Fix low entropy x509 subjects

Add trend micro processes

client/command/processes/ps.go

@@ -51,12 +51,26 @@ var (
 		"bdservicehost.exe":               {console.Red, "Bitdefender"},                  // Bitdefender (Total Security)
 		"bdagent.exe":                     {console.Red, "Bitdefender"},                  // Bitdefender (Total Security)
 		"bdredline.exe":                   {console.Red, "Bitdefender"},                  // Bitdefender Redline Update Service (Source https://community.bitdefender.com/en/discussion/82135/bdredline-exe-bitdefender-total-security-2020)
+		"Deep Security Manager.exe":	   {console.Red, "Trend Micro"},		  // TM Deep Security Manager 
+		"coreServiceShell.exe":	   	   {console.Red, "Trend Micro"},		  // TM Anti-malware scan process
+		"ds_monitor.exe":	   	   {console.Red, "Trend Micro"},		  // TM Deep Security Monitor
+		"Notifier.exe":	   		   {console.Red, "Trend Micro"},	    	  // TM Deep Security Notifier's process
+		"dsa.exe":	   		   {console.Red, "Trend Micro"},		  // TM Agent's main process
+		"ds_nuagent.exe":	   	   {console.Red, "Trend Micro"},	 	  // TM Advanced TLS traffic inspection
+		"coreFrameworkHost.exe":	   {console.Red, "Trend Micro"},		  // TM Anti-malware scan process
 		"SentinelServiceHost.exe":         {console.Red, "SentinelOne"},                  // Sentinel One
 		"SentinelStaticEngine.exe":        {console.Red, "SentinelOne"},                  // Sentinel One
 		"SentinelStaticEngineScanner.exe": {console.Red, "SentinelOne"},                  // Sentinel One
 		"SentinelAgent.exe":               {console.Red, "SentinelOne"},                  // Sentinel One
 		"SentinelAgentWorker.exe":         {console.Red, "SentinelOne"},                  // Sentinel One
 		"SentinelHelperService.exe":       {console.Red, "SentinelOne"},                  // Sentinel One
+		"SentinelBrowserNativeHost.exe":   {console.Red, "SentinelOne"},                  // Sentinel One
+		"SentinelUI.exe":                  {console.Red, "SentinelOne"},                  // Sentinel One
+		"CylanceSvc.exe":                  {console.Red, "Cylance"},                      // Cylance
+		"CylanceUI.exe":                   {console.Red, "Cylance"},                      // Cylance
+		"TaniumClient.exe":                {console.Red, "Tanium"},                       // Tanium
+		"TaniumCX.exe":                    {console.Red, "Tanium"},                       // Tanium
+		"TaniumDetectEngine.exe":          {console.Red, "Tanium"},                       // Tanium
 	}
 )
 

implant/sliver/handlers/handlers.go

@@ -372,6 +372,9 @@ func prepareDownload(path string, filter string, recurse bool) ([]byte, bool, in
 		to download a single file
 	*/
 	fileInfo, err := os.Stat(path + filter)
+	if err != nil {
+		return nil, false, 0, 1, err
+	}
 	if err == nil && !fileInfo.IsDir() {
 		// Then this is a single file
 		rawData, err := os.ReadFile(path + filter)

server/certs/certs.go

@@ -31,6 +31,7 @@ import (
 	"errors"
 	"fmt"
 	"math/big"
+	insecureRand "math/rand"
 	"net"
 	"time"
 
@@ -40,12 +41,6 @@ import (
 )
 
 const (
-	// RSAKeySize - Default size of RSA keys in bits
-	RSAKeySize = 2048 // This is plenty 4096 is overkill
-
-	// Certs are valid for ~3 Years, minus up to 1 year from Now()
-	validFor = 3 * (365 * 24 * time.Hour)
-
 	// ECCKey - Namespace for ECC keys
 	ECCKey = "ecc"
 
@@ -148,7 +143,9 @@ func GenerateECCCertificate(caType string, commonName string, isCA bool, isClien
 	var err error
 
 	// Generate private key
-	privateKey, err = ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
+	curves := []elliptic.Curve{elliptic.P521(), elliptic.P384(), elliptic.P256()}
+	curve := curves[randomInt(len(curves))]
+	privateKey, err = ecdsa.GenerateKey(curve, rand.Reader)
 	if err != nil {
 		certsLog.Fatalf("Failed to generate private key: %s", err)
 	}
@@ -158,7 +155,7 @@ func GenerateECCCertificate(caType string, commonName string, isCA bool, isClien
 	return generateCertificate(caType, subject, isCA, isClient, privateKey)
 }
 
-// GenerateRSACertificate - Generates a 2048 bit RSA Certificate
+// GenerateRSACertificate - Generates an RSA Certificate
 func GenerateRSACertificate(caType string, commonName string, isCA bool, isClient bool) ([]byte, []byte) {
 
 	certsLog.Debugf("Generating TLS certificate (RSA) for '%s' ...", commonName)
@@ -167,7 +164,7 @@ func GenerateRSACertificate(caType string, commonName string, isCA bool, isClien
 	var err error
 
 	// Generate private key
-	privateKey, err = rsa.GenerateKey(rand.Reader, RSAKeySize)
+	privateKey, err = rsa.GenerateKey(rand.Reader, rsaKeySize())
 	if err != nil {
 		certsLog.Fatalf("Failed to generate private key %s", err)
 	}
@@ -183,7 +180,7 @@ func generateCertificate(caType string, subject pkix.Name, isCA bool, isClient b
 	notBefore := time.Now()
 	days := randomInt(365) * -1 // Within -1 year
 	notBefore = notBefore.AddDate(0, 0, days)
-	notAfter := notBefore.Add(validFor)
+	notAfter := notBefore.Add(randomValidFor())
 	certsLog.Debugf("Valid from %v to %v", notBefore, notAfter)
 
 	// Serial number
@@ -297,3 +294,19 @@ func randomInt(max int) int {
 	i := binary.LittleEndian.Uint32(buf)
 	return int(i) % max
 }
+
+func randomValidFor() time.Duration {
+	validFor := 3 * (365 * 24 * time.Hour)
+	switch insecureRand.Intn(2) {
+	case 0:
+		validFor = 2 * (365 * 24 * time.Hour)
+	case 1:
+		validFor = 3 * (365 * 24 * time.Hour)
+	}
+	return validFor
+}
+
+func rsaKeySize() int {
+	rsaKeySizes := []int{4096, 2048}
+	return rsaKeySizes[randomInt(len(rsaKeySizes))]
+}

server/certs/https.go

@@ -37,7 +37,7 @@ func HTTPSGenerateRSACertificate(host string) ([]byte, []byte, error) {
 	var err error
 
 	// Generate private key
-	privateKey, err = rsa.GenerateKey(rand.Reader, RSAKeySize)
+	privateKey, err = rsa.GenerateKey(rand.Reader, rsaKeySize())
 	if err != nil {
 		certsLog.Fatalf("Failed to generate private key %s", err)
 		return nil, nil, err

server/certs/operators.go

@@ -66,7 +66,6 @@ func OperatorServerGenerateCertificate(hostname string) ([]byte, []byte, error)
 
 // OperatorClientListCertificates - Get all client certificates
 func OperatorClientListCertificates() []*x509.Certificate {
-
 	operatorCerts := []*models.Certificate{}
 	dbSession := db.Session()
 	result := dbSession.Where(&models.Certificate{CAType: OperatorCA}).Find(&operatorCerts)

server/certs/subject.go

@@ -16,6 +16,11 @@ package certs
 
 	You should have received a copy of the GNU General Public License
 	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+	------------------------------------------------------------------------
+
+	Use JARM if you want to fingerprint, don't rely on the subject, its sloppy.
+
 */
 
 import (
@@ -23,101 +28,314 @@ import (
 	"fmt"
 	insecureRand "math/rand"
 	"strings"
+
+	"github.com/bishopfox/sliver/server/codenames"
 )
 
 var (
-	// State -> Localities -> Street Addresses
-	states = map[string]map[string][]string{
-		"": {
-			"": {""},
+	// Finally found a good use for Github Co-Pilot!
+	// Country -> State -> Localities -> Street Addresses
+	subjects = map[string]map[string]map[string][]string{
+		"US": {
+			"": {
+				"": {
+					"",
+				},
+			},
+			"Arizona": {
+				"Phoenix":    {""},
+				"Mesa":       {""},
+				"Scottsdale": {""},
+				"Chandler":   {""},
+			},
+			"California": {
+				"San Francisco": {"", "", "Golden Gate"},
+				"Oakland":       {""},
+				"Berkeley":      {""},
+				"Palo Alto":     {""},
+				"Los Angeles":   {""},
+				"San Diego":     {""},
+				"San Jose":      {""},
+				"Sunnyvale":     {""},
+				"Santa Clara":   {""},
+				"Mountain View": {""},
+				"San Mateo":     {""},
+				"Redwood City":  {""},
+				"Menlo Park":    {""},
+				"San Bruno":     {""},
+				"San Carlos":    {""},
+				"San Leandro":   {""},
+				"San Rafael":    {""},
+				"San Ramon":     {""},
+				"Santa Monica":  {""},
+				"Santa Rosa":    {""},
+				"South San Francisco": {
+					"",
+				},
+			},
+			"Colorado": {
+				"Denver":       {""},
+				"Boulder":      {""},
+				"Aurora":       {""},
+				"Fort Collins": {""},
+			},
+			"Connecticut": {
+				"New Haven":  {""},
+				"Bridgeport": {""},
+				"Stamford":   {""},
+				"Norwalk":    {""},
+			},
+			"Washington": {
+				"Seattle": {""},
+				"Tacoma":  {""},
+				"Olympia": {""},
+				"Spokane": {""},
+			},
+			"Florida": {
+				"Miami":        {""},
+				"Orlando":      {""},
+				"Tampa":        {""},
+				"Jacksonville": {""},
+			},
+			"Illinois": {
+				"Chicago":    {""},
+				"Aurora":     {""},
+				"Naperville": {""},
+				"Peoria":     {""},
+			},
+			"Indiana": {
+				"Indianapolis": {""},
+				"Fort Wayne":   {""},
+				"Evansville":   {""},
+				"South Bend":   {""},
+			},
+			"Massachusetts": {
+				"Boston": {""},
+				"Worcester": {
+					"",
+					"Polytechnic Institute",
+				},
+				"Springfield": {""},
+				"Lowell":      {""},
+			},
+			"Michigan": {
+				"Detroit": {""},
+				"Grand Rapids": {
+					"",
+					"State University",
+				},
+				"Warren": {""},
+				"Sterling Heights": {
+					"",
+					"Community College",
+				},
+			},
+			"Minnesota": {
+				"Minneapolis": {""},
+				"Saint Paul":  {""},
+				"Bloomington": {""},
+				"Plymouth":    {""},
+			},
+			"New Jersey": {
+				"Newark": {""},
+				"Jersey City": {
+					"",
+					"Institute of Technology",
+				},
+				"Paterson": {""},
+				"Elizabeth": {
+					"",
+					"Princeton",
+				},
+			},
+			"New York": {
+				"New York": {""},
+				"Buffalo":  {""},
+				"Rochester": {
+					"",
+					"University",
+				},
+				"Yonkers": {""},
+			},
+			"North Carolina": {
+				"Charlotte": {""},
+				"Raleigh":   {""},
+				"Greensboro": {
+					"",
+					"University",
+				},
+				"Winston-Salem": {""},
+			},
+			"Ohio": {
+				"Columbus": {""},
+				"Cleveland": {
+					"",
+					"State University",
+				},
+				"Cincinnati": {""},
+				"Toledo":     {""},
+			},
 		},
-		"Arizona": {
-			"Phoenix":    {""},
-			"Mesa":       {""},
-			"Scottsdale": {""},
-			"Chandler":   {""},
+		"CA": {
+			"": {
+				"": {
+					"",
+				},
+			},
+			"Alberta": {
+				"Calgary": {""},
+				"Edmonton": {
+					"",
+					"University",
+				},
+				"Red Deer": {""},
+				"Fort McMurray": {
+					"",
+					"University",
+				},
+			},
+			"British Columbia": {
+				"Vancouver": {""},
+				"Victoria":  {""},
+				"Kelowna":   {""},
+				"Richmond":  {""},
+			},
+			"Manitoba": {
+				"Winnipeg": {""},
+				"Brandon":  {""},
+				"Thompson": {""},
+				"Portage la Prairie": {
+					"",
+					"University",
+				},
+			},
+			"New Brunswick": {
+				"Fredericton": {""},
+				"Moncton":     {""},
+				"Saint John":  {""},
+				"Dieppe":      {""},
+			},
+			"Newfoundland and Labrador": {
+				"St. John's": {""},
+				"Mount Pearl": {
+					"",
+					"College",
+				},
+				"Conception Bay South": {""},
+				"Paradise": {
+					"",
+					"College",
+				},
+			},
 		},
-		"California": {
-			"San Francisco": {"", "Golden Gate Bridge"},
-			"Oakland":       {""},
-			"Berkeley":      {""},
-			"Palo Alto":     {""},
-			"Los Angeles":   {""},
-			"San Diego":     {""},
-			"San Jose":      {""},
-		},
-		"Colorado": {
-			"Denver":       {""},
-			"Boulder":      {""},
-			"Aurora":       {""},
-			"Fort Collins": {""},
-		},
-		"Connecticut": {
-			"New Haven":  {""},
-			"Bridgeport": {""},
-			"Stamford":   {""},
-			"Norwalk":    {""},
-		},
-		"Washington": {
-			"Seattle": {""},
-			"Tacoma":  {""},
-			"Olympia": {""},
-			"Spokane": {""},
-		},
-		"Florida": {
-			"Miami":        {""},
-			"Orlando":      {""},
-			"Tampa":        {""},
-			"Jacksonville": {""},
-		},
-		"Illinois": {
-			"Chicago":    {""},
-			"Aurora":     {""},
-			"Naperville": {""},
-			"Peoria":     {""},
+		"JP": {
+			"": {
+				"": {
+					"",
+				},
+			},
+			"Aichi": {
+				"Nagoya": {""},
+				"Kasugai": {
+					"",
+					"University",
+				},
+				"Okazaki": {""},
+				"Handa":   {""},
+			},
+			"Chiba": {
+				"Chiba": {""},
+				"Kashiwa": {
+					"",
+					"University",
+				},
+				"Funabashi": {""},
+				"Kimitsu":   {""},
+			},
 		},
 	}
 )
 
 func randomSubject(commonName string) *pkix.Name {
-	province, locale, street := randomProvinceLocalityStreetAddress()
+	country, province, locale, street := randomProvinceLocalityStreetAddress()
 	return &pkix.Name{
 		Organization:  randomOrganization(),
-		Country:       []string{"US"},
+		Country:       country,
 		Province:      province,
 		Locality:      locale,
 		StreetAddress: street,
-		PostalCode:    randomPostalCode(),
+		PostalCode:    randomPostalCode(country),
 		CommonName:    commonName,
 	}
 }
 
-func randomPostalCode() []string {
-	switch insecureRand.Intn(1) {
-	case 0:
-		return []string{fmt.Sprintf("%d", insecureRand.Intn(8000)+1000)}
-	default:
+func randomPostalCode(country []string) []string {
+	// 1 in `n` will include a postal code
+	// From my cursory view of a few TLS certs it seems uncommon to include this
+	// in the distinguished name so right now it's set to 1/5
+	const postalProbability = 5
+
+	if len(country) == 0 {
 		return []string{}
 	}
+	switch country[0] {
+
+	case "US":
+		// American postal codes are 5 digits
+		switch insecureRand.Intn(postalProbability) {
+		case 0:
+			return []string{fmt.Sprintf("%05d", insecureRand.Intn(90000)+1000)}
+		default:
+			return []string{}
+		}
+
+	case "CA":
+		// Canadian postal codes are weird and include letter/number combo's
+		letters := "ABHLMNKGJPRSTVYX"
+		switch insecureRand.Intn(postalProbability) {
+		case 0:
+			letter1 := string(letters[insecureRand.Intn(len(letters))])
+			letter2 := string(letters[insecureRand.Intn(len(letters))])
+			if insecureRand.Intn(2) == 0 {
+				letter1 = strings.ToLower(letter1)
+				letter2 = strings.ToLower(letter2)
+			}
+			return []string{
+				fmt.Sprintf("%s%d%s", letter1, insecureRand.Intn(9), letter2),
+			}
+		default:
+			return []string{}
+		}
+	}
+	return []string{}
 }
 
-func randomProvinceLocalityStreetAddress() ([]string, []string, []string) {
-	state := randomState()
-	locality := randomLocality(state)
-	streetAddress := randomStreetAddress(state, locality)
-	return []string{state}, []string{locality}, []string{streetAddress}
+func randomProvinceLocalityStreetAddress() ([]string, []string, []string, []string) {
+	country := randomCountry()
+	state := randomState(country)
+	locality := randomLocality(country, state)
+	streetAddress := randomStreetAddress(country, state, locality)
+	return []string{country}, []string{state}, []string{locality}, []string{streetAddress}
 }
 
-func randomState() string {
-	keys := make([]string, 0, len(states))
-	for k := range states {
+func randomCountry() string {
+	keys := make([]string, 0, len(subjects))
+	for k := range subjects {
 		keys = append(keys, k)
 	}
 	return keys[insecureRand.Intn(len(keys))]
 }
 
-func randomLocality(state string) string {
-	locales := states[state]
+func randomState(country string) string {
+	keys := make([]string, 0, len(subjects[country]))
+	for k := range subjects[country] {
+		keys = append(keys, k)
+	}
+	return keys[insecureRand.Intn(len(keys))]
+}
+
+func randomLocality(country string, state string) string {
+	locales := subjects[country][state]
 	keys := make([]string, 0, len(locales))
 	for k := range locales {
 		keys = append(keys, k)
@@ -125,44 +343,65 @@ func randomLocality(state string) string {
 	return keys[insecureRand.Intn(len(keys))]
 }
 
-func randomStreetAddress(state string, locality string) string {
-	addresses := states[state][locality]
+func randomStreetAddress(country string, state string, locality string) string {
+	addresses := subjects[country][state][locality]
 	return addresses[insecureRand.Intn(len(addresses))]
 }
 
 var (
-	orgNames = []string{
-		"",
-		"ACME",
-		"Partners",
-		"Tech",
-		"Cloud",
-		"Synergy",
-		"Test",
-		"Debug",
-	}
 	orgSuffixes = []string{
+		"",
 		"",
 		"co",
 		"llc",
 		"inc",
 		"corp",
 		"ltd",
+		"plc",
+		"inc.",
+		"corp.",
+		"ltd.",
+		"plc.",
+		"co.",
+		"llc.",
+		"incorporated",
+		"limited",
+		"corporation",
+		"company",
+		"incorporated",
+		"limited",
+		"corporation",
+		"company",
 	}
 )
 
 func randomOrganization() []string {
-	name := orgNames[insecureRand.Intn(len(orgNames))]
+	adjective, _ := codenames.RandomAdjective()
+	noun, _ := codenames.RandomNoun()
 	suffix := orgSuffixes[insecureRand.Intn(len(orgSuffixes))]
-	switch insecureRand.Intn(4) {
-	case 0:
-		return []string{strings.TrimSpace(strings.ToLower(name + " " + suffix))}
-	case 1:
-		return []string{strings.TrimSpace(strings.ToUpper(name + " " + suffix))}
-	case 2:
-		return []string{strings.TrimSpace(strings.Title(fmt.Sprintf("%s %s", name, suffix)))}
 
+	var orgName string
+	switch insecureRand.Intn(8) {
+	case 0:
+		orgName = strings.TrimSpace(fmt.Sprintf("%s %s, %s", adjective, noun, suffix))
+	case 1:
+		orgName = strings.TrimSpace(strings.ToLower(fmt.Sprintf("%s %s, %s", adjective, noun, suffix)))
+	case 2:
+		orgName = strings.TrimSpace(fmt.Sprintf("%s, %s", noun, suffix))
+	case 3:
+		orgName = strings.TrimSpace(strings.Title(fmt.Sprintf("%s %s, %s", adjective, noun, suffix)))
+	case 4:
+		orgName = strings.TrimSpace(strings.Title(fmt.Sprintf("%s %s", adjective, noun)))
+	case 5:
+		orgName = strings.TrimSpace(strings.ToLower(fmt.Sprintf("%s %s", adjective, noun)))
+	case 6:
+		orgName = strings.TrimSpace(strings.Title(fmt.Sprintf("%s", noun)))
+	case 7:
+		noun2, _ := codenames.RandomNoun()
+		orgName = strings.TrimSpace(strings.ToLower(fmt.Sprintf("%s-%s", noun, noun2)))
 	default:
-		return []string{}
+		orgName = ""
 	}
+
+	return []string{orgName}
 }

server/codenames/codenames.go

@@ -1,4 +1,4 @@
-package generate
+package codenames
 
 /*
 	Sliver Implant Framework
@@ -78,22 +78,22 @@ func getRandomWord(fpath string) (string, error) {
 }
 
 // getRandomAdjective - Get a random noun, not cryptographically secure
-func getRandomAdjective() (string, error) {
+func RandomAdjective() (string, error) {
 	return getRandomWord("adjectives.txt")
 }
 
 // getRandomNoun - Get a random noun, not cryptographically secure
-func getRandomNoun() (string, error) {
+func RandomNoun() (string, error) {
 	return getRandomWord("nouns.txt")
 }
 
 // GetCodename - Returns a randomly generated 'codename'
 func GetCodename() (string, error) {
-	adjective, err := getRandomAdjective()
+	adjective, err := RandomAdjective()
 	if err != nil {
 		return "", err
 	}
-	noun, err := getRandomNoun()
+	noun, err := RandomNoun()
 	if err != nil {
 		return "", err
 	}

server/log/audit.go

@@ -21,7 +21,7 @@ package log
 import (
 	"fmt"
 	"os"
-	"path"
+	"path/filepath"
 
 	"github.com/sirupsen/logrus"
 )
@@ -34,7 +34,7 @@ var (
 func newAuditLogger() *logrus.Logger {
 	auditLogger := logrus.New()
 	auditLogger.Formatter = &logrus.JSONFormatter{}
-	jsonFilePath := path.Join(GetLogDir(), "audit.json")
+	jsonFilePath := filepath.Join(GetLogDir(), "audit.json")
 	jsonFile, err := os.OpenFile(jsonFilePath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
 	if err != nil {
 		panic(fmt.Sprintf("Failed to open log file %v", err))

server/rpc/rpc-generate.go

@@ -30,6 +30,7 @@ import (
 	consts "github.com/bishopfox/sliver/client/constants"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/server/codenames"
 	"github.com/bishopfox/sliver/server/core"
 	"github.com/bishopfox/sliver/server/db"
 	"github.com/bishopfox/sliver/server/generate"
@@ -46,7 +47,7 @@ func (rpc *Server) Generate(ctx context.Context, req *clientpb.GenerateReq) (*cl
 	var err error
 	name, config := generate.ImplantConfigFromProtobuf(req.Config)
 	if name == "" {
-		name, err = generate.GetCodename()
+		name, err = codenames.GetCodename()
 		if err != nil {
 			return nil, err
 		}

server/rpc/rpc-hijack.go

@@ -34,6 +34,7 @@ import (
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/bishopfox/sliver/server/codenames"
 	"github.com/bishopfox/sliver/server/core"
 	"github.com/bishopfox/sliver/server/generate"
 	"github.com/bishopfox/sliver/util/encoders"
@@ -107,7 +108,7 @@ func (rpc *Server) HijackDLL(ctx context.Context, req *clientpb.DllHijackReq) (*
 
 		name, config := generate.ImplantConfigFromProtobuf(p.Config)
 		if name == "" {
-			name, err = generate.GetCodename()
+			name, err = codenames.GetCodename()
 			if err != nil {
 				return nil, err
 			}

server/rpc/rpc-msf.go

@@ -29,9 +29,9 @@ import (
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/bishopfox/sliver/server/codenames"
 	"github.com/bishopfox/sliver/server/core"
 	"github.com/bishopfox/sliver/server/db"
-	"github.com/bishopfox/sliver/server/generate"
 	"github.com/bishopfox/sliver/server/log"
 	"github.com/bishopfox/sliver/server/msf"
 )
@@ -197,7 +197,7 @@ func (rpc *Server) MsfStage(ctx context.Context, req *clientpb.MsfStagerReq) (*c
 		return MSFStage, err
 	}
 	MSFStage.File.Data = stage
-	name, err := generate.GetCodename()
+	name, err := codenames.GetCodename()
 	if err != nil {
 		return MSFStage, err
 	}

server/rpc/rpc-priv.go

@@ -26,6 +26,7 @@ import (
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/bishopfox/sliver/server/codenames"
 	"github.com/bishopfox/sliver/server/core"
 	"github.com/bishopfox/sliver/server/generate"
 
@@ -85,7 +86,7 @@ func (rpc *Server) GetSystem(ctx context.Context, req *clientpb.GetSystemReq) (*
 	if err != nil {
 		name, config := generate.ImplantConfigFromProtobuf(req.Config)
 		if name == "" {
-			name, err = generate.GetCodename()
+			name, err = codenames.GetCodename()
 			if err != nil {
 				return nil, err
 			}

server/rpc/rpc-tasks.go

@@ -31,6 +31,7 @@ import (
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/bishopfox/sliver/server/codenames"
 	"github.com/bishopfox/sliver/server/core"
 	"github.com/bishopfox/sliver/server/db"
 	"github.com/bishopfox/sliver/server/db/models"
@@ -66,7 +67,7 @@ func (rpc *Server) Migrate(ctx context.Context, req *clientpb.MigrateReq) (*sliv
 	if err != nil {
 		name, config := generate.ImplantConfigFromProtobuf(req.Config)
 		if name == "" {
-			name, err = generate.GetCodename()
+			name, err = codenames.GetCodename()
 			if err != nil {
 				return nil, err
 			}

server/transport/middleware.go

@@ -23,10 +23,11 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
-	"fmt"
 	"sync"
 
+	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/server/configs"
+	"github.com/bishopfox/sliver/server/core"
 	"github.com/bishopfox/sliver/server/db"
 	"github.com/bishopfox/sliver/server/log"
 	grpc_middleware "github.com/grpc-ecosystem/go-grpc-middleware"
@@ -41,6 +42,8 @@ import (
 
 var (
 	serverConfig = configs.GetServerConfig()
+
+	middlewareLog = log.NamedLogger("transport", "middleware")
 )
 
 // initMiddleware - Initialize middleware logger
@@ -126,9 +129,6 @@ func tokenAuthFunc(ctx context.Context) (context.Context, error) {
 	mtlsLog.Debugf("Valid user token for %s", operator.Name)
 	tokenCache.Store(token, operator.Name)
 
-	// grpc_ctxtags.Extract(ctx).Set("auth.sub", userClaimFromToken(tokenInfo))
-	// WARNING: in production define your own type to avoid context collisions
-
 	newCtx = context.WithValue(newCtx, "operator", operator.Name)
 	return newCtx, nil
 }
@@ -186,26 +186,84 @@ func codeToLevel(code codes.Code) logrus.Level {
 type auditUnaryLogMsg struct {
 	Request string `json:"request"`
 	Method  string `json:"method"`
+	Session string `json:"session,omitempty"`
+	Beacon  string `json:"beacon,omitempty"`
 }
 
 func auditLogUnaryServerInterceptor() grpc.UnaryServerInterceptor {
 	return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (_ interface{}, err error) {
-		var request string
 		rawRequest, err := json.Marshal(req)
 		if err != nil {
-			log.AuditLogger.Errorf("Failed to serialize %s", err)
-			request = fmt.Sprintf("%v", req)
-		} else {
-			request = string(rawRequest)
+			middlewareLog.Errorf("Failed to serialize %s", err)
+			return
+		}
+		middlewareLog.Debugf("Raw request: %s", string(rawRequest))
+		session, beacon, err := getActiveTarget(rawRequest)
+		if err != nil {
+			middlewareLog.Errorf("Middleware failed to insert details: %s", err)
 		}
 
-		msg, _ := json.Marshal(&auditUnaryLogMsg{
-			Request: request,
+		// Construct Log Message
+		msg := &auditUnaryLogMsg{
+			Request: string(rawRequest),
 			Method:  info.FullMethod,
-		})
-		log.AuditLogger.Info(string(msg))
+		}
+		if session != nil {
+			sessionJSON, _ := json.Marshal(session)
+			msg.Session = string(sessionJSON)
+		}
+		if beacon != nil {
+			beaconJSON, _ := json.Marshal(beacon)
+			msg.Beacon = string(beaconJSON)
+		}
+
+		msgData, _ := json.Marshal(msg)
+		log.AuditLogger.Info(string(msgData))
 
 		resp, err := handler(ctx, req)
 		return resp, err
 	}
 }
+
+func getActiveTarget(rawRequest []byte) (*clientpb.Session, *clientpb.Beacon, error) {
+
+	var activeBeacon *clientpb.Beacon
+	var activeSession *clientpb.Session
+
+	var request map[string]interface{}
+	err := json.Unmarshal(rawRequest, &request)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// RPC is not a session/beacon request
+	if _, ok := request["Request"]; !ok {
+		return nil, nil, nil
+	}
+
+	rpcRequest := request["Request"].(map[string]interface{})
+
+	middlewareLog.Debugf("RPC Request: %v", rpcRequest)
+
+	if rawBeaconID, ok := rpcRequest["BeaconID"]; ok {
+		beaconID := rawBeaconID.(string)
+		middlewareLog.Debugf("Found Beacon ID: %s", beaconID)
+		beacon, err := db.BeaconByID(beaconID)
+		if err != nil {
+			middlewareLog.Errorf("Failed to get beacon %s: %s", beaconID, err)
+		} else if beacon != nil {
+			activeBeacon = beacon.ToProtobuf()
+		}
+	}
+
+	if rawSessionID, ok := rpcRequest["SessionID"]; ok {
+		sessionID := rawSessionID.(string)
+		middlewareLog.Debugf("Found Session ID: %s", sessionID)
+		session := core.Sessions.Get(sessionID)
+		if session != nil {
+			activeSession = session.ToProtobuf()
+		}
+	}
+
+	return activeSession, activeBeacon, nil
+}

server/website/website.go

@@ -21,6 +21,7 @@ package website
 import (
 	"errors"
 	"io/ioutil"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strings"
@@ -72,9 +73,14 @@ func GetContent(websiteName string, path string) (string, []byte, error) {
 
 	dbSession := db.Session()
 	content := models.WebContent{}
+	// Use path without any query parameters
+	u, err := url.Parse(path)
+	if err != nil {
+		return "", []byte{}, err
+	}
 	result := dbSession.Where(&models.WebContent{
 		WebsiteID: website.ID,
-		Path:      path,
+		Path:      u.Path,
 	}).First(&content)
 	if result.Error != nil {
 		return "", []byte{}, result.Error