mirror of
https://github.com/BishopFox/sliver.git
synced 2026-11-11 01:41:27 -10:00
Compare commits
5
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Raf
|
f606639db5 | ||
|
moloch--
|
ea0f4e41b7 | ||
|
Joe
|
6dadd929e8 | ||
|
Joe
|
ae21b45147 | ||
|
Raf
|
a07b775d90 |
No files matched your search
@@ -155,11 +155,11 @@ clients: clean .downloaded_assets validate-go-version
|
||||
|
||||
.PHONY: servers
|
||||
servers:
|
||||
GOOS=windows GOARCH=amd64 $(ENV) CGO_ENABLED=$(CGO_ENABLED) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_windows-amd64$(ARTIFACT_SUFFIX).exe ./server
|
||||
GOOS=linux GOARCH=amd64 $(ENV) CGO_ENABLED=$(CGO_ENABLED) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_linux-amd64$(ARTIFACT_SUFFIX) ./server
|
||||
GOOS=linux GOARCH=arm64 $(ENV) CGO_ENABLED=$(CGO_ENABLED) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_linux-arm64$(ARTIFACT_SUFFIX) ./server
|
||||
GOOS=darwin GOARCH=arm64 $(ENV) CGO_ENABLED=$(CGO_ENABLED) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_darwin-arm64$(ARTIFACT_SUFFIX) ./server
|
||||
GOOS=darwin GOARCH=amd64 $(ENV) CGO_ENABLED=$(CGO_ENABLED) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_darwin-amd64$(ARTIFACT_SUFFIX) ./server
|
||||
GOOS=windows GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_windows-amd64$(ARTIFACT_SUFFIX).exe ./server
|
||||
GOOS=linux GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_linux-amd64$(ARTIFACT_SUFFIX) ./server
|
||||
GOOS=linux GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_linux-arm64$(ARTIFACT_SUFFIX) ./server
|
||||
GOOS=darwin GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_darwin-arm64$(ARTIFACT_SUFFIX) ./server
|
||||
GOOS=darwin GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_darwin-amd64$(ARTIFACT_SUFFIX) ./server
|
||||
|
||||
.PHONY: pb
|
||||
pb:
|
||||
|
||||
@@ -72,6 +72,7 @@ func GenerateStagerCmd(cmd *cobra.Command, con *console.SliverConsoleClient, arg
|
||||
format, _ := cmd.Flags().GetString("format")
|
||||
badChars, _ := cmd.Flags().GetString("badchars")
|
||||
save, _ := cmd.Flags().GetString("save")
|
||||
advOptions, _ := cmd.Flags().GetString("advanced")
|
||||
|
||||
bChars := make([]string, 0)
|
||||
if len(badChars) > 0 {
|
||||
@@ -95,13 +96,14 @@ func GenerateStagerCmd(cmd *cobra.Command, con *console.SliverConsoleClient, arg
|
||||
ctrl := make(chan bool)
|
||||
con.SpinUntil("Generating stager, please wait ...", ctrl)
|
||||
stageFile, err := con.Rpc.MsfStage(context.Background(), &clientpb.MsfStagerReq{
|
||||
Arch: arch,
|
||||
BadChars: bChars,
|
||||
Format: format,
|
||||
Host: lhost,
|
||||
Port: lport,
|
||||
Protocol: stageProto,
|
||||
OS: stageOS,
|
||||
Arch: arch,
|
||||
BadChars: bChars,
|
||||
Format: format,
|
||||
Host: lhost,
|
||||
Port: lport,
|
||||
Protocol: stageProto,
|
||||
OS: stageOS,
|
||||
AdvOptions: advOptions,
|
||||
})
|
||||
ctrl <- true
|
||||
<-ctrl
|
||||
@@ -124,7 +126,7 @@ func GenerateStagerCmd(cmd *cobra.Command, con *console.SliverConsoleClient, arg
|
||||
}
|
||||
con.PrintInfof("Sliver implant stager saved to: %s\n", saveTo)
|
||||
} else {
|
||||
con.PrintInfof("Here's your stager:")
|
||||
con.PrintInfof("Here's your stager:\n")
|
||||
con.Println(string(stageFile.GetFile().GetData()))
|
||||
}
|
||||
}
|
||||
@@ -531,7 +531,7 @@ func ParseWGc2(args string) ([]*clientpb.ImplantC2, error) {
|
||||
func hasValidC2AdvancedOptions(options url.Values) (bool, error) {
|
||||
for key, value := range options {
|
||||
if len(value) > 1 {
|
||||
return false, fmt.Errorf("too many values specified for advanced option %s. Only one value for %s can be specified.", key, key)
|
||||
return false, fmt.Errorf("too many values specified for advanced option %s. Only one value for %s can be specified", key, key)
|
||||
}
|
||||
testValue := value[0]
|
||||
|
||||
@@ -588,13 +588,35 @@ func hasValidC2AdvancedOptions(options url.Values) (bool, error) {
|
||||
return true, nil
|
||||
}
|
||||
|
||||
func checkOptionValue(c2Options url.Values, option string, value string) bool {
|
||||
if !c2Options.Has(option) {
|
||||
return false
|
||||
} else {
|
||||
optionValue := c2Options.Get(option)
|
||||
return strings.ToLower(optionValue) == value
|
||||
}
|
||||
}
|
||||
|
||||
func uriWithoutProxyOptions(uri *url.URL) {
|
||||
options := uri.Query()
|
||||
// If any of the options do not exist, there is no error
|
||||
options.Del("proxy")
|
||||
options.Del("proxy-username")
|
||||
options.Del("proxy-password")
|
||||
options.Del("ask-proxy-creds")
|
||||
options.Del("fallback")
|
||||
|
||||
uri.RawQuery = options.Encode()
|
||||
}
|
||||
|
||||
// ParseHTTPc2 - Parse HTTP connection string arg
|
||||
func ParseHTTPc2(args string) ([]*clientpb.ImplantC2, error) {
|
||||
c2s := []*clientpb.ImplantC2{}
|
||||
if args == "" {
|
||||
return c2s, nil
|
||||
}
|
||||
for index, arg := range strings.Split(args, ",") {
|
||||
allArguments := strings.Split(args, ",")
|
||||
for index, arg := range allArguments {
|
||||
var uri *url.URL
|
||||
var err error
|
||||
if cmp := strings.ToLower(arg); strings.HasPrefix(cmp, "http://") || strings.HasPrefix(cmp, "https://") {
|
||||
@@ -619,6 +641,16 @@ func ParseHTTPc2(args string) ([]*clientpb.ImplantC2, error) {
|
||||
Priority: uint32(index),
|
||||
URL: uri.String(),
|
||||
})
|
||||
/* If a proxy is defined and the operator wants to fallback to connecting directly, add
|
||||
a C2 that connects directly without the proxy settings.
|
||||
*/
|
||||
if checkOptionValue(uri.Query(), "fallback", "true") && uri.Query().Has("proxy") && !checkOptionValue(uri.Query(), "driver", "wininet") {
|
||||
uriWithoutProxyOptions(uri)
|
||||
c2s = append(c2s, &clientpb.ImplantC2{
|
||||
Priority: uint32(index + len(allArguments)),
|
||||
URL: uri.String(),
|
||||
})
|
||||
}
|
||||
}
|
||||
return c2s, nil
|
||||
}
|
||||
|
||||
@@ -187,21 +187,32 @@ Due to the large number of options and C2s this can be a lot of typing. If you'd
|
||||
see 'help profiles new'. All "generate" flags can be saved into a profile, you can view existing profiles with the "profiles"
|
||||
command.
|
||||
`
|
||||
generateStagerHelp = `[[.Bold]]Command:[[.Normal]] generate stager <options>
|
||||
generateStagerHelp = `[[.Bold]]Command:[[.Normal]] generate msf-stager <options>
|
||||
[[.Bold]]About:[[.Normal]] Generate a new sliver stager shellcode and saves the output to the cwd or a path specified with --save, or to stdout using --format.
|
||||
|
||||
[[.Bold]][[.Underline]]++ Bad Characters ++[[.Normal]]
|
||||
Bad characters must be specified like this for single bytes:
|
||||
|
||||
generate stager -b 00
|
||||
generate msf-stager -b 00
|
||||
|
||||
And like this for multiple bytes:
|
||||
|
||||
generate stager -b '00 0a cc'
|
||||
generate msf-stager -b '00 0a cc'
|
||||
|
||||
[[.Bold]][[.Underline]]++ Output Formats ++[[.Normal]]
|
||||
You can use the --format flag to print out the shellcode to stdout, in one of the following transform formats:
|
||||
[[.Bold]]bash c csharp dw dword hex java js_be js_le num perl pl powershell ps1 py python raw rb ruby sh vbapplication vbscript[[.Normal]]
|
||||
|
||||
[[.Bold]][[.Underline]]++ Advanced Options ++[[.Normal]]
|
||||
If there are any advanced options you need to pass to msfvenom, you can use the --advanced flag to provide them. They must be provided in URI query format: option1=value1&option2=value2 and so on.
|
||||
The full list of advanced options is available using "show advanced" in msf for the payload corresponding to the chosen protocol:
|
||||
TCP: meterpreter/reverse_tcp
|
||||
HTTP: custom/reverse_winhttp
|
||||
HTTPS: custom/reverse_winhttps
|
||||
|
||||
Example:
|
||||
To tell the stager to use the proxy proxy.corp.com:8080 with the user name "corp_drone" and password "MyPassword", you would pass the following string to --advanced:
|
||||
HttpProxyHost=proxy.corp.com&HttpProxyPort=8080&HttpProxyUser=corp_drone&HttpProxyPass=MyPassword
|
||||
`
|
||||
stageListenerHelp = `[[.Bold]]Command:[[.Normal]] stage-listener <options>
|
||||
[[.Bold]]About:[[.Normal]] Starts a stager listener bound to a Sliver profile.
|
||||
|
||||
@@ -758,9 +758,10 @@ func ServerCommands(con *client.SliverConsoleClient, serverCmds func() []*cobra.
|
||||
f.StringP("lhost", "L", "", "Listening host")
|
||||
f.Uint32P("lport", "l", 8443, "Listening port")
|
||||
f.StringP("protocol", "r", "tcp", "Staging protocol (tcp/http/https)")
|
||||
f.StringP("format", "f", "raw", "Output format (msfvenom formats, see `help generate stager` for the list)")
|
||||
f.StringP("format", "f", "raw", "Output format (msfvenom formats, see help generate msf-stager for the list)")
|
||||
f.StringP("badchars", "b", "", "bytes to exclude from stage shellcode")
|
||||
f.StringP("save", "s", "", "directory to save the generated stager to")
|
||||
f.StringP("advanced", "d", "", "Advanced options for the stager using URI query syntax (option1=value1&option2=value2...)")
|
||||
})
|
||||
generateCmd.AddCommand(generateStagerCmd)
|
||||
|
||||
|
||||
+59
-61
@@ -24,8 +24,6 @@ GO_VER="1.20.4"
|
||||
GARBLE_VER="1.20.4a"
|
||||
SGN_VER="0.0.3"
|
||||
|
||||
GO_ARCH_1="amd64"
|
||||
GO_ARCH_2="arm64"
|
||||
BLOAT_FILES="AUTHORS CONTRIBUTORS PATENTS VERSION favicon.ico robots.txt SECURITY.md CONTRIBUTING.md LICENSE README.md ./doc ./test ./api ./misc"
|
||||
|
||||
if ! [ -x "$(command -v curl)" ]; then
|
||||
@@ -59,111 +57,111 @@ echo "-----------------------------------------------------------------"
|
||||
cd $WORK_DIR
|
||||
|
||||
# --- Darwin (amd64) ---
|
||||
curl --output go$GO_VER.darwin-$GO_ARCH_1.tar.gz https://dl.google.com/go/go$GO_VER.darwin-$GO_ARCH_1.tar.gz
|
||||
tar xvf go$GO_VER.darwin-$GO_ARCH_1.tar.gz
|
||||
curl --output go$GO_VER.darwin-amd64.tar.gz https://dl.google.com/go/go$GO_VER.darwin-amd64.tar.gz
|
||||
tar xvf go$GO_VER.darwin-amd64.tar.gz
|
||||
|
||||
cd go
|
||||
rm -rf $BLOAT_FILES
|
||||
zip -r ../src.zip ./src # Zip up /src we only need to do this once
|
||||
rm -rf ./src
|
||||
rm -f ./pkg/tool/darwin_$GO_ARCH_1/doc
|
||||
rm -f ./pkg/tool/darwin_$GO_ARCH_1/tour
|
||||
rm -f ./pkg/tool/darwin_$GO_ARCH_1/test2json
|
||||
rm -f ./pkg/tool/darwin_amd64/doc
|
||||
rm -f ./pkg/tool/darwin_amd64/tour
|
||||
rm -f ./pkg/tool/darwin_amd64/test2json
|
||||
cd ..
|
||||
cp -vv src.zip $OUTPUT_DIR/src.zip
|
||||
rm -f src.zip
|
||||
|
||||
zip -r darwin-go.zip ./go
|
||||
mkdir -p $OUTPUT_DIR/darwin/$GO_ARCH_1
|
||||
cp -vv darwin-go.zip $OUTPUT_DIR/darwin/$GO_ARCH_1/go.zip
|
||||
mkdir -p $OUTPUT_DIR/darwin/amd64
|
||||
cp -vv darwin-go.zip $OUTPUT_DIR/darwin/amd64/go.zip
|
||||
|
||||
rm -rf ./go
|
||||
rm -f darwin-go.zip go$GO_VER.darwin-$GO_ARCH_1.tar.gz
|
||||
rm -f darwin-go.zip go$GO_VER.darwin-amd64.tar.gz
|
||||
|
||||
# --- Darwin (arm64) ---
|
||||
curl --output go$GO_VER.darwin-$GO_ARCH_2.tar.gz https://dl.google.com/go/go$GO_VER.darwin-$GO_ARCH_2.tar.gz
|
||||
tar xvf go$GO_VER.darwin-$GO_ARCH_2.tar.gz
|
||||
curl --output go$GO_VER.darwin-arm64.tar.gz https://dl.google.com/go/go$GO_VER.darwin-arm64.tar.gz
|
||||
tar xvf go$GO_VER.darwin-arm64.tar.gz
|
||||
|
||||
cd go
|
||||
rm -rf $BLOAT_FILES
|
||||
zip -r ../src.zip ./src # Zip up /src we only need to do this once
|
||||
rm -rf ./src
|
||||
rm -f ./pkg/tool/darwin_$GO_ARCH_2/doc
|
||||
rm -f ./pkg/tool/darwin_$GO_ARCH_2/tour
|
||||
rm -f ./pkg/tool/darwin_$GO_ARCH_2/test2json
|
||||
rm -f ./pkg/tool/darwin_arm64/doc
|
||||
rm -f ./pkg/tool/darwin_arm64/tour
|
||||
rm -f ./pkg/tool/darwin_arm64/test2json
|
||||
cd ..
|
||||
cp -vv src.zip $OUTPUT_DIR/src.zip
|
||||
rm -f src.zip
|
||||
|
||||
zip -r darwin-go.zip ./go
|
||||
mkdir -p $OUTPUT_DIR/darwin/$GO_ARCH_2
|
||||
cp -vv darwin-go.zip $OUTPUT_DIR/darwin/$GO_ARCH_2/go.zip
|
||||
mkdir -p $OUTPUT_DIR/darwin/arm64
|
||||
cp -vv darwin-go.zip $OUTPUT_DIR/darwin/arm64/go.zip
|
||||
|
||||
rm -rf ./go
|
||||
rm -f darwin-go.zip go$GO_VER.darwin-$GO_ARCH_2.tar.gz
|
||||
rm -f darwin-go.zip go$GO_VER.darwin-arm64.tar.gz
|
||||
|
||||
# --- Linux (amd64) ---
|
||||
curl --output go$GO_VER.linux-$GO_ARCH_1.tar.gz https://dl.google.com/go/go$GO_VER.linux-$GO_ARCH_1.tar.gz
|
||||
tar xvf go$GO_VER.linux-$GO_ARCH_1.tar.gz
|
||||
curl --output go$GO_VER.linux-amd64.tar.gz https://dl.google.com/go/go$GO_VER.linux-amd64.tar.gz
|
||||
tar xvf go$GO_VER.linux-amd64.tar.gz
|
||||
cd go
|
||||
rm -rf $BLOAT_FILES
|
||||
rm -rf ./src
|
||||
rm -f ./pkg/tool/linux_$GO_ARCH_1/doc
|
||||
rm -f ./pkg/tool/linux_$GO_ARCH_1/tour
|
||||
rm -f ./pkg/tool/linux_$GO_ARCH_1/test2json
|
||||
rm -f ./pkg/tool/linux_amd64/doc
|
||||
rm -f ./pkg/tool/linux_amd64/tour
|
||||
rm -f ./pkg/tool/linux_amd64/test2json
|
||||
cd ..
|
||||
zip -r linux-go.zip ./go
|
||||
mkdir -p $OUTPUT_DIR/linux/$GO_ARCH_1
|
||||
cp -vv linux-go.zip $OUTPUT_DIR/linux/$GO_ARCH_1/go.zip
|
||||
mkdir -p $OUTPUT_DIR/linux/amd64
|
||||
cp -vv linux-go.zip $OUTPUT_DIR/linux/amd64/go.zip
|
||||
rm -rf ./go
|
||||
rm -f linux-go.zip go$GO_VER.linux-$GO_ARCH_1.tar.gz
|
||||
rm -f linux-go.zip go$GO_VER.linux-amd64.tar.gz
|
||||
|
||||
# --- Linux (arm64) ---
|
||||
curl --output go$GO_VER.linux-$GO_ARCH_2.tar.gz https://dl.google.com/go/go$GO_VER.linux-$GO_ARCH_2.tar.gz
|
||||
tar xvf go$GO_VER.linux-$GO_ARCH_2.tar.gz
|
||||
curl --output go$GO_VER.linux-arm64.tar.gz https://dl.google.com/go/go$GO_VER.linux-arm64.tar.gz
|
||||
tar xvf go$GO_VER.linux-arm64.tar.gz
|
||||
cd go
|
||||
rm -rf $BLOAT_FILES
|
||||
rm -rf ./src
|
||||
rm -f ./pkg/tool/linux_$GO_ARCH_2/doc
|
||||
rm -f ./pkg/tool/linux_$GO_ARCH_2/tour
|
||||
rm -f ./pkg/tool/linux_$GO_ARCH_2/test2json
|
||||
rm -f ./pkg/tool/linux_arm64/doc
|
||||
rm -f ./pkg/tool/linux_arm64/tour
|
||||
rm -f ./pkg/tool/linux_arm64/test2json
|
||||
cd ..
|
||||
zip -r linux-go.zip ./go
|
||||
mkdir -p $OUTPUT_DIR/linux/$GO_ARCH_2
|
||||
cp -vv linux-go.zip $OUTPUT_DIR/linux/$GO_ARCH_2/go.zip
|
||||
mkdir -p $OUTPUT_DIR/linux/arm64
|
||||
cp -vv linux-go.zip $OUTPUT_DIR/linux/arm64/go.zip
|
||||
rm -rf ./go
|
||||
rm -f linux-go.zip go$GO_VER.linux-$GO_ARCH_2.tar.gz
|
||||
rm -f linux-go.zip go$GO_VER.linux-arm64.tar.gz
|
||||
|
||||
# --- Windows ---
|
||||
curl --output go$GO_VER.windows-amd64.zip https://dl.google.com/go/go$GO_VER.windows-$GO_ARCH_1.zip
|
||||
curl --output go$GO_VER.windows-amd64.zip https://dl.google.com/go/go$GO_VER.windows-amd64.zip
|
||||
unzip go$GO_VER.windows-amd64.zip
|
||||
cd go
|
||||
rm -rf $BLOAT_FILES
|
||||
rm -rf ./src
|
||||
rm -f ./pkg/tool/windows_$GO_ARCH_1/doc.exe
|
||||
rm -f ./pkg/tool/windows_$GO_ARCH_1/tour.exe
|
||||
rm -f ./pkg/tool/windows_$GO_ARCH_1/test2json.exe
|
||||
rm -f ./pkg/tool/windows_amd64/doc.exe
|
||||
rm -f ./pkg/tool/windows_amd64/tour.exe
|
||||
rm -f ./pkg/tool/windows_amd64/test2json.exe
|
||||
cd ..
|
||||
zip -r windows-go.zip ./go
|
||||
mkdir -p $OUTPUT_DIR/windows/$GO_ARCH_1
|
||||
cp -vv windows-go.zip $OUTPUT_DIR/windows/$GO_ARCH_1/go.zip
|
||||
mkdir -p $OUTPUT_DIR/windows/amd64
|
||||
cp -vv windows-go.zip $OUTPUT_DIR/windows/amd64/go.zip
|
||||
rm -rf ./go
|
||||
rm -f windows-go.zip go$GO_VER.windows-$GO_ARCH_1.zip
|
||||
rm -f windows-go.zip go$GO_VER.windows-amd64.zip
|
||||
|
||||
echo "-----------------------------------------------------------------"
|
||||
echo " Garble"
|
||||
echo "-----------------------------------------------------------------"
|
||||
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux"
|
||||
curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux-$GO_ARCH_2"
|
||||
curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux-$GO_ARCH_2
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/garble.exe https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_windows.exe"
|
||||
curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/garble.exe https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_windows.exe
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_1/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-$GO_ARCH_1"
|
||||
curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_1/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-$GO_ARCH_1
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-$GO_ARCH_2"
|
||||
curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-$GO_ARCH_2
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/linux/amd64/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux"
|
||||
curl -L --fail --output $OUTPUT_DIR/linux/amd64/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/linux/arm64/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux-arm64"
|
||||
curl -L --fail --output $OUTPUT_DIR/linux/arm64/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux-arm64
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/windows/amd64/garble.exe https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_windows.exe"
|
||||
curl -L --fail --output $OUTPUT_DIR/windows/amd64/garble.exe https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_windows.exe
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/darwin/amd64/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-amd64"
|
||||
curl -L --fail --output $OUTPUT_DIR/darwin/amd64/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-amd64
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/darwin/arm64/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-arm64"
|
||||
curl -L --fail --output $OUTPUT_DIR/darwin/arm64/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-arm64
|
||||
|
||||
|
||||
echo "-----------------------------------------------------------------"
|
||||
@@ -171,24 +169,24 @@ echo " Shikata ga nai (ノ ゜Д゜)ノ ︵ 仕方がない"
|
||||
echo "-----------------------------------------------------------------"
|
||||
|
||||
# Linux (amd64)
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_1.zip"
|
||||
curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_1.zip
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/linux/amd64/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-amd64.zip"
|
||||
curl -L --fail --output $OUTPUT_DIR/linux/amd64/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-amd64.zip
|
||||
|
||||
# Linux (arm64)
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_2.zip"
|
||||
curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-$GO_ARCH_2.zip
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/linux/arm64/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-arm64.zip"
|
||||
curl -L --fail --output $OUTPUT_DIR/linux/arm64/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_linux-arm64.zip
|
||||
|
||||
# Windows (amd64)
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_windows-$GO_ARCH_1.zip"
|
||||
curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_windows-$GO_ARCH_1.zip
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/windows/amd64/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_windows-amd64.zip"
|
||||
curl -L --fail --output $OUTPUT_DIR/windows/amd64/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_windows-amd64.zip
|
||||
|
||||
# MacOS (amd64)
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_1.zip"
|
||||
curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_1/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_1.zip
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/darwin/amd64/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-amd64.zip"
|
||||
curl -L --fail --output $OUTPUT_DIR/darwin/amd64/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-amd64.zip
|
||||
|
||||
# MacOS (arm64)
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_2.zip"
|
||||
curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_2/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-$GO_ARCH_2.zip
|
||||
echo "curl -L --fail --output $OUTPUT_DIR/darwin/arm64/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-arm64.zip"
|
||||
curl -L --fail --output $OUTPUT_DIR/darwin/arm64/sgn.zip https://github.com/moloch--/sgn/releases/download/v$SGN_VER/sgn_macos-arm64.zip
|
||||
|
||||
# end
|
||||
echo -e "clean up: $WORK_DIR"
|
||||
|
||||
@@ -5102,13 +5102,14 @@ type MsfStagerReq struct {
|
||||
sizeCache protoimpl.SizeCache
|
||||
unknownFields protoimpl.UnknownFields
|
||||
|
||||
Arch string `protobuf:"bytes,1,opt,name=Arch,proto3" json:"Arch,omitempty"`
|
||||
Format string `protobuf:"bytes,2,opt,name=Format,proto3" json:"Format,omitempty"`
|
||||
Port uint32 `protobuf:"varint,3,opt,name=Port,proto3" json:"Port,omitempty"`
|
||||
Host string `protobuf:"bytes,4,opt,name=Host,proto3" json:"Host,omitempty"`
|
||||
OS string `protobuf:"bytes,5,opt,name=OS,proto3" json:"OS,omitempty"` // reserved for future usage
|
||||
Protocol StageProtocol `protobuf:"varint,6,opt,name=Protocol,proto3,enum=clientpb.StageProtocol" json:"Protocol,omitempty"`
|
||||
BadChars []string `protobuf:"bytes,7,rep,name=BadChars,proto3" json:"BadChars,omitempty"`
|
||||
Arch string `protobuf:"bytes,1,opt,name=Arch,proto3" json:"Arch,omitempty"`
|
||||
Format string `protobuf:"bytes,2,opt,name=Format,proto3" json:"Format,omitempty"`
|
||||
Port uint32 `protobuf:"varint,3,opt,name=Port,proto3" json:"Port,omitempty"`
|
||||
Host string `protobuf:"bytes,4,opt,name=Host,proto3" json:"Host,omitempty"`
|
||||
OS string `protobuf:"bytes,5,opt,name=OS,proto3" json:"OS,omitempty"` // reserved for future usage
|
||||
Protocol StageProtocol `protobuf:"varint,6,opt,name=Protocol,proto3,enum=clientpb.StageProtocol" json:"Protocol,omitempty"`
|
||||
BadChars []string `protobuf:"bytes,7,rep,name=BadChars,proto3" json:"BadChars,omitempty"`
|
||||
AdvOptions string `protobuf:"bytes,8,opt,name=AdvOptions,proto3" json:"AdvOptions,omitempty"`
|
||||
}
|
||||
|
||||
func (x *MsfStagerReq) Reset() {
|
||||
@@ -5192,6 +5193,13 @@ func (x *MsfStagerReq) GetBadChars() []string {
|
||||
return nil
|
||||
}
|
||||
|
||||
func (x *MsfStagerReq) GetAdvOptions() string {
|
||||
if x != nil {
|
||||
return x.AdvOptions
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
type MsfStager struct {
|
||||
state protoimpl.MessageState
|
||||
sizeCache protoimpl.SizeCache
|
||||
@@ -5240,8 +5248,7 @@ func (x *MsfStager) GetFile() *commonpb.File {
|
||||
}
|
||||
|
||||
// GetSystemReq - Client request to the server which is translated into
|
||||
//
|
||||
// InvokeSystemReq when sending to the implant.
|
||||
// InvokeSystemReq when sending to the implant.
|
||||
type GetSystemReq struct {
|
||||
state protoimpl.MessageState
|
||||
sizeCache protoimpl.SizeCache
|
||||
@@ -5306,8 +5313,7 @@ func (x *GetSystemReq) GetRequest() *commonpb.Request {
|
||||
}
|
||||
|
||||
// MigrateReq - Client request to the server which is translated into
|
||||
//
|
||||
// InvokeMigrateReq when sending to the implant.
|
||||
// InvokeMigrateReq when sending to the implant.
|
||||
type MigrateReq struct {
|
||||
state protoimpl.MessageState
|
||||
sizeCache protoimpl.SizeCache
|
||||
@@ -10024,7 +10030,7 @@ var file_clientpb_client_proto_rawDesc = []byte{
|
||||
0x65, 0x6e, 0x74, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x41, 0x72, 0x67, 0x75,
|
||||
0x6d, 0x65, 0x6e, 0x74, 0x73, 0x22, 0x22, 0x0a, 0x0c, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x63, 0x6f,
|
||||
0x64, 0x65, 0x52, 0x44, 0x49, 0x12, 0x12, 0x0a, 0x04, 0x44, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20,
|
||||
0x01, 0x28, 0x0c, 0x52, 0x04, 0x44, 0x61, 0x74, 0x61, 0x22, 0xc3, 0x01, 0x0a, 0x0c, 0x4d, 0x73,
|
||||
0x01, 0x28, 0x0c, 0x52, 0x04, 0x44, 0x61, 0x74, 0x61, 0x22, 0xe3, 0x01, 0x0a, 0x0c, 0x4d, 0x73,
|
||||
0x66, 0x53, 0x74, 0x61, 0x67, 0x65, 0x72, 0x52, 0x65, 0x71, 0x12, 0x12, 0x0a, 0x04, 0x41, 0x72,
|
||||
0x63, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x41, 0x72, 0x63, 0x68, 0x12, 0x16,
|
||||
0x0a, 0x06, 0x46, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
|
||||
@@ -10036,7 +10042,9 @@ var file_clientpb_client_proto_rawDesc = []byte{
|
||||
0x32, 0x17, 0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x70, 0x62, 0x2e, 0x53, 0x74, 0x61, 0x67,
|
||||
0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f,
|
||||
0x63, 0x6f, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x42, 0x61, 0x64, 0x43, 0x68, 0x61, 0x72, 0x73, 0x18,
|
||||
0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x42, 0x61, 0x64, 0x43, 0x68, 0x61, 0x72, 0x73, 0x22,
|
||||
0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x42, 0x61, 0x64, 0x43, 0x68, 0x61, 0x72, 0x73, 0x12,
|
||||
0x1e, 0x0a, 0x0a, 0x41, 0x64, 0x76, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x08, 0x20,
|
||||
0x01, 0x28, 0x09, 0x52, 0x0a, 0x41, 0x64, 0x76, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22,
|
||||
0x2f, 0x0a, 0x09, 0x4d, 0x73, 0x66, 0x53, 0x74, 0x61, 0x67, 0x65, 0x72, 0x12, 0x22, 0x0a, 0x04,
|
||||
0x46, 0x69, 0x6c, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x63, 0x6f, 0x6d,
|
||||
0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x46, 0x69, 0x6c, 0x65, 0x52, 0x04, 0x46, 0x69, 0x6c, 0x65,
|
||||
|
||||
@@ -446,6 +446,7 @@ message MsfStagerReq {
|
||||
string OS = 5; // reserved for future usage
|
||||
StageProtocol Protocol = 6;
|
||||
repeated string BadChars = 7;
|
||||
string AdvOptions = 8;
|
||||
}
|
||||
|
||||
message MsfStager { commonpb.File File = 1; }
|
||||
|
||||
@@ -131,9 +131,8 @@ func (x *Request) GetSessionID() string {
|
||||
}
|
||||
|
||||
// Response - Common fields used in all gRPC responses. Note that the Err field
|
||||
//
|
||||
// only used when the implant needs to return an error to the server.
|
||||
// Client<->Server comms should use normal gRPC error handling.
|
||||
// only used when the implant needs to return an error to the server.
|
||||
// Client<->Server comms should use normal gRPC error handling.
|
||||
type Response struct {
|
||||
state protoimpl.MessageState
|
||||
sizeCache protoimpl.SizeCache
|
||||
|
||||
@@ -87,10 +87,12 @@ func (DNSMessageType) EnumDescriptor() ([]byte, []int) {
|
||||
return file_dnspb_dns_proto_rawDescGZIP(), []int{0}
|
||||
}
|
||||
|
||||
// NOTE: DNS is very space sensitive so certain fields are re-purposed
|
||||
// depending on the DNSMessageType as noted below:
|
||||
//
|
||||
// [Type TOTP]: ID field is used for the TOTP code
|
||||
//NOTE: DNS is very space sensitive so certain fields are re-purposed
|
||||
//depending on the DNSMessageType as noted below:
|
||||
//
|
||||
//[Type TOTP]: ID field is used for the TOTP code
|
||||
//
|
||||
type DNSMessage struct {
|
||||
state protoimpl.MessageState
|
||||
sizeCache protoimpl.SizeCache
|
||||
|
||||
+325
-493
File diff suppressed because it is too large.
Load diff
@@ -173,8 +173,7 @@ func (PeerFailureType) EnumDescriptor() ([]byte, []int) {
|
||||
}
|
||||
|
||||
// Envelope - Used to encode implant<->server messages since we
|
||||
//
|
||||
// cannot use gRPC due to the various transports used.
|
||||
// cannot use gRPC due to the various transports used.
|
||||
type Envelope struct {
|
||||
state protoimpl.MessageState
|
||||
sizeCache protoimpl.SizeCache
|
||||
@@ -747,8 +746,7 @@ func (x *CloseSession) GetRequest() *commonpb.Request {
|
||||
}
|
||||
|
||||
// Ping - Not ICMP, just sends a rount trip message to an implant to
|
||||
//
|
||||
// see if it's still responding.
|
||||
// see if it's still responding.
|
||||
type Ping struct {
|
||||
state protoimpl.MessageState
|
||||
sizeCache protoimpl.SizeCache
|
||||
@@ -2936,8 +2934,7 @@ func (x *CurrentTokenOwner) GetResponse() *commonpb.Response {
|
||||
}
|
||||
|
||||
// InvokeGetSystemReq - Implant-side version of GetSystemReq, this message
|
||||
//
|
||||
// contains the .Data based on the client's req.Config
|
||||
// contains the .Data based on the client's req.Config
|
||||
type InvokeGetSystemReq struct {
|
||||
state protoimpl.MessageState
|
||||
sizeCache protoimpl.SizeCache
|
||||
|
||||
@@ -21,6 +21,7 @@ package msf
|
||||
import (
|
||||
"bytes"
|
||||
"fmt"
|
||||
"net/url"
|
||||
"os/exec"
|
||||
"strconv"
|
||||
"strings"
|
||||
@@ -113,6 +114,7 @@ type VenomConfig struct {
|
||||
BadChars []string
|
||||
Format string
|
||||
Luri string
|
||||
AdvOptions string
|
||||
}
|
||||
|
||||
// Version - Return the version of MSFVenom
|
||||
@@ -160,6 +162,20 @@ func VenomPayload(config VenomConfig) ([]byte, error) {
|
||||
luri = fmt.Sprintf("LURI=%s", luri)
|
||||
}
|
||||
|
||||
// Parse advanced options
|
||||
advancedOptions := make(map[string]string)
|
||||
if config.AdvOptions != "" {
|
||||
options, err := url.ParseQuery(config.AdvOptions)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("could not parse provided advanced options: %s", err.Error())
|
||||
}
|
||||
for option, value := range options {
|
||||
// Options should only be specified once,
|
||||
// so if a given option is specified more than once, use the last value
|
||||
advancedOptions[option] = value[len(value)-1]
|
||||
}
|
||||
}
|
||||
|
||||
args := []string{
|
||||
"--platform", config.Os,
|
||||
"--arch", config.Arch,
|
||||
@@ -170,6 +186,10 @@ func VenomPayload(config VenomConfig) ([]byte, error) {
|
||||
"EXITFUNC=thread",
|
||||
}
|
||||
|
||||
for optionName, optionValue := range advancedOptions {
|
||||
args = append(args, fmt.Sprintf("%s=%s", optionName, optionValue))
|
||||
}
|
||||
|
||||
if luri != "" {
|
||||
args = append(args, luri)
|
||||
}
|
||||
|
||||
+10
-9
@@ -38,7 +38,7 @@ import (
|
||||
)
|
||||
|
||||
var (
|
||||
msfLog = log.NamedLogger("rcp", "msf")
|
||||
msfLog = log.NamedLogger("rpc", "msf")
|
||||
)
|
||||
|
||||
// Msf - Helper function to execute MSF payloads on the remote system
|
||||
@@ -182,14 +182,15 @@ func (rpc *Server) MsfStage(ctx context.Context, req *clientpb.MsfStagerReq) (*c
|
||||
}
|
||||
|
||||
venomConfig := msf.VenomConfig{
|
||||
Os: req.GetOS(),
|
||||
Payload: payload,
|
||||
LHost: req.GetHost(),
|
||||
LPort: uint16(req.GetPort()),
|
||||
Arch: arch,
|
||||
Format: req.GetFormat(),
|
||||
BadChars: req.GetBadChars(), // TODO: make this configurable
|
||||
Luri: uri,
|
||||
Os: req.GetOS(),
|
||||
Payload: payload,
|
||||
LHost: req.GetHost(),
|
||||
LPort: uint16(req.GetPort()),
|
||||
Arch: arch,
|
||||
Format: req.GetFormat(),
|
||||
BadChars: req.GetBadChars(), // TODO: make this configurable
|
||||
Luri: uri,
|
||||
AdvOptions: req.AdvOptions,
|
||||
}
|
||||
|
||||
stage, err := msf.VenomPayload(venomConfig)
|
||||
|
||||
Reference in new issue
Block a user