Gophish: GoPhish Panic on Delete Group

[glennzw]

Please scroll to the bottom as my original observation was slightly erroneous.

---

What version of Gophish are you using?: 0.9.0

Brief description of the issue:

Gophish binary crashes about 50% of the time after quickly sending a sequence of three API requests:

The crash output:

panic: runtime error: index out of range [0] with length 0

goroutine 210 [running]:
github.com/gophish/gophish/mailer.(*MailWorker).Start.func1(0xce1ce0, 0xc00002c078, 0x138f9c0, 0x0, 0x0)
        /home/user/go/src/github.com/gophish/gophish/mailer/mailer.go:84 +0xe5
created by github.com/gophish/gophish/mailer.(*MailWorker).Start
        /home/user/go/src/github.com/gophish/gophish/mailer/mailer.go:83 +0x81

The sequence of requests is below, which is an automated test. We create a group with one user, send a campaign, and then delete the group. Gophish crashes on the DELETE request.

POST /api/groups/ HTTP/1.1

{"name":"_testCampaignGroup5675","targets":[{"first_name":"Bobby","last_name":"Phisher","email":"[email protected]","position":"Space Janitor"}]}

(Response 200 OK, returning group id of '8')

POST /api/campaigns/ HTTP/1.1

{"name":"Test Campaign-5675","template":{"name":"Test Template"},"url":"https://blah.com","page":{"name":"Test Campaign"},"smtp":{"name":"Test"},"groups":[{"name":"_testCampaignGroup5675"}]}

(Response 200 OK)

DELETE /api/groups/8 HTTP/1.1

(No response as server crashes.)

The code I'm working with today was working a few months ago on (i) an older version of Gophish and (ii) sqlite rather than the above which is postgres.

When I restart Gophish, the campaign email is dispatched, but the group I tried to delete in the final request is still present. If I resend the exact same DELETE, the group is successfully deleted.

[glennzw]

To help with debugging, pasting the following into the console crashes Gophish.

Make sure to create a template, page, and smtp called "Antivirus Update".

name = "Antivirus Update"
email = "[email protected]"
listener = "http://localhost/"
rnd = Math.floor(Math.random() * (+9999 - +1000)) + +1000;
groupname = "_testCampaignGroup" + rnd
campaignname = "Test Campaign-" + rnd
group = {"name":groupname,"targets":[{"first_name":"Bobby","last_name":"Phisher","email":email,"position":"Space Janitor"}]}
console.log(group)
api.groups.post(group)
.success(function (data) {
    groupid = data.id
    campaign = {  
        "name": campaignname,
        "template":{  "name": name},
        "url":listener,
        "page":{"name":name},
        "smtp":{"name":name},
        "groups":[{"name":groupname}]
    }
    api.campaigns.post(campaign)
    .success(function (data) {
        //Delete temp group.
        api.groupId.delete(groupid)
        .success(function (msg) {
            //All good
        })
        .error(function (data) {
            console.log(data.responseJSON.message)
        })
        Swal.fire({type:"success", title:"Test campaign sent!"})
    })
    .error(function (data) {
        Swal.fire("Error: " + data.responseJSON.message)
    })


})//end success
.error(function (data) {
    Swal.fire("Error: " + data.responseJSON.message)
})

[glennzw]

Now that I think about it some more I think this is happening because we delete the group before the campaign has had time to be dispatched. The code was working before because I was using Mailhog locally. When I use a real mailserver the delay in sending is long enough to reach this crash condition.

[glennzw]

It also seems that calling api.campaignId.results(groupid) right after creating a campaign causes Gophish to panic/crash in the same way:

panic: runtime error: index out of range [0] with length 0

goroutine 96 [running]:
github.com/gophish/gophish/mailer.(*MailWorker).Start.func1(0xce1ce0, 0xc00002c078, 0x138f9c0, 0x0, 0x0)
        /home/user/go/src/github.com/gophish/gophish/mailer/mailer.go:84 +0xe5
created by github.com/gophish/gophish/mailer.(*MailWorker).Start
        /home/user/go/src/github.com/gophish/gophish/mailer/mailer.go:83 +0x81

[glennzw]

It seems my previous observations were incorrect.

I've removed the DELETE, and it still crashes, right after creating the campaign.

So two quick calls in rapid succession:

POST /api/groups/ 
POST /api/campaigns/

Both of these return 200s with good JSON data, but then the server immediately crashes with an index out of range error here:

https://github.com/gophish/gophish/blob/master/mailer/mailer.go#L84

case ms := <-mw.queue:
    go func(ctx context.Context, ms []Mail) {
        dialer, err := ms[0].GetDialer()
        if err != nil {
            errorMail(err, ms)
            return
        }

Adding some debug code ms is indeed popped as []

I've now added a 5 second delay between the group creation and campaign dispatch, and still getting a panic. I restart gophish and the campaign gets dispatched.

[glennzw]

Well I added:

if len(ms) < 1 {
    return
}

above line 84 and no crashes so far. This could be shortest amount of code for hours spent debugging in long time.

[jordan-wright]

Hey @glennzw!

Thanks for sending this over. This seems like it's a thing that shouldn't be happening so I'd like to find some time to sit down and dig into this a bit more.

It's quite possible that the fix is what you've suggested, but I'd like to make sure that it fixes the root cause.

I'll keep you updated!

[fenix820077]

hola estoy atento al desarrollo del error