search

BishopFox / sliver

Adversary Emulation Framework
GNU General Public License v3.0
8.2k stars 1.08k forks source link

BOFs with fileless data transfer capabilities #602

Open cmprmsd opened 2 years ago

cmprmsd commented 2 years ago

Describe the bug I don't own a copy of Cobalt Strike but for nanodump.o (BOF) in Sliver's armory, there is a fileless option for which you at least have the write-file setting in its extension.json.

Is a feature planned to handle the implant-C2-channel data transfer or even already implemented?

Expected behavior When running BOFs with fileless capabilities the output file(s) should be transferred to the operator and downloaded to the client's cwd.

Desktop (please complete the following information):

rkervella commented 2 years ago

Yeah that's a known "bug", I need to look on how to support that.

rkervella commented 2 years ago

Ok looks like we just need to implement the BeaconOutput function as a Go callback and wire it to the implant handler.

cmprmsd commented 2 years ago

Hehe, yes I wasn't sure if it better fitted to bug or feature request as it is at least mentioned in the setting flags. :sweat_smile: Feel free to label it feature request :)