Add registry list-subkeys and list-values sub commands

Fix crash on registry read

client/command/commands.go

@@ -1643,7 +1643,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-			f.String("H", "hive", "HKCU", "egistry hive")
+			f.String("H", "hive", "HKCU", "registry hive")
 			f.String("o", "hostname", "", "remote host to read values from")
 		},
 		HelpGroup: consts.SliverWinHelpGroup,
@@ -1690,6 +1690,45 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("o", "hostname", "", "remote host to write values to")
 		},
 	})
+	registryCmd.AddCommand(&grumble.Command{
+		Name:     consts.RegistryListSubStr,
+		Help:     "List the sub keys under a registry key",
+		LongHelp: help.GetHelpFor([]string{consts.RegistryListSubStr}),
+		Args: func(a *grumble.Args) {
+			a.String("registry-path", "registry path")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			registry.RegListSubKeysCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+			f.String("H", "hive", "HKCU", "registry hive")
+			f.String("o", "hostname", "", "remote host to write values to")
+		},
+	})
+
+	registryCmd.AddCommand(&grumble.Command{
+		Name:     consts.RegistryListValuesStr,
+		Help:     "List the values for a registry key",
+		LongHelp: help.GetHelpFor([]string{consts.RegistryListValuesStr}),
+		Args: func(a *grumble.Args) {
+			a.String("registry-path", "registry path")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			registry.RegListValuesCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+			f.String("H", "hive", "HKCU", "registry hive")
+			f.String("o", "hostname", "", "remote host to write values to")
+		},
+	})
 	con.App.AddCommand(registryCmd)
 
 	// [ Pivots ] --------------------------------------------------------------
@@ -2168,4 +2207,22 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 	}
 	con.App.AddCommand(dllhijackCmd)
+
+	// [ Get Privs ] -----------------------------------------------------------------
+	getprivsCmd := &grumble.Command{
+		Name:      consts.GetPrivsStr,
+		Help:      "Get current privileges (Windows)",
+		LongHelp:  help.GetHelpFor([]string{consts.GetPrivsStr}),
+		HelpGroup: consts.SliverWinHelpGroup,
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			privilege.GetPrivsCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+	}
+	con.App.AddCommand(getprivsCmd)
 }

client/command/help/long-help.go

@@ -627,6 +627,10 @@ dllhijack --reference-path c:\\windows\\system32\\msasn1.dll --profile dll c:\\u
 
 # Use a local DLL as the reference DLL
 dllhijack --reference-path c:\\windows\\system32\\msasn1.dll --reference-file /tmp/msasn1.dll.orig --profile dll c:\\users\\bob\\appdata\\slack\\app-4.18.0\\msasn1.dll
+`
+
+	getPrivsHelp = `[[.Bold]]Command:[[.Normal]] getprivs
+[[.Bold]]About:[[.Normal]] Get privilege information for the current process (Windows only).
 `
 )
 

client/command/privilege/getprivs.go

@@ -0,0 +1,99 @@
+package privilege
+
+import (
+	"context"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+)
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+func GetPrivsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveSession.GetInteractive()
+	if session == nil {
+		return
+	}
+
+	if session.OS != "windows" {
+		con.PrintErrorf("Command not supported on this operating system.")
+		return
+	}
+
+	privs, err := con.Rpc.GetPrivs(context.Background(), &sliverpb.GetPrivsReq{
+		Request: con.ActiveSession.Request(ctx),
+	})
+
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	// Response is the Envelope (see RPC API), Err is part of it.
+	if privs.Response != nil && privs.Response.Err != "" {
+		con.PrintErrorf("NOTE: Information may be incomplete due to an error:\n")
+		con.PrintErrorf("%s\n", privs.Response.Err)
+	}
+
+	if privs.PrivInfo == nil {
+		return
+	}
+
+	// To make things look pretty, figure out the longest name and description
+	// for column width
+	var nameColumnWidth int = 0
+	var descriptionColumnWidth int = 0
+
+	for _, entry := range privs.PrivInfo {
+		if len(entry.Name) > nameColumnWidth {
+			nameColumnWidth = len(entry.Name)
+		}
+		if len(entry.Description) > descriptionColumnWidth {
+			descriptionColumnWidth = len(entry.Description)
+		}
+	}
+
+	// Give one more space
+	nameColumnWidth += 1
+	descriptionColumnWidth += 1
+
+	con.Println("Privilege Information for Current Process")
+	con.Println("-----------------------------------------")
+	con.Printf("%-*s\t%-*s\t%s\n", nameColumnWidth, "Name", descriptionColumnWidth, "Description", "Attributes")
+	con.Printf("%-*s\t%-*s\t%s\n", nameColumnWidth, "====", descriptionColumnWidth, "===========", "==========")
+	for _, entry := range privs.PrivInfo {
+		con.Printf("%-*s\t%-*s\t(", nameColumnWidth, entry.Name, descriptionColumnWidth, entry.Description)
+		if entry.Enabled {
+			con.Printf("Enabled")
+		} else {
+			con.Printf("Disabled")
+		}
+		if entry.EnabledByDefault {
+			con.Printf(", Enabled by Default")
+		}
+		if entry.Removed {
+			con.Printf(", Removed")
+		}
+		if entry.UsedForAccess {
+			con.Printf(", Used for Access")
+		}
+		con.Printf(")\n")
+	}
+}

client/command/registry/reg-create.go

@@ -49,12 +49,20 @@ func RegCreateKeyCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if strings.Contains(regPath, "/") {
 		regPath = strings.ReplaceAll(regPath, "/", "\\")
 	}
-	slashIndex := strings.LastIndex(regPath, "\\")
-	key := regPath[slashIndex+1:]
-	regPath = regPath[:slashIndex]
+	pathBaseIdx := strings.LastIndex(regPath, `\`)
+	if pathBaseIdx < 0 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	if len(regPath) < pathBaseIdx+1 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	finalPath := regPath[:pathBaseIdx]
+	key := regPath[pathBaseIdx+1:]
 	createKeyResp, err := con.Rpc.RegistryCreateKey(context.Background(), &sliverpb.RegistryCreateKeyReq{
 		Hive:     hive,
-		Path:     regPath,
+		Path:     finalPath,
 		Key:      key,
 		Hostname: hostname,
 		Request:  con.ActiveSession.Request(ctx),

client/command/registry/reg-list.go

@@ -0,0 +1,77 @@
+package registry
+
+import (
+	"context"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+)
+
+func RegListSubKeysCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveSession.GetInteractive()
+	if session == nil {
+		return
+	}
+
+	path := ctx.Args.String("registry-path")
+	hive := ctx.Flags.String("hive")
+	hostname := ctx.Flags.String("hostname")
+
+	regList, err := con.Rpc.RegistryListSubKeys(context.Background(), &sliverpb.RegistrySubKeyListReq{
+		Hive:     hive,
+		Hostname: hostname,
+		Path:     path,
+		Request:  con.ActiveSession.Request(ctx),
+	})
+
+	if err != nil {
+		con.PrintErrorf("Error: %s\n", err.Error())
+		return
+	}
+
+	if regList.Response != nil && regList.Response.Err != "" {
+		con.PrintErrorf("Error: %s\n", regList.Response.Err)
+		return
+	}
+	if len(regList.Subkeys) > 0 {
+		con.PrintInfof("Sub keys under %s:\\%s:\n", hive, path)
+	}
+	for _, subKey := range regList.Subkeys {
+		con.Println(subKey)
+	}
+}
+
+func RegListValuesCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveSession.GetInteractive()
+	if session == nil {
+		return
+	}
+
+	regPath := ctx.Args.String("registry-path")
+	hive := ctx.Flags.String("hive")
+	hostname := ctx.Flags.String("hostname")
+
+	regList, err := con.Rpc.RegistryListValues(context.Background(), &sliverpb.RegistryListValuesReq{
+		Hive:     hive,
+		Hostname: hostname,
+		Path:     regPath,
+		Request:  con.ActiveSession.Request(ctx),
+	})
+
+	if err != nil {
+		con.PrintErrorf("Error: %s\n", err.Error())
+		return
+	}
+
+	if regList.Response != nil && regList.Response.Err != "" {
+		con.PrintErrorf("Error: %s\n", regList.Response.Err)
+		return
+	}
+	if len(regList.ValueNames) > 0 {
+		con.PrintInfof("Values under %s:\\%s:\n", hive, regPath)
+	}
+	for _, val := range regList.ValueNames {
+		con.Println(val)
+	}
+}

client/command/registry/reg-read.go

@@ -72,6 +72,10 @@ func getType(t string) (uint32, error) {
 
 // RegReadCmd - Read a windows registry key: registry read --hostname aa.bc.local --hive HKCU "software\google\chrome\blbeacon\version"
 func RegReadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var (
+		finalPath string
+		key       string
+	)
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {
 		return
@@ -93,15 +97,24 @@ func RegReadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintErrorf("You must provide a path")
 		return
 	}
+
 	if strings.Contains(regPath, "/") {
 		regPath = strings.ReplaceAll(regPath, "/", "\\")
 	}
-	slashIndex := strings.LastIndex(regPath, "\\")
-	key := regPath[slashIndex+1:]
-	regPath = regPath[:slashIndex]
+	pathBaseIdx := strings.LastIndex(regPath, `\`)
+	if pathBaseIdx < 0 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	if len(regPath) < pathBaseIdx+1 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	finalPath = regPath[:pathBaseIdx]
+	key = regPath[pathBaseIdx+1:]
 	regRead, err := con.Rpc.RegistryRead(context.Background(), &sliverpb.RegistryReadReq{
 		Hive:     hive,
-		Path:     regPath,
+		Path:     finalPath,
 		Key:      key,
 		Hostname: hostname,
 		Request:  con.ActiveSession.Request(ctx),

client/command/registry/reg-write.go

@@ -71,9 +71,17 @@ func RegWriteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if strings.Contains(regPath, "/") {
 		regPath = strings.ReplaceAll(regPath, "/", "\\")
 	}
-	slashIndex := strings.LastIndex(regPath, "\\")
-	key := regPath[slashIndex+1:]
-	regPath = regPath[:slashIndex]
+	pathBaseIdx := strings.LastIndex(regPath, `\`)
+	if pathBaseIdx < 0 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	if len(regPath) < pathBaseIdx+1 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	finalPath := regPath[:pathBaseIdx]
+	key := regPath[pathBaseIdx+1:]
 	switch valType {
 	case sliverpb.RegistryTypeBinary:
 		var (
@@ -118,7 +126,7 @@ func RegWriteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		Request:     con.ActiveSession.Request(ctx),
 		Hostname:    hostname,
 		Hive:        hive,
-		Path:        regPath,
+		Path:        finalPath,
 		Type:        valType,
 		Key:         key,
 		StringValue: stringValue,

client/constants/constants.go

@@ -206,6 +206,8 @@ const (
 	ReactionStr = "reaction"
 
 	LicensesStr = "licenses"
+
+	GetPrivsStr = "getprivs"
 )
 
 // Groups

implant/sliver/handlers/handlers_windows.go

@@ -61,18 +61,21 @@ var (
 		sliverpb.MsgSetEnvReq:                setEnvHandler,
 		sliverpb.MsgUnsetEnvReq:              unsetEnvHandler,
 		sliverpb.MsgExecuteTokenReq:          executeTokenHandler,
+		sliverpb.MsgGetPrivsReq:              getPrivsHandler,
 
 		// Platform specific
-		sliverpb.MsgIfconfigReq:          ifconfigHandler,
-		sliverpb.MsgScreenshotReq:        screenshotHandler,
-		sliverpb.MsgSideloadReq:          sideloadHandler,
-		sliverpb.MsgNetstatReq:           netstatHandler,
-		sliverpb.MsgMakeTokenReq:         makeTokenHandler,
-		sliverpb.MsgPsReq:                psHandler,
-		sliverpb.MsgTerminateReq:         terminateHandler,
-		sliverpb.MsgRegistryReadReq:      regReadHandler,
-		sliverpb.MsgRegistryWriteReq:     regWriteHandler,
-		sliverpb.MsgRegistryCreateKeyReq: regCreateKeyHandler,
+		sliverpb.MsgIfconfigReq:            ifconfigHandler,
+		sliverpb.MsgScreenshotReq:          screenshotHandler,
+		sliverpb.MsgSideloadReq:            sideloadHandler,
+		sliverpb.MsgNetstatReq:             netstatHandler,
+		sliverpb.MsgMakeTokenReq:           makeTokenHandler,
+		sliverpb.MsgPsReq:                  psHandler,
+		sliverpb.MsgTerminateReq:           terminateHandler,
+		sliverpb.MsgRegistryReadReq:        regReadHandler,
+		sliverpb.MsgRegistryWriteReq:       regWriteHandler,
+		sliverpb.MsgRegistryCreateKeyReq:   regCreateKeyHandler,
+		sliverpb.MsgRegistrySubKeysListReq: regSubKeysListHandler,
+		sliverpb.MsgRegistryListValuesReq:  regValuesListHandler,
 
 		// Generic
 		sliverpb.MsgPing:                 pingHandler,
@@ -493,3 +496,85 @@ func regCreateKeyHandler(data []byte, resp RPCResponse) {
 	data, err = proto.Marshal(createResp)
 	resp(data, err)
 }
+
+func regSubKeysListHandler(data []byte, resp RPCResponse) {
+	listReq := &sliverpb.RegistrySubKeyListReq{}
+	err := proto.Unmarshal(data, listReq)
+	if err != nil {
+		return
+	}
+	subKeys, err := registry.ListSubKeys(listReq.Hostname, listReq.Hive, listReq.Path)
+	regListResp := &sliverpb.RegistrySubKeyList{
+		Response: &commonpb.Response{},
+	}
+	if err != nil {
+		regListResp.Response.Err = err.Error()
+	} else {
+		regListResp.Subkeys = subKeys
+	}
+	data, err = proto.Marshal(regListResp)
+	resp(data, err)
+}
+
+func regValuesListHandler(data []byte, resp RPCResponse) {
+	listReq := &sliverpb.RegistryListValuesReq{}
+	err := proto.Unmarshal(data, listReq)
+	if err != nil {
+		return
+	}
+	regValues, err := registry.ListValues(listReq.Hostname, listReq.Hive, listReq.Path)
+	regListResp := &sliverpb.RegistryValuesList{
+		Response: &commonpb.Response{},
+	}
+	if err != nil {
+		regListResp.Response.Err = err.Error()
+	} else {
+		regListResp.ValueNames = regValues
+	}
+	data, err = proto.Marshal(regListResp)
+	resp(data, err)
+}
+
+func getPrivsHandler(data []byte, resp RPCResponse) {
+	createReq := &sliverpb.GetPrivsReq{}
+
+	err := proto.Unmarshal(data, createReq)
+	if err != nil {
+		return
+	}
+
+	privsInfo, err := priv.GetPrivs()
+
+	response_data := make([]*sliverpb.WindowsPrivilegeEntry, len(privsInfo))
+
+	/*
+		Translate the PrivilegeInfo structs into
+		sliverpb.WindowsPrivilegeEntry structs and put them in the data
+		that will go back to the server / client
+	*/
+	for index, entry := range privsInfo {
+		var currentEntry sliverpb.WindowsPrivilegeEntry
+
+		currentEntry.Name = entry.Name
+		currentEntry.Description = entry.Description
+		currentEntry.Enabled = entry.Enabled
+		currentEntry.EnabledByDefault = entry.EnabledByDefault
+		currentEntry.Removed = entry.Removed
+		currentEntry.UsedForAccess = entry.UsedForAccess
+
+		response_data[index] = &currentEntry
+	}
+
+	// Package up the response
+	getPrivsResp := &sliverpb.GetPrivs{
+		PrivInfo: response_data,
+		Response: &commonpb.Response{},
+	}
+
+	if err != nil {
+		getPrivsResp.Response.Err = err.Error()
+	}
+
+	data, err = proto.Marshal(getPrivsResp)
+	resp(data, err)
+}

implant/sliver/priv/priv_windows.go

@@ -26,6 +26,8 @@ import (
 	"log"
 
 	// {{end}}
+	"bytes"
+	"encoding/binary"
 	"fmt"
 	"os/exec"
 	"runtime"
@@ -43,6 +45,15 @@ const (
 	THREAD_ALL_ACCESS = windows.STANDARD_RIGHTS_REQUIRED | windows.SYNCHRONIZE | 0xffff
 )
 
+type PrivilegeInfo struct {
+	Name             string
+	Description      string
+	Enabled          bool
+	EnabledByDefault bool
+	Removed          bool
+	UsedForAccess    bool
+}
+
 var CurrentToken windows.Token
 
 func SePrivEnable(s string) error {
@@ -328,3 +339,163 @@ func GetSystem(data []byte, hostingProcess string) (err error) {
 	}
 	return
 }
+
+func lookupPrivilegeNameByLUID(luid uint64) (string, string, error) {
+	/*
+	   We will need the LookupPrivilegeNameW and LookupPrivilegeDisplayNameW functions
+	   https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-lookupprivilegenamew
+	   https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-lookupprivilegedisplaynamew
+
+	   Defined these syscalls in implant/sliver/syscalls/syscalls_windows.go and generated them with
+	   mkwinsyscall, so we are good to go.
+	*/
+
+	// Allocate 256 wide unicode characters (uint16) for the both names (255 characters plus a null terminator)
+	nameBuffer := make([]uint16, 256)
+	nameBufferSize := uint32(len(nameBuffer))
+	displayNameBuffer := make([]uint16, 256)
+	displayNameBufferSize := uint32(len(displayNameBuffer))
+
+	// A blank string for the system name tells the call to use the local machine
+	systemName := ""
+
+	/*
+	  A language ID that gets returned from LookupPrivilegeDisplayNameW
+	  We do not need it for anything, but we still need to provide it
+	*/
+	var langID uint32
+
+	err := syscalls.LookupPrivilegeNameW(systemName, &luid, &nameBuffer[0], &nameBufferSize)
+
+	if err != nil {
+		return "", "", err
+	}
+
+	err = syscalls.LookupPrivilegeDisplayNameW(systemName, &nameBuffer[0], &displayNameBuffer[0], &displayNameBufferSize, &langID)
+
+	if err != nil {
+		// We already got the privilege name, so we might as well return that
+		return syscall.UTF16ToString(nameBuffer), "", err
+	}
+
+	return syscall.UTF16ToString(nameBuffer), syscall.UTF16ToString(displayNameBuffer), nil
+}
+
+func GetPrivs() ([]PrivilegeInfo, error) {
+	// A place to store the process token
+	var tokenHandle syscall.Token
+
+	// A place to put the size of the token information
+	var tokenInfoBufferSize uint32
+
+	// Get a handle for the current process
+	currentProcHandle, err := syscall.GetCurrentProcess()
+
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("Could not get a handle for the current process: ", err)
+		// {{end}}
+		return nil, err
+	}
+
+	// Get the process token from the current process
+	err = syscall.OpenProcessToken(currentProcHandle, syscall.TOKEN_QUERY, &tokenHandle)
+
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("Could not open process token: ", err)
+		// {{end}}
+		return nil, err
+	}
+
+	// Get the size of the token information buffer so we know how large of a buffer to allocate
+	// This produces an error about a data area passed to the syscall being too small, but
+	// we do not care about that because we just want to know how big of a buffer to make
+	syscall.GetTokenInformation(tokenHandle, syscall.TokenPrivileges, nil, 0, &tokenInfoBufferSize)
+
+	// Make the buffer and get token information
+	// Using a bytes Buffer so that we can Read from it later
+	tokenInfoBuffer := bytes.NewBuffer(make([]byte, tokenInfoBufferSize))
+
+	err = syscall.GetTokenInformation(tokenHandle,
+		syscall.TokenPrivileges,
+		&tokenInfoBuffer.Bytes()[0],
+		uint32(tokenInfoBuffer.Len()),
+		&tokenInfoBufferSize,
+	)
+
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("Error in call to GetTokenInformation: ", err)
+		// {{end}}
+		return nil, err
+	}
+
+	// The first 32 bits is the number of privileges in the structure
+	var privilegeCount uint32
+	err = binary.Read(tokenInfoBuffer, binary.LittleEndian, &privilegeCount)
+
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("Could not read the number of privileges from the token information.")
+		// {{end}}
+		return nil, err
+	}
+
+	/*
+		The remaining bytes contain the privileges themselves
+		LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY]
+		Structure of the array: https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-luid_and_attributes
+	*/
+
+	privInfo := make([]PrivilegeInfo, int(privilegeCount))
+
+	for index := 0; index < int(privilegeCount); index++ {
+		// Iterate over the privileges and make sense of them
+		// In case of errors, return what we have so far and the error
+
+		// LUIDs consist of a DWORD and a LONG
+		var luid uint64
+
+		// Attributes are up to 32 one bit flags, so a uint32 is good for that
+		var attributes uint32
+
+		var currentPrivInfo PrivilegeInfo
+
+		// Read the LUID
+		err = binary.Read(tokenInfoBuffer, binary.LittleEndian, &luid)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Println("Could not read the LUID from the binary stream: ", err)
+			// {{end}}
+			return privInfo, err
+		}
+
+		// Read the attributes
+		err = binary.Read(tokenInfoBuffer, binary.LittleEndian, &attributes)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Println("Could not read the attributes from the binary stream: ", err)
+			// {{end}}
+			return privInfo, err
+		}
+
+		currentPrivInfo.Name, currentPrivInfo.Description, err = lookupPrivilegeNameByLUID(luid)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Println("Could not get privilege info based on the LUID: ", err)
+			// {{end}}
+			return privInfo, err
+		}
+
+		// Figure out the attributes
+		currentPrivInfo.EnabledByDefault = (attributes & windows.SE_PRIVILEGE_ENABLED_BY_DEFAULT) > 0
+		currentPrivInfo.UsedForAccess = (attributes & windows.SE_PRIVILEGE_USED_FOR_ACCESS) > 0
+		currentPrivInfo.Enabled = (attributes & windows.SE_PRIVILEGE_ENABLED) > 0
+		currentPrivInfo.Removed = (attributes & windows.SE_PRIVILEGE_REMOVED) > 0
+
+		privInfo[index] = currentPrivInfo
+	}
+
+	return privInfo, nil
+}

implant/sliver/syscalls/syscalls_windows.go

@@ -35,3 +35,5 @@ package syscalls
 //sys SelectObject(hdc windows.Handle, h windows.Handle) (HGDIOBJ windows.Handle, err error) = Gdi32.SelectObject
 //sys BitBlt(hdc windows.Handle, x uint32, y uint32, cx uint32, cy uint32, hdcSrc windows.Handle, x1 uint32, y1 uint32, rop int32) (BOOL int, err error) = Gdi32.BitBlt
 //sys GetDIBits(hdc windows.Handle, hbm windows.Handle, start uint32, cLines uint32, lpvBits uintptr, lpbmi uintptr, usage int) (ret int, err error) = Gdi32.GetDIBits
+//sys LookupPrivilegeNameW(systemName string, luid *uint64, buffer *uint16, size *uint32) (err error) = advapi32.LookupPrivilegeNameW
+//sys LookupPrivilegeDisplayNameW(systemName string, privilegeName *uint16, buffer *uint16, size *uint32, languageId *uint32) (err error) = advapi32.LookupPrivilegeDisplayNameW

implant/sliver/syscalls/zsyscalls_windows.go

@@ -19,6 +19,7 @@ const (
 
 var (
 	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
+	errERROR_EINVAL     error = syscall.EINVAL
 )
 
 // errnoErr returns common boxed Errno values, to prevent
@@ -26,7 +27,7 @@ var (
 func errnoErr(e syscall.Errno) error {
 	switch e {
 	case 0:
-		return nil
+		return errERROR_EINVAL
 	case errnoERROR_IO_PENDING:
 		return errERROR_IO_PENDING
 	}
@@ -37,92 +38,228 @@ func errnoErr(e syscall.Errno) error {
 }
 
 var (
-	modkernel32 = windows.NewLazySystemDLL("kernel32.dll")
 	modDbgHelp  = windows.NewLazySystemDLL("DbgHelp.dll")
-	modadvapi32 = windows.NewLazySystemDLL("advapi32.dll")
-	modUser32   = windows.NewLazySystemDLL("User32.dll")
 	modGdi32    = windows.NewLazySystemDLL("Gdi32.dll")
 	modKernel32 = windows.NewLazySystemDLL("Kernel32.dll")
+	modUser32   = windows.NewLazySystemDLL("User32.dll")
+	modadvapi32 = windows.NewLazySystemDLL("advapi32.dll")
+	modkernel32 = windows.NewLazySystemDLL("kernel32.dll")
 
-	procInitializeProcThreadAttributeList = modkernel32.NewProc("InitializeProcThreadAttributeList")
-	procGetProcessHeap                    = modkernel32.NewProc("GetProcessHeap")
-	procHeapAlloc                         = modkernel32.NewProc("HeapAlloc")
-	procUpdateProcThreadAttribute         = modkernel32.NewProc("UpdateProcThreadAttribute")
-	procCreateProcessW                    = modkernel32.NewProc("CreateProcessW")
-	procVirtualAllocEx                    = modkernel32.NewProc("VirtualAllocEx")
-	procWriteProcessMemory                = modkernel32.NewProc("WriteProcessMemory")
-	procVirtualProtectEx                  = modkernel32.NewProc("VirtualProtectEx")
-	procQueueUserAPC                      = modkernel32.NewProc("QueueUserAPC")
-	procDeleteProcThreadAttributeList     = modkernel32.NewProc("DeleteProcThreadAttributeList")
-	procHeapFree                          = modkernel32.NewProc("HeapFree")
-	procCreateRemoteThread                = modkernel32.NewProc("CreateRemoteThread")
-	procCreateThread                      = modkernel32.NewProc("CreateThread")
-	procGetExitCodeThread                 = modkernel32.NewProc("GetExitCodeThread")
 	procMiniDumpWriteDump                 = modDbgHelp.NewProc("MiniDumpWriteDump")
-	procImpersonateLoggedOnUser           = modadvapi32.NewProc("ImpersonateLoggedOnUser")
-	procLogonUserW                        = modadvapi32.NewProc("LogonUserW")
-	procGetDC                             = modUser32.NewProc("GetDC")
-	procReleaseDC                         = modUser32.NewProc("ReleaseDC")
-	procCreateCompatibleDC                = modGdi32.NewProc("CreateCompatibleDC")
-	procGetDesktopWindow                  = modUser32.NewProc("GetDesktopWindow")
-	procDeleteDC                          = modGdi32.NewProc("DeleteDC")
+	procBitBlt                            = modGdi32.NewProc("BitBlt")
 	procCreateCompatibleBitmap            = modGdi32.NewProc("CreateCompatibleBitmap")
+	procCreateCompatibleDC                = modGdi32.NewProc("CreateCompatibleDC")
+	procDeleteDC                          = modGdi32.NewProc("DeleteDC")
 	procDeleteObject                      = modGdi32.NewProc("DeleteObject")
+	procGetDIBits                         = modGdi32.NewProc("GetDIBits")
+	procSelectObject                      = modGdi32.NewProc("SelectObject")
 	procGlobalAlloc                       = modKernel32.NewProc("GlobalAlloc")
 	procGlobalFree                        = modKernel32.NewProc("GlobalFree")
 	procGlobalLock                        = modKernel32.NewProc("GlobalLock")
 	procGlobalUnlock                      = modKernel32.NewProc("GlobalUnlock")
-	procSelectObject                      = modGdi32.NewProc("SelectObject")
-	procBitBlt                            = modGdi32.NewProc("BitBlt")
-	procGetDIBits                         = modGdi32.NewProc("GetDIBits")
+	procGetDC                             = modUser32.NewProc("GetDC")
+	procGetDesktopWindow                  = modUser32.NewProc("GetDesktopWindow")
+	procReleaseDC                         = modUser32.NewProc("ReleaseDC")
+	procImpersonateLoggedOnUser           = modadvapi32.NewProc("ImpersonateLoggedOnUser")
+	procLogonUserW                        = modadvapi32.NewProc("LogonUserW")
+	procLookupPrivilegeDisplayNameW       = modadvapi32.NewProc("LookupPrivilegeDisplayNameW")
+	procLookupPrivilegeNameW              = modadvapi32.NewProc("LookupPrivilegeNameW")
+	procCreateProcessW                    = modkernel32.NewProc("CreateProcessW")
+	procCreateRemoteThread                = modkernel32.NewProc("CreateRemoteThread")
+	procCreateThread                      = modkernel32.NewProc("CreateThread")
+	procDeleteProcThreadAttributeList     = modkernel32.NewProc("DeleteProcThreadAttributeList")
+	procGetExitCodeThread                 = modkernel32.NewProc("GetExitCodeThread")
+	procGetProcessHeap                    = modkernel32.NewProc("GetProcessHeap")
+	procHeapAlloc                         = modkernel32.NewProc("HeapAlloc")
+	procHeapFree                          = modkernel32.NewProc("HeapFree")
+	procInitializeProcThreadAttributeList = modkernel32.NewProc("InitializeProcThreadAttributeList")
+	procQueueUserAPC                      = modkernel32.NewProc("QueueUserAPC")
+	procUpdateProcThreadAttribute         = modkernel32.NewProc("UpdateProcThreadAttribute")
+	procVirtualAllocEx                    = modkernel32.NewProc("VirtualAllocEx")
+	procVirtualProtectEx                  = modkernel32.NewProc("VirtualProtectEx")
+	procWriteProcessMemory                = modkernel32.NewProc("WriteProcessMemory")
 )
 
-func InitializeProcThreadAttributeList(lpAttributeList *PROC_THREAD_ATTRIBUTE_LIST, dwAttributeCount uint32, dwFlags uint32, lpSize *uintptr) (err error) {
-	r1, _, e1 := syscall.Syscall6(procInitializeProcThreadAttributeList.Addr(), 4, uintptr(unsafe.Pointer(lpAttributeList)), uintptr(dwAttributeCount), uintptr(dwFlags), uintptr(unsafe.Pointer(lpSize)), 0, 0)
+func MiniDumpWriteDump(hProcess windows.Handle, pid uint32, hFile uintptr, dumpType uint32, exceptionParam uintptr, userStreamParam uintptr, callbackParam uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall9(procMiniDumpWriteDump.Addr(), 7, uintptr(hProcess), uintptr(pid), uintptr(hFile), uintptr(dumpType), uintptr(exceptionParam), uintptr(userStreamParam), uintptr(callbackParam), 0, 0)
 	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func GetProcessHeap() (procHeap windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procGetProcessHeap.Addr(), 0, 0, 0, 0)
-	procHeap = windows.Handle(r0)
-	if procHeap == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+func BitBlt(hdc windows.Handle, x uint32, y uint32, cx uint32, cy uint32, hdcSrc windows.Handle, x1 uint32, y1 uint32, rop int32) (BOOL int, err error) {
+	r0, _, e1 := syscall.Syscall9(procBitBlt.Addr(), 9, uintptr(hdc), uintptr(x), uintptr(y), uintptr(cx), uintptr(cy), uintptr(hdcSrc), uintptr(x1), uintptr(y1), uintptr(rop))
+	BOOL = int(r0)
+	if BOOL == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func HeapAlloc(hHeap windows.Handle, dwFlags uint32, dwBytes uintptr) (lpMem uintptr, err error) {
-	r0, _, e1 := syscall.Syscall(procHeapAlloc.Addr(), 3, uintptr(hHeap), uintptr(dwFlags), uintptr(dwBytes))
-	lpMem = uintptr(r0)
-	if lpMem == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+func CreateCompatibleBitmap(hdc windows.Handle, cx int, cy int) (HBITMAP windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procCreateCompatibleBitmap.Addr(), 3, uintptr(hdc), uintptr(cx), uintptr(cy))
+	HBITMAP = windows.Handle(r0)
+	if HBITMAP == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func UpdateProcThreadAttribute(lpAttributeList *PROC_THREAD_ATTRIBUTE_LIST, dwFlags uint32, attribute uintptr, lpValue *uintptr, cbSize uintptr, lpPreviousValue uintptr, lpReturnSize *uintptr) (err error) {
-	r1, _, e1 := syscall.Syscall9(procUpdateProcThreadAttribute.Addr(), 7, uintptr(unsafe.Pointer(lpAttributeList)), uintptr(dwFlags), uintptr(attribute), uintptr(unsafe.Pointer(lpValue)), uintptr(cbSize), uintptr(lpPreviousValue), uintptr(unsafe.Pointer(lpReturnSize)), 0, 0)
+func CreateCompatibleDC(hdc windows.Handle) (HDC windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procCreateCompatibleDC.Addr(), 1, uintptr(hdc), 0, 0)
+	HDC = windows.Handle(r0)
+	if HDC == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func DeleteDC(hdc windows.Handle) (BOOL uint32, err error) {
+	r0, _, e1 := syscall.Syscall(procDeleteDC.Addr(), 1, uintptr(hdc), 0, 0)
+	BOOL = uint32(r0)
+	if BOOL == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func DeleteObject(ho windows.Handle) (BOOL uint32, err error) {
+	r0, _, e1 := syscall.Syscall(procDeleteObject.Addr(), 1, uintptr(ho), 0, 0)
+	BOOL = uint32(r0)
+	if BOOL == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func GetDIBits(hdc windows.Handle, hbm windows.Handle, start uint32, cLines uint32, lpvBits uintptr, lpbmi uintptr, usage int) (ret int, err error) {
+	r0, _, e1 := syscall.Syscall9(procGetDIBits.Addr(), 7, uintptr(hdc), uintptr(hbm), uintptr(start), uintptr(cLines), uintptr(lpvBits), uintptr(lpbmi), uintptr(usage), 0, 0)
+	ret = int(r0)
+	if ret == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func SelectObject(hdc windows.Handle, h windows.Handle) (HGDIOBJ windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procSelectObject.Addr(), 2, uintptr(hdc), uintptr(h), 0)
+	HGDIOBJ = windows.Handle(r0)
+	if HGDIOBJ == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func GlobalAlloc(uFlags uint, dwBytes uintptr) (HGLOBAL windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procGlobalAlloc.Addr(), 2, uintptr(uFlags), uintptr(dwBytes), 0)
+	HGLOBAL = windows.Handle(r0)
+	if HGLOBAL == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func GlobalFree(hMem windows.Handle) (HGLOBAL windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procGlobalFree.Addr(), 1, uintptr(hMem), 0, 0)
+	HGLOBAL = windows.Handle(r0)
+	if HGLOBAL == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func GlobalLock(hMem windows.Handle) (LPVOID uintptr, err error) {
+	r0, _, e1 := syscall.Syscall(procGlobalLock.Addr(), 1, uintptr(hMem), 0, 0)
+	LPVOID = uintptr(r0)
+	if LPVOID == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func GlobalUnlock(hMem windows.Handle) (BOOL uint32, err error) {
+	r0, _, e1 := syscall.Syscall(procGlobalUnlock.Addr(), 1, uintptr(hMem), 0, 0)
+	BOOL = uint32(r0)
+	if BOOL == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func GetDC(HWND windows.Handle) (HDC windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procGetDC.Addr(), 1, uintptr(HWND), 0, 0)
+	HDC = windows.Handle(r0)
+	if HDC == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func GetDesktopWindow() (HWND windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procGetDesktopWindow.Addr(), 0, 0, 0, 0)
+	HWND = windows.Handle(r0)
+	if HWND == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func ReleaseDC(hWnd windows.Handle, hDC windows.Handle) (int uint32, err error) {
+	r0, _, e1 := syscall.Syscall(procReleaseDC.Addr(), 2, uintptr(hWnd), uintptr(hDC), 0)
+	int = uint32(r0)
+	if int == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func ImpersonateLoggedOnUser(hToken windows.Token) (err error) {
+	r1, _, e1 := syscall.Syscall(procImpersonateLoggedOnUser.Addr(), 1, uintptr(hToken), 0, 0)
 	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func LogonUser(lpszUsername *uint16, lpszDomain *uint16, lpszPassword *uint16, dwLogonType uint32, dwLogonProvider uint32, phToken *windows.Token) (err error) {
+	r1, _, e1 := syscall.Syscall6(procLogonUserW.Addr(), 6, uintptr(unsafe.Pointer(lpszUsername)), uintptr(unsafe.Pointer(lpszDomain)), uintptr(unsafe.Pointer(lpszPassword)), uintptr(dwLogonType), uintptr(dwLogonProvider), uintptr(unsafe.Pointer(phToken)))
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func LookupPrivilegeDisplayNameW(systemName string, privilegeName *uint16, buffer *uint16, size *uint32, languageId *uint32) (err error) {
+	var _p0 *uint16
+	_p0, err = syscall.UTF16PtrFromString(systemName)
+	if err != nil {
+		return
+	}
+	return _LookupPrivilegeDisplayNameW(_p0, privilegeName, buffer, size, languageId)
+}
+
+func _LookupPrivilegeDisplayNameW(systemName *uint16, privilegeName *uint16, buffer *uint16, size *uint32, languageId *uint32) (err error) {
+	r1, _, e1 := syscall.Syscall6(procLookupPrivilegeDisplayNameW.Addr(), 5, uintptr(unsafe.Pointer(systemName)), uintptr(unsafe.Pointer(privilegeName)), uintptr(unsafe.Pointer(buffer)), uintptr(unsafe.Pointer(size)), uintptr(unsafe.Pointer(languageId)), 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func LookupPrivilegeNameW(systemName string, luid *uint64, buffer *uint16, size *uint32) (err error) {
+	var _p0 *uint16
+	_p0, err = syscall.UTF16PtrFromString(systemName)
+	if err != nil {
+		return
+	}
+	return _LookupPrivilegeNameW(_p0, luid, buffer, size)
+}
+
+func _LookupPrivilegeNameW(systemName *uint16, luid *uint64, buffer *uint16, size *uint32) (err error) {
+	r1, _, e1 := syscall.Syscall6(procLookupPrivilegeNameW.Addr(), 4, uintptr(unsafe.Pointer(systemName)), uintptr(unsafe.Pointer(luid)), uintptr(unsafe.Pointer(buffer)), uintptr(unsafe.Pointer(size)), 0, 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -131,65 +268,28 @@ func CreateProcess(appName *uint16, commandLine *uint16, procSecurity *windows.S
 	var _p0 uint32
 	if inheritHandles {
 		_p0 = 1
-	} else {
-		_p0 = 0
 	}
 	r1, _, e1 := syscall.Syscall12(procCreateProcessW.Addr(), 10, uintptr(unsafe.Pointer(appName)), uintptr(unsafe.Pointer(commandLine)), uintptr(unsafe.Pointer(procSecurity)), uintptr(unsafe.Pointer(threadSecurity)), uintptr(_p0), uintptr(creationFlags), uintptr(unsafe.Pointer(env)), uintptr(unsafe.Pointer(currentDir)), uintptr(unsafe.Pointer(startupInfo)), uintptr(unsafe.Pointer(outProcInfo)), 0, 0)
 	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func VirtualAllocEx(hProcess windows.Handle, lpAddress uintptr, dwSize uintptr, flAllocationType uint32, flProtect uint32) (addr uintptr, err error) {
-	r0, _, e1 := syscall.Syscall6(procVirtualAllocEx.Addr(), 5, uintptr(hProcess), uintptr(lpAddress), uintptr(dwSize), uintptr(flAllocationType), uintptr(flProtect), 0)
-	addr = uintptr(r0)
-	if addr == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+func CreateRemoteThread(hProcess windows.Handle, lpThreadAttributes *windows.SecurityAttributes, dwStackSize uint32, lpStartAddress uintptr, lpParameter uintptr, dwCreationFlags uint32, lpThreadId *uint32) (threadHandle windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall9(procCreateRemoteThread.Addr(), 7, uintptr(hProcess), uintptr(unsafe.Pointer(lpThreadAttributes)), uintptr(dwStackSize), uintptr(lpStartAddress), uintptr(lpParameter), uintptr(dwCreationFlags), uintptr(unsafe.Pointer(lpThreadId)), 0, 0)
+	threadHandle = windows.Handle(r0)
+	if threadHandle == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func WriteProcessMemory(hProcess windows.Handle, lpBaseAddress uintptr, lpBuffer *byte, nSize uintptr, lpNumberOfBytesWritten *uintptr) (err error) {
-	r1, _, e1 := syscall.Syscall6(procWriteProcessMemory.Addr(), 5, uintptr(hProcess), uintptr(lpBaseAddress), uintptr(unsafe.Pointer(lpBuffer)), uintptr(nSize), uintptr(unsafe.Pointer(lpNumberOfBytesWritten)), 0)
-	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func VirtualProtectEx(hProcess windows.Handle, lpAddress uintptr, dwSize uintptr, flNewProtect uint32, lpflOldProtect *uint32) (err error) {
-	r1, _, e1 := syscall.Syscall6(procVirtualProtectEx.Addr(), 5, uintptr(hProcess), uintptr(lpAddress), uintptr(dwSize), uintptr(flNewProtect), uintptr(unsafe.Pointer(lpflOldProtect)), 0)
-	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func QueueUserAPC(pfnAPC uintptr, hThread windows.Handle, dwData uintptr) (err error) {
-	r1, _, e1 := syscall.Syscall(procQueueUserAPC.Addr(), 3, uintptr(pfnAPC), uintptr(hThread), uintptr(dwData))
-	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+func CreateThread(lpThreadAttributes *windows.SecurityAttributes, dwStackSize uint32, lpStartAddress uintptr, lpParameter uintptr, dwCreationFlags uint32, lpThreadId *uint32) (threadHandle windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall6(procCreateThread.Addr(), 6, uintptr(unsafe.Pointer(lpThreadAttributes)), uintptr(dwStackSize), uintptr(lpStartAddress), uintptr(lpParameter), uintptr(dwCreationFlags), uintptr(unsafe.Pointer(lpThreadId)))
+	threadHandle = windows.Handle(r0)
+	if threadHandle == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -199,270 +299,85 @@ func DeleteProcThreadAttributeList(lpAttributeList *PROC_THREAD_ATTRIBUTE_LIST)
 	return
 }
 
-func HeapFree(hHeap windows.Handle, dwFlags uint32, lpMem uintptr) (err error) {
-	r1, _, e1 := syscall.Syscall(procHeapFree.Addr(), 3, uintptr(hHeap), uintptr(dwFlags), uintptr(lpMem))
-	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func CreateRemoteThread(hProcess windows.Handle, lpThreadAttributes *windows.SecurityAttributes, dwStackSize uint32, lpStartAddress uintptr, lpParameter uintptr, dwCreationFlags uint32, lpThreadId *uint32) (threadHandle windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall9(procCreateRemoteThread.Addr(), 7, uintptr(hProcess), uintptr(unsafe.Pointer(lpThreadAttributes)), uintptr(dwStackSize), uintptr(lpStartAddress), uintptr(lpParameter), uintptr(dwCreationFlags), uintptr(unsafe.Pointer(lpThreadId)), 0, 0)
-	threadHandle = windows.Handle(r0)
-	if threadHandle == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func CreateThread(lpThreadAttributes *windows.SecurityAttributes, dwStackSize uint32, lpStartAddress uintptr, lpParameter uintptr, dwCreationFlags uint32, lpThreadId *uint32) (threadHandle windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall6(procCreateThread.Addr(), 6, uintptr(unsafe.Pointer(lpThreadAttributes)), uintptr(dwStackSize), uintptr(lpStartAddress), uintptr(lpParameter), uintptr(dwCreationFlags), uintptr(unsafe.Pointer(lpThreadId)))
-	threadHandle = windows.Handle(r0)
-	if threadHandle == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
 func GetExitCodeThread(hTread windows.Handle, lpExitCode *uint32) (err error) {
 	r1, _, e1 := syscall.Syscall(procGetExitCodeThread.Addr(), 2, uintptr(hTread), uintptr(unsafe.Pointer(lpExitCode)), 0)
 	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func MiniDumpWriteDump(hProcess windows.Handle, pid uint32, hFile uintptr, dumpType uint32, exceptionParam uintptr, userStreamParam uintptr, callbackParam uintptr) (err error) {
-	r1, _, e1 := syscall.Syscall9(procMiniDumpWriteDump.Addr(), 7, uintptr(hProcess), uintptr(pid), uintptr(hFile), uintptr(dumpType), uintptr(exceptionParam), uintptr(userStreamParam), uintptr(callbackParam), 0, 0)
+func GetProcessHeap() (procHeap windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procGetProcessHeap.Addr(), 0, 0, 0, 0)
+	procHeap = windows.Handle(r0)
+	if procHeap == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func HeapAlloc(hHeap windows.Handle, dwFlags uint32, dwBytes uintptr) (lpMem uintptr, err error) {
+	r0, _, e1 := syscall.Syscall(procHeapAlloc.Addr(), 3, uintptr(hHeap), uintptr(dwFlags), uintptr(dwBytes))
+	lpMem = uintptr(r0)
+	if lpMem == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func HeapFree(hHeap windows.Handle, dwFlags uint32, lpMem uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall(procHeapFree.Addr(), 3, uintptr(hHeap), uintptr(dwFlags), uintptr(lpMem))
 	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func ImpersonateLoggedOnUser(hToken windows.Token) (err error) {
-	r1, _, e1 := syscall.Syscall(procImpersonateLoggedOnUser.Addr(), 1, uintptr(hToken), 0, 0)
+func InitializeProcThreadAttributeList(lpAttributeList *PROC_THREAD_ATTRIBUTE_LIST, dwAttributeCount uint32, dwFlags uint32, lpSize *uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall6(procInitializeProcThreadAttributeList.Addr(), 4, uintptr(unsafe.Pointer(lpAttributeList)), uintptr(dwAttributeCount), uintptr(dwFlags), uintptr(unsafe.Pointer(lpSize)), 0, 0)
 	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func LogonUser(lpszUsername *uint16, lpszDomain *uint16, lpszPassword *uint16, dwLogonType uint32, dwLogonProvider uint32, phToken *windows.Token) (err error) {
-	r1, _, e1 := syscall.Syscall6(procLogonUserW.Addr(), 6, uintptr(unsafe.Pointer(lpszUsername)), uintptr(unsafe.Pointer(lpszDomain)), uintptr(unsafe.Pointer(lpszPassword)), uintptr(dwLogonType), uintptr(dwLogonProvider), uintptr(unsafe.Pointer(phToken)))
+func QueueUserAPC(pfnAPC uintptr, hThread windows.Handle, dwData uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall(procQueueUserAPC.Addr(), 3, uintptr(pfnAPC), uintptr(hThread), uintptr(dwData))
 	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func GetDC(HWND windows.Handle) (HDC windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procGetDC.Addr(), 1, uintptr(HWND), 0, 0)
-	HDC = windows.Handle(r0)
-	if HDC == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+func UpdateProcThreadAttribute(lpAttributeList *PROC_THREAD_ATTRIBUTE_LIST, dwFlags uint32, attribute uintptr, lpValue *uintptr, cbSize uintptr, lpPreviousValue uintptr, lpReturnSize *uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall9(procUpdateProcThreadAttribute.Addr(), 7, uintptr(unsafe.Pointer(lpAttributeList)), uintptr(dwFlags), uintptr(attribute), uintptr(unsafe.Pointer(lpValue)), uintptr(cbSize), uintptr(lpPreviousValue), uintptr(unsafe.Pointer(lpReturnSize)), 0, 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func ReleaseDC(hWnd windows.Handle, hDC windows.Handle) (int uint32, err error) {
-	r0, _, e1 := syscall.Syscall(procReleaseDC.Addr(), 2, uintptr(hWnd), uintptr(hDC), 0)
-	int = uint32(r0)
-	if int == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+func VirtualAllocEx(hProcess windows.Handle, lpAddress uintptr, dwSize uintptr, flAllocationType uint32, flProtect uint32) (addr uintptr, err error) {
+	r0, _, e1 := syscall.Syscall6(procVirtualAllocEx.Addr(), 5, uintptr(hProcess), uintptr(lpAddress), uintptr(dwSize), uintptr(flAllocationType), uintptr(flProtect), 0)
+	addr = uintptr(r0)
+	if addr == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func CreateCompatibleDC(hdc windows.Handle) (HDC windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procCreateCompatibleDC.Addr(), 1, uintptr(hdc), 0, 0)
-	HDC = windows.Handle(r0)
-	if HDC == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+func VirtualProtectEx(hProcess windows.Handle, lpAddress uintptr, dwSize uintptr, flNewProtect uint32, lpflOldProtect *uint32) (err error) {
+	r1, _, e1 := syscall.Syscall6(procVirtualProtectEx.Addr(), 5, uintptr(hProcess), uintptr(lpAddress), uintptr(dwSize), uintptr(flNewProtect), uintptr(unsafe.Pointer(lpflOldProtect)), 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func GetDesktopWindow() (HWND windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procGetDesktopWindow.Addr(), 0, 0, 0, 0)
-	HWND = windows.Handle(r0)
-	if HWND == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func DeleteDC(hdc windows.Handle) (BOOL uint32, err error) {
-	r0, _, e1 := syscall.Syscall(procDeleteDC.Addr(), 1, uintptr(hdc), 0, 0)
-	BOOL = uint32(r0)
-	if BOOL == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func CreateCompatibleBitmap(hdc windows.Handle, cx int, cy int) (HBITMAP windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procCreateCompatibleBitmap.Addr(), 3, uintptr(hdc), uintptr(cx), uintptr(cy))
-	HBITMAP = windows.Handle(r0)
-	if HBITMAP == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func DeleteObject(ho windows.Handle) (BOOL uint32, err error) {
-	r0, _, e1 := syscall.Syscall(procDeleteObject.Addr(), 1, uintptr(ho), 0, 0)
-	BOOL = uint32(r0)
-	if BOOL == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func GlobalAlloc(uFlags uint, dwBytes uintptr) (HGLOBAL windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procGlobalAlloc.Addr(), 2, uintptr(uFlags), uintptr(dwBytes), 0)
-	HGLOBAL = windows.Handle(r0)
-	if HGLOBAL == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func GlobalFree(hMem windows.Handle) (HGLOBAL windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procGlobalFree.Addr(), 1, uintptr(hMem), 0, 0)
-	HGLOBAL = windows.Handle(r0)
-	if HGLOBAL == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func GlobalLock(hMem windows.Handle) (LPVOID uintptr, err error) {
-	r0, _, e1 := syscall.Syscall(procGlobalLock.Addr(), 1, uintptr(hMem), 0, 0)
-	LPVOID = uintptr(r0)
-	if LPVOID == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func GlobalUnlock(hMem windows.Handle) (BOOL uint32, err error) {
-	r0, _, e1 := syscall.Syscall(procGlobalUnlock.Addr(), 1, uintptr(hMem), 0, 0)
-	BOOL = uint32(r0)
-	if BOOL == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func SelectObject(hdc windows.Handle, h windows.Handle) (HGDIOBJ windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procSelectObject.Addr(), 2, uintptr(hdc), uintptr(h), 0)
-	HGDIOBJ = windows.Handle(r0)
-	if HGDIOBJ == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func BitBlt(hdc windows.Handle, x uint32, y uint32, cx uint32, cy uint32, hdcSrc windows.Handle, x1 uint32, y1 uint32, rop int32) (BOOL int, err error) {
-	r0, _, e1 := syscall.Syscall9(procBitBlt.Addr(), 9, uintptr(hdc), uintptr(x), uintptr(y), uintptr(cx), uintptr(cy), uintptr(hdcSrc), uintptr(x1), uintptr(y1), uintptr(rop))
-	BOOL = int(r0)
-	if BOOL == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func GetDIBits(hdc windows.Handle, hbm windows.Handle, start uint32, cLines uint32, lpvBits uintptr, lpbmi uintptr, usage int) (ret int, err error) {
-	r0, _, e1 := syscall.Syscall9(procGetDIBits.Addr(), 7, uintptr(hdc), uintptr(hbm), uintptr(start), uintptr(cLines), uintptr(lpvBits), uintptr(lpbmi), uintptr(usage), 0, 0)
-	ret = int(r0)
-	if ret == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+func WriteProcessMemory(hProcess windows.Handle, lpBaseAddress uintptr, lpBuffer *byte, nSize uintptr, lpNumberOfBytesWritten *uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall6(procWriteProcessMemory.Addr(), 5, uintptr(hProcess), uintptr(lpBaseAddress), uintptr(unsafe.Pointer(lpBuffer)), uintptr(nSize), uintptr(unsafe.Pointer(lpNumberOfBytesWritten)), 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }

protobuf/clientpb/client.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.26.0
-// 	protoc        v3.17.3
+// 	protoc        v3.15.8
 // source: clientpb/client.proto
 
 package clientpb

protobuf/commonpb/common.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.26.0
-// 	protoc        v3.17.3
+// 	protoc        v3.15.8
 // source: commonpb/common.proto
 
 package commonpb

protobuf/rpcpb/services.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.26.0
-// 	protoc        v3.17.3
+// 	protoc        v3.15.8
 // source: rpcpb/services.proto
 
 package rpcpb
@@ -31,7 +31,7 @@ var file_rpcpb_services_proto_rawDesc = []byte{
 	0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2f, 0x73,
 	0x6c, 0x69, 0x76, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x63, 0x6c, 0x69,
 	0x65, 0x6e, 0x74, 0x70, 0x62, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x32, 0xa4, 0x2b, 0x0a, 0x09, 0x53, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x52, 0x50, 0x43,
+	0x74, 0x6f, 0x32, 0x86, 0x2d, 0x0a, 0x09, 0x53, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x52, 0x50, 0x43,
 	0x12, 0x30, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x0f,
 	0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a,
 	0x11, 0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x70, 0x62, 0x2e, 0x56, 0x65, 0x72, 0x73, 0x69,
@@ -323,64 +323,79 @@ var file_rpcpb_services_proto_rawDesc = []byte{
 	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79,
 	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x1a, 0x1b, 0x2e, 0x73,
 	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x3e, 0x0a, 0x0d, 0x52, 0x75, 0x6e,
-	0x53, 0x53, 0x48, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12, 0x17, 0x2e, 0x73, 0x6c, 0x69,
-	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64,
-	0x52, 0x65, 0x71, 0x1a, 0x14, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53,
-	0x53, 0x48, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12, 0x38, 0x0a, 0x09, 0x48, 0x69, 0x6a,
-	0x61, 0x63, 0x6b, 0x44, 0x4c, 0x4c, 0x12, 0x16, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70,
-	0x62, 0x2e, 0x44, 0x6c, 0x6c, 0x48, 0x69, 0x6a, 0x61, 0x63, 0x6b, 0x52, 0x65, 0x71, 0x1a, 0x13,
-	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x44, 0x6c, 0x6c, 0x48, 0x69, 0x6a,
-	0x61, 0x63, 0x6b, 0x12, 0x4e, 0x0a, 0x12, 0x57, 0x47, 0x53, 0x74, 0x61, 0x72, 0x74, 0x50, 0x6f,
-	0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x1f, 0x2e, 0x73, 0x6c, 0x69, 0x76,
-	0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61,
-	0x72, 0x64, 0x53, 0x74, 0x61, 0x72, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x73, 0x6c, 0x69,
+	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x54, 0x0a, 0x13, 0x52, 0x65, 0x67,
+	0x69, 0x73, 0x74, 0x72, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x73,
+	0x12, 0x1f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69,
+	0x73, 0x74, 0x72, 0x79, 0x53, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65,
+	0x71, 0x1a, 0x1c, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67,
+	0x69, 0x73, 0x74, 0x72, 0x79, 0x53, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x12,
+	0x53, 0x0a, 0x12, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x1f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
+	0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x1c, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70,
+	0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73,
+	0x4c, 0x69, 0x73, 0x74, 0x12, 0x3e, 0x0a, 0x0d, 0x52, 0x75, 0x6e, 0x53, 0x53, 0x48, 0x43, 0x6f,
+	0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12, 0x17, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
+	0x2e, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x52, 0x65, 0x71, 0x1a, 0x14,
+	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6d,
+	0x6d, 0x61, 0x6e, 0x64, 0x12, 0x38, 0x0a, 0x09, 0x48, 0x69, 0x6a, 0x61, 0x63, 0x6b, 0x44, 0x4c,
+	0x4c, 0x12, 0x16, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x44, 0x6c, 0x6c,
+	0x48, 0x69, 0x6a, 0x61, 0x63, 0x6b, 0x52, 0x65, 0x71, 0x1a, 0x13, 0x2e, 0x73, 0x6c, 0x69, 0x76,
+	0x65, 0x72, 0x70, 0x62, 0x2e, 0x44, 0x6c, 0x6c, 0x48, 0x69, 0x6a, 0x61, 0x63, 0x6b, 0x12, 0x35,
+	0x0a, 0x08, 0x47, 0x65, 0x74, 0x50, 0x72, 0x69, 0x76, 0x73, 0x12, 0x15, 0x2e, 0x73, 0x6c, 0x69,
+	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x69, 0x76, 0x73, 0x52, 0x65,
+	0x71, 0x1a, 0x12, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x47, 0x65, 0x74,
+	0x50, 0x72, 0x69, 0x76, 0x73, 0x12, 0x4e, 0x0a, 0x12, 0x57, 0x47, 0x53, 0x74, 0x61, 0x72, 0x74,
+	0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x1f, 0x2e, 0x73, 0x6c,
+	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72,
+	0x77, 0x61, 0x72, 0x64, 0x53, 0x74, 0x61, 0x72, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x73,
+	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f,
+	0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x4c, 0x0a, 0x11, 0x57, 0x47, 0x53, 0x74, 0x6f, 0x70, 0x50,
+	0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x1e, 0x2e, 0x73, 0x6c, 0x69,
 	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77,
-	0x61, 0x72, 0x64, 0x12, 0x4c, 0x0a, 0x11, 0x57, 0x47, 0x53, 0x74, 0x6f, 0x70, 0x50, 0x6f, 0x72,
-	0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x1e, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65,
-	0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72,
-	0x64, 0x53, 0x74, 0x6f, 0x70, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65,
-	0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72,
-	0x64, 0x12, 0x3c, 0x0a, 0x0c, 0x57, 0x47, 0x53, 0x74, 0x61, 0x72, 0x74, 0x53, 0x6f, 0x63, 0x6b,
-	0x73, 0x12, 0x19, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53,
-	0x6f, 0x63, 0x6b, 0x73, 0x53, 0x74, 0x61, 0x72, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x73,
-	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12,
-	0x3a, 0x0a, 0x0b, 0x57, 0x47, 0x53, 0x74, 0x6f, 0x70, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x18,
+	0x61, 0x72, 0x64, 0x53, 0x74, 0x6f, 0x70, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x73, 0x6c, 0x69,
+	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77,
+	0x61, 0x72, 0x64, 0x12, 0x3c, 0x0a, 0x0c, 0x57, 0x47, 0x53, 0x74, 0x61, 0x72, 0x74, 0x53, 0x6f,
+	0x63, 0x6b, 0x73, 0x12, 0x19, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57,
+	0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x74, 0x61, 0x72, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x11,
 	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b,
-	0x73, 0x53, 0x74, 0x6f, 0x70, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65,
-	0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x4b, 0x0a, 0x10, 0x57,
-	0x47, 0x4c, 0x69, 0x73, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x73, 0x12,
-	0x1c, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x54, 0x43, 0x50,
-	0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x19, 0x2e,
-	0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x54, 0x43, 0x50, 0x46, 0x6f,
-	0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x73, 0x12, 0x4b, 0x0a, 0x12, 0x57, 0x47, 0x4c, 0x69,
-	0x73, 0x74, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x1b,
-	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b,
-	0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x18, 0x2e, 0x73, 0x6c,
-	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x2c, 0x0a, 0x05, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x12, 0x12,
-	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x52,
-	0x65, 0x71, 0x1a, 0x0f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x68,
-	0x65, 0x6c, 0x6c, 0x12, 0x32, 0x0a, 0x07, 0x50, 0x6f, 0x72, 0x74, 0x66, 0x77, 0x64, 0x12, 0x14,
-	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x66, 0x77,
-	0x64, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e,
-	0x50, 0x6f, 0x72, 0x74, 0x66, 0x77, 0x64, 0x12, 0x32, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74,
-	0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x10, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72,
-	0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x1a, 0x10, 0x2e, 0x73, 0x6c, 0x69, 0x76,
-	0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x30, 0x0a, 0x0b, 0x43,
-	0x6c, 0x6f, 0x73, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x10, 0x2e, 0x73, 0x6c, 0x69,
-	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x1a, 0x0f, 0x2e, 0x63,
-	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x3c, 0x0a,
-	0x0a, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x12, 0x14, 0x2e, 0x73, 0x6c,
-	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x44, 0x61, 0x74,
-	0x61, 0x1a, 0x14, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e,
-	0x6e, 0x65, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x28, 0x01, 0x30, 0x01, 0x12, 0x2c, 0x0a, 0x06, 0x45,
-	0x76, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x0f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62,
-	0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0f, 0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x70,
-	0x62, 0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x30, 0x01, 0x42, 0x2c, 0x5a, 0x2a, 0x67, 0x69, 0x74,
-	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x62, 0x69, 0x73, 0x68, 0x6f, 0x70, 0x66, 0x6f,
-	0x78, 0x2f, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2f, 0x72, 0x70, 0x63, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x73, 0x12, 0x3a, 0x0a, 0x0b, 0x57, 0x47, 0x53, 0x74, 0x6f, 0x70, 0x53, 0x6f, 0x63, 0x6b, 0x73,
+	0x12, 0x18, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f,
+	0x63, 0x6b, 0x73, 0x53, 0x74, 0x6f, 0x70, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x73, 0x6c, 0x69,
+	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x4b, 0x0a,
+	0x10, 0x57, 0x47, 0x4c, 0x69, 0x73, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72,
+	0x73, 0x12, 0x1c, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x54,
+	0x43, 0x50, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x1a,
+	0x19, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x54, 0x43, 0x50,
+	0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x73, 0x12, 0x4b, 0x0a, 0x12, 0x57, 0x47,
+	0x4c, 0x69, 0x73, 0x74, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73,
+	0x12, 0x1b, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f,
+	0x63, 0x6b, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x18, 0x2e,
+	0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73,
+	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x2c, 0x0a, 0x05, 0x53, 0x68, 0x65, 0x6c, 0x6c,
+	0x12, 0x12, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x68, 0x65, 0x6c,
+	0x6c, 0x52, 0x65, 0x71, 0x1a, 0x0f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e,
+	0x53, 0x68, 0x65, 0x6c, 0x6c, 0x12, 0x32, 0x0a, 0x07, 0x50, 0x6f, 0x72, 0x74, 0x66, 0x77, 0x64,
+	0x12, 0x14, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x50, 0x6f, 0x72, 0x74,
+	0x66, 0x77, 0x64, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70,
+	0x62, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x66, 0x77, 0x64, 0x12, 0x32, 0x0a, 0x0c, 0x43, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x10, 0x2e, 0x73, 0x6c, 0x69, 0x76,
+	0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x1a, 0x10, 0x2e, 0x73, 0x6c,
+	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x30, 0x0a,
+	0x0b, 0x43, 0x6c, 0x6f, 0x73, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x10, 0x2e, 0x73,
+	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x1a, 0x0f,
+	0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12,
+	0x3c, 0x0a, 0x0a, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x12, 0x14, 0x2e,
+	0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x44,
+	0x61, 0x74, 0x61, 0x1a, 0x14, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54,
+	0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x28, 0x01, 0x30, 0x01, 0x12, 0x2c, 0x0a,
+	0x06, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x0f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
+	0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0f, 0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e,
+	0x74, 0x70, 0x62, 0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x30, 0x01, 0x42, 0x2c, 0x5a, 0x2a, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x62, 0x69, 0x73, 0x68, 0x6f, 0x70,
+	0x66, 0x6f, 0x78, 0x2f, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2f, 0x72, 0x70, 0x63, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
 }
 
 var file_rpcpb_services_proto_goTypes = []interface{}{
@@ -444,84 +459,90 @@ var file_rpcpb_services_proto_goTypes = []interface{}{
 	(*sliverpb.RegistryReadReq)(nil),       // 57: sliverpb.RegistryReadReq
 	(*sliverpb.RegistryWriteReq)(nil),      // 58: sliverpb.RegistryWriteReq
 	(*sliverpb.RegistryCreateKeyReq)(nil),  // 59: sliverpb.RegistryCreateKeyReq
-	(*sliverpb.SSHCommandReq)(nil),         // 60: sliverpb.SSHCommandReq
-	(*sliverpb.DllHijackReq)(nil),          // 61: sliverpb.DllHijackReq
-	(*sliverpb.WGPortForwardStartReq)(nil), // 62: sliverpb.WGPortForwardStartReq
-	(*sliverpb.WGPortForwardStopReq)(nil),  // 63: sliverpb.WGPortForwardStopReq
-	(*sliverpb.WGSocksStartReq)(nil),       // 64: sliverpb.WGSocksStartReq
-	(*sliverpb.WGSocksStopReq)(nil),        // 65: sliverpb.WGSocksStopReq
-	(*sliverpb.WGTCPForwardersReq)(nil),    // 66: sliverpb.WGTCPForwardersReq
-	(*sliverpb.WGSocksServersReq)(nil),     // 67: sliverpb.WGSocksServersReq
-	(*sliverpb.ShellReq)(nil),              // 68: sliverpb.ShellReq
-	(*sliverpb.PortfwdReq)(nil),            // 69: sliverpb.PortfwdReq
-	(*sliverpb.Tunnel)(nil),                // 70: sliverpb.Tunnel
-	(*sliverpb.TunnelData)(nil),            // 71: sliverpb.TunnelData
-	(*clientpb.Version)(nil),               // 72: clientpb.Version
-	(*clientpb.Operators)(nil),             // 73: clientpb.Operators
-	(*clientpb.Sessions)(nil),              // 74: clientpb.Sessions
-	(*clientpb.Session)(nil),               // 75: clientpb.Session
-	(*commonpb.Response)(nil),              // 76: commonpb.Response
-	(*clientpb.Jobs)(nil),                  // 77: clientpb.Jobs
-	(*clientpb.KillJob)(nil),               // 78: clientpb.KillJob
-	(*clientpb.MTLSListener)(nil),          // 79: clientpb.MTLSListener
-	(*clientpb.WGListener)(nil),            // 80: clientpb.WGListener
-	(*clientpb.DNSListener)(nil),           // 81: clientpb.DNSListener
-	(*clientpb.HTTPListener)(nil),          // 82: clientpb.HTTPListener
-	(*clientpb.StagerListener)(nil),        // 83: clientpb.StagerListener
-	(*clientpb.AllLoot)(nil),               // 84: clientpb.AllLoot
-	(*clientpb.Generate)(nil),              // 85: clientpb.Generate
-	(*clientpb.ImplantBuilds)(nil),         // 86: clientpb.ImplantBuilds
-	(*clientpb.Canaries)(nil),              // 87: clientpb.Canaries
-	(*clientpb.WGClientConfig)(nil),        // 88: clientpb.WGClientConfig
-	(*clientpb.UniqueWGIP)(nil),            // 89: clientpb.UniqueWGIP
-	(*clientpb.ImplantProfiles)(nil),       // 90: clientpb.ImplantProfiles
-	(*clientpb.MsfStager)(nil),             // 91: clientpb.MsfStager
-	(*clientpb.ShellcodeRDI)(nil),          // 92: clientpb.ShellcodeRDI
-	(*clientpb.Compiler)(nil),              // 93: clientpb.Compiler
-	(*clientpb.Websites)(nil),              // 94: clientpb.Websites
-	(*sliverpb.Ps)(nil),                    // 95: sliverpb.Ps
-	(*sliverpb.Terminate)(nil),             // 96: sliverpb.Terminate
-	(*sliverpb.Ifconfig)(nil),              // 97: sliverpb.Ifconfig
-	(*sliverpb.Netstat)(nil),               // 98: sliverpb.Netstat
-	(*sliverpb.Ls)(nil),                    // 99: sliverpb.Ls
-	(*sliverpb.Pwd)(nil),                   // 100: sliverpb.Pwd
-	(*sliverpb.Rm)(nil),                    // 101: sliverpb.Rm
-	(*sliverpb.Mkdir)(nil),                 // 102: sliverpb.Mkdir
-	(*sliverpb.Download)(nil),              // 103: sliverpb.Download
-	(*sliverpb.Upload)(nil),                // 104: sliverpb.Upload
-	(*sliverpb.ProcessDump)(nil),           // 105: sliverpb.ProcessDump
-	(*sliverpb.RunAs)(nil),                 // 106: sliverpb.RunAs
-	(*sliverpb.Impersonate)(nil),           // 107: sliverpb.Impersonate
-	(*sliverpb.RevToSelf)(nil),             // 108: sliverpb.RevToSelf
-	(*sliverpb.GetSystem)(nil),             // 109: sliverpb.GetSystem
-	(*sliverpb.Task)(nil),                  // 110: sliverpb.Task
-	(*sliverpb.ExecuteAssembly)(nil),       // 111: sliverpb.ExecuteAssembly
-	(*sliverpb.Migrate)(nil),               // 112: sliverpb.Migrate
-	(*sliverpb.Execute)(nil),               // 113: sliverpb.Execute
-	(*sliverpb.Sideload)(nil),              // 114: sliverpb.Sideload
-	(*sliverpb.SpawnDll)(nil),              // 115: sliverpb.SpawnDll
-	(*sliverpb.Screenshot)(nil),            // 116: sliverpb.Screenshot
-	(*sliverpb.NamedPipes)(nil),            // 117: sliverpb.NamedPipes
-	(*sliverpb.TCPPivot)(nil),              // 118: sliverpb.TCPPivot
-	(*sliverpb.PivotList)(nil),             // 119: sliverpb.PivotList
-	(*sliverpb.ServiceInfo)(nil),           // 120: sliverpb.ServiceInfo
-	(*sliverpb.MakeToken)(nil),             // 121: sliverpb.MakeToken
-	(*sliverpb.EnvInfo)(nil),               // 122: sliverpb.EnvInfo
-	(*sliverpb.SetEnv)(nil),                // 123: sliverpb.SetEnv
-	(*sliverpb.UnsetEnv)(nil),              // 124: sliverpb.UnsetEnv
-	(*sliverpb.Backdoor)(nil),              // 125: sliverpb.Backdoor
-	(*sliverpb.RegistryRead)(nil),          // 126: sliverpb.RegistryRead
-	(*sliverpb.RegistryWrite)(nil),         // 127: sliverpb.RegistryWrite
-	(*sliverpb.RegistryCreateKey)(nil),     // 128: sliverpb.RegistryCreateKey
-	(*sliverpb.SSHCommand)(nil),            // 129: sliverpb.SSHCommand
-	(*sliverpb.DllHijack)(nil),             // 130: sliverpb.DllHijack
-	(*sliverpb.WGPortForward)(nil),         // 131: sliverpb.WGPortForward
-	(*sliverpb.WGSocks)(nil),               // 132: sliverpb.WGSocks
-	(*sliverpb.WGTCPForwarders)(nil),       // 133: sliverpb.WGTCPForwarders
-	(*sliverpb.WGSocksServers)(nil),        // 134: sliverpb.WGSocksServers
-	(*sliverpb.Shell)(nil),                 // 135: sliverpb.Shell
-	(*sliverpb.Portfwd)(nil),               // 136: sliverpb.Portfwd
-	(*clientpb.Event)(nil),                 // 137: clientpb.Event
+	(*sliverpb.RegistrySubKeyListReq)(nil), // 60: sliverpb.RegistrySubKeyListReq
+	(*sliverpb.RegistryListValuesReq)(nil), // 61: sliverpb.RegistryListValuesReq
+	(*sliverpb.SSHCommandReq)(nil),         // 62: sliverpb.SSHCommandReq
+	(*sliverpb.DllHijackReq)(nil),          // 63: sliverpb.DllHijackReq
+	(*sliverpb.GetPrivsReq)(nil),           // 64: sliverpb.GetPrivsReq
+	(*sliverpb.WGPortForwardStartReq)(nil), // 65: sliverpb.WGPortForwardStartReq
+	(*sliverpb.WGPortForwardStopReq)(nil),  // 66: sliverpb.WGPortForwardStopReq
+	(*sliverpb.WGSocksStartReq)(nil),       // 67: sliverpb.WGSocksStartReq
+	(*sliverpb.WGSocksStopReq)(nil),        // 68: sliverpb.WGSocksStopReq
+	(*sliverpb.WGTCPForwardersReq)(nil),    // 69: sliverpb.WGTCPForwardersReq
+	(*sliverpb.WGSocksServersReq)(nil),     // 70: sliverpb.WGSocksServersReq
+	(*sliverpb.ShellReq)(nil),              // 71: sliverpb.ShellReq
+	(*sliverpb.PortfwdReq)(nil),            // 72: sliverpb.PortfwdReq
+	(*sliverpb.Tunnel)(nil),                // 73: sliverpb.Tunnel
+	(*sliverpb.TunnelData)(nil),            // 74: sliverpb.TunnelData
+	(*clientpb.Version)(nil),               // 75: clientpb.Version
+	(*clientpb.Operators)(nil),             // 76: clientpb.Operators
+	(*clientpb.Sessions)(nil),              // 77: clientpb.Sessions
+	(*clientpb.Session)(nil),               // 78: clientpb.Session
+	(*commonpb.Response)(nil),              // 79: commonpb.Response
+	(*clientpb.Jobs)(nil),                  // 80: clientpb.Jobs
+	(*clientpb.KillJob)(nil),               // 81: clientpb.KillJob
+	(*clientpb.MTLSListener)(nil),          // 82: clientpb.MTLSListener
+	(*clientpb.WGListener)(nil),            // 83: clientpb.WGListener
+	(*clientpb.DNSListener)(nil),           // 84: clientpb.DNSListener
+	(*clientpb.HTTPListener)(nil),          // 85: clientpb.HTTPListener
+	(*clientpb.StagerListener)(nil),        // 86: clientpb.StagerListener
+	(*clientpb.AllLoot)(nil),               // 87: clientpb.AllLoot
+	(*clientpb.Generate)(nil),              // 88: clientpb.Generate
+	(*clientpb.ImplantBuilds)(nil),         // 89: clientpb.ImplantBuilds
+	(*clientpb.Canaries)(nil),              // 90: clientpb.Canaries
+	(*clientpb.WGClientConfig)(nil),        // 91: clientpb.WGClientConfig
+	(*clientpb.UniqueWGIP)(nil),            // 92: clientpb.UniqueWGIP
+	(*clientpb.ImplantProfiles)(nil),       // 93: clientpb.ImplantProfiles
+	(*clientpb.MsfStager)(nil),             // 94: clientpb.MsfStager
+	(*clientpb.ShellcodeRDI)(nil),          // 95: clientpb.ShellcodeRDI
+	(*clientpb.Compiler)(nil),              // 96: clientpb.Compiler
+	(*clientpb.Websites)(nil),              // 97: clientpb.Websites
+	(*sliverpb.Ps)(nil),                    // 98: sliverpb.Ps
+	(*sliverpb.Terminate)(nil),             // 99: sliverpb.Terminate
+	(*sliverpb.Ifconfig)(nil),              // 100: sliverpb.Ifconfig
+	(*sliverpb.Netstat)(nil),               // 101: sliverpb.Netstat
+	(*sliverpb.Ls)(nil),                    // 102: sliverpb.Ls
+	(*sliverpb.Pwd)(nil),                   // 103: sliverpb.Pwd
+	(*sliverpb.Rm)(nil),                    // 104: sliverpb.Rm
+	(*sliverpb.Mkdir)(nil),                 // 105: sliverpb.Mkdir
+	(*sliverpb.Download)(nil),              // 106: sliverpb.Download
+	(*sliverpb.Upload)(nil),                // 107: sliverpb.Upload
+	(*sliverpb.ProcessDump)(nil),           // 108: sliverpb.ProcessDump
+	(*sliverpb.RunAs)(nil),                 // 109: sliverpb.RunAs
+	(*sliverpb.Impersonate)(nil),           // 110: sliverpb.Impersonate
+	(*sliverpb.RevToSelf)(nil),             // 111: sliverpb.RevToSelf
+	(*sliverpb.GetSystem)(nil),             // 112: sliverpb.GetSystem
+	(*sliverpb.Task)(nil),                  // 113: sliverpb.Task
+	(*sliverpb.ExecuteAssembly)(nil),       // 114: sliverpb.ExecuteAssembly
+	(*sliverpb.Migrate)(nil),               // 115: sliverpb.Migrate
+	(*sliverpb.Execute)(nil),               // 116: sliverpb.Execute
+	(*sliverpb.Sideload)(nil),              // 117: sliverpb.Sideload
+	(*sliverpb.SpawnDll)(nil),              // 118: sliverpb.SpawnDll
+	(*sliverpb.Screenshot)(nil),            // 119: sliverpb.Screenshot
+	(*sliverpb.NamedPipes)(nil),            // 120: sliverpb.NamedPipes
+	(*sliverpb.TCPPivot)(nil),              // 121: sliverpb.TCPPivot
+	(*sliverpb.PivotList)(nil),             // 122: sliverpb.PivotList
+	(*sliverpb.ServiceInfo)(nil),           // 123: sliverpb.ServiceInfo
+	(*sliverpb.MakeToken)(nil),             // 124: sliverpb.MakeToken
+	(*sliverpb.EnvInfo)(nil),               // 125: sliverpb.EnvInfo
+	(*sliverpb.SetEnv)(nil),                // 126: sliverpb.SetEnv
+	(*sliverpb.UnsetEnv)(nil),              // 127: sliverpb.UnsetEnv
+	(*sliverpb.Backdoor)(nil),              // 128: sliverpb.Backdoor
+	(*sliverpb.RegistryRead)(nil),          // 129: sliverpb.RegistryRead
+	(*sliverpb.RegistryWrite)(nil),         // 130: sliverpb.RegistryWrite
+	(*sliverpb.RegistryCreateKey)(nil),     // 131: sliverpb.RegistryCreateKey
+	(*sliverpb.RegistrySubKeyList)(nil),    // 132: sliverpb.RegistrySubKeyList
+	(*sliverpb.RegistryValuesList)(nil),    // 133: sliverpb.RegistryValuesList
+	(*sliverpb.SSHCommand)(nil),            // 134: sliverpb.SSHCommand
+	(*sliverpb.DllHijack)(nil),             // 135: sliverpb.DllHijack
+	(*sliverpb.GetPrivs)(nil),              // 136: sliverpb.GetPrivs
+	(*sliverpb.WGPortForward)(nil),         // 137: sliverpb.WGPortForward
+	(*sliverpb.WGSocks)(nil),               // 138: sliverpb.WGSocks
+	(*sliverpb.WGTCPForwarders)(nil),       // 139: sliverpb.WGTCPForwarders
+	(*sliverpb.WGSocksServers)(nil),        // 140: sliverpb.WGSocksServers
+	(*sliverpb.Shell)(nil),                 // 141: sliverpb.Shell
+	(*sliverpb.Portfwd)(nil),               // 142: sliverpb.Portfwd
+	(*clientpb.Event)(nil),                 // 143: clientpb.Event
 }
 var file_rpcpb_services_proto_depIdxs = []int32{
 	0,   // 0: rpcpb.SliverRPC.GetVersion:input_type -> commonpb.Empty
@@ -606,118 +627,124 @@ var file_rpcpb_services_proto_depIdxs = []int32{
 	57,  // 79: rpcpb.SliverRPC.RegistryRead:input_type -> sliverpb.RegistryReadReq
 	58,  // 80: rpcpb.SliverRPC.RegistryWrite:input_type -> sliverpb.RegistryWriteReq
 	59,  // 81: rpcpb.SliverRPC.RegistryCreateKey:input_type -> sliverpb.RegistryCreateKeyReq
-	60,  // 82: rpcpb.SliverRPC.RunSSHCommand:input_type -> sliverpb.SSHCommandReq
-	61,  // 83: rpcpb.SliverRPC.HijackDLL:input_type -> sliverpb.DllHijackReq
-	62,  // 84: rpcpb.SliverRPC.WGStartPortForward:input_type -> sliverpb.WGPortForwardStartReq
-	63,  // 85: rpcpb.SliverRPC.WGStopPortForward:input_type -> sliverpb.WGPortForwardStopReq
-	64,  // 86: rpcpb.SliverRPC.WGStartSocks:input_type -> sliverpb.WGSocksStartReq
-	65,  // 87: rpcpb.SliverRPC.WGStopSocks:input_type -> sliverpb.WGSocksStopReq
-	66,  // 88: rpcpb.SliverRPC.WGListForwarders:input_type -> sliverpb.WGTCPForwardersReq
-	67,  // 89: rpcpb.SliverRPC.WGListSocksServers:input_type -> sliverpb.WGSocksServersReq
-	68,  // 90: rpcpb.SliverRPC.Shell:input_type -> sliverpb.ShellReq
-	69,  // 91: rpcpb.SliverRPC.Portfwd:input_type -> sliverpb.PortfwdReq
-	70,  // 92: rpcpb.SliverRPC.CreateTunnel:input_type -> sliverpb.Tunnel
-	70,  // 93: rpcpb.SliverRPC.CloseTunnel:input_type -> sliverpb.Tunnel
-	71,  // 94: rpcpb.SliverRPC.TunnelData:input_type -> sliverpb.TunnelData
-	0,   // 95: rpcpb.SliverRPC.Events:input_type -> commonpb.Empty
-	72,  // 96: rpcpb.SliverRPC.GetVersion:output_type -> clientpb.Version
-	73,  // 97: rpcpb.SliverRPC.GetOperators:output_type -> clientpb.Operators
-	74,  // 98: rpcpb.SliverRPC.GetSessions:output_type -> clientpb.Sessions
-	0,   // 99: rpcpb.SliverRPC.KillSession:output_type -> commonpb.Empty
-	75,  // 100: rpcpb.SliverRPC.UpdateSession:output_type -> clientpb.Session
-	76,  // 101: rpcpb.SliverRPC.MonitorStart:output_type -> commonpb.Response
-	0,   // 102: rpcpb.SliverRPC.MonitorStop:output_type -> commonpb.Empty
-	77,  // 103: rpcpb.SliverRPC.GetJobs:output_type -> clientpb.Jobs
-	78,  // 104: rpcpb.SliverRPC.KillJob:output_type -> clientpb.KillJob
-	79,  // 105: rpcpb.SliverRPC.StartMTLSListener:output_type -> clientpb.MTLSListener
-	80,  // 106: rpcpb.SliverRPC.StartWGListener:output_type -> clientpb.WGListener
-	81,  // 107: rpcpb.SliverRPC.StartDNSListener:output_type -> clientpb.DNSListener
-	82,  // 108: rpcpb.SliverRPC.StartHTTPSListener:output_type -> clientpb.HTTPListener
-	82,  // 109: rpcpb.SliverRPC.StartHTTPListener:output_type -> clientpb.HTTPListener
-	83,  // 110: rpcpb.SliverRPC.StartTCPStagerListener:output_type -> clientpb.StagerListener
-	83,  // 111: rpcpb.SliverRPC.StartHTTPStagerListener:output_type -> clientpb.StagerListener
-	9,   // 112: rpcpb.SliverRPC.LootAdd:output_type -> clientpb.Loot
-	0,   // 113: rpcpb.SliverRPC.LootRm:output_type -> commonpb.Empty
-	9,   // 114: rpcpb.SliverRPC.LootUpdate:output_type -> clientpb.Loot
-	9,   // 115: rpcpb.SliverRPC.LootContent:output_type -> clientpb.Loot
-	84,  // 116: rpcpb.SliverRPC.LootAll:output_type -> clientpb.AllLoot
-	84,  // 117: rpcpb.SliverRPC.LootAllOf:output_type -> clientpb.AllLoot
-	85,  // 118: rpcpb.SliverRPC.Generate:output_type -> clientpb.Generate
-	85,  // 119: rpcpb.SliverRPC.Regenerate:output_type -> clientpb.Generate
-	86,  // 120: rpcpb.SliverRPC.ImplantBuilds:output_type -> clientpb.ImplantBuilds
-	0,   // 121: rpcpb.SliverRPC.DeleteImplantBuild:output_type -> commonpb.Empty
-	87,  // 122: rpcpb.SliverRPC.Canaries:output_type -> clientpb.Canaries
-	88,  // 123: rpcpb.SliverRPC.GenerateWGClientConfig:output_type -> clientpb.WGClientConfig
-	89,  // 124: rpcpb.SliverRPC.GenerateUniqueIP:output_type -> clientpb.UniqueWGIP
-	90,  // 125: rpcpb.SliverRPC.ImplantProfiles:output_type -> clientpb.ImplantProfiles
-	0,   // 126: rpcpb.SliverRPC.DeleteImplantProfile:output_type -> commonpb.Empty
-	13,  // 127: rpcpb.SliverRPC.SaveImplantProfile:output_type -> clientpb.ImplantProfile
-	91,  // 128: rpcpb.SliverRPC.MsfStage:output_type -> clientpb.MsfStager
-	92,  // 129: rpcpb.SliverRPC.ShellcodeRDI:output_type -> clientpb.ShellcodeRDI
-	93,  // 130: rpcpb.SliverRPC.GetCompiler:output_type -> clientpb.Compiler
-	94,  // 131: rpcpb.SliverRPC.Websites:output_type -> clientpb.Websites
-	16,  // 132: rpcpb.SliverRPC.Website:output_type -> clientpb.Website
-	0,   // 133: rpcpb.SliverRPC.WebsiteRemove:output_type -> commonpb.Empty
-	16,  // 134: rpcpb.SliverRPC.WebsiteAddContent:output_type -> clientpb.Website
-	16,  // 135: rpcpb.SliverRPC.WebsiteUpdateContent:output_type -> clientpb.Website
-	16,  // 136: rpcpb.SliverRPC.WebsiteRemoveContent:output_type -> clientpb.Website
-	19,  // 137: rpcpb.SliverRPC.Ping:output_type -> sliverpb.Ping
-	95,  // 138: rpcpb.SliverRPC.Ps:output_type -> sliverpb.Ps
-	96,  // 139: rpcpb.SliverRPC.Terminate:output_type -> sliverpb.Terminate
-	97,  // 140: rpcpb.SliverRPC.Ifconfig:output_type -> sliverpb.Ifconfig
-	98,  // 141: rpcpb.SliverRPC.Netstat:output_type -> sliverpb.Netstat
-	99,  // 142: rpcpb.SliverRPC.Ls:output_type -> sliverpb.Ls
-	100, // 143: rpcpb.SliverRPC.Cd:output_type -> sliverpb.Pwd
-	100, // 144: rpcpb.SliverRPC.Pwd:output_type -> sliverpb.Pwd
-	101, // 145: rpcpb.SliverRPC.Rm:output_type -> sliverpb.Rm
-	102, // 146: rpcpb.SliverRPC.Mkdir:output_type -> sliverpb.Mkdir
-	103, // 147: rpcpb.SliverRPC.Download:output_type -> sliverpb.Download
-	104, // 148: rpcpb.SliverRPC.Upload:output_type -> sliverpb.Upload
-	105, // 149: rpcpb.SliverRPC.ProcessDump:output_type -> sliverpb.ProcessDump
-	106, // 150: rpcpb.SliverRPC.RunAs:output_type -> sliverpb.RunAs
-	107, // 151: rpcpb.SliverRPC.Impersonate:output_type -> sliverpb.Impersonate
-	108, // 152: rpcpb.SliverRPC.RevToSelf:output_type -> sliverpb.RevToSelf
-	109, // 153: rpcpb.SliverRPC.GetSystem:output_type -> sliverpb.GetSystem
-	110, // 154: rpcpb.SliverRPC.Task:output_type -> sliverpb.Task
-	0,   // 155: rpcpb.SliverRPC.Msf:output_type -> commonpb.Empty
-	0,   // 156: rpcpb.SliverRPC.MsfRemote:output_type -> commonpb.Empty
-	111, // 157: rpcpb.SliverRPC.ExecuteAssembly:output_type -> sliverpb.ExecuteAssembly
-	112, // 158: rpcpb.SliverRPC.Migrate:output_type -> sliverpb.Migrate
-	113, // 159: rpcpb.SliverRPC.Execute:output_type -> sliverpb.Execute
-	113, // 160: rpcpb.SliverRPC.ExecuteToken:output_type -> sliverpb.Execute
-	114, // 161: rpcpb.SliverRPC.Sideload:output_type -> sliverpb.Sideload
-	115, // 162: rpcpb.SliverRPC.SpawnDll:output_type -> sliverpb.SpawnDll
-	116, // 163: rpcpb.SliverRPC.Screenshot:output_type -> sliverpb.Screenshot
-	117, // 164: rpcpb.SliverRPC.NamedPipes:output_type -> sliverpb.NamedPipes
-	118, // 165: rpcpb.SliverRPC.TCPListener:output_type -> sliverpb.TCPPivot
-	119, // 166: rpcpb.SliverRPC.ListPivots:output_type -> sliverpb.PivotList
-	120, // 167: rpcpb.SliverRPC.StartService:output_type -> sliverpb.ServiceInfo
-	120, // 168: rpcpb.SliverRPC.StopService:output_type -> sliverpb.ServiceInfo
-	120, // 169: rpcpb.SliverRPC.RemoveService:output_type -> sliverpb.ServiceInfo
-	121, // 170: rpcpb.SliverRPC.MakeToken:output_type -> sliverpb.MakeToken
-	122, // 171: rpcpb.SliverRPC.GetEnv:output_type -> sliverpb.EnvInfo
-	123, // 172: rpcpb.SliverRPC.SetEnv:output_type -> sliverpb.SetEnv
-	124, // 173: rpcpb.SliverRPC.UnsetEnv:output_type -> sliverpb.UnsetEnv
-	125, // 174: rpcpb.SliverRPC.Backdoor:output_type -> sliverpb.Backdoor
-	126, // 175: rpcpb.SliverRPC.RegistryRead:output_type -> sliverpb.RegistryRead
-	127, // 176: rpcpb.SliverRPC.RegistryWrite:output_type -> sliverpb.RegistryWrite
-	128, // 177: rpcpb.SliverRPC.RegistryCreateKey:output_type -> sliverpb.RegistryCreateKey
-	129, // 178: rpcpb.SliverRPC.RunSSHCommand:output_type -> sliverpb.SSHCommand
-	130, // 179: rpcpb.SliverRPC.HijackDLL:output_type -> sliverpb.DllHijack
-	131, // 180: rpcpb.SliverRPC.WGStartPortForward:output_type -> sliverpb.WGPortForward
-	131, // 181: rpcpb.SliverRPC.WGStopPortForward:output_type -> sliverpb.WGPortForward
-	132, // 182: rpcpb.SliverRPC.WGStartSocks:output_type -> sliverpb.WGSocks
-	132, // 183: rpcpb.SliverRPC.WGStopSocks:output_type -> sliverpb.WGSocks
-	133, // 184: rpcpb.SliverRPC.WGListForwarders:output_type -> sliverpb.WGTCPForwarders
-	134, // 185: rpcpb.SliverRPC.WGListSocksServers:output_type -> sliverpb.WGSocksServers
-	135, // 186: rpcpb.SliverRPC.Shell:output_type -> sliverpb.Shell
-	136, // 187: rpcpb.SliverRPC.Portfwd:output_type -> sliverpb.Portfwd
-	70,  // 188: rpcpb.SliverRPC.CreateTunnel:output_type -> sliverpb.Tunnel
-	0,   // 189: rpcpb.SliverRPC.CloseTunnel:output_type -> commonpb.Empty
-	71,  // 190: rpcpb.SliverRPC.TunnelData:output_type -> sliverpb.TunnelData
-	137, // 191: rpcpb.SliverRPC.Events:output_type -> clientpb.Event
-	96,  // [96:192] is the sub-list for method output_type
-	0,   // [0:96] is the sub-list for method input_type
+	60,  // 82: rpcpb.SliverRPC.RegistryListSubKeys:input_type -> sliverpb.RegistrySubKeyListReq
+	61,  // 83: rpcpb.SliverRPC.RegistryListValues:input_type -> sliverpb.RegistryListValuesReq
+	62,  // 84: rpcpb.SliverRPC.RunSSHCommand:input_type -> sliverpb.SSHCommandReq
+	63,  // 85: rpcpb.SliverRPC.HijackDLL:input_type -> sliverpb.DllHijackReq
+	64,  // 86: rpcpb.SliverRPC.GetPrivs:input_type -> sliverpb.GetPrivsReq
+	65,  // 87: rpcpb.SliverRPC.WGStartPortForward:input_type -> sliverpb.WGPortForwardStartReq
+	66,  // 88: rpcpb.SliverRPC.WGStopPortForward:input_type -> sliverpb.WGPortForwardStopReq
+	67,  // 89: rpcpb.SliverRPC.WGStartSocks:input_type -> sliverpb.WGSocksStartReq
+	68,  // 90: rpcpb.SliverRPC.WGStopSocks:input_type -> sliverpb.WGSocksStopReq
+	69,  // 91: rpcpb.SliverRPC.WGListForwarders:input_type -> sliverpb.WGTCPForwardersReq
+	70,  // 92: rpcpb.SliverRPC.WGListSocksServers:input_type -> sliverpb.WGSocksServersReq
+	71,  // 93: rpcpb.SliverRPC.Shell:input_type -> sliverpb.ShellReq
+	72,  // 94: rpcpb.SliverRPC.Portfwd:input_type -> sliverpb.PortfwdReq
+	73,  // 95: rpcpb.SliverRPC.CreateTunnel:input_type -> sliverpb.Tunnel
+	73,  // 96: rpcpb.SliverRPC.CloseTunnel:input_type -> sliverpb.Tunnel
+	74,  // 97: rpcpb.SliverRPC.TunnelData:input_type -> sliverpb.TunnelData
+	0,   // 98: rpcpb.SliverRPC.Events:input_type -> commonpb.Empty
+	75,  // 99: rpcpb.SliverRPC.GetVersion:output_type -> clientpb.Version
+	76,  // 100: rpcpb.SliverRPC.GetOperators:output_type -> clientpb.Operators
+	77,  // 101: rpcpb.SliverRPC.GetSessions:output_type -> clientpb.Sessions
+	0,   // 102: rpcpb.SliverRPC.KillSession:output_type -> commonpb.Empty
+	78,  // 103: rpcpb.SliverRPC.UpdateSession:output_type -> clientpb.Session
+	79,  // 104: rpcpb.SliverRPC.MonitorStart:output_type -> commonpb.Response
+	0,   // 105: rpcpb.SliverRPC.MonitorStop:output_type -> commonpb.Empty
+	80,  // 106: rpcpb.SliverRPC.GetJobs:output_type -> clientpb.Jobs
+	81,  // 107: rpcpb.SliverRPC.KillJob:output_type -> clientpb.KillJob
+	82,  // 108: rpcpb.SliverRPC.StartMTLSListener:output_type -> clientpb.MTLSListener
+	83,  // 109: rpcpb.SliverRPC.StartWGListener:output_type -> clientpb.WGListener
+	84,  // 110: rpcpb.SliverRPC.StartDNSListener:output_type -> clientpb.DNSListener
+	85,  // 111: rpcpb.SliverRPC.StartHTTPSListener:output_type -> clientpb.HTTPListener
+	85,  // 112: rpcpb.SliverRPC.StartHTTPListener:output_type -> clientpb.HTTPListener
+	86,  // 113: rpcpb.SliverRPC.StartTCPStagerListener:output_type -> clientpb.StagerListener
+	86,  // 114: rpcpb.SliverRPC.StartHTTPStagerListener:output_type -> clientpb.StagerListener
+	9,   // 115: rpcpb.SliverRPC.LootAdd:output_type -> clientpb.Loot
+	0,   // 116: rpcpb.SliverRPC.LootRm:output_type -> commonpb.Empty
+	9,   // 117: rpcpb.SliverRPC.LootUpdate:output_type -> clientpb.Loot
+	9,   // 118: rpcpb.SliverRPC.LootContent:output_type -> clientpb.Loot
+	87,  // 119: rpcpb.SliverRPC.LootAll:output_type -> clientpb.AllLoot
+	87,  // 120: rpcpb.SliverRPC.LootAllOf:output_type -> clientpb.AllLoot
+	88,  // 121: rpcpb.SliverRPC.Generate:output_type -> clientpb.Generate
+	88,  // 122: rpcpb.SliverRPC.Regenerate:output_type -> clientpb.Generate
+	89,  // 123: rpcpb.SliverRPC.ImplantBuilds:output_type -> clientpb.ImplantBuilds
+	0,   // 124: rpcpb.SliverRPC.DeleteImplantBuild:output_type -> commonpb.Empty
+	90,  // 125: rpcpb.SliverRPC.Canaries:output_type -> clientpb.Canaries
+	91,  // 126: rpcpb.SliverRPC.GenerateWGClientConfig:output_type -> clientpb.WGClientConfig
+	92,  // 127: rpcpb.SliverRPC.GenerateUniqueIP:output_type -> clientpb.UniqueWGIP
+	93,  // 128: rpcpb.SliverRPC.ImplantProfiles:output_type -> clientpb.ImplantProfiles
+	0,   // 129: rpcpb.SliverRPC.DeleteImplantProfile:output_type -> commonpb.Empty
+	13,  // 130: rpcpb.SliverRPC.SaveImplantProfile:output_type -> clientpb.ImplantProfile
+	94,  // 131: rpcpb.SliverRPC.MsfStage:output_type -> clientpb.MsfStager
+	95,  // 132: rpcpb.SliverRPC.ShellcodeRDI:output_type -> clientpb.ShellcodeRDI
+	96,  // 133: rpcpb.SliverRPC.GetCompiler:output_type -> clientpb.Compiler
+	97,  // 134: rpcpb.SliverRPC.Websites:output_type -> clientpb.Websites
+	16,  // 135: rpcpb.SliverRPC.Website:output_type -> clientpb.Website
+	0,   // 136: rpcpb.SliverRPC.WebsiteRemove:output_type -> commonpb.Empty
+	16,  // 137: rpcpb.SliverRPC.WebsiteAddContent:output_type -> clientpb.Website
+	16,  // 138: rpcpb.SliverRPC.WebsiteUpdateContent:output_type -> clientpb.Website
+	16,  // 139: rpcpb.SliverRPC.WebsiteRemoveContent:output_type -> clientpb.Website
+	19,  // 140: rpcpb.SliverRPC.Ping:output_type -> sliverpb.Ping
+	98,  // 141: rpcpb.SliverRPC.Ps:output_type -> sliverpb.Ps
+	99,  // 142: rpcpb.SliverRPC.Terminate:output_type -> sliverpb.Terminate
+	100, // 143: rpcpb.SliverRPC.Ifconfig:output_type -> sliverpb.Ifconfig
+	101, // 144: rpcpb.SliverRPC.Netstat:output_type -> sliverpb.Netstat
+	102, // 145: rpcpb.SliverRPC.Ls:output_type -> sliverpb.Ls
+	103, // 146: rpcpb.SliverRPC.Cd:output_type -> sliverpb.Pwd
+	103, // 147: rpcpb.SliverRPC.Pwd:output_type -> sliverpb.Pwd
+	104, // 148: rpcpb.SliverRPC.Rm:output_type -> sliverpb.Rm
+	105, // 149: rpcpb.SliverRPC.Mkdir:output_type -> sliverpb.Mkdir
+	106, // 150: rpcpb.SliverRPC.Download:output_type -> sliverpb.Download
+	107, // 151: rpcpb.SliverRPC.Upload:output_type -> sliverpb.Upload
+	108, // 152: rpcpb.SliverRPC.ProcessDump:output_type -> sliverpb.ProcessDump
+	109, // 153: rpcpb.SliverRPC.RunAs:output_type -> sliverpb.RunAs
+	110, // 154: rpcpb.SliverRPC.Impersonate:output_type -> sliverpb.Impersonate
+	111, // 155: rpcpb.SliverRPC.RevToSelf:output_type -> sliverpb.RevToSelf
+	112, // 156: rpcpb.SliverRPC.GetSystem:output_type -> sliverpb.GetSystem
+	113, // 157: rpcpb.SliverRPC.Task:output_type -> sliverpb.Task
+	0,   // 158: rpcpb.SliverRPC.Msf:output_type -> commonpb.Empty
+	0,   // 159: rpcpb.SliverRPC.MsfRemote:output_type -> commonpb.Empty
+	114, // 160: rpcpb.SliverRPC.ExecuteAssembly:output_type -> sliverpb.ExecuteAssembly
+	115, // 161: rpcpb.SliverRPC.Migrate:output_type -> sliverpb.Migrate
+	116, // 162: rpcpb.SliverRPC.Execute:output_type -> sliverpb.Execute
+	116, // 163: rpcpb.SliverRPC.ExecuteToken:output_type -> sliverpb.Execute
+	117, // 164: rpcpb.SliverRPC.Sideload:output_type -> sliverpb.Sideload
+	118, // 165: rpcpb.SliverRPC.SpawnDll:output_type -> sliverpb.SpawnDll
+	119, // 166: rpcpb.SliverRPC.Screenshot:output_type -> sliverpb.Screenshot
+	120, // 167: rpcpb.SliverRPC.NamedPipes:output_type -> sliverpb.NamedPipes
+	121, // 168: rpcpb.SliverRPC.TCPListener:output_type -> sliverpb.TCPPivot
+	122, // 169: rpcpb.SliverRPC.ListPivots:output_type -> sliverpb.PivotList
+	123, // 170: rpcpb.SliverRPC.StartService:output_type -> sliverpb.ServiceInfo
+	123, // 171: rpcpb.SliverRPC.StopService:output_type -> sliverpb.ServiceInfo
+	123, // 172: rpcpb.SliverRPC.RemoveService:output_type -> sliverpb.ServiceInfo
+	124, // 173: rpcpb.SliverRPC.MakeToken:output_type -> sliverpb.MakeToken
+	125, // 174: rpcpb.SliverRPC.GetEnv:output_type -> sliverpb.EnvInfo
+	126, // 175: rpcpb.SliverRPC.SetEnv:output_type -> sliverpb.SetEnv
+	127, // 176: rpcpb.SliverRPC.UnsetEnv:output_type -> sliverpb.UnsetEnv
+	128, // 177: rpcpb.SliverRPC.Backdoor:output_type -> sliverpb.Backdoor
+	129, // 178: rpcpb.SliverRPC.RegistryRead:output_type -> sliverpb.RegistryRead
+	130, // 179: rpcpb.SliverRPC.RegistryWrite:output_type -> sliverpb.RegistryWrite
+	131, // 180: rpcpb.SliverRPC.RegistryCreateKey:output_type -> sliverpb.RegistryCreateKey
+	132, // 181: rpcpb.SliverRPC.RegistryListSubKeys:output_type -> sliverpb.RegistrySubKeyList
+	133, // 182: rpcpb.SliverRPC.RegistryListValues:output_type -> sliverpb.RegistryValuesList
+	134, // 183: rpcpb.SliverRPC.RunSSHCommand:output_type -> sliverpb.SSHCommand
+	135, // 184: rpcpb.SliverRPC.HijackDLL:output_type -> sliverpb.DllHijack
+	136, // 185: rpcpb.SliverRPC.GetPrivs:output_type -> sliverpb.GetPrivs
+	137, // 186: rpcpb.SliverRPC.WGStartPortForward:output_type -> sliverpb.WGPortForward
+	137, // 187: rpcpb.SliverRPC.WGStopPortForward:output_type -> sliverpb.WGPortForward
+	138, // 188: rpcpb.SliverRPC.WGStartSocks:output_type -> sliverpb.WGSocks
+	138, // 189: rpcpb.SliverRPC.WGStopSocks:output_type -> sliverpb.WGSocks
+	139, // 190: rpcpb.SliverRPC.WGListForwarders:output_type -> sliverpb.WGTCPForwarders
+	140, // 191: rpcpb.SliverRPC.WGListSocksServers:output_type -> sliverpb.WGSocksServers
+	141, // 192: rpcpb.SliverRPC.Shell:output_type -> sliverpb.Shell
+	142, // 193: rpcpb.SliverRPC.Portfwd:output_type -> sliverpb.Portfwd
+	73,  // 194: rpcpb.SliverRPC.CreateTunnel:output_type -> sliverpb.Tunnel
+	0,   // 195: rpcpb.SliverRPC.CloseTunnel:output_type -> commonpb.Empty
+	74,  // 196: rpcpb.SliverRPC.TunnelData:output_type -> sliverpb.TunnelData
+	143, // 197: rpcpb.SliverRPC.Events:output_type -> clientpb.Event
+	99,  // [99:198] is the sub-list for method output_type
+	0,   // [0:99] is the sub-list for method input_type
 	0,   // [0:0] is the sub-list for extension type_name
 	0,   // [0:0] is the sub-list for extension extendee
 	0,   // [0:0] is the sub-list for field type_name

protobuf/rpcpb/services.proto

@@ -112,8 +112,11 @@ service SliverRPC {
     rpc RegistryRead(sliverpb.RegistryReadReq) returns (sliverpb.RegistryRead);
     rpc RegistryWrite(sliverpb.RegistryWriteReq) returns (sliverpb.RegistryWrite);
     rpc RegistryCreateKey(sliverpb.RegistryCreateKeyReq) returns (sliverpb.RegistryCreateKey);
+    rpc RegistryListSubKeys(sliverpb.RegistrySubKeyListReq) returns (sliverpb.RegistrySubKeyList);
+    rpc RegistryListValues(sliverpb.RegistryListValuesReq) returns (sliverpb.RegistryValuesList);
     rpc RunSSHCommand(sliverpb.SSHCommandReq) returns (sliverpb.SSHCommand);
     rpc HijackDLL(sliverpb.DllHijackReq) returns (sliverpb.DllHijack);
+    rpc GetPrivs(sliverpb.GetPrivsReq) returns  (sliverpb.GetPrivs);
     
     // *** Wireguard Specific ***
     rpc WGStartPortForward(sliverpb.WGPortForwardStartReq) returns (sliverpb.WGPortForward);

protobuf/rpcpb/services_grpc.pb.go

@@ -114,8 +114,11 @@ type SliverRPCClient interface {
 	RegistryRead(ctx context.Context, in *sliverpb.RegistryReadReq, opts ...grpc.CallOption) (*sliverpb.RegistryRead, error)
 	RegistryWrite(ctx context.Context, in *sliverpb.RegistryWriteReq, opts ...grpc.CallOption) (*sliverpb.RegistryWrite, error)
 	RegistryCreateKey(ctx context.Context, in *sliverpb.RegistryCreateKeyReq, opts ...grpc.CallOption) (*sliverpb.RegistryCreateKey, error)
+	RegistryListSubKeys(ctx context.Context, in *sliverpb.RegistrySubKeyListReq, opts ...grpc.CallOption) (*sliverpb.RegistrySubKeyList, error)
+	RegistryListValues(ctx context.Context, in *sliverpb.RegistryListValuesReq, opts ...grpc.CallOption) (*sliverpb.RegistryValuesList, error)
 	RunSSHCommand(ctx context.Context, in *sliverpb.SSHCommandReq, opts ...grpc.CallOption) (*sliverpb.SSHCommand, error)
 	HijackDLL(ctx context.Context, in *sliverpb.DllHijackReq, opts ...grpc.CallOption) (*sliverpb.DllHijack, error)
+	GetPrivs(ctx context.Context, in *sliverpb.GetPrivsReq, opts ...grpc.CallOption) (*sliverpb.GetPrivs, error)
 	// *** Wireguard Specific ***
 	WGStartPortForward(ctx context.Context, in *sliverpb.WGPortForwardStartReq, opts ...grpc.CallOption) (*sliverpb.WGPortForward, error)
 	WGStopPortForward(ctx context.Context, in *sliverpb.WGPortForwardStopReq, opts ...grpc.CallOption) (*sliverpb.WGPortForward, error)
@@ -880,6 +883,24 @@ func (c *sliverRPCClient) RegistryCreateKey(ctx context.Context, in *sliverpb.Re
 	return out, nil
 }
 
+func (c *sliverRPCClient) RegistryListSubKeys(ctx context.Context, in *sliverpb.RegistrySubKeyListReq, opts ...grpc.CallOption) (*sliverpb.RegistrySubKeyList, error) {
+	out := new(sliverpb.RegistrySubKeyList)
+	err := c.cc.Invoke(ctx, "/rpcpb.SliverRPC/RegistryListSubKeys", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *sliverRPCClient) RegistryListValues(ctx context.Context, in *sliverpb.RegistryListValuesReq, opts ...grpc.CallOption) (*sliverpb.RegistryValuesList, error) {
+	out := new(sliverpb.RegistryValuesList)
+	err := c.cc.Invoke(ctx, "/rpcpb.SliverRPC/RegistryListValues", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *sliverRPCClient) RunSSHCommand(ctx context.Context, in *sliverpb.SSHCommandReq, opts ...grpc.CallOption) (*sliverpb.SSHCommand, error) {
 	out := new(sliverpb.SSHCommand)
 	err := c.cc.Invoke(ctx, "/rpcpb.SliverRPC/RunSSHCommand", in, out, opts...)
@@ -898,6 +919,15 @@ func (c *sliverRPCClient) HijackDLL(ctx context.Context, in *sliverpb.DllHijackR
 	return out, nil
 }
 
+func (c *sliverRPCClient) GetPrivs(ctx context.Context, in *sliverpb.GetPrivsReq, opts ...grpc.CallOption) (*sliverpb.GetPrivs, error) {
+	out := new(sliverpb.GetPrivs)
+	err := c.cc.Invoke(ctx, "/rpcpb.SliverRPC/GetPrivs", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *sliverRPCClient) WGStartPortForward(ctx context.Context, in *sliverpb.WGPortForwardStartReq, opts ...grpc.CallOption) (*sliverpb.WGPortForward, error) {
 	out := new(sliverpb.WGPortForward)
 	err := c.cc.Invoke(ctx, "/rpcpb.SliverRPC/WGStartPortForward", in, out, opts...)
@@ -1148,8 +1178,11 @@ type SliverRPCServer interface {
 	RegistryRead(context.Context, *sliverpb.RegistryReadReq) (*sliverpb.RegistryRead, error)
 	RegistryWrite(context.Context, *sliverpb.RegistryWriteReq) (*sliverpb.RegistryWrite, error)
 	RegistryCreateKey(context.Context, *sliverpb.RegistryCreateKeyReq) (*sliverpb.RegistryCreateKey, error)
+	RegistryListSubKeys(context.Context, *sliverpb.RegistrySubKeyListReq) (*sliverpb.RegistrySubKeyList, error)
+	RegistryListValues(context.Context, *sliverpb.RegistryListValuesReq) (*sliverpb.RegistryValuesList, error)
 	RunSSHCommand(context.Context, *sliverpb.SSHCommandReq) (*sliverpb.SSHCommand, error)
 	HijackDLL(context.Context, *sliverpb.DllHijackReq) (*sliverpb.DllHijack, error)
+	GetPrivs(context.Context, *sliverpb.GetPrivsReq) (*sliverpb.GetPrivs, error)
 	// *** Wireguard Specific ***
 	WGStartPortForward(context.Context, *sliverpb.WGPortForwardStartReq) (*sliverpb.WGPortForward, error)
 	WGStopPortForward(context.Context, *sliverpb.WGPortForwardStopReq) (*sliverpb.WGPortForward, error)
@@ -1419,12 +1452,21 @@ func (UnimplementedSliverRPCServer) RegistryWrite(context.Context, *sliverpb.Reg
 func (UnimplementedSliverRPCServer) RegistryCreateKey(context.Context, *sliverpb.RegistryCreateKeyReq) (*sliverpb.RegistryCreateKey, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method RegistryCreateKey not implemented")
 }
+func (UnimplementedSliverRPCServer) RegistryListSubKeys(context.Context, *sliverpb.RegistrySubKeyListReq) (*sliverpb.RegistrySubKeyList, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RegistryListSubKeys not implemented")
+}
+func (UnimplementedSliverRPCServer) RegistryListValues(context.Context, *sliverpb.RegistryListValuesReq) (*sliverpb.RegistryValuesList, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RegistryListValues not implemented")
+}
 func (UnimplementedSliverRPCServer) RunSSHCommand(context.Context, *sliverpb.SSHCommandReq) (*sliverpb.SSHCommand, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method RunSSHCommand not implemented")
 }
 func (UnimplementedSliverRPCServer) HijackDLL(context.Context, *sliverpb.DllHijackReq) (*sliverpb.DllHijack, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method HijackDLL not implemented")
 }
+func (UnimplementedSliverRPCServer) GetPrivs(context.Context, *sliverpb.GetPrivsReq) (*sliverpb.GetPrivs, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetPrivs not implemented")
+}
 func (UnimplementedSliverRPCServer) WGStartPortForward(context.Context, *sliverpb.WGPortForwardStartReq) (*sliverpb.WGPortForward, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method WGStartPortForward not implemented")
 }
@@ -2950,6 +2992,42 @@ func _SliverRPC_RegistryCreateKey_Handler(srv interface{}, ctx context.Context,
 	return interceptor(ctx, in, info, handler)
 }
 
+func _SliverRPC_RegistryListSubKeys_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(sliverpb.RegistrySubKeyListReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SliverRPCServer).RegistryListSubKeys(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/rpcpb.SliverRPC/RegistryListSubKeys",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SliverRPCServer).RegistryListSubKeys(ctx, req.(*sliverpb.RegistrySubKeyListReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SliverRPC_RegistryListValues_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(sliverpb.RegistryListValuesReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SliverRPCServer).RegistryListValues(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/rpcpb.SliverRPC/RegistryListValues",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SliverRPCServer).RegistryListValues(ctx, req.(*sliverpb.RegistryListValuesReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _SliverRPC_RunSSHCommand_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(sliverpb.SSHCommandReq)
 	if err := dec(in); err != nil {
@@ -2986,6 +3064,24 @@ func _SliverRPC_HijackDLL_Handler(srv interface{}, ctx context.Context, dec func
 	return interceptor(ctx, in, info, handler)
 }
 
+func _SliverRPC_GetPrivs_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(sliverpb.GetPrivsReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SliverRPCServer).GetPrivs(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/rpcpb.SliverRPC/GetPrivs",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SliverRPCServer).GetPrivs(ctx, req.(*sliverpb.GetPrivsReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _SliverRPC_WGStartPortForward_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(sliverpb.WGPortForwardStartReq)
 	if err := dec(in); err != nil {
@@ -3548,6 +3644,14 @@ var SliverRPC_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "RegistryCreateKey",
 			Handler:    _SliverRPC_RegistryCreateKey_Handler,
 		},
+		{
+			MethodName: "RegistryListSubKeys",
+			Handler:    _SliverRPC_RegistryListSubKeys_Handler,
+		},
+		{
+			MethodName: "RegistryListValues",
+			Handler:    _SliverRPC_RegistryListValues_Handler,
+		},
 		{
 			MethodName: "RunSSHCommand",
 			Handler:    _SliverRPC_RunSSHCommand_Handler,
@@ -3556,6 +3660,10 @@ var SliverRPC_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "HijackDLL",
 			Handler:    _SliverRPC_HijackDLL_Handler,
 		},
+		{
+			MethodName: "GetPrivs",
+			Handler:    _SliverRPC_GetPrivs_Handler,
+		},
 		{
 			MethodName: "WGStartPortForward",
 			Handler:    _SliverRPC_WGStartPortForward_Handler,

protobuf/sliverpb/constants.go

@@ -242,6 +242,15 @@ const (
 
 	// MsgSSHCommandReq - Run a SSH command
 	MsgSSHCommandReq
+
+	// MsgGetPrivsReq - Get privileges (Windows)
+	MsgGetPrivsReq
+
+	// MsgRegistryListReq - List registry sub keys
+	MsgRegistrySubKeysListReq
+
+	// MsgRegistryListValuesReq - List registry values
+	MsgRegistryListValuesReq
 )
 
 // Constants to replace enums
@@ -464,6 +473,13 @@ func MsgNumber(request proto.Message) uint32 {
 		return MsgPollInterval
 	case *SSHCommandReq:
 		return MsgSSHCommandReq
+
+	case *GetPrivsReq:
+		return MsgGetPrivsReq
+	case *RegistrySubKeyListReq:
+		return MsgRegistrySubKeysListReq
+	case *RegistryListValuesReq:
+		return MsgRegistryListValuesReq
 	}
 
 	return uint32(0)

protobuf/sliverpb/sliver.proto

@@ -559,6 +559,32 @@ message RegistryCreateKey {
   commonpb.Response Response = 9;
 }
 
+message RegistrySubKeyListReq {
+  string Hive = 1;
+  string Path = 2;
+  // Keep the same ID as the other registry operations
+  string Hostname = 4;
+  commonpb.Request Request = 9;
+}
+
+message RegistrySubKeyList {
+  repeated string Subkeys = 1;
+  commonpb.Response Response = 9;
+}
+
+message RegistryListValuesReq {
+  string Hive = 1;
+  string Path = 2;
+  // Keep the same ID as the other registry operations
+  string Hostname = 4;
+  commonpb.Request Request = 9;
+}
+
+message RegistryValuesList {
+  repeated string ValueNames = 1;
+  commonpb.Response Response = 9;
+}
+
 // Tunnel - Tunnel related messages
 message Tunnel {
   uint64 TunnelID = 8 [jstype = JS_STRING];
@@ -782,5 +808,24 @@ message DllHijackReq {
 }
 
 message DllHijack {
+  commonpb.Response Response = 9;
+}
+
+message GetPrivsReq {
+  commonpb.Request Request = 9;
+}
+
+message WindowsPrivilegeEntry {
+  string Name = 1;
+  string Description = 2;
+  bool Enabled = 3;
+  bool EnabledByDefault = 4;
+  bool Removed = 5;
+  bool UsedForAccess = 6;
+}
+
+message GetPrivs {
+  repeated WindowsPrivilegeEntry PrivInfo = 1;
+
   commonpb.Response Response = 9;
 }

server/rpc/rpc-priv.go

@@ -118,3 +118,13 @@ func (rpc *Server) MakeToken(ctx context.Context, req *sliverpb.MakeTokenReq) (*
 	}
 	return resp, nil
 }
+
+// GetPrivs - gRPC interface to get privilege information from the current process
+func (rpc *Server) GetPrivs(ctx context.Context, req *sliverpb.GetPrivsReq) (*sliverpb.GetPrivs, error) {
+	resp := &sliverpb.GetPrivs{}
+	err := rpc.GenericHandler(req, resp)
+	if err != nil {
+		return nil, err
+	}
+	return resp, nil
+}

server/rpc/rpc-registry.go

@@ -35,3 +35,23 @@ func (rpc *Server) RegistryCreateKey(ctx context.Context, req *sliverpb.Registry
 	}
 	return resp, nil
 }
+
+// RegistryListSubKeys - gRPC interface to list the sub keys of a registry key
+func (rpc *Server) RegistryListSubKeys(ctx context.Context, req *sliverpb.RegistrySubKeyListReq) (*sliverpb.RegistrySubKeyList, error) {
+	resp := &sliverpb.RegistrySubKeyList{}
+	err := rpc.GenericHandler(req, resp)
+	if err != nil {
+		return nil, err
+	}
+	return resp, nil
+}
+
+// RegistryListSubKeys - gRPC interface to list the sub keys of a registry key
+func (rpc *Server) RegistryListValues(ctx context.Context, req *sliverpb.RegistryListValuesReq) (*sliverpb.RegistryValuesList, error) {
+	resp := &sliverpb.RegistryValuesList{}
+	err := rpc.GenericHandler(req, resp)
+	if err != nil {
+		return nil, err
+	}
+	return resp, nil
+}