/server/generate/binaries_test.go

https://github.com/BishopFox/sliver · Go · 265 lines · 201 code · 28 blank · 36 comment · 16 complexity · e499148ee5c5374958f36941f36201fb MD5 · raw file

  1. package generate
  2. /*
  3. Sliver Implant Framework
  4. Copyright (C) 2019 Bishop Fox
  5. This program is free software: you can redistribute it and/or modify
  6. it under the terms of the GNU General Public License as published by
  7. the Free Software Foundation, either version 3 of the License, or
  8. (at your option) any later version.
  9. This program is distributed in the hope that it will be useful,
  10. but WITHOUT ANY WARRANTY; without even the implied warranty of
  11. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  12. GNU General Public License for more details.
  13. You should have received a copy of the GNU General Public License
  14. along with this program. If not, see <https://www.gnu.org/licenses/>.
  15. */
  16. import (
  17. "fmt"
  18. "testing"
  19. "github.com/bishopfox/sliver/protobuf/clientpb"
  20. "github.com/bishopfox/sliver/server/log"
  21. )
  22. var (
  23. buildTestLog = log.NamedLogger("generate", "testbuild")
  24. )
  25. func TestSliverExecutableWindows(t *testing.T) {
  26. // mTLS C2
  27. mtlsExe(t, "windows", "amd64", false)
  28. //mtlsExe(t, "windows", "386", false)
  29. mtlsExe(t, "windows", "amd64", true)
  30. //mtlsExe(t, "windows", "386", true)
  31. // DNS C2
  32. dnsExe(t, "windows", "amd64", false)
  33. //dnsExe(t, "windows", "386", false)
  34. dnsExe(t, "windows", "amd64", true)
  35. //dnsExe(t, "windows", "386", true)
  36. // HTTP C2
  37. httpExe(t, "windows", "amd64", false)
  38. //httpExe(t, "windows", "386", false)
  39. httpExe(t, "windows", "amd64", true)
  40. //httpExe(t, "windows", "386", true)
  41. // PIVOT TCP C2
  42. tcpPivotExe(t, "windows", "amd64", false)
  43. //httpExe(t, "windows", "386", false)
  44. tcpPivotExe(t, "windows", "amd64", true)
  45. //httpExe(t, "windows", "386", true)
  46. // Named Pipe C2
  47. namedPipeExe(t, "windows", "amd64", false)
  48. //namedPipeExe(t, "windows", "386", false)
  49. namedPipeExe(t, "windows", "amd64", true)
  50. //namedPipeExe(t, "windows", "386", true)
  51. // Multiple C2s
  52. multiExe(t, "windows", "amd64", true)
  53. multiExe(t, "windows", "amd64", false)
  54. multiExe(t, "windows", "386", false)
  55. multiExe(t, "windows", "386", false)
  56. }
  57. func TestSliverSharedLibWindows(t *testing.T) {
  58. multiLibrary(t, "windows", "amd64", true)
  59. multiLibrary(t, "windows", "amd64", false)
  60. multiLibrary(t, "windows", "386", true)
  61. multiLibrary(t, "windows", "386", false)
  62. }
  63. func TestSliverExecutableLinux(t *testing.T) {
  64. multiExe(t, "linux", "amd64", true)
  65. multiExe(t, "linux", "amd64", false)
  66. tcpPivotExe(t, "linux", "amd64", false)
  67. }
  68. func TestSliverExecutableDarwin(t *testing.T) {
  69. multiExe(t, "darwin", "amd64", true)
  70. multiExe(t, "darwin", "amd64", false)
  71. tcpPivotExe(t, "darwin", "amd64", false)
  72. }
  73. // func TestSymbolObfuscation(t *testing.T) {
  74. // symbolObfuscation(t, "windows", "amd64")
  75. // }
  76. func mtlsExe(t *testing.T, goos string, goarch string, debug bool) {
  77. t.Logf("[mtls] EXE %s/%s - debug: %v", goos, goarch, debug)
  78. config := &ImplantConfig{
  79. GOOS: goos,
  80. GOARCH: goarch,
  81. C2: []ImplantC2{
  82. ImplantC2{URL: "mtls://1.example.com"},
  83. },
  84. MTLSc2Enabled: true,
  85. Debug: debug,
  86. ObfuscateSymbols: false,
  87. }
  88. _, err := SliverExecutable(config)
  89. if err != nil {
  90. t.Errorf(fmt.Sprintf("%v", err))
  91. }
  92. }
  93. func dnsExe(t *testing.T, goos string, goarch string, debug bool) {
  94. t.Logf("[dns] EXE %s/%s - debug: %v", goos, goarch, debug)
  95. config := &ImplantConfig{
  96. GOOS: goos,
  97. GOARCH: goarch,
  98. C2: []ImplantC2{
  99. ImplantC2{URL: "dns://3.example.com"},
  100. },
  101. DNSc2Enabled: true,
  102. Debug: debug,
  103. ObfuscateSymbols: false,
  104. }
  105. _, err := SliverExecutable(config)
  106. if err != nil {
  107. t.Errorf(fmt.Sprintf("%v", err))
  108. }
  109. }
  110. func httpExe(t *testing.T, goos string, goarch string, debug bool) {
  111. t.Logf("[http] EXE %s/%s - debug: %v", goos, goarch, debug)
  112. config := &ImplantConfig{
  113. GOOS: goos,
  114. GOARCH: goarch,
  115. C2: []ImplantC2{
  116. ImplantC2{
  117. Priority: 1,
  118. URL: "http://4.example.com",
  119. Options: "asdf",
  120. },
  121. },
  122. HTTPc2Enabled: true,
  123. Debug: debug,
  124. ObfuscateSymbols: false,
  125. }
  126. _, err := SliverExecutable(config)
  127. if err != nil {
  128. t.Errorf(fmt.Sprintf("%v", err))
  129. }
  130. }
  131. func multiExe(t *testing.T, goos string, goarch string, debug bool) {
  132. t.Logf("[multi] %s/%s - debug: %v", goos, goarch, debug)
  133. config := &ImplantConfig{
  134. GOOS: goos,
  135. GOARCH: goarch,
  136. C2: []ImplantC2{
  137. ImplantC2{URL: "mtls://1.example.com"},
  138. ImplantC2{URL: "mtls://2.example.com", Options: "asdf"},
  139. ImplantC2{URL: "https://3.example.com"},
  140. ImplantC2{Priority: 3, URL: "dns://4.example.com"},
  141. },
  142. MTLSc2Enabled: true,
  143. HTTPc2Enabled: true,
  144. DNSc2Enabled: true,
  145. Debug: debug,
  146. ObfuscateSymbols: false,
  147. }
  148. _, err := SliverExecutable(config)
  149. if err != nil {
  150. t.Errorf(fmt.Sprintf("%v", err))
  151. }
  152. }
  153. func tcpPivotExe(t *testing.T, goos string, goarch string, debug bool) {
  154. t.Logf("[tcppivot] EXE %s/%s - debug: %v", goos, goarch, debug)
  155. config := &ImplantConfig{
  156. GOOS: goos,
  157. GOARCH: goarch,
  158. C2: []ImplantC2{
  159. ImplantC2{
  160. Priority: 1,
  161. URL: "tcppivot://127.0.0.1:8080",
  162. Options: "asdf",
  163. },
  164. },
  165. NamePipec2Enabled: true,
  166. Debug: debug,
  167. ObfuscateSymbols: false,
  168. }
  169. _, err := SliverExecutable(config)
  170. if err != nil {
  171. t.Errorf(fmt.Sprintf("%v", err))
  172. }
  173. }
  174. func namedPipeExe(t *testing.T, goos string, goarch string, debug bool) {
  175. t.Logf("[namedpipe] EXE %s/%s - debug: %v", goos, goarch, debug)
  176. config := &ImplantConfig{
  177. GOOS: goos,
  178. GOARCH: goarch,
  179. C2: []ImplantC2{
  180. ImplantC2{
  181. Priority: 1,
  182. URL: "namedpipe://./pipe/test",
  183. Options: "asdf",
  184. },
  185. },
  186. NamePipec2Enabled: true,
  187. Debug: debug,
  188. ObfuscateSymbols: false,
  189. }
  190. _, err := SliverExecutable(config)
  191. if err != nil {
  192. t.Errorf(fmt.Sprintf("%v", err))
  193. }
  194. }
  195. func multiLibrary(t *testing.T, goos string, goarch string, debug bool) {
  196. t.Logf("[multi] LIB %s/%s - debug: %v", goos, goarch, debug)
  197. config := &ImplantConfig{
  198. GOOS: goos,
  199. GOARCH: goarch,
  200. C2: []ImplantC2{
  201. ImplantC2{URL: "mtls://1.example.com"},
  202. ImplantC2{Priority: 2, URL: "mtls://2.example.com"},
  203. ImplantC2{URL: "https://3.example.com"},
  204. ImplantC2{URL: "dns://4.example.com", Options: "asdf"},
  205. },
  206. Debug: debug,
  207. ObfuscateSymbols: false,
  208. Format: clientpb.ImplantConfig_SHARED_LIB,
  209. IsSharedLib: true,
  210. }
  211. _, err := SliverSharedLibrary(config)
  212. if err != nil {
  213. t.Errorf(fmt.Sprintf("%v", err))
  214. }
  215. }
  216. func symbolObfuscation(t *testing.T, goos string, goarch string) {
  217. t.Logf("[symbol obfuscation] %s/%s ...", goos, goarch)
  218. config := &ImplantConfig{
  219. GOOS: goos,
  220. GOARCH: goarch,
  221. C2: []ImplantC2{
  222. ImplantC2{URL: "mtls://1.example.com"},
  223. ImplantC2{Priority: 2, URL: "mtls://2.example.com"},
  224. ImplantC2{URL: "https://3.example.com"},
  225. ImplantC2{URL: "dns://4.example.com", Options: "asdf"},
  226. },
  227. Debug: false,
  228. ObfuscateSymbols: true,
  229. }
  230. _, err := SliverExecutable(config)
  231. if err != nil {
  232. t.Errorf(fmt.Sprintf("%v", err))
  233. }
  234. }