Update SECURITY.md

Signed-off-by: Joe <[email protected]>

SECURITY.md

@@ -15,4 +15,4 @@ Anything in the `master` branch, without an open ticket.
 
 ### Reporting a Vulnerability
 
-Please report high and/or critical vulnerabilities via email `jdemesy<[a]>bishopfox.com`, if no response within 14 days, file a ticket with a `security` tag. Medium to Low risk vulnerabilities can simply be filed as a normal bug/issue with the `security` tag.
+Please report high and/or critical vulnerabilities via GitHub's private [report a vulnerability feature](https://github.com/BishopFox/sliver/security/advisories).

go.mod

@@ -10,7 +10,7 @@ require (
 	github.com/Binject/debug v0.0.0-20210312092933-6277045c2fdf
 	github.com/Binject/go-donut v0.0.0-20210701074227-67a31e2d883e
 	github.com/Binject/universal v0.0.0-20210304094126-daefaa886313
-	github.com/Ne0nd0g/go-clr v1.0.2
+	github.com/Ne0nd0g/go-clr v1.0.3
 	github.com/alecthomas/chroma v0.10.0
 	github.com/cheggaaa/pb/v3 v3.1.0
 	github.com/chromedp/cdproto v0.0.0-20220924210414-0e3390be1777
@@ -49,7 +49,7 @@ require (
 	google.golang.org/grpc v1.42.0-dev.0.20211020220737-f00baa6c3c84
 	google.golang.org/protobuf v1.28.1
 	gopkg.in/AlecAivazis/survey.v1 v1.8.8
-	gorm.io/driver/mysql v1.4.3
+	gorm.io/driver/mysql v1.4.4
 	gorm.io/driver/postgres v1.4.5
 	gorm.io/driver/sqlite v1.4.3
 	gorm.io/gorm v1.24.1-0.20221019064659-5dd2bb482755

go.sum

@@ -23,8 +23,8 @@ github.com/Masterminds/semver/v3 v3.1.1 h1:hLg3sBzpNErnxhQtUy/mmLR2I9foDujNK030I
 github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
 github.com/Microsoft/go-winio v0.5.1 h1:aPJp2QD7OOrhO5tQXqQoGSJc+DjDtWTGLOmNyAm6FgY=
 github.com/Microsoft/go-winio v0.5.1/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
-github.com/Ne0nd0g/go-clr v1.0.2 h1:jVD7iJyXaS3KhPiKetUnUAuLxgDlNSvYmPfMFK8E3VY=
-github.com/Ne0nd0g/go-clr v1.0.2/go.mod h1:TKYSQ/5xT25EvBUttAlUrzpR8yHuI0qTRK495I5xG/I=
+github.com/Ne0nd0g/go-clr v1.0.3 h1:xt92wwuqY23ZSC7RuHD3mKu3K22Bk5NNbxI803vojK4=
+github.com/Ne0nd0g/go-clr v1.0.3/go.mod h1:TKYSQ/5xT25EvBUttAlUrzpR8yHuI0qTRK495I5xG/I=
 github.com/Netflix/go-expect v0.0.0-20180615182759-c93bf25de8e8/go.mod h1:oX5x61PbNXchhh0oikYAH+4Pcfw5LKv21+Jnpr6r6Pc=
 github.com/Netflix/go-expect v0.0.0-20190729225929-0e00d9168667/go.mod h1:oX5x61PbNXchhh0oikYAH+4Pcfw5LKv21+Jnpr6r6Pc=
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s=
@@ -604,8 +604,8 @@ gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gorm.io/driver/mysql v1.4.3 h1:/JhWJhO2v17d8hjApTltKNADm7K7YI2ogkR7avJUL3k=
-gorm.io/driver/mysql v1.4.3/go.mod h1:sSIebwZAVPiT+27jK9HIwvsqOGKx3YMPmrA3mBJR10c=
+gorm.io/driver/mysql v1.4.4 h1:MX0K9Qvy0Na4o7qSC/YI7XxqUw5KDw01umqgID+svdQ=
+gorm.io/driver/mysql v1.4.4/go.mod h1:BCg8cKI+R0j/rZRQxeKis/forqRwRSYOR8OM3Wo6hOM=
 gorm.io/driver/postgres v1.4.5 h1:mTeXTTtHAgnS9PgmhN2YeUbazYpLhUI1doLnw42XUZc=
 gorm.io/driver/postgres v1.4.5/go.mod h1:GKNQYSJ14qvWkvPwXljMGehpKrhlDNsqYRr5HnYGncg=
 gorm.io/driver/sqlite v1.4.3 h1:HBBcZSDnWi5BW3B3rwvVTc510KGkBkexlOg0QrmLUuU=

implant/sliver/handlers/handlers.go

@@ -530,7 +530,16 @@ func executeHandler(data []byte, resp RPCResponse) {
 	}
 
 	execResp := &sliverpb.Execute{}
-	cmd := exec.Command(execReq.Path, execReq.Args...)
+	exePath, err := expandPath(execReq.Path)
+	if err != nil {
+		execResp.Response = &commonpb.Response{
+			Err: fmt.Sprintf("%s", err),
+		}
+		proto.Marshal(execResp)
+		resp(data, err)
+		return
+	}
+	cmd := exec.Command(exePath, execReq.Args...)
 
 	if execReq.Output {
 		stdOutBuff := new(bytes.Buffer)
@@ -929,3 +938,13 @@ func compressDir(path string, filter string, recurse bool, buf io.Writer) (int,
 	}
 	return readFiles, unreadableFiles, nil
 }
+
+func expandPath(exePath string) (string, error) {
+	if !strings.ContainsRune(exePath, os.PathSeparator) {
+		_, err := exec.LookPath(exePath)
+		if err != nil {
+			return filepath.Abs(exePath)
+		}
+	}
+	return exePath, nil
+}

implant/sliver/handlers/handlers_windows.go

@@ -303,7 +303,16 @@ func executeWindowsHandler(data []byte, resp RPCResponse) {
 	}
 
 	execResp := &sliverpb.Execute{}
-	cmd := exec.Command(execReq.Path, execReq.Args...)
+	exePath, err := expandPath(execReq.Path)
+	if err != nil {
+		execResp.Response = &commonpb.Response{
+			Err: fmt.Sprintf("%s", err),
+		}
+		proto.Marshal(execResp)
+		resp(data, err)
+		return
+	}
+	cmd := exec.Command(exePath, execReq.Args...)
 
 	// Execute with current token
 	cmd.SysProcAttr = &syscall.SysProcAttr{}

vendor/github.com/Ne0nd0g/go-clr/CHANGELOG.md

@@ -0,0 +1,38 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
+and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
+
+## 1.0.3 2022-11-10
+
+## Changed
+
+- Merged [Pull 3](https://github.com/Ne0nd0g/go-clr/pull/3) from @mec07 to return errors instead of exiting the program
+
+### Fixed
+
+- [Issue 4](https://github.com/Ne0nd0g/go-clr/issues/4) - Application's Without A Console Will Not Return Output
+
+## 1.0.2 2022-04-02
+
+### Fixed
+
+- Merged [Pull 2](https://github.com/Ne0nd0g/go-clr/pull/2) from @audibleblink that fixed an error when attempting to 
+load correctly targeted assemblies through 
+
+### Changed
+
+- Upgraded supporting Go modules
+
+## 1.0.1 2021-04-08
+
+- Learned how to correctly use tags and updated import
+
+## 1.0.0 2021-04-08
+
+- Initial tagged version from forked 
+
+### Added
+
+- Added buffer to collect redirected STDOUT/STDERR

vendor/github.com/Ne0nd0g/go-clr/go-clr.go

@@ -1,6 +1,7 @@
+//go:build windows
 // +build windows
 
-// go-clr is a PoC package that wraps Windows syscalls necessary to load and the CLR into the current process and
+// Package clr is a PoC package that wraps Windows syscalls necessary to load and the CLR into the current process and
 // execute a managed DLL from disk or a managed EXE from memory
 package clr
 
@@ -11,7 +12,7 @@ import (
 	"unsafe"
 )
 
-// GetInstallRuntimes is a wrapper function that returns an array of installed runtimes. Requires an existing ICLRMetaHost
+// GetInstalledRuntimes is a wrapper function that returns an array of installed runtimes. Requires an existing ICLRMetaHost
 func GetInstalledRuntimes(metahost *ICLRMetaHost) ([]string, error) {
 	var runtimes []string
 	enumICLRRuntimeInfo, err := metahost.EnumerateInstalledRuntimes()
@@ -89,16 +90,26 @@ func ExecuteDLLFromDisk(targetRuntime, dllpath, typeName, methodName, argument s
 	}
 
 	pDLLPath, err := syscall.UTF16PtrFromString(dllpath)
-	must(err)
+	if err != nil {
+		return
+	}
 	pTypeName, err := syscall.UTF16PtrFromString(typeName)
-	must(err)
+	if err != nil {
+		return
+	}
 	pMethodName, err := syscall.UTF16PtrFromString(methodName)
-	must(err)
+	if err != nil {
+		return
+	}
 	pArgument, err := syscall.UTF16PtrFromString(argument)
-	must(err)
+	if err != nil {
+		return
+	}
 
 	ret, err := runtimeHost.ExecuteInDefaultAppDomain(pDLLPath, pTypeName, pMethodName, pArgument)
-	must(err)
+	if err != nil {
+		return
+	}
 	if *ret != 0 {
 		return int16(*ret), fmt.Errorf("the ICLRRuntimeHost::ExecuteInDefaultAppDomain method returned a non-zero return value: %d", *ret)
 	}
@@ -200,7 +211,7 @@ func ExecuteByteArray(targetRuntime string, rawBytes []byte, params []string) (r
 
 // LoadCLR loads the target runtime into the current process and returns the runtimehost
 // The intended purpose is for the runtimehost to be reused for subsequent operations
-// throught the duration of the program. Commonly used with C2 frameworks
+// throughout the duration of the program. Commonly used with C2 frameworks
 func LoadCLR(targetRuntime string) (runtimeHost *ICORRuntimeHost, err error) {
 	if targetRuntime == "" {
 		targetRuntime = "v4"
@@ -300,7 +311,7 @@ func ExecuteByteArrayDefaultDomain(runtimeHost *ICORRuntimeHost, rawBytes []byte
 
 // LoadAssembly uses a previously instantiated runtimehost and loads an assembly into the default AppDomain
 // and returns the assembly's methodInfo structure. The intended purpose is for the assembly to be loaded
-// once but executed many times throught the duration of the program. Commonly used with C2 frameworks
+// once but executed many times throughout the duration of the program. Commonly used with C2 frameworks
 func LoadAssembly(runtimeHost *ICORRuntimeHost, rawBytes []byte) (methodInfo *MethodInfo, err error) {
 	appDomain, err := GetAppDomain(runtimeHost)
 	if err != nil {
@@ -319,7 +330,7 @@ func LoadAssembly(runtimeHost *ICORRuntimeHost, rawBytes []byte) (methodInfo *Me
 }
 
 // InvokeAssembly uses the MethodInfo structure of a previously loaded assembly and executes it.
-// The intended purpose is for the assembly to be executed many times throught the duration of the
+// The intended purpose is for the assembly to be executed many times throughout the duration of the
 // program. Commonly used with C2 frameworks
 func InvokeAssembly(methodInfo *MethodInfo, params []string) (stdout string, stderr string) {
 	var paramSafeArray *SafeArray

vendor/github.com/Ne0nd0g/go-clr/io.go

@@ -1,3 +1,4 @@
+//go:build windows
 // +build windows
 
 package clr
@@ -8,6 +9,7 @@ import (
 	"fmt"
 	"os"
 	"sync"
+	"syscall"
 	"time"
 
 	"golang.org/x/sys/windows"
@@ -58,13 +60,41 @@ func RedirectStdoutStderr() (err error) {
 		return
 	}
 
-	// Createa new reader and writer for STDERR
+	// Create a new reader and writer for STDERR
 	rSTDERR, wSTDERR, err = os.Pipe()
 	if err != nil {
 		err = fmt.Errorf("there was an error calling the os.Pipe() function to create a new STDERR:\n%s", err)
 		return
 	}
 
+	kernel32 := windows.NewLazySystemDLL("kernel32.dll")
+	getConsoleWindow := kernel32.NewProc("GetConsoleWindow")
+
+	// Ensure the process has a console because if it doesn't there will be no output to capture
+	hConsole, _, _ := getConsoleWindow.Call()
+	if hConsole == 0 {
+		// https://learn.microsoft.com/en-us/windows/console/allocconsole
+		allocConsole := kernel32.NewProc("AllocConsole")
+		// BOOL WINAPI AllocConsole(void);
+		ret, _, err := allocConsole.Call()
+		// A process can be associated with only one console, so the AllocConsole function fails if the calling process
+		// already has a console. So long as any console exists we are good to go and therefore don't care about errors
+		if ret == 0 {
+			return fmt.Errorf("there was an error calling kernel32!AllocConsole with return code %d: %s", ret, err)
+		}
+
+		// Get a handle to the newly created/allocated console
+		hConsole, _, _ = getConsoleWindow.Call()
+
+		user32 := windows.NewLazySystemDLL("user32.dll")
+		showWindow := user32.NewProc("ShowWindow")
+		// Hide the console window
+		ret, _, err = showWindow.Call(hConsole, windows.SW_HIDE)
+		if err != syscall.Errno(0) {
+			return fmt.Errorf("there was an error calling user32!ShowWindow with return %+v: %s", ret, err)
+		}
+	}
+
 	// Set STDOUT/STDERR to the new files from os.Pipe()
 	// https://docs.microsoft.com/en-us/windows/console/setstdhandle
 	if err = windows.SetStdHandle(windows.STD_OUTPUT_HANDLE, windows.Handle(wSTDOUT.Fd())); err != nil {
@@ -132,7 +162,7 @@ func ReadStdoutStderr() (stdout string, stderr string, err error) {
 	return
 }
 
-// CloseSTdoutStderr closes the Reader/Writer for the prviously redirected STDOUT/STDERR
+// CloseStdoutStderr closes the Reader/Writer for the previously redirected STDOUT/STDERR
 // that was changed to an *os.File
 func CloseStdoutStderr() (err error) {
 	err = rSTDOUT.Close()

vendor/github.com/Ne0nd0g/go-clr/utils.go

@@ -5,7 +5,6 @@ package clr
 import (
 	"bytes"
 	"fmt"
-	"log"
 	"strings"
 	"unicode/utf16"
 	"unsafe"
@@ -25,13 +24,6 @@ func checkOK(hr uintptr, caller string) error {
 	}
 }
 
-// must forces the program to exit if there is an error using the log.Fatal command
-func must(err error) {
-	if err != nil {
-		log.Fatal(err)
-	}
-}
-
 func utf16Le(s string) []byte {
 	enc := unicode.UTF16(unicode.LittleEndian, unicode.IgnoreBOM).NewEncoder()
 	var buf bytes.Buffer

vendor/gorm.io/driver/mysql/migrator.go

@@ -183,7 +183,7 @@ func (m Migrator) ColumnTypes(value interface{}) ([]gorm.ColumnType, error) {
 		}
 		columnTypeSQL += "FROM information_schema.columns WHERE table_schema = ? AND table_name = ? ORDER BY ORDINAL_POSITION"
 
-		columns, rowErr := m.DB.Raw(columnTypeSQL, currentDatabase, table).Rows()
+		columns, rowErr := m.DB.Table(table).Raw(columnTypeSQL, currentDatabase, table).Rows()
 		if rowErr != nil {
 			return rowErr
 		}
@@ -271,7 +271,7 @@ func (m Migrator) GetIndexes(value interface{}) ([]gorm.Index, error) {
 
 		result := make([]*Index, 0)
 		schema, table := m.CurrentSchema(stmt, stmt.Table)
-		scanErr := m.DB.Raw(indexSql, schema, table).Scan(&result).Error
+		scanErr := m.DB.Table(table).Raw(indexSql, schema, table).Scan(&result).Error
 		if scanErr != nil {
 			return scanErr
 		}
@@ -317,12 +317,10 @@ func groupByIndexName(indexList []*Index) map[string][]*Index {
 }
 
 func (m Migrator) CurrentSchema(stmt *gorm.Statement, table string) (string, string) {
-	if strings.Contains(table, ".") {
-		if tables := strings.Split(table, `.`); len(tables) == 2 {
-			return tables[0], tables[1]
-		}
+	if tables := strings.Split(table, `.`); len(tables) == 2 {
+		return tables[0], tables[1]
 	}
-
+	m.DB = m.DB.Table(table)
 	return m.CurrentDatabase(), table
 }
 

vendor/gorm.io/driver/mysql/mysql.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/go-sql-driver/mysql"
+
 	"gorm.io/gorm"
 	"gorm.io/gorm/callbacks"
 	"gorm.io/gorm/clause"
@@ -76,22 +77,20 @@ func (dialector Dialector) NowFunc(n int) func() time.Time {
 }
 
 func (dialector Dialector) Apply(config *gorm.Config) error {
-	if config.NowFunc == nil {
-		if dialector.DefaultDatetimePrecision == nil {
-			dialector.DefaultDatetimePrecision = &defaultDatetimePrecision
-		}
-
-		// while maintaining the readability of the code, separate the business logic from
-		// the general part and leave it to the function to do it here.
-		config.NowFunc = dialector.NowFunc(*dialector.DefaultDatetimePrecision)
+	if config.NowFunc != nil {
+		return nil
 	}
 
+	if dialector.DefaultDatetimePrecision == nil {
+		dialector.DefaultDatetimePrecision = &defaultDatetimePrecision
+	}
+	// while maintaining the readability of the code, separate the business logic from
+	// the general part and leave it to the function to do it here.
+	config.NowFunc = dialector.NowFunc(*dialector.DefaultDatetimePrecision)
 	return nil
 }
 
 func (dialector Dialector) Initialize(db *gorm.DB) (err error) {
-	ctx := context.Background()
-
 	if dialector.DriverName == "" {
 		dialector.DriverName = "mysql"
 	}
@@ -111,7 +110,7 @@ func (dialector Dialector) Initialize(db *gorm.DB) (err error) {
 
 	withReturning := false
 	if !dialector.Config.SkipInitializeWithVersion {
-		err = db.ConnPool.QueryRowContext(ctx, "SELECT VERSION()").Scan(&dialector.ServerVersion)
+		err = db.ConnPool.QueryRowContext(context.Background(), "SELECT VERSION()").Scan(&dialector.ServerVersion)
 		if err != nil {
 			return err
 		}
@@ -121,9 +120,7 @@ func (dialector Dialector) Initialize(db *gorm.DB) (err error) {
 			dialector.Config.DontSupportRenameColumn = true
 			dialector.Config.DontSupportForShareClause = true
 			dialector.Config.DontSupportNullAsDefaultValue = true
-			if checkVersion(dialector.ServerVersion, "10.5") {
-				withReturning = true
-			}
+			withReturning = checkVersion(dialector.ServerVersion, "10.5")
 		} else if strings.HasPrefix(dialector.ServerVersion, "5.6.") {
 			dialector.Config.DontSupportRenameIndex = true
 			dialector.Config.DontSupportRenameColumn = true
@@ -176,7 +173,7 @@ const (
 	ClauseOnConflict = "ON CONFLICT"
 	// ClauseValues for clause.ClauseBuilder VALUES key
 	ClauseValues = "VALUES"
-	// ClauseValues for clause.ClauseBuilder FOR key
+	// ClauseFor for clause.ClauseBuilder FOR key
 	ClauseFor = "FOR"
 )
 
@@ -393,11 +390,11 @@ func (dialector Dialector) getSchemaStringType(field *schema.Field) string {
 }
 
 func (dialector Dialector) getSchemaTimeType(field *schema.Field) string {
-	precision := ""
 	if !dialector.DisableDatetimePrecision && field.Precision == 0 {
 		field.Precision = *dialector.DefaultDatetimePrecision
 	}
 
+	var precision string
 	if field.Precision > 0 {
 		precision = fmt.Sprintf("(%d)", field.Precision)
 	}
@@ -421,27 +418,31 @@ func (dialector Dialector) getSchemaBytesType(field *schema.Field) string {
 }
 
 func (dialector Dialector) getSchemaIntAndUnitType(field *schema.Field) string {
-	sqlType := "bigint"
+	constraint := func(sqlType string) string {
+		if field.DataType == schema.Uint {
+			sqlType += " unsigned"
+		}
+		if field.NotNull {
+			sqlType += " NOT NULL"
+		}
+		if field.AutoIncrement {
+			sqlType += " AUTO_INCREMENT"
+		}
+		return sqlType
+	}
+
 	switch {
 	case field.Size <= 8:
-		sqlType = "tinyint"
+		return constraint("tinyint")
 	case field.Size <= 16:
-		sqlType = "smallint"
+		return constraint("smallint")
 	case field.Size <= 24:
-		sqlType = "mediumint"
+		return constraint("mediumint")
 	case field.Size <= 32:
-		sqlType = "int"
+		return constraint("int")
+	default:
+		return constraint("bigint")
 	}
-
-	if field.DataType == schema.Uint {
-		sqlType += " unsigned"
-	}
-
-	if field.AutoIncrement {
-		sqlType += " AUTO_INCREMENT"
-	}
-
-	return sqlType
 }
 
 func (dialector Dialector) getSchemaCustomType(field *schema.Field) string {
@@ -462,23 +463,25 @@ func (dialector Dialector) RollbackTo(tx *gorm.DB, name string) error {
 	return tx.Exec("ROLLBACK TO SAVEPOINT " + name).Error
 }
 
-var versionTrimerRegexp = regexp.MustCompile(`^(\d+).*$`)
-
 // checkVersion newer or equal returns true, old returns false
 func checkVersion(newVersion, oldVersion string) bool {
 	if newVersion == oldVersion {
 		return true
 	}
 
-	newVersions := strings.Split(newVersion, ".")
-	oldVersions := strings.Split(oldVersion, ".")
+	var (
+		versionTrimmerRegexp = regexp.MustCompile(`^(\d+).*$`)
+
+		newVersions = strings.Split(newVersion, ".")
+		oldVersions = strings.Split(oldVersion, ".")
+	)
 	for idx, nv := range newVersions {
 		if len(oldVersions) <= idx {
 			return true
 		}
 
-		nvi, _ := strconv.Atoi(versionTrimerRegexp.ReplaceAllString(nv, "$1"))
-		ovi, _ := strconv.Atoi(versionTrimerRegexp.ReplaceAllString(oldVersions[idx], "$1"))
+		nvi, _ := strconv.Atoi(versionTrimmerRegexp.ReplaceAllString(nv, "$1"))
+		ovi, _ := strconv.Atoi(versionTrimmerRegexp.ReplaceAllString(oldVersions[idx], "$1"))
 		if nvi == ovi {
 			continue
 		}

vendor/modules.txt

@@ -30,7 +30,7 @@ github.com/BurntSushi/xgb/xproto
 # github.com/Microsoft/go-winio v0.5.1
 ## explicit; go 1.12
 github.com/Microsoft/go-winio/pkg/guid
-# github.com/Ne0nd0g/go-clr v1.0.2
+# github.com/Ne0nd0g/go-clr v1.0.3
 ## explicit; go 1.13
 github.com/Ne0nd0g/go-clr
 # github.com/VirusTotal/vt-go v0.0.0-20210528074736-45bbe34cc8ab
@@ -641,7 +641,7 @@ gopkg.in/jcmturner/rpc.v1/ndr
 # gopkg.in/yaml.v3 v3.0.1
 ## explicit
 gopkg.in/yaml.v3
-# gorm.io/driver/mysql v1.4.3
+# gorm.io/driver/mysql v1.4.4
 ## explicit; go 1.14
 gorm.io/driver/mysql
 # gorm.io/driver/postgres v1.4.5