Closing sliver client terminate all the socks started before

[n3rada]

If you start a socks in an implant (e.g., sliver (PLASTIC_SECURITY) > socks5 start -H 127.0.0.1 -P 1081) and quit a job which is blocking your terminal with "Ctrl + C", this will necessarily disconnect the sliver client, but if you reconnect, you keep the jobs because they are server-side, but you lose the socks started before.

Any reason why?

PS: I also tried to have two sliver clients opened-up but same issue when one is closed.

[rkervella]

Because socks is partly a client-side feature. So if the client is dead, the tunnel is closed.

[n3rada]

Ok. Seems logical.

For better comprehension, let's say that you received your implant and you need to pivot:

sliver (PLASTIC_SECURITY) > socks5 start -H 127.0.0.1 -P 1081

Then, you're using a command that's taking too long to run and you want to stop it, you're stuck because exiting a running command seems impossible if I do say so myself. It's either press Ctrl+ C and quit the current client (thus loosing my socks), or wait for the long timeout, isn't?

Do I miss something?

[rkervella]

Do I miss something?

No that's about right, in the current state of things, if you don't want to kill the client, you'll need to wait for the timeout to expire (1 minute by default).

[rkervella]

Closing this one because this is by design: socks tunnels should be closed if the client dies / exits.

[n3rada]

Totally understandable, thanks a lot for the promptness.