Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Docker] Run Sliver server from writable CWD #132

Closed
moloch-- opened this issue Nov 1, 2019 · 3 comments
Closed

[Docker] Run Sliver server from writable CWD #132

moloch-- opened this issue Nov 1, 2019 · 3 comments
Labels
enhancement New feature or request

Comments

@moloch--
Copy link
Member

moloch-- commented Nov 1, 2019

Describe the bug

Currently the Docker server process is run from a CWD that is not writable by the user the server process is executed as, which means that users must specify a --save location and by default builds will fail. Related to issue #130

Expected behavior

Default build commands should work with the need to specify additional flags.

Desktop (please complete the following information):

  • OS: Docker/linux
  • Version v0.0.7 (master)
@moloch-- moloch-- added the enhancement New feature or request label Nov 1, 2019
@khast3x
Copy link

khast3x commented Nov 2, 2019

Hello,

Fixed the CWD issue by adding:

RUN chown -R sliver:sliver /go/src/github.com/bishopfox/sliver
USER sliver
ENTRYPOINT [ "/opt/sliver-server" ]

I have since managed to run the implant successfully 🎉

It might be more elegant to test writing perms before generating binary and output to /tmp or something? Idk.
In practical usage, running the C2 with docker is also done by mounting a volume so as to get the binary. Maybe use a default volume that is chowned correctly?

Cheers!

@moloch--
Copy link
Member Author

moloch-- commented Nov 2, 2019

There's a couple shortcomings of the current tests in that (1) they're execute as the root user, and (2) don't cover all use cases of thegenerate command. Changing the CWD is easy enough short-term but long-term I think we need to create better CI/CD integration tests.

moloch-- pushed a commit that referenced this issue Nov 3, 2019
@moloch--
Copy link
Member Author

moloch-- commented Nov 3, 2019

Fixed, but due to the increased code in the implant obfuscation process takes about 3 hours and 45mins on a t2.xlarge .... which is not ideal, but should be addressed once we have a better staged version.

@moloch-- moloch-- closed this as completed Nov 3, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants