BishopFox / sliver

Adversary Emulation Framework
GNU General Public License v3.0
8.54k stars 1.13k forks source link

Sliver rpc error: code = Unknown desc = exit status 1 (Attempting to Generate Wireguard Implant) #1553

Closed MidasJade closed 10 months ago

MidasJade commented 10 months ago

Describe the bug Trying to generate a Wireguard implant and getting the captioned error.

To Reproduce Steps to reproduce the behavior: sliver > generate --wg 10.10.10.10

[] Generated unique ip for wg peer tun interface: 100.64.0.2 [] Generating new windows/amd64 implant binary [*] Symbol obfuscation is enabled [!] rpc error: code = Unknown desc = exit status 1

sliver > generate --wg 10.10.10.10 --os windows --arch amd64

[] Generated unique ip for wg peer tun interface: 100.64.0.3 [] Generating new windows/amd64 implant binary [*] Symbol obfuscation is enabled [!] rpc error: code = Unknown desc = exit status 1

sliver > generate --wg 10.10.10.10 --os windows

[] Generated unique ip for wg peer tun interface: 100.64.0.4 [] Generating new windows/amd64 implant binary [*] Symbol obfuscation is enabled [!] rpc error: code = Unknown desc = exit status 1

Log Info: INFO[2024-01-13T11:16:29-05:00] [github.com/grpc-ecosystem/go-grpc-middleware@v1.4.0/logging/logrus/options.go:220] finished unary call with code OK WARN[2024-01-13T11:16:29-05:00] [sliver/server/generate/binaries.go:208] Name cannot be blank! INFO[2024-01-13T11:16:29-05:00] [sliver/server/certs/certs.go:140] Generating TLS certificate (ECC) for 'AGRICULTURAL_MUKLUK' ... INFO[2024-01-13T11:16:29-05:00] [sliver/server/certs/certs.go:65] Saving certificate for cn = 'AGRICULTURAL_MUKLUK' INFO[2024-01-13T11:16:29-05:00] [sliver/server/certs/wireguard.go:119] Generating wg keys INFO[2024-01-13T11:16:29-05:00] [sliver/server/certs/wireguard.go:133] Saving wg keys INFO[2024-01-13T11:16:29-05:00] [sliver/server/certs/wireguard.go:88] Getting wg keys for wg server INFO[2024-01-13T11:16:29-05:00] [sliver/server/configs/server.go:46] Loading config from /home/kali/.sliver/configs/server.json INFO[2024-01-13T11:16:29-05:00] [sliver/server/configs/server.go:46] Loading config from /home/kali/.sliver/configs/server.json INFO[2024-01-13T11:16:29-05:00] [sliver/server/configs/server.go:153] Saving config to /home/kali/.sliver/configs/server.json INFO[2024-01-13T11:16:29-05:00] [sliver/server/gogo/go.go:164] go cmd: '/home/kali/.sliver/go/bin/go tool dist list' INFO[2024-01-13T11:16:30-05:00] [sliver/server/assets/assets.go:249] Creating GOPATH directory: /home/kali/.sliver/slivers/windows/amd64/AGRICULTURAL_MUKLUK/src WARN[2024-01-13T11:16:30-05:00] [sliver/server/generate/canaries.go:70] No parent domains WARN[2024-01-13T11:16:30-05:00] [sliver/server/generate/canaries.go:70] No parent domains INFO[2024-01-13T11:16:30-05:00] [sliver/server/generate/binaries.go:608] Rendering go.mod file ... INFO[2024-01-13T11:16:30-05:00] [sliver/server/gogo/go.go:164] go cmd: '/home/kali/.sliver/go/bin/go tool dist list' INFO[2024-01-13T11:16:30-05:00] [sliver/server/gogo/go.go:164] go cmd: '/home/kali/.sliver/go/bin/go tool dist list' INFO[2024-01-13T11:16:30-05:00] [sliver/server/gogo/go.go:126] garble cmd: '/home/kali/.sliver/go/bin/garble -seed=random -literals -tiny build -trimpath -ldflags -s -w -buildid= -H=windowsgui -o /home/kali/.sliver/slivers/windows/amd64/AGRICULTURAL_MUKLUK/bin/AGRICULTURAL_MUKLUK.exe .' ERRO[2024-01-13T11:16:46-05:00] [sliver/server/gogo/go.go:133] --- stdout ---

ERRO[2024-01-13T11:16:46-05:00] [sliver/server/gogo/go.go:134] --- stderr --- -seed chosen at random: ozHgPYVQRDp7UKetqVEMrg

github.com/bishopfox/sliver/implant/sliver/netstack

implant/sliver/netstack/tun.go:144:9: pkt.IsNil undefined (type *stack.PacketBuffer has no field or method IsNil)

ERRO[2024-01-13T11:16:46-05:00] [sliver/server/gogo/go.go:135] exit status 1 ERRO[2024-01-13T11:16:46-05:00] [github.com/grpc-ecosystem/go-grpc-middleware@v1.4.0/logging/logrus/options.go:224] finished unary call with code Unknown INFO[2024-01-13T11:21:03-05:00] [github.com/grpc-ecosystem/go-grpc-middleware@v1.4.0/logging/logrus/options.go:220] finished unary call with code OK WARN[2024-01-13T11:21:03-05:00] [sliver/server/generate/binaries.go:208] Name cannot be blank! INFO[2024-01-13T11:21:03-05:00] [sliver/server/certs/certs.go:140] Generating TLS certificate (ECC) for 'STRAIGHT_TAM' ... INFO[2024-01-13T11:21:03-05:00] [sliver/server/certs/certs.go:65] Saving certificate for cn = 'STRAIGHT_TAM' INFO[2024-01-13T11:21:03-05:00] [sliver/server/certs/wireguard.go:119] Generating wg keys INFO[2024-01-13T11:21:03-05:00] [sliver/server/certs/wireguard.go:133] Saving wg keys INFO[2024-01-13T11:21:03-05:00] [sliver/server/certs/wireguard.go:88] Getting wg keys for wg server INFO[2024-01-13T11:21:03-05:00] [sliver/server/configs/server.go:46] Loading config from /home/kali/.sliver/configs/server.json INFO[2024-01-13T11:21:03-05:00] [sliver/server/configs/server.go:46] Loading config from /home/kali/.sliver/configs/server.json INFO[2024-01-13T11:21:03-05:00] [sliver/server/configs/server.go:153] Saving config to /home/kali/.sliver/configs/server.json INFO[2024-01-13T11:21:03-05:00] [sliver/server/gogo/go.go:164] go cmd: '/home/kali/.sliver/go/bin/go tool dist list' INFO[2024-01-13T11:21:03-05:00] [sliver/server/assets/assets.go:249] Creating GOPATH directory: /home/kali/.sliver/slivers/windows/amd64/STRAIGHT_TAM/src WARN[2024-01-13T11:21:03-05:00] [sliver/server/generate/canaries.go:70] No parent domains WARN[2024-01-13T11:21:03-05:00] [sliver/server/generate/canaries.go:70] No parent domains INFO[2024-01-13T11:21:03-05:00] [sliver/server/generate/binaries.go:608] Rendering go.mod file ... INFO[2024-01-13T11:21:03-05:00] [sliver/server/gogo/go.go:164] go cmd: '/home/kali/.sliver/go/bin/go tool dist list' INFO[2024-01-13T11:21:03-05:00] [sliver/server/gogo/go.go:164] go cmd: '/home/kali/.sliver/go/bin/go tool dist list' INFO[2024-01-13T11:21:03-05:00] [sliver/server/gogo/go.go:126] garble cmd: '/home/kali/.sliver/go/bin/garble -seed=random -literals -tiny build -trimpath -ldflags -s -w -buildid= -H=windowsgui -o /home/kali/.sliver/slivers/windows/amd64/STRAIGHT_TAM/bin/STRAIGHT_TAM.exe .' ERRO[2024-01-13T11:21:04-05:00] [sliver/server/gogo/go.go:133] --- stdout ---

ERRO[2024-01-13T11:21:04-05:00] [sliver/server/gogo/go.go:134] --- stderr --- -seed chosen at random: ImX5FdJDtJIsEmmUFHxHKg

github.com/bishopfox/sliver/implant/sliver/netstack

implant/sliver/netstack/tun.go:144:9: pkt.IsNil undefined (type *stack.PacketBuffer has no field or method IsNil)

ERRO[2024-01-13T11:21:04-05:00] [sliver/server/gogo/go.go:135] exit status 1 ERRO[2024-01-13T11:21:04-05:00] [github.com/grpc-ecosystem/go-grpc-middleware@v1.4.0/logging/logrus/options.go:224] finished unary call with code Unknown INFO[2024-01-13T11:21:09-05:00] [github.com/grpc-ecosystem/go-grpc-middleware@v1.4.0/logging/logrus/options.go:220] finished unary call with code OK WARN[2024-01-13T11:21:09-05:00] [sliver/server/generate/binaries.go:208] Name cannot be blank! INFO[2024-01-13T11:21:09-05:00] [sliver/server/certs/certs.go:140] Generating TLS certificate (ECC) for 'VISITING_ASSISTANT' ... INFO[2024-01-13T11:21:09-05:00] [sliver/server/certs/certs.go:65] Saving certificate for cn = 'VISITING_ASSISTANT' INFO[2024-01-13T11:21:09-05:00] [sliver/server/certs/wireguard.go:119] Generating wg keys INFO[2024-01-13T11:21:09-05:00] [sliver/server/certs/wireguard.go:133] Saving wg keys INFO[2024-01-13T11:21:09-05:00] [sliver/server/certs/wireguard.go:88] Getting wg keys for wg server INFO[2024-01-13T11:21:09-05:00] [sliver/server/configs/server.go:46] Loading config from /home/kali/.sliver/configs/server.json INFO[2024-01-13T11:21:09-05:00] [sliver/server/configs/server.go:46] Loading config from /home/kali/.sliver/configs/server.json INFO[2024-01-13T11:21:09-05:00] [sliver/server/configs/server.go:153] Saving config to /home/kali/.sliver/configs/server.json INFO[2024-01-13T11:21:09-05:00] [sliver/server/gogo/go.go:164] go cmd: '/home/kali/.sliver/go/bin/go tool dist list' INFO[2024-01-13T11:21:09-05:00] [sliver/server/assets/assets.go:249] Creating GOPATH directory: /home/kali/.sliver/slivers/windows/amd64/VISITING_ASSISTANT/src WARN[2024-01-13T11:21:09-05:00] [sliver/server/generate/canaries.go:70] No parent domains WARN[2024-01-13T11:21:09-05:00] [sliver/server/generate/canaries.go:70] No parent domains INFO[2024-01-13T11:21:09-05:00] [sliver/server/generate/binaries.go:608] Rendering go.mod file ... INFO[2024-01-13T11:21:09-05:00] [sliver/server/gogo/go.go:164] go cmd: '/home/kali/.sliver/go/bin/go tool dist list' INFO[2024-01-13T11:21:09-05:00] [sliver/server/gogo/go.go:164] go cmd: '/home/kali/.sliver/go/bin/go tool dist list' INFO[2024-01-13T11:21:09-05:00] [sliver/server/gogo/go.go:126] garble cmd: '/home/kali/.sliver/go/bin/garble -seed=random -literals -tiny build -trimpath -ldflags -s -w -buildid= -H=windowsgui -o /home/kali/.sliver/slivers/windows/amd64/VISITING_ASSISTANT/bin/VISITING_ASSISTANT.exe .' ERRO[2024-01-13T11:21:10-05:00] [sliver/server/gogo/go.go:133] --- stdout ---

ERRO[2024-01-13T11:21:10-05:00] [sliver/server/gogo/go.go:134] --- stderr --- -seed chosen at random: 5aN7fO/Zun42dfvXhgqwFw

github.com/bishopfox/sliver/implant/sliver/netstack

implant/sliver/netstack/tun.go:144:9: pkt.IsNil undefined (type *stack.PacketBuffer has no field or method IsNil)

ERRO[2024-01-13T11:21:10-05:00] [sliver/server/gogo/go.go:135] exit status 1 ERRO[2024-01-13T11:21:10-05:00] [github.com/grpc-ecosystem/go-grpc-middleware@v1.4.0/logging/logrus/options.go:224] finished unary call with code Unknown

Expected behavior I'm able to generate http and mtls implants. Verified wireguard-tools is installed if that matters: ┌──(kali㉿kali)-[~/.sliver/logs] └─$ sudo apt list --installed | grep wireguard [sudo] password for kali:

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

python3-mitmproxy-wireguard/kali-rolling,now 0.1.18-0kali2 amd64 [installed,automatic] wireguard-tools/kali-rolling,now 1.0.20210914-1+b1 amd64 [installed]

Desktop (please complete the following information):

UPDATE: I just built a new Kali VM from scratch, fully updated, installed sliver with apt. Same errors. Then reverted VM and installed sliver using the curl command to your install piped to bash. Same errors.

moloch-- commented 10 months ago

We don't maintain the apt version of Sliver, you should file a bug with the Kali tracker.

MidasJade commented 10 months ago

I added an edit at the very end. Sorry, I should have put it at the top. I tried both the apt version and then reverted the VM and tried the one straight from the repo. Both gave me the same error.

RafBishopFox commented 10 months ago

@MidasJade - I cannot replicate what you are seeing. I started with a fresh Kali install and installed Sliver using the bash script.

$ lsb_release -a
No LSB modules are available.
Distributor ID: Kali
Description:    Kali GNU/Linux Rolling
Release:        2023.4
Codename:       kali-rolling

Command:

$ sliver-client                                                                                                                                                                                                                                                                                              
Connecting to localhost:31337 ...                                                                                                                                                                                                                                                                              

    ███████╗██╗     ██╗██╗   ██╗███████╗██████╗                                                                                                                                                                                                                                                                
    ██╔════╝██║     ██║██║   ██║██╔════╝██╔══██╗                                                                                                                                                                                                                                                               
    ███████╗██║     ██║██║   ██║█████╗  ██████╔╝                                                                                                                                                                                                                                                               
    ╚════██║██║     ██║╚██╗ ██╔╝██╔══╝  ██╔══██╗                                                                                                                                                                                                                                                               
    ███████║███████╗██║ ╚████╔╝ ███████╗██║  ██║                                                                                                                                                                                                                                                               
    ╚══════╝╚══════╝╚═╝  ╚═══╝  ╚══════╝╚═╝  ╚═╝                                                                                                                                                                                                                                                               

All hackers gain ninjitsu                                                                                                                                                                                                                                                                                      
[*] Server v1.5.41 - f2a3915c79b31ab31c0c2f0428bbd53d9e93c54b
[*] Welcome to the sliver shell, please type 'help' for options

[*] Check for updates with the 'update' command

sliver > generate --wg 10.10.10.10 --os windows                            

[*] Generated unique ip for wg peer tun interface: 100.64.0.2
[*] Generating new windows/amd64 implant binary                            
[*] Symbol obfuscation is enabled                  
[*] Build completed in 45s                                                 
[*] Implant saved to /home/user/SOLID_SASH.exe

Logs:

INFO[2024-01-15T13:45:45-05:00] [sliver/server/certs/certs.go:140] Generating TLS certificate (ECC) for 'SOLID_SASH' ...                                                                                                                                                                                       
INFO[2024-01-15T13:45:45-05:00] [sliver/server/certs/certs.go:65] Saving certificate for cn = 'SOLID_SASH'                                    
INFO[2024-01-15T13:45:45-05:00] [sliver/server/certs/wireguard.go:119] Generating wg keys                                                                                                                                                                                                                      
INFO[2024-01-15T13:45:45-05:00] [sliver/server/certs/wireguard.go:133] Saving wg keys                                   
INFO[2024-01-15T13:45:45-05:00] [sliver/server/certs/wireguard.go:88] Getting wg keys for wg server 
INFO[2024-01-15T13:45:45-05:00] [sliver/server/configs/server.go:46] Loading config from /root/.sliver/configs/server.json 
INFO[2024-01-15T13:45:45-05:00] [sliver/server/configs/server.go:46] Loading config from /root/.sliver/configs/server.json 
INFO[2024-01-15T13:45:45-05:00] [sliver/server/configs/server.go:153] Saving config to /root/.sliver/configs/server.json 
INFO[2024-01-15T13:45:45-05:00] [sliver/server/gogo/go.go:164] go cmd: '/root/.sliver/go/bin/go tool dist list' 
INFO[2024-01-15T13:45:45-05:00] [sliver/server/assets/assets.go:249] Creating GOPATH directory: /root/.sliver/slivers/windows/amd64/SOLID_SASH/src 
WARN[2024-01-15T13:45:45-05:00] [sliver/server/generate/canaries.go:70] No parent domains 
WARN[2024-01-15T13:45:45-05:00] [sliver/server/generate/canaries.go:70] No parent domains 
INFO[2024-01-15T13:45:45-05:00] [sliver/server/generate/binaries.go:608] Rendering go.mod file ... 
INFO[2024-01-15T13:45:45-05:00] [sliver/server/gogo/go.go:164] go cmd: '/root/.sliver/go/bin/go tool dist list' 
INFO[2024-01-15T13:45:45-05:00] [sliver/server/gogo/go.go:164] go cmd: '/root/.sliver/go/bin/go tool dist list' 
INFO[2024-01-15T13:45:45-05:00] [sliver/server/gogo/go.go:126] garble cmd: '/root/.sliver/go/bin/garble -seed=random -literals -tiny build -trimpath -ldflags -s -w -buildid= -H=windowsgui -o /root/.sliver/slivers/windows/amd64/SOLID_SASH/bin/SOLID_SASH.exe .' 
INFO[2024-01-15T13:46:29-05:00] [sliver/server/generate/implants.go:102] 50543b00-d472-4f94-981d-3aa327671f4c -> SOLID_SASH 
INFO[2024-01-15T13:46:29-05:00] [github.com/grpc-ecosystem/go-grpc-middleware@v1.4.0/logging/logrus/options.go:220] finished unary call with code OK

When you reverted the VM, had you ever installed Sliver in the past? I wonder if there is some old code or an old binary hanging around.

MidasJade commented 10 months ago

@RafBishopFox - I just tried a fresh install of Ubuntu and can't duplicate. I then grabbed the latest Kali iso and installed from the sliver install script and can't duplicate. I verified my VM snapshot does not have sliver installed but there must be an artifact there somewhere that's messing with it. I apologize for the false alarm but appreciate you all taking the time to look.

rkervella commented 10 months ago

Closing since it seems there's no issue in the end.