#9 Added persist command.

[usiegl00]

Card

This pr adds persistence support for the 3 major operating systems. (Windows, Darwin, Linux).

Details

I do not have a linux machine to test on right now. Here are the screenshots for Windows and Darwin:

• Windows

  • User:
  • Root:

• Darwin

  • User:
  • Root:

[usiegl00]

How do I store the names of the files being persisted for later cleanup? (persist -u)

[rkervella]

How do I store the names of the files being persisted for later cleanup? (persist -u)

I guess we'd need to use the database for that, and link the session with the file names.

[usiegl00]

Could you share some example code on using the database? It would really help with custom file names / paths.

[rkervella]

Could you share some example code on using the database? It would really help with custom file names / paths.

Sure, here's an example:

https://github.com/BishopFox/sliver/blob/7507cf0b201a4427f5e8ca61e50e6c4be404f999/server/generate/canaries.go#L113-L123

However, we'll need to add an RPC to update the session data (maybe there's already one, I don't remember), as the DB is stored on the server side.

Also, FYI, I just pushed a new PR to add a GetEnv RPC:

https://github.com/BishopFox/sliver/blob/a1635807ccae0e5793c2b7f7a2e796ad82edb2c9/protobuf/rpcpb/services.proto#L86

[usiegl00]

I am going to implement a generic grpc db handler. That will allow the client to get and set bucket data.

[usiegl00]

Is there an update on this?

[rkervella]

Sorry I've been quite busy lately, I started reviewing it but I'm not done, and I don't know when I'll get some time to continue.

[usiegl00]

I have updated the code in accordance with the database changes.

[moloch--]

Awesome we're going to be digging into this PR shortly.

[rkervella]

@usiegl00 so I gave this PR another go, and so far, only the MacOS persistence seem to work.

[usiegl00]

If you could give me more info, that would be great. For windows, check the scheduled tasks to see if the task was registered. For linux, check crontab to see if the entry is there. I really appreciate you taking the time to review this. Also, if you have the debug log, that would be very useful.

[rkervella]

On Windows, the task doesn't show in the task scheduler. On Linux, the crontab is empty for the user:

ubuntu@devbox:~$ crontab -l
no crontab for ubuntu

On Windows, the user is a local administrator, but the Sliver instance does not run in an elevated context. On Linux, I'm using a regular user.

[usiegl00]

After adding some debug logging, a very interesting issue appeared. For linux, the crontab command appears to be executing, but the entry is not added.

Sliver Debug Log:
Command: /bin/sh -c "echo \"@reboot /home/user/...\" | crontab -"
$ crontab -l
no crontab for user
$ /bin/sh -c "echo \"@reboot /home/user/...\" | crontab -"
$ crontab -l
@reboot /home/user/...

When executing the exact same command in the shell, the entry is added as expected.

[usiegl00]

It should work now.

[rkervella]

Persistence on Linux seems to work now, but still nothing on Windows. I even try to run it within an elevated context, but the task doesn't seem to be created at all:

Get-ScheduledTask -TaskName RUBBER_WEDDING
Get-ScheduledTask : No MSFT_ScheduledTask objects found with property 'TaskName' equal to 'RUBBER_WEDDING'.  Verify the value of the property and retry.
At line:1 char:1
+ Get-ScheduledTask -TaskName RUBBER_WEDDING
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (RUBBER_WEDDING:String) [Get-ScheduledTask], CimJobException
    + FullyQualifiedErrorId : CmdletizationQuery_NotFound_TaskName,Get-ScheduledTask

[usiegl00]

Hmm, I will take another look.

[usiegl00]

In userland we cannot create schtasks with onstart or onlogon. I have switched to using minute, so there will be way too many slivers spawned. This can be fixed by using a semaphore detailed in #231.

If you want, I can also add an option to configure the schtask duration. Ex: 10 minutes.

[usiegl00]

I have updated this pr in accordance with the architecture changes.

@rkervella It is ready for review.

[usiegl00]

I know it's been a while. Is there anything you need from me to get this across the line?

[moloch--]

I was just taking a look at this as well, I think we can probably fit it into v1.5

[usiegl00]

Nice! Let me know if there is anything I can do to help.

[acheong08]

Any chance that this will ever get implemented?

[rkervella]

It would probably be better implemented as an extension/alias at this point. Back when this PR was open we did not have any of that in place. Since there are tons of ways to persist on different systems, it's probably more beneficial to implement these techniques as a Sliver script or an extension depending on the system you're targeting.