Is your feature request related to a problem? Please describe.
I wanted to try the fileless argument while using the nanodump BOF but it just prints the entire file in stdout which makes it very complicated to paste afterwards.
Describe the solution you'd like
Put (back) the -s, --save flag to save the output to disk (this is described in wiki but not implemented).
Additional context
Maybe I'm missing something but I can't find a way to do this properly.
sliver (session1) > help nanodump
A Beacon Object File that creates a minidump of the LSASS process.
Usage:
======
nanodump [flags] pid dump-name write-file signature
Args:
=====
pid int The PID of the process you want to dump.
dump-name string The name of the dump file.
write-file int 1 = write file, 0 = fileless
signature string Signature used for evasion, PMDM = default
Flags:
======
-h, --help display help
-t, --timeout int command timeout in seconds (default: 60)
sliver (session1) > nanodump --save test.txt PID SuperFile 0 ABCD
error: invalid flag: --save
It's a known issue and fixing that will be part of a larger effort to allow extensions and BOFs to stream back output to the server. Right now it's kinda hackish.
Is your feature request related to a problem? Please describe. I wanted to try the fileless argument while using the nanodump BOF but it just prints the entire file in stdout which makes it very complicated to paste afterwards.
Describe the solution you'd like Put (back) the
-s, --save
flag to save the output to disk (this is described in wiki but not implemented).Describe alternatives you've considered
Ofc it doesn't work.
Additional context Maybe I'm missing something but I can't find a way to do this properly.