Merge pull request #2166 from BishopFox/linux/shellcode

Linux/shellcode

Author: moloch--

client/command/generate/commands.go

@@ -343,13 +343,14 @@ func coreImplantFlags(name string, cmd *cobra.Command) {
 		f.StringP("limit-fileexists", "F", "", "limit execution to hosts with this file in the filesystem")
 		f.StringP("limit-locale", "L", "", "limit execution to hosts that match this locale")
 
-		f.StringP("format", "f", "exe", "Specifies the output formats, valid values are: 'exe', 'shared' (for dynamic libraries), 'service' (see: `psexec` for more info) and 'shellcode' (windows and darwin/arm64)")
+		f.StringP("format", "f", "exe", "Specifies the output formats, valid values are: 'exe', 'shared' (for dynamic libraries), 'service' (see: `psexec` for more info) and 'shellcode' (windows, darwin/arm64, linux/amd64, linux/arm64)")
 
 		// Shellcode generation options:
 		// - Windows: Donut
 		// - macOS: beignet
+		// - Linux: malasada
 		f.Uint32("shellcode-entropy", 1, "Shellcode entropy (Donut: 1=none, 2=random names, 3=random+encrypt) (windows shellcode only)")
-		f.Bool("shellcode-compress", false, "Enable shellcode compression (aPLib) (windows and macOS shellcode)")
+		f.Bool("shellcode-compress", false, "Enable shellcode compression (aPLib) (windows, macOS, and Linux shellcode)")
 		f.Uint32("shellcode-exitopt", 1, "Shellcode exit option (Donut: 1=exit thread, 2=exit process, 3=block) (windows shellcode only)")
 		f.Uint32("shellcode-bypass", 3, "Shellcode bypass mode (Donut: 1=none, 2=abort, 3=continue) (windows shellcode only)")
 		f.Uint32("shellcode-headers", 1, "Shellcode headers handling (Donut: 1=overwrite, 2=keep) (windows shellcode only)")

client/command/generate/generate.go

@@ -80,6 +80,7 @@ var (
 		"darwin/arm64":  true,
 		"linux/386":     true,
 		"linux/amd64":   true,
+		"linux/arm64":   true,
 		"windows/386":   true,
 		"windows/amd64": true,
 	}
@@ -394,12 +395,25 @@ func parseCompileFlags(cmd *cobra.Command, con *console.SliverClient) (string, *
 		return "", nil
 	}
 	if configFormat == clientpb.OutputFormat_SHELLCODE {
-		if targetOS != "windows" && targetOS != "darwin" {
-			con.PrintErrorf("Shellcode format is currently only supported on Windows and macOS\n")
-			return "", nil
-		}
-		if targetOS == "darwin" && targetArch != "arm64" {
-			con.PrintErrorf("macOS shellcode format is only supported on darwin/arm64\n")
+		switch targetOS {
+		case "windows":
+			// Server-side implementation supports amd64 and 386 only.
+			if targetArch != "amd64" && targetArch != "386" {
+				con.PrintErrorf("Windows shellcode format is only supported on windows/amd64 and windows/386\n")
+				return "", nil
+			}
+		case "darwin":
+			if targetArch != "arm64" {
+				con.PrintErrorf("macOS shellcode format is only supported on darwin/arm64\n")
+				return "", nil
+			}
+		case "linux":
+			if targetArch != "amd64" && targetArch != "arm64" {
+				con.PrintErrorf("Linux shellcode format is only supported on linux/amd64 and linux/arm64\n")
+				return "", nil
+			}
+		default:
+			con.PrintErrorf("Shellcode format is currently only supported on Windows, macOS, and Linux\n")
 			return "", nil
 		}
 	}
@@ -585,14 +599,22 @@ func parseShellcodeFlags(cmd *cobra.Command, targetOS string, configFormat clien
 		cmd.Flags().Changed("donut-unicode") ||
 		cmd.Flags().Changed("donut-oep")
 
-	// macOS shellcode currently only supports compression.
+	// macOS and Linux shellcode currently only support compression.
 	if targetOS != "windows" {
-		if targetOS == "darwin" {
-			if windowsOnlyChanged {
+		if targetOS != "darwin" && targetOS != "linux" {
+			// parseCompileFlags normally blocks this, but keep a safe fallback.
+			if anyChanged {
+				con.PrintWarnf("Shellcode options are only supported on Windows, macOS, and Linux shellcode, ignoring.\n")
+			}
+			return nil, nil
+		}
+
+		if windowsOnlyChanged {
+			if targetOS == "darwin" {
 				con.PrintWarnf("Windows-only shellcode options are ignored on macOS shellcode.\n")
+			} else {
+				con.PrintWarnf("Windows-only shellcode options are ignored on Linux shellcode.\n")
 			}
-		} else if anyChanged {
-			con.PrintWarnf("Shellcode options are only supported on Windows and macOS shellcode, ignoring.\n")
 		}
 
 		shellcodeCompress := uint32(1)

client/command/help/long-help.go

@@ -190,7 +190,7 @@ You can also stack the C2 configuration with multiple protocols:
 
 [[.Bold]][[.Underline]]++ Formats ++[[.Normal]]
 Supported output formats include Windows PE, Windows DLL, Windows shellcode, macOS Mach-O, macOS shellcode (arm64),
-and Linux ELF. The output format is controlled with the --os and --format flags.
+Linux ELF, and Linux shellcode (amd64/arm64). The output format is controlled with the --os and --format flags.
 
 To output a 64bit Windows PE file (defaults to WinPE/64bit), either of the following command would be used:
 	generate --mtls foo.example.com 
@@ -209,7 +209,7 @@ To output a Linux ELF executable file, the following command would be used:
 [[.Bold]][[.Underline]]++ Shellcode Options ++[[.Normal]]
 When generating shellcode (--format shellcode), you can tune the shellcode generator:
 	--shellcode-encoder <name|none> # Apply a shellcode encoder (see: shellcode-encoders)
-	--shellcode-compress        # Enable aPLib compression (windows and macOS)
+	--shellcode-compress        # Enable aPLib compression (windows, macOS, and Linux)
 	--shellcode-entropy 1|2|3   # (windows only) Entropy: 1=none (default), 2=random names, 3=random+encrypt
 	--shellcode-exitopt 1|2|3   # (windows only) Exit behavior: 1=exit thread (default), 2=exit process, 3=block
 	--shellcode-bypass 1|2|3    # (windows only) Bypass: 1=none, 2=abort on failure, 3=continue (default)
@@ -218,6 +218,8 @@ When generating shellcode (--format shellcode), you can tune the shellcode gener
 	--shellcode-unicode         # (windows only) Unmanaged DLL: pass Unicode command line
 	--shellcode-oep <uint32>    # (windows only) Override original entry point (0=default)
 
+Note: macOS and Linux shellcode currently only support --shellcode-compress; other options are Windows-only.
+
 
 [[.Bold]][[.Underline]]++ DNS Canaries ++[[.Normal]]
 DNS canaries are unique per-binary domains that are deliberately NOT obfuscated during the compilation process. 

client/forms/generate_profiles_new.go

@@ -60,6 +60,7 @@ func GenerateProfilesNewForm() (*GenerateProfilesNewFormResult, error) {
 					case "linux":
 						return []huh.Option[string]{
 							huh.NewOption("amd64", "amd64"),
+							huh.NewOption("arm64", "arm64"),
 							huh.NewOption("386", "386"),
 						}
 					default:
@@ -83,6 +84,8 @@ func GenerateProfilesNewForm() (*GenerateProfilesNewFormResult, error) {
 							huh.NewOption("Service", "service"),
 							huh.NewOption("Shellcode", "shellcode"),
 						)
+					} else if result.OS == "darwin" || result.OS == "linux" {
+						options = append(options, huh.NewOption("Shellcode", "shellcode"))
 					}
 					return options
 				}, &result.OS).

client/forms/generate_profiles_new_beacon.go

@@ -65,6 +65,7 @@ func GenerateProfilesNewBeaconForm() (*GenerateProfilesNewBeaconFormResult, erro
 					case "linux":
 						return []huh.Option[string]{
 							huh.NewOption("amd64", "amd64"),
+							huh.NewOption("arm64", "arm64"),
 							huh.NewOption("386", "386"),
 						}
 					default:
@@ -88,6 +89,8 @@ func GenerateProfilesNewBeaconForm() (*GenerateProfilesNewBeaconFormResult, erro
 							huh.NewOption("Service", "service"),
 							huh.NewOption("Shellcode", "shellcode"),
 						)
+					} else if result.OS == "darwin" || result.OS == "linux" {
+						options = append(options, huh.NewOption("Shellcode", "shellcode"))
 					}
 					return options
 				}, &result.OS).

client/forms/generate_targets.go

@@ -44,6 +44,7 @@ func commonArchOptions(goos string) []huh.Option[string] {
 	case "linux":
 		return []huh.Option[string]{
 			huh.NewOption("amd64", "amd64"),
+			huh.NewOption("arm64", "arm64"),
 			huh.NewOption("386", "386"),
 		}
 	default:
@@ -66,6 +67,8 @@ func commonFormatOptions(goos string) []huh.Option[string] {
 		)
 	} else if goos == "darwin" {
 		options = append(options, huh.NewOption("Shellcode", "shellcode"))
+	} else if goos == "linux" {
+		options = append(options, huh.NewOption("Shellcode", "shellcode"))
 	}
 	return options
 }

client/packages/output.go

@@ -1,5 +1,23 @@
 package packages
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2024  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 	"encoding/json"
 	"fmt"
@@ -10,23 +28,6 @@ import (
 	"github.com/jedib0t/go-pretty/v6/table"
 )
 
-/*
-Sliver Implant Framework
-Copyright (C) 2024  Bishop Fox
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License
-along with this program.  If not, see <https://www.gnu.org/licenses/>.
-*/
 const (
 	KeyValueSchemaName        = "key-value"
 	GroupedKeyValueSchemaName = "grouped-key-value"

docs/sliver-docs/pages/docs/md/Cross-compiling Implants.md

@@ -1,4 +1,4 @@
-**NOTE:** Any platform can cross-compile a standalone executable to any other platform out of the box; you only need cross-compilers when using `--format shared`.
+**NOTE:** Any platform can cross-compile a standalone executable to any other platform out of the box; you primarily need cross-compilers when using CGO-based formats like `--format shared`, and for `--format shellcode` on macOS/Linux.
 
 Sliver can tell you which platforms it can likely target based on the server's platform and available cross-compilers by running the `generate info` command in the console.
 
@@ -37,7 +37,7 @@ Sliver automatically looks in the default paths for these cross-compilers; once
 
 ## From MacOS to Linux/Windows
 
-Sliver embeds a Zig cross-compiler out of the box, so Windows DLLs and Linux shared objects do not require mingw-w64 or musl-cross.
+Sliver embeds a Zig cross-compiler out of the box, so Windows DLLs and Linux shared objects/shellcode do not require mingw-w64 or musl-cross.
 
 However, we're not aware of any good options to target 32-bit Linux from MacOS. Sliver automatically looks in the default paths for these cross-compilers; once installed simply use the `generate` command with the desired `--os` and `--arch`, check `~/.sliver/logs/sliver.log` for build errors. You can override any cross-compiler location via the appropriate [environment variables](/docs?name=Environment+Variables).
 

docs/sliver-docs/pages/docs/md/External Builders.md

@@ -47,6 +47,7 @@ sliver > builders
 =============================== ========== =========== ============== ==========================
  molochs-MacBook-Pro-111.local   moloch     sliver      darwin/arm64   EXECUTABLE:linux/386
                                                                        EXECUTABLE:linux/amd64
+                                                                       EXECUTABLE:linux/arm64
                                                                        EXECUTABLE:windows/386
                                                                        EXECUTABLE:windows/amd64
                                                                        EXECUTABLE:darwin/amd64
@@ -56,10 +57,14 @@ sliver > builders
                                                                        SHARED_LIB:darwin/amd64
                                                                        SHARED_LIB:darwin/arm64
                                                                        SHARED_LIB:linux/amd64
+                                                                       SHARED_LIB:linux/arm64
                                                                        SERVICE:windows/386
                                                                        SERVICE:windows/amd64
                                                                        SHELLCODE:windows/386
                                                                        SHELLCODE:windows/amd64
+                                                                       SHELLCODE:darwin/arm64
+                                                                       SHELLCODE:linux/amd64
+                                                                       SHELLCODE:linux/arm64
 ```
 
 Use the `--external-builder` flag to offload a `generate` or `generate beacon` command onto an external builder:

docs/sliver-docs/pages/docs/md/Stagers.md

@@ -1,4 +1,4 @@
-**⚠️ Important:** You must have MinGW installed on your Sliver server to get some staged (e.g., Windows DLLs) payloads to work.
+**⚠️ Important:** Some staged payloads require a working cross-compiler toolchain on the Sliver server (especially shared libraries and non-native targets). Sliver bundles a Zig toolchain for many Windows/Linux targets, but macOS shared library/shellcode builds require osxcross.
 
 ## Overview
 
@@ -33,23 +33,35 @@ Name           Platform       Command & Control              Debug  Format
 win-shellcode  windows/amd64  [1] mtls://192.168.122.1:8888  false  SHELLCODE   enabled
 ```
 
-You can tune shellcode options for shellcode profiles (Windows: Donut):
+Shellcode generation varies by platform:
 
-- `--shellcode-entropy`: 1=none, 2=random names, 3=random+encrypt
-- `--shellcode-compress`: enable/disable aPLib compression (boolean)
-- `--shellcode-exitopt`: 1=exit thread, 2=exit process, 3=block
-- `--shellcode-bypass`: 1=none, 2=abort on failure, 3=continue
-- `--shellcode-headers`: 1=overwrite, 2=keep
-- `--shellcode-thread`: run unmanaged EXE entrypoint as a new thread (boolean)
-- `--shellcode-unicode`: pass Unicode command line to unmanaged DLL entrypoints (boolean)
-- `--shellcode-oep`: override original entry point (uint32, 0=default)
+- Windows shellcode uses Donut and supports all shellcode tuning flags below.
+- macOS (darwin/arm64) and Linux (amd64/arm64) shellcode currently only support `--shellcode-compress`; other `--shellcode-*` options are Windows-only.
+
+Shellcode options:
+
+- `--shellcode-encoder`: apply an optional shellcode encoder (see: `shellcode-encoders`)
+- `--shellcode-compress`: enable/disable aPLib compression (boolean) (Windows, macOS, Linux)
+- `--shellcode-entropy`: 1=none, 2=random names, 3=random+encrypt (Windows only)
+- `--shellcode-exitopt`: 1=exit thread, 2=exit process, 3=block (Windows only)
+- `--shellcode-bypass`: 1=none, 2=abort on failure, 3=continue (Windows only)
+- `--shellcode-headers`: 1=overwrite, 2=keep (Windows only)
+- `--shellcode-thread`: run unmanaged EXE entrypoint as a new thread (boolean) (Windows only)
+- `--shellcode-unicode`: pass Unicode command line to unmanaged DLL entrypoints (boolean) (Windows only)
+- `--shellcode-oep`: override original entry point (uint32, 0=default) (Windows only)
 
 Example:
 
 ```
 sliver > profiles new --mtls 192.168.122.1 --format shellcode --shellcode-entropy 2 --shellcode-compress --shellcode-exitopt 3 win-shellcode
 ```
 
+Linux example (compression only):
+
+```
+sliver > profiles new --os linux --arch amd64 --mtls 192.168.122.1 --format shellcode --shellcode-compress linux-shellcode
+```
+
 We can now create a staging listener and link it to the profile:
 
 ```