Deserialize to the proper message, and don't reuse message in response. Fixes Screenshot not working. #610

Add beacon registration to audit log

implant/sliver/handlers/rpc-handlers.go

@@ -174,7 +174,7 @@ func ifconfig() *sliverpb.Ifconfig {
 }
 
 func screenshotHandler(data []byte, resp RPCResponse) {
-	sc := &sliverpb.Screenshot{}
+	sc := &sliverpb.ScreenshotReq{}
 	err := proto.Unmarshal(data, sc)
 	if err != nil {
 		// {{if .Config.Debug}}
@@ -185,9 +185,9 @@ func screenshotHandler(data []byte, resp RPCResponse) {
 	// {{if .Config.Debug}}
 	log.Printf("Screenshot Request")
 	// {{end}}
-
-	sc.Data = screen.Screenshot()
-	data, err = proto.Marshal(sc)
+	scRes := &sliverpb.Screenshot{}
+	scRes.Data = screen.Screenshot()
+	data, err = proto.Marshal(scRes)
 
 	resp(data, err)
 }

server/assets/assets.go

@@ -275,14 +275,21 @@ func SetupGoPath(goPathSrc string) error {
 
 func stripSliverpb(src []byte) []byte {
 	out := src
-	re := regexp.MustCompile(`protobuf:"[a-z]+,\d+,[a-z]+,name=(?P<FieldName1>[a-zA-Z0-9]+),proto3" json:"(?P<FiledName2>[a-zA-Z0-9]+),[a-z]+"`)
+	re := regexp.MustCompile(`protobuf:"[a-z]+,\d+,[a-z]+,name=(?P<FieldName1>[a-zA-Z0-9]+),proto3(,enum=(?P<EnumName>[a-zA-Z\.]+))?" json:"(?P<FiledName2>[a-zA-Z0-9]+),[a-z]+"`)
 	found := re.FindAllSubmatch(src, -1)
 	for _, x := range found {
-		line := x[0] // line that matched
-		item := x[1] // first named capturing group (FieldName1)
+		line := x[0]     // line that matched
+		typeName := x[1] // first named capturing group (FieldName1)
+		enumName := x[3]
+		if string(enumName) != "" {
+			newEnumName := pseudoRandStringRunes(len(enumName))
+			newEnumLine := bytes.ReplaceAll(line, enumName, []byte(newEnumName))
+			out = bytes.ReplaceAll(out, line, []byte(newEnumLine))
+			line = newEnumLine
+		}
 		// we don't care about FieldName2 because its value is the same as FieldName1
-		newItem := pseudoRandStringRunes(len(item))
-		newLine := bytes.ReplaceAll(line, item, []byte(newItem))
+		newItem := pseudoRandStringRunes(len(typeName))
+		newLine := bytes.ReplaceAll(line, typeName, []byte(newItem))
 		out = bytes.ReplaceAll(out, line, []byte(newLine))
 	}
 	return out

server/handlers/beacons.go

@@ -23,10 +23,12 @@ package handlers
 */
 
 import (
+	"encoding/json"
 	"errors"
 	"time"
 
 	consts "github.com/bishopfox/sliver/client/constants"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
 	sliverpb "github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/bishopfox/sliver/server/core"
 	"github.com/bishopfox/sliver/server/db"
@@ -94,9 +96,27 @@ func beaconRegisterHandler(implantConn *core.ImplantConnection, data []byte) *sl
 		Data:      eventData,
 	})
 
+	go auditLogBeacon(beacon, beaconReg.Register)
 	return nil
 }
 
+type auditLogNewBeaconMsg struct {
+	Beacon   *clientpb.Beacon
+	Register *sliverpb.Register
+}
+
+func auditLogBeacon(beacon *models.Beacon, register *sliverpb.Register) {
+	msg, err := json.Marshal(auditLogNewBeaconMsg{
+		Beacon:   beacon.ToProtobuf(),
+		Register: register,
+	})
+	if err != nil {
+		beaconHandlerLog.Errorf("Failed to log new beacon to audit log: %s", err)
+	} else {
+		log.AuditLogger.Warn(string(msg))
+	}
+}
+
 func beaconTasksHandler(implantConn *core.ImplantConnection, data []byte) *sliverpb.Envelope {
 	beaconTasks := &sliverpb.BeaconTasks{}
 	err := proto.Unmarshal(data, beaconTasks)