core

Documentation

Index

• Variables
• func EnvelopeID() uint64
• func NewTunnelID() uint64
• func NextJobID() int
• func NextSessionID() uint32
• type Client
  • func NewClient(operatorName string) *Client
  • func (c *Client) ToProtobuf() *clientpb.Client
• type Event
• type Job
  • func (j *Job) ToProtobuf() *clientpb.Job
• type Session
  • func (s *Session) Request(msgType uint32, timeout time.Duration, data []byte) ([]byte, error)
  • func (s *Session) ToProtobuf() *clientpb.Session
  • func (s *Session) UpdateCheckin()
• type Tunnel

Variables

var (
	// Sessions - Manages implant connections
	Sessions = &sessions{
		sessions: map[uint32]*Session{},
		mutex:    &sync.RWMutex{},
	}

	// ErrUnknownMessageType - Returned if the implant did not understand the message for
	//                         example when the command is not supported on the platform
	ErrUnknownMessageType = errors.New("Unknown message type")

	// ErrImplantTimeout - The implant did not respond prior to timeout deadline
	ErrImplantTimeout = errors.New("Implant timeout")
)

var (
	// Tunnels - Interating with duplex tunnels
	Tunnels = tunnels{
			// contains filtered or unexported fields
	}

	// ErrInvalidTunnelID - Invalid tunnel ID value
	ErrInvalidTunnelID = errors.New("Invalid tunnel ID")
)

var (
	// Clients - Manages client active
	Clients = &clients{
		active: map[int]*Client{},
		mutex:  &sync.Mutex{},
	}
)

var (
	// EventBroker - Distributes event messages
	EventBroker = newBroker()
)

var (
	// Jobs - Holds pointers to all the current jobs
	Jobs = &jobs{
		active: map[int]*Job{},
		mutex:  &sync.RWMutex{},
	}
)

Functions

func EnvelopeID

func EnvelopeID() uint64

EnvelopeID - Generate random ID of 8 bytes

func NewTunnelID

func NewTunnelID() uint64

NewTunnelID - New 64-bit identifier

func NextJobID

func NextJobID() int

NextJobID - Returns an incremental nonce as an id

func NextSessionID

func NextSessionID() uint32

NextSessionID - Returns an incremental nonce as an id

Types

type Client

type Client struct {
	ID       int
	Operator *clientpb.Operator
}

Client - Single client connection

func NewClient

func NewClient(operatorName string) *Client

NewClient - Create a new client object

func (*Client) ToProtobuf

func (c *Client) ToProtobuf() *clientpb.Client

ToProtobuf - Get the protobuf version of the object

type Event

type Event struct {
	Session *Session
	Job     *Job
	Client  *Client

	EventType string

	Data []byte
	Err  error
}

Event - An event is fired when there's a state change involving a

session, job, or client.

type Job

type Job struct {
	ID           int
	Name         string
	Description  string
	Protocol     string
	Port         uint16
	Domains      []string
	JobCtrl      chan bool
	PersistentID string
}

Job - Manages background jobs

func (*Job) ToProtobuf

func (j *Job) ToProtobuf() *clientpb.Job

ToProtobuf - Get the protobuf version of the object

type Session

type Session struct {
	ID                uint32
	Name              string
	Hostname          string
	Username          string
	UUID              string
	UID               string
	GID               string
	Os                string
	Version           string
	Arch              string
	Transport         string
	RemoteAddress     string
	PID               int32
	Filename          string
	LastCheckin       *time.Time
	Send              chan *sliverpb.Envelope
	Resp              map[uint64]chan *sliverpb.Envelope
	RespMutex         *sync.RWMutex
	ActiveC2          string
	IsDead            bool
	ReconnectInterval uint32
	ProxyURL          string
}

Session - Represents a connection to an implant

func (*Session) Request

func (s *Session) Request(msgType uint32, timeout time.Duration, data []byte) ([]byte, error)

Request - Sends a protobuf request to the active sliver and returns the response

func (*Session) ToProtobuf

func (s *Session) ToProtobuf() *clientpb.Session

ToProtobuf - Get the protobuf version of the object

func (*Session) UpdateCheckin

func (s *Session) UpdateCheckin()

UpdateCheckin - Update a session's checkin time

type Tunnel

type Tunnel struct {
	ID        uint64
	SessionID uint32

	ToImplant         chan []byte
	ToImplantSequence uint64

	FromImplant         chan *sliverpb.TunnelData
	FromImplantSequence uint64

	Client rpcpb.SliverRPC_TunnelDataServer
}

Tunnel - Essentially just a mapping between a specific client and sliver with an identifier, these tunnels are full duplex. The server doesn't really care what data gets passed back and forth it just facilitates the connection