sliver icon indicating copy to clipboard operation
sliver copied to clipboard

Linux Shell Doesn't Pop On mTLS implant

Open mgeeky opened this issue 2 years ago • 5 comments

Describe the bug While operating inside of a Sliver linux session, I want to spawn interactive shell. However unable to do so.

To Reproduce Steps to reproduce the behavior:

  1. Spawn sliver linux build (mTLS)
  2. Interact with inbound session
  3. Type shell

Expected behavior I just wanted to pop some shellz...

Desktop (please complete the following information):

sliver (UNUSUAL_EARTHQUAKE) > info

        Session ID: e4a31d4a-4270-4636-acd7-e4c914a61883
              Name: UNUSUAL_EARTHQUAKE
          Hostname: foobar
              UUID: 98b366ca-5c42-4a8d-b34d-a067bd409010
          Username: foouser
               UID: 2029
               GID: 2029
               PID: 438598
                OS: linux
           Version: Linux foobar 4.18.0-348.12.2.el8_5.x86_64
              Arch: amd64
         Active C2: mtls://attacker.com:8888
    Remote Address: 1.2.3.4:7180
         Proxy URL:
Reconnect Interval: 1m0s

Additional context Output:

sliver (UNUSUAL_EARTHQUAKE) > shell
? This action is bad OPSEC, are you an adult? Yes
[*] Opening shell tunnel (EOF to exit) ...

[*] Started remote shell with pid 438631

[!] Failed to save terminal stateShell exited

Any ideas how to proceed?

mgeeky avatar Apr 14 '22 02:04 mgeeky

Are you using a terminal that supports PTYs?

moloch-- avatar Apr 14 '22 03:04 moloch--

Yes, I'm using Windows Terminal.

mgeeky avatar Apr 14 '22 08:04 mgeeky

Interesting, I'll see if i can reproduce, give shell --no-pty a try as I suspect its related to PTYs in some way.

moloch-- avatar Apr 14 '22 14:04 moloch--

Also reproduced using Windows Terminal. With shell --no-pty it doesn't fail and exit but just hangs. Same with normal windows cmd prompt - Windows 10. Same in my WSL window.

aringo-bf avatar Apr 21 '22 20:04 aringo-bf

Okay, we'll try to reproduce likely some issue specific to the Windows Terminal implementation of pty/stdin/out

moloch-- avatar Apr 21 '22 22:04 moloch--