Remove uneeded rand seeding

Update sqlite deps

implant/sliver/sliver.go

@@ -25,8 +25,6 @@ import "C"
 // {{end}}
 
 import (
-	"crypto/rand"
-	"encoding/binary"
 	"errors"
 
 	insecureRand "math/rand"
@@ -69,13 +67,6 @@ var (
 )
 
 func init() {
-	buf := make([]byte, 8)
-	n, err := rand.Read(buf)
-	if err != nil || n != len(buf) {
-		insecureRand.Seed(time.Now().Unix())
-	} else {
-		insecureRand.Seed(int64(binary.LittleEndian.Uint64(buf)))
-	}
 	id, err := uuid.NewV4()
 	if err != nil {
 		buf := make([]byte, 16) // NewV4 fails if secure rand fails

server/c2/c2profile.go

@@ -17,21 +17,6 @@ package c2
 	You should have received a copy of the GNU General Public License
 	along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
-	------------------------------------------------------------------------
-
-	We've put a little effort to making the server at least not super easily fingerprintable,
-	though I'm guessing it's also still not super hard to do. The server must receive a valid
-	TOTP code before we start returning any non-error records. All requests must be formatted
-	as valid protobuf and contain a 24-bit "dns session ID" (16777216 possible values), and a
-	8 bit "message ID." The server only responds to non-TOTP queries with valid dns session IDs
-	16,777,216 can probably be bruteforced but it'll at least be slow.
-
-	DNS command and control outline:
-		1. Implant sends TOTP encoded message to DNS server, server checks validity
-		2. DNS server responds with the "DNS Session ID" which is just some random value
-		3. Requests with valid DNS session IDs enable the server to respond with CRC32 responses
-		4. Implant establishes encrypted session
-
 */
 import (
 	"log"

server/certs/subject.go

@@ -25,6 +25,8 @@ import (
 	"strings"
 
 	"github.com/bishopfox/sliver/server/codenames"
+	"golang.org/x/text/cases"
+	"golang.org/x/text/language"
 )
 
 var (
@@ -267,8 +269,8 @@ func randomSubject(commonName string) *pkix.Name {
 func randomPostalCode(country []string) []string {
 	// 1 in `n` will include a postal code
 	// From my cursory view of a few TLS certs it seems uncommon to include this
-	// in the distinguished name so right now it's set to 1/5
-	const postalProbability = 5
+	// in the distinguished name so right now it's set to 1/20
+	const postalProbability = 20
 
 	if len(country) == 0 {
 		return []string{}
@@ -367,6 +369,50 @@ var (
 		"limited",
 		"corporation",
 		"company",
+		"GmbH",
+		"AG",
+		"S.A.",
+		"B.V.",
+		"LLP",
+		"Pte Ltd",
+		"Sdn Bhd",
+		"KG",
+		"Limited",
+		"Partnership",
+		"Associates",
+		"Group",
+		"Holdings",
+		"Enterprises",
+		"Industries",
+		"Ventures",
+		"International",
+		"Systems",
+		"Technologies",
+		"Incorporated",
+		"Services",
+		"Solutions",
+		"Enterprises",
+		"Global",
+		"Trading",
+		"Manufacturing",
+		"Development",
+		"Management",
+		"Consulting",
+		"Logistics",
+		"Communications",
+		"Finance",
+		"Electronics",
+		"Pharmaceuticals",
+		"Automotive",
+		"Energy",
+		"Healthcare",
+		"Technology",
+		"Biotech",
+		"Media",
+		"Software",
+		"Hardware",
+		"Entertainment",
+		"Construction",
 	}
 )
 
@@ -375,6 +421,14 @@ func randomOrganization() []string {
 	noun, _ := codenames.RandomNoun()
 	suffix := orgSuffixes[insecureRand.Intn(len(orgSuffixes))]
 
+	// Not exactly sure this even matters much, but hey its fun to add more randomness
+	caseTitles := []cases.Caser{
+		cases.Title(language.English),
+		cases.Title(language.AmericanEnglish),
+		cases.Title(language.BritishEnglish),
+	}
+	caseTitle := caseTitles[insecureRand.Intn(len(caseTitles))]
+
 	var orgName string
 	switch insecureRand.Intn(8) {
 	case 0:
@@ -384,13 +438,13 @@ func randomOrganization() []string {
 	case 2:
 		orgName = strings.TrimSpace(fmt.Sprintf("%s, %s", noun, suffix))
 	case 3:
-		orgName = strings.TrimSpace(strings.Title(fmt.Sprintf("%s %s, %s", adjective, noun, suffix)))
+		orgName = strings.TrimSpace(caseTitle.String(fmt.Sprintf("%s %s, %s", adjective, noun, suffix)))
 	case 4:
-		orgName = strings.TrimSpace(strings.Title(fmt.Sprintf("%s %s", adjective, noun)))
+		orgName = strings.TrimSpace(caseTitle.String(fmt.Sprintf("%s %s", adjective, noun)))
 	case 5:
 		orgName = strings.TrimSpace(strings.ToLower(fmt.Sprintf("%s %s", adjective, noun)))
 	case 6:
-		orgName = strings.TrimSpace(strings.Title(fmt.Sprintf("%s", noun)))
+		orgName = strings.TrimSpace(caseTitle.String(fmt.Sprintf("%s", noun)))
 	case 7:
 		noun2, _ := codenames.RandomNoun()
 		orgName = strings.TrimSpace(strings.ToLower(fmt.Sprintf("%s-%s", noun, noun2)))

server/configs/http-c2.go

@@ -188,9 +188,9 @@ func GenerateDefaultHTTPC2Config() *clientpb.HTTPC2Config {
 		NonceQueryArgChars:        "abcdefghijklmnopqrstuvwxyz",
 		ExtraURLParameters:        httpC2UrlParameters,
 		Headers:                   httpC2Headers,
-		MaxFiles:                  8,
+		MaxFiles:                  4,
 		MinFiles:                  2,
-		MaxPaths:                  8,
+		MaxPaths:                  4,
 		MinPaths:                  2,
 		StagerFileExtension:       "woff",
 		PollFileExtension:         "js",
@@ -318,7 +318,83 @@ func GenerateHTTPC2DefaultPathSegment() []*clientpb.HTTPC2PathSegment {
 var (
 	httpC2ConfigLog = log.NamedLogger("config", "http-c2")
 
+	// Pro-tip: You can use ChatGPT to generate this stuff for you!
 	Cookies = []string{
+		"JSESSIONID",
+		"rememberMe",
+		"authToken",
+		"userId",
+		"userName",
+		"language",
+		"theme",
+		"locale",
+		"currency",
+		"lastVisited",
+		"loggedIn",
+		"userRole",
+		"cartId",
+		"accessToken",
+		"refreshToken",
+		"consent",
+		"notificationPreference",
+		"userSettings",
+		"sessionTimeout",
+		"error",
+		"errorMessage",
+		"successMessage",
+		"infoMessage",
+		"warningMessage",
+		"errorMessageKey",
+		"successMessageKey",
+		"infoMessageKey",
+		"warningMessageKey",
+		"sessionID",
+		"userID",
+		"username",
+		"authToken",
+		"rememberMe",
+		"language",
+		"theme",
+		"locale",
+		"currency",
+		"lastVisit",
+		"loggedIn",
+		"userRole",
+		"cartID",
+		"accessToken",
+		"refreshToken",
+		"consent",
+		"notificationPref",
+		"userSettings",
+		"sessionTimeout",
+		"visitedPages",
+		"favoriteItems",
+		"searchHistory",
+		"basketID",
+		"promoCode",
+		"campaignID",
+		"referrer",
+		"source",
+		"utmCampaign",
+		"utmSource",
+		"utmMedium",
+		"utmContent",
+		"utmTerm",
+		"deviceType",
+		"OSVersion",
+		"browser",
+		"screenResolution",
+		"timezone",
+		"firstVisit",
+		"feedbackGiven",
+		"surveyID",
+		"errorAlerts",
+		"successAlerts",
+		"infoAlerts",
+		"warningAlerts",
+		"darkMode",
+		"emailSubscription",
+		"privacyConsent",
 		"PHPSESSID",
 		"SID",
 		"SSID",
@@ -338,6 +414,104 @@ var (
 		"backbone",
 		"script",
 		"email",
+		"main",
+		"index",
+		"utils",
+		"jquery.min",
+		"bootstrap",
+		"angular",
+		"react",
+		"vue",
+		"lodash",
+		"moment",
+		"axios",
+		"underscore",
+		"d3",
+		"chart",
+		"map",
+		"validation",
+		"animation",
+		"slider",
+		"modal",
+		"form",
+		"ajax",
+		"cookie",
+		"dom",
+		"events",
+		"navigation",
+		"menu",
+		"dropdown",
+		"carousel",
+		"scroll",
+		"pagination",
+		"tabs",
+		"accordion",
+		"tooltip",
+		"popover",
+		"alert",
+		"notification",
+		"progress",
+		"loader",
+		"countdown",
+		"lazyload",
+		"parallax",
+		"video",
+		"audio",
+		"slideshow",
+		"gallery",
+		"lightbox",
+		"share",
+		"social",
+		"analytics",
+		"tracking",
+		"search",
+		"autocomplete",
+		"filter",
+		"sort",
+		"table",
+		"chart",
+		"graph",
+		"calendar",
+		"datepicker",
+		"timepicker",
+		"dropdown",
+		"multi-select",
+		"form-validation",
+		"tooltip",
+		"popover",
+		"modal",
+		"sidebar",
+		"drawer",
+		"sticky",
+		"scrollspy",
+		"smoothscroll",
+		"anchor",
+		"slideshow",
+		"testimonial",
+		"newsletter",
+		"login",
+		"registration",
+		"cart",
+		"checkout",
+		"payment",
+		"validation",
+		"maps",
+		"geolocation",
+		"geocoding",
+		"canvas",
+		"webgl",
+		"particles",
+		"barcode",
+		"qr-code",
+		"encryption",
+		"decryption",
+		"localization",
+		"translation",
+		"i18n",
+		"routing",
+		"router",
+		"storage",
+		"offline",
 	}
 	PollPaths = []string{
 		"js",
@@ -350,6 +524,62 @@ var (
 		"javascripts",
 		"javascript",
 		"jscript",
+		"js",
+		"scripts",
+		"assets",
+		"src",
+		"lib",
+		"public",
+		"static",
+		"app",
+		"www",
+		"dist",
+		"frontend",
+		"client",
+		"server",
+		"resources",
+		"jsfiles",
+		"javascript",
+		"jslib",
+		"jslibraries",
+		"jsdir",
+		"jsfolder",
+		"jsfilesdir",
+		"jsfilesfolder",
+		"scriptsdir",
+		"assetsjs",
+		"srcjs",
+		"srcscripts",
+		"libjs",
+		"libscripts",
+		"publicjs",
+		"publicscripts",
+		"staticjs",
+		"staticscripts",
+		"appjs",
+		"appscripts",
+		"distjs",
+		"distscripts",
+		"frontendjs",
+		"frontendscripts",
+		"clientjs",
+		"clientscripts",
+		"serverjs",
+		"resourcesjs",
+		"jsfilesjs",
+		"jsfilesscripts",
+		"javascriptjs",
+		"jslibscripts",
+		"assetsjs",
+		"assetsjsscripts",
+		"assetsjs",
+		"assetsscripts",
+		"srcjs",
+		"srcjsscripts",
+		"srcscripts",
+		"srcscripts",
+		"libjs",
+		"libjsscripts",
 	}
 	SessionFiles = []string{
 		"login",
@@ -361,6 +591,97 @@ var (
 		"admin",
 		"register",
 		"sign-up",
+		"index",
+		"config",
+		"functions",
+		"database",
+		"header",
+		"footer",
+		"login",
+		"register",
+		"logout",
+		"profile",
+		"dashboard",
+		"home",
+		"about",
+		"contact",
+		"services",
+		"utils",
+		"common",
+		"init",
+		"auth",
+		"session",
+		"error",
+		"handler",
+		"api",
+		"ajax",
+		"form",
+		"validation",
+		"upload",
+		"download",
+		"report",
+		"admin",
+		"user",
+		"account",
+		"settings",
+		"utility",
+		"script",
+		"mailer",
+		"cron",
+		"cache",
+		"template",
+		"page",
+		"model",
+		"view",
+		"controller",
+		"middleware",
+		"router",
+		"route",
+		"helper",
+		"library",
+		"plugin",
+		"widget",
+		"widgetized",
+		"search",
+		"filter",
+		"sort",
+		"pagination",
+		"backup",
+		"restore",
+		"upgrade",
+		"install",
+		"uninstall",
+		"upgrade",
+		"maintenance",
+		"sitemap",
+		"rss",
+		"atom",
+		"xml",
+		"json",
+		"rss",
+		"log",
+		"debug",
+		"test",
+		"mock",
+		"stub",
+		"mockup",
+		"mockdata",
+		"temp",
+		"tmp",
+		"backup",
+		"old",
+		"new",
+		"demo",
+		"example",
+		"sample",
+		"prototype",
+		"backup",
+		"import",
+		"export",
+		"sync",
+		"async",
+		"validate",
+		"authenticate",
 	}
 	SessionPaths = []string{
 		"php",
@@ -377,8 +698,193 @@ var (
 		"database",
 		"db",
 		"namespaces",
+		"home",
+		"about",
+		"contact",
+		"services",
+		"products",
+		"blog",
+		"news",
+		"events",
+		"gallery",
+		"portfolio",
+		"shop",
+		"store",
+		"login",
+		"register",
+		"profile",
+		"dashboard",
+		"account",
+		"settings",
+		"faq",
+		"help",
+		"support",
+		"download",
+		"upload",
+		"subscribe",
+		"unsubscribe",
+		"search",
+		"sitemap",
+		"privacy",
+		"terms",
+		"conditions",
+		"policy",
+		"cookie",
+		"checkout",
+		"cart",
+		"order",
+		"payment",
+		"confirmation",
+		"feedback",
+		"survey",
+		"testimonial",
+		"newsletter",
+		"membership",
+		"forum",
+		"signin",
+		"signup",
+		"forum",
+		"contact-us",
+		"pricing",
+		"donate",
+		"partners",
+		"team",
+		"career",
+		"join-us",
+		"downloads",
+		"events",
+		"explore",
+		"insights",
+		"newsroom",
+		"press",
+		"media",
+		"blog",
+		"articles",
+		"research",
+		"library",
+		"resources",
+		"inspiration",
+		"academy",
+		"labs",
+		"developers",
+		"api",
+		"integration",
+		"status",
+		"changelog",
+		"roadmap",
+		"solutions",
+		"clients",
+		"testimonials",
+		"success-stories",
+		"clients",
+		"partners",
+		"404",
+		"500",
+		"error",
+		"maintenance",
+		"upgrade",
 	}
 	CloseFiles = []string{
+		"image",
+		"logo",
+		"icon",
+		"background",
+		"banner",
+		"button",
+		"avatar",
+		"photo",
+		"picture",
+		"header",
+		"footer",
+		"thumbnail",
+		"screenshot",
+		"cover",
+		"badge",
+		"illustration",
+		"graphic",
+		"map",
+		"diagram",
+		"chart",
+		"emoji",
+		"flag",
+		"arrow",
+		"social",
+		"media",
+		"document",
+		"product",
+		"menu",
+		"navigation",
+		"search",
+		"result",
+		"loading",
+		"progress",
+		"error",
+		"success",
+		"warning",
+		"info",
+		"question",
+		"exclamation",
+		"play",
+		"pause",
+		"stop",
+		"next",
+		"previous",
+		"rewind",
+		"forward",
+		"volume",
+		"mute",
+		"speaker",
+		"microphone",
+		"camera",
+		"video",
+		"audio",
+		"file",
+		"folder",
+		"download",
+		"upload",
+		"share",
+		"like",
+		"heart",
+		"star",
+		"comment",
+		"chat",
+		"speech bubble",
+		"message",
+		"envelope",
+		"mail",
+		"clock",
+		"calendar",
+		"location",
+		"pin",
+		"home",
+		"settings",
+		"gear",
+		"tools",
+		"user",
+		"profile",
+		"login",
+		"logout",
+		"register",
+		"lock",
+		"unlock",
+		"shield",
+		"security",
+		"privacy",
+		"checkmark",
+		"cross",
+		"delete",
+		"trash",
+		"restore",
+		"recycle",
+		"favorite",
+		"bookmark",
+		"star",
+		"eye",
+		"magnifier",
+		"question mark",
+		"information",
+		"exclamationmark",
+		"help",
 		"favicon",
 		"sample",
 		"example",
@@ -392,6 +898,55 @@ var (
 		"image",
 		"icon",
 		"png",
+		"images",
+		"photos",
+		"pictures",
+		"pics",
+		"gallery",
+		"media",
+		"uploads",
+		"assets",
+		"img",
+		"graphics",
+		"visuals",
+		"media-library",
+		"artwork",
+		"design",
+		"diagrams",
+		"icons",
+		"logos",
+		"banners",
+		"thumbnails",
+		"avatars",
+		"screenshots",
+		"headers",
+		"footers",
+		"backgrounds",
+		"buttons",
+		"illustrations",
+		"diagrams",
+		"photoshoots",
+		"picoftheday",
+		"imagebank",
+		"album",
+		"memories",
+		"memes",
+		"snapshots",
+		"portraits",
+		"posters",
+		"renders",
+		"cover-photos",
+		"wallpapers",
+		"photography",
+		"visualizations",
+		"moodboard",
+		"infographics",
+		"renders",
+		"icons",
+		"layers",
+		"picgallery",
+		"picdump",
+		"imagelibrary",
 	}
 	StagerFiles = []string{
 		"attribute_text_w01_regular", "ZillaSlab-Regular.subset.bbc33fb47cf6",

server/main.go

@@ -21,26 +21,9 @@ package main
 */
 
 import (
-	"crypto/rand"
-	"encoding/binary"
-	insecureRand "math/rand"
-	"time"
-
 	"github.com/bishopfox/sliver/server/cli"
 )
 
-// Attempt to seed insecure rand with secure rand, but we really
-// don't care that much if it fails since it's insecure anyways
-func init() {
-	buf := make([]byte, 8)
-	_, err := rand.Read(buf)
-	if err != nil {
-		insecureRand.Seed(int64(time.Now().Unix()))
-	} else {
-		insecureRand.Seed(int64(binary.LittleEndian.Uint64(buf)))
-	}
-}
-
 func main() {
 	cli.Execute()
 }