SpecterOps / Nemesis

An offensive data enrichment pipeline
https://specterops.github.io/Nemesis/
Other
613 stars 59 forks source link

Sliver Connector #22

Open siesta888 opened 1 year ago

siesta888 commented 1 year ago

Would you all consider making the sliver connector in golang instead of python? If not, I'll probably make one myself and I'm happy to make a pull request.

Specifically I noticed this from the Sliver Connector README: See if you can pull agent ID. Doesn't seem possible from RPC endpoint

Using the official golang API from sliver, you can easily do something like the following:

event, err := eventStream.Recv()
        if err == io.EOF || event == nil {
            return
        }
        // Trigger event based on type
        switch event.EventType {

        case consts.LootAddedEvent:
            loot := &clientpb.Loot{}
            // Get the session object from the event
            session := event.Session
            // Print the session info
            logrus.Infof("New loot from session %s %s - %s (%s) - %s/%s", session.ID, session.Name, session.RemoteAddress, session.Hostname, session.OS, session.Arch)

            proto.Unmarshal(event.Data, loot)
            logrus.Infof("Loot %s: %s", loot.Name, loot.File.Name)

If you insist to use python, I think you can just access the Session via event.Session.ID and similar inside your on_loot_added function.

If you make the connector in python you dont need all the unnecessary python protobuf code and dependency issues. Just drop the golang bin in your docker container. A bonus is that it will support the native sliver multiplayer config file format instead of making users copy and paste their sliver config into the .env style connector config. That is very awkward.

Lastly it would be good if you indicate which version(s) of sliver this connector is intended to work with. I think the generate.sh script pulls from master/main but that's not the recommended branch per the sliver README. They recommende to use the tagged releases.

Cheers