Update autorelease.yml

Remove goreleaser branch trigger Signed-off-by: Joe <[email protected]>
Merge pull request #964 from BishopFox/stage
2026-11-08 01:38:17 -10:00 · 2022-10-22 13:21:15 -05:00 · 2022-10-21 15:21:24 -05:00 · 2022-10-21 11:46:29 -07:00 · 2022-10-21 12:01:47 -05:00 · 2022-10-21 11:23:57 -05:00
13 changed files with 42 additions and 85 deletions
@@ -5,4 +5,4 @@ queries:
    uses: security-extended
    paths:
      - server
-      - implant
+      - client
@@ -3,7 +3,7 @@ name: Release
 on:
  push:
    tags: ["v[1-9]+.[0-9]+.[0-9]+"]
-    branches: [master, goreleaser]
+    branches: [master]

 jobs:
  linux-windows-build:
@@ -15,7 +15,7 @@ jobs:
      - name: Go 1.19
        uses: actions/setup-go@v3
        with:
-          go-version: "1.19.1"
+          go-version: "^1.19"

      - name: OS Packages
        run: |
@@ -4,23 +4,22 @@ on:
  push:
    branches:
      - test/*
-  # pull_request:
-  #   branches:
-  #     - master
+  pull_request:
+    branches:
+      - master

 jobs:
  CodeQL-Build:
    name: CodeQL Security Scan
-    # CodeQL runs on ubuntu-latest, windows-latest, and macos-latest
    runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 90

    steps:
      # Setup go environment
      - name: Go 1.19
        uses: actions/setup-go@v3
        with:
-          go-version: "1.19.1"
+          go-version: "^1.19"

      - name: Checkout repository
        uses: actions/checkout@v3
@@ -37,23 +36,6 @@ jobs:
          git build-essential zlib1g zlib1g-dev wget zip unzip \
          mingw-w64 binutils-mingw-w64 g++-mingw-w64

-      - name: Protoc
-        env:
-          PROTOC_VER: 3.11.4
-        run: |
-          wget -O protoc-${PROTOC_VER}-linux-x86_64.zip https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VER}/protoc-${PROTOC_VER}-linux-x86_64.zip \
-          && unzip protoc-${PROTOC_VER}-linux-x86_64.zip \
-          && sudo cp -vv ./bin/protoc /usr/local/bin/protoc
-
-      - name: Protoc-gen-go
-        env:
-          PROTOC_GEN_GO_VER: 1.3.5
-        run: |
-          wget -O protoc-gen-go.tar.gz https://github.com/golang/protobuf/archive/v${PROTOC_GEN_GO_VER}.tar.gz \
-          && tar xvf protoc-gen-go.tar.gz \
-          && cd protobuf-${PROTOC_GEN_GO_VER} \
-          && make install
-
      - name: Check out code into the Go module directory
        uses: actions/checkout@v3

@@ -1,8 +1,5 @@
 name: Build & Test
 on:
-  push:
-    branches:
-      - test/*
  pull_request:
    branches:
      - master
@@ -21,7 +18,7 @@ jobs:
      - name: Go 1.19
        uses: actions/setup-go@v3
        with:
-          go-version: "1.19.1"
+          go-version: "^1.19"

      - name: OS Packages
        run: |
@@ -55,7 +52,7 @@ jobs:
      - name: Go 1.19
        uses: actions/setup-go@v3
        with:
-          go-version: "1.19.1"
+          go-version: "^1.19"

      - name: Mingw
        run: brew install mingw-w64
@@ -5,7 +5,7 @@ Sliver is an open source cross-platform adversary emulation/red team framework,

 The server and client support MacOS, Windows, and Linux. Implants are supported on MacOS, Windows, and Linux (and possibly every Golang compiler target but we've not tested them all).

-![Go](https://github.com/BishopFox/sliver/workflows/Go/badge.svg?branch=master) [![Go Report Card](https://goreportcard.com/badge/github.com/BishopFox/sliver)](https://goreportcard.com/report/github.com/BishopFox/sliver) [![License: GPL v3](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)
+[![Go Report Card](https://goreportcard.com/badge/github.com/BishopFox/sliver)](https://goreportcard.com/report/github.com/BishopFox/sliver) [![License: GPL v3](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)

 ### Features

@@ -22,7 +22,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path"
 	"path/filepath"
@@ -142,7 +141,7 @@ func LoadAlias(manifestPath string, con *console.SliverConsoleClient) (*AliasMan
 	}

 	// parse it
-	data, err := ioutil.ReadFile(manifestPath)
+	data, err := os.ReadFile(manifestPath)
 	if err != nil {
 		return nil, err
 	}
@@ -303,7 +302,7 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if strings.ToLower(filepath.Ext(binPath)) == ".dll" {
 		isDLL = true
 	}
-	binData, err := ioutil.ReadFile(binPath)
+	binData, err := os.ReadFile(binPath)
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 		return
@@ -311,7 +310,7 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	var outFilePath *os.File
 	if ctx.Flags.Bool("save") {
 		outFile := filepath.Base(fmt.Sprintf("%s_%s*.log", filepath.Base(ctx.Command.Name), filepath.Base(session.GetHostname())))
-		outFilePath, err = ioutil.TempFile("", outFile)
+		outFilePath, err = os.CreateTemp("", outFile)
 		if err != nil {
 			con.PrintErrorf("%s\n", err)
 			return
@@ -232,7 +232,7 @@ GEM
      jekyll-seo-tag (~> 2.1)
    minitest (5.15.0)
    multipart-post (2.1.1)
-    nokogiri (1.13.6)
+    nokogiri (1.13.9)
      mini_portile2 (~> 2.8.0)
      racc (~> 1.4)
    octokit (4.22.0)
@@ -156,7 +156,7 @@ echo "-----------------------------------------------------------------"

 echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux"
 curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux
-echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux"
+echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux-$GO_ARCH_2"
 curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux
 echo "curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/garble.exe https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_windows.exe"
 curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/garble.exe https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_windows.exe
@@ -24,7 +24,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	insecureRand "math/rand"
 	"os"
 	"os/user"
@@ -80,7 +79,7 @@ func GetRootAppDir() string {

 func assetVersion() string {
 	appDir := GetRootAppDir()
-	data, err := ioutil.ReadFile(path.Join(appDir, versionFileName))
+	data, err := os.ReadFile(path.Join(appDir, versionFileName))
 	if err != nil {
 		setupLog.Infof("No version detected %s", err)
 		return ""
@@ -184,7 +183,7 @@ func setupGo(appDir string) error {

 	goZipPath := filepath.Join(appDir, "go.zip")
 	defer os.Remove(goZipPath)
-	ioutil.WriteFile(goZipPath, goZip, 0600)
+	os.WriteFile(goZipPath, goZip, 0600)
 	_, err = unzip(goZipPath, appDir)
 	if err != nil {
 		setupLog.Infof("Failed to unzip file %s -> %s", goZipPath, appDir)
@@ -198,7 +197,7 @@ func setupGo(appDir string) error {
 	}
 	goSrcZipPath := filepath.Join(appDir, "src.zip")
 	defer os.Remove(goSrcZipPath)
-	ioutil.WriteFile(goSrcZipPath, goSrcZip, 0600)
+	os.WriteFile(goSrcZipPath, goSrcZip, 0600)
 	_, err = unzip(goSrcZipPath, goRootPath)
 	if err != nil {
 		setupLog.Infof("Failed to unzip file %s -> %s/go", goSrcZipPath, appDir)
@@ -216,7 +215,7 @@ func setupGo(appDir string) error {
 		return err
 	}
 	garbleLocalPath := filepath.Join(appDir, "go", "bin", garbleFileName)
-	err = ioutil.WriteFile(garbleLocalPath, garbleFile, 0700)
+	err = os.WriteFile(garbleLocalPath, garbleFile, 0700)
 	if err != nil {
 		setupLog.Errorf("Failed to write garble %s", err)
 		return err
@@ -260,8 +259,8 @@ func SetupGoPath(goPathSrc string) error {
 	sliverpbGoSrc = stripSliverpb(sliverpbGoSrc)
 	sliverpbDir := filepath.Join(goPathSrc, "github.com", "bishopfox", "sliver", "protobuf", "sliverpb")
 	os.MkdirAll(sliverpbDir, 0700)
-	ioutil.WriteFile(filepath.Join(sliverpbDir, "sliver.pb.go"), sliverpbGoSrc, 0600)
-	ioutil.WriteFile(filepath.Join(sliverpbDir, "constants.go"), sliverpbConstSrc, 0600)
+	os.WriteFile(filepath.Join(sliverpbDir, "sliver.pb.go"), sliverpbGoSrc, 0600)
+	os.WriteFile(filepath.Join(sliverpbDir, "constants.go"), sliverpbConstSrc, 0600)

 	// Common PB
 	commonpbSrc, err := protobufs.FS.ReadFile("commonpb/common.pb.go")
@@ -271,7 +270,7 @@ func SetupGoPath(goPathSrc string) error {
 	}
 	commonpbDir := filepath.Join(goPathSrc, "github.com", "bishopfox", "sliver", "protobuf", "commonpb")
 	os.MkdirAll(commonpbDir, 0700)
-	ioutil.WriteFile(filepath.Join(commonpbDir, "common.pb.go"), commonpbSrc, 0600)
+	os.WriteFile(filepath.Join(commonpbDir, "common.pb.go"), commonpbSrc, 0600)

 	// DNS PB
 	dnspbSrc, err := protobufs.FS.ReadFile("dnspb/dns.pb.go")
@@ -281,7 +280,7 @@ func SetupGoPath(goPathSrc string) error {
 	}
 	dnspbDir := filepath.Join(goPathSrc, "github.com", "bishopfox", "sliver", "protobuf", "dnspb")
 	os.MkdirAll(dnspbDir, 0700)
-	ioutil.WriteFile(filepath.Join(dnspbDir, "dns.pb.go"), dnspbSrc, 0600)
+	os.WriteFile(filepath.Join(dnspbDir, "dns.pb.go"), dnspbSrc, 0600)
 	return nil
 }

@@ -307,28 +306,6 @@ func stripSliverpb(src []byte) []byte {
 	return out
 }

-func unzipGoDependency(fsPath string, targetPath string) error {
-	setupLog.Infof("Unpacking go dependency %s -> %s", fsPath, targetPath)
-
-	appDir := GetRootAppDir()
-	goDep, err := assetsFs.ReadFile(fsPath)
-	if err != nil {
-		setupLog.Infof("static asset not found: %s", fsPath)
-		return err
-	}
-
-	goDepZipPath := filepath.Join(appDir, filepath.Base(fsPath))
-	defer os.Remove(goDepZipPath)
-	ioutil.WriteFile(goDepZipPath, goDep, 0600)
-	_, err = unzip(goDepZipPath, targetPath)
-	if err != nil {
-		setupLog.Infof("Failed to unzip file %s -> %s", goDepZipPath, appDir)
-		return err
-	}
-
-	return nil
-}
-
 func setupCodenames(appDir string) error {
 	nouns, err := assetsFs.ReadFile("fs/nouns.txt")
 	if err != nil {
@@ -342,13 +319,13 @@ func setupCodenames(appDir string) error {
 		return err
 	}

-	err = ioutil.WriteFile(path.Join(appDir, "nouns.txt"), nouns, 0600)
+	err = os.WriteFile(filepath.Join(appDir, "nouns.txt"), nouns, 0600)
 	if err != nil {
 		setupLog.Infof("Failed to write noun data to: %s", appDir)
 		return err
 	}

-	err = ioutil.WriteFile(path.Join(appDir, "adjectives.txt"), adjectives, 0600)
+	err = os.WriteFile(filepath.Join(appDir, "adjectives.txt"), adjectives, 0600)
 	if err != nil {
 		setupLog.Infof("Failed to write adjective data to: %s", appDir)
 		return err
@@ -374,7 +351,10 @@ func unzip(src string, dest string) ([]string, error) {
 		}
 		defer rc.Close()

-		fPath := filepath.Join(dest, file.Name)
+		fPath := filepath.Clean(filepath.Join(dest, file.Name))
+		if !strings.HasPrefix(fPath, filepath.Clean(dest)) {
+			panic("illegal zip file path")
+		}
 		filenames = append(filenames, fPath)

 		if file.FileInfo().IsDir() {
@@ -22,10 +22,10 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"net/url"
 	"os"
 	"path"
+	"path/filepath"

 	"github.com/bishopfox/sliver/server/assets"
 	"github.com/bishopfox/sliver/server/log"
@@ -52,8 +52,8 @@ var (
 // GetDatabaseConfigPath - File path to config.json
 func GetDatabaseConfigPath() string {
 	appDir := assets.GetRootAppDir()
-	databaseConfigPath := path.Join(appDir, "configs", databaseConfigFileName)
-	databaseConfigLog.Infof("Loading config from %s", databaseConfigPath)
+	databaseConfigPath := filepath.Join(appDir, "configs", databaseConfigFileName)
+	databaseConfigLog.Debugf("Loading config from %s", databaseConfigPath)
 	return databaseConfigPath
 }

@@ -79,7 +79,7 @@ type DatabaseConfig struct {
 func (c *DatabaseConfig) DSN() (string, error) {
 	switch c.Dialect {
 	case Sqlite:
-		filePath := path.Join(assets.GetRootAppDir(), "sliver.db")
+		filePath := filepath.Join(assets.GetRootAppDir(), "sliver.db")
 		params := encodeParams(c.Params)
 		return fmt.Sprintf("file:%s?%s", filePath, params), nil
 	case MySQL:
@@ -88,6 +88,7 @@ func (c *DatabaseConfig) DSN() (string, error) {
 		db := url.QueryEscape(c.Database)
 		host := fmt.Sprintf("%s:%d", url.QueryEscape(c.Host), c.Port)
 		params := encodeParams(c.Params)
+		databaseConfigLog.Infof("Connecting to MySQL database %s@%s/%s", user, host, db)
 		return fmt.Sprintf("%s:%s@tcp(%s)/%s?%s", user, password, host, db, params), nil
 	case Postgres:
 		user := url.QueryEscape(c.Username)
@@ -96,6 +97,7 @@ func (c *DatabaseConfig) DSN() (string, error) {
 		host := url.QueryEscape(c.Host)
 		port := c.Port
 		params := encodeParams(c.Params)
+		databaseConfigLog.Infof("Connecting to Postgres database %s@%s:%d/%s", user, host, port, db)
 		return fmt.Sprintf("host=%s port=%d user=%s password=%s dbname=%s %s", host, port, user, password, db, params), nil
 	default:
 		return "", ErrInvalidDialect
@@ -126,7 +128,7 @@ func (c *DatabaseConfig) Save() error {
 		return err
 	}
 	databaseConfigLog.Infof("Saving config to %s", configPath)
-	err = ioutil.WriteFile(configPath, data, 0600)
+	err = os.WriteFile(configPath, data, 0600)
 	if err != nil {
 		databaseConfigLog.Errorf("Failed to write config %s", err)
 	}
@@ -138,7 +140,7 @@ func GetDatabaseConfig() *DatabaseConfig {
 	configPath := GetDatabaseConfigPath()
 	config := getDefaultDatabaseConfig()
 	if _, err := os.Stat(configPath); !os.IsNotExist(err) {
-		data, err := ioutil.ReadFile(configPath)
+		data, err := os.ReadFile(configPath)
 		if err != nil {
 			databaseConfigLog.Errorf("Failed to read config file %s", err)
 			return config
@@ -22,7 +22,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io/ioutil"
 	insecureRand "math/rand"
 	"os"
 	"path"
@@ -298,7 +297,7 @@ func GetHTTPC2Config() *HTTPC2Config {
 			return &defaultHTTPC2Config
 		}
 	}
-	data, err := ioutil.ReadFile(configPath)
+	data, err := os.ReadFile(configPath)
 	if err != nil {
 		httpC2ConfigLog.Errorf("Failed to read http c2 config %s", err)
 		return &defaultHTTPC2Config
@@ -327,7 +326,7 @@ func CheckHTTPC2ConfigErrors() error {
 			return err
 		}
 	}
-	data, err := ioutil.ReadFile(configPath)
+	data, err := os.ReadFile(configPath)
 	if err != nil {
 		httpC2ConfigLog.Errorf("Failed to read http c2 config %s", err)
 		return err
@@ -351,7 +350,7 @@ func generateDefaultConfig(saveTo string) error {
 	if err != nil {
 		return err
 	}
-	return ioutil.WriteFile(saveTo, data, 0600)
+	return os.WriteFile(saveTo, data, 0600)
 }

 var (
@@ -98,7 +98,6 @@ func postgresClient(dbConfig *configs.DatabaseConfig) *gorm.DB {
 	if err != nil {
 		panic(err)
 	}
-	clientLog.Infof("postgres -> %s", dsn)
 	dbClient, err := gorm.Open(postgres.Open(dsn), &gorm.Config{
 		PrepareStmt: true,
 		Logger:      getGormLogger(dbConfig),
@@ -114,7 +113,6 @@ func mySQLClient(dbConfig *configs.DatabaseConfig) *gorm.DB {
 	if err != nil {
 		panic(err)
 	}
-	clientLog.Infof("mysql -> %s", dsn)
 	dbClient, err := gorm.Open(mysql.Open(dsn), &gorm.Config{
 		PrepareStmt: true,
 		Logger:      getGormLogger(dbConfig),
@@ -32,7 +32,7 @@ func sqliteClient(dbConfig *configs.DatabaseConfig) *gorm.DB {
 	if err != nil {
 		panic(err)
 	}
-	clientLog.Infof("sqlite -> %s", dsn)
+	clientLog.Debugf("sqlite -> %s", dsn)

 	dbClient, err := gorm.Open(sqlite.Open(dsn), &gorm.Config{
 		PrepareStmt: true,
Author	SHA1	Message	Date
Joe	0f5262ef87	Update autorelease.yml Remove goreleaser branch trigger Signed-off-by: Joe <[email protected]>	2022-10-22 13:21:15 -05:00
Joe	bb8b7111b7	Merge pull request #964 from BishopFox/stage Remove ioutil usage	2022-10-21 15:21:24 -05:00
rkervella	567e51ca46	Remove ioutil usage	2022-10-21 11:46:29 -07:00
Joe	05166e896f	Merge pull request #962 from BishopFox/moloch---patch-3 Remove status badge until github fixes	2022-10-21 12:01:47 -05:00
Joe	3cfe6435f3	Remove status badge until github fixes https://github.com/actions/runner/issues/1830 Signed-off-by: Joe <[email protected]>	2022-10-21 11:23:57 -05:00
Ronan Kervella	48c65108d6	Merge pull request #960 from BishopFox/moloch---patch-2 Update badge	2022-10-21 09:00:01 -07:00
Ronan Kervella	a271932c8a	Merge pull request #961 from BishopFox/fix/garble-linux-arm64 Download the correct garble executable for linux arm64	2022-10-21 08:28:13 -07:00
moloch--	8c6fe18280	Download the correct garble executable for linux arm64	2022-10-21 07:38:41 -07:00
Joe	97dbae571c	Update badge Signed-off-by: Joe <[email protected]>	2022-10-20 15:44:48 -05:00
Joe	b5e629c4a6	Merge pull request #959 from BishopFox/test/code-ql Test/code ql	2022-10-20 15:04:24 -05:00
moloch--	30b1cb8a85	Appease codeql's zip/path traversal false detection	2022-10-20 11:45:35 -07:00
moloch--	eb70ed2d0b	Tweak codeql config, fix db logging issue	2022-10-20 10:39:02 -07:00
Joe	53593be73f	Merge pull request #958 from BishopFox/fix/action-go Switch actions to Go ^1.19	2022-10-20 12:35:21 -05:00
moloch--	a144991ede	Update codeql config	2022-10-20 10:03:34 -07:00
moloch--	0bb5ea506a	Switch actions to Go ^1.19	2022-10-20 09:53:13 -07:00
Joe	d76e845bda	Merge pull request #957 from BishopFox/0145dependabot/bundler/docs/nokogiri-1.13.9 Bump nokogiri from 1.13.6 to 1.13.9 in /docs	2022-10-19 13:25:05 -05:00
dependabot[bot]	47d1f0d66b	Bump nokogiri from 1.13.6 to 1.13.9 in /docs Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.13.6 to 1.13.9. - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.13.6...v1.13.9) --- updated-dependencies: - dependency-name: nokogiri dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>	2022-10-19 17:07:35 +00:00
Joe	bf1127f7f2	Merge pull request #956 from BishopFox/go-sqlite Update pure go sqlite3	2022-10-19 12:07:04 -05:00