search

BishopFox / sliver

Adversary Emulation Framework
GNU General Public License v3.0
8.39k stars 1.11k forks source link

History of Commands Sent to Sliver #272

Closed Matir closed 2 years ago

Matir commented 4 years ago

Is your feature request related to a problem? Please describe. It is nice to see what commands have been executed against a particular sliver agent, especially when in multiplayer mode. Results would be nice too.

Describe the solution you'd like Be able to run a command (e.g., history) on a sliver and see a history of the commands sent to the sliver, the results of those commands, etc.

Describe alternatives you've considered Logfiles have some information, but not all of this.

rkervella commented 4 years ago

Log files should have all the information, as we log both the RPC calls made as well as their output. It's just not really convenient to parse. One thing to also keep in mind: depending on which command you run, the output can be really consequent, so displaying it might not help a lot.

Matir commented 4 years ago

One thing to also keep in mind: depending on which command you run, the output can be really consequent, so displaying it might not help a lot.

I'm not sure what you mean by that?

You're right, logfiles do have all the information, sorry. It's just pretty difficult to get to. I think this would be a really nice to have feature, especially as the DB support gets fleshed out.

rkervella commented 4 years ago

I'm not sure what you mean by that?

Let's say you run execute-assembly Seatbelt.exe -group=all -full, the output can be massive. A few commands like that, you'll probably explode your terminal output buffer, making such a feature a bit counter intuitive. A solution could be to let the user decide whether they want to also show the output, or have some kind of replay feature where they could select a command and see its output.

Matir commented 4 years ago

Ah, thanks, yes this makes sense.

I think a history command similar to shell history (but maybe also including the success/failure, etc.) is a start, and then a command like get-output or something to dump the output for a single command makes sense.

On Tue, Oct 20, 2020 at 1:35 PM Ronan Kervella notifications@github.com wrote:

I'm not sure what you mean by that?

Let's say you run execute-assembly Seatbelt.exe -group=all -full, the output can be massive. A few commands like that, you'll probably explode your terminal output buffer, making such a feature a bit counter intuitive. A solution could be to let the user decide whether they want to also show the output, or have some kind of replay feature where they could select a command and see its output.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/BishopFox/sliver/issues/272#issuecomment-713123877, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAGFQAFHRHNKVFDK2H4CKXTSLXYADANCNFSM4SYUJI6A .

-- David Tomaschik https://systemoverlord.com david@systemoverlord.com 7FD5 8D9A 196D CEEE AD67 1F94 F4D7 A791 5DEA 789B

moloch-- commented 3 years ago

@Matir I've nearly completed work on porting the Sliver server to using GORM/SQL, which should lay the groundwork for implementing this shortly after.

mubix commented 3 years ago

Looking forward to this feature :)

moloch-- commented 2 years ago

Beacons implement this feature in v1.5