add exports when creating profile for windows shellcode

Added ps detection for Faronics Anti-Executable processes

client/command/c2profiles/c2profiles.go

@@ -529,11 +529,11 @@ func PrintC2Profiles(profile *clientpb.HTTPC2Config, con *console.SliverClient)
 
 	tw.AppendRow(table.Row{
 		"Paths",
-		strings.Join(paths[:], ","),
+		strings.Join(paths[:], ",")[:50] + "...",
 	})
 	tw.AppendRow(table.Row{
 		"Files",
-		strings.Join(files[:], ","),
+		strings.Join(files[:], ",")[:50] + "...",
 	})
 
 	con.Println(tw.Render())

client/command/generate/generate.go

@@ -291,6 +291,13 @@ func parseCompileFlags(cmd *cobra.Command, con *console.SliverClient) (string, *
 	sgnEnabled := false
 
 	var exports []string
+	exportsArg, _ := cmd.Flags().GetString("exports")
+	if exportsArg == "" {
+		con.PrintErrorf("Shared libraries need at least one export\n")
+		return "", nil
+	} else {
+		exports = strings.Split(exportsArg, ",")
+	}
 
 	format, _ := cmd.Flags().GetString("format")
 	runAtLoad := false
@@ -302,13 +309,6 @@ func parseCompileFlags(cmd *cobra.Command, con *console.SliverClient) (string, *
 		configFormat = clientpb.OutputFormat_SHARED_LIB
 		isSharedLib = true
 		runAtLoad, _ = cmd.Flags().GetBool("run-at-load")
-		exportsArg, _ := cmd.Flags().GetString("exports")
-		if exportsArg == "" {
-			con.PrintErrorf("Shared libraries need at least one export\n")
-			return "", nil
-		} else {
-			exports = strings.Split(exportsArg, ",")
-		}
 	case "shellcode":
 		configFormat = clientpb.OutputFormat_SHELLCODE
 		isShellcode = true

client/command/jobs/commands.go

@@ -48,7 +48,6 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 	flags.Bind("mTLS listener", false, mtlsCmd, func(f *pflag.FlagSet) {
 		f.StringP("lhost", "L", "", "interface to bind server to")
 		f.Uint32P("lport", "l", generate.DefaultMTLSLPort, "tcp listen port")
-		f.BoolP("persistent", "p", false, "make persistent across restarts")
 	})
 
 	// Wireguard
@@ -66,7 +65,6 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 		f.Uint32P("lport", "l", generate.DefaultWGLPort, "udp listen port")
 		f.Uint32P("nport", "n", generate.DefaultWGNPort, "virtual tun interface listen port")
 		f.Uint32P("key-port", "x", generate.DefaultWGKeyExPort, "virtual tun interface key exchange port")
-		f.BoolP("persistent", "p", false, "make persistent across restarts")
 	})
 
 	// DNS
@@ -85,7 +83,6 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 		f.StringP("lhost", "L", "", "interface to bind server to")
 		f.Uint32P("lport", "l", generate.DefaultDNSLPort, "udp listen port")
 		f.BoolP("disable-otp", "D", false, "disable otp authentication")
-		f.BoolP("persistent", "p", false, "make persistent across restarts")
 	})
 
 	// HTTP
@@ -106,7 +103,6 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 		f.BoolP("disable-otp", "D", false, "disable otp authentication")
 		f.StringP("long-poll-timeout", "T", "1s", "server-side long poll timeout")
 		f.StringP("long-poll-jitter", "J", "2s", "server-side long poll jitter")
-		f.BoolP("persistent", "p", false, "make persistent across restarts")
 	})
 
 	// HTTPS
@@ -132,8 +128,6 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 		f.StringP("key", "k", "", "PEM encoded private key file")
 		f.BoolP("lets-encrypt", "e", false, "attempt to provision a let's encrypt certificate")
 		f.BoolP("disable-randomized-jarm", "E", false, "disable randomized jarm fingerprints")
-
-		f.BoolP("persistent", "p", false, "make persistent across restarts")
 	})
 	flags.BindFlagCompletions(httpsCmd, func(comp *carapace.ActionMap) {
 		(*comp)["cert"] = carapace.ActionFiles().Tag("certificate file")

client/command/processes/ps.go

@@ -105,6 +105,8 @@ var knownSecurityTools = map[string][]string{
 	"cyuserservice.exe":               {console.Red, "Palo Alto Cortex"},             // Cortex XDR - user service
 	"cywscsvc.exe":                    {console.Red, "Palo Alto Cortex"},             // Cortex XDR - security center service
 	"tlaworker.exe":                   {console.Red, "Palo Alto Cortex"},             // Cortex XDR - local analysis worker
+	"AEEngine.exe":                    {console.Red, "Faronics Anti-Executable"},     // Faronics Anti-Executable - security service
+	"Antiexecutable.exe":              {console.Red, "Faronics Anti-Executable"},     // Faronics Anti-Executable - gui and tray icon
 }
 
 // PsCmd - List processes on the remote system

implant/sliver/cryptography/crypto.go

@@ -219,6 +219,23 @@ func (c *CipherContext) Decrypt(msg []byte) ([]byte, error) {
 	return plaintext, nil
 }
 
+// Decrypt - Decrypt a message without signature with the contextual key and check for replay attacks
+func (c *CipherContext) DecryptWithoutSignatureCheck(msg []byte) ([]byte, error) {
+
+	plaintext, err := Decrypt(c.Key, msg)
+	if err != nil {
+		return nil, err
+	}
+	if 0 < len(msg) {
+		digest := sha256.Sum256(msg)
+		b64Digest := base64.RawStdEncoding.EncodeToString(digest[:])
+		if _, ok := c.replay.LoadOrStore(b64Digest, true); ok {
+			return nil, ErrReplayAttack
+		}
+	}
+	return plaintext, nil
+}
+
 // Encrypt - Encrypt a message with the contextual key
 func (c *CipherContext) Encrypt(plaintext []byte) ([]byte, error) {
 	ciphertext, err := Encrypt(c.Key, plaintext)

implant/sliver/pivots/pivots.go

@@ -544,7 +544,7 @@ func (p *NetConnPivot) readEnvelope() (*pb.Envelope, error) {
 		// {{end}}
 		return nil, err
 	}
-	data, err = p.cipherCtx.Decrypt(data)
+	data, err = p.cipherCtx.DecryptWithoutSignatureCheck(data)
 	if err != nil {
 		// {{if .Config.Debug}}
 		log.Printf("[pivot] Decryption error: %s", err)

implant/sliver/transports/pivotclients/pivotclient.go

@@ -329,7 +329,7 @@ func (p *NetConnPivotClient) ReadEnvelope() (*pb.Envelope, error) {
 		// {{end}}
 		return nil, err
 	}
-	data, err = p.peerCipherCtx.Decrypt(data)
+	data, err = p.peerCipherCtx.DecryptWithoutSignatureCheck(data)
 	if err != nil {
 		// {{if .Config.Debug}}
 		log.Printf("[pivot] Peer decryption error: %s", err)

server/c2/http.go

@@ -770,7 +770,7 @@ func (s *SliverHTTPC2) stagerHandler(resp http.ResponseWriter, req *http.Request
 
 	for _, nonce := range nonces {
 		resourceID, err = db.ResourceIDByValue(nonce)
-		if err != nil {
+		if err == nil {
 			httpLog.Debug("Stager request")
 			build, _ := db.ImplantBuildByResourceID(resourceID.Value)
 			if build.Stage {

server/console/console.go

@@ -77,7 +77,6 @@ func serverOnlyCmds() (commands []*cobra.Command) {
 		f.StringP("lhost", "L", "", "interface to bind server to")
 		f.Uint16P("lport", "l", 31337, "tcp listen port")
 		f.BoolP("tailscale", "T", false, "only expose multiplayer interface over Tailscale (requires TS_AUTHKEY)")
-		f.BoolP("persistent", "p", false, "make persistent across restarts")
 	})
 
 	commands = append(commands, startMultiplayer)

server/db/models/implant.go

@@ -20,6 +20,7 @@ package models
 
 import (
 	"net/url"
+	"strings"
 	"time"
 
 	"github.com/bishopfox/sliver/protobuf/clientpb"
@@ -167,6 +168,7 @@ type ImplantConfig struct {
 	MaxConnectionErrors uint32
 	ConnectionStrategy  string
 	SGNEnabled          bool
+	Exports             string
 
 	// WireGuard
 	WGPeerTunIP       string
@@ -285,6 +287,7 @@ func (ic *ImplantConfig) ToProtobuf() *clientpb.ImplantConfig {
 		IncludeWG:       ic.IncludeWG,
 		IncludeTCP:      ic.IncludeTCP,
 		Extension:       ic.Extension,
+		Exports:         strings.Split(ic.Exports, ","),
 	}
 
 	if ic.ImplantProfileID != nil {
@@ -495,6 +498,7 @@ func ImplantConfigFromProtobuf(pbConfig *clientpb.ImplantConfig) *ImplantConfig
 	cfg.IsShellcode = pbConfig.IsShellcode
 	cfg.RunAtLoad = pbConfig.RunAtLoad
 	cfg.DebugFile = pbConfig.DebugFile
+	cfg.Exports = strings.Join(pbConfig.Exports, ",")
 
 	cfg.HttpC2ConfigName = pbConfig.HTTPC2ConfigName
 	cfg.NetGoEnabled = pbConfig.NetGoEnabled

server/rpc/rpc-generate.go

@@ -91,6 +91,10 @@ func (rpc *Server) Generate(ctx context.Context, req *clientpb.GenerateReq) (*cl
 		config.IncludeTCP = models.IsC2Enabled([]string{"tcppivot"}, config.C2)
 	}
 
+	if len(config.Exports) == 0 {
+		config.Exports = []string{"StartW"}
+	}
+
 	// generate config
 	build, err := generate.GenerateConfig(name, config)
 	if err != nil {
@@ -705,6 +709,10 @@ func (rpc *Server) GenerateStage(ctx context.Context, req *clientpb.GenerateStag
 		return nil, err
 	}
 
+	if len(profile.Config.Exports) == 0 {
+		profile.Config.Exports = []string{"StartW"}
+	}
+
 	// generate config
 	build, err := generate.GenerateConfig(name, profile.Config)
 	if err != nil {