUser replaced.
INFO:root:0/2 occurrences of SamOpenGroup replaced.
INFO:root:0/2 occurrences of SamOpenAlias replaced.
INFO:root:0/2 occurrences of SamGetGroupsForUser replaced.
INFO:root:0/4 occurrences of SamGetAliasMembership replaced.
INFO:root:0/2 occurrences of SamGetMembersInGroup replaced.
INFO:root:0/2 occurrences of SamGetMembersInAlias replaced.
INFO:root:0/4 occurrences of SamEnumerateUsersInDomain replaced.
INFO:root:0/2 occurrences of SamEnumerateGroupsInDomain replaced.
INFO:root:0/2 occurrences of SamEnumerateAliasesInDomain replaced.
INFO:root:0/4 occurrences of SamLookupIdsInDomain replaced.
INFO:root:0/32 occurrences of SamCloseHandle replaced.
INFO:root:0/56 occurrences of SamFreeMemory replaced.
INFO:root:0/2 occurrences of SamQueryInformationUser replaced.
INFO:root:0/4 occurrences of SamSetInformationUser replaced.
INFO:root:0/2 occurrences of SamiChangePasswordUser replaced.
INFO:root:0/4 occurrences of SamLookupNamesInDomain replaced.
INFO:root:0/8 occurrences of NtResumeProcess replaced.
INFO:root:0/4 occurrences of NtSuspendProcess replaced.

Not really sure what I can offer in the way of logs or extra error messages, or where to look for them. Or if I've just done something daft!

[t3hbb]

output_result.log

[plowsec]

Hey,

You're close I think, you just need to make sure the compiler can find the header "globals.h" (I grepped for "fatal error" in your log file)

This is an iterative process unfortunately, once you fix globals.h it's possible it will start complaining about other headers, until you have them all.

Good luck!

[t3hbb]

Thanks @plowsec - I will give that a go and see how we get on. Feel free to close this if you'd like.

Kindest regards