BishopFox / sliver

Adversary Emulation Framework
GNU General Public License v3.0
8.55k stars 1.13k forks source link

No --save flag when using nanodump BOF extension #1163

Open Darktortue opened 1 year ago

Darktortue commented 1 year ago

Is your feature request related to a problem? Please describe. I wanted to try the fileless argument while using the nanodump BOF but it just prints the entire file in stdout which makes it very complicated to paste afterwards.

Describe the solution you'd like Put (back) the -s, --save flag to save the output to disk (this is described in wiki but not implemented).

Describe alternatives you've considered

sliver (session1) > nanodump PID SuperFile 0 ABCD > outputfile.txt

Ofc it doesn't work.

Additional context Maybe I'm missing something but I can't find a way to do this properly.

sliver (session1) > help nanodump

A Beacon Object File that creates a minidump of the LSASS process.

Usage:
======
  nanodump [flags] pid dump-name write-file signature

Args:
=====
  pid         int       The PID of the process you want to dump.
  dump-name   string    The name of the dump file.
  write-file  int       1 = write file, 0 = fileless
  signature   string    Signature used for evasion, PMDM = default

Flags:
======
  -h, --help           display help
  -t, --timeout int    command timeout in seconds (default: 60)

sliver (session1) > nanodump --save test.txt PID SuperFile 0 ABCD
error: invalid flag: --save
rkervella commented 1 year ago

It's a known issue and fixing that will be part of a larger effort to allow extensions and BOFs to stream back output to the server. Right now it's kinda hackish.