sliver icon indicating copy to clipboard operation
sliver copied to clipboard

Upgrade connection of running implant

Open pooki3bear opened this issue 2 years ago • 3 comments

Describe the solution you'd like I would like a session to use new connection details, whether or not they have been compiled into the implant.

sessions -i 1
upgrade wg -l 12.34.56.78 -p 666

Creates new temporary c2 connection in-memory for active usage of socks feature

Describe alternatives you've considered If a dynamic/in-memory only upgrade cannot be achieved, it would be useful to compile options into an implant, and then specify which it should use at runtime.

Additional context Dynamic socks is a useful, and sometimes critical feature for testing, but is coupled with the wireguard protocol. I am hesitant to use wg as primary comms, because there is no established baseline for this traffic within many environments (whereas there is for TLS).

pooki3bear avatar Aug 12 '21 06:08 pooki3bear

Dynamically adding new transports is currently not an option, as the responsible code for the transport is added at compile time (and we don't have at-runtime loadable go code working at this time).

You can set multiple transports for an implant, we just don't have a way to tell it to switch transports right now. It could be added though.

As for socks, we need to merge #251 at some point, which currently has the same drawbacks as the in-band port forward feature.

rkervella avatar Aug 12 '21 06:08 rkervella

@rkervella Thanks, I'm fine with using my considered alternate for now. Can documentation or guidance be given for this in the wiki?

e.g. "To migrate an implant with multiple transports to a preferred transport, you must disable or firewall non-preferred transports to the c2"

pooki3bear avatar Aug 12 '21 19:08 pooki3bear

I'll boost what's in the getting started. It's been on our to-do list for a while to allow the user to specify different combinations / support random transport select / etc.

moloch-- avatar Aug 12 '21 21:08 moloch--