Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sliver Linux Implant cat command not reading /proc/* files that report 0 bytes despite valid data #1812

Open
ice-wzl opened this issue Nov 8, 2024 · 0 comments

Comments

@ice-wzl
Copy link

ice-wzl commented Nov 8, 2024

Describe the bug
Sliver implant on linux does not read files under /proc/* that report a 0 byte size. For example cat /proc/net/arp reports back no stdout when there are in fact entries in the file visible with cat /proc/net/arp in a separate terminal or via execute -o '/bin/sh' -- -c 'cat /proc/net/arp' in the sliver session

To Reproduce
Steps to reproduce the behavior:

  1. Establish mtls sliver session on a linux host. Enter session context.
  2. Verify report above with cat /proc/net/arp
  3. Verify entries exist with execute -o '/bin/sh' -- -c 'cat /proc/net/arp'
  4. See difference between the two command outputs

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
image

Desktop (please complete the following information):

PRETTY_NAME="Kali GNU/Linux Rolling"
NAME="Kali GNU/Linux"
VERSION_ID="2024.3"
VERSION="2024.3"
  • Sliver Version
sliver > version

[*] Client v1.5.39 - e4b64e10504723c8e5d182389e9b46c54a1123b5 - linux/amd64
    Compiled at 2024-11-08 12:29:21 -0500 EST
    Compiled with go version go1.23.0 linux/amd64

[*] Server v1.5.39 - e4b64e10504723c8e5d182389e9b46c54a1123b5 - linux/amd64
    Compiled at 2024-11-08 12:29:21 -0500 EST
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants