search

BishopFox / sliver

Adversary Emulation Framework
GNU General Public License v3.0
8.38k stars 1.1k forks source link

Implant - Proxy Aware #511

Closed b4b857f6ee closed 3 years ago

b4b857f6ee commented 3 years ago

Describe the bug Hello, Quick question, after i've read the documentation and try to find the info in this issues, i can't find if the implants are proxy aware? I think they are not right?

Thank you for your answer

moloch-- commented 3 years ago

Implants are proxy aware in most cases, internally we use https://github.com/rapid7/go-get-proxied to determine the proxy settings. If we detect a proxy we'll try to connect using it, however if that connection fails the implant will also attempt to connect directly/ignore the proxy before giving up and rotating to the next C2.

b4b857f6ee commented 3 years ago

Ok, great, i've read one line about this go, but i was not sure if this was effective or not. Thank you for your very QUICK answer :D!! BTW : If i configure multiple domain, the implant is going to check each one at the start or just the first and if it's work, stay with it? I got this problem with poshC2 so during readteam exercice they can see all the domain in the first communication ^^.

Thank you for you answer.

moloch-- commented 3 years ago

In the current release version (v1.4.21) the implant will only fallback on connection errors, in the upcoming v1.5.0 release we're adding support for different types of connection strategies that are configurable.

b4b857f6ee commented 3 years ago

In the current release version (v1.4.21) the implant will only fallback on connection errors, in the upcoming v1.5.0 release we're adding support for different types of connection strategies that are configurable.

Waou, this is F**** awesome. Keep the good work!