WIP on new dns c2 schema

Makefile

@@ -121,6 +121,7 @@ windows: clean
 .PHONY: pb
 pb:
 	protoc -I protobuf/ protobuf/commonpb/common.proto --go_out=paths=source_relative:protobuf/
+	protoc -I protobuf/ protobuf/dnspb/dns.proto --go_out=paths=source_relative:protobuf/
 	protoc -I protobuf/ protobuf/sliverpb/sliver.proto --go_out=paths=source_relative:protobuf/
 	protoc -I protobuf/ protobuf/clientpb/client.proto --go_out=paths=source_relative:protobuf/
 	protoc -I protobuf/ protobuf/rpcpb/services.proto --go_out=paths=source_relative:protobuf/ --go-grpc_out=protobuf/ --go-grpc_opt=paths=source_relative 

client/command/commands.go

@@ -1643,7 +1643,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-			f.String("H", "hive", "HKCU", "registry hive")
+			f.String("H", "hive", "HKCU", "egistry hive")
 			f.String("o", "hostname", "", "remote host to read values from")
 		},
 		HelpGroup: consts.SliverWinHelpGroup,
@@ -1690,45 +1690,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("o", "hostname", "", "remote host to write values to")
 		},
 	})
-	registryCmd.AddCommand(&grumble.Command{
-		Name:     consts.RegistryListSubStr,
-		Help:     "List the sub keys under a registry key",
-		LongHelp: help.GetHelpFor([]string{consts.RegistryListSubStr}),
-		Args: func(a *grumble.Args) {
-			a.String("registry-path", "registry path")
-		},
-		Run: func(ctx *grumble.Context) error {
-			con.Println()
-			registry.RegListSubKeysCmd(ctx, con)
-			con.Println()
-			return nil
-		},
-		Flags: func(f *grumble.Flags) {
-			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-			f.String("H", "hive", "HKCU", "registry hive")
-			f.String("o", "hostname", "", "remote host to write values to")
-		},
-	})
-
-	registryCmd.AddCommand(&grumble.Command{
-		Name:     consts.RegistryListValuesStr,
-		Help:     "List the values for a registry key",
-		LongHelp: help.GetHelpFor([]string{consts.RegistryListValuesStr}),
-		Args: func(a *grumble.Args) {
-			a.String("registry-path", "registry path")
-		},
-		Run: func(ctx *grumble.Context) error {
-			con.Println()
-			registry.RegListValuesCmd(ctx, con)
-			con.Println()
-			return nil
-		},
-		Flags: func(f *grumble.Flags) {
-			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-			f.String("H", "hive", "HKCU", "registry hive")
-			f.String("o", "hostname", "", "remote host to write values to")
-		},
-	})
 	con.App.AddCommand(registryCmd)
 
 	// [ Pivots ] --------------------------------------------------------------
@@ -2207,22 +2168,4 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 	}
 	con.App.AddCommand(dllhijackCmd)
-
-	// [ Get Privs ] -----------------------------------------------------------------
-	getprivsCmd := &grumble.Command{
-		Name:      consts.GetPrivsStr,
-		Help:      "Get current privileges (Windows)",
-		LongHelp:  help.GetHelpFor([]string{consts.GetPrivsStr}),
-		HelpGroup: consts.SliverWinHelpGroup,
-		Run: func(ctx *grumble.Context) error {
-			con.Println()
-			privilege.GetPrivsCmd(ctx, con)
-			con.Println()
-			return nil
-		},
-		Flags: func(f *grumble.Flags) {
-			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-		},
-	}
-	con.App.AddCommand(getprivsCmd)
 }

client/command/help/long-help.go

@@ -627,10 +627,6 @@ dllhijack --reference-path c:\\windows\\system32\\msasn1.dll --profile dll c:\\u
 
 # Use a local DLL as the reference DLL
 dllhijack --reference-path c:\\windows\\system32\\msasn1.dll --reference-file /tmp/msasn1.dll.orig --profile dll c:\\users\\bob\\appdata\\slack\\app-4.18.0\\msasn1.dll
-`
-
-	getPrivsHelp = `[[.Bold]]Command:[[.Normal]] getprivs
-[[.Bold]]About:[[.Normal]] Get privilege information for the current process (Windows only).
 `
 )
 

client/command/privilege/getprivs.go

@@ -1,99 +0,0 @@
-package privilege
-
-import (
-	"context"
-
-	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/protobuf/sliverpb"
-	"github.com/desertbit/grumble"
-)
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2021  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-func GetPrivsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
-	if session == nil {
-		return
-	}
-
-	if session.OS != "windows" {
-		con.PrintErrorf("Command not supported on this operating system.")
-		return
-	}
-
-	privs, err := con.Rpc.GetPrivs(context.Background(), &sliverpb.GetPrivsReq{
-		Request: con.ActiveSession.Request(ctx),
-	})
-
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return
-	}
-
-	// Response is the Envelope (see RPC API), Err is part of it.
-	if privs.Response != nil && privs.Response.Err != "" {
-		con.PrintErrorf("NOTE: Information may be incomplete due to an error:\n")
-		con.PrintErrorf("%s\n", privs.Response.Err)
-	}
-
-	if privs.PrivInfo == nil {
-		return
-	}
-
-	// To make things look pretty, figure out the longest name and description
-	// for column width
-	var nameColumnWidth int = 0
-	var descriptionColumnWidth int = 0
-
-	for _, entry := range privs.PrivInfo {
-		if len(entry.Name) > nameColumnWidth {
-			nameColumnWidth = len(entry.Name)
-		}
-		if len(entry.Description) > descriptionColumnWidth {
-			descriptionColumnWidth = len(entry.Description)
-		}
-	}
-
-	// Give one more space
-	nameColumnWidth += 1
-	descriptionColumnWidth += 1
-
-	con.Println("Privilege Information for Current Process")
-	con.Println("-----------------------------------------")
-	con.Printf("%-*s\t%-*s\t%s\n", nameColumnWidth, "Name", descriptionColumnWidth, "Description", "Attributes")
-	con.Printf("%-*s\t%-*s\t%s\n", nameColumnWidth, "====", descriptionColumnWidth, "===========", "==========")
-	for _, entry := range privs.PrivInfo {
-		con.Printf("%-*s\t%-*s\t(", nameColumnWidth, entry.Name, descriptionColumnWidth, entry.Description)
-		if entry.Enabled {
-			con.Printf("Enabled")
-		} else {
-			con.Printf("Disabled")
-		}
-		if entry.EnabledByDefault {
-			con.Printf(", Enabled by Default")
-		}
-		if entry.Removed {
-			con.Printf(", Removed")
-		}
-		if entry.UsedForAccess {
-			con.Printf(", Used for Access")
-		}
-		con.Printf(")\n")
-	}
-}

client/command/registry/reg-create.go

@@ -49,20 +49,12 @@ func RegCreateKeyCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if strings.Contains(regPath, "/") {
 		regPath = strings.ReplaceAll(regPath, "/", "\\")
 	}
-	pathBaseIdx := strings.LastIndex(regPath, `\`)
-	if pathBaseIdx < 0 {
-		con.PrintErrorf("invalid path: %s", regPath)
-		return
-	}
-	if len(regPath) < pathBaseIdx+1 {
-		con.PrintErrorf("invalid path: %s", regPath)
-		return
-	}
-	finalPath := regPath[:pathBaseIdx]
-	key := regPath[pathBaseIdx+1:]
+	slashIndex := strings.LastIndex(regPath, "\\")
+	key := regPath[slashIndex+1:]
+	regPath = regPath[:slashIndex]
 	createKeyResp, err := con.Rpc.RegistryCreateKey(context.Background(), &sliverpb.RegistryCreateKeyReq{
 		Hive:     hive,
-		Path:     finalPath,
+		Path:     regPath,
 		Key:      key,
 		Hostname: hostname,
 		Request:  con.ActiveSession.Request(ctx),

client/command/registry/reg-list.go

@@ -1,77 +0,0 @@
-package registry
-
-import (
-	"context"
-
-	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/protobuf/sliverpb"
-	"github.com/desertbit/grumble"
-)
-
-func RegListSubKeysCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
-	if session == nil {
-		return
-	}
-
-	path := ctx.Args.String("registry-path")
-	hive := ctx.Flags.String("hive")
-	hostname := ctx.Flags.String("hostname")
-
-	regList, err := con.Rpc.RegistryListSubKeys(context.Background(), &sliverpb.RegistrySubKeyListReq{
-		Hive:     hive,
-		Hostname: hostname,
-		Path:     path,
-		Request:  con.ActiveSession.Request(ctx),
-	})
-
-	if err != nil {
-		con.PrintErrorf("Error: %s\n", err.Error())
-		return
-	}
-
-	if regList.Response != nil && regList.Response.Err != "" {
-		con.PrintErrorf("Error: %s\n", regList.Response.Err)
-		return
-	}
-	if len(regList.Subkeys) > 0 {
-		con.PrintInfof("Sub keys under %s:\\%s:\n", hive, path)
-	}
-	for _, subKey := range regList.Subkeys {
-		con.Println(subKey)
-	}
-}
-
-func RegListValuesCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.GetInteractive()
-	if session == nil {
-		return
-	}
-
-	regPath := ctx.Args.String("registry-path")
-	hive := ctx.Flags.String("hive")
-	hostname := ctx.Flags.String("hostname")
-
-	regList, err := con.Rpc.RegistryListValues(context.Background(), &sliverpb.RegistryListValuesReq{
-		Hive:     hive,
-		Hostname: hostname,
-		Path:     regPath,
-		Request:  con.ActiveSession.Request(ctx),
-	})
-
-	if err != nil {
-		con.PrintErrorf("Error: %s\n", err.Error())
-		return
-	}
-
-	if regList.Response != nil && regList.Response.Err != "" {
-		con.PrintErrorf("Error: %s\n", regList.Response.Err)
-		return
-	}
-	if len(regList.ValueNames) > 0 {
-		con.PrintInfof("Values under %s:\\%s:\n", hive, regPath)
-	}
-	for _, val := range regList.ValueNames {
-		con.Println(val)
-	}
-}

client/command/registry/reg-read.go

@@ -72,10 +72,6 @@ func getType(t string) (uint32, error) {
 
 // RegReadCmd - Read a windows registry key: registry read --hostname aa.bc.local --hive HKCU "software\google\chrome\blbeacon\version"
 func RegReadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	var (
-		finalPath string
-		key       string
-	)
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {
 		return
@@ -97,24 +93,15 @@ func RegReadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintErrorf("You must provide a path")
 		return
 	}
-
 	if strings.Contains(regPath, "/") {
 		regPath = strings.ReplaceAll(regPath, "/", "\\")
 	}
-	pathBaseIdx := strings.LastIndex(regPath, `\`)
-	if pathBaseIdx < 0 {
-		con.PrintErrorf("invalid path: %s", regPath)
-		return
-	}
-	if len(regPath) < pathBaseIdx+1 {
-		con.PrintErrorf("invalid path: %s", regPath)
-		return
-	}
-	finalPath = regPath[:pathBaseIdx]
-	key = regPath[pathBaseIdx+1:]
+	slashIndex := strings.LastIndex(regPath, "\\")
+	key := regPath[slashIndex+1:]
+	regPath = regPath[:slashIndex]
 	regRead, err := con.Rpc.RegistryRead(context.Background(), &sliverpb.RegistryReadReq{
 		Hive:     hive,
-		Path:     finalPath,
+		Path:     regPath,
 		Key:      key,
 		Hostname: hostname,
 		Request:  con.ActiveSession.Request(ctx),

client/command/registry/reg-write.go

@@ -71,17 +71,9 @@ func RegWriteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if strings.Contains(regPath, "/") {
 		regPath = strings.ReplaceAll(regPath, "/", "\\")
 	}
-	pathBaseIdx := strings.LastIndex(regPath, `\`)
-	if pathBaseIdx < 0 {
-		con.PrintErrorf("invalid path: %s", regPath)
-		return
-	}
-	if len(regPath) < pathBaseIdx+1 {
-		con.PrintErrorf("invalid path: %s", regPath)
-		return
-	}
-	finalPath := regPath[:pathBaseIdx]
-	key := regPath[pathBaseIdx+1:]
+	slashIndex := strings.LastIndex(regPath, "\\")
+	key := regPath[slashIndex+1:]
+	regPath = regPath[:slashIndex]
 	switch valType {
 	case sliverpb.RegistryTypeBinary:
 		var (
@@ -126,7 +118,7 @@ func RegWriteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		Request:     con.ActiveSession.Request(ctx),
 		Hostname:    hostname,
 		Hive:        hive,
-		Path:        finalPath,
+		Path:        regPath,
 		Type:        valType,
 		Key:         key,
 		StringValue: stringValue,

client/constants/constants.go

@@ -206,8 +206,6 @@ const (
 	ReactionStr = "reaction"
 
 	LicensesStr = "licenses"
-
-	GetPrivsStr = "getprivs"
 )
 
 // Groups

implant/sliver/encoders/base32.go

@@ -0,0 +1,42 @@
+package encoders
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2019  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"encoding/base32"
+)
+
+// Base32EncoderID - EncoderID
+const Base32EncoderID = 65
+
+// Base32 Encoder
+type Base32 struct{}
+
+var base32Alphabet = "ab1c2d3e4f5g6h7j8k9m0npqrtuvwxyz"
+var sliverBase32 = base32.NewEncoding(base32Alphabet)
+
+// Encode - Base32 Encode
+func (e Base32) Encode(data []byte) []byte {
+	return []byte(sliverBase32.EncodeToString(data))
+}
+
+// Decode - Base32 Decode
+func (e Base32) Decode(data []byte) ([]byte, error) {
+	return sliverBase32.DecodeString(string(data))
+}

implant/sliver/encoders/base62.go

@@ -0,0 +1,210 @@
+package encoders
+
+/*
+	MIT License
+
+	Copyright (c) 2019 Shawn Wang <[email protected]>
+
+	Permission is hereby granted, free of charge, to any person obtaining a copy
+	of this software and associated documentation files (the "Software"), to deal
+	in the Software without restriction, including without limitation the rights
+	to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+	copies of the Software, and to permit persons to whom the Software is
+	furnished to do so, subject to the following conditions:
+
+	The above copyright notice and this permission notice shall be included in all
+	copies or substantial portions of the Software.
+
+	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+	IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+	AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+	LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+	OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+	SOFTWARE.
+	-------------------------------------------------------------------------------
+
+	Modifications by moloch to work with Sliver
+
+*/
+
+import (
+	"math/bits"
+	"strconv"
+)
+
+const (
+	base        = 62
+	compactMask = 0x1E // 00011110
+	mask5bits   = 0x1F // 00011111
+)
+
+// Base62EncoderID - EncoderID
+const Base62EncoderID = 43
+
+// Base62 Encoder
+type Base62 struct{}
+
+var base62Alphabet = "aBCDEFGHIJKLMNOPQRSTUVWXYZAbcdefghijklmnopqrstuvwxyz0123456789"
+
+// Encode - Base62 Encode
+func (e Base62) Encode(data []byte) []byte {
+	return []byte(NewEncoding(base62Alphabet).EncodeToString(data))
+}
+
+// Decode - Base62 Decode
+func (e Base62) Decode(data []byte) ([]byte, error) {
+	return NewEncoding(base62Alphabet).DecodeString(string(data))
+}
+
+type Base62Encoder struct {
+	encode    [base]byte
+	decodeMap [256]byte
+}
+
+func NewEncoding(encoder string) *Base62Encoder {
+	if len(encoder) != base {
+		panic("encoding alphabet is not 62-bytes long")
+	}
+	for i := 0; i < len(encoder); i++ {
+		if encoder[i] == '\n' || encoder[i] == '\r' {
+			panic("encoding alphabet contains newline character")
+		}
+	}
+
+	e := new(Base62Encoder)
+	copy(e.encode[:], encoder)
+	for i := 0; i < len(e.decodeMap); i++ {
+		e.decodeMap[i] = 0xFF
+	}
+	for i := 0; i < len(encoder); i++ {
+		e.decodeMap[encoder[i]] = byte(i)
+	}
+	return e
+}
+
+func (enc *Base62Encoder) Encode(src []byte) []byte {
+	if len(src) == 0 {
+		return []byte{}
+	}
+	encoder := newEncoder(src)
+	return encoder.encode(enc.encode[:])
+}
+
+func (enc *Base62Encoder) EncodeToString(src []byte) string {
+	ret := enc.Encode(src)
+	return string(ret)
+}
+
+type encoder struct {
+	b   []byte
+	pos int
+}
+
+func newEncoder(src []byte) *encoder {
+	return &encoder{
+		b:   src,
+		pos: len(src) * 8,
+	}
+}
+
+func (enc *encoder) next() (byte, bool) {
+	var i, pos int
+	var j, blen byte
+	pos = enc.pos - 6
+	if pos <= 0 {
+		pos = 0
+		blen = byte(enc.pos)
+	} else {
+		i = pos / 8
+		j = byte(pos % 8)
+		blen = byte((i+1)*8 - pos)
+		if blen > 6 {
+			blen = 6
+		}
+	}
+	shift := 8 - j - blen
+	b := enc.b[i] >> shift & (1<<blen - 1)
+
+	if blen < 6 && pos > 0 {
+		blen1 := 6 - blen
+		b = b<<blen1 | enc.b[i+1]>>(8-blen1)
+	}
+	if b&compactMask == compactMask {
+		if pos > 0 || b > mask5bits {
+			pos++
+		}
+		b &= mask5bits
+	}
+	enc.pos = pos
+
+	return b, pos > 0
+}
+
+func (enc *encoder) encode(encTable []byte) []byte {
+	ret := make([]byte, 0, len(enc.b)*8/5+1)
+	x, hasMore := enc.next()
+	for {
+		ret = append(ret, encTable[x])
+		if !hasMore {
+			break
+		}
+		x, hasMore = enc.next()
+	}
+	return ret
+}
+
+type CorruptInputError int64
+
+func (e CorruptInputError) Error() string {
+	return "illegal base62 data at input byte " + strconv.FormatInt(int64(e), 10)
+}
+
+func (enc *Base62Encoder) Decode(src []byte) ([]byte, error) {
+	if len(src) == 0 {
+		return []byte{}, nil
+	}
+	dec := decoder(src)
+	return dec.decode(enc.decodeMap[:])
+}
+
+func (enc *Base62Encoder) DecodeString(src string) ([]byte, error) {
+	return enc.Decode([]byte(src))
+}
+
+type decoder []byte
+
+func (dec decoder) decode(decTable []byte) ([]byte, error) {
+	ret := make([]byte, len(dec)*6/8+1)
+	idx := len(ret)
+	pos := byte(0)
+	b := 0
+	for i, c := range dec {
+		x := decTable[c]
+		if x == 0xFF {
+			return nil, CorruptInputError(i)
+		}
+		if i == len(dec)-1 {
+			b |= int(x) << pos
+			pos += byte(bits.Len8(x))
+		} else if x&compactMask == compactMask {
+			b |= int(x) << pos
+			pos += 5
+		} else {
+			b |= int(x) << pos
+			pos += 6
+		}
+		if pos >= 8 {
+			idx--
+			ret[idx] = byte(b)
+			pos %= 8
+			b >>= 8
+		}
+	}
+	if pos > 0 {
+		idx--
+		ret[idx] = byte(b)
+	}
+
+	return ret[idx:], nil
+}

implant/sliver/encoders/base64.go

@@ -1,7 +1,5 @@
 package encoders
 
-import "encoding/base64"
-
 /*
 	Sliver Implant Framework
 	Copyright (C) 2019  Bishop Fox
@@ -20,6 +18,8 @@ import "encoding/base64"
 	along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 
+import "encoding/base64"
+
 // Base64EncoderID - EncoderID
 const Base64EncoderID = 13
 

implant/sliver/handlers/handlers_windows.go

@@ -61,21 +61,18 @@ var (
 		sliverpb.MsgSetEnvReq:                setEnvHandler,
 		sliverpb.MsgUnsetEnvReq:              unsetEnvHandler,
 		sliverpb.MsgExecuteTokenReq:          executeTokenHandler,
-		sliverpb.MsgGetPrivsReq:              getPrivsHandler,
 
 		// Platform specific
-		sliverpb.MsgIfconfigReq:            ifconfigHandler,
-		sliverpb.MsgScreenshotReq:          screenshotHandler,
-		sliverpb.MsgSideloadReq:            sideloadHandler,
-		sliverpb.MsgNetstatReq:             netstatHandler,
-		sliverpb.MsgMakeTokenReq:           makeTokenHandler,
-		sliverpb.MsgPsReq:                  psHandler,
-		sliverpb.MsgTerminateReq:           terminateHandler,
-		sliverpb.MsgRegistryReadReq:        regReadHandler,
-		sliverpb.MsgRegistryWriteReq:       regWriteHandler,
-		sliverpb.MsgRegistryCreateKeyReq:   regCreateKeyHandler,
-		sliverpb.MsgRegistrySubKeysListReq: regSubKeysListHandler,
-		sliverpb.MsgRegistryListValuesReq:  regValuesListHandler,
+		sliverpb.MsgIfconfigReq:          ifconfigHandler,
+		sliverpb.MsgScreenshotReq:        screenshotHandler,
+		sliverpb.MsgSideloadReq:          sideloadHandler,
+		sliverpb.MsgNetstatReq:           netstatHandler,
+		sliverpb.MsgMakeTokenReq:         makeTokenHandler,
+		sliverpb.MsgPsReq:                psHandler,
+		sliverpb.MsgTerminateReq:         terminateHandler,
+		sliverpb.MsgRegistryReadReq:      regReadHandler,
+		sliverpb.MsgRegistryWriteReq:     regWriteHandler,
+		sliverpb.MsgRegistryCreateKeyReq: regCreateKeyHandler,
 
 		// Generic
 		sliverpb.MsgPing:                 pingHandler,
@@ -496,85 +493,3 @@ func regCreateKeyHandler(data []byte, resp RPCResponse) {
 	data, err = proto.Marshal(createResp)
 	resp(data, err)
 }
-
-func regSubKeysListHandler(data []byte, resp RPCResponse) {
-	listReq := &sliverpb.RegistrySubKeyListReq{}
-	err := proto.Unmarshal(data, listReq)
-	if err != nil {
-		return
-	}
-	subKeys, err := registry.ListSubKeys(listReq.Hostname, listReq.Hive, listReq.Path)
-	regListResp := &sliverpb.RegistrySubKeyList{
-		Response: &commonpb.Response{},
-	}
-	if err != nil {
-		regListResp.Response.Err = err.Error()
-	} else {
-		regListResp.Subkeys = subKeys
-	}
-	data, err = proto.Marshal(regListResp)
-	resp(data, err)
-}
-
-func regValuesListHandler(data []byte, resp RPCResponse) {
-	listReq := &sliverpb.RegistryListValuesReq{}
-	err := proto.Unmarshal(data, listReq)
-	if err != nil {
-		return
-	}
-	regValues, err := registry.ListValues(listReq.Hostname, listReq.Hive, listReq.Path)
-	regListResp := &sliverpb.RegistryValuesList{
-		Response: &commonpb.Response{},
-	}
-	if err != nil {
-		regListResp.Response.Err = err.Error()
-	} else {
-		regListResp.ValueNames = regValues
-	}
-	data, err = proto.Marshal(regListResp)
-	resp(data, err)
-}
-
-func getPrivsHandler(data []byte, resp RPCResponse) {
-	createReq := &sliverpb.GetPrivsReq{}
-
-	err := proto.Unmarshal(data, createReq)
-	if err != nil {
-		return
-	}
-
-	privsInfo, err := priv.GetPrivs()
-
-	response_data := make([]*sliverpb.WindowsPrivilegeEntry, len(privsInfo))
-
-	/*
-		Translate the PrivilegeInfo structs into
-		sliverpb.WindowsPrivilegeEntry structs and put them in the data
-		that will go back to the server / client
-	*/
-	for index, entry := range privsInfo {
-		var currentEntry sliverpb.WindowsPrivilegeEntry
-
-		currentEntry.Name = entry.Name
-		currentEntry.Description = entry.Description
-		currentEntry.Enabled = entry.Enabled
-		currentEntry.EnabledByDefault = entry.EnabledByDefault
-		currentEntry.Removed = entry.Removed
-		currentEntry.UsedForAccess = entry.UsedForAccess
-
-		response_data[index] = &currentEntry
-	}
-
-	// Package up the response
-	getPrivsResp := &sliverpb.GetPrivs{
-		PrivInfo: response_data,
-		Response: &commonpb.Response{},
-	}
-
-	if err != nil {
-		getPrivsResp.Response.Err = err.Error()
-	}
-
-	data, err = proto.Marshal(getPrivsResp)
-	resp(data, err)
-}

implant/sliver/priv/priv_windows.go

@@ -26,8 +26,6 @@ import (
 	"log"
 
 	// {{end}}
-	"bytes"
-	"encoding/binary"
 	"fmt"
 	"os/exec"
 	"runtime"
@@ -45,15 +43,6 @@ const (
 	THREAD_ALL_ACCESS = windows.STANDARD_RIGHTS_REQUIRED | windows.SYNCHRONIZE | 0xffff
 )
 
-type PrivilegeInfo struct {
-	Name             string
-	Description      string
-	Enabled          bool
-	EnabledByDefault bool
-	Removed          bool
-	UsedForAccess    bool
-}
-
 var CurrentToken windows.Token
 
 func SePrivEnable(s string) error {
@@ -339,163 +328,3 @@ func GetSystem(data []byte, hostingProcess string) (err error) {
 	}
 	return
 }
-
-func lookupPrivilegeNameByLUID(luid uint64) (string, string, error) {
-	/*
-	   We will need the LookupPrivilegeNameW and LookupPrivilegeDisplayNameW functions
-	   https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-lookupprivilegenamew
-	   https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-lookupprivilegedisplaynamew
-
-	   Defined these syscalls in implant/sliver/syscalls/syscalls_windows.go and generated them with
-	   mkwinsyscall, so we are good to go.
-	*/
-
-	// Allocate 256 wide unicode characters (uint16) for the both names (255 characters plus a null terminator)
-	nameBuffer := make([]uint16, 256)
-	nameBufferSize := uint32(len(nameBuffer))
-	displayNameBuffer := make([]uint16, 256)
-	displayNameBufferSize := uint32(len(displayNameBuffer))
-
-	// A blank string for the system name tells the call to use the local machine
-	systemName := ""
-
-	/*
-	  A language ID that gets returned from LookupPrivilegeDisplayNameW
-	  We do not need it for anything, but we still need to provide it
-	*/
-	var langID uint32
-
-	err := syscalls.LookupPrivilegeNameW(systemName, &luid, &nameBuffer[0], &nameBufferSize)
-
-	if err != nil {
-		return "", "", err
-	}
-
-	err = syscalls.LookupPrivilegeDisplayNameW(systemName, &nameBuffer[0], &displayNameBuffer[0], &displayNameBufferSize, &langID)
-
-	if err != nil {
-		// We already got the privilege name, so we might as well return that
-		return syscall.UTF16ToString(nameBuffer), "", err
-	}
-
-	return syscall.UTF16ToString(nameBuffer), syscall.UTF16ToString(displayNameBuffer), nil
-}
-
-func GetPrivs() ([]PrivilegeInfo, error) {
-	// A place to store the process token
-	var tokenHandle syscall.Token
-
-	// A place to put the size of the token information
-	var tokenInfoBufferSize uint32
-
-	// Get a handle for the current process
-	currentProcHandle, err := syscall.GetCurrentProcess()
-
-	if err != nil {
-		// {{if .Config.Debug}}
-		log.Println("Could not get a handle for the current process: ", err)
-		// {{end}}
-		return nil, err
-	}
-
-	// Get the process token from the current process
-	err = syscall.OpenProcessToken(currentProcHandle, syscall.TOKEN_QUERY, &tokenHandle)
-
-	if err != nil {
-		// {{if .Config.Debug}}
-		log.Println("Could not open process token: ", err)
-		// {{end}}
-		return nil, err
-	}
-
-	// Get the size of the token information buffer so we know how large of a buffer to allocate
-	// This produces an error about a data area passed to the syscall being too small, but
-	// we do not care about that because we just want to know how big of a buffer to make
-	syscall.GetTokenInformation(tokenHandle, syscall.TokenPrivileges, nil, 0, &tokenInfoBufferSize)
-
-	// Make the buffer and get token information
-	// Using a bytes Buffer so that we can Read from it later
-	tokenInfoBuffer := bytes.NewBuffer(make([]byte, tokenInfoBufferSize))
-
-	err = syscall.GetTokenInformation(tokenHandle,
-		syscall.TokenPrivileges,
-		&tokenInfoBuffer.Bytes()[0],
-		uint32(tokenInfoBuffer.Len()),
-		&tokenInfoBufferSize,
-	)
-
-	if err != nil {
-		// {{if .Config.Debug}}
-		log.Println("Error in call to GetTokenInformation: ", err)
-		// {{end}}
-		return nil, err
-	}
-
-	// The first 32 bits is the number of privileges in the structure
-	var privilegeCount uint32
-	err = binary.Read(tokenInfoBuffer, binary.LittleEndian, &privilegeCount)
-
-	if err != nil {
-		// {{if .Config.Debug}}
-		log.Println("Could not read the number of privileges from the token information.")
-		// {{end}}
-		return nil, err
-	}
-
-	/*
-		The remaining bytes contain the privileges themselves
-		LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY]
-		Structure of the array: https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-luid_and_attributes
-	*/
-
-	privInfo := make([]PrivilegeInfo, int(privilegeCount))
-
-	for index := 0; index < int(privilegeCount); index++ {
-		// Iterate over the privileges and make sense of them
-		// In case of errors, return what we have so far and the error
-
-		// LUIDs consist of a DWORD and a LONG
-		var luid uint64
-
-		// Attributes are up to 32 one bit flags, so a uint32 is good for that
-		var attributes uint32
-
-		var currentPrivInfo PrivilegeInfo
-
-		// Read the LUID
-		err = binary.Read(tokenInfoBuffer, binary.LittleEndian, &luid)
-		if err != nil {
-			// {{if .Config.Debug}}
-			log.Println("Could not read the LUID from the binary stream: ", err)
-			// {{end}}
-			return privInfo, err
-		}
-
-		// Read the attributes
-		err = binary.Read(tokenInfoBuffer, binary.LittleEndian, &attributes)
-		if err != nil {
-			// {{if .Config.Debug}}
-			log.Println("Could not read the attributes from the binary stream: ", err)
-			// {{end}}
-			return privInfo, err
-		}
-
-		currentPrivInfo.Name, currentPrivInfo.Description, err = lookupPrivilegeNameByLUID(luid)
-		if err != nil {
-			// {{if .Config.Debug}}
-			log.Println("Could not get privilege info based on the LUID: ", err)
-			// {{end}}
-			return privInfo, err
-		}
-
-		// Figure out the attributes
-		currentPrivInfo.EnabledByDefault = (attributes & windows.SE_PRIVILEGE_ENABLED_BY_DEFAULT) > 0
-		currentPrivInfo.UsedForAccess = (attributes & windows.SE_PRIVILEGE_USED_FOR_ACCESS) > 0
-		currentPrivInfo.Enabled = (attributes & windows.SE_PRIVILEGE_ENABLED) > 0
-		currentPrivInfo.Removed = (attributes & windows.SE_PRIVILEGE_REMOVED) > 0
-
-		privInfo[index] = currentPrivInfo
-	}
-
-	return privInfo, nil
-}

implant/sliver/syscalls/syscalls_windows.go

@@ -35,5 +35,3 @@ package syscalls
 //sys SelectObject(hdc windows.Handle, h windows.Handle) (HGDIOBJ windows.Handle, err error) = Gdi32.SelectObject
 //sys BitBlt(hdc windows.Handle, x uint32, y uint32, cx uint32, cy uint32, hdcSrc windows.Handle, x1 uint32, y1 uint32, rop int32) (BOOL int, err error) = Gdi32.BitBlt
 //sys GetDIBits(hdc windows.Handle, hbm windows.Handle, start uint32, cLines uint32, lpvBits uintptr, lpbmi uintptr, usage int) (ret int, err error) = Gdi32.GetDIBits
-//sys LookupPrivilegeNameW(systemName string, luid *uint64, buffer *uint16, size *uint32) (err error) = advapi32.LookupPrivilegeNameW
-//sys LookupPrivilegeDisplayNameW(systemName string, privilegeName *uint16, buffer *uint16, size *uint32, languageId *uint32) (err error) = advapi32.LookupPrivilegeDisplayNameW

implant/sliver/syscalls/zsyscalls_windows.go

@@ -19,7 +19,6 @@ const (
 
 var (
 	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
-	errERROR_EINVAL     error = syscall.EINVAL
 )
 
 // errnoErr returns common boxed Errno values, to prevent
@@ -27,7 +26,7 @@ var (
 func errnoErr(e syscall.Errno) error {
 	switch e {
 	case 0:
-		return errERROR_EINVAL
+		return nil
 	case errnoERROR_IO_PENDING:
 		return errERROR_IO_PENDING
 	}
@@ -38,228 +37,92 @@ func errnoErr(e syscall.Errno) error {
 }
 
 var (
+	modkernel32 = windows.NewLazySystemDLL("kernel32.dll")
 	modDbgHelp  = windows.NewLazySystemDLL("DbgHelp.dll")
+	modadvapi32 = windows.NewLazySystemDLL("advapi32.dll")
+	modUser32   = windows.NewLazySystemDLL("User32.dll")
 	modGdi32    = windows.NewLazySystemDLL("Gdi32.dll")
 	modKernel32 = windows.NewLazySystemDLL("Kernel32.dll")
-	modUser32   = windows.NewLazySystemDLL("User32.dll")
-	modadvapi32 = windows.NewLazySystemDLL("advapi32.dll")
-	modkernel32 = windows.NewLazySystemDLL("kernel32.dll")
 
+	procInitializeProcThreadAttributeList = modkernel32.NewProc("InitializeProcThreadAttributeList")
+	procGetProcessHeap                    = modkernel32.NewProc("GetProcessHeap")
+	procHeapAlloc                         = modkernel32.NewProc("HeapAlloc")
+	procUpdateProcThreadAttribute         = modkernel32.NewProc("UpdateProcThreadAttribute")
+	procCreateProcessW                    = modkernel32.NewProc("CreateProcessW")
+	procVirtualAllocEx                    = modkernel32.NewProc("VirtualAllocEx")
+	procWriteProcessMemory                = modkernel32.NewProc("WriteProcessMemory")
+	procVirtualProtectEx                  = modkernel32.NewProc("VirtualProtectEx")
+	procQueueUserAPC                      = modkernel32.NewProc("QueueUserAPC")
+	procDeleteProcThreadAttributeList     = modkernel32.NewProc("DeleteProcThreadAttributeList")
+	procHeapFree                          = modkernel32.NewProc("HeapFree")
+	procCreateRemoteThread                = modkernel32.NewProc("CreateRemoteThread")
+	procCreateThread                      = modkernel32.NewProc("CreateThread")
+	procGetExitCodeThread                 = modkernel32.NewProc("GetExitCodeThread")
 	procMiniDumpWriteDump                 = modDbgHelp.NewProc("MiniDumpWriteDump")
-	procBitBlt                            = modGdi32.NewProc("BitBlt")
-	procCreateCompatibleBitmap            = modGdi32.NewProc("CreateCompatibleBitmap")
+	procImpersonateLoggedOnUser           = modadvapi32.NewProc("ImpersonateLoggedOnUser")
+	procLogonUserW                        = modadvapi32.NewProc("LogonUserW")
+	procGetDC                             = modUser32.NewProc("GetDC")
+	procReleaseDC                         = modUser32.NewProc("ReleaseDC")
 	procCreateCompatibleDC                = modGdi32.NewProc("CreateCompatibleDC")
+	procGetDesktopWindow                  = modUser32.NewProc("GetDesktopWindow")
 	procDeleteDC                          = modGdi32.NewProc("DeleteDC")
+	procCreateCompatibleBitmap            = modGdi32.NewProc("CreateCompatibleBitmap")
 	procDeleteObject                      = modGdi32.NewProc("DeleteObject")
-	procGetDIBits                         = modGdi32.NewProc("GetDIBits")
-	procSelectObject                      = modGdi32.NewProc("SelectObject")
 	procGlobalAlloc                       = modKernel32.NewProc("GlobalAlloc")
 	procGlobalFree                        = modKernel32.NewProc("GlobalFree")
 	procGlobalLock                        = modKernel32.NewProc("GlobalLock")
 	procGlobalUnlock                      = modKernel32.NewProc("GlobalUnlock")
-	procGetDC                             = modUser32.NewProc("GetDC")
-	procGetDesktopWindow                  = modUser32.NewProc("GetDesktopWindow")
-	procReleaseDC                         = modUser32.NewProc("ReleaseDC")
-	procImpersonateLoggedOnUser           = modadvapi32.NewProc("ImpersonateLoggedOnUser")
-	procLogonUserW                        = modadvapi32.NewProc("LogonUserW")
-	procLookupPrivilegeDisplayNameW       = modadvapi32.NewProc("LookupPrivilegeDisplayNameW")
-	procLookupPrivilegeNameW              = modadvapi32.NewProc("LookupPrivilegeNameW")
-	procCreateProcessW                    = modkernel32.NewProc("CreateProcessW")
-	procCreateRemoteThread                = modkernel32.NewProc("CreateRemoteThread")
-	procCreateThread                      = modkernel32.NewProc("CreateThread")
-	procDeleteProcThreadAttributeList     = modkernel32.NewProc("DeleteProcThreadAttributeList")
-	procGetExitCodeThread                 = modkernel32.NewProc("GetExitCodeThread")
-	procGetProcessHeap                    = modkernel32.NewProc("GetProcessHeap")
-	procHeapAlloc                         = modkernel32.NewProc("HeapAlloc")
-	procHeapFree                          = modkernel32.NewProc("HeapFree")
-	procInitializeProcThreadAttributeList = modkernel32.NewProc("InitializeProcThreadAttributeList")
-	procQueueUserAPC                      = modkernel32.NewProc("QueueUserAPC")
-	procUpdateProcThreadAttribute         = modkernel32.NewProc("UpdateProcThreadAttribute")
-	procVirtualAllocEx                    = modkernel32.NewProc("VirtualAllocEx")
-	procVirtualProtectEx                  = modkernel32.NewProc("VirtualProtectEx")
-	procWriteProcessMemory                = modkernel32.NewProc("WriteProcessMemory")
+	procSelectObject                      = modGdi32.NewProc("SelectObject")
+	procBitBlt                            = modGdi32.NewProc("BitBlt")
+	procGetDIBits                         = modGdi32.NewProc("GetDIBits")
 )
 
-func MiniDumpWriteDump(hProcess windows.Handle, pid uint32, hFile uintptr, dumpType uint32, exceptionParam uintptr, userStreamParam uintptr, callbackParam uintptr) (err error) {
-	r1, _, e1 := syscall.Syscall9(procMiniDumpWriteDump.Addr(), 7, uintptr(hProcess), uintptr(pid), uintptr(hFile), uintptr(dumpType), uintptr(exceptionParam), uintptr(userStreamParam), uintptr(callbackParam), 0, 0)
+func InitializeProcThreadAttributeList(lpAttributeList *PROC_THREAD_ATTRIBUTE_LIST, dwAttributeCount uint32, dwFlags uint32, lpSize *uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall6(procInitializeProcThreadAttributeList.Addr(), 4, uintptr(unsafe.Pointer(lpAttributeList)), uintptr(dwAttributeCount), uintptr(dwFlags), uintptr(unsafe.Pointer(lpSize)), 0, 0)
 	if r1 == 0 {
-		err = errnoErr(e1)
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
 	}
 	return
 }
 
-func BitBlt(hdc windows.Handle, x uint32, y uint32, cx uint32, cy uint32, hdcSrc windows.Handle, x1 uint32, y1 uint32, rop int32) (BOOL int, err error) {
-	r0, _, e1 := syscall.Syscall9(procBitBlt.Addr(), 9, uintptr(hdc), uintptr(x), uintptr(y), uintptr(cx), uintptr(cy), uintptr(hdcSrc), uintptr(x1), uintptr(y1), uintptr(rop))
-	BOOL = int(r0)
-	if BOOL == 0 {
-		err = errnoErr(e1)
+func GetProcessHeap() (procHeap windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procGetProcessHeap.Addr(), 0, 0, 0, 0)
+	procHeap = windows.Handle(r0)
+	if procHeap == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
 	}
 	return
 }
 
-func CreateCompatibleBitmap(hdc windows.Handle, cx int, cy int) (HBITMAP windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procCreateCompatibleBitmap.Addr(), 3, uintptr(hdc), uintptr(cx), uintptr(cy))
-	HBITMAP = windows.Handle(r0)
-	if HBITMAP == 0 {
-		err = errnoErr(e1)
+func HeapAlloc(hHeap windows.Handle, dwFlags uint32, dwBytes uintptr) (lpMem uintptr, err error) {
+	r0, _, e1 := syscall.Syscall(procHeapAlloc.Addr(), 3, uintptr(hHeap), uintptr(dwFlags), uintptr(dwBytes))
+	lpMem = uintptr(r0)
+	if lpMem == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
 	}
 	return
 }
 
-func CreateCompatibleDC(hdc windows.Handle) (HDC windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procCreateCompatibleDC.Addr(), 1, uintptr(hdc), 0, 0)
-	HDC = windows.Handle(r0)
-	if HDC == 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-func DeleteDC(hdc windows.Handle) (BOOL uint32, err error) {
-	r0, _, e1 := syscall.Syscall(procDeleteDC.Addr(), 1, uintptr(hdc), 0, 0)
-	BOOL = uint32(r0)
-	if BOOL == 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-func DeleteObject(ho windows.Handle) (BOOL uint32, err error) {
-	r0, _, e1 := syscall.Syscall(procDeleteObject.Addr(), 1, uintptr(ho), 0, 0)
-	BOOL = uint32(r0)
-	if BOOL == 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-func GetDIBits(hdc windows.Handle, hbm windows.Handle, start uint32, cLines uint32, lpvBits uintptr, lpbmi uintptr, usage int) (ret int, err error) {
-	r0, _, e1 := syscall.Syscall9(procGetDIBits.Addr(), 7, uintptr(hdc), uintptr(hbm), uintptr(start), uintptr(cLines), uintptr(lpvBits), uintptr(lpbmi), uintptr(usage), 0, 0)
-	ret = int(r0)
-	if ret == 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-func SelectObject(hdc windows.Handle, h windows.Handle) (HGDIOBJ windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procSelectObject.Addr(), 2, uintptr(hdc), uintptr(h), 0)
-	HGDIOBJ = windows.Handle(r0)
-	if HGDIOBJ == 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-func GlobalAlloc(uFlags uint, dwBytes uintptr) (HGLOBAL windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procGlobalAlloc.Addr(), 2, uintptr(uFlags), uintptr(dwBytes), 0)
-	HGLOBAL = windows.Handle(r0)
-	if HGLOBAL == 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-func GlobalFree(hMem windows.Handle) (HGLOBAL windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procGlobalFree.Addr(), 1, uintptr(hMem), 0, 0)
-	HGLOBAL = windows.Handle(r0)
-	if HGLOBAL == 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-func GlobalLock(hMem windows.Handle) (LPVOID uintptr, err error) {
-	r0, _, e1 := syscall.Syscall(procGlobalLock.Addr(), 1, uintptr(hMem), 0, 0)
-	LPVOID = uintptr(r0)
-	if LPVOID == 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-func GlobalUnlock(hMem windows.Handle) (BOOL uint32, err error) {
-	r0, _, e1 := syscall.Syscall(procGlobalUnlock.Addr(), 1, uintptr(hMem), 0, 0)
-	BOOL = uint32(r0)
-	if BOOL == 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-func GetDC(HWND windows.Handle) (HDC windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procGetDC.Addr(), 1, uintptr(HWND), 0, 0)
-	HDC = windows.Handle(r0)
-	if HDC == 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-func GetDesktopWindow() (HWND windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procGetDesktopWindow.Addr(), 0, 0, 0, 0)
-	HWND = windows.Handle(r0)
-	if HWND == 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-func ReleaseDC(hWnd windows.Handle, hDC windows.Handle) (int uint32, err error) {
-	r0, _, e1 := syscall.Syscall(procReleaseDC.Addr(), 2, uintptr(hWnd), uintptr(hDC), 0)
-	int = uint32(r0)
-	if int == 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-func ImpersonateLoggedOnUser(hToken windows.Token) (err error) {
-	r1, _, e1 := syscall.Syscall(procImpersonateLoggedOnUser.Addr(), 1, uintptr(hToken), 0, 0)
+func UpdateProcThreadAttribute(lpAttributeList *PROC_THREAD_ATTRIBUTE_LIST, dwFlags uint32, attribute uintptr, lpValue *uintptr, cbSize uintptr, lpPreviousValue uintptr, lpReturnSize *uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall9(procUpdateProcThreadAttribute.Addr(), 7, uintptr(unsafe.Pointer(lpAttributeList)), uintptr(dwFlags), uintptr(attribute), uintptr(unsafe.Pointer(lpValue)), uintptr(cbSize), uintptr(lpPreviousValue), uintptr(unsafe.Pointer(lpReturnSize)), 0, 0)
 	if r1 == 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-func LogonUser(lpszUsername *uint16, lpszDomain *uint16, lpszPassword *uint16, dwLogonType uint32, dwLogonProvider uint32, phToken *windows.Token) (err error) {
-	r1, _, e1 := syscall.Syscall6(procLogonUserW.Addr(), 6, uintptr(unsafe.Pointer(lpszUsername)), uintptr(unsafe.Pointer(lpszDomain)), uintptr(unsafe.Pointer(lpszPassword)), uintptr(dwLogonType), uintptr(dwLogonProvider), uintptr(unsafe.Pointer(phToken)))
-	if r1 == 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-func LookupPrivilegeDisplayNameW(systemName string, privilegeName *uint16, buffer *uint16, size *uint32, languageId *uint32) (err error) {
-	var _p0 *uint16
-	_p0, err = syscall.UTF16PtrFromString(systemName)
-	if err != nil {
-		return
-	}
-	return _LookupPrivilegeDisplayNameW(_p0, privilegeName, buffer, size, languageId)
-}
-
-func _LookupPrivilegeDisplayNameW(systemName *uint16, privilegeName *uint16, buffer *uint16, size *uint32, languageId *uint32) (err error) {
-	r1, _, e1 := syscall.Syscall6(procLookupPrivilegeDisplayNameW.Addr(), 5, uintptr(unsafe.Pointer(systemName)), uintptr(unsafe.Pointer(privilegeName)), uintptr(unsafe.Pointer(buffer)), uintptr(unsafe.Pointer(size)), uintptr(unsafe.Pointer(languageId)), 0)
-	if r1 == 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-func LookupPrivilegeNameW(systemName string, luid *uint64, buffer *uint16, size *uint32) (err error) {
-	var _p0 *uint16
-	_p0, err = syscall.UTF16PtrFromString(systemName)
-	if err != nil {
-		return
-	}
-	return _LookupPrivilegeNameW(_p0, luid, buffer, size)
-}
-
-func _LookupPrivilegeNameW(systemName *uint16, luid *uint64, buffer *uint16, size *uint32) (err error) {
-	r1, _, e1 := syscall.Syscall6(procLookupPrivilegeNameW.Addr(), 4, uintptr(unsafe.Pointer(systemName)), uintptr(unsafe.Pointer(luid)), uintptr(unsafe.Pointer(buffer)), uintptr(unsafe.Pointer(size)), 0, 0)
-	if r1 == 0 {
-		err = errnoErr(e1)
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
 	}
 	return
 }
@@ -268,28 +131,65 @@ func CreateProcess(appName *uint16, commandLine *uint16, procSecurity *windows.S
 	var _p0 uint32
 	if inheritHandles {
 		_p0 = 1
+	} else {
+		_p0 = 0
 	}
 	r1, _, e1 := syscall.Syscall12(procCreateProcessW.Addr(), 10, uintptr(unsafe.Pointer(appName)), uintptr(unsafe.Pointer(commandLine)), uintptr(unsafe.Pointer(procSecurity)), uintptr(unsafe.Pointer(threadSecurity)), uintptr(_p0), uintptr(creationFlags), uintptr(unsafe.Pointer(env)), uintptr(unsafe.Pointer(currentDir)), uintptr(unsafe.Pointer(startupInfo)), uintptr(unsafe.Pointer(outProcInfo)), 0, 0)
 	if r1 == 0 {
-		err = errnoErr(e1)
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
 	}
 	return
 }
 
-func CreateRemoteThread(hProcess windows.Handle, lpThreadAttributes *windows.SecurityAttributes, dwStackSize uint32, lpStartAddress uintptr, lpParameter uintptr, dwCreationFlags uint32, lpThreadId *uint32) (threadHandle windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall9(procCreateRemoteThread.Addr(), 7, uintptr(hProcess), uintptr(unsafe.Pointer(lpThreadAttributes)), uintptr(dwStackSize), uintptr(lpStartAddress), uintptr(lpParameter), uintptr(dwCreationFlags), uintptr(unsafe.Pointer(lpThreadId)), 0, 0)
-	threadHandle = windows.Handle(r0)
-	if threadHandle == 0 {
-		err = errnoErr(e1)
+func VirtualAllocEx(hProcess windows.Handle, lpAddress uintptr, dwSize uintptr, flAllocationType uint32, flProtect uint32) (addr uintptr, err error) {
+	r0, _, e1 := syscall.Syscall6(procVirtualAllocEx.Addr(), 5, uintptr(hProcess), uintptr(lpAddress), uintptr(dwSize), uintptr(flAllocationType), uintptr(flProtect), 0)
+	addr = uintptr(r0)
+	if addr == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
 	}
 	return
 }
 
-func CreateThread(lpThreadAttributes *windows.SecurityAttributes, dwStackSize uint32, lpStartAddress uintptr, lpParameter uintptr, dwCreationFlags uint32, lpThreadId *uint32) (threadHandle windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall6(procCreateThread.Addr(), 6, uintptr(unsafe.Pointer(lpThreadAttributes)), uintptr(dwStackSize), uintptr(lpStartAddress), uintptr(lpParameter), uintptr(dwCreationFlags), uintptr(unsafe.Pointer(lpThreadId)))
-	threadHandle = windows.Handle(r0)
-	if threadHandle == 0 {
-		err = errnoErr(e1)
+func WriteProcessMemory(hProcess windows.Handle, lpBaseAddress uintptr, lpBuffer *byte, nSize uintptr, lpNumberOfBytesWritten *uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall6(procWriteProcessMemory.Addr(), 5, uintptr(hProcess), uintptr(lpBaseAddress), uintptr(unsafe.Pointer(lpBuffer)), uintptr(nSize), uintptr(unsafe.Pointer(lpNumberOfBytesWritten)), 0)
+	if r1 == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
+	}
+	return
+}
+
+func VirtualProtectEx(hProcess windows.Handle, lpAddress uintptr, dwSize uintptr, flNewProtect uint32, lpflOldProtect *uint32) (err error) {
+	r1, _, e1 := syscall.Syscall6(procVirtualProtectEx.Addr(), 5, uintptr(hProcess), uintptr(lpAddress), uintptr(dwSize), uintptr(flNewProtect), uintptr(unsafe.Pointer(lpflOldProtect)), 0)
+	if r1 == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
+	}
+	return
+}
+
+func QueueUserAPC(pfnAPC uintptr, hThread windows.Handle, dwData uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall(procQueueUserAPC.Addr(), 3, uintptr(pfnAPC), uintptr(hThread), uintptr(dwData))
+	if r1 == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
 	}
 	return
 }
@@ -299,85 +199,270 @@ func DeleteProcThreadAttributeList(lpAttributeList *PROC_THREAD_ATTRIBUTE_LIST)
 	return
 }
 
-func GetExitCodeThread(hTread windows.Handle, lpExitCode *uint32) (err error) {
-	r1, _, e1 := syscall.Syscall(procGetExitCodeThread.Addr(), 2, uintptr(hTread), uintptr(unsafe.Pointer(lpExitCode)), 0)
-	if r1 == 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-func GetProcessHeap() (procHeap windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procGetProcessHeap.Addr(), 0, 0, 0, 0)
-	procHeap = windows.Handle(r0)
-	if procHeap == 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-func HeapAlloc(hHeap windows.Handle, dwFlags uint32, dwBytes uintptr) (lpMem uintptr, err error) {
-	r0, _, e1 := syscall.Syscall(procHeapAlloc.Addr(), 3, uintptr(hHeap), uintptr(dwFlags), uintptr(dwBytes))
-	lpMem = uintptr(r0)
-	if lpMem == 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
 func HeapFree(hHeap windows.Handle, dwFlags uint32, lpMem uintptr) (err error) {
 	r1, _, e1 := syscall.Syscall(procHeapFree.Addr(), 3, uintptr(hHeap), uintptr(dwFlags), uintptr(lpMem))
 	if r1 == 0 {
-		err = errnoErr(e1)
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
 	}
 	return
 }
 
-func InitializeProcThreadAttributeList(lpAttributeList *PROC_THREAD_ATTRIBUTE_LIST, dwAttributeCount uint32, dwFlags uint32, lpSize *uintptr) (err error) {
-	r1, _, e1 := syscall.Syscall6(procInitializeProcThreadAttributeList.Addr(), 4, uintptr(unsafe.Pointer(lpAttributeList)), uintptr(dwAttributeCount), uintptr(dwFlags), uintptr(unsafe.Pointer(lpSize)), 0, 0)
+func CreateRemoteThread(hProcess windows.Handle, lpThreadAttributes *windows.SecurityAttributes, dwStackSize uint32, lpStartAddress uintptr, lpParameter uintptr, dwCreationFlags uint32, lpThreadId *uint32) (threadHandle windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall9(procCreateRemoteThread.Addr(), 7, uintptr(hProcess), uintptr(unsafe.Pointer(lpThreadAttributes)), uintptr(dwStackSize), uintptr(lpStartAddress), uintptr(lpParameter), uintptr(dwCreationFlags), uintptr(unsafe.Pointer(lpThreadId)), 0, 0)
+	threadHandle = windows.Handle(r0)
+	if threadHandle == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
+	}
+	return
+}
+
+func CreateThread(lpThreadAttributes *windows.SecurityAttributes, dwStackSize uint32, lpStartAddress uintptr, lpParameter uintptr, dwCreationFlags uint32, lpThreadId *uint32) (threadHandle windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall6(procCreateThread.Addr(), 6, uintptr(unsafe.Pointer(lpThreadAttributes)), uintptr(dwStackSize), uintptr(lpStartAddress), uintptr(lpParameter), uintptr(dwCreationFlags), uintptr(unsafe.Pointer(lpThreadId)))
+	threadHandle = windows.Handle(r0)
+	if threadHandle == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
+	}
+	return
+}
+
+func GetExitCodeThread(hTread windows.Handle, lpExitCode *uint32) (err error) {
+	r1, _, e1 := syscall.Syscall(procGetExitCodeThread.Addr(), 2, uintptr(hTread), uintptr(unsafe.Pointer(lpExitCode)), 0)
 	if r1 == 0 {
-		err = errnoErr(e1)
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
 	}
 	return
 }
 
-func QueueUserAPC(pfnAPC uintptr, hThread windows.Handle, dwData uintptr) (err error) {
-	r1, _, e1 := syscall.Syscall(procQueueUserAPC.Addr(), 3, uintptr(pfnAPC), uintptr(hThread), uintptr(dwData))
+func MiniDumpWriteDump(hProcess windows.Handle, pid uint32, hFile uintptr, dumpType uint32, exceptionParam uintptr, userStreamParam uintptr, callbackParam uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall9(procMiniDumpWriteDump.Addr(), 7, uintptr(hProcess), uintptr(pid), uintptr(hFile), uintptr(dumpType), uintptr(exceptionParam), uintptr(userStreamParam), uintptr(callbackParam), 0, 0)
 	if r1 == 0 {
-		err = errnoErr(e1)
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
 	}
 	return
 }
 
-func UpdateProcThreadAttribute(lpAttributeList *PROC_THREAD_ATTRIBUTE_LIST, dwFlags uint32, attribute uintptr, lpValue *uintptr, cbSize uintptr, lpPreviousValue uintptr, lpReturnSize *uintptr) (err error) {
-	r1, _, e1 := syscall.Syscall9(procUpdateProcThreadAttribute.Addr(), 7, uintptr(unsafe.Pointer(lpAttributeList)), uintptr(dwFlags), uintptr(attribute), uintptr(unsafe.Pointer(lpValue)), uintptr(cbSize), uintptr(lpPreviousValue), uintptr(unsafe.Pointer(lpReturnSize)), 0, 0)
+func ImpersonateLoggedOnUser(hToken windows.Token) (err error) {
+	r1, _, e1 := syscall.Syscall(procImpersonateLoggedOnUser.Addr(), 1, uintptr(hToken), 0, 0)
 	if r1 == 0 {
-		err = errnoErr(e1)
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
 	}
 	return
 }
 
-func VirtualAllocEx(hProcess windows.Handle, lpAddress uintptr, dwSize uintptr, flAllocationType uint32, flProtect uint32) (addr uintptr, err error) {
-	r0, _, e1 := syscall.Syscall6(procVirtualAllocEx.Addr(), 5, uintptr(hProcess), uintptr(lpAddress), uintptr(dwSize), uintptr(flAllocationType), uintptr(flProtect), 0)
-	addr = uintptr(r0)
-	if addr == 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-func VirtualProtectEx(hProcess windows.Handle, lpAddress uintptr, dwSize uintptr, flNewProtect uint32, lpflOldProtect *uint32) (err error) {
-	r1, _, e1 := syscall.Syscall6(procVirtualProtectEx.Addr(), 5, uintptr(hProcess), uintptr(lpAddress), uintptr(dwSize), uintptr(flNewProtect), uintptr(unsafe.Pointer(lpflOldProtect)), 0)
+func LogonUser(lpszUsername *uint16, lpszDomain *uint16, lpszPassword *uint16, dwLogonType uint32, dwLogonProvider uint32, phToken *windows.Token) (err error) {
+	r1, _, e1 := syscall.Syscall6(procLogonUserW.Addr(), 6, uintptr(unsafe.Pointer(lpszUsername)), uintptr(unsafe.Pointer(lpszDomain)), uintptr(unsafe.Pointer(lpszPassword)), uintptr(dwLogonType), uintptr(dwLogonProvider), uintptr(unsafe.Pointer(phToken)))
 	if r1 == 0 {
-		err = errnoErr(e1)
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
 	}
 	return
 }
 
-func WriteProcessMemory(hProcess windows.Handle, lpBaseAddress uintptr, lpBuffer *byte, nSize uintptr, lpNumberOfBytesWritten *uintptr) (err error) {
-	r1, _, e1 := syscall.Syscall6(procWriteProcessMemory.Addr(), 5, uintptr(hProcess), uintptr(lpBaseAddress), uintptr(unsafe.Pointer(lpBuffer)), uintptr(nSize), uintptr(unsafe.Pointer(lpNumberOfBytesWritten)), 0)
-	if r1 == 0 {
-		err = errnoErr(e1)
+func GetDC(HWND windows.Handle) (HDC windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procGetDC.Addr(), 1, uintptr(HWND), 0, 0)
+	HDC = windows.Handle(r0)
+	if HDC == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
+	}
+	return
+}
+
+func ReleaseDC(hWnd windows.Handle, hDC windows.Handle) (int uint32, err error) {
+	r0, _, e1 := syscall.Syscall(procReleaseDC.Addr(), 2, uintptr(hWnd), uintptr(hDC), 0)
+	int = uint32(r0)
+	if int == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
+	}
+	return
+}
+
+func CreateCompatibleDC(hdc windows.Handle) (HDC windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procCreateCompatibleDC.Addr(), 1, uintptr(hdc), 0, 0)
+	HDC = windows.Handle(r0)
+	if HDC == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
+	}
+	return
+}
+
+func GetDesktopWindow() (HWND windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procGetDesktopWindow.Addr(), 0, 0, 0, 0)
+	HWND = windows.Handle(r0)
+	if HWND == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
+	}
+	return
+}
+
+func DeleteDC(hdc windows.Handle) (BOOL uint32, err error) {
+	r0, _, e1 := syscall.Syscall(procDeleteDC.Addr(), 1, uintptr(hdc), 0, 0)
+	BOOL = uint32(r0)
+	if BOOL == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
+	}
+	return
+}
+
+func CreateCompatibleBitmap(hdc windows.Handle, cx int, cy int) (HBITMAP windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procCreateCompatibleBitmap.Addr(), 3, uintptr(hdc), uintptr(cx), uintptr(cy))
+	HBITMAP = windows.Handle(r0)
+	if HBITMAP == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
+	}
+	return
+}
+
+func DeleteObject(ho windows.Handle) (BOOL uint32, err error) {
+	r0, _, e1 := syscall.Syscall(procDeleteObject.Addr(), 1, uintptr(ho), 0, 0)
+	BOOL = uint32(r0)
+	if BOOL == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
+	}
+	return
+}
+
+func GlobalAlloc(uFlags uint, dwBytes uintptr) (HGLOBAL windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procGlobalAlloc.Addr(), 2, uintptr(uFlags), uintptr(dwBytes), 0)
+	HGLOBAL = windows.Handle(r0)
+	if HGLOBAL == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
+	}
+	return
+}
+
+func GlobalFree(hMem windows.Handle) (HGLOBAL windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procGlobalFree.Addr(), 1, uintptr(hMem), 0, 0)
+	HGLOBAL = windows.Handle(r0)
+	if HGLOBAL == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
+	}
+	return
+}
+
+func GlobalLock(hMem windows.Handle) (LPVOID uintptr, err error) {
+	r0, _, e1 := syscall.Syscall(procGlobalLock.Addr(), 1, uintptr(hMem), 0, 0)
+	LPVOID = uintptr(r0)
+	if LPVOID == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
+	}
+	return
+}
+
+func GlobalUnlock(hMem windows.Handle) (BOOL uint32, err error) {
+	r0, _, e1 := syscall.Syscall(procGlobalUnlock.Addr(), 1, uintptr(hMem), 0, 0)
+	BOOL = uint32(r0)
+	if BOOL == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
+	}
+	return
+}
+
+func SelectObject(hdc windows.Handle, h windows.Handle) (HGDIOBJ windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procSelectObject.Addr(), 2, uintptr(hdc), uintptr(h), 0)
+	HGDIOBJ = windows.Handle(r0)
+	if HGDIOBJ == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
+	}
+	return
+}
+
+func BitBlt(hdc windows.Handle, x uint32, y uint32, cx uint32, cy uint32, hdcSrc windows.Handle, x1 uint32, y1 uint32, rop int32) (BOOL int, err error) {
+	r0, _, e1 := syscall.Syscall9(procBitBlt.Addr(), 9, uintptr(hdc), uintptr(x), uintptr(y), uintptr(cx), uintptr(cy), uintptr(hdcSrc), uintptr(x1), uintptr(y1), uintptr(rop))
+	BOOL = int(r0)
+	if BOOL == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
+	}
+	return
+}
+
+func GetDIBits(hdc windows.Handle, hbm windows.Handle, start uint32, cLines uint32, lpvBits uintptr, lpbmi uintptr, usage int) (ret int, err error) {
+	r0, _, e1 := syscall.Syscall9(procGetDIBits.Addr(), 7, uintptr(hdc), uintptr(hbm), uintptr(start), uintptr(cLines), uintptr(lpvBits), uintptr(lpbmi), uintptr(usage), 0, 0)
+	ret = int(r0)
+	if ret == 0 {
+		if e1 != 0 {
+			err = errnoErr(e1)
+		} else {
+			err = syscall.EINVAL
+		}
 	}
 	return
 }

protobuf/clientpb/client.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.26.0
-// 	protoc        v3.15.8
+// 	protoc        v3.17.3
 // source: clientpb/client.proto
 
 package clientpb

protobuf/commonpb/common.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.26.0
-// 	protoc        v3.15.8
+// 	protoc        v3.17.3
 // source: commonpb/common.proto
 
 package commonpb

protobuf/dnspb/dns.pb.go

@@ -0,0 +1,255 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.26.0
+// 	protoc        v3.17.3
+// source: dnspb/dns.proto
+
+package dnspb
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type DNSMessageType int32
+
+const (
+	DNSMessageType_NOP            DNSMessageType = 0
+	DNSMessageType_DOMAIN_KEY     DNSMessageType = 1
+	DNSMessageType_SESSION_INIT   DNSMessageType = 2
+	DNSMessageType_SESSION_POLL   DNSMessageType = 3
+	DNSMessageType_BLOCK_PREAMBLE DNSMessageType = 7
+	DNSMessageType_BLOCK_DATA     DNSMessageType = 8
+	DNSMessageType_BLOCK_CLEAR    DNSMessageType = 9
+)
+
+// Enum value maps for DNSMessageType.
+var (
+	DNSMessageType_name = map[int32]string{
+		0: "NOP",
+		1: "DOMAIN_KEY",
+		2: "SESSION_INIT",
+		3: "SESSION_POLL",
+		7: "BLOCK_PREAMBLE",
+		8: "BLOCK_DATA",
+		9: "BLOCK_CLEAR",
+	}
+	DNSMessageType_value = map[string]int32{
+		"NOP":            0,
+		"DOMAIN_KEY":     1,
+		"SESSION_INIT":   2,
+		"SESSION_POLL":   3,
+		"BLOCK_PREAMBLE": 7,
+		"BLOCK_DATA":     8,
+		"BLOCK_CLEAR":    9,
+	}
+)
+
+func (x DNSMessageType) Enum() *DNSMessageType {
+	p := new(DNSMessageType)
+	*p = x
+	return p
+}
+
+func (x DNSMessageType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (DNSMessageType) Descriptor() protoreflect.EnumDescriptor {
+	return file_dnspb_dns_proto_enumTypes[0].Descriptor()
+}
+
+func (DNSMessageType) Type() protoreflect.EnumType {
+	return &file_dnspb_dns_proto_enumTypes[0]
+}
+
+func (x DNSMessageType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use DNSMessageType.Descriptor instead.
+func (DNSMessageType) EnumDescriptor() ([]byte, []int) {
+	return file_dnspb_dns_proto_rawDescGZIP(), []int{0}
+}
+
+type DNSMessage struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Type DNSMessageType `protobuf:"varint,1,opt,name=Type,proto3,enum=dnspb.DNSMessageType" json:"Type,omitempty"`
+	ID   uint32         `protobuf:"varint,2,opt,name=ID,proto3" json:"ID,omitempty"`
+	N    uint32         `protobuf:"varint,3,opt,name=N,proto3" json:"N,omitempty"`
+	Size uint32         `protobuf:"varint,4,opt,name=Size,proto3" json:"Size,omitempty"`
+	Data []byte         `protobuf:"bytes,5,opt,name=Data,proto3" json:"Data,omitempty"`
+}
+
+func (x *DNSMessage) Reset() {
+	*x = DNSMessage{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_dnspb_dns_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DNSMessage) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DNSMessage) ProtoMessage() {}
+
+func (x *DNSMessage) ProtoReflect() protoreflect.Message {
+	mi := &file_dnspb_dns_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DNSMessage.ProtoReflect.Descriptor instead.
+func (*DNSMessage) Descriptor() ([]byte, []int) {
+	return file_dnspb_dns_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *DNSMessage) GetType() DNSMessageType {
+	if x != nil {
+		return x.Type
+	}
+	return DNSMessageType_NOP
+}
+
+func (x *DNSMessage) GetID() uint32 {
+	if x != nil {
+		return x.ID
+	}
+	return 0
+}
+
+func (x *DNSMessage) GetN() uint32 {
+	if x != nil {
+		return x.N
+	}
+	return 0
+}
+
+func (x *DNSMessage) GetSize() uint32 {
+	if x != nil {
+		return x.Size
+	}
+	return 0
+}
+
+func (x *DNSMessage) GetData() []byte {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+var File_dnspb_dns_proto protoreflect.FileDescriptor
+
+var file_dnspb_dns_proto_rawDesc = []byte{
+	0x0a, 0x0f, 0x64, 0x6e, 0x73, 0x70, 0x62, 0x2f, 0x64, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x12, 0x05, 0x64, 0x6e, 0x73, 0x70, 0x62, 0x22, 0x7d, 0x0a, 0x0a, 0x44, 0x4e, 0x53, 0x4d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x29, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0e, 0x32, 0x15, 0x2e, 0x64, 0x6e, 0x73, 0x70, 0x62, 0x2e, 0x44, 0x4e, 0x53,
+	0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x54, 0x79, 0x70,
+	0x65, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x44, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x02, 0x49,
+	0x44, 0x12, 0x0c, 0x0a, 0x01, 0x4e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x01, 0x4e, 0x12,
+	0x12, 0x0a, 0x04, 0x53, 0x69, 0x7a, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x53,
+	0x69, 0x7a, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x44, 0x61, 0x74, 0x61, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x04, 0x44, 0x61, 0x74, 0x61, 0x2a, 0x82, 0x01, 0x0a, 0x0e, 0x44, 0x4e, 0x53, 0x4d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x07, 0x0a, 0x03, 0x4e, 0x4f,
+	0x50, 0x10, 0x00, 0x12, 0x0e, 0x0a, 0x0a, 0x44, 0x4f, 0x4d, 0x41, 0x49, 0x4e, 0x5f, 0x4b, 0x45,
+	0x59, 0x10, 0x01, 0x12, 0x10, 0x0a, 0x0c, 0x53, 0x45, 0x53, 0x53, 0x49, 0x4f, 0x4e, 0x5f, 0x49,
+	0x4e, 0x49, 0x54, 0x10, 0x02, 0x12, 0x10, 0x0a, 0x0c, 0x53, 0x45, 0x53, 0x53, 0x49, 0x4f, 0x4e,
+	0x5f, 0x50, 0x4f, 0x4c, 0x4c, 0x10, 0x03, 0x12, 0x12, 0x0a, 0x0e, 0x42, 0x4c, 0x4f, 0x43, 0x4b,
+	0x5f, 0x50, 0x52, 0x45, 0x41, 0x4d, 0x42, 0x4c, 0x45, 0x10, 0x07, 0x12, 0x0e, 0x0a, 0x0a, 0x42,
+	0x4c, 0x4f, 0x43, 0x4b, 0x5f, 0x44, 0x41, 0x54, 0x41, 0x10, 0x08, 0x12, 0x0f, 0x0a, 0x0b, 0x42,
+	0x4c, 0x4f, 0x43, 0x4b, 0x5f, 0x43, 0x4c, 0x45, 0x41, 0x52, 0x10, 0x09, 0x42, 0x2c, 0x5a, 0x2a,
+	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x62, 0x69, 0x73, 0x68, 0x6f,
+	0x70, 0x66, 0x6f, 0x78, 0x2f, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x6e, 0x73, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x33,
+}
+
+var (
+	file_dnspb_dns_proto_rawDescOnce sync.Once
+	file_dnspb_dns_proto_rawDescData = file_dnspb_dns_proto_rawDesc
+)
+
+func file_dnspb_dns_proto_rawDescGZIP() []byte {
+	file_dnspb_dns_proto_rawDescOnce.Do(func() {
+		file_dnspb_dns_proto_rawDescData = protoimpl.X.CompressGZIP(file_dnspb_dns_proto_rawDescData)
+	})
+	return file_dnspb_dns_proto_rawDescData
+}
+
+var file_dnspb_dns_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_dnspb_dns_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_dnspb_dns_proto_goTypes = []interface{}{
+	(DNSMessageType)(0), // 0: dnspb.DNSMessageType
+	(*DNSMessage)(nil),  // 1: dnspb.DNSMessage
+}
+var file_dnspb_dns_proto_depIdxs = []int32{
+	0, // 0: dnspb.DNSMessage.Type:type_name -> dnspb.DNSMessageType
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_dnspb_dns_proto_init() }
+func file_dnspb_dns_proto_init() {
+	if File_dnspb_dns_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_dnspb_dns_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DNSMessage); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_dnspb_dns_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_dnspb_dns_proto_goTypes,
+		DependencyIndexes: file_dnspb_dns_proto_depIdxs,
+		EnumInfos:         file_dnspb_dns_proto_enumTypes,
+		MessageInfos:      file_dnspb_dns_proto_msgTypes,
+	}.Build()
+	File_dnspb_dns_proto = out.File
+	file_dnspb_dns_proto_rawDesc = nil
+	file_dnspb_dns_proto_goTypes = nil
+	file_dnspb_dns_proto_depIdxs = nil
+}

protobuf/dnspb/dns.proto

@@ -0,0 +1,23 @@
+syntax = "proto3";
+package dnspb;
+option go_package = "github.com/bishopfox/sliver/protobuf/dnspb";
+
+enum DNSMessageType {
+    NOP = 0; // aka FINGERPRINT
+    DOMAIN_KEY = 1;
+    SESSION_INIT = 2;
+    SESSION_POLL = 3;
+
+    BLOCK_PREAMBLE = 7;
+    BLOCK_DATA = 8;
+    BLOCK_CLEAR = 9;
+}
+
+message DNSMessage {
+    DNSMessageType Type = 1;
+    uint32 ID = 2;
+    uint32 N = 3;
+    uint32 Size = 4;
+    bytes Data = 5;
+}
+

protobuf/rpcpb/services.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.26.0
-// 	protoc        v3.15.8
+// 	protoc        v3.17.3
 // source: rpcpb/services.proto
 
 package rpcpb
@@ -31,7 +31,7 @@ var file_rpcpb_services_proto_rawDesc = []byte{
 	0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2f, 0x73,
 	0x6c, 0x69, 0x76, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x63, 0x6c, 0x69,
 	0x65, 0x6e, 0x74, 0x70, 0x62, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x32, 0x86, 0x2d, 0x0a, 0x09, 0x53, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x52, 0x50, 0x43,
+	0x74, 0x6f, 0x32, 0xa4, 0x2b, 0x0a, 0x09, 0x53, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x52, 0x50, 0x43,
 	0x12, 0x30, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x0f,
 	0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a,
 	0x11, 0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x70, 0x62, 0x2e, 0x56, 0x65, 0x72, 0x73, 0x69,
@@ -323,79 +323,64 @@ var file_rpcpb_services_proto_rawDesc = []byte{
 	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79,
 	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x1a, 0x1b, 0x2e, 0x73,
 	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x54, 0x0a, 0x13, 0x52, 0x65, 0x67,
-	0x69, 0x73, 0x74, 0x72, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x73,
-	0x12, 0x1f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69,
-	0x73, 0x74, 0x72, 0x79, 0x53, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65,
-	0x71, 0x1a, 0x1c, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67,
-	0x69, 0x73, 0x74, 0x72, 0x79, 0x53, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x12,
-	0x53, 0x0a, 0x12, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x56,
-	0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x1f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
-	0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x61, 0x6c,
-	0x75, 0x65, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x1c, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70,
-	0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73,
-	0x4c, 0x69, 0x73, 0x74, 0x12, 0x3e, 0x0a, 0x0d, 0x52, 0x75, 0x6e, 0x53, 0x53, 0x48, 0x43, 0x6f,
-	0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12, 0x17, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
-	0x2e, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x52, 0x65, 0x71, 0x1a, 0x14,
-	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6d,
-	0x6d, 0x61, 0x6e, 0x64, 0x12, 0x38, 0x0a, 0x09, 0x48, 0x69, 0x6a, 0x61, 0x63, 0x6b, 0x44, 0x4c,
-	0x4c, 0x12, 0x16, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x44, 0x6c, 0x6c,
-	0x48, 0x69, 0x6a, 0x61, 0x63, 0x6b, 0x52, 0x65, 0x71, 0x1a, 0x13, 0x2e, 0x73, 0x6c, 0x69, 0x76,
-	0x65, 0x72, 0x70, 0x62, 0x2e, 0x44, 0x6c, 0x6c, 0x48, 0x69, 0x6a, 0x61, 0x63, 0x6b, 0x12, 0x35,
-	0x0a, 0x08, 0x47, 0x65, 0x74, 0x50, 0x72, 0x69, 0x76, 0x73, 0x12, 0x15, 0x2e, 0x73, 0x6c, 0x69,
-	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x69, 0x76, 0x73, 0x52, 0x65,
-	0x71, 0x1a, 0x12, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x47, 0x65, 0x74,
-	0x50, 0x72, 0x69, 0x76, 0x73, 0x12, 0x4e, 0x0a, 0x12, 0x57, 0x47, 0x53, 0x74, 0x61, 0x72, 0x74,
-	0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x1f, 0x2e, 0x73, 0x6c,
-	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72,
-	0x77, 0x61, 0x72, 0x64, 0x53, 0x74, 0x61, 0x72, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x73,
-	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f,
-	0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x4c, 0x0a, 0x11, 0x57, 0x47, 0x53, 0x74, 0x6f, 0x70, 0x50,
-	0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x1e, 0x2e, 0x73, 0x6c, 0x69,
+	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x3e, 0x0a, 0x0d, 0x52, 0x75, 0x6e,
+	0x53, 0x53, 0x48, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12, 0x17, 0x2e, 0x73, 0x6c, 0x69,
+	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64,
+	0x52, 0x65, 0x71, 0x1a, 0x14, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53,
+	0x53, 0x48, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12, 0x38, 0x0a, 0x09, 0x48, 0x69, 0x6a,
+	0x61, 0x63, 0x6b, 0x44, 0x4c, 0x4c, 0x12, 0x16, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70,
+	0x62, 0x2e, 0x44, 0x6c, 0x6c, 0x48, 0x69, 0x6a, 0x61, 0x63, 0x6b, 0x52, 0x65, 0x71, 0x1a, 0x13,
+	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x44, 0x6c, 0x6c, 0x48, 0x69, 0x6a,
+	0x61, 0x63, 0x6b, 0x12, 0x4e, 0x0a, 0x12, 0x57, 0x47, 0x53, 0x74, 0x61, 0x72, 0x74, 0x50, 0x6f,
+	0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x1f, 0x2e, 0x73, 0x6c, 0x69, 0x76,
+	0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61,
+	0x72, 0x64, 0x53, 0x74, 0x61, 0x72, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x73, 0x6c, 0x69,
 	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77,
-	0x61, 0x72, 0x64, 0x53, 0x74, 0x6f, 0x70, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x73, 0x6c, 0x69,
-	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77,
-	0x61, 0x72, 0x64, 0x12, 0x3c, 0x0a, 0x0c, 0x57, 0x47, 0x53, 0x74, 0x61, 0x72, 0x74, 0x53, 0x6f,
-	0x63, 0x6b, 0x73, 0x12, 0x19, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57,
-	0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x74, 0x61, 0x72, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x11,
+	0x61, 0x72, 0x64, 0x12, 0x4c, 0x0a, 0x11, 0x57, 0x47, 0x53, 0x74, 0x6f, 0x70, 0x50, 0x6f, 0x72,
+	0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x1e, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65,
+	0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72,
+	0x64, 0x53, 0x74, 0x6f, 0x70, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65,
+	0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72,
+	0x64, 0x12, 0x3c, 0x0a, 0x0c, 0x57, 0x47, 0x53, 0x74, 0x61, 0x72, 0x74, 0x53, 0x6f, 0x63, 0x6b,
+	0x73, 0x12, 0x19, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53,
+	0x6f, 0x63, 0x6b, 0x73, 0x53, 0x74, 0x61, 0x72, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x73,
+	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12,
+	0x3a, 0x0a, 0x0b, 0x57, 0x47, 0x53, 0x74, 0x6f, 0x70, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x18,
 	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b,
-	0x73, 0x12, 0x3a, 0x0a, 0x0b, 0x57, 0x47, 0x53, 0x74, 0x6f, 0x70, 0x53, 0x6f, 0x63, 0x6b, 0x73,
-	0x12, 0x18, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f,
-	0x63, 0x6b, 0x73, 0x53, 0x74, 0x6f, 0x70, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x73, 0x6c, 0x69,
-	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x4b, 0x0a,
-	0x10, 0x57, 0x47, 0x4c, 0x69, 0x73, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72,
-	0x73, 0x12, 0x1c, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x54,
-	0x43, 0x50, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x1a,
-	0x19, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x54, 0x43, 0x50,
-	0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x73, 0x12, 0x4b, 0x0a, 0x12, 0x57, 0x47,
-	0x4c, 0x69, 0x73, 0x74, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73,
-	0x12, 0x1b, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f,
-	0x63, 0x6b, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x18, 0x2e,
-	0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73,
-	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x2c, 0x0a, 0x05, 0x53, 0x68, 0x65, 0x6c, 0x6c,
-	0x12, 0x12, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x68, 0x65, 0x6c,
-	0x6c, 0x52, 0x65, 0x71, 0x1a, 0x0f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e,
-	0x53, 0x68, 0x65, 0x6c, 0x6c, 0x12, 0x32, 0x0a, 0x07, 0x50, 0x6f, 0x72, 0x74, 0x66, 0x77, 0x64,
-	0x12, 0x14, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x50, 0x6f, 0x72, 0x74,
-	0x66, 0x77, 0x64, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70,
-	0x62, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x66, 0x77, 0x64, 0x12, 0x32, 0x0a, 0x0c, 0x43, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x10, 0x2e, 0x73, 0x6c, 0x69, 0x76,
-	0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x1a, 0x10, 0x2e, 0x73, 0x6c,
-	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x30, 0x0a,
-	0x0b, 0x43, 0x6c, 0x6f, 0x73, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x10, 0x2e, 0x73,
-	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x1a, 0x0f,
-	0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12,
-	0x3c, 0x0a, 0x0a, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x12, 0x14, 0x2e,
-	0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x44,
-	0x61, 0x74, 0x61, 0x1a, 0x14, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54,
-	0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x28, 0x01, 0x30, 0x01, 0x12, 0x2c, 0x0a,
-	0x06, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x0f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
-	0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0f, 0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e,
-	0x74, 0x70, 0x62, 0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x30, 0x01, 0x42, 0x2c, 0x5a, 0x2a, 0x67,
-	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x62, 0x69, 0x73, 0x68, 0x6f, 0x70,
-	0x66, 0x6f, 0x78, 0x2f, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2f, 0x72, 0x70, 0x63, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x33,
+	0x73, 0x53, 0x74, 0x6f, 0x70, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65,
+	0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x4b, 0x0a, 0x10, 0x57,
+	0x47, 0x4c, 0x69, 0x73, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x73, 0x12,
+	0x1c, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x54, 0x43, 0x50,
+	0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x19, 0x2e,
+	0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x54, 0x43, 0x50, 0x46, 0x6f,
+	0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x73, 0x12, 0x4b, 0x0a, 0x12, 0x57, 0x47, 0x4c, 0x69,
+	0x73, 0x74, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x1b,
+	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b,
+	0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x18, 0x2e, 0x73, 0x6c,
+	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x2c, 0x0a, 0x05, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x12, 0x12,
+	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x52,
+	0x65, 0x71, 0x1a, 0x0f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x68,
+	0x65, 0x6c, 0x6c, 0x12, 0x32, 0x0a, 0x07, 0x50, 0x6f, 0x72, 0x74, 0x66, 0x77, 0x64, 0x12, 0x14,
+	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x66, 0x77,
+	0x64, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e,
+	0x50, 0x6f, 0x72, 0x74, 0x66, 0x77, 0x64, 0x12, 0x32, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x10, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72,
+	0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x1a, 0x10, 0x2e, 0x73, 0x6c, 0x69, 0x76,
+	0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x30, 0x0a, 0x0b, 0x43,
+	0x6c, 0x6f, 0x73, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x10, 0x2e, 0x73, 0x6c, 0x69,
+	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x1a, 0x0f, 0x2e, 0x63,
+	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x3c, 0x0a,
+	0x0a, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x12, 0x14, 0x2e, 0x73, 0x6c,
+	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x44, 0x61, 0x74,
+	0x61, 0x1a, 0x14, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e,
+	0x6e, 0x65, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x28, 0x01, 0x30, 0x01, 0x12, 0x2c, 0x0a, 0x06, 0x45,
+	0x76, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x0f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62,
+	0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0f, 0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x70,
+	0x62, 0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x30, 0x01, 0x42, 0x2c, 0x5a, 0x2a, 0x67, 0x69, 0x74,
+	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x62, 0x69, 0x73, 0x68, 0x6f, 0x70, 0x66, 0x6f,
+	0x78, 0x2f, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2f, 0x72, 0x70, 0x63, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var file_rpcpb_services_proto_goTypes = []interface{}{
@@ -459,90 +444,84 @@ var file_rpcpb_services_proto_goTypes = []interface{}{
 	(*sliverpb.RegistryReadReq)(nil),       // 57: sliverpb.RegistryReadReq
 	(*sliverpb.RegistryWriteReq)(nil),      // 58: sliverpb.RegistryWriteReq
 	(*sliverpb.RegistryCreateKeyReq)(nil),  // 59: sliverpb.RegistryCreateKeyReq
-	(*sliverpb.RegistrySubKeyListReq)(nil), // 60: sliverpb.RegistrySubKeyListReq
-	(*sliverpb.RegistryListValuesReq)(nil), // 61: sliverpb.RegistryListValuesReq
-	(*sliverpb.SSHCommandReq)(nil),         // 62: sliverpb.SSHCommandReq
-	(*sliverpb.DllHijackReq)(nil),          // 63: sliverpb.DllHijackReq
-	(*sliverpb.GetPrivsReq)(nil),           // 64: sliverpb.GetPrivsReq
-	(*sliverpb.WGPortForwardStartReq)(nil), // 65: sliverpb.WGPortForwardStartReq
-	(*sliverpb.WGPortForwardStopReq)(nil),  // 66: sliverpb.WGPortForwardStopReq
-	(*sliverpb.WGSocksStartReq)(nil),       // 67: sliverpb.WGSocksStartReq
-	(*sliverpb.WGSocksStopReq)(nil),        // 68: sliverpb.WGSocksStopReq
-	(*sliverpb.WGTCPForwardersReq)(nil),    // 69: sliverpb.WGTCPForwardersReq
-	(*sliverpb.WGSocksServersReq)(nil),     // 70: sliverpb.WGSocksServersReq
-	(*sliverpb.ShellReq)(nil),              // 71: sliverpb.ShellReq
-	(*sliverpb.PortfwdReq)(nil),            // 72: sliverpb.PortfwdReq
-	(*sliverpb.Tunnel)(nil),                // 73: sliverpb.Tunnel
-	(*sliverpb.TunnelData)(nil),            // 74: sliverpb.TunnelData
-	(*clientpb.Version)(nil),               // 75: clientpb.Version
-	(*clientpb.Operators)(nil),             // 76: clientpb.Operators
-	(*clientpb.Sessions)(nil),              // 77: clientpb.Sessions
-	(*clientpb.Session)(nil),               // 78: clientpb.Session
-	(*commonpb.Response)(nil),              // 79: commonpb.Response
-	(*clientpb.Jobs)(nil),                  // 80: clientpb.Jobs
-	(*clientpb.KillJob)(nil),               // 81: clientpb.KillJob
-	(*clientpb.MTLSListener)(nil),          // 82: clientpb.MTLSListener
-	(*clientpb.WGListener)(nil),            // 83: clientpb.WGListener
-	(*clientpb.DNSListener)(nil),           // 84: clientpb.DNSListener
-	(*clientpb.HTTPListener)(nil),          // 85: clientpb.HTTPListener
-	(*clientpb.StagerListener)(nil),        // 86: clientpb.StagerListener
-	(*clientpb.AllLoot)(nil),               // 87: clientpb.AllLoot
-	(*clientpb.Generate)(nil),              // 88: clientpb.Generate
-	(*clientpb.ImplantBuilds)(nil),         // 89: clientpb.ImplantBuilds
-	(*clientpb.Canaries)(nil),              // 90: clientpb.Canaries
-	(*clientpb.WGClientConfig)(nil),        // 91: clientpb.WGClientConfig
-	(*clientpb.UniqueWGIP)(nil),            // 92: clientpb.UniqueWGIP
-	(*clientpb.ImplantProfiles)(nil),       // 93: clientpb.ImplantProfiles
-	(*clientpb.MsfStager)(nil),             // 94: clientpb.MsfStager
-	(*clientpb.ShellcodeRDI)(nil),          // 95: clientpb.ShellcodeRDI
-	(*clientpb.Compiler)(nil),              // 96: clientpb.Compiler
-	(*clientpb.Websites)(nil),              // 97: clientpb.Websites
-	(*sliverpb.Ps)(nil),                    // 98: sliverpb.Ps
-	(*sliverpb.Terminate)(nil),             // 99: sliverpb.Terminate
-	(*sliverpb.Ifconfig)(nil),              // 100: sliverpb.Ifconfig
-	(*sliverpb.Netstat)(nil),               // 101: sliverpb.Netstat
-	(*sliverpb.Ls)(nil),                    // 102: sliverpb.Ls
-	(*sliverpb.Pwd)(nil),                   // 103: sliverpb.Pwd
-	(*sliverpb.Rm)(nil),                    // 104: sliverpb.Rm
-	(*sliverpb.Mkdir)(nil),                 // 105: sliverpb.Mkdir
-	(*sliverpb.Download)(nil),              // 106: sliverpb.Download
-	(*sliverpb.Upload)(nil),                // 107: sliverpb.Upload
-	(*sliverpb.ProcessDump)(nil),           // 108: sliverpb.ProcessDump
-	(*sliverpb.RunAs)(nil),                 // 109: sliverpb.RunAs
-	(*sliverpb.Impersonate)(nil),           // 110: sliverpb.Impersonate
-	(*sliverpb.RevToSelf)(nil),             // 111: sliverpb.RevToSelf
-	(*sliverpb.GetSystem)(nil),             // 112: sliverpb.GetSystem
-	(*sliverpb.Task)(nil),                  // 113: sliverpb.Task
-	(*sliverpb.ExecuteAssembly)(nil),       // 114: sliverpb.ExecuteAssembly
-	(*sliverpb.Migrate)(nil),               // 115: sliverpb.Migrate
-	(*sliverpb.Execute)(nil),               // 116: sliverpb.Execute
-	(*sliverpb.Sideload)(nil),              // 117: sliverpb.Sideload
-	(*sliverpb.SpawnDll)(nil),              // 118: sliverpb.SpawnDll
-	(*sliverpb.Screenshot)(nil),            // 119: sliverpb.Screenshot
-	(*sliverpb.NamedPipes)(nil),            // 120: sliverpb.NamedPipes
-	(*sliverpb.TCPPivot)(nil),              // 121: sliverpb.TCPPivot
-	(*sliverpb.PivotList)(nil),             // 122: sliverpb.PivotList
-	(*sliverpb.ServiceInfo)(nil),           // 123: sliverpb.ServiceInfo
-	(*sliverpb.MakeToken)(nil),             // 124: sliverpb.MakeToken
-	(*sliverpb.EnvInfo)(nil),               // 125: sliverpb.EnvInfo
-	(*sliverpb.SetEnv)(nil),                // 126: sliverpb.SetEnv
-	(*sliverpb.UnsetEnv)(nil),              // 127: sliverpb.UnsetEnv
-	(*sliverpb.Backdoor)(nil),              // 128: sliverpb.Backdoor
-	(*sliverpb.RegistryRead)(nil),          // 129: sliverpb.RegistryRead
-	(*sliverpb.RegistryWrite)(nil),         // 130: sliverpb.RegistryWrite
-	(*sliverpb.RegistryCreateKey)(nil),     // 131: sliverpb.RegistryCreateKey
-	(*sliverpb.RegistrySubKeyList)(nil),    // 132: sliverpb.RegistrySubKeyList
-	(*sliverpb.RegistryValuesList)(nil),    // 133: sliverpb.RegistryValuesList
-	(*sliverpb.SSHCommand)(nil),            // 134: sliverpb.SSHCommand
-	(*sliverpb.DllHijack)(nil),             // 135: sliverpb.DllHijack
-	(*sliverpb.GetPrivs)(nil),              // 136: sliverpb.GetPrivs
-	(*sliverpb.WGPortForward)(nil),         // 137: sliverpb.WGPortForward
-	(*sliverpb.WGSocks)(nil),               // 138: sliverpb.WGSocks
-	(*sliverpb.WGTCPForwarders)(nil),       // 139: sliverpb.WGTCPForwarders
-	(*sliverpb.WGSocksServers)(nil),        // 140: sliverpb.WGSocksServers
-	(*sliverpb.Shell)(nil),                 // 141: sliverpb.Shell
-	(*sliverpb.Portfwd)(nil),               // 142: sliverpb.Portfwd
-	(*clientpb.Event)(nil),                 // 143: clientpb.Event
+	(*sliverpb.SSHCommandReq)(nil),         // 60: sliverpb.SSHCommandReq
+	(*sliverpb.DllHijackReq)(nil),          // 61: sliverpb.DllHijackReq
+	(*sliverpb.WGPortForwardStartReq)(nil), // 62: sliverpb.WGPortForwardStartReq
+	(*sliverpb.WGPortForwardStopReq)(nil),  // 63: sliverpb.WGPortForwardStopReq
+	(*sliverpb.WGSocksStartReq)(nil),       // 64: sliverpb.WGSocksStartReq
+	(*sliverpb.WGSocksStopReq)(nil),        // 65: sliverpb.WGSocksStopReq
+	(*sliverpb.WGTCPForwardersReq)(nil),    // 66: sliverpb.WGTCPForwardersReq
+	(*sliverpb.WGSocksServersReq)(nil),     // 67: sliverpb.WGSocksServersReq
+	(*sliverpb.ShellReq)(nil),              // 68: sliverpb.ShellReq
+	(*sliverpb.PortfwdReq)(nil),            // 69: sliverpb.PortfwdReq
+	(*sliverpb.Tunnel)(nil),                // 70: sliverpb.Tunnel
+	(*sliverpb.TunnelData)(nil),            // 71: sliverpb.TunnelData
+	(*clientpb.Version)(nil),               // 72: clientpb.Version
+	(*clientpb.Operators)(nil),             // 73: clientpb.Operators
+	(*clientpb.Sessions)(nil),              // 74: clientpb.Sessions
+	(*clientpb.Session)(nil),               // 75: clientpb.Session
+	(*commonpb.Response)(nil),              // 76: commonpb.Response
+	(*clientpb.Jobs)(nil),                  // 77: clientpb.Jobs
+	(*clientpb.KillJob)(nil),               // 78: clientpb.KillJob
+	(*clientpb.MTLSListener)(nil),          // 79: clientpb.MTLSListener
+	(*clientpb.WGListener)(nil),            // 80: clientpb.WGListener
+	(*clientpb.DNSListener)(nil),           // 81: clientpb.DNSListener
+	(*clientpb.HTTPListener)(nil),          // 82: clientpb.HTTPListener
+	(*clientpb.StagerListener)(nil),        // 83: clientpb.StagerListener
+	(*clientpb.AllLoot)(nil),               // 84: clientpb.AllLoot
+	(*clientpb.Generate)(nil),              // 85: clientpb.Generate
+	(*clientpb.ImplantBuilds)(nil),         // 86: clientpb.ImplantBuilds
+	(*clientpb.Canaries)(nil),              // 87: clientpb.Canaries
+	(*clientpb.WGClientConfig)(nil),        // 88: clientpb.WGClientConfig
+	(*clientpb.UniqueWGIP)(nil),            // 89: clientpb.UniqueWGIP
+	(*clientpb.ImplantProfiles)(nil),       // 90: clientpb.ImplantProfiles
+	(*clientpb.MsfStager)(nil),             // 91: clientpb.MsfStager
+	(*clientpb.ShellcodeRDI)(nil),          // 92: clientpb.ShellcodeRDI
+	(*clientpb.Compiler)(nil),              // 93: clientpb.Compiler
+	(*clientpb.Websites)(nil),              // 94: clientpb.Websites
+	(*sliverpb.Ps)(nil),                    // 95: sliverpb.Ps
+	(*sliverpb.Terminate)(nil),             // 96: sliverpb.Terminate
+	(*sliverpb.Ifconfig)(nil),              // 97: sliverpb.Ifconfig
+	(*sliverpb.Netstat)(nil),               // 98: sliverpb.Netstat
+	(*sliverpb.Ls)(nil),                    // 99: sliverpb.Ls
+	(*sliverpb.Pwd)(nil),                   // 100: sliverpb.Pwd
+	(*sliverpb.Rm)(nil),                    // 101: sliverpb.Rm
+	(*sliverpb.Mkdir)(nil),                 // 102: sliverpb.Mkdir
+	(*sliverpb.Download)(nil),              // 103: sliverpb.Download
+	(*sliverpb.Upload)(nil),                // 104: sliverpb.Upload
+	(*sliverpb.ProcessDump)(nil),           // 105: sliverpb.ProcessDump
+	(*sliverpb.RunAs)(nil),                 // 106: sliverpb.RunAs
+	(*sliverpb.Impersonate)(nil),           // 107: sliverpb.Impersonate
+	(*sliverpb.RevToSelf)(nil),             // 108: sliverpb.RevToSelf
+	(*sliverpb.GetSystem)(nil),             // 109: sliverpb.GetSystem
+	(*sliverpb.Task)(nil),                  // 110: sliverpb.Task
+	(*sliverpb.ExecuteAssembly)(nil),       // 111: sliverpb.ExecuteAssembly
+	(*sliverpb.Migrate)(nil),               // 112: sliverpb.Migrate
+	(*sliverpb.Execute)(nil),               // 113: sliverpb.Execute
+	(*sliverpb.Sideload)(nil),              // 114: sliverpb.Sideload
+	(*sliverpb.SpawnDll)(nil),              // 115: sliverpb.SpawnDll
+	(*sliverpb.Screenshot)(nil),            // 116: sliverpb.Screenshot
+	(*sliverpb.NamedPipes)(nil),            // 117: sliverpb.NamedPipes
+	(*sliverpb.TCPPivot)(nil),              // 118: sliverpb.TCPPivot
+	(*sliverpb.PivotList)(nil),             // 119: sliverpb.PivotList
+	(*sliverpb.ServiceInfo)(nil),           // 120: sliverpb.ServiceInfo
+	(*sliverpb.MakeToken)(nil),             // 121: sliverpb.MakeToken
+	(*sliverpb.EnvInfo)(nil),               // 122: sliverpb.EnvInfo
+	(*sliverpb.SetEnv)(nil),                // 123: sliverpb.SetEnv
+	(*sliverpb.UnsetEnv)(nil),              // 124: sliverpb.UnsetEnv
+	(*sliverpb.Backdoor)(nil),              // 125: sliverpb.Backdoor
+	(*sliverpb.RegistryRead)(nil),          // 126: sliverpb.RegistryRead
+	(*sliverpb.RegistryWrite)(nil),         // 127: sliverpb.RegistryWrite
+	(*sliverpb.RegistryCreateKey)(nil),     // 128: sliverpb.RegistryCreateKey
+	(*sliverpb.SSHCommand)(nil),            // 129: sliverpb.SSHCommand
+	(*sliverpb.DllHijack)(nil),             // 130: sliverpb.DllHijack
+	(*sliverpb.WGPortForward)(nil),         // 131: sliverpb.WGPortForward
+	(*sliverpb.WGSocks)(nil),               // 132: sliverpb.WGSocks
+	(*sliverpb.WGTCPForwarders)(nil),       // 133: sliverpb.WGTCPForwarders
+	(*sliverpb.WGSocksServers)(nil),        // 134: sliverpb.WGSocksServers
+	(*sliverpb.Shell)(nil),                 // 135: sliverpb.Shell
+	(*sliverpb.Portfwd)(nil),               // 136: sliverpb.Portfwd
+	(*clientpb.Event)(nil),                 // 137: clientpb.Event
 }
 var file_rpcpb_services_proto_depIdxs = []int32{
 	0,   // 0: rpcpb.SliverRPC.GetVersion:input_type -> commonpb.Empty
@@ -627,124 +606,118 @@ var file_rpcpb_services_proto_depIdxs = []int32{
 	57,  // 79: rpcpb.SliverRPC.RegistryRead:input_type -> sliverpb.RegistryReadReq
 	58,  // 80: rpcpb.SliverRPC.RegistryWrite:input_type -> sliverpb.RegistryWriteReq
 	59,  // 81: rpcpb.SliverRPC.RegistryCreateKey:input_type -> sliverpb.RegistryCreateKeyReq
-	60,  // 82: rpcpb.SliverRPC.RegistryListSubKeys:input_type -> sliverpb.RegistrySubKeyListReq
-	61,  // 83: rpcpb.SliverRPC.RegistryListValues:input_type -> sliverpb.RegistryListValuesReq
-	62,  // 84: rpcpb.SliverRPC.RunSSHCommand:input_type -> sliverpb.SSHCommandReq
-	63,  // 85: rpcpb.SliverRPC.HijackDLL:input_type -> sliverpb.DllHijackReq
-	64,  // 86: rpcpb.SliverRPC.GetPrivs:input_type -> sliverpb.GetPrivsReq
-	65,  // 87: rpcpb.SliverRPC.WGStartPortForward:input_type -> sliverpb.WGPortForwardStartReq
-	66,  // 88: rpcpb.SliverRPC.WGStopPortForward:input_type -> sliverpb.WGPortForwardStopReq
-	67,  // 89: rpcpb.SliverRPC.WGStartSocks:input_type -> sliverpb.WGSocksStartReq
-	68,  // 90: rpcpb.SliverRPC.WGStopSocks:input_type -> sliverpb.WGSocksStopReq
-	69,  // 91: rpcpb.SliverRPC.WGListForwarders:input_type -> sliverpb.WGTCPForwardersReq
-	70,  // 92: rpcpb.SliverRPC.WGListSocksServers:input_type -> sliverpb.WGSocksServersReq
-	71,  // 93: rpcpb.SliverRPC.Shell:input_type -> sliverpb.ShellReq
-	72,  // 94: rpcpb.SliverRPC.Portfwd:input_type -> sliverpb.PortfwdReq
-	73,  // 95: rpcpb.SliverRPC.CreateTunnel:input_type -> sliverpb.Tunnel
-	73,  // 96: rpcpb.SliverRPC.CloseTunnel:input_type -> sliverpb.Tunnel
-	74,  // 97: rpcpb.SliverRPC.TunnelData:input_type -> sliverpb.TunnelData
-	0,   // 98: rpcpb.SliverRPC.Events:input_type -> commonpb.Empty
-	75,  // 99: rpcpb.SliverRPC.GetVersion:output_type -> clientpb.Version
-	76,  // 100: rpcpb.SliverRPC.GetOperators:output_type -> clientpb.Operators
-	77,  // 101: rpcpb.SliverRPC.GetSessions:output_type -> clientpb.Sessions
-	0,   // 102: rpcpb.SliverRPC.KillSession:output_type -> commonpb.Empty
-	78,  // 103: rpcpb.SliverRPC.UpdateSession:output_type -> clientpb.Session
-	79,  // 104: rpcpb.SliverRPC.MonitorStart:output_type -> commonpb.Response
-	0,   // 105: rpcpb.SliverRPC.MonitorStop:output_type -> commonpb.Empty
-	80,  // 106: rpcpb.SliverRPC.GetJobs:output_type -> clientpb.Jobs
-	81,  // 107: rpcpb.SliverRPC.KillJob:output_type -> clientpb.KillJob
-	82,  // 108: rpcpb.SliverRPC.StartMTLSListener:output_type -> clientpb.MTLSListener
-	83,  // 109: rpcpb.SliverRPC.StartWGListener:output_type -> clientpb.WGListener
-	84,  // 110: rpcpb.SliverRPC.StartDNSListener:output_type -> clientpb.DNSListener
-	85,  // 111: rpcpb.SliverRPC.StartHTTPSListener:output_type -> clientpb.HTTPListener
-	85,  // 112: rpcpb.SliverRPC.StartHTTPListener:output_type -> clientpb.HTTPListener
-	86,  // 113: rpcpb.SliverRPC.StartTCPStagerListener:output_type -> clientpb.StagerListener
-	86,  // 114: rpcpb.SliverRPC.StartHTTPStagerListener:output_type -> clientpb.StagerListener
-	9,   // 115: rpcpb.SliverRPC.LootAdd:output_type -> clientpb.Loot
-	0,   // 116: rpcpb.SliverRPC.LootRm:output_type -> commonpb.Empty
-	9,   // 117: rpcpb.SliverRPC.LootUpdate:output_type -> clientpb.Loot
-	9,   // 118: rpcpb.SliverRPC.LootContent:output_type -> clientpb.Loot
-	87,  // 119: rpcpb.SliverRPC.LootAll:output_type -> clientpb.AllLoot
-	87,  // 120: rpcpb.SliverRPC.LootAllOf:output_type -> clientpb.AllLoot
-	88,  // 121: rpcpb.SliverRPC.Generate:output_type -> clientpb.Generate
-	88,  // 122: rpcpb.SliverRPC.Regenerate:output_type -> clientpb.Generate
-	89,  // 123: rpcpb.SliverRPC.ImplantBuilds:output_type -> clientpb.ImplantBuilds
-	0,   // 124: rpcpb.SliverRPC.DeleteImplantBuild:output_type -> commonpb.Empty
-	90,  // 125: rpcpb.SliverRPC.Canaries:output_type -> clientpb.Canaries
-	91,  // 126: rpcpb.SliverRPC.GenerateWGClientConfig:output_type -> clientpb.WGClientConfig
-	92,  // 127: rpcpb.SliverRPC.GenerateUniqueIP:output_type -> clientpb.UniqueWGIP
-	93,  // 128: rpcpb.SliverRPC.ImplantProfiles:output_type -> clientpb.ImplantProfiles
-	0,   // 129: rpcpb.SliverRPC.DeleteImplantProfile:output_type -> commonpb.Empty
-	13,  // 130: rpcpb.SliverRPC.SaveImplantProfile:output_type -> clientpb.ImplantProfile
-	94,  // 131: rpcpb.SliverRPC.MsfStage:output_type -> clientpb.MsfStager
-	95,  // 132: rpcpb.SliverRPC.ShellcodeRDI:output_type -> clientpb.ShellcodeRDI
-	96,  // 133: rpcpb.SliverRPC.GetCompiler:output_type -> clientpb.Compiler
-	97,  // 134: rpcpb.SliverRPC.Websites:output_type -> clientpb.Websites
-	16,  // 135: rpcpb.SliverRPC.Website:output_type -> clientpb.Website
-	0,   // 136: rpcpb.SliverRPC.WebsiteRemove:output_type -> commonpb.Empty
-	16,  // 137: rpcpb.SliverRPC.WebsiteAddContent:output_type -> clientpb.Website
-	16,  // 138: rpcpb.SliverRPC.WebsiteUpdateContent:output_type -> clientpb.Website
-	16,  // 139: rpcpb.SliverRPC.WebsiteRemoveContent:output_type -> clientpb.Website
-	19,  // 140: rpcpb.SliverRPC.Ping:output_type -> sliverpb.Ping
-	98,  // 141: rpcpb.SliverRPC.Ps:output_type -> sliverpb.Ps
-	99,  // 142: rpcpb.SliverRPC.Terminate:output_type -> sliverpb.Terminate
-	100, // 143: rpcpb.SliverRPC.Ifconfig:output_type -> sliverpb.Ifconfig
-	101, // 144: rpcpb.SliverRPC.Netstat:output_type -> sliverpb.Netstat
-	102, // 145: rpcpb.SliverRPC.Ls:output_type -> sliverpb.Ls
-	103, // 146: rpcpb.SliverRPC.Cd:output_type -> sliverpb.Pwd
-	103, // 147: rpcpb.SliverRPC.Pwd:output_type -> sliverpb.Pwd
-	104, // 148: rpcpb.SliverRPC.Rm:output_type -> sliverpb.Rm
-	105, // 149: rpcpb.SliverRPC.Mkdir:output_type -> sliverpb.Mkdir
-	106, // 150: rpcpb.SliverRPC.Download:output_type -> sliverpb.Download
-	107, // 151: rpcpb.SliverRPC.Upload:output_type -> sliverpb.Upload
-	108, // 152: rpcpb.SliverRPC.ProcessDump:output_type -> sliverpb.ProcessDump
-	109, // 153: rpcpb.SliverRPC.RunAs:output_type -> sliverpb.RunAs
-	110, // 154: rpcpb.SliverRPC.Impersonate:output_type -> sliverpb.Impersonate
-	111, // 155: rpcpb.SliverRPC.RevToSelf:output_type -> sliverpb.RevToSelf
-	112, // 156: rpcpb.SliverRPC.GetSystem:output_type -> sliverpb.GetSystem
-	113, // 157: rpcpb.SliverRPC.Task:output_type -> sliverpb.Task
-	0,   // 158: rpcpb.SliverRPC.Msf:output_type -> commonpb.Empty
-	0,   // 159: rpcpb.SliverRPC.MsfRemote:output_type -> commonpb.Empty
-	114, // 160: rpcpb.SliverRPC.ExecuteAssembly:output_type -> sliverpb.ExecuteAssembly
-	115, // 161: rpcpb.SliverRPC.Migrate:output_type -> sliverpb.Migrate
-	116, // 162: rpcpb.SliverRPC.Execute:output_type -> sliverpb.Execute
-	116, // 163: rpcpb.SliverRPC.ExecuteToken:output_type -> sliverpb.Execute
-	117, // 164: rpcpb.SliverRPC.Sideload:output_type -> sliverpb.Sideload
-	118, // 165: rpcpb.SliverRPC.SpawnDll:output_type -> sliverpb.SpawnDll
-	119, // 166: rpcpb.SliverRPC.Screenshot:output_type -> sliverpb.Screenshot
-	120, // 167: rpcpb.SliverRPC.NamedPipes:output_type -> sliverpb.NamedPipes
-	121, // 168: rpcpb.SliverRPC.TCPListener:output_type -> sliverpb.TCPPivot
-	122, // 169: rpcpb.SliverRPC.ListPivots:output_type -> sliverpb.PivotList
-	123, // 170: rpcpb.SliverRPC.StartService:output_type -> sliverpb.ServiceInfo
-	123, // 171: rpcpb.SliverRPC.StopService:output_type -> sliverpb.ServiceInfo
-	123, // 172: rpcpb.SliverRPC.RemoveService:output_type -> sliverpb.ServiceInfo
-	124, // 173: rpcpb.SliverRPC.MakeToken:output_type -> sliverpb.MakeToken
-	125, // 174: rpcpb.SliverRPC.GetEnv:output_type -> sliverpb.EnvInfo
-	126, // 175: rpcpb.SliverRPC.SetEnv:output_type -> sliverpb.SetEnv
-	127, // 176: rpcpb.SliverRPC.UnsetEnv:output_type -> sliverpb.UnsetEnv
-	128, // 177: rpcpb.SliverRPC.Backdoor:output_type -> sliverpb.Backdoor
-	129, // 178: rpcpb.SliverRPC.RegistryRead:output_type -> sliverpb.RegistryRead
-	130, // 179: rpcpb.SliverRPC.RegistryWrite:output_type -> sliverpb.RegistryWrite
-	131, // 180: rpcpb.SliverRPC.RegistryCreateKey:output_type -> sliverpb.RegistryCreateKey
-	132, // 181: rpcpb.SliverRPC.RegistryListSubKeys:output_type -> sliverpb.RegistrySubKeyList
-	133, // 182: rpcpb.SliverRPC.RegistryListValues:output_type -> sliverpb.RegistryValuesList
-	134, // 183: rpcpb.SliverRPC.RunSSHCommand:output_type -> sliverpb.SSHCommand
-	135, // 184: rpcpb.SliverRPC.HijackDLL:output_type -> sliverpb.DllHijack
-	136, // 185: rpcpb.SliverRPC.GetPrivs:output_type -> sliverpb.GetPrivs
-	137, // 186: rpcpb.SliverRPC.WGStartPortForward:output_type -> sliverpb.WGPortForward
-	137, // 187: rpcpb.SliverRPC.WGStopPortForward:output_type -> sliverpb.WGPortForward
-	138, // 188: rpcpb.SliverRPC.WGStartSocks:output_type -> sliverpb.WGSocks
-	138, // 189: rpcpb.SliverRPC.WGStopSocks:output_type -> sliverpb.WGSocks
-	139, // 190: rpcpb.SliverRPC.WGListForwarders:output_type -> sliverpb.WGTCPForwarders
-	140, // 191: rpcpb.SliverRPC.WGListSocksServers:output_type -> sliverpb.WGSocksServers
-	141, // 192: rpcpb.SliverRPC.Shell:output_type -> sliverpb.Shell
-	142, // 193: rpcpb.SliverRPC.Portfwd:output_type -> sliverpb.Portfwd
-	73,  // 194: rpcpb.SliverRPC.CreateTunnel:output_type -> sliverpb.Tunnel
-	0,   // 195: rpcpb.SliverRPC.CloseTunnel:output_type -> commonpb.Empty
-	74,  // 196: rpcpb.SliverRPC.TunnelData:output_type -> sliverpb.TunnelData
-	143, // 197: rpcpb.SliverRPC.Events:output_type -> clientpb.Event
-	99,  // [99:198] is the sub-list for method output_type
-	0,   // [0:99] is the sub-list for method input_type
+	60,  // 82: rpcpb.SliverRPC.RunSSHCommand:input_type -> sliverpb.SSHCommandReq
+	61,  // 83: rpcpb.SliverRPC.HijackDLL:input_type -> sliverpb.DllHijackReq
+	62,  // 84: rpcpb.SliverRPC.WGStartPortForward:input_type -> sliverpb.WGPortForwardStartReq
+	63,  // 85: rpcpb.SliverRPC.WGStopPortForward:input_type -> sliverpb.WGPortForwardStopReq
+	64,  // 86: rpcpb.SliverRPC.WGStartSocks:input_type -> sliverpb.WGSocksStartReq
+	65,  // 87: rpcpb.SliverRPC.WGStopSocks:input_type -> sliverpb.WGSocksStopReq
+	66,  // 88: rpcpb.SliverRPC.WGListForwarders:input_type -> sliverpb.WGTCPForwardersReq
+	67,  // 89: rpcpb.SliverRPC.WGListSocksServers:input_type -> sliverpb.WGSocksServersReq
+	68,  // 90: rpcpb.SliverRPC.Shell:input_type -> sliverpb.ShellReq
+	69,  // 91: rpcpb.SliverRPC.Portfwd:input_type -> sliverpb.PortfwdReq
+	70,  // 92: rpcpb.SliverRPC.CreateTunnel:input_type -> sliverpb.Tunnel
+	70,  // 93: rpcpb.SliverRPC.CloseTunnel:input_type -> sliverpb.Tunnel
+	71,  // 94: rpcpb.SliverRPC.TunnelData:input_type -> sliverpb.TunnelData
+	0,   // 95: rpcpb.SliverRPC.Events:input_type -> commonpb.Empty
+	72,  // 96: rpcpb.SliverRPC.GetVersion:output_type -> clientpb.Version
+	73,  // 97: rpcpb.SliverRPC.GetOperators:output_type -> clientpb.Operators
+	74,  // 98: rpcpb.SliverRPC.GetSessions:output_type -> clientpb.Sessions
+	0,   // 99: rpcpb.SliverRPC.KillSession:output_type -> commonpb.Empty
+	75,  // 100: rpcpb.SliverRPC.UpdateSession:output_type -> clientpb.Session
+	76,  // 101: rpcpb.SliverRPC.MonitorStart:output_type -> commonpb.Response
+	0,   // 102: rpcpb.SliverRPC.MonitorStop:output_type -> commonpb.Empty
+	77,  // 103: rpcpb.SliverRPC.GetJobs:output_type -> clientpb.Jobs
+	78,  // 104: rpcpb.SliverRPC.KillJob:output_type -> clientpb.KillJob
+	79,  // 105: rpcpb.SliverRPC.StartMTLSListener:output_type -> clientpb.MTLSListener
+	80,  // 106: rpcpb.SliverRPC.StartWGListener:output_type -> clientpb.WGListener
+	81,  // 107: rpcpb.SliverRPC.StartDNSListener:output_type -> clientpb.DNSListener
+	82,  // 108: rpcpb.SliverRPC.StartHTTPSListener:output_type -> clientpb.HTTPListener
+	82,  // 109: rpcpb.SliverRPC.StartHTTPListener:output_type -> clientpb.HTTPListener
+	83,  // 110: rpcpb.SliverRPC.StartTCPStagerListener:output_type -> clientpb.StagerListener
+	83,  // 111: rpcpb.SliverRPC.StartHTTPStagerListener:output_type -> clientpb.StagerListener
+	9,   // 112: rpcpb.SliverRPC.LootAdd:output_type -> clientpb.Loot
+	0,   // 113: rpcpb.SliverRPC.LootRm:output_type -> commonpb.Empty
+	9,   // 114: rpcpb.SliverRPC.LootUpdate:output_type -> clientpb.Loot
+	9,   // 115: rpcpb.SliverRPC.LootContent:output_type -> clientpb.Loot
+	84,  // 116: rpcpb.SliverRPC.LootAll:output_type -> clientpb.AllLoot
+	84,  // 117: rpcpb.SliverRPC.LootAllOf:output_type -> clientpb.AllLoot
+	85,  // 118: rpcpb.SliverRPC.Generate:output_type -> clientpb.Generate
+	85,  // 119: rpcpb.SliverRPC.Regenerate:output_type -> clientpb.Generate
+	86,  // 120: rpcpb.SliverRPC.ImplantBuilds:output_type -> clientpb.ImplantBuilds
+	0,   // 121: rpcpb.SliverRPC.DeleteImplantBuild:output_type -> commonpb.Empty
+	87,  // 122: rpcpb.SliverRPC.Canaries:output_type -> clientpb.Canaries
+	88,  // 123: rpcpb.SliverRPC.GenerateWGClientConfig:output_type -> clientpb.WGClientConfig
+	89,  // 124: rpcpb.SliverRPC.GenerateUniqueIP:output_type -> clientpb.UniqueWGIP
+	90,  // 125: rpcpb.SliverRPC.ImplantProfiles:output_type -> clientpb.ImplantProfiles
+	0,   // 126: rpcpb.SliverRPC.DeleteImplantProfile:output_type -> commonpb.Empty
+	13,  // 127: rpcpb.SliverRPC.SaveImplantProfile:output_type -> clientpb.ImplantProfile
+	91,  // 128: rpcpb.SliverRPC.MsfStage:output_type -> clientpb.MsfStager
+	92,  // 129: rpcpb.SliverRPC.ShellcodeRDI:output_type -> clientpb.ShellcodeRDI
+	93,  // 130: rpcpb.SliverRPC.GetCompiler:output_type -> clientpb.Compiler
+	94,  // 131: rpcpb.SliverRPC.Websites:output_type -> clientpb.Websites
+	16,  // 132: rpcpb.SliverRPC.Website:output_type -> clientpb.Website
+	0,   // 133: rpcpb.SliverRPC.WebsiteRemove:output_type -> commonpb.Empty
+	16,  // 134: rpcpb.SliverRPC.WebsiteAddContent:output_type -> clientpb.Website
+	16,  // 135: rpcpb.SliverRPC.WebsiteUpdateContent:output_type -> clientpb.Website
+	16,  // 136: rpcpb.SliverRPC.WebsiteRemoveContent:output_type -> clientpb.Website
+	19,  // 137: rpcpb.SliverRPC.Ping:output_type -> sliverpb.Ping
+	95,  // 138: rpcpb.SliverRPC.Ps:output_type -> sliverpb.Ps
+	96,  // 139: rpcpb.SliverRPC.Terminate:output_type -> sliverpb.Terminate
+	97,  // 140: rpcpb.SliverRPC.Ifconfig:output_type -> sliverpb.Ifconfig
+	98,  // 141: rpcpb.SliverRPC.Netstat:output_type -> sliverpb.Netstat
+	99,  // 142: rpcpb.SliverRPC.Ls:output_type -> sliverpb.Ls
+	100, // 143: rpcpb.SliverRPC.Cd:output_type -> sliverpb.Pwd
+	100, // 144: rpcpb.SliverRPC.Pwd:output_type -> sliverpb.Pwd
+	101, // 145: rpcpb.SliverRPC.Rm:output_type -> sliverpb.Rm
+	102, // 146: rpcpb.SliverRPC.Mkdir:output_type -> sliverpb.Mkdir
+	103, // 147: rpcpb.SliverRPC.Download:output_type -> sliverpb.Download
+	104, // 148: rpcpb.SliverRPC.Upload:output_type -> sliverpb.Upload
+	105, // 149: rpcpb.SliverRPC.ProcessDump:output_type -> sliverpb.ProcessDump
+	106, // 150: rpcpb.SliverRPC.RunAs:output_type -> sliverpb.RunAs
+	107, // 151: rpcpb.SliverRPC.Impersonate:output_type -> sliverpb.Impersonate
+	108, // 152: rpcpb.SliverRPC.RevToSelf:output_type -> sliverpb.RevToSelf
+	109, // 153: rpcpb.SliverRPC.GetSystem:output_type -> sliverpb.GetSystem
+	110, // 154: rpcpb.SliverRPC.Task:output_type -> sliverpb.Task
+	0,   // 155: rpcpb.SliverRPC.Msf:output_type -> commonpb.Empty
+	0,   // 156: rpcpb.SliverRPC.MsfRemote:output_type -> commonpb.Empty
+	111, // 157: rpcpb.SliverRPC.ExecuteAssembly:output_type -> sliverpb.ExecuteAssembly
+	112, // 158: rpcpb.SliverRPC.Migrate:output_type -> sliverpb.Migrate
+	113, // 159: rpcpb.SliverRPC.Execute:output_type -> sliverpb.Execute
+	113, // 160: rpcpb.SliverRPC.ExecuteToken:output_type -> sliverpb.Execute
+	114, // 161: rpcpb.SliverRPC.Sideload:output_type -> sliverpb.Sideload
+	115, // 162: rpcpb.SliverRPC.SpawnDll:output_type -> sliverpb.SpawnDll
+	116, // 163: rpcpb.SliverRPC.Screenshot:output_type -> sliverpb.Screenshot
+	117, // 164: rpcpb.SliverRPC.NamedPipes:output_type -> sliverpb.NamedPipes
+	118, // 165: rpcpb.SliverRPC.TCPListener:output_type -> sliverpb.TCPPivot
+	119, // 166: rpcpb.SliverRPC.ListPivots:output_type -> sliverpb.PivotList
+	120, // 167: rpcpb.SliverRPC.StartService:output_type -> sliverpb.ServiceInfo
+	120, // 168: rpcpb.SliverRPC.StopService:output_type -> sliverpb.ServiceInfo
+	120, // 169: rpcpb.SliverRPC.RemoveService:output_type -> sliverpb.ServiceInfo
+	121, // 170: rpcpb.SliverRPC.MakeToken:output_type -> sliverpb.MakeToken
+	122, // 171: rpcpb.SliverRPC.GetEnv:output_type -> sliverpb.EnvInfo
+	123, // 172: rpcpb.SliverRPC.SetEnv:output_type -> sliverpb.SetEnv
+	124, // 173: rpcpb.SliverRPC.UnsetEnv:output_type -> sliverpb.UnsetEnv
+	125, // 174: rpcpb.SliverRPC.Backdoor:output_type -> sliverpb.Backdoor
+	126, // 175: rpcpb.SliverRPC.RegistryRead:output_type -> sliverpb.RegistryRead
+	127, // 176: rpcpb.SliverRPC.RegistryWrite:output_type -> sliverpb.RegistryWrite
+	128, // 177: rpcpb.SliverRPC.RegistryCreateKey:output_type -> sliverpb.RegistryCreateKey
+	129, // 178: rpcpb.SliverRPC.RunSSHCommand:output_type -> sliverpb.SSHCommand
+	130, // 179: rpcpb.SliverRPC.HijackDLL:output_type -> sliverpb.DllHijack
+	131, // 180: rpcpb.SliverRPC.WGStartPortForward:output_type -> sliverpb.WGPortForward
+	131, // 181: rpcpb.SliverRPC.WGStopPortForward:output_type -> sliverpb.WGPortForward
+	132, // 182: rpcpb.SliverRPC.WGStartSocks:output_type -> sliverpb.WGSocks
+	132, // 183: rpcpb.SliverRPC.WGStopSocks:output_type -> sliverpb.WGSocks
+	133, // 184: rpcpb.SliverRPC.WGListForwarders:output_type -> sliverpb.WGTCPForwarders
+	134, // 185: rpcpb.SliverRPC.WGListSocksServers:output_type -> sliverpb.WGSocksServers
+	135, // 186: rpcpb.SliverRPC.Shell:output_type -> sliverpb.Shell
+	136, // 187: rpcpb.SliverRPC.Portfwd:output_type -> sliverpb.Portfwd
+	70,  // 188: rpcpb.SliverRPC.CreateTunnel:output_type -> sliverpb.Tunnel
+	0,   // 189: rpcpb.SliverRPC.CloseTunnel:output_type -> commonpb.Empty
+	71,  // 190: rpcpb.SliverRPC.TunnelData:output_type -> sliverpb.TunnelData
+	137, // 191: rpcpb.SliverRPC.Events:output_type -> clientpb.Event
+	96,  // [96:192] is the sub-list for method output_type
+	0,   // [0:96] is the sub-list for method input_type
 	0,   // [0:0] is the sub-list for extension type_name
 	0,   // [0:0] is the sub-list for extension extendee
 	0,   // [0:0] is the sub-list for field type_name

protobuf/rpcpb/services.proto

@@ -112,11 +112,8 @@ service SliverRPC {
     rpc RegistryRead(sliverpb.RegistryReadReq) returns (sliverpb.RegistryRead);
     rpc RegistryWrite(sliverpb.RegistryWriteReq) returns (sliverpb.RegistryWrite);
     rpc RegistryCreateKey(sliverpb.RegistryCreateKeyReq) returns (sliverpb.RegistryCreateKey);
-    rpc RegistryListSubKeys(sliverpb.RegistrySubKeyListReq) returns (sliverpb.RegistrySubKeyList);
-    rpc RegistryListValues(sliverpb.RegistryListValuesReq) returns (sliverpb.RegistryValuesList);
     rpc RunSSHCommand(sliverpb.SSHCommandReq) returns (sliverpb.SSHCommand);
     rpc HijackDLL(sliverpb.DllHijackReq) returns (sliverpb.DllHijack);
-    rpc GetPrivs(sliverpb.GetPrivsReq) returns  (sliverpb.GetPrivs);
     
     // *** Wireguard Specific ***
     rpc WGStartPortForward(sliverpb.WGPortForwardStartReq) returns (sliverpb.WGPortForward);

protobuf/rpcpb/services_grpc.pb.go

@@ -114,11 +114,8 @@ type SliverRPCClient interface {
 	RegistryRead(ctx context.Context, in *sliverpb.RegistryReadReq, opts ...grpc.CallOption) (*sliverpb.RegistryRead, error)
 	RegistryWrite(ctx context.Context, in *sliverpb.RegistryWriteReq, opts ...grpc.CallOption) (*sliverpb.RegistryWrite, error)
 	RegistryCreateKey(ctx context.Context, in *sliverpb.RegistryCreateKeyReq, opts ...grpc.CallOption) (*sliverpb.RegistryCreateKey, error)
-	RegistryListSubKeys(ctx context.Context, in *sliverpb.RegistrySubKeyListReq, opts ...grpc.CallOption) (*sliverpb.RegistrySubKeyList, error)
-	RegistryListValues(ctx context.Context, in *sliverpb.RegistryListValuesReq, opts ...grpc.CallOption) (*sliverpb.RegistryValuesList, error)
 	RunSSHCommand(ctx context.Context, in *sliverpb.SSHCommandReq, opts ...grpc.CallOption) (*sliverpb.SSHCommand, error)
 	HijackDLL(ctx context.Context, in *sliverpb.DllHijackReq, opts ...grpc.CallOption) (*sliverpb.DllHijack, error)
-	GetPrivs(ctx context.Context, in *sliverpb.GetPrivsReq, opts ...grpc.CallOption) (*sliverpb.GetPrivs, error)
 	// *** Wireguard Specific ***
 	WGStartPortForward(ctx context.Context, in *sliverpb.WGPortForwardStartReq, opts ...grpc.CallOption) (*sliverpb.WGPortForward, error)
 	WGStopPortForward(ctx context.Context, in *sliverpb.WGPortForwardStopReq, opts ...grpc.CallOption) (*sliverpb.WGPortForward, error)
@@ -883,24 +880,6 @@ func (c *sliverRPCClient) RegistryCreateKey(ctx context.Context, in *sliverpb.Re
 	return out, nil
 }
 
-func (c *sliverRPCClient) RegistryListSubKeys(ctx context.Context, in *sliverpb.RegistrySubKeyListReq, opts ...grpc.CallOption) (*sliverpb.RegistrySubKeyList, error) {
-	out := new(sliverpb.RegistrySubKeyList)
-	err := c.cc.Invoke(ctx, "/rpcpb.SliverRPC/RegistryListSubKeys", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *sliverRPCClient) RegistryListValues(ctx context.Context, in *sliverpb.RegistryListValuesReq, opts ...grpc.CallOption) (*sliverpb.RegistryValuesList, error) {
-	out := new(sliverpb.RegistryValuesList)
-	err := c.cc.Invoke(ctx, "/rpcpb.SliverRPC/RegistryListValues", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
 func (c *sliverRPCClient) RunSSHCommand(ctx context.Context, in *sliverpb.SSHCommandReq, opts ...grpc.CallOption) (*sliverpb.SSHCommand, error) {
 	out := new(sliverpb.SSHCommand)
 	err := c.cc.Invoke(ctx, "/rpcpb.SliverRPC/RunSSHCommand", in, out, opts...)
@@ -919,15 +898,6 @@ func (c *sliverRPCClient) HijackDLL(ctx context.Context, in *sliverpb.DllHijackR
 	return out, nil
 }
 
-func (c *sliverRPCClient) GetPrivs(ctx context.Context, in *sliverpb.GetPrivsReq, opts ...grpc.CallOption) (*sliverpb.GetPrivs, error) {
-	out := new(sliverpb.GetPrivs)
-	err := c.cc.Invoke(ctx, "/rpcpb.SliverRPC/GetPrivs", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
 func (c *sliverRPCClient) WGStartPortForward(ctx context.Context, in *sliverpb.WGPortForwardStartReq, opts ...grpc.CallOption) (*sliverpb.WGPortForward, error) {
 	out := new(sliverpb.WGPortForward)
 	err := c.cc.Invoke(ctx, "/rpcpb.SliverRPC/WGStartPortForward", in, out, opts...)
@@ -1178,11 +1148,8 @@ type SliverRPCServer interface {
 	RegistryRead(context.Context, *sliverpb.RegistryReadReq) (*sliverpb.RegistryRead, error)
 	RegistryWrite(context.Context, *sliverpb.RegistryWriteReq) (*sliverpb.RegistryWrite, error)
 	RegistryCreateKey(context.Context, *sliverpb.RegistryCreateKeyReq) (*sliverpb.RegistryCreateKey, error)
-	RegistryListSubKeys(context.Context, *sliverpb.RegistrySubKeyListReq) (*sliverpb.RegistrySubKeyList, error)
-	RegistryListValues(context.Context, *sliverpb.RegistryListValuesReq) (*sliverpb.RegistryValuesList, error)
 	RunSSHCommand(context.Context, *sliverpb.SSHCommandReq) (*sliverpb.SSHCommand, error)
 	HijackDLL(context.Context, *sliverpb.DllHijackReq) (*sliverpb.DllHijack, error)
-	GetPrivs(context.Context, *sliverpb.GetPrivsReq) (*sliverpb.GetPrivs, error)
 	// *** Wireguard Specific ***
 	WGStartPortForward(context.Context, *sliverpb.WGPortForwardStartReq) (*sliverpb.WGPortForward, error)
 	WGStopPortForward(context.Context, *sliverpb.WGPortForwardStopReq) (*sliverpb.WGPortForward, error)
@@ -1452,21 +1419,12 @@ func (UnimplementedSliverRPCServer) RegistryWrite(context.Context, *sliverpb.Reg
 func (UnimplementedSliverRPCServer) RegistryCreateKey(context.Context, *sliverpb.RegistryCreateKeyReq) (*sliverpb.RegistryCreateKey, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method RegistryCreateKey not implemented")
 }
-func (UnimplementedSliverRPCServer) RegistryListSubKeys(context.Context, *sliverpb.RegistrySubKeyListReq) (*sliverpb.RegistrySubKeyList, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method RegistryListSubKeys not implemented")
-}
-func (UnimplementedSliverRPCServer) RegistryListValues(context.Context, *sliverpb.RegistryListValuesReq) (*sliverpb.RegistryValuesList, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method RegistryListValues not implemented")
-}
 func (UnimplementedSliverRPCServer) RunSSHCommand(context.Context, *sliverpb.SSHCommandReq) (*sliverpb.SSHCommand, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method RunSSHCommand not implemented")
 }
 func (UnimplementedSliverRPCServer) HijackDLL(context.Context, *sliverpb.DllHijackReq) (*sliverpb.DllHijack, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method HijackDLL not implemented")
 }
-func (UnimplementedSliverRPCServer) GetPrivs(context.Context, *sliverpb.GetPrivsReq) (*sliverpb.GetPrivs, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetPrivs not implemented")
-}
 func (UnimplementedSliverRPCServer) WGStartPortForward(context.Context, *sliverpb.WGPortForwardStartReq) (*sliverpb.WGPortForward, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method WGStartPortForward not implemented")
 }
@@ -2992,42 +2950,6 @@ func _SliverRPC_RegistryCreateKey_Handler(srv interface{}, ctx context.Context,
 	return interceptor(ctx, in, info, handler)
 }
 
-func _SliverRPC_RegistryListSubKeys_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(sliverpb.RegistrySubKeyListReq)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(SliverRPCServer).RegistryListSubKeys(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/rpcpb.SliverRPC/RegistryListSubKeys",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(SliverRPCServer).RegistryListSubKeys(ctx, req.(*sliverpb.RegistrySubKeyListReq))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _SliverRPC_RegistryListValues_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(sliverpb.RegistryListValuesReq)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(SliverRPCServer).RegistryListValues(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/rpcpb.SliverRPC/RegistryListValues",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(SliverRPCServer).RegistryListValues(ctx, req.(*sliverpb.RegistryListValuesReq))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
 func _SliverRPC_RunSSHCommand_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(sliverpb.SSHCommandReq)
 	if err := dec(in); err != nil {
@@ -3064,24 +2986,6 @@ func _SliverRPC_HijackDLL_Handler(srv interface{}, ctx context.Context, dec func
 	return interceptor(ctx, in, info, handler)
 }
 
-func _SliverRPC_GetPrivs_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(sliverpb.GetPrivsReq)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(SliverRPCServer).GetPrivs(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/rpcpb.SliverRPC/GetPrivs",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(SliverRPCServer).GetPrivs(ctx, req.(*sliverpb.GetPrivsReq))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
 func _SliverRPC_WGStartPortForward_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(sliverpb.WGPortForwardStartReq)
 	if err := dec(in); err != nil {
@@ -3644,14 +3548,6 @@ var SliverRPC_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "RegistryCreateKey",
 			Handler:    _SliverRPC_RegistryCreateKey_Handler,
 		},
-		{
-			MethodName: "RegistryListSubKeys",
-			Handler:    _SliverRPC_RegistryListSubKeys_Handler,
-		},
-		{
-			MethodName: "RegistryListValues",
-			Handler:    _SliverRPC_RegistryListValues_Handler,
-		},
 		{
 			MethodName: "RunSSHCommand",
 			Handler:    _SliverRPC_RunSSHCommand_Handler,
@@ -3660,10 +3556,6 @@ var SliverRPC_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "HijackDLL",
 			Handler:    _SliverRPC_HijackDLL_Handler,
 		},
-		{
-			MethodName: "GetPrivs",
-			Handler:    _SliverRPC_GetPrivs_Handler,
-		},
 		{
 			MethodName: "WGStartPortForward",
 			Handler:    _SliverRPC_WGStartPortForward_Handler,

protobuf/sliverpb/constants.go

@@ -242,15 +242,6 @@ const (
 
 	// MsgSSHCommandReq - Run a SSH command
 	MsgSSHCommandReq
-
-	// MsgGetPrivsReq - Get privileges (Windows)
-	MsgGetPrivsReq
-
-	// MsgRegistryListReq - List registry sub keys
-	MsgRegistrySubKeysListReq
-
-	// MsgRegistryListValuesReq - List registry values
-	MsgRegistryListValuesReq
 )
 
 // Constants to replace enums
@@ -473,13 +464,6 @@ func MsgNumber(request proto.Message) uint32 {
 		return MsgPollInterval
 	case *SSHCommandReq:
 		return MsgSSHCommandReq
-
-	case *GetPrivsReq:
-		return MsgGetPrivsReq
-	case *RegistrySubKeyListReq:
-		return MsgRegistrySubKeysListReq
-	case *RegistryListValuesReq:
-		return MsgRegistryListValuesReq
 	}
 
 	return uint32(0)

protobuf/sliverpb/sliver.proto

@@ -559,32 +559,6 @@ message RegistryCreateKey {
   commonpb.Response Response = 9;
 }
 
-message RegistrySubKeyListReq {
-  string Hive = 1;
-  string Path = 2;
-  // Keep the same ID as the other registry operations
-  string Hostname = 4;
-  commonpb.Request Request = 9;
-}
-
-message RegistrySubKeyList {
-  repeated string Subkeys = 1;
-  commonpb.Response Response = 9;
-}
-
-message RegistryListValuesReq {
-  string Hive = 1;
-  string Path = 2;
-  // Keep the same ID as the other registry operations
-  string Hostname = 4;
-  commonpb.Request Request = 9;
-}
-
-message RegistryValuesList {
-  repeated string ValueNames = 1;
-  commonpb.Response Response = 9;
-}
-
 // Tunnel - Tunnel related messages
 message Tunnel {
   uint64 TunnelID = 8 [jstype = JS_STRING];
@@ -808,24 +782,5 @@ message DllHijackReq {
 }
 
 message DllHijack {
-  commonpb.Response Response = 9;
-}
-
-message GetPrivsReq {
-  commonpb.Request Request = 9;
-}
-
-message WindowsPrivilegeEntry {
-  string Name = 1;
-  string Description = 2;
-  bool Enabled = 3;
-  bool EnabledByDefault = 4;
-  bool Removed = 5;
-  bool UsedForAccess = 6;
-}
-
-message GetPrivs {
-  repeated WindowsPrivilegeEntry PrivInfo = 1;
-
   commonpb.Response Response = 9;
 }

server/c2/udp-dns.go

@@ -16,58 +16,50 @@ package c2
 
 	You should have received a copy of the GNU General Public License
 	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+	------------------------------------------------------------------------
+
+	DNS command and control implementation
 
-	---
-	DNS Tunnel Implementation
 */
 
 import (
+	secureRand "crypto/rand"
 	"crypto/sha256"
 	"crypto/x509"
-	"math"
+	"errors"
+	"hash/crc32"
+	insecureRand "math/rand"
 	"net"
-	"sort"
 
+	"github.com/bishopfox/sliver/implant/sliver/encoders"
+	"github.com/bishopfox/sliver/protobuf/dnspb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/bishopfox/sliver/server/certs"
 	"github.com/bishopfox/sliver/server/db"
 	"github.com/bishopfox/sliver/server/generate"
+	"github.com/bishopfox/sliver/util/encoders"
+	"google.golang.org/protobuf/proto"
 
-	"encoding/base32"
 	"encoding/base64"
 	"encoding/binary"
 	"encoding/pem"
 
-	secureRand "crypto/rand"
-	"errors"
 	"fmt"
-	insecureRand "math/rand"
-	"strconv"
 	"strings"
 	"sync"
 	"time"
 
 	consts "github.com/bishopfox/sliver/client/constants"
-	"github.com/bishopfox/sliver/server/certs"
 	"github.com/bishopfox/sliver/server/core"
 	"github.com/bishopfox/sliver/server/cryptography"
-	serverHandlers "github.com/bishopfox/sliver/server/handlers"
 	"github.com/bishopfox/sliver/server/log"
 
 	"github.com/miekg/dns"
-	"google.golang.org/protobuf/proto"
 )
 
 const (
 	sessionIDSize = 12
 
-	domainKeyMsg  = "_domainkey"
-	blockReqMsg   = "b"
-	clearBlockMsg = "cb"
-
-	sessionInitMsg     = "si"
-	sessionPollingMsg  = "sp"
-	sessionEnvelopeMsg = "se"
-
 	// Max TXT record is 255, records are b64 so (n*8 + 5) / 6 = ~250
 	byteBlockSize = 185 // Can be as high as n = 187, but we'll leave some slop
 	blockIDSize   = 6
@@ -78,23 +70,59 @@ var (
 
 	dnsCharSet = []rune("abcdefghijklmnopqrstuvwxyz0123456789_")
 
-	sendBlocksMutex = &sync.RWMutex{}
-	sendBlocks      = &map[string]*SendBlock{}
-
 	dnsSessionsMutex = &sync.RWMutex{}
-	dnsSessions      = &map[string]*DNSSession{}
+	dnsSessions      = map[string]*DNSSession{}
 
-	blockReassemblerMutex = &sync.RWMutex{}
-	blockReassembler      = &map[string][][]byte{}
+	sendBlocksMutex = &sync.RWMutex{}
+	sendBlocks      = map[uint32]*Block{}
 
-	dnsSegmentReassemblerMutex = &sync.RWMutex{}
-	dnsSegmentReassembler      = &map[string](*map[int][]string){}
+	recvBlocksMutex = &sync.RWMutex{}
+	recvBlocks      = map[uint32]*Block{}
 )
 
-// SendBlock - Data is encoded and split into `Blocks`
-type SendBlock struct {
-	ID   string
-	Data []string
+// Block - A blob of data that we're sending or receiving, blocks of data
+// are split up into arrays of bytes (chunks) that are encoded per-query
+// the amount of data that can be encoded into a single request or response
+// varies depending on the type of query and the length of the parent domain.
+type Block struct {
+	ID      uint32
+	data    [][]byte
+	Size    int
+	Started time.Time
+	Mutex   sync.RWMutex
+}
+
+func (b *Block) AddData(index int, data []byte) (bool, error) {
+	b.Mutex.Lock()
+	defer b.Mutex.Unlock()
+	if len(b.data) < index+1 {
+		return false, errors.New("Data index out of bounds")
+	}
+	b.data[index] = data
+	sum := 0
+	for _, data := range b.data {
+		sum += len(data)
+	}
+	return sum == b.Size, nil
+}
+
+func (b *Block) GetData(index int) ([]byte, error) {
+	b.Mutex.Lock()
+	defer b.Mutex.Unlock()
+	if len(b.data) < index+1 {
+		return nil, errors.New("Data index out of bounds")
+	}
+	return b.data[index], nil
+}
+
+func (b *Block) Reassemble() []byte {
+	b.Mutex.RLock()
+	defer b.Mutex.RUnlock()
+	data := []byte{}
+	for _, block := range b.data {
+		data = append(data, block...)
+	}
+	return data
 }
 
 // DNSSession - Holds DNS session information
@@ -135,7 +163,10 @@ func StartDNSListener(bindIface string, lport uint16, domains []string, canaries
 	return server
 }
 
-// DNSRequest -> C2 or canary?
+// ---------------------------
+// DNS Handler
+// ---------------------------
+// Handles all DNS queries, first we determine if the query is C2 or a canary
 func handleDNSRequest(domains []string, canaries bool, writer dns.ResponseWriter, req *dns.Msg) {
 	if req == nil {
 		dnsLog.Info("req can not be nil")
@@ -158,7 +189,6 @@ func handleDNSRequest(domains []string, canaries bool, writer dns.ResponseWriter
 	}
 
 	if resp != nil {
-		// dnsLog.Debug(resp.String())
 		writer.WriteMsg(resp)
 	} else {
 		dnsLog.Infof("Invalid query, no DNS response")
@@ -177,7 +207,9 @@ func isC2SubDomain(domains []string, reqDomain string) (bool, string) {
 	return false, ""
 }
 
-// C2 -> Record type?
+// The query is C2, pass to the appropriate record handler this is done
+// so the record handler can encode the response based on the type of
+// record that was requested
 func handleC2(domain string, req *dns.Msg) *dns.Msg {
 	subdomain := req.Question[0].Name[:len(req.Question[0].Name)-len(domain)]
 	if strings.HasSuffix(subdomain, ".") {
@@ -187,24 +219,26 @@ func handleC2(domain string, req *dns.Msg) *dns.Msg {
 	switch req.Question[0].Qtype {
 	case dns.TypeTXT:
 		return handleTXT(domain, subdomain, req)
+	case dns.TypeA:
+		return handleA(domain, subdomain, req)
 	default:
 	}
 	return nil
 }
 
+// ---------------------------
+// Canary Record Handler
+// ---------------------------
 // Canary -> valid? -> trigger alert event
 func handleCanary(req *dns.Msg) *dns.Msg {
-
 	reqDomain := strings.ToLower(req.Question[0].Name)
 	if !strings.HasSuffix(reqDomain, ".") {
 		reqDomain += "." // Ensure we have the FQDN
 	}
-
 	canary, err := db.CanaryByDomain(reqDomain)
 	if err != nil {
 		return nil
 	}
-
 	resp := new(dns.Msg)
 	resp.SetReply(req)
 	if canary != nil {
@@ -239,179 +273,173 @@ func handleCanary(req *dns.Msg) *dns.Msg {
 	return resp
 }
 
-// handles the c2 TXT record interactions, kind hacky this probably needs to get refactored at some point
+func randomIP() net.IP {
+	randBuf := make([]byte, 4)
+	secureRand.Read(randBuf)
+
+	// Ensure non-zeros with various bitmasks
+	return net.IPv4(randBuf[0]|0x10, randBuf[1]|0x10, randBuf[2]|0x1, randBuf[3]|0x10)
+}
+
+// ---------------------------
+// C2 Record Handlers
+// ---------------------------
 func handleTXT(domain string, subdomain string, req *dns.Msg) *dns.Msg {
-
 	q := req.Question[0]
-	fields := strings.Split(subdomain, ".")
-
 	resp := new(dns.Msg)
 	resp.SetReply(req)
-	msgType := strings.ToLower(fields[len(fields)-1])
 
-	switch msgType {
-
-	case domainKeyMsg: // Send PubKey -  _(nonce).(slivername).domainkey.example.com
-		result, err := getDomainKeyFor(domain)
-		if err != nil {
-			dnsLog.Infof("Error during session init: %v", err)
-		}
-		txt := &dns.TXT{
-			Hdr: dns.RR_Header{Name: q.Name, Rrtype: dns.TypeTXT, Class: dns.ClassINET, Ttl: 0},
-			Txt: result,
-		}
-		resp.Answer = append(resp.Answer, txt)
-
-	case blockReqMsg: // Get block: _(nonce).(start).(stop).(block id).b.example.com
-		if len(fields) == 5 {
-			startIndex := fields[1]
-			stopIndex := fields[2]
-			blockID := fields[3]
-			txt := &dns.TXT{
-				Hdr: dns.RR_Header{Name: q.Name, Rrtype: dns.TypeTXT, Class: dns.ClassINET, Ttl: 0},
-				Txt: dnsSendBlocks(blockID, startIndex, stopIndex),
-			}
-			resp.Answer = append(resp.Answer, txt)
-		} else {
-			dnsLog.Infof("Block request has invalid number of fields %d expected %d", len(fields), 5)
-		}
-
-	case clearBlockMsg: // Clear block: _(nonce).(block id)._cb.example.com
-		if len(fields) == 3 {
-			result := 0
-			if clearSendBlock(fields[1]) {
-				result = 1
-			}
-			txt := &dns.TXT{
-				Hdr: dns.RR_Header{Name: q.Name, Rrtype: dns.TypeTXT, Class: dns.ClassINET, Ttl: 0},
-				Txt: []string{fmt.Sprintf("%d", result)},
-			}
-			resp.Answer = append(resp.Answer, txt)
-		}
-
-	case "_" + sessionInitMsg:
-		fallthrough
-	case sessionInitMsg: // Session init: (data)...(seq).(nonce).(_)si.example.com
-		result, err := startDNSSession(domain, fields)
-		if err != nil {
-			dnsLog.Infof("Error during session init: %v", err)
-		}
-		txt := &dns.TXT{
-			Hdr: dns.RR_Header{Name: q.Name, Rrtype: dns.TypeTXT, Class: dns.ClassINET, Ttl: 0},
-			Txt: result,
-		}
-		resp.Answer = append(resp.Answer, txt)
-
-	case "_" + sessionEnvelopeMsg:
-		fallthrough
-	case sessionEnvelopeMsg:
-		result, err := dnsSessionEnvelope(domain, fields)
-		if err != nil {
-			dnsLog.Infof("Error during session init: %v", err)
-		}
-		txt := &dns.TXT{
-			Hdr: dns.RR_Header{Name: q.Name, Rrtype: dns.TypeTXT, Class: dns.ClassINET, Ttl: 0},
-			Txt: result,
-		}
-		resp.Answer = append(resp.Answer, txt)
-
-	case sessionPollingMsg:
-		result, err := dnsSessionPoll(domain, fields)
-		if err != nil {
-			dnsLog.Infof("Error during session init: %v", err)
-		}
-		txt := &dns.TXT{
-			Hdr: dns.RR_Header{Name: q.Name, Rrtype: dns.TypeTXT, Class: dns.ClassINET, Ttl: 0},
-			Txt: result,
-		}
-		resp.Answer = append(resp.Answer, txt)
-
-	default:
-		dnsLog.Infof("Unknown msg type '%s' in TXT req", fields[len(fields)-1])
+	checksum, dnsMsg := parseC2Query(subdomain)
+	if dnsMsg == nil {
+		dnsLog.Errorf("Failed to parse TXT query")
+		return nil
 	}
 
+	// Execute action based on message type
+
+	txtRecords := []string{}
+
+	switch dnsMsg.Type {
+	case dnspb.DNSMessageType_DOMAIN_KEY:
+		blockID := handleDomainKeyQuery(domain, dnsMsg)
+		data, _ := proto.Marshal(&dnspb.DNSMessage{
+			N:    checksum,
+			Data: blockID,
+		})
+		record := string(new(encoders.Base64).Encode(data))
+		txtRecords = append(txtRecords, record)
+	}
+
+	txt := &dns.TXT{
+		Hdr: dns.RR_Header{Name: q.Name, Rrtype: dns.TypeTXT, Class: dns.ClassINET, Ttl: 0},
+		Txt: txtRecords,
+	}
+	resp.Answer = append(resp.Answer, txt)
 	return resp
 }
 
-// --------------------------- FIELDS ---------------------------
+func handleA(domain string, subdomain string, req *dns.Msg) *dns.Msg {
+	q := req.Question[0]
+	resp := new(dns.Msg)
+	resp.SetReply(req)
 
-func getFieldMsgType(fields []string) (string, error) {
-	if len(fields) < 1 {
-		return "", errors.New("Invalid number of fields in session init message (nonce)")
+	checksum, dnsMsg := parseC2Query(subdomain)
+	if dnsMsg == nil {
+		dnsLog.Errorf("Failed to parse A query")
+		return nil
 	}
-	return fields[len(fields)-1], nil
+
+	switch dnsMsg.Type {
+	case dnspb.DNSMessageType_NOP:
+		break
+	}
+
+	checksumBuf := make([]byte, 4)
+	binary.LittleEndian.PutUint32(checksumBuf, checksum)
+	resp.Answer = append(resp.Answer, &dns.A{
+		Hdr: dns.RR_Header{Name: q.Name, Rrtype: dns.TypeA, Class: dns.ClassINET, Ttl: 0},
+		A:   checksumBuf,
+	})
+	return resp
 }
 
-func getFieldSessionID(fields []string) (string, error) {
-	if len(fields) < 2 {
-		return "", errors.New("Invalid number of fields in session init message (session id)")
+// ---------------------------
+// C2 Handler
+// ---------------------------
+// This parses the C2 message and performs actions based on the request
+// the response is a CRC32 of the encoded data in the message
+func parseC2Query(subdomain string) (uint32, *dnspb.DNSMessage) {
+	subdomainData := strings.Join(strings.Split(subdomain, "."), "")
+	dnsLog.Debugf("Subdomain = %v, Data = %v", subdomain, subdomainData)
+	dnsMsg := decodeMessage(subdomainData)
+	if dnsMsg == nil {
+		return 0, nil
 	}
-	sessionID := fields[len(fields)-2]
-	if sessionID == "_" {
-		return "", errors.New("Session ID is null")
-	}
-	return sessionID, nil
+	checksum := crc32.Checksum(dnsMsg.Data, crc32.IEEETable)
+	return checksum, dnsMsg
 }
 
-func getFieldNonce(fields []string) (string, error) {
-	if len(fields) < 3 {
-		return "", errors.New("Invalid number of fields in session init message (nonce)")
+func decodeMessage(subdomainData string) *dnspb.DNSMessage {
+	encoders := detectEncoding(subdomainData)
+	query := &dnspb.DNSMessage{}
+	for _, encoder := range encoders {
+		dnsLog.Debugf("Attempting to decode subdomain data with %v", encoder)
+		data, err := encoder.Decode([]byte(subdomainData))
+		if err != nil {
+			dnsLog.Debugf("Decode attempt failed %s, continue ...", err)
+			continue
+		}
+		err = proto.Unmarshal(data, query)
+		if err != nil {
+			dnsLog.Debugf("Failed to parse pb %s, continue ...", err)
+			continue
+		}
+		return query
 	}
-	return fields[len(fields)-3], nil
+	return nil
 }
 
-func getFieldSeq(fields []string) (int, error) {
-	if len(fields) < 4 {
-		return -1, errors.New("Invalid number of fields in session init message (seq)")
+// This function attempts to detect the most likely encoder used by the implant
+// we return a list of encoders in order of most likely to least likely
+func detectEncoding(subdomainData string) []encoders.Encoder {
+
+	// Our version of base32 is missing chars: i, l, o, s
+	// if any of these appear the message must be base62
+	base62Chars := strings.ContainsAny(subdomainData, "silo") // "silo" simply appeases my spell checker
+	if base62Chars {
+		return []encoders.Encoder{new(encoders.Base62)}
 	}
-	rawSeq := fields[len(fields)-4]
-	data, err := dnsDecodeString(rawSeq)
+
+	// Okay now we detect if the message only contains lower case letters
+	// our base32 encoder only uses lower case but a resolver could have
+	// messed with the domain letter cases on the way over to us. So we
+	// say it's likely base62 if it contains a mix but fallback to base32
+	if strings.ContainsAny(subdomainData, "ABCDEFGHIJKLMNOPQRSTUVWXYZ") {
+		return []encoders.Encoder{new(encoders.Base62), new(encoders.Base32)}
+	} else {
+		return []encoders.Encoder{new(encoders.Base32), new(encoders.Base64)}
+	}
+}
+
+// --------------------------- DNS HANDLERS ---------------------------
+func encodeSendBlock(domain string, data []byte) *Block {
+	encodedData := new(encoders.Base64).Encode(data)
+	blockData := [][]byte{}
+	for index := 0; index < len(encodedData); {
+		end := index + 254
+		if len(encodedData) < end {
+			end = len(encodedData)
+		}
+		blockData = append(blockData, encodedData[index:end])
+		index += 254
+	}
+	return &Block{
+		ID:      blockID(),
+		Size:    len(data),
+		data:    blockData,
+		Started: time.Now(),
+		Mutex:   sync.RWMutex{},
+	}
+}
+
+func handleDomainKeyQuery(domain string, query *dnspb.DNSMessage) []byte {
+	domainKey, err := getDomainKeyFor(domain)
 	if err != nil {
-		dnsLog.Infof("Failed to decode seq field: %#v", rawSeq)
-		return 0, err
+		dnsLog.Errorf("Failed to find domain key for '%s' %s", domain, err)
+		return nil
 	}
-	index := int(binary.LittleEndian.Uint32(data))
-
-	return index, nil
+	block := encodeSendBlock(domain, domainKey)
+	sendBlocksMutex.Lock()
+	defer sendBlocksMutex.Unlock()
+	sendBlocks[block.ID] = block
+	return []byte{}
 }
 
-func getFieldSubdata(fields []string) ([]string, error) {
-	if len(fields) < 5 {
-		return []string{}, errors.New("Invalid number of fields in session init message (subdata)")
-	}
-	subdataFields := len(fields) - 4
-	dnsLog.Infof("Domain contains %d subdata fields", subdataFields)
-	return fields[:subdataFields], nil
-}
-
-// --------------------------- DNS SESSION START ---------------------------
-
 // Returns an confirmation value (e.g. exit code 0 non-0) and error
-func startDNSSession(domain string, fields []string) ([]string, error) {
-	dnsLog.Infof("[start session] fields = %#v", fields)
+func startDNSSession(msgID uint32, domain string) ([]string, error) {
 
-	msgType, err := getFieldMsgType(fields)
-	if err != nil {
-		return []string{"1"}, err
-	}
-
-	nonce, err := getFieldNonce(fields)
-	if err != nil {
-		return []string{"1"}, err
-	}
-
-	if !strings.HasPrefix(msgType, "_") {
-		return dnsSegment(fields)
-	}
 	dnsLog.Infof("Complete session init message received, reassembling ...")
 
-	// TODO: We don't have replay protection against the RSA-encrypt
-	// sessionInit messages, but I don't think it's an issue ...
-	encryptedSessionInit, err := dnsSegmentReassemble(nonce)
-	if err != nil {
-		return []string{"1"}, err
-	}
-
 	publicKeyPEM, privateKeyPEM, err := certs.GetCertificate(certs.C2ServerCA, certs.RSAKey, domain)
 	if err != nil {
 		dnsLog.Infof("Failed to fetch RSA private key")
@@ -452,7 +480,7 @@ func startDNSSession(domain string, fields []string) ([]string, error) {
 	sessionID := dnsSessionID()
 	dnsLog.Infof("Starting new DNS session with id = %s", sessionID)
 	dnsSessionsMutex.Lock()
-	(*dnsSessions)[sessionID] = &DNSSession{
+	dnsSessions[sessionID] = &DNSSession{
 		ID:      sessionID,
 		Session: session,
 		Key:     aesKey,
@@ -461,359 +489,16 @@ func startDNSSession(domain string, fields []string) ([]string, error) {
 	dnsSessionsMutex.Unlock()
 
 	encryptedSessionID, _ := cryptography.GCMEncrypt(aesKey, []byte(sessionID))
-	result, err := dnsSendOnce(encryptedSessionID)
-	if err != nil {
-		dnsLog.Infof("Failed to encode message into single result %v", err)
-		return []string{"1"}, err
-	}
 
 	return result, nil
 }
 
-// --------------------------- DNS SESSION RECV ---------------------------
-
-func dnsSessionEnvelope(domain string, fields []string) ([]string, error) {
-	dnsLog.Infof("[session envelope] fields = %#v", fields)
-
-	msgType, err := getFieldMsgType(fields)
-	if err != nil {
-		return []string{"1"}, err
-	}
-
-	nonce, err := getFieldNonce(fields)
-	if err != nil {
-		return []string{"1"}, err
-	}
-
-	if !strings.HasPrefix(msgType, "_") {
-		return dnsSegment(fields)
-	}
-	dnsLog.Infof("Complete envelope received, reassembling ...")
-	encryptedDNSEnvelope, err := dnsSegmentReassemble(nonce)
-	if err != nil {
-		return []string{"1"}, errors.New("Failed to reassemble segments")
-	}
-
-	sessionID, err := getFieldSessionID(fields)
-	if err != nil {
-		return []string{"1"}, err
-	}
-	dnsSessionsMutex.Lock()
-	defer dnsSessionsMutex.Unlock()
-
-	if dnsSession, ok := (*dnsSessions)[sessionID]; ok {
-		dnsLog.Infof("Envelope has valid DNS session (%s)", dnsSession.ID)
-		if dnsSession.isReplayAttack(encryptedDNSEnvelope) {
-			dnsLog.Infof("WARNING: Replay attack detected, ignore request")
-			return []string{"1"}, errors.New("Replay attack")
-		}
-		envelopeData, err := cryptography.GCMDecrypt(dnsSession.Key, encryptedDNSEnvelope)
-		if err != nil {
-			return []string{"1"}, errors.New("Failed to decrypt DNS envelope")
-		}
-		envelope := &sliverpb.Envelope{}
-		proto.Unmarshal(envelopeData, envelope)
-
-		dnsLog.Infof("Envelope Type = %#v RespID = %#v", envelope.Type, envelope.ID)
-
-		dnsSession.Session.UpdateCheckin()
-
-		// Response Envelope or Handler
-		handlers := serverHandlers.GetSessionHandlers()
-		if envelope.ID != 0 {
-			dnsSession.Session.RespMutex.Lock()
-			defer dnsSession.Session.RespMutex.Unlock()
-			if resp, ok := dnsSession.Session.Resp[envelope.ID]; ok {
-				resp <- envelope
-			}
-		} else if handler, ok := handlers[envelope.Type]; ok {
-			handler.(func(*core.Session, []byte))(dnsSession.Session, envelope.Data)
-		}
-		return []string{"0"}, nil
-	}
-	dnsLog.Infof("Invalid session id '%#v'", sessionID)
-	return []string{"1"}, errors.New("Invalid session ID")
-}
-
-// Client should have sent all of the data, attempt to reassemble segments
-func dnsSegmentReassemble(nonce string) ([]byte, error) {
-	dnsSegmentReassemblerMutex.Lock()
-	defer dnsSegmentReassemblerMutex.Unlock()
-	if reasm, ok := (*dnsSegmentReassembler)[nonce]; ok {
-		var keys []int
-		for k := range *reasm {
-			keys = append(keys, k)
-		}
-		sort.Ints(keys)
-		orderedSubdata := []string{}
-		for _, k := range keys {
-			orderedSubdata = append(orderedSubdata, (*reasm)[k]...)
-		}
-		data, err := dnsDecodeString(strings.Join(orderedSubdata, ""))
-		if err != nil {
-			dnsLog.Infof("Failed to decode session init: %v", err)
-			return nil, err
-		}
-		//BUG - in the event that the session init msg does not make it to the client, this will fail. This has been
-		//observed consistently (Namely due to the race condition bug that is also being fixed in dnsSessionPoll).
-		//Currently a memory leak. Consider tracking moving the cleanup code to after polling has
-		//begun to ensure the initial handshake was successful.
-		//
-		//delete((*dnsSegmentReassembler), nonce)
-		return data, nil
-	}
-	return nil, fmt.Errorf("Invalid nonce '%#v' (session init reassembler)", nonce)
-}
-
-// The domain is only a segment of the startDNSSession message, so we just store the data
-func dnsSegment(fields []string) ([]string, error) {
-	dnsSegmentReassemblerMutex.Lock()
-	defer dnsSegmentReassemblerMutex.Unlock()
-
-	nonce, _ := getFieldNonce(fields)
-	index, err := getFieldSeq(fields)
-	if err != nil {
-		return []string{"1"}, err
-	}
-	subdata, err := getFieldSubdata(fields)
-	if err != nil {
-		return []string{"1"}, err
-	}
-	if _, ok := (*dnsSegmentReassembler)[nonce]; !ok {
-		(*dnsSegmentReassembler)[nonce] = &map[int][]string{}
-	}
-	if reasm, ok := (*dnsSegmentReassembler)[nonce]; ok {
-		(*reasm)[index] = subdata
-		return []string{"0"}, nil
-	}
-	dnsLog.Infof("Invalid nonce (session segment): %#v", nonce)
-	return []string{"1"}, errors.New("Invalid nonce (session segment)")
-}
-
-// TODO: Avoid double-fetch
-func getDomainKeyFor(domain string) ([]string, error) {
-	_, _, err := certs.GetCertificate(certs.C2ServerCA, certs.RSAKey, domain)
-	if err != nil {
-		certs.C2ServerGenerateRSACertificate(domain)
-	}
-	certPEM, _, err := certs.GetCertificate(certs.C2ServerCA, certs.RSAKey, domain)
-	if err != nil {
-		return nil, err
-	}
-	return dnsSendOnce(certPEM)
-}
-
-// --------------------------- DNS SESSION SEND ---------------------------
-
-// Send all response data in a single TXT record, limited to 65535 bytes
-func dnsSendOnce(rawData []byte) ([]string, error) {
-	if 65535 <= base64.RawStdEncoding.EncodedLen(len(rawData)) {
-		return nil, errors.New("Response too large to encode into one TXT record")
-	}
-	data := base64.RawStdEncoding.EncodeToString(rawData)
-	dnsLog.Infof("Encoding single resp: %#v", data)
-	txts := []string{}
-	size := int(math.Ceil(float64(len(data)) / 255.0))
-	for index := 0; index < size; index++ {
-		start := index * 255
-		stop := start + 255
-		if len(data) < stop {
-			stop = len(data)
-		}
-		txts = append(txts, data[start:stop])
-	}
-	return txts, nil
-}
-
-func dnsSessionPoll(domain string, fields []string) ([]string, error) {
-
-	sessionID, err := getFieldSessionID(fields)
-	if err != nil {
-		return []string{"1"}, errors.New("invalid session id (session poll)")
-	}
-	dnsSessionsMutex.Lock()
-	dnsSession, found := (*dnsSessions)[sessionID]
-	if !found {
-		dnsSessionsMutex.Unlock()
-		b64SessionId := base64.RawStdEncoding.EncodeToString([]byte(sessionID))
-		return []string{b64SessionId}, errors.New("invalid session (nil pointer)")
-	}
-	dnsSessionsMutex.Unlock()
-
-	isDrained := false
-	envelopes := []*sliverpb.Envelope{}
-	for !isDrained {
-		select {
-		case envelope := <-dnsSession.Session.Send:
-			dnsLog.Infof("New message from send channel ...")
-			envelopes = append(envelopes, envelope)
-		default:
-			isDrained = true
-		}
-	}
-
-	dnsSession.Session.UpdateCheckin()
-
-	if 0 < len(envelopes) {
-		dnsLog.Infof("%d new message(s) for session id %#v", len(envelopes), sessionID)
-		dnsPoll := &sliverpb.DNSPoll{}
-		for _, envelope := range envelopes {
-			data, err := proto.Marshal(envelope)
-			if err != nil {
-				dnsLog.Infof("Failed to encode envelope %v", err)
-				continue
-			}
-
-			encryptedEnvelopeData, err := cryptography.GCMEncrypt(dnsSession.Key, data)
-			if err != nil {
-				dnsLog.Infof("Failed to encrypt poll data %v", err)
-				return []string{"1"}, errors.New("Failed to encrypt dns poll data")
-			}
-
-			blockID, size := storeSendBlocks(encryptedEnvelopeData)
-			dnsPoll.Blocks = append(dnsPoll.Blocks, &sliverpb.DNSBlockHeader{
-				ID:   blockID,
-				Size: uint32(size),
-			})
-		}
-		pollData, err := proto.Marshal(dnsPoll)
-		if err != nil {
-			dnsLog.Infof("Failed to encode envelope %v", err)
-			return []string{"1"}, errors.New("Failed to encode dns poll data")
-		}
-		encryptedPollData, err := cryptography.GCMEncrypt(dnsSession.Key, pollData)
-		if err != nil {
-			dnsLog.Infof("Failed to encrypt poll data %v", err)
-			return []string{"1"}, errors.New("Failed to encrypt dns poll data")
-		}
-		return dnsSendOnce(encryptedPollData)
-	}
-	dnsLog.Infof("No new message for session id %#v", sessionID)
-	return []string{"0"}, nil
-}
-
-// Send blocks of data via multiple DNS TXT responses
-func dnsSendBlocks(blockID string, startIndex string, stopIndex string) []string {
-	start, err := strconv.Atoi(startIndex)
-	if err != nil {
-		return []string{}
-	}
-	stop, err := strconv.Atoi(stopIndex)
-	if err != nil {
-		return []string{}
-	}
-
-	if stop < start {
-		return []string{}
-	}
-
-	dnsLog.Infof("Send blocks %d to %d for ID %s", start, stop, blockID)
-
-	sendBlocksMutex.Lock()
-	defer sendBlocksMutex.Unlock()
-	respBlocks := []string{}
-	if block, ok := (*sendBlocks)[blockID]; ok {
-		for index := start; index < stop; index++ {
-			if index < len(block.Data) {
-				respBlocks = append(respBlocks, block.Data[index])
-			}
-		}
-		dnsLog.Infof("Sending %d response block(s)", len(respBlocks))
-		return respBlocks
-	}
-	dnsLog.Infof("Invalid block ID: %#v", blockID)
-	return []string{}
-}
-
-// Clear send blocks of data from memory
-func clearSendBlock(blockID string) bool {
-	sendBlocksMutex.Lock()
-	defer sendBlocksMutex.Unlock()
-	if _, ok := (*sendBlocks)[blockID]; ok {
-		delete(*sendBlocks, blockID)
-		return true
-	}
-	return false
-}
-
-// Stores encoded blocks fo data into "sendBlocks"
-func storeSendBlocks(data []byte) (string, int) {
-	blockID := generateBlockID()
-
-	sendBlock := &SendBlock{
-		ID:   blockID,
-		Data: []string{},
-	}
-	for index := 0; index < len(data); index += byteBlockSize {
-		start := index
-		stop := index + byteBlockSize
-		if len(data) < stop {
-			stop = len(data)
-		}
-		encoded := base64.RawStdEncoding.EncodeToString(data[start:stop])
-		dnsLog.Infof("Encoded block is %d bytes", len(encoded))
-		sendBlock.Data = append(sendBlock.Data, encoded)
-	}
-	sendBlocksMutex.Lock()
-	(*sendBlocks)[sendBlock.ID] = sendBlock
-	sendBlocksMutex.Unlock()
-	return sendBlock.ID, len(sendBlock.Data)
-}
-
-// --------------------------- HELPERS ---------------------------
-
-// Unique IDs, no need for secure random
-func generateBlockID() string {
-	insecureRand.Seed(time.Now().UnixNano())
-	blockID := []rune{}
-	for i := 0; i < blockIDSize; i++ {
-		index := insecureRand.Intn(len(dnsCharSet))
-		blockID = append(blockID, dnsCharSet[index])
-	}
-	return string(blockID)
-}
-
 func fingerprintSHA256(block *pem.Block) string {
 	hash := sha256.Sum256(block.Bytes)
 	b64hash := base64.RawStdEncoding.EncodeToString(hash[:])
 	return strings.TrimRight(b64hash, "=")
 }
 
-// TODO: Add a geofilter to make it look like we're in various regions of the world.
-// We don't really need to use srand but it's just easier to operate on bytes here.
-func randomIP() net.IP {
-	randBuf := make([]byte, 4)
-	secureRand.Read(randBuf)
-
-	// Ensure non-zeros with various bitmasks
-	return net.IPv4(randBuf[0]|0x10, randBuf[1]|0x10, randBuf[2]|0x1, randBuf[3]|0x10)
-}
-
-// --------------------------- ENCODER ---------------------------
-
-var base32Alphabet = "ab1c2d3e4f5g6h7j8k9m0npqrtuvwxyz"
-var sliverBase32 = base32.NewEncoding(base32Alphabet)
-
-// EncodeToString encodes the given byte slice in base32
-func dnsEncodeToString(input []byte) string {
-	return strings.TrimRight(sliverBase32.EncodeToString(input), "=")
-}
-
-// DecodeString decodes the given base32 encoded bytes
-func dnsDecodeString(raw string) ([]byte, error) {
-	pad := 8 - (len(raw) % 8)
-	padded := []byte(raw)
-	if pad != 8 {
-		padded = make([]byte, len(raw)+pad)
-		copy(padded, raw)
-		for index := 0; index < pad; index++ {
-			padded[len(raw)+index] = '='
-		}
-	}
-	// dnsLog.Infof("[base32] %#v", string(padded))
-	return sliverBase32.DecodeString(string(padded))
-}
-
 // SessionIDs are public parameters in this use case
 // so it's only important that they're unique
 func dnsSessionID() string {
@@ -823,5 +508,23 @@ func dnsSessionID() string {
 		index := insecureRand.Intn(len(dnsCharSet))
 		sessionID = append(sessionID, dnsCharSet[index])
 	}
-	return "_" + string(sessionID)
+	return string(sessionID)
+}
+
+func blockID() uint32 {
+	randBuf := make([]byte, 4)
+	secureRand.Read(randBuf)
+	return binary.LittleEndian.Uint32(randBuf)
+}
+
+func getDomainKeyFor(domain string) ([]byte, error) {
+	_, _, err := certs.GetCertificate(certs.C2ServerCA, certs.RSAKey, domain)
+	if err != nil {
+		certs.C2ServerGenerateRSACertificate(domain)
+	}
+	certPEM, _, err := certs.GetCertificate(certs.C2ServerCA, certs.RSAKey, domain)
+	if err != nil {
+		return nil, err
+	}
+	return certPEM, nil
 }

server/generate/srcfiles.go

@@ -27,6 +27,8 @@ var (
 	srcFiles = []string{
 		"constants/constants.go",
 
+		"encoders/base32.go",
+		"encoders/base62.go",
 		"encoders/base64.go",
 		"encoders/combos.go",
 		"encoders/encoders.go",
@@ -165,6 +167,8 @@ var (
 	genericSrcFiles = []string{
 		"constants/constants.go",
 
+		"encoders/base32.go",
+		"encoders/base62.go",
 		"encoders/base64.go",
 		"encoders/combos.go",
 		"encoders/encoders.go",

server/rpc/rpc-priv.go

@@ -118,13 +118,3 @@ func (rpc *Server) MakeToken(ctx context.Context, req *sliverpb.MakeTokenReq) (*
 	}
 	return resp, nil
 }
-
-// GetPrivs - gRPC interface to get privilege information from the current process
-func (rpc *Server) GetPrivs(ctx context.Context, req *sliverpb.GetPrivsReq) (*sliverpb.GetPrivs, error) {
-	resp := &sliverpb.GetPrivs{}
-	err := rpc.GenericHandler(req, resp)
-	if err != nil {
-		return nil, err
-	}
-	return resp, nil
-}

server/rpc/rpc-registry.go

@@ -35,23 +35,3 @@ func (rpc *Server) RegistryCreateKey(ctx context.Context, req *sliverpb.Registry
 	}
 	return resp, nil
 }
-
-// RegistryListSubKeys - gRPC interface to list the sub keys of a registry key
-func (rpc *Server) RegistryListSubKeys(ctx context.Context, req *sliverpb.RegistrySubKeyListReq) (*sliverpb.RegistrySubKeyList, error) {
-	resp := &sliverpb.RegistrySubKeyList{}
-	err := rpc.GenericHandler(req, resp)
-	if err != nil {
-		return nil, err
-	}
-	return resp, nil
-}
-
-// RegistryListSubKeys - gRPC interface to list the sub keys of a registry key
-func (rpc *Server) RegistryListValues(ctx context.Context, req *sliverpb.RegistryListValuesReq) (*sliverpb.RegistryValuesList, error) {
-	resp := &sliverpb.RegistryValuesList{}
-	err := rpc.GenericHandler(req, resp)
-	if err != nil {
-		return nil, err
-	}
-	return resp, nil
-}

util/encoders/base32.go

@@ -0,0 +1,44 @@
+package encoders
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2019  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"encoding/base32"
+)
+
+// Base32EncoderID - EncoderID
+const Base32EncoderID = 65
+
+// Base32 Encoder
+type Base32 struct{}
+
+// Missing chars: i, l, o, s
+const base32Alphabet = "ab1c2d3e4f5g6h7j8k9m0npqrtuvwxyz"
+
+var sliverBase32 = base32.NewEncoding(base32Alphabet)
+
+// Encode - Base32 Encode
+func (e Base32) Encode(data []byte) []byte {
+	return []byte(sliverBase32.EncodeToString(data))
+}
+
+// Decode - Base32 Decode
+func (e Base32) Decode(data []byte) ([]byte, error) {
+	return sliverBase32.DecodeString(string(data))
+}

util/encoders/base32_test.go

@@ -0,0 +1,80 @@
+package encoders
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2019  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"bytes"
+	"testing"
+
+	implantEncoders "github.com/bishopfox/sliver/implant/sliver/encoders"
+)
+
+func TestBase32(t *testing.T) {
+	sample := randomData()
+
+	b32 := new(Base32)
+	output := b32.Encode(sample)
+	data, err := b32.Decode(output)
+	if err != nil {
+		t.Errorf("b32 decode returned an error %v", err)
+	}
+	if !bytes.Equal(sample, data) {
+		t.Logf("sample = %#v", sample)
+		t.Logf("output = %#v", output)
+		t.Logf("  data = %#v", data)
+		t.Errorf("sample does not match returned\n%#v != %#v", sample, data)
+	}
+
+	implantBase32 := new(implantEncoders.Base32)
+	output2 := implantBase32.Encode(sample)
+	data2, err := implantBase32.Decode(output2)
+	if err != nil {
+		t.Errorf("implant b32 decode returned an error %v", err)
+	}
+	if !bytes.Equal(sample, data2) {
+		t.Logf("sample  = %#v", sample)
+		t.Logf("output2 = %#v", output2)
+		t.Logf("  data2 = %#v", data2)
+		t.Errorf("sample does not match returned\n%#v != %#v", sample, data)
+	}
+
+	output = b32.Encode(sample)
+	data, err = implantBase32.Decode(output)
+	if err != nil {
+		t.Errorf("b32 decode returned an error %v", err)
+	}
+	if !bytes.Equal(sample, data) {
+		t.Logf("sample = %#v", sample)
+		t.Logf("output = %#v", output)
+		t.Logf("  data = %#v", data)
+		t.Errorf("sample does not match returned\n%#v != %#v", sample, data)
+	}
+
+	output = implantBase32.Encode(sample)
+	data, err = b32.Decode(output)
+	if err != nil {
+		t.Errorf("b32 decode returned an error %v", err)
+	}
+	if !bytes.Equal(sample, data) {
+		t.Logf("sample = %#v", sample)
+		t.Logf("output = %#v", output)
+		t.Logf("  data = %#v", data)
+		t.Errorf("sample does not match returned\n%#v != %#v", sample, data)
+	}
+}

util/encoders/base62.go

@@ -0,0 +1,210 @@
+package encoders
+
+/*
+	MIT License
+
+	Copyright (c) 2019 Shawn Wang <jxskiss@126.com>
+
+	Permission is hereby granted, free of charge, to any person obtaining a copy
+	of this software and associated documentation files (the "Software"), to deal
+	in the Software without restriction, including without limitation the rights
+	to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+	copies of the Software, and to permit persons to whom the Software is
+	furnished to do so, subject to the following conditions:
+
+	The above copyright notice and this permission notice shall be included in all
+	copies or substantial portions of the Software.
+
+	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+	IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+	AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+	LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+	OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+	SOFTWARE.
+	-------------------------------------------------------------------------------
+
+	Modifications by moloch to work with Sliver
+
+*/
+
+import (
+	"math/bits"
+	"strconv"
+)
+
+const (
+	base        = 62
+	compactMask = 0x1E // 00011110
+	mask5bits   = 0x1F // 00011111
+)
+
+// Base62EncoderID - EncoderID
+const Base62EncoderID = 43
+
+// Base62 Encoder
+type Base62 struct{}
+
+const base62Alphabet = "aBCDEFGHIJKLMNOPQRSTUVWXYZAbcdefghijklmnopqrstuvwxyz0123456789"
+
+// Encode - Base62 Encode
+func (e Base62) Encode(data []byte) []byte {
+	return []byte(NewEncoding(base62Alphabet).EncodeToString(data))
+}
+
+// Decode - Base62 Decode
+func (e Base62) Decode(data []byte) ([]byte, error) {
+	return NewEncoding(base62Alphabet).DecodeString(string(data))
+}
+
+type Base62Encoder struct {
+	encode    [base]byte
+	decodeMap [256]byte
+}
+
+func NewEncoding(encoder string) *Base62Encoder {
+	if len(encoder) != base {
+		panic("encoding alphabet is not 62-bytes long")
+	}
+	for i := 0; i < len(encoder); i++ {
+		if encoder[i] == '\n' || encoder[i] == '\r' {
+			panic("encoding alphabet contains newline character")
+		}
+	}
+
+	e := new(Base62Encoder)
+	copy(e.encode[:], encoder)
+	for i := 0; i < len(e.decodeMap); i++ {
+		e.decodeMap[i] = 0xFF
+	}
+	for i := 0; i < len(encoder); i++ {
+		e.decodeMap[encoder[i]] = byte(i)
+	}
+	return e
+}
+
+func (enc *Base62Encoder) Encode(src []byte) []byte {
+	if len(src) == 0 {
+		return []byte{}
+	}
+	encoder := newEncoder(src)
+	return encoder.encode(enc.encode[:])
+}
+
+func (enc *Base62Encoder) EncodeToString(src []byte) string {
+	ret := enc.Encode(src)
+	return string(ret)
+}
+
+type encoder struct {
+	b   []byte
+	pos int
+}
+
+func newEncoder(src []byte) *encoder {
+	return &encoder{
+		b:   src,
+		pos: len(src) * 8,
+	}
+}
+
+func (enc *encoder) next() (byte, bool) {
+	var i, pos int
+	var j, blen byte
+	pos = enc.pos - 6
+	if pos <= 0 {
+		pos = 0
+		blen = byte(enc.pos)
+	} else {
+		i = pos / 8
+		j = byte(pos % 8)
+		blen = byte((i+1)*8 - pos)
+		if blen > 6 {
+			blen = 6
+		}
+	}
+	shift := 8 - j - blen
+	b := enc.b[i] >> shift & (1<<blen - 1)
+
+	if blen < 6 && pos > 0 {
+		blen1 := 6 - blen
+		b = b<<blen1 | enc.b[i+1]>>(8-blen1)
+	}
+	if b&compactMask == compactMask {
+		if pos > 0 || b > mask5bits {
+			pos++
+		}
+		b &= mask5bits
+	}
+	enc.pos = pos
+
+	return b, pos > 0
+}
+
+func (enc *encoder) encode(encTable []byte) []byte {
+	ret := make([]byte, 0, len(enc.b)*8/5+1)
+	x, hasMore := enc.next()
+	for {
+		ret = append(ret, encTable[x])
+		if !hasMore {
+			break
+		}
+		x, hasMore = enc.next()
+	}
+	return ret
+}
+
+type CorruptInputError int64
+
+func (e CorruptInputError) Error() string {
+	return "illegal base62 data at input byte " + strconv.FormatInt(int64(e), 10)
+}
+
+func (enc *Base62Encoder) Decode(src []byte) ([]byte, error) {
+	if len(src) == 0 {
+		return []byte{}, nil
+	}
+	dec := decoder(src)
+	return dec.decode(enc.decodeMap[:])
+}
+
+func (enc *Base62Encoder) DecodeString(src string) ([]byte, error) {
+	return enc.Decode([]byte(src))
+}
+
+type decoder []byte
+
+func (dec decoder) decode(decTable []byte) ([]byte, error) {
+	ret := make([]byte, len(dec)*6/8+1)
+	idx := len(ret)
+	pos := byte(0)
+	b := 0
+	for i, c := range dec {
+		x := decTable[c]
+		if x == 0xFF {
+			return nil, CorruptInputError(i)
+		}
+		if i == len(dec)-1 {
+			b |= int(x) << pos
+			pos += byte(bits.Len8(x))
+		} else if x&compactMask == compactMask {
+			b |= int(x) << pos
+			pos += 5
+		} else {
+			b |= int(x) << pos
+			pos += 6
+		}
+		if pos >= 8 {
+			idx--
+			ret[idx] = byte(b)
+			pos %= 8
+			b >>= 8
+		}
+	}
+	if pos > 0 {
+		idx--
+		ret[idx] = byte(b)
+	}
+
+	return ret[idx:], nil
+}

util/encoders/base62_test.go

@@ -0,0 +1,80 @@
+package encoders
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2019  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"bytes"
+	"testing"
+
+	implantEncoders "github.com/bishopfox/sliver/implant/sliver/encoders"
+)
+
+func TestBase62(t *testing.T) {
+	sample := randomData()
+
+	b62 := new(Base62)
+	output := b62.Encode(sample)
+	data, err := b62.Decode(output)
+	if err != nil {
+		t.Errorf("b62 decode returned an error %v", err)
+	}
+	if !bytes.Equal(sample, data) {
+		t.Logf("sample = %#v", sample)
+		t.Logf("output = %#v", output)
+		t.Logf("  data = %#v", data)
+		t.Errorf("sample does not match returned\n%#v != %#v", sample, data)
+	}
+
+	implantBase62 := new(implantEncoders.Base62)
+	output2 := implantBase62.Encode(sample)
+	data2, err := implantBase62.Decode(output2)
+	if err != nil {
+		t.Errorf("implant b62 decode returned an error %v", err)
+	}
+	if !bytes.Equal(sample, data2) {
+		t.Logf("sample  = %#v", sample)
+		t.Logf("output2 = %#v", output2)
+		t.Logf("  data2 = %#v", data2)
+		t.Errorf("sample does not match returned\n%#v != %#v", sample, data)
+	}
+
+	output = b62.Encode(sample)
+	data, err = implantBase62.Decode(output)
+	if err != nil {
+		t.Errorf("b62 decode returned an error %v", err)
+	}
+	if !bytes.Equal(sample, data) {
+		t.Logf("sample = %#v", sample)
+		t.Logf("output = %#v", output)
+		t.Logf("  data = %#v", data)
+		t.Errorf("sample does not match returned\n%#v != %#v", sample, data)
+	}
+
+	output = implantBase62.Encode(sample)
+	data, err = b62.Decode(output)
+	if err != nil {
+		t.Errorf("b62 decode returned an error %v", err)
+	}
+	if !bytes.Equal(sample, data) {
+		t.Logf("sample = %#v", sample)
+		t.Logf("output = %#v", output)
+		t.Logf("  data = %#v", data)
+		t.Errorf("sample does not match returned\n%#v != %#v", sample, data)
+	}
+}

util/encoders/base64.go

@@ -1,7 +1,5 @@
 package encoders
 
-import "encoding/base64"
-
 /*
 	Sliver Implant Framework
 	Copyright (C) 2019  Bishop Fox
@@ -20,6 +18,8 @@ import "encoding/base64"
 	along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 
+import "encoding/base64"
+
 // Base64EncoderID - EncoderID
 const Base64EncoderID = 13
 

util/encoders/base64_test.go

@@ -1,12 +1,5 @@
 package encoders
 
-import (
-	"bytes"
-	"testing"
-
-	implantEncoders "github.com/bishopfox/sliver/implant/sliver/encoders"
-)
-
 /*
 	Sliver Implant Framework
 	Copyright (C) 2019  Bishop Fox
@@ -25,6 +18,13 @@ import (
 	along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 
+import (
+	"bytes"
+	"testing"
+
+	implantEncoders "github.com/bishopfox/sliver/implant/sliver/encoders"
+)
+
 func TestBase64(t *testing.T) {
 	sample := randomData()
 

util/encoders/combos_test.go

@@ -1,12 +1,5 @@
 package encoders
 
-import (
-	"bytes"
-	"testing"
-
-	implantEncoders "github.com/bishopfox/sliver/implant/sliver/encoders"
-)
-
 /*
 	Sliver Implant Framework
 	Copyright (C) 2019  Bishop Fox
@@ -25,6 +18,13 @@ import (
 	along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 
+import (
+	"bytes"
+	"testing"
+
+	implantEncoders "github.com/bishopfox/sliver/implant/sliver/encoders"
+)
+
 func TestGzipEnglish(t *testing.T) {
 	sample := randomData()
 

util/encoders/english_test.go

@@ -1,12 +1,5 @@
 package encoders
 
-import (
-	"bytes"
-	"testing"
-
-	implantEncoders "github.com/bishopfox/sliver/implant/sliver/encoders"
-)
-
 /*
 	Sliver Implant Framework
 	Copyright (C) 2019  Bishop Fox
@@ -25,6 +18,13 @@ import (
 	along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 
+import (
+	"bytes"
+	"testing"
+
+	implantEncoders "github.com/bishopfox/sliver/implant/sliver/encoders"
+)
+
 func TestEnglish(t *testing.T) {
 	sample := randomData()
 

util/encoders/gzip_test.go

@@ -1,12 +1,5 @@
 package encoders
 
-import (
-	"bytes"
-	"testing"
-
-	implantEncoders "github.com/bishopfox/sliver/implant/sliver/encoders"
-)
-
 /*
 	Sliver Implant Framework
 	Copyright (C) 2019  Bishop Fox
@@ -25,6 +18,13 @@ import (
 	along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 
+import (
+	"bytes"
+	"testing"
+
+	implantEncoders "github.com/bishopfox/sliver/implant/sliver/encoders"
+)
+
 func TestGzip(t *testing.T) {
 	sample := randomData()
 

util/encoders/hex_test.go

@@ -1,12 +1,5 @@
 package encoders
 
-import (
-	"bytes"
-	"testing"
-
-	implantEncoders "github.com/bishopfox/sliver/implant/sliver/encoders"
-)
-
 /*
 	Sliver Implant Framework
 	Copyright (C) 2019  Bishop Fox
@@ -25,6 +18,13 @@ import (
 	along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 
+import (
+	"bytes"
+	"testing"
+
+	implantEncoders "github.com/bishopfox/sliver/implant/sliver/encoders"
+)
+
 func TestHex(t *testing.T) {
 	sample := randomData()