Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implant file name issues #1856

Open
c2biz opened this issue Jan 15, 2025 · 0 comments
Open

Implant file name issues #1856

c2biz opened this issue Jan 15, 2025 · 0 comments

Comments

@c2biz
Copy link
Contributor

c2biz commented Jan 15, 2025

Describe the bug
rpc.Regenerate is returning the implant's name, not the filename.

To Reproduce
Two options:

  1. Generate an implant locally, then regenerate it: the filename will be missing its extension
  2. Generate an implant with an external builder: the external builder will compile the file with the correct filename, upload it as the implant name, and the server will write it to disk as the implant name

Steps to reproduce the behavior:

Option 1)

sliver > generate -e -G -b asdf.com --format shared -N mhylib

[*] Generating new windows/amd64 implant binary
[*] Symbol obfuscation is enabled
[*] Build completed in 6m6s
[*] Implant saved to /home/ubuntu/dev/sliver/mhylib.dll

sliver > implants

 Name     Implant Type   Template   OS/Arch             Format   Command & Control      Debug   C2 Config   ID      Stage
======== ============== ========== =============== ============ ====================== ======= =========== ======= =======
 mhylib   session        sliver     windows/amd64   SHARED_LIB   [1] https://asdf.com   false   default     20170   false

sliver > regenerate mhylib

[*] Implant binary saved to: /home/ubuntu/dev/sliver/mhylib

Option 2)

sliver > generate --os mac --format shared --http asdf.com --external-builder --arch arm64 -N mhymacho
[*] Using external builder: MacBook-Pro.local
[*] Externally generating new darwin/arm64 implant binary
[*] Symbol obfuscation is enabled
[*] Creating external build ...
[*] Build completed in 41s
[*] Build name: mhymacho (17687634 bytes)
[*] Implant saved to /home/ubuntu/dev/sliver/mhymacho

And on the builder side:

INFO[2025-01-15T11:23:01-05:00] [sliver/server/gogo/go.go:123] garble cmd: '/Users/jsmith/.sliver/go/bin/garble -seed=random -literals -tiny build -trimpath -ldflags  -buildmode=c-shared -o /Users/jsmith/.sliver/slivers/darwin/arm64/mhymacho/bin/mhymacho.dylib .'
INFO[2025-01-15T11:23:18-05:00] [sliver/server/builder/builder.go:232] Build completed successfully: /Users/jsmith/.sliver/slivers/darwin/arm64/mhymacho/bin/mhymacho.dylib
INFO[2025-01-15T11:23:18-05:00] [sliver/server/builder/builder.go:249] Uploading 'mhymacho' to server ...
INFO[2025-01-15T11:23:32-05:00] [sliver/server/builder/builder.go:270] All done, built and saved mhymacho

Expected behavior

  • regenerating an implant stores the file with its extension.
  • externally built implants are stored on the upstream server with its file extension

Desktop (please complete the following information):

  • Server OS: Ubuntu 22.04
  • mac builder OS: 15.1.1
  • sliver version: master
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant