moloch-- / sliver-py

A Python gRPC Client Library for Sliver
GNU General Public License v3.0
65 stars 13 forks source link

Add extension commands #39

Closed zimnyaa closed 1 year ago

zimnyaa commented 1 year ago

The commit adds list_extensions/register_extension/call_extension to work with extensions. This is a simple wrapper for the three respective RPC calls. Does not implement BOF logic, the user will need to pack arguments for COFFLoader's LoadAndRun export manually like so:

    interact = await client.interact_session(sessions[0].ID)
    extensions = await interact.list_extensions()

    if "coff-loader" not in extensions.Names:
        with open("COFFLoader.x64.dll", 'rb') as f:
            coffloaderdata = f.read()
        await interact.register_extension("coff-loader", coffloaderdata, sessions[0].OS, None)

    with open("probe.x64.o", 'rb') as f:
        bofdata = f.read()

    bofparams = BeaconPack()
    bofparams.addstr("1.1.1.1")
    bofparams.addint(80)
    bofbuffer = bofparams.getbuffer() # 1.1.1.1:80

    coffloader_params = BeaconPack()
    coffloader_params.addstr("go")
    coffloader_params.addstr(bofdata)
    coffloader_params.addstr(bofbuffer)

    coffloader_buffer = coffloader_params.getbuffer()

    call_result = await interact.call_extension("coff-loader", "LoadAndRun", coffloader_buffer)