Expand time formats supported by chtimes

SOCKS5 Stability Improvements for HTTP/mTLS Transports

README.md

@@ -42,3 +42,4 @@ See the [wiki](https://sliver.sh/docs?name=Compile+from+Source).
 ### License - GPLv3
 
 Sliver is licensed under [GPLv3](https://www.gnu.org/licenses/gpl-3.0.en.html), some sub-components may have separate licenses. See their respective subdirectories in this project for details.
+

client/command/edit/editor.go

@@ -2,7 +2,9 @@ package edit
 
 import (
 	"fmt"
+	"strconv"
 	"strings"
+	"unicode"
 
 	"github.com/alecthomas/chroma/v2"
 	"github.com/alecthomas/chroma/v2/formatters"
@@ -37,30 +39,33 @@ type editorResult struct {
 }
 
 type editorModel struct {
-	lines           [][]rune
-	row             int
-	col             int
-	top             int
-	left            int
-	width           int
-	height          int
-	mode            editorMode
-	command         string
-	pending         rune
-	dirty           bool
-	filename        string
-	showLineNumbers bool
-	syntaxName      string
-	lexer           chroma.Lexer
-	formatter       chroma.Formatter
-	style           *chroma.Style
-	highlighted     []string
-	highlightOn     bool
-	highlightDirty  bool
-	action          exitAction
-	forceQuit       bool
-	message         string
-	clearMessage    bool
+	lines             [][]rune
+	row               int
+	col               int
+	top               int
+	left              int
+	width             int
+	height            int
+	mode              editorMode
+	command           string
+	commandPrefix     rune
+	pending           rune
+	dirty             bool
+	filename          string
+	showLineNumbers   bool
+	syntaxName        string
+	lexer             chroma.Lexer
+	formatter         chroma.Formatter
+	style             *chroma.Style
+	highlighted       []string
+	highlightOn       bool
+	highlightDirty    bool
+	lastSearch        string
+	lastSearchForward bool
+	action            exitAction
+	forceQuit         bool
+	message           string
+	clearMessage      bool
 }
 
 var (
@@ -76,6 +81,7 @@ func newEditorModel(content, filename string, lexer chroma.Lexer, syntaxName str
 		mode:            modeNormal,
 		filename:        filename,
 		showLineNumbers: showLineNumbers,
+		commandPrefix:   ':',
 	}
 	model.setSyntax(lexer, syntaxName)
 	return model
@@ -175,10 +181,16 @@ func (m *editorModel) handleCommand(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 	case tea.KeyEsc:
 		m.mode = modeNormal
 		m.command = ""
+		m.commandPrefix = ':'
 	case tea.KeyEnter:
-		m.executeCommand(strings.TrimSpace(m.command))
+		if m.commandPrefix == '/' {
+			m.executeSearch(strings.TrimSpace(m.command))
+		} else {
+			m.executeCommand(strings.TrimSpace(m.command))
+		}
 		m.command = ""
 		m.mode = modeNormal
+		m.commandPrefix = ':'
 		if m.action != actionNone {
 			return m, tea.Quit
 		}
@@ -276,6 +288,14 @@ func (m *editorModel) handleNormalRune(r rune) bool {
 		m.moveUp()
 	case 'l':
 		m.moveRight()
+	case 'w':
+		m.moveWordForward()
+	case 'b':
+		m.moveWordBackward()
+	case 'e':
+		m.moveWordEnd()
+	case '^':
+		m.moveLineFirstNonWhitespace()
 	case '0':
 		m.moveLineStart()
 	case '$':
@@ -303,15 +323,31 @@ func (m *editorModel) handleNormalRune(r rune) bool {
 		m.pending = 'g'
 	case 'G':
 		m.gotoBottom()
+	case 'n':
+		m.searchNext(true)
+	case 'N':
+		m.searchNext(false)
 	case ':':
 		m.mode = modeCommand
 		m.command = ""
+		m.commandPrefix = ':'
+	case '/':
+		m.mode = modeCommand
+		m.command = ""
+		m.commandPrefix = '/'
 	}
 
 	return false
 }
 
 func (m *editorModel) executeCommand(cmd string) {
+	if isDigits(cmd) {
+		target, err := strconv.Atoi(cmd)
+		if err == nil {
+			m.gotoLine(target)
+			return
+		}
+	}
 	switch strings.ToLower(cmd) {
 	case "":
 		return
@@ -408,15 +444,19 @@ func (m *editorModel) statusLine() string {
 
 func (m *editorModel) commandLine() string {
 	if m.mode == modeCommand {
-		return ":" + m.command
+		prefix := ":"
+		if m.commandPrefix == '/' {
+			prefix = "/"
+		}
+		return prefix + m.command
 	}
 	if m.message != "" {
 		return m.message
 	}
 	if m.mode == modeInsert {
-		return "ESC: normal  :wq save+quit  :q quit  :n line numbers"
+		return "ESC: normal  / search  :wq save+quit  :q quit  :n line numbers  :<num> goto line"
 	}
-	return "i: insert  h/j/k/l: move  :wq save+quit  :q quit  :n line numbers"
+	return "i: insert  h/j/k/l: move  / search  :wq save+quit  :q quit  :n line numbers  :<num> goto line"
 }
 
 func (m *editorModel) content() string {
@@ -551,6 +591,18 @@ func (m *editorModel) moveLineStart() {
 	m.col = 0
 }
 
+func (m *editorModel) moveLineFirstNonWhitespace() {
+	line := m.lines[m.row]
+	col := 0
+	for col < len(line) {
+		if line[col] != ' ' && line[col] != '\t' {
+			break
+		}
+		col++
+	}
+	m.col = col
+}
+
 func (m *editorModel) moveLineEnd() {
 	m.col = len(m.lines[m.row])
 }
@@ -570,6 +622,115 @@ func (m *editorModel) gotoBottom() {
 	m.clampCol()
 }
 
+func (m *editorModel) gotoLine(lineNumber int) {
+	if lineNumber < 1 {
+		lineNumber = 1
+	}
+	if len(m.lines) == 0 {
+		m.row = 0
+		m.col = 0
+		return
+	}
+	if lineNumber > len(m.lines) {
+		lineNumber = len(m.lines)
+	}
+	m.row = lineNumber - 1
+	m.clampCol()
+	m.ensureCursorVisible()
+}
+
+func (m *editorModel) moveWordForward() {
+	row := m.row
+	col := m.col
+	for {
+		if row >= len(m.lines) {
+			return
+		}
+		line := m.lines[row]
+		if col >= len(line) {
+			row++
+			col = 0
+			continue
+		}
+		if isWordChar(line[col]) {
+			for col < len(line) && isWordChar(line[col]) {
+				col++
+			}
+		}
+		for col < len(line) && !isWordChar(line[col]) {
+			col++
+		}
+		if col < len(line) {
+			m.row = row
+			m.col = col
+			return
+		}
+		row++
+		col = 0
+	}
+}
+
+func (m *editorModel) moveWordBackward() {
+	row := m.row
+	col := m.col - 1
+	for {
+		if row < 0 {
+			return
+		}
+		line := m.lines[row]
+		if col >= len(line) {
+			col = len(line) - 1
+		}
+		for col >= 0 && (col >= len(line) || !isWordChar(line[col])) {
+			col--
+		}
+		for col >= 0 && isWordChar(line[col]) {
+			col--
+		}
+		if col+1 >= 0 && col+1 < len(line) {
+			m.row = row
+			m.col = col + 1
+			return
+		}
+		row--
+		if row >= 0 {
+			col = len(m.lines[row]) - 1
+		}
+	}
+}
+
+func (m *editorModel) moveWordEnd() {
+	row := m.row
+	col := m.col
+	for {
+		if row >= len(m.lines) {
+			return
+		}
+		line := m.lines[row]
+		if col >= len(line) {
+			row++
+			col = 0
+			continue
+		}
+		if isWordChar(line[col]) {
+			for col+1 < len(line) && isWordChar(line[col+1]) {
+				col++
+			}
+			m.row = row
+			m.col = col
+			return
+		}
+		for col < len(line) && !isWordChar(line[col]) {
+			col++
+		}
+		if col < len(line) {
+			continue
+		}
+		row++
+		col = 0
+	}
+}
+
 func (m *editorModel) clampCol() {
 	lineLen := len(m.lines[m.row])
 	if m.col > lineLen {
@@ -763,6 +924,104 @@ func (m *editorModel) applyCursor(rendered, highlighted string, line []rune, sta
 	return left + cursorStyle.Render(string(line[cursor])) + right
 }
 
+func (m *editorModel) executeSearch(pattern string) {
+	if pattern == "" {
+		if m.lastSearch == "" {
+			return
+		}
+		pattern = m.lastSearch
+	}
+	m.lastSearch = pattern
+	m.lastSearchForward = true
+	if !m.searchNext(true) {
+		m.message = fmt.Sprintf("Pattern not found: %s", pattern)
+		m.clearMessage = true
+	}
+}
+
+func (m *editorModel) searchNext(forward bool) bool {
+	pattern := m.lastSearch
+	if pattern == "" {
+		m.message = "No previous search"
+		m.clearMessage = true
+		return false
+	}
+	row, col, ok := m.findMatch(pattern, forward)
+	if !ok {
+		m.message = fmt.Sprintf("Pattern not found: %s", pattern)
+		m.clearMessage = true
+		return false
+	}
+	m.row = row
+	m.col = col
+	m.lastSearchForward = forward
+	m.ensureCursorVisible()
+	return true
+}
+
+func (m *editorModel) findMatch(pattern string, forward bool) (int, int, bool) {
+	if pattern == "" {
+		return 0, 0, false
+	}
+	pat := []rune(pattern)
+	if forward {
+		return m.findForward(pat)
+	}
+	return m.findBackward(pat)
+}
+
+func (m *editorModel) findForward(pattern []rune) (int, int, bool) {
+	row := m.row
+	col := m.col + 1
+	for r := row; r < len(m.lines); r++ {
+		line := m.lines[r]
+		start := 0
+		if r == row {
+			start = col
+		}
+		if idx := indexOfRunes(line, pattern, start); idx >= 0 {
+			return r, idx, true
+		}
+	}
+	for r := 0; r <= row && r < len(m.lines); r++ {
+		line := m.lines[r]
+		end := len(line)
+		if r == row {
+			end = min(end, col)
+		}
+		if idx := indexOfRunes(line, pattern, 0); idx >= 0 && idx < end {
+			return r, idx, true
+		}
+	}
+	return 0, 0, false
+}
+
+func (m *editorModel) findBackward(pattern []rune) (int, int, bool) {
+	row := m.row
+	col := m.col - 1
+	for r := row; r >= 0; r-- {
+		line := m.lines[r]
+		end := len(line)
+		if r == row {
+			end = col + 1
+		}
+		if idx := lastIndexOfRunes(line, pattern, end); idx >= 0 {
+			return r, idx, true
+		}
+	}
+	for r := len(m.lines) - 1; r >= row && r >= 0; r-- {
+		line := m.lines[r]
+		end := len(line)
+		if r == row {
+			end = len(line)
+		}
+		if idx := lastIndexOfRunes(line, pattern, end); idx >= 0 {
+			return r, idx, true
+		}
+	}
+	return 0, 0, false
+}
+
 func splitLines(content string) [][]rune {
 	parts := strings.Split(content, "\n")
 	if len(parts) == 0 {
@@ -783,6 +1042,76 @@ func popRune(value string) string {
 	return string(runes[:len(runes)-1])
 }
 
+func isDigits(value string) bool {
+	if value == "" {
+		return false
+	}
+	for _, r := range value {
+		if r < '0' || r > '9' {
+			return false
+		}
+	}
+	return true
+}
+
+func isWordChar(r rune) bool {
+	return r == '_' || unicode.IsLetter(r) || unicode.IsDigit(r)
+}
+
+func indexOfRunes(haystack, needle []rune, start int) int {
+	if len(needle) == 0 {
+		return -1
+	}
+	if start < 0 {
+		start = 0
+	}
+	if start >= len(haystack) {
+		return -1
+	}
+	for i := start; i+len(needle) <= len(haystack); i++ {
+		match := true
+		for j := range needle {
+			if haystack[i+j] != needle[j] {
+				match = false
+				break
+			}
+		}
+		if match {
+			return i
+		}
+	}
+	return -1
+}
+
+func lastIndexOfRunes(haystack, needle []rune, end int) int {
+	if len(needle) == 0 {
+		return -1
+	}
+	if end > len(haystack) {
+		end = len(haystack)
+	}
+	for i := end - len(needle); i >= 0; i-- {
+		match := true
+		for j := range needle {
+			if haystack[i+j] != needle[j] {
+				match = false
+				break
+			}
+		}
+		if match {
+			return i
+		}
+	}
+	return -1
+}
+
+func min(a, b int) int {
+	if a < b {
+		return a
+	}
+	return b
+}
+
 func baseName(path string) string {
 	if path == "" {
 		return ""

client/command/filesystem/chtimes.go

@@ -19,6 +19,8 @@ package filesystem
 
 import (
 	"context"
+	"fmt"
+	"strconv"
 	"time"
 
 	"github.com/bishopfox/sliver/client/console"
@@ -28,14 +30,77 @@ import (
 	"google.golang.org/protobuf/proto"
 )
 
+const chtimesDefaultLayout = "2006-01-02 15:04:05"
+
+type chtimesTimeFormat struct {
+	name  string
+	parse func(string) (int64, error)
+}
+
+func chtimesParseUnixSeconds(value string) (int64, error) {
+	parsed, err := strconv.ParseInt(value, 10, 64)
+	if err != nil {
+		return 0, err
+	}
+	return parsed, nil
+}
+
+func chtimesParseUnixMillis(value string) (int64, error) {
+	parsed, err := strconv.ParseInt(value, 10, 64)
+	if err != nil {
+		return 0, err
+	}
+	return time.UnixMilli(parsed).Unix(), nil
+}
+
+func chtimesParseLayout(layout string) func(string) (int64, error) {
+	return func(value string) (int64, error) {
+		parsed, err := time.Parse(layout, value)
+		if err != nil {
+			return 0, err
+		}
+		return parsed.Unix(), nil
+	}
+}
+
+func chtimesFormatFromFlags(cmd *cobra.Command) (chtimesTimeFormat, error) {
+	formatFlags := []struct {
+		flag   string
+		format chtimesTimeFormat
+	}{
+		{flag: "unix", format: chtimesTimeFormat{name: "unix", parse: chtimesParseUnixSeconds}},
+		{flag: "unix-ms", format: chtimesTimeFormat{name: "unix-ms", parse: chtimesParseUnixMillis}},
+		{flag: "rfc3339", format: chtimesTimeFormat{name: "rfc3339", parse: chtimesParseLayout(time.RFC3339)}},
+		{flag: "rfc1123", format: chtimesTimeFormat{name: "rfc1123", parse: chtimesParseLayout(time.RFC1123)}},
+	}
+
+	var selected *chtimesTimeFormat
+	selectedFlag := ""
+	for _, candidate := range formatFlags {
+		enabled, _ := cmd.Flags().GetBool(candidate.flag)
+		if !enabled {
+			continue
+		}
+		if selected != nil {
+			return chtimesTimeFormat{}, fmt.Errorf("only one time format flag can be used (--%s and --%s are both set)", selectedFlag, candidate.flag)
+		}
+		selected = &candidate.format
+		selectedFlag = candidate.flag
+	}
+
+	if selected == nil {
+		return chtimesTimeFormat{name: "datetime", parse: chtimesParseLayout(chtimesDefaultLayout)}, nil
+	}
+
+	return *selected, nil
+}
+
 // ChtimesCmd - Change the access and modified time of a file on the remote file system.
 func ChtimesCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
 	session, beacon := con.ActiveTarget.GetInteractive()
 	if session == nil && beacon == nil {
 		return
 	}
-	// DateTime layout (https://pkg.go.dev/time)
-	layout := "2006-01-02 15:04:05"
 	filePath := args[0]
 
 	if filePath == "" {
@@ -43,33 +108,35 @@ func ChtimesCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
 		return
 	}
 
-	atime := args[1]
+	format, err := chtimesFormatFromFlags(cmd)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
 
+	atime := args[1]
 	if atime == "" {
 		con.PrintErrorf("Missing parameter: Last accessed time id\n")
 		return
 	}
 
-	t_a, err := time.Parse(layout, atime)
+	unixAtime, err := format.parse(atime)
 	if err != nil {
-		con.PrintErrorf("%s\n", err)
+		con.PrintErrorf("Invalid access time (%s): %s\n", format.name, err)
 		return
 	}
-	unixAtime := t_a.Unix()
 
 	mtime := args[2]
-
 	if mtime == "" {
 		con.PrintErrorf("Missing parameter: Last modified time id\n")
 		return
 	}
 
-	t_b, err := time.Parse(layout, mtime)
+	unixMtime, err := format.parse(mtime)
 	if err != nil {
-		con.PrintErrorf("%s\n", err)
+		con.PrintErrorf("Invalid modified time (%s): %s\n", format.name, err)
 		return
 	}
-	unixMtime := t_b.Unix()
 
 	chtimes, err := con.Rpc.Chtimes(context.Background(), &sliverpb.ChtimesReq{
 		Request: con.ActiveTarget.Request(cmd),

client/command/help/long-help.go

@@ -64,6 +64,7 @@ var (
 		consts.UploadStr:           uploadHelp,
 		consts.MkdirStr:            mkdirHelp,
 		consts.RmStr:               rmHelp,
+		consts.ChtimesStr:          chtimesHelp,
 		consts.ProcdumpStr:         procdumpHelp,
 		consts.ElevateStr:          elevateHelp,
 		consts.RunAsStr:            runAsHelp,
@@ -299,6 +300,24 @@ On Windows, escaping is disabled. Instead, '\\' is treated as path separator.
 	rmHelp = `[[.Bold]]Command:[[.Normal]] rm [remote path]
 [[.Bold]]About:[[.Normal]] Delete a remote file or directory.`
 
+	chtimesHelp = `[[.Bold]]Command:[[.Normal]] chtimes [--unix | --unix-ms | --rfc3339 | --rfc1123] <path> <atime> <mtime>
+[[.Bold]]About:[[.Normal]] Change access and modification times on a file (timestomp).
+
+[[.Bold]][[.Underline]]Time Formats[[.Normal]]
+Default (datetime): "2006-01-02 15:04:05"
+--unix: 1704067200
+--unix-ms: 1704067200000
+--rfc3339: 2024-01-01T00:00:00Z
+--rfc1123: Mon, 02 Jan 2006 15:04:05 MST
+
+[[.Bold]][[.Underline]]Examples[[.Normal]]
+chtimes /tmp/file "2024-01-01 12:34:56" "2024-01-01 12:35:56"
+chtimes --unix /tmp/file 1704112496 1704112556
+chtimes --unix-ms /tmp/file 1704112496000 1704112556000
+chtimes --rfc3339 /tmp/file 2024-01-01T12:34:56Z 2024-01-01T12:35:56Z
+chtimes --rfc1123 /tmp/file "Mon, 02 Jan 2006 15:04:05 MST" "Mon, 02 Jan 2006 16:04:05 MST"
+`
+
 	catHelp = `[[.Bold]]Command:[[.Normal]] cat <remote path> 
 [[.Bold]]About:[[.Normal]] Cat a remote file to stdout.`
 

client/command/privilege/commands.go

@@ -150,11 +150,15 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 	}
 	flags.Bind("", false, chtimesCmd, func(f *pflag.FlagSet) {
 		f.Int64P("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
+		f.Bool("unix", false, "interpret timestamps as Unix seconds")
+		f.Bool("unix-ms", false, "interpret timestamps as Unix milliseconds")
+		f.Bool("rfc3339", false, "interpret timestamps as RFC3339")
+		f.Bool("rfc1123", false, "interpret timestamps as RFC1123")
 	})
 	carapace.Gen(chtimesCmd).PositionalCompletion(
 		carapace.ActionValues().Usage("path to file to change access timestamps"),
-		carapace.ActionValues().Usage("last accessed time in DateTime format, i.e. 2006-01-02 15:04:05"),
-		carapace.ActionValues().Usage("last modified time in DateTime format, i.e. 2006-01-02 15:04:05"),
+		carapace.ActionValues().Usage("last accessed time (default: 2006-01-02 15:04:05; see --help for format flags)"),
+		carapace.ActionValues().Usage("last modified time (default: 2006-01-02 15:04:05; see --help for format flags)"),
 	)
 
 	getprivsCmd := &cobra.Command{

client/core/socks.go

@@ -31,6 +31,7 @@ import (
 	"github.com/bishopfox/sliver/protobuf/rpcpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/bishopfox/sliver/util/leaky"
+	"golang.org/x/time/rate"
 )
 
 var (
@@ -210,6 +211,8 @@ const leakyBufSize = 4108 // data.len(2) + hmacsha1(10) + data(4096)
 var leakyBuf = leaky.NewLeakyBuf(2048, leakyBufSize)
 
 func connect(conn net.Conn, stream rpcpb.SliverRPC_SocksProxyClient, frame *sliverpb.SocksData) {
+	// Client Rate Limiter: 10 operations per second, burst of 1
+	limiter := rate.NewLimiter(rate.Limit(10), 1)
 
 	SocksConnPool.Store(frame.TunnelID, conn)
 
@@ -241,6 +244,11 @@ func connect(conn net.Conn, stream rpcpb.SliverRPC_SocksProxyClient, frame *sliv
 			return
 		}
 		if n > 0 {
+			if err := limiter.Wait(context.Background()); err != nil {
+				log.Printf("[socks] rate limiter error: %s", err)
+				return
+			}
+
 			frame.Data = buff[:n]
 			frame.Sequence = ToImplantSequence
 			log.Printf("[socks] (User to Client) to Server to agent  Data Sequence %d , Data Size %d \n", ToImplantSequence, len(frame.Data))

implant/sliver/handlers/handlers_darwin.go

@@ -25,6 +25,7 @@ import (
 	"syscall"
 
 	"github.com/bishopfox/sliver/implant/sliver/extension"
+	"github.com/bishopfox/sliver/implant/sliver/mount"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	pb "github.com/bishopfox/sliver/protobuf/sliverpb"
 	"google.golang.org/protobuf/proto"
@@ -56,6 +57,7 @@ var (
 		pb.MsgNetstatReq:    netstatHandler,
 
 		pb.MsgSideloadReq: sideloadHandler,
+		pb.MsgMountReq:    mountHandler,
 
 		pb.MsgReconfigureReq: reconfigureHandler,
 		pb.MsgSSHCommandReq:  runSSHCommandHandler,
@@ -154,6 +156,27 @@ func listExtensionsHandler(data []byte, resp RPCResponse) {
 	resp(data, err)
 }
 
+func mountHandler(data []byte, resp RPCResponse) {
+	mountReq := &pb.MountReq{}
+	err := proto.Unmarshal(data, mountReq)
+	if err != nil {
+		return
+	}
+
+	mountData, err := mount.GetMountInformation()
+	mountResp := &pb.Mount{
+		Info:     mountData,
+		Response: &commonpb.Response{},
+	}
+
+	if err != nil {
+		mountResp.Response.Err = err.Error()
+	}
+
+	data, err = proto.Marshal(mountResp)
+	resp(data, err)
+}
+
 func getUid(fileInfo os.FileInfo) string {
 	uid := int32(fileInfo.Sys().(*syscall.Stat_t).Uid)
 	uid_str := strconv.FormatUint(uint64(uid), 10)

implant/sliver/handlers/tunnel_handlers/socks_handler.go

@@ -36,16 +36,29 @@ import (
 	"google.golang.org/protobuf/proto"
 )
 
+const (
+	inactivityCheckInterval = 4 * time.Second
+	inactivityTimeout       = 15 * time.Second
+)
+
 type socksTunnelPool struct {
-	tunnels *sync.Map // map[uint64]chan []byte
+	tunnels      *sync.Map // map[uint64]chan []byte
+	lastActivity *sync.Map // map[uint64]time.Time
 }
 
 var socksTunnels = socksTunnelPool{
-	tunnels: &sync.Map{},
+	tunnels:      &sync.Map{},
+	lastActivity: &sync.Map{},
 }
 
 var socksServer *socks5.Server
 
+// Initialize socks server
+func init() {
+	socksServer = socks5.NewServer()
+	socksTunnels.startCleanupMonitor()
+}
+
 func SocksReqHandler(envelope *sliverpb.Envelope, connection *transports.Connection) {
 	socksData := &sliverpb.SocksData{}
 	err := proto.Unmarshal(envelope.Data, socksData)
@@ -55,9 +68,26 @@ func SocksReqHandler(envelope *sliverpb.Envelope, connection *transports.Connect
 		// {{end}}
 		return
 	}
+	time.Sleep(10 * time.Millisecond) // Necessary delay
+
+	// Check early to see if this is a close request from server
+	if socksData.CloseConn {
+		if tunnel, ok := socksTunnels.tunnels.LoadAndDelete(socksData.TunnelID); ok {
+			if ch, ok := tunnel.(chan []byte); ok {
+				close(ch)
+			}
+		}
+		socksTunnels.lastActivity.Delete(socksData.TunnelID)
+		return
+	}
+
 	if socksData.Data == nil {
 		return
 	}
+
+	// Record activity as soon as we get data for this tunnel
+	socksTunnels.recordActivity(socksData.TunnelID)
+
 	// {{if .Config.Debug}}
 	log.Printf("[socks] User to Client to (server to implant) Data Sequence %d, Data Size %d\n", socksData.Sequence, len(socksData.Data))
 	// {{end}}
@@ -70,8 +100,6 @@ func SocksReqHandler(envelope *sliverpb.Envelope, connection *transports.Connect
 		socksServer = socks5.NewServer(
 			socks5.WithAuthMethods([]socks5.Authenticator{auth}),
 		)
-	} else {
-		socksServer = socks5.NewServer()
 	}
 
 	// {{if .Config.Debug}}
@@ -80,7 +108,7 @@ func SocksReqHandler(envelope *sliverpb.Envelope, connection *transports.Connect
 
 	// init tunnel
 	if tunnel, ok := socksTunnels.tunnels.Load(socksData.TunnelID); !ok {
-		tunnelChan := make(chan []byte, 10)
+		tunnelChan := make(chan []byte, 100) // Buffered channel for 100 messages
 		socksTunnels.tunnels.Store(socksData.TunnelID, tunnelChan)
 		tunnelChan <- socksData.Data
 		err := socksServer.ServeConn(&socks{stream: socksData, conn: connection})
@@ -88,9 +116,12 @@ func SocksReqHandler(envelope *sliverpb.Envelope, connection *transports.Connect
 			// {{if .Config.Debug}}
 			log.Printf("[socks] Failed to serve connection: %v", err)
 			// {{end}}
+			// Cleanup on serve failure
+			socksTunnels.tunnels.Delete(socksData.TunnelID)
 			return
 		}
 	} else {
+		// Will block when channel is full
 		tunnel.(chan []byte) <- socksData.Data
 	}
 }
@@ -105,16 +136,22 @@ type socks struct {
 }
 
 func (s *socks) Read(b []byte) (n int, err error) {
+	time.Sleep(10 * time.Millisecond) // Necessary delay
+
 	channel, ok := socksTunnels.tunnels.Load(s.stream.TunnelID)
 	if !ok {
 		return 0, errors.New("[socks] invalid tunnel id")
 	}
 
+	socksTunnels.recordActivity(s.stream.TunnelID)
 	data := <-channel.(chan []byte)
 	return copy(b, data), nil
 }
 
 func (s *socks) Write(b []byte) (n int, err error) {
+	time.Sleep(10 * time.Millisecond) // Necessary delay
+
+	socksTunnels.recordActivity(s.stream.TunnelID)
 	data, err := proto.Marshal(&sliverpb.SocksData{
 		TunnelID: s.stream.TunnelID,
 		Data:     b,
@@ -136,12 +173,15 @@ func (s *socks) Write(b []byte) (n int, err error) {
 }
 
 func (s *socks) Close() error {
+	time.Sleep(10 * time.Millisecond) // Necessary delay
+
 	channel, ok := socksTunnels.tunnels.LoadAndDelete(s.stream.TunnelID)
 	if !ok {
 		return errors.New("[socks] can't close unknown channel")
 	}
 	close(channel.(chan []byte))
 
+	// Signal to server that we need to close this tunnel
 	data, err := proto.Marshal(&sliverpb.SocksData{
 		TunnelID:  s.stream.TunnelID,
 		CloseConn: true,
@@ -181,3 +221,38 @@ func (c *socks) SetReadDeadline(t time.Time) error {
 func (c *socks) SetWriteDeadline(t time.Time) error {
 	return nil
 }
+
+func (s *socksTunnelPool) recordActivity(tunnelID uint64) {
+	s.lastActivity.Store(tunnelID, time.Now())
+}
+
+// Periodically check for inactive tunnels and clean up
+func (s *socksTunnelPool) startCleanupMonitor() {
+	go func() {
+		ticker := time.NewTicker(inactivityCheckInterval)
+		defer ticker.Stop()
+
+		for range ticker.C {
+			s.tunnels.Range(func(key, value interface{}) bool {
+				tunnelID := key.(uint64)
+				lastActivityI, exists := s.lastActivity.Load(tunnelID)
+				if !exists {
+					// If no activity record exists, create one
+					s.recordActivity(tunnelID)
+					return true
+				}
+
+				lastActivity := lastActivityI.(time.Time)
+				if time.Since(lastActivity) > inactivityTimeout {
+					// Clean up the inactive tunnel
+					if ch, ok := value.(chan []byte); ok {
+						close(ch)
+					}
+					s.tunnels.Delete(tunnelID)
+					s.lastActivity.Delete(tunnelID)
+				}
+				return true
+			})
+		}
+	}()
+}

implant/sliver/mount/mount_darwin.go

@@ -0,0 +1,166 @@
+//go:build darwin
+
+package mount
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2023  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"strings"
+
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"golang.org/x/sys/unix"
+)
+
+func getString(input []byte) string {
+	ver := string(input)
+	if i := strings.Index(ver, "\x00"); i != -1 {
+		ver = ver[:i]
+	}
+	return ver
+}
+
+func formatMountFlags(flags uint32) string {
+	opts := make([]string, 0, 12)
+
+	if flags&unix.MNT_RDONLY != 0 {
+		opts = append(opts, "ro")
+	} else {
+		opts = append(opts, "rw")
+	}
+	if flags&unix.MNT_NOSUID != 0 {
+		opts = append(opts, "nosuid")
+	}
+	if flags&unix.MNT_NODEV != 0 {
+		opts = append(opts, "nodev")
+	}
+	if flags&unix.MNT_NOEXEC != 0 {
+		opts = append(opts, "noexec")
+	}
+	if flags&unix.MNT_SYNCHRONOUS != 0 {
+		opts = append(opts, "sync")
+	}
+	if flags&unix.MNT_ASYNC != 0 {
+		opts = append(opts, "async")
+	}
+	if flags&unix.MNT_NOATIME != 0 {
+		opts = append(opts, "noatime")
+	}
+	if flags&unix.MNT_JOURNALED != 0 {
+		opts = append(opts, "journaled")
+	}
+	if flags&unix.MNT_QUOTA != 0 {
+		opts = append(opts, "quota")
+	}
+	if flags&unix.MNT_UNION != 0 {
+		opts = append(opts, "union")
+	}
+	if flags&unix.MNT_AUTOMOUNTED != 0 {
+		opts = append(opts, "automounted")
+	}
+	if flags&unix.MNT_REMOVABLE != 0 {
+		opts = append(opts, "removable")
+	}
+	if flags&unix.MNT_DONTBROWSE != 0 {
+		opts = append(opts, "nobrowse")
+	}
+	if flags&unix.MNT_IGNORE_OWNERSHIP != 0 {
+		opts = append(opts, "ignore-ownership")
+	}
+	if flags&unix.MNT_LOCAL != 0 {
+		opts = append(opts, "local")
+	}
+	if flags&unix.MNT_ROOTFS != 0 {
+		opts = append(opts, "rootfs")
+	}
+	if flags&unix.MNT_SNAPSHOT != 0 {
+		opts = append(opts, "snapshot")
+	}
+	if flags&unix.MNT_CPROTECT != 0 {
+		opts = append(opts, "cprotect")
+	}
+	if flags&unix.MNT_NOUSERXATTR != 0 {
+		opts = append(opts, "nouserxattr")
+	}
+	if flags&unix.MNT_QUARANTINE != 0 {
+		opts = append(opts, "quarantine")
+	}
+	if flags&unix.MNT_UNKNOWNPERMISSIONS != 0 {
+		opts = append(opts, "unknown-permissions")
+	}
+	if flags&unix.MNT_DEFWRITE != 0 {
+		opts = append(opts, "defwrite")
+	}
+	if flags&unix.MNT_DOVOLFS != 0 {
+		opts = append(opts, "volfs")
+	}
+	if flags&unix.MNT_NOBLOCK != 0 {
+		opts = append(opts, "noblock")
+	}
+	if flags&unix.MNT_RELOAD != 0 {
+		opts = append(opts, "reload")
+	}
+	if flags&unix.MNT_UPDATE != 0 {
+		opts = append(opts, "update")
+	}
+	if flags&unix.MNT_EXPORTED != 0 {
+		opts = append(opts, "exported")
+	}
+	if flags&unix.MNT_MULTILABEL != 0 {
+		opts = append(opts, "multilabel")
+	}
+	if flags&unix.MNT_STRICTATIME != 0 {
+		opts = append(opts, "strictatime")
+	}
+	if flags&unix.MNT_FORCE != 0 {
+		opts = append(opts, "force")
+	}
+
+	return strings.Join(opts, ",")
+}
+
+func GetMountInformation() ([]*sliverpb.MountInfo, error) {
+	mountInfo := make([]*sliverpb.MountInfo, 0)
+
+	count, err := unix.Getfsstat(nil, unix.MNT_NOWAIT)
+	if err != nil || count == 0 {
+		return mountInfo, err
+	}
+
+	stats := make([]unix.Statfs_t, count)
+	count, err = unix.Getfsstat(stats, unix.MNT_NOWAIT)
+	if err != nil {
+		return mountInfo, err
+	}
+
+	stats = stats[:count]
+	for _, stat := range stats {
+		var mountData sliverpb.MountInfo
+		mountData.VolumeName = getString(stat.Mntfromname[:])
+		mountData.MountPoint = getString(stat.Mntonname[:])
+		mountData.Label = "/"
+		mountData.VolumeType = getString(stat.Fstypename[:])
+		mountData.MountOptions = formatMountFlags(stat.Flags)
+		mountData.TotalSpace = stat.Blocks * uint64(stat.Bsize)
+		mountData.FreeSpace = stat.Bavail * uint64(stat.Bsize)
+		mountData.UsedSpace = (stat.Blocks - stat.Bfree) * uint64(stat.Bsize)
+		mountInfo = append(mountInfo, &mountData)
+	}
+
+	return mountInfo, nil
+}

implant/sliver/mount/mount_linux.go

@@ -1,7 +1,25 @@
-// +linux
+//go:build linux
 
 package mount
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2023  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 	"bufio"
 	"os"

implant/sliver/mount/mount_windows.go

@@ -1,5 +1,6 @@
 //go:build windows
-// +build windows
+
+package mount
 
 /*
 	Sliver Implant Framework
@@ -19,8 +20,6 @@
 	along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 
-package mount
-
 import (
 	"errors"
 	"fmt"

implant/sliver/procdump/dump_darwin.go

@@ -1,4 +1,4 @@
-// +darwin
+//go:build darwin
 
 package procdump
 

implant/sliver/version/version_darwin.go

@@ -18,6 +18,129 @@ package version
 	along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 
-func GetVersion() string {
+import (
+	"encoding/xml"
+	"errors"
+	"fmt"
+	//{{if .Config.Debug}}
+	"log"
+	//{{end}}
+	"os"
+	"strings"
+
+	"golang.org/x/sys/unix"
+)
+
+type plist struct {
+	XMLName xml.Name `xml:"plist"`
+	Dict    dict     `xml:"dict"`
+}
+
+type dict struct {
+	Key    []string `xml:"key"`
+	String []string `xml:"string"`
+}
+
+func getString(input []byte) string {
+	ver := string(input)
+	if i := strings.Index(ver, "\x00"); i != -1 {
+		ver = ver[:i]
+	}
+	return ver
+}
+
+func readOSRelease() string {
+	paths := []string{
+		"/System/Library/CoreServices/SystemVersion.plist",
+		"/System/Library/CoreServices/ServerVersion.plist",
+	}
+	for _, path := range paths {
+		file, err := os.Open(path)
+		if err != nil {
+			continue
+		}
+		properties, err := parsePlistFile(file)
+		_ = file.Close()
+		if err != nil {
+			//{{if .Config.Debug}}
+			log.Printf("error parsing %s: %v", path, err)
+			//{{end}}
+			continue
+		}
+		if osRelease := buildOSRelease(properties); osRelease != "" {
+			return osRelease
+		}
+	}
 	return ""
 }
+
+func parsePlistFile(file *os.File) (map[string]string, error) {
+	var v plist
+	if err := xml.NewDecoder(file).Decode(&v); err != nil {
+		return nil, err
+	}
+	if len(v.Dict.Key) != len(v.Dict.String) {
+		return nil, errors.New("invalid plist content")
+	}
+	properties := make(map[string]string, len(v.Dict.Key))
+	for i, key := range v.Dict.Key {
+		properties[key] = v.Dict.String[i]
+	}
+	return properties, nil
+}
+
+func buildOSRelease(properties map[string]string) string {
+	productName := properties["ProductName"]
+	productVersion := properties["ProductVersion"]
+	productBuildVersion := properties["ProductBuildVersion"]
+	if productName == "" || productVersion == "" || productBuildVersion == "" {
+		return ""
+	}
+	return fmt.Sprintf("%s %s (%s)", productName, productVersion, productBuildVersion)
+}
+
+func normalizeArch(arch string) string {
+	arch = strings.TrimSpace(arch)
+	if arch == "" {
+		return ""
+	}
+	switch strings.ToLower(arch) {
+	case "amd64":
+		return "x86_64"
+	case "i386", "i486", "i586", "i686", "x86":
+		return "x86"
+	default:
+		return arch
+	}
+}
+
+func formatDetailedVersion(osRelease, kernel, arch string) string {
+	parts := make([]string, 0, 3)
+	if osRelease != "" {
+		parts = append(parts, osRelease)
+	}
+	if kernel != "" {
+		parts = append(parts, fmt.Sprintf("kernel %s", kernel))
+	}
+	if arch != "" {
+		parts = append(parts, arch)
+	}
+	return strings.Join(parts, " ")
+}
+
+func GetVersion() string {
+	osRelease := readOSRelease()
+	var uname unix.Utsname
+	if err := unix.Uname(&uname); err != nil {
+		//{{if .Config.Debug}}
+		log.Printf("error getting OS version: %v", err)
+		//{{end}}
+		return osRelease
+	}
+	if osRelease == "" {
+		osRelease = getString(uname.Sysname[:])
+	}
+	kernel := getString(uname.Release[:])
+	arch := normalizeArch(getString(uname.Machine[:]))
+	return formatDetailedVersion(osRelease, kernel, arch)
+}

implant/sliver/version/version_linux.go

@@ -22,7 +22,10 @@ package version
 
 import (
 	"fmt"
+	//{{if .Config.Debug}}
 	"log"
+	//{{end}}
+	"os"
 	"strings"
 	"syscall"
 )
@@ -39,11 +42,111 @@ func getString(input [65]int8) string {
 	return ver
 }
 
+func readOSRelease() string {
+	paths := []string{"/etc/os-release", "/usr/lib/os-release"}
+	for _, path := range paths {
+		data, err := os.ReadFile(path)
+		if err != nil {
+			continue
+		}
+		return buildOSRelease(parseOSRelease(string(data)))
+	}
+	return ""
+}
+
+func parseOSRelease(content string) map[string]string {
+	values := make(map[string]string)
+	for _, line := range strings.Split(content, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		key, value, ok := strings.Cut(line, "=")
+		if !ok || key == "" {
+			continue
+		}
+		key = strings.TrimSpace(key)
+		value = unescape(unquote(strings.TrimSpace(value)))
+		values[key] = value
+	}
+	return values
+}
+
+func unquote(s string) string {
+	if len(s) < 2 {
+		return s
+	}
+	if (s[0] == '"' || s[0] == '\'') && s[0] == s[len(s)-1] {
+		return s[1 : len(s)-1]
+	}
+	return s
+}
+
+func unescape(s string) string {
+	return strings.NewReplacer(
+		`\$`, `$`,
+		`\"`, `"`,
+		`\'`, `'`,
+		`\\`, `\`,
+		"\\`", "`",
+	).Replace(s)
+}
+
+func buildOSRelease(values map[string]string) string {
+	name := values["NAME"]
+	version := values["VERSION"]
+	if version == "" {
+		version = values["VERSION_ID"]
+	}
+	if name != "" && version != "" {
+		return fmt.Sprintf("%s %s", name, version)
+	}
+	return values["PRETTY_NAME"]
+}
+
+func normalizeArch(arch string) string {
+	arch = strings.TrimSpace(arch)
+	if arch == "" {
+		return ""
+	}
+	switch strings.ToLower(arch) {
+	case "amd64":
+		return "x86_64"
+	case "i386", "i486", "i586", "i686", "x86":
+		return "x86"
+	default:
+		return arch
+	}
+}
+
+func formatDetailedVersion(osRelease, kernel, arch string) string {
+	parts := make([]string, 0, 3)
+	if osRelease != "" {
+		parts = append(parts, osRelease)
+	}
+	if kernel != "" {
+		parts = append(parts, fmt.Sprintf("kernel %s", kernel))
+	}
+	if arch != "" {
+		parts = append(parts, arch)
+	}
+	return strings.Join(parts, " ")
+}
+
 // GetVersion returns the os version information
 func GetVersion() string {
+	osRelease := readOSRelease()
 	var uname syscall.Utsname
 	if err := syscall.Uname(&uname); err != nil {
-		log.Fatal(err)
+		//{{if .Config.Debug}}
+		log.Printf("error getting OS version: %v", err)
+		//{{end}}
+		return osRelease
 	}
-	return fmt.Sprintf("%s %s %s", getString(uname.Sysname), getString(uname.Nodename), getString(uname.Release))
+	if osRelease == "" {
+		osRelease = getString(uname.Sysname)
+	}
+	kernel := getString(uname.Release)
+	arch := normalizeArch(getString(uname.Machine))
+	return formatDetailedVersion(osRelease, kernel, arch)
 }

server/rpc/rpc-socks.go

@@ -20,8 +20,11 @@ package rpc
 
 import (
 	"context"
+	"fmt"
 	"io"
 	"sync"
+	"sync/atomic"
+	"time"
 
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/rpcpb"
@@ -32,15 +35,16 @@ import (
 
 var (
 	// SessionID->Tunnels[TunnelID]->Tunnel->Cache map[uint64]*sliverpb.SocksData{}
-	toImplantCacheSocks = socksDataCache{mutex: &sync.RWMutex{}, cache: map[uint64]map[uint64]*sliverpb.SocksData{}}
+	toImplantCacheSocks = socksDataCache{mutex: &sync.RWMutex{}, cache: map[uint64]map[uint64]*sliverpb.SocksData{}, lastActivity: map[uint64]time.Time{}}
 
 	// SessionID->Tunnels[TunnelID]->Tunnel->Cache
-	fromImplantCacheSocks = socksDataCache{mutex: &sync.RWMutex{}, cache: map[uint64]map[uint64]*sliverpb.SocksData{}}
+	fromImplantCacheSocks = socksDataCache{mutex: &sync.RWMutex{}, cache: map[uint64]map[uint64]*sliverpb.SocksData{}, lastActivity: map[uint64]time.Time{}}
 )
 
 type socksDataCache struct {
-	mutex *sync.RWMutex
-	cache map[uint64]map[uint64]*sliverpb.SocksData
+	mutex        *sync.RWMutex
+	cache        map[uint64]map[uint64]*sliverpb.SocksData
+	lastActivity map[uint64]time.Time
 }
 
 func (c *socksDataCache) Add(tunnelID uint64, sequence uint64, tunnelData *sliverpb.SocksData) {
@@ -72,6 +76,7 @@ func (c *socksDataCache) DeleteTun(tunnelID uint64) {
 	defer c.mutex.Unlock()
 
 	delete(c.cache, tunnelID)
+	delete(c.lastActivity, tunnelID)
 }
 
 func (c *socksDataCache) DeleteSeq(tunnelID uint64, sequence uint64) {
@@ -85,69 +90,299 @@ func (c *socksDataCache) DeleteSeq(tunnelID uint64, sequence uint64) {
 	delete(c.cache[tunnelID], sequence)
 }
 
+func (c *socksDataCache) recordActivity(tunnelID uint64) {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+	c.lastActivity[tunnelID] = time.Now()
+}
+
 // Socks - Open an in-band port forward
+
+const (
+	writeTimeout            = 5 * time.Second
+	batchSize               = 100 // Maximum number of sequences to batch
+	inactivityCheckInterval = 4 * time.Second
+	inactivityTimeout       = 15 * time.Second
+	ToImplantTickerInterval = 10 * time.Millisecond // data going towards implant is usually smaller request data
+	ToClientTickerInterval  = 5 * time.Millisecond  // data coming back from implant is usually larger response data
+)
+
 func (s *Server) SocksProxy(stream rpcpb.SliverRPC_SocksProxyServer) error {
+	errChan := make(chan error, 2)
+	defer close(errChan)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	connDone := make(chan struct{})
+	defer close(connDone)
+
+	// Track all goroutines spawned for this session
+	var wg sync.WaitGroup
+	defer wg.Wait()
+
+	// Track all tunnels created for this session
+	activeTunnels := make(map[uint64]bool)
+	var tunnelMutex sync.Mutex
+
+	// Cleanup all tunnels on SocksProxy closure
+	defer func() {
+		tunnelMutex.Lock()
+		for tunnelID := range activeTunnels {
+			if tunnel := core.SocksTunnels.Get(tunnelID); tunnel != nil {
+				rpcLog.Infof("Cleaning up tunnel %d on proxy closure", tunnelID)
+				close(tunnel.FromImplant)
+				tunnel.Client = nil
+				s.CloseSocks(context.Background(), &sliverpb.Socks{TunnelID: tunnelID})
+			}
+		}
+		tunnelMutex.Unlock()
+	}()
+
 	for {
+		select {
+		case err := <-errChan:
+			rpcLog.Errorf("SocksProxy error: %v", err)
+			return err
+		default:
+		}
+
 		fromClient, err := stream.Recv()
 		if err == io.EOF {
-			break
+			return nil
 		}
-		//fmt.Println("Send Agent 1 ",fromClient.TunnelID,len(fromClient.Data))
 		if err != nil {
 			rpcLog.Warnf("Error on stream recv %s", err)
 			return rpcError(err)
 		}
-		tunnelLog.Debugf("Tunnel %d: From client %d byte(s)",
-			fromClient.TunnelID, len(fromClient.Data))
-		socks := core.SocksTunnels.Get(fromClient.TunnelID)
-		if socks == nil {
-			return nil
+
+		tunnelMutex.Lock()
+		activeTunnels[fromClient.TunnelID] = true // Mark this as an active tunnel
+		tunnelMutex.Unlock()
+
+		tunnel := core.SocksTunnels.Get(fromClient.TunnelID)
+		if tunnel == nil {
+			continue
 		}
-		if socks.Client == nil {
-			socks.Client = stream // Bind client to tunnel
-			// Send Client
-			go func() {
-				for tunnelData := range socks.FromImplant {
 
-					fromImplantCacheSocks.Add(fromClient.TunnelID, tunnelData.Sequence, tunnelData)
+		if tunnel.Client == nil {
+			tunnel.Client = stream
+			tunnel.FromImplant = make(chan *sliverpb.SocksData, 100) // Buffered channel for 100 messages
 
-					for recv, ok := fromImplantCacheSocks.Get(fromClient.TunnelID, socks.FromImplantSequence); ok; recv, ok = fromImplantCacheSocks.Get(fromClient.TunnelID, socks.FromImplantSequence) {
-						rpcLog.Debugf("[socks] agent to (Server To Client)  Data Sequence %d , Data Size %d ,Data %v\n", socks.FromImplantSequence, len(recv.Data), recv.Data)
-						socks.Client.Send(&sliverpb.SocksData{
-							CloseConn: recv.CloseConn,
-							TunnelID:  recv.TunnelID,
-							Data:      recv.Data,
-						})
-
-						fromImplantCacheSocks.DeleteSeq(fromClient.TunnelID, socks.FromImplantSequence)
-						socks.FromImplantSequence++
+			// Monitor tunnel goroutines for inactivity and cleanup
+			wg.Add(1)
+			go func(tunnelID uint64) {
+				defer wg.Done()
+				defer func() {
+					if r := recover(); r != nil {
+						rpcLog.Errorf("Recovered from panic in monitor: %v", r)
+						errChan <- fmt.Errorf("monitor goroutine panic: %v", r)
+						cancel() // Cancel context in case of a panic
 					}
+				}()
 
+				ticker := time.NewTicker(inactivityCheckInterval)
+				defer ticker.Stop()
+
+				for {
+					select {
+					case <-ctx.Done():
+						return
+					case <-connDone:
+						return
+					case <-ticker.C:
+						tunnel := core.SocksTunnels.Get(tunnelID)
+						if tunnel == nil || tunnel.Client == nil {
+							return
+						}
+						session := core.Sessions.Get(tunnel.SessionID)
+
+						// Check both caches for activity
+						toImplantCacheSocks.mutex.RLock()
+						fromImplantCacheSocks.mutex.RLock()
+						toLastActivity := toImplantCacheSocks.lastActivity[tunnelID]
+						fromLastActivity := fromImplantCacheSocks.lastActivity[tunnelID]
+						toImplantCacheSocks.mutex.RUnlock()
+						fromImplantCacheSocks.mutex.RUnlock()
+
+						// Clean up goroutine if both directions have hit the idle threshold
+						if time.Since(toLastActivity) > inactivityTimeout && time.Since(fromLastActivity) > inactivityTimeout {
+							s.CloseSocks(context.Background(), &sliverpb.Socks{TunnelID: tunnelID})
+							return
+						}
+
+						// Clean up goroutine if the client has disconnected early
+						if tunnel.Client == nil || session == nil {
+							s.CloseSocks(context.Background(), &sliverpb.Socks{TunnelID: tunnelID})
+							return
+						}
+
+					}
+				}
+			}(fromClient.TunnelID)
+
+			// Send Client
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				defer func() {
+					if r := recover(); r != nil {
+						rpcLog.Errorf("Recovered from panic in client sender: %v", r)
+						errChan <- fmt.Errorf("client sender panic: %v", r)
+						cancel() // Cancel context in case of a panic
+					}
+				}()
+
+				pendingData := make(map[uint64]*sliverpb.SocksData)
+				ticker := time.NewTicker(ToClientTickerInterval)
+				defer ticker.Stop()
+
+				for {
+					select {
+					case <-ctx.Done():
+						return
+					case <-connDone:
+						return
+					case tunnelData, ok := <-tunnel.FromImplant:
+						if !ok {
+							return
+						}
+
+						// Check if implant is requesting to close the tunnel
+						if tunnelData.CloseConn {
+							// Clean up the tunnel
+							s.CloseSocks(context.Background(), &sliverpb.Socks{TunnelID: fromClient.TunnelID})
+							return
+						}
+
+						sequence := tunnelData.Sequence
+						fromImplantCacheSocks.Add(fromClient.TunnelID, sequence, tunnelData)
+						pendingData[sequence] = tunnelData
+						fromImplantCacheSocks.recordActivity(fromClient.TunnelID)
+
+					case <-ticker.C:
+						if tunnel.Client == nil {
+							return
+						}
+						if len(pendingData) == 0 {
+							continue
+						}
+
+						expectedSequence := atomic.LoadUint64(&tunnel.FromImplantSequence)
+						processed := 0
+
+						// Perform Batching
+						for i := 0; i < batchSize && processed < len(pendingData); i++ {
+							data, exists := pendingData[expectedSequence]
+							if !exists {
+								break // Stop batching if we don't have the next expected sequence
+							}
+
+							func() {
+								defer func() {
+									if r := recover(); r != nil {
+										errChan <- fmt.Errorf("Client sender panic: %v", r)
+									}
+								}()
+
+								err := stream.Send(&sliverpb.SocksData{
+									CloseConn: data.CloseConn,
+									TunnelID:  data.TunnelID,
+									Data:      data.Data,
+								})
+
+								if err != nil {
+									rpcLog.Errorf("Send error: %v", err)
+									return
+								}
+
+								delete(pendingData, expectedSequence)
+								fromImplantCacheSocks.DeleteSeq(fromClient.TunnelID, expectedSequence)
+								atomic.AddUint64(&tunnel.FromImplantSequence, 1)
+								expectedSequence++
+								processed++
+							}()
+						}
+
+					}
+				}
+			}()
+
+			// Send Agent
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				defer func() {
+					if r := recover(); r != nil {
+						rpcLog.Errorf("Recovered from panic in agent sender: %v", r)
+						errChan <- fmt.Errorf("agent sender panic: %v", r)
+						cancel() // Cancel context in case of a panic
+					}
+				}()
+
+				pendingData := make(map[uint64]*sliverpb.SocksData)
+				ticker := time.NewTicker(ToImplantTickerInterval)
+				defer ticker.Stop()
+
+				for {
+					select {
+					case <-ctx.Done():
+						return
+					case <-connDone:
+						return
+					case <-ticker.C:
+						if tunnel.Client == nil {
+							return
+						}
+						sequence := atomic.LoadUint64(&tunnel.ToImplantSequence)
+
+						func() {
+							defer func() {
+								if r := recover(); r != nil {
+									rpcLog.Errorf("Recovered from processing panic: %v", r)
+								}
+							}()
+
+							for {
+								recv, ok := toImplantCacheSocks.Get(fromClient.TunnelID, sequence)
+								if !ok {
+									break
+								}
+
+								session := core.Sessions.Get(fromClient.Request.SessionID)
+								if session == nil {
+									rpcLog.Error("Session not found")
+									break
+								}
+
+								data, err := proto.Marshal(recv)
+								if err != nil {
+									rpcLog.Errorf("Failed to marshal data: %v", err)
+									continue
+								}
+
+								select {
+								case session.Connection.Send <- &sliverpb.Envelope{
+									Type: sliverpb.MsgSocksData,
+									Data: data,
+								}:
+									toImplantCacheSocks.DeleteSeq(fromClient.TunnelID, sequence)
+									atomic.AddUint64(&tunnel.ToImplantSequence, 1)
+									sequence++
+								case <-time.After(writeTimeout):
+									rpcLog.Error("Write timeout to implant")
+									pendingData[sequence] = recv
+									break
+								}
+							}
+						}()
+					}
 				}
 			}()
 		}
 
-		// Send Agent
-		go func() {
-			toImplantCacheSocks.Add(fromClient.TunnelID, fromClient.Sequence, fromClient)
-
-			for recv, ok := toImplantCacheSocks.Get(fromClient.TunnelID, socks.ToImplantSequence); ok; recv, ok = toImplantCacheSocks.Get(fromClient.TunnelID, socks.ToImplantSequence) {
-				rpcLog.Debugf("[socks] Client to (Server To Agent) Data Sequence %d ,  Data Size %d \n", socks.ToImplantSequence, len(fromClient.Data))
-				data, _ := proto.Marshal(recv)
-
-				session := core.Sessions.Get(fromClient.Request.SessionID)
-				session.Connection.Send <- &sliverpb.Envelope{
-					Type: sliverpb.MsgSocksData,
-					Data: data,
-				}
-
-				toImplantCacheSocks.DeleteSeq(fromClient.TunnelID, socks.ToImplantSequence)
-				socks.ToImplantSequence++
-			}
-
-		}()
+		toImplantCacheSocks.Add(fromClient.TunnelID, fromClient.Sequence, fromClient)
 	}
-	return nil
 }
 
 // CreateSocks5 - Create requests we close a Socks
@@ -169,11 +404,48 @@ func (s *Server) CreateSocks(ctx context.Context, req *sliverpb.Socks) (*sliverp
 
 // CloseSocks - Client requests we close a Socks
 func (s *Server) CloseSocks(ctx context.Context, req *sliverpb.Socks) (*commonpb.Empty, error) {
-	err := core.SocksTunnels.Close(req.TunnelID)
+	defer func() {
+		if r := recover(); r != nil {
+			rpcLog.Errorf("Recovered from panic in CloseSocks for tunnel %d: %v", req.TunnelID, r)
+		}
+	}()
+
+	tunnel := core.SocksTunnels.Get(req.TunnelID)
+	if tunnel != nil {
+		// Signal close to implant first
+		if session := core.Sessions.Get(tunnel.SessionID); session != nil {
+			data, _ := proto.Marshal(&sliverpb.SocksData{
+				TunnelID:  req.TunnelID,
+				CloseConn: true,
+			})
+			session.Connection.Send <- &sliverpb.Envelope{
+				Type: sliverpb.MsgSocksData,
+				Data: data,
+			}
+		}
+		time.Sleep(100 * time.Millisecond) // Delay to allow close message to be sent
+		tunnel.Client = nil                // Cleanup the tunnel
+		if tunnel.FromImplant != nil {
+			select {
+			case _, ok := <-tunnel.FromImplant:
+				if ok {
+					close(tunnel.FromImplant)
+				}
+			default:
+				close(tunnel.FromImplant)
+			}
+			tunnel.FromImplant = nil
+		}
+	}
+
+	// Clean up caches
 	toImplantCacheSocks.DeleteTun(req.TunnelID)
 	fromImplantCacheSocks.DeleteTun(req.TunnelID)
-	if err != nil {
-		return nil, rpcError(err)
+
+	// Remove from core tunnels last
+	if err := core.SocksTunnels.Close(req.TunnelID); err != nil {
+		rpcLog.Errorf("Error closing tunnel %d: %v", req.TunnelID, err)
 	}
+
 	return &commonpb.Empty{}, nil
 }