Update badge

Signed-off-by: Joe <[email protected]>

.github/codeql/codeql-config.yml

@@ -5,4 +5,4 @@ queries:
     uses: security-extended
     paths:
       - server
-      - implant
+      - client

.github/workflows/autorelease.yml

@@ -15,7 +15,7 @@ jobs:
       - name: Go 1.19
         uses: actions/setup-go@v3
         with:
-          go-version: "1.19.1"
+          go-version: "^1.19"
 
       - name: OS Packages
         run: |

.github/workflows/codeql-scanning.yml

@@ -4,23 +4,22 @@ on:
   push:
     branches:
       - test/*
-  # pull_request:
-  #   branches:
-  #     - master
+  pull_request:
+    branches:
+      - master
 
 jobs:
   CodeQL-Build:
     name: CodeQL Security Scan
-    # CodeQL runs on ubuntu-latest, windows-latest, and macos-latest
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 90
 
     steps:
       # Setup go environment
       - name: Go 1.19
         uses: actions/setup-go@v3
         with:
-          go-version: "1.19.1"
+          go-version: "^1.19"
 
       - name: Checkout repository
         uses: actions/checkout@v3
@@ -37,23 +36,6 @@ jobs:
           git build-essential zlib1g zlib1g-dev wget zip unzip \
           mingw-w64 binutils-mingw-w64 g++-mingw-w64
 
-      - name: Protoc
-        env:
-          PROTOC_VER: 3.11.4
-        run: |
-          wget -O protoc-${PROTOC_VER}-linux-x86_64.zip https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VER}/protoc-${PROTOC_VER}-linux-x86_64.zip \
-          && unzip protoc-${PROTOC_VER}-linux-x86_64.zip \
-          && sudo cp -vv ./bin/protoc /usr/local/bin/protoc
-
-      - name: Protoc-gen-go
-        env:
-          PROTOC_GEN_GO_VER: 1.3.5
-        run: |
-          wget -O protoc-gen-go.tar.gz https://github.com/golang/protobuf/archive/v${PROTOC_GEN_GO_VER}.tar.gz \
-          && tar xvf protoc-gen-go.tar.gz \
-          && cd protobuf-${PROTOC_GEN_GO_VER} \
-          && make install
-
       - name: Check out code into the Go module directory
         uses: actions/checkout@v3
 

.github/workflows/go.yml

@@ -1,8 +1,5 @@
 name: Build & Test
 on:
-  push:
-    branches:
-      - test/*
   pull_request:
     branches:
       - master
@@ -21,7 +18,7 @@ jobs:
       - name: Go 1.19
         uses: actions/setup-go@v3
         with:
-          go-version: "1.19.1"
+          go-version: "^1.19"
 
       - name: OS Packages
         run: |
@@ -55,7 +52,7 @@ jobs:
       - name: Go 1.19
         uses: actions/setup-go@v3
         with:
-          go-version: "1.19.1"
+          go-version: "^1.19"
 
       - name: Mingw
         run: brew install mingw-w64

README.md

@@ -5,7 +5,7 @@ Sliver is an open source cross-platform adversary emulation/red team framework,
 
 The server and client support MacOS, Windows, and Linux. Implants are supported on MacOS, Windows, and Linux (and possibly every Golang compiler target but we've not tested them all).
 
-![Go](https://github.com/BishopFox/sliver/workflows/Go/badge.svg?branch=master) [![Go Report Card](https://goreportcard.com/badge/github.com/BishopFox/sliver)](https://goreportcard.com/report/github.com/BishopFox/sliver) [![License: GPL v3](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)
+[![Build & Test](https://github.com/BishopFox/sliver/actions/workflows/go.yml/badge.svg)](https://github.com/BishopFox/sliver/actions/workflows/go.yml) [![Go Report Card](https://goreportcard.com/badge/github.com/BishopFox/sliver)](https://goreportcard.com/report/github.com/BishopFox/sliver) [![License: GPL v3](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)
 
 ### Features
 

docs/Gemfile.lock

@@ -232,7 +232,7 @@ GEM
       jekyll-seo-tag (~> 2.1)
     minitest (5.15.0)
     multipart-post (2.1.1)
-    nokogiri (1.13.6)
+    nokogiri (1.13.9)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
     octokit (4.22.0)

server/assets/assets.go

@@ -24,7 +24,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	insecureRand "math/rand"
 	"os"
 	"os/user"
@@ -80,7 +79,7 @@ func GetRootAppDir() string {
 
 func assetVersion() string {
 	appDir := GetRootAppDir()
-	data, err := ioutil.ReadFile(path.Join(appDir, versionFileName))
+	data, err := os.ReadFile(path.Join(appDir, versionFileName))
 	if err != nil {
 		setupLog.Infof("No version detected %s", err)
 		return ""
@@ -184,7 +183,7 @@ func setupGo(appDir string) error {
 
 	goZipPath := filepath.Join(appDir, "go.zip")
 	defer os.Remove(goZipPath)
-	ioutil.WriteFile(goZipPath, goZip, 0600)
+	os.WriteFile(goZipPath, goZip, 0600)
 	_, err = unzip(goZipPath, appDir)
 	if err != nil {
 		setupLog.Infof("Failed to unzip file %s -> %s", goZipPath, appDir)
@@ -198,7 +197,7 @@ func setupGo(appDir string) error {
 	}
 	goSrcZipPath := filepath.Join(appDir, "src.zip")
 	defer os.Remove(goSrcZipPath)
-	ioutil.WriteFile(goSrcZipPath, goSrcZip, 0600)
+	os.WriteFile(goSrcZipPath, goSrcZip, 0600)
 	_, err = unzip(goSrcZipPath, goRootPath)
 	if err != nil {
 		setupLog.Infof("Failed to unzip file %s -> %s/go", goSrcZipPath, appDir)
@@ -216,7 +215,7 @@ func setupGo(appDir string) error {
 		return err
 	}
 	garbleLocalPath := filepath.Join(appDir, "go", "bin", garbleFileName)
-	err = ioutil.WriteFile(garbleLocalPath, garbleFile, 0700)
+	err = os.WriteFile(garbleLocalPath, garbleFile, 0700)
 	if err != nil {
 		setupLog.Errorf("Failed to write garble %s", err)
 		return err
@@ -260,8 +259,8 @@ func SetupGoPath(goPathSrc string) error {
 	sliverpbGoSrc = stripSliverpb(sliverpbGoSrc)
 	sliverpbDir := filepath.Join(goPathSrc, "github.com", "bishopfox", "sliver", "protobuf", "sliverpb")
 	os.MkdirAll(sliverpbDir, 0700)
-	ioutil.WriteFile(filepath.Join(sliverpbDir, "sliver.pb.go"), sliverpbGoSrc, 0600)
-	ioutil.WriteFile(filepath.Join(sliverpbDir, "constants.go"), sliverpbConstSrc, 0600)
+	os.WriteFile(filepath.Join(sliverpbDir, "sliver.pb.go"), sliverpbGoSrc, 0600)
+	os.WriteFile(filepath.Join(sliverpbDir, "constants.go"), sliverpbConstSrc, 0600)
 
 	// Common PB
 	commonpbSrc, err := protobufs.FS.ReadFile("commonpb/common.pb.go")
@@ -271,7 +270,7 @@ func SetupGoPath(goPathSrc string) error {
 	}
 	commonpbDir := filepath.Join(goPathSrc, "github.com", "bishopfox", "sliver", "protobuf", "commonpb")
 	os.MkdirAll(commonpbDir, 0700)
-	ioutil.WriteFile(filepath.Join(commonpbDir, "common.pb.go"), commonpbSrc, 0600)
+	os.WriteFile(filepath.Join(commonpbDir, "common.pb.go"), commonpbSrc, 0600)
 
 	// DNS PB
 	dnspbSrc, err := protobufs.FS.ReadFile("dnspb/dns.pb.go")
@@ -281,7 +280,7 @@ func SetupGoPath(goPathSrc string) error {
 	}
 	dnspbDir := filepath.Join(goPathSrc, "github.com", "bishopfox", "sliver", "protobuf", "dnspb")
 	os.MkdirAll(dnspbDir, 0700)
-	ioutil.WriteFile(filepath.Join(dnspbDir, "dns.pb.go"), dnspbSrc, 0600)
+	os.WriteFile(filepath.Join(dnspbDir, "dns.pb.go"), dnspbSrc, 0600)
 	return nil
 }
 
@@ -307,28 +306,6 @@ func stripSliverpb(src []byte) []byte {
 	return out
 }
 
-func unzipGoDependency(fsPath string, targetPath string) error {
-	setupLog.Infof("Unpacking go dependency %s -> %s", fsPath, targetPath)
-
-	appDir := GetRootAppDir()
-	goDep, err := assetsFs.ReadFile(fsPath)
-	if err != nil {
-		setupLog.Infof("static asset not found: %s", fsPath)
-		return err
-	}
-
-	goDepZipPath := filepath.Join(appDir, filepath.Base(fsPath))
-	defer os.Remove(goDepZipPath)
-	ioutil.WriteFile(goDepZipPath, goDep, 0600)
-	_, err = unzip(goDepZipPath, targetPath)
-	if err != nil {
-		setupLog.Infof("Failed to unzip file %s -> %s", goDepZipPath, appDir)
-		return err
-	}
-
-	return nil
-}
-
 func setupCodenames(appDir string) error {
 	nouns, err := assetsFs.ReadFile("fs/nouns.txt")
 	if err != nil {
@@ -342,13 +319,13 @@ func setupCodenames(appDir string) error {
 		return err
 	}
 
-	err = ioutil.WriteFile(path.Join(appDir, "nouns.txt"), nouns, 0600)
+	err = os.WriteFile(filepath.Join(appDir, "nouns.txt"), nouns, 0600)
 	if err != nil {
 		setupLog.Infof("Failed to write noun data to: %s", appDir)
 		return err
 	}
 
-	err = ioutil.WriteFile(path.Join(appDir, "adjectives.txt"), adjectives, 0600)
+	err = os.WriteFile(filepath.Join(appDir, "adjectives.txt"), adjectives, 0600)
 	if err != nil {
 		setupLog.Infof("Failed to write adjective data to: %s", appDir)
 		return err
@@ -374,7 +351,10 @@ func unzip(src string, dest string) ([]string, error) {
 		}
 		defer rc.Close()
 
-		fPath := filepath.Join(dest, file.Name)
+		fPath := filepath.Clean(filepath.Join(dest, file.Name))
+		if !strings.HasPrefix(fPath, filepath.Clean(dest)) {
+			panic("illegal zip file path")
+		}
 		filenames = append(filenames, fPath)
 
 		if file.FileInfo().IsDir() {

server/configs/database.go

@@ -22,10 +22,10 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"net/url"
 	"os"
 	"path"
+	"path/filepath"
 
 	"github.com/bishopfox/sliver/server/assets"
 	"github.com/bishopfox/sliver/server/log"
@@ -52,8 +52,8 @@ var (
 // GetDatabaseConfigPath - File path to config.json
 func GetDatabaseConfigPath() string {
 	appDir := assets.GetRootAppDir()
-	databaseConfigPath := path.Join(appDir, "configs", databaseConfigFileName)
-	databaseConfigLog.Infof("Loading config from %s", databaseConfigPath)
+	databaseConfigPath := filepath.Join(appDir, "configs", databaseConfigFileName)
+	databaseConfigLog.Debugf("Loading config from %s", databaseConfigPath)
 	return databaseConfigPath
 }
 
@@ -79,7 +79,7 @@ type DatabaseConfig struct {
 func (c *DatabaseConfig) DSN() (string, error) {
 	switch c.Dialect {
 	case Sqlite:
-		filePath := path.Join(assets.GetRootAppDir(), "sliver.db")
+		filePath := filepath.Join(assets.GetRootAppDir(), "sliver.db")
 		params := encodeParams(c.Params)
 		return fmt.Sprintf("file:%s?%s", filePath, params), nil
 	case MySQL:
@@ -88,6 +88,7 @@ func (c *DatabaseConfig) DSN() (string, error) {
 		db := url.QueryEscape(c.Database)
 		host := fmt.Sprintf("%s:%d", url.QueryEscape(c.Host), c.Port)
 		params := encodeParams(c.Params)
+		databaseConfigLog.Infof("Connecting to MySQL database %s@%s/%s", user, host, db)
 		return fmt.Sprintf("%s:%s@tcp(%s)/%s?%s", user, password, host, db, params), nil
 	case Postgres:
 		user := url.QueryEscape(c.Username)
@@ -96,6 +97,7 @@ func (c *DatabaseConfig) DSN() (string, error) {
 		host := url.QueryEscape(c.Host)
 		port := c.Port
 		params := encodeParams(c.Params)
+		databaseConfigLog.Infof("Connecting to Postgres database %s@%s:%d/%s", user, host, port, db)
 		return fmt.Sprintf("host=%s port=%d user=%s password=%s dbname=%s %s", host, port, user, password, db, params), nil
 	default:
 		return "", ErrInvalidDialect
@@ -126,7 +128,7 @@ func (c *DatabaseConfig) Save() error {
 		return err
 	}
 	databaseConfigLog.Infof("Saving config to %s", configPath)
-	err = ioutil.WriteFile(configPath, data, 0600)
+	err = os.WriteFile(configPath, data, 0600)
 	if err != nil {
 		databaseConfigLog.Errorf("Failed to write config %s", err)
 	}
@@ -138,7 +140,7 @@ func GetDatabaseConfig() *DatabaseConfig {
 	configPath := GetDatabaseConfigPath()
 	config := getDefaultDatabaseConfig()
 	if _, err := os.Stat(configPath); !os.IsNotExist(err) {
-		data, err := ioutil.ReadFile(configPath)
+		data, err := os.ReadFile(configPath)
 		if err != nil {
 			databaseConfigLog.Errorf("Failed to read config file %s", err)
 			return config

server/configs/http-c2.go

@@ -22,7 +22,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io/ioutil"
 	insecureRand "math/rand"
 	"os"
 	"path"
@@ -298,7 +297,7 @@ func GetHTTPC2Config() *HTTPC2Config {
 			return &defaultHTTPC2Config
 		}
 	}
-	data, err := ioutil.ReadFile(configPath)
+	data, err := os.ReadFile(configPath)
 	if err != nil {
 		httpC2ConfigLog.Errorf("Failed to read http c2 config %s", err)
 		return &defaultHTTPC2Config
@@ -327,7 +326,7 @@ func CheckHTTPC2ConfigErrors() error {
 			return err
 		}
 	}
-	data, err := ioutil.ReadFile(configPath)
+	data, err := os.ReadFile(configPath)
 	if err != nil {
 		httpC2ConfigLog.Errorf("Failed to read http c2 config %s", err)
 		return err
@@ -351,7 +350,7 @@ func generateDefaultConfig(saveTo string) error {
 	if err != nil {
 		return err
 	}
-	return ioutil.WriteFile(saveTo, data, 0600)
+	return os.WriteFile(saveTo, data, 0600)
 }
 
 var (

server/db/sql.go

@@ -98,7 +98,6 @@ func postgresClient(dbConfig *configs.DatabaseConfig) *gorm.DB {
 	if err != nil {
 		panic(err)
 	}
-	clientLog.Infof("postgres -> %s", dsn)
 	dbClient, err := gorm.Open(postgres.Open(dsn), &gorm.Config{
 		PrepareStmt: true,
 		Logger:      getGormLogger(dbConfig),
@@ -114,7 +113,6 @@ func mySQLClient(dbConfig *configs.DatabaseConfig) *gorm.DB {
 	if err != nil {
 		panic(err)
 	}
-	clientLog.Infof("mysql -> %s", dsn)
 	dbClient, err := gorm.Open(mysql.Open(dsn), &gorm.Config{
 		PrepareStmt: true,
 		Logger:      getGormLogger(dbConfig),

server/db/sql_cgo.go

@@ -32,7 +32,7 @@ func sqliteClient(dbConfig *configs.DatabaseConfig) *gorm.DB {
 	if err != nil {
 		panic(err)
 	}
-	clientLog.Infof("sqlite -> %s", dsn)
+	clientLog.Debugf("sqlite -> %s", dsn)
 
 	dbClient, err := gorm.Open(sqlite.Open(dsn), &gorm.Config{
 		PrepareStmt: true,