Merge pull request #1175 from rwincey/file_log

Added file path for debug so it doesn't always goto stdout
BishopFox · Mar 30, 2023 · da4ee8a · da4ee8a
2 parents 7d95856 + e6645c9
commit da4ee8a
Show file tree

Hide file tree

Showing 7 changed files with 566 additions and 537 deletions.
diff --git a/client/command/commands.go b/client/command/commands.go
@@ -1324,6 +1324,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("a", "arch", "amd64", "cpu architecture")
 			f.String("N", "name", "", "agent name")
 			f.Bool("d", "debug", false, "enable debug features")
+			f.String("O", "debug-file", "", "path to debug output")
 			f.Bool("e", "evasion", false, "enable evasion features (e.g. overwrite user space hooks)")
 			f.Bool("l", "skip-symbols", false, "skip symbol obfuscation")
 			f.String("I", "template", "sliver", "implant code template")
@@ -1385,6 +1386,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("a", "arch", "amd64", "cpu architecture")
 			f.String("N", "name", "", "agent name")
 			f.Bool("d", "debug", false, "enable debug features")
+			f.String("O", "debug-file", "", "path to debug output")
 			f.Bool("e", "evasion", false, "enable evasion features  (e.g. overwrite user space hooks)")
 			f.Bool("l", "skip-symbols", false, "skip symbol obfuscation")
 			f.String("I", "template", "sliver", "implant code template")
@@ -1541,6 +1543,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("a", "arch", "amd64", "cpu architecture")
 
 			f.Bool("d", "debug", false, "enable debug features")
+			f.String("O", "debug-file", "", "path to debug output")
 			f.Bool("e", "evasion", false, "enable evasion features")
 			f.Bool("l", "skip-symbols", false, "skip symbol obfuscation")
 			f.Bool("G", "disable-sgn", false, "disable shikata ga nai shellcode encoder")
@@ -1609,6 +1612,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("a", "arch", "amd64", "cpu architecture")
 
 			f.Bool("d", "debug", false, "enable debug features")
+			f.String("O", "debug-file", "", "path to debug output")
 			f.Bool("e", "evasion", false, "enable evasion features")
 			f.Bool("l", "skip-symbols", false, "skip symbol obfuscation")
 

diff --git a/client/command/generate/generate.go b/client/command/generate/generate.go
@@ -272,6 +272,7 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 	limitDatetime := ctx.Flags.String("limit-datetime")
 	limitFileExists := ctx.Flags.String("limit-fileexists")
 	limitLocale := ctx.Flags.String("limit-locale")
+	debugFile := ctx.Flags.String("debug-file")
 
 	isSharedLib := false
 	isService := false
@@ -369,6 +370,8 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 		IsShellcode: isShellcode,
 
 		RunAtLoad: runAtLoad,
+
+		DebugFile: debugFile,
 	}
 
 	return config

diff --git a/implant/sliver/sliver.go b/implant/sliver/sliver.go
@@ -162,6 +162,14 @@ func main() {
 
 	// {{if .Config.Debug}}
 	log.SetFlags(log.LstdFlags | log.Lshortfile)
+	debugFilePath := "{{ .Config.DebugFile }}"
+	if debugFilePath != "" {
+		// Open the log file for writing
+		file, err := os.OpenFile(debugFilePath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0666)
+		if err == nil {
+			log.SetOutput(file)
+		}
+	}
 	// {{else}}
 	log.SetFlags(0)
 	log.SetOutput(ioutil.Discard)

diff --git a/protobuf/clientpb/client.pb.go b/protobuf/clientpb/client.pb.go
diff --git a/protobuf/clientpb/client.proto b/protobuf/clientpb/client.proto
@@ -171,6 +171,7 @@ message ImplantConfig {
   bool IsShellcode = 104;
 
   bool RunAtLoad = 105;
+  string DebugFile = 106;
 }
 
 message ExternalImplantConfig {

diff --git a/server/db/models/implant.go b/server/db/models/implant.go
@@ -87,6 +87,7 @@ type ImplantConfig struct {
 	MtlsKey    string
 
 	Debug               bool
+	DebugFile           string
 	Evasion             bool
 	ObfuscateSymbols    bool
 	ReconnectInterval   int64
@@ -159,6 +160,7 @@ func (ic *ImplantConfig) ToProtobuf() *clientpb.ImplantConfig {
 		MtlsKey:    ic.MtlsKey,
 
 		Debug:            ic.Debug,
+		DebugFile:        ic.DebugFile,
 		Evasion:          ic.Evasion,
 		ObfuscateSymbols: ic.ObfuscateSymbols,
 		TemplateName:     ic.TemplateName,

diff --git a/server/generate/binaries.go b/server/generate/binaries.go
@@ -148,6 +148,7 @@ func ImplantConfigFromProtobuf(pbConfig *clientpb.ImplantConfig) (string, *model
 	cfg.MtlsCert = pbConfig.MtlsCert
 	cfg.MtlsKey = pbConfig.MtlsKey
 	cfg.Debug = pbConfig.Debug
+	cfg.DebugFile = pbConfig.DebugFile
 	cfg.Evasion = pbConfig.Evasion
 	cfg.ObfuscateSymbols = pbConfig.ObfuscateSymbols
 	cfg.TemplateName = pbConfig.TemplateName