Wininet communication problems

[Peppinell0]

Hey together,
I was trying to do a proxy authenticate via the wininet driver.
However, I ran in the following problem:

2023/06/09 10:21:20 sliver.go:126: Hello my name is INNOVATIVE_HUNGER 
2023/06/09 10:21:20 limits.go:58: Limit checks completed
2023/06/09 10:21:20 sliver.go:144: Running in session mode
2023/06/09 10:21:20 session.go:67: Starting interactive session connection loop ...
2023/06/09 10:21:20 transports.go:41: Starting c2 url generator () ...
2023/06/09 10:21:20 transports.go:95: Return generator: (chan *url.URL)(0xc000195080)
2023/06/09 10:21:20 transports.go:83: Yield c2 uri = 'https://XXXXXXXXXXXXXX/123456?driver=wininet'
2023/06/09 10:21:20 transports.go:83: Yield c2 uri = 'https://XXXXXXXXXXXXXX/123456?driver=wininet'
2023/06/09 10:21:20 session.go:84: Next CC = https://XXXXXXXXXXXXXX/123456?driver=wininet
2023/06/09 10:21:20 session.go:84: Next CC = https://XXXXXXXXXXXXXX/123456?driver=wininet
2023/06/09 10:21:20 session.go:172: Connecting -> http(s)://XXXXXXXXXXXXXX
2023/06/09 10:21:20 transports.go:83: Yield c2 uri = 'https://XXXXXXXXXXXXXX/123456?driver=wininet'
2023/06/09 10:21:20 drivers_windows.go:42: Using wininet driver
2023/06/09 10:21:20 httpclient.go:666: [http] segments = [api api api], filename = login, ext = php
2023/06/09 10:21:20 crypto.go:189: TOTP Code (2023-06-09 08:21:20.5181514 +0000 UTC): 24089617
2023/06/09 10:21:20 httpclient.go:341: [http] POST -> https://XXXXXXXXXXXXXX/123456/api/api/api/login.html?cg=2408f961h7&y=792h7937i5 (106 bytes)
2023/06/09 10:21:20 httpclient.go:390: [http] New session id: 9c8b6637f1dba5a7f9d4d8283caa65f3
2023/06/09 10:21:20 httpclient.go:666: [http] segments = [], filename = jquery, ext = js
2023/06/09 10:21:20 httpclient.go:408: [http] GET -> https://XXXXXXXXXXXXXX/123456/jquery.js?d=e79897697
2023/06/09 10:21:20 sliver.go:319: Host Uuid: 104ad24a-1982-4191-b1fd-d1ec109122d4
2023/06/09 10:21:20 tun-handlers.go:45: [tunnel] Tunnel handlers map[20:0x173e0878d00 22:0x173e0877a20 23:0x173e0877060 80:0x173e0877f40 82:0x173e0879c80]
2023/06/09 10:21:20 session.go:189: [http] send envelope ...
2023/06/09 10:21:20 httpclient.go:666: [http] segments = [oauth2 namespaces oauth api oauth2callback], filename = sign-up, ext = php
2023/06/09 10:21:20 httpclient.go:484: [http] POST -> https://XXXXXXXXXXXXXX/123456/oauth2/namespaces/oauth/api/oauth2callback/sign-up.php?q=x46839791 (381 bytes)
2023/06/09 10:21:20 httpclient.go:289: Cancelling poll context
2023/06/09 10:21:20 httpclient.go:450: [http] Unexpected status code &{404 Not Found 404 HTTP/1.1 1 1 map[] {0xc00022c780} 0 [] false false map[] 0xc0000e2600 <nil>}
2023/06/09 10:21:20 session.go:241: [http] error: &errors.errorString{s:"unexpected http response code"}
2023/06/09 10:21:20 httpclient.go:666: [http] segments = [], filename = jquery, ext = js
2023/06/09 10:21:20 httpclient.go:408: [http] GET -> https://XXXXXXXXXXXXXX/123456/jquery.js?h=39n02171c7
2023/06/09 10:21:20 httpclient.go:490: [http] POST request completed
2023/06/09 10:21:20 httpclient.go:500: [http] non-202 response (404): &{404 Not Found 404 HTTP/1.1 1 1 map[] {0xc00002d290} 0 [] false false map[] 0xc0002be400 <nil>}
2023/06/09 10:21:21 httpclient.go:289: Cancelling poll context
2023/06/09 10:21:21 httpclient.go:450: [http] Unexpected status code &{404 Not Found 404 HTTP/1.1 1 1 map[] {0xc00002d530} 0 [] false false map[] 0xc0000e2800 <nil>}

I am surprised due to the established connection and the failure afterwards.
Without a proxy and the wininet driver it works like a charm. But the proxy is maybe not the problem here, because the connection receives the c2 Server as it can be seen in the following sliver.log:

INFO[2023-06-09T11:...] [sliver/server/c2/http.go:604] Started new session with http session id: 123b3a76507a5782ad99dc873033d560 
INFO[2023-06-09T11:...] [sliver/server/c2/http.go:485] tcp(127.0.0.1:59612)->XXX.XXX.XXX.XXX - /123456/jquery.js?s=99138211 - Mozilla/5.0 (Windo[...]
INFO[2023-06-09T11:...] [sliver/server/c2/http.go:485] tcp(127.0.0.1:59626)->XXX.XXX.XXX.XXX - /123456/api/register.php?w=863k8854q5 - Mozilla/5[...]
INFO[2023-06-09T11:...] [sliver/server/c2/http.go:485] tcp(127.0.0.1:59628)->XXX.XXX.XXX.XXX - /123456/bundle/jquery.js?i=572f67821 - Mozilla/5.[...]
INFO[2023-06-09T11:...] [sliver/server/c2/http.go:485] tcp(127.0.0.1:59632)->XXX.XXX.XXX.XXX - /123456/bundle/jquery.js?b=14647516 - Mozilla/5.0[...]
INFO[2023-06-09T11:...] [sliver/server/c2/http.go:485] tcp(127.0.0.1:59644)->XXX.XXX.XXX.XXX - /123456/jquery.js?_=29g1t13314 - Mozilla/5.0 (Win[...]
INFO[2023-06-09T11:...] [sliver/server/c2/http.go:485] tcp(127.0.0.1:59648)->XXX.XXX.XXX.XXX - /123456/jquery.js?b=p56_320776 - Mozilla/5.0 (Win[...]
INFO[2023-06-09T11:...] [sliver/server/c2/http.go:485] tcp(127.0.0.1:59650)->XXX.XXX.XXX.XXX - /123456/jquery.min.js?g=38d621403 - Mozilla/5.0 ([...]
INFO[2023-06-09T11:...] [sliver/server/c2/http.go:485] tcp(127.0.0.1:59656)->XXX.XXX.XXX.XXX - /123456/bundle/jquery.js?r=95003744 - Mozilla/5.0[...]
INFO[2023-06-09T11:...] [sliver/server/c2/http.go:485] tcp(127.0.0.1:59660)->XXX.XXX.XXX.XXX - /123456/jquery.js?a=20515353 - Mozilla/5.0 (Windo[...]
INFO[2023-06-09T11:...] [sliver/server/c2/http.go:485] tcp(127.0.0.1:59664)->XXX.XXX.XXX.XXX - /123456/bundle/jquery.js?q=7c266175q4 - Mozilla/5[...]
INFO[2023-06-09T11:...] [sliver/server/c2/http.go:485] tcp(127.0.0.1:59674)->XXX.XXX.XXX.XXX - /123456/jquery.js?o=68107779 - Mozilla/5.0 (Windo[...]

I have no further idea to fix this. Does anyone ran into a similar problem or have a idea to fix it?

[Peppinell0]

Ok i fixed it. It was a problem in a redirection rule internally and had nothing to do with sliver ;-)