package sliverpb

Get desktop application:
View/edit binary Protocol Buffers messages

• string ID = 1

• int64 Interval = 2

• int64 Jitter = 3

• optional Register Register = 4

• int64 NextCheckin = 5

BeaconTasks - DO NOT CONFUSE WITH clientpb.BeaconTasks

• string ID = 1

• repeated Envelope Tasks = 2

• int64 NextCheckin = 3

Used as response type in: rpcpb.SliverRPC.CallExtension

• bytes Output = 1

• bool ServerStore = 2

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.CallExtension

• string Name = 1

• bool ServerStore = 2

• bytes Args = 3

• string Export = 4

• optional commonpb.Request Request = 9

Used as request type in: rpcpb.SliverRPC.Cd

• string Path = 1

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Chmod

• string Path = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.Chmod

• string Path = 1

• string FileMode = 2

• bool Recursive = 3

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Chown

• string Path = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.Chown

• string Path = 1

• string Uid = 2

• string Gid = 3

• bool Recursive = 4

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Chtimes

• string Path = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.Chtimes

• string Path = 1

• int64 ATime = 2

• int64 MTime = 3

• optional commonpb.Request Request = 9

Used as request type in: rpcpb.SliverRPC.CloseSession

• optional commonpb.Response Response = 8

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Cp

• string Src = 1

• string Dst = 2

• int64 BytesWritten = 3

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.Cp

• string Src = 1

• string Dst = 2

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.CurrentTokenOwner

• string Output = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.CurrentTokenOwner

• optional commonpb.Request Request = 9

• string Name = 1

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Download

• string Path = 1

• string Encoder = 2

• bool Exists = 3

• int64 Start = 4

• int64 Stop = 5

• bytes Data = 6

• bool IsDir = 7

• int32 ReadFiles = 8

• int32 UnreadableFiles = 10

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.Download

• string Path = 1

• int64 Start = 2

• int64 Stop = 3

• bool Recurse = 4

• int64 MaxBytes = 5

• int64 MaxLines = 6

• bool RestrictedToFile = 7

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.GetEnv

• repeated commonpb.EnvVar Variables = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.GetEnv

• string Name = 1

• optional commonpb.Request Request = 9

Envelope - Used to encode implant<->server messages since we cannot use gRPC due to the various transports used.

Used in: BeaconTasks

• int64 ID = 1

  Envelope ID used to track request/response

• uint32 Type = 2

  Message type

• bytes Data = 3

  Actual message data

• bool UnknownMessageType = 4

  Set if the implant did not understand the message

Used as response type in: rpcpb.SliverRPC.ExecWasmExtension

• bytes Stdout = 1

• bytes Stderr = 2

• uint32 ExitCode = 3

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.ExecWasmExtension

• string Name = 1

• repeated string Args = 2

• bool Interactive = 3

• map<string, bytes> MemFS = 4

• uint64 TunnelID = 8

  Bind to this tunnel

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Execute, rpcpb.SliverRPC.ExecuteWindows

• uint32 Status = 1

• bytes Stdout = 2

• bytes Stderr = 3

• uint32 Pid = 4

• optional commonpb.Response Response = 9

Used as response type in: rpcpb.SliverRPC.ExecuteAssembly

• bytes Output = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.ExecuteAssembly

• bytes Assembly = 1

• repeated string Arguments = 2

• string Process = 3

• bool IsDLL = 4

• string Arch = 5

• string ClassName = 6

• string Method = 7

• string AppDomain = 8

• uint32 PPid = 10

• repeated string ProcessArgs = 11

• bool InProcess = 12

  In process specific fields

• string Runtime = 13

• bool AmsiBypass = 14

• bool EtwBypass = 15

• optional commonpb.Request Request = 9

Used as request type in: rpcpb.SliverRPC.Execute

• string Path = 1

• repeated string Args = 2

• bool Output = 3

• string Stdout = 4

• string Stderr = 5

• uint32 PPid = 10

• optional commonpb.Request Request = 9

Used as request type in: rpcpb.SliverRPC.ExecuteWindows

• string Path = 1

• repeated string Args = 2

• bool Output = 3

• string Stdout = 4

• string Stderr = 5

• bool UseToken = 6

• bool HideWindow = 7

• uint32 PPid = 10

• optional commonpb.Request Request = 9

Used in: Ls

• string Name = 1

• bool IsDir = 2

• int64 Size = 3

• int64 ModTime = 4

• string Mode = 5

• string Link = 6

• string Uid = 7

• string Gid = 8

Used as response type in: rpcpb.SliverRPC.GetPrivs

• repeated WindowsPrivilegeEntry PrivInfo = 1

• string ProcessIntegrity = 2

• string ProcessName = 3

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.GetPrivs

• optional commonpb.Request Request = 9

GetSystem - The result of a InvokeGetSystemReq attempt

Used as response type in: rpcpb.SliverRPC.GetSystem

• optional commonpb.Response Response = 9

Used as response type in: rpcpb.SliverRPC.Grep

• map<string, GrepResultsForFile> Results = 1

• string SearchPathAbsolute = 2

• optional commonpb.Response Response = 9

Used in: GrepResult

• int32 Start = 1

• int32 End = 2

Used as request type in: rpcpb.SliverRPC.Grep

• string SearchPattern = 1

• string Path = 2

• bool Recursive = 3

• int32 LinesBefore = 4

• int32 LinesAfter = 5

• optional commonpb.Request Request = 9

Used in: GrepResultsForFile

• int64 LineNumber = 1

• repeated GrepLinePosition Positions = 2

• string Line = 3

• repeated string LinesBefore = 4

• repeated string LinesAfter = 5

Used in: Grep

• repeated GrepResult FileResults = 1

• bool IsBinary = 2

HTTP Sepecific message

• bytes Key = 1

Used as response type in: rpcpb.SliverRPC.Ifconfig

• repeated NetInterface NetInterfaces = 1

• optional commonpb.Response Response = 9

IfconfigReq - Request the implant to list network interfaces

Used as request type in: rpcpb.SliverRPC.Ifconfig

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Impersonate

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.Impersonate

• string Username = 1

• optional commonpb.Request Request = 9

• bytes Data = 1

• string process = 2

• uint32 PPid = 10

• repeated string ProcessArgs = 11

• optional commonpb.Request Request = 9

InvokeGetSystemReq - Implant-side version of GetSystemReq, this message contains the .Data based on the client's req.Config

• bytes Data = 1

• string HostingProcess = 2

• optional commonpb.Request Request = 9

• bytes Data = 1

• repeated string Arguments = 2

• string Runtime = 3

• bool AmsiBypass = 4

• bool EtwBypass = 5

• optional commonpb.Request Request = 9

• uint32 Pid = 1

• bytes Data = 2

• string ProcName = 3

• optional commonpb.Request Request = 9

Used as request type in: rpcpb.SliverRPC.SpawnDll

• bytes Data = 1

• string ProcessName = 2

• repeated string Args = 3

• string EntryPoint = 4

• bool Kill = 5

• uint32 PPid = 10

• repeated string ProcessArgs = 11

• optional commonpb.Request Request = 9

KillSessionReq - Request the implant to kill a session

Used as request type in: rpcpb.SliverRPC.Kill

• bool Force = 1

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.ListExtensions

• repeated string Names = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.ListExtensions

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.ListWasmExtensions

• repeated string Names = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.ListWasmExtensions

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Ls, rpcpb.SliverRPC.MemfilesList

• string Path = 1

• bool Exists = 2

• repeated FileInfo Files = 3

• string timezone = 4

• int32 timezoneOffset = 5

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.Ls

• string Path = 1

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.MakeToken

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.MakeToken

• string Username = 1

• string Password = 2

• string Domain = 3

• uint32 LogonType = 4

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.MemfilesAdd

• int64 Fd = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.MemfilesAdd

• optional commonpb.Request Request = 9

Used as request type in: rpcpb.SliverRPC.MemfilesList

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.MemfilesRm

• int64 Fd = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.MemfilesRm

• int64 Fd = 1

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Migrate

• bool Success = 1

• uint32 Pid = 2

• optional commonpb.Response Response = 9

Used as response type in: rpcpb.SliverRPC.Mkdir

• string Path = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.Mkdir

• string Path = 1

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Mount

• repeated MountInfo Info = 1

• optional commonpb.Response Response = 9

Used in: Mount

• string VolumeName = 1

• string VolumeType = 2

• string MountPoint = 3

• string Label = 4

• string FileSystem = 5

• uint64 UsedSpace = 6

• uint64 FreeSpace = 7

• uint64 TotalSpace = 8

• string MountOptions = 9

Used as request type in: rpcpb.SliverRPC.Mount

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Mv

• string Src = 1

• string Dst = 2

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.Mv

• string Src = 1

• string Dst = 2

• optional commonpb.Request Request = 9

Used in: PivotListener

• int64 PeerID = 1

• string RemoteAddress = 2

Used in: Ifconfig

• int32 Index = 1

• string Name = 2

• string MAC = 3

• repeated string IPAddresses = 4

Used as response type in: rpcpb.SliverRPC.Netstat

• repeated SockTabEntry Entries = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.Netstat

• bool TCP = 1

• bool UDP = 2

• bool IP4 = 3

• bool IP6 = 5

• bool Listening = 6

• optional commonpb.Request Request = 9

Used as request type in: rpcpb.SliverRPC.OpenSession

Used as response type in: rpcpb.SliverRPC.OpenSession

• repeated string C2s = 1

• int64 Delay = 2

• optional commonpb.Response Response = 8

• optional commonpb.Request Request = 9

Used in: PivotPeerFailure

• SEND_FAILURE = 0

• DISCONNECT = 1

Ping - Not ICMP, just sends a rount trip message to an implant to see if it's still responding.

Used as request type in: rpcpb.SliverRPC.Ping

Used as response type in: rpcpb.SliverRPC.Ping

• int32 Nonce = 1

• optional commonpb.Response Response = 8

  Ping is special

• optional commonpb.Request Request = 9

• bytes PublicKey = 1

• int64 PeerID = 2

• string PublicKeySignature = 3

• bytes SessionKey = 4

Used as response type in: rpcpb.SliverRPC.PivotStartListener

Used as field type in: PivotListeners

• uint32 ID = 1

• PivotType Type = 2

• string BindAddress = 3

• repeated NetConnPivot Pivots = 4

• optional commonpb.Response Response = 9

Used as response type in: rpcpb.SliverRPC.PivotSessionListeners

• repeated PivotListener Listeners = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.PivotSessionListeners

• optional commonpb.Request Request = 9

Used in: PivotPeerEnvelope

• int64 PeerID = 1

• string Name = 2

• repeated PivotPeer Peers = 1

• uint32 Type = 2

• bytes PivotSessionID = 3

• bytes Data = 4

• int64 PeerFailureAt = 5

• int64 PeerID = 1

• PeerFailureType Type = 2

• string Err = 3

• uint32 Nonce = 1

• int64 OriginID = 1

• bytes SessionKey = 2

Used as request type in: rpcpb.SliverRPC.PivotStartListener

• PivotType Type = 1

• string BindAddress = 2

• repeated bool Options = 3

• optional commonpb.Request Request = 9

Used as request type in: rpcpb.SliverRPC.PivotStopListener

• uint32 ID = 1

• optional commonpb.Request Request = 9

Used in: PivotListener, PivotStartListenerReq

• TCP = 0

• UDP = 1

• NamedPipe = 2

• optional commonpb.Response Response = 9

PollIntervalReq - Request the implant to update it's poll intervbal

• int64 PollInterval = 1

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Portfwd

• uint32 Port = 1

• int32 Protocol = 2

• string Host = 3

• uint64 TunnelID = 8

  Bind to this tunnel

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.Portfwd

• uint32 Port = 1

• int32 Protocol = 2

• string Host = 3

• uint64 TunnelID = 8

  Bind to this tunnel

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.ProcessDump

• bytes Data = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.ProcessDump

• int32 Pid = 1

• int32 Timeout = 2

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Ps

• repeated commonpb.Process Processes = 1

• optional commonpb.Response Response = 9

PsReq - Request the implant to list processes of a remote session.

Used as request type in: rpcpb.SliverRPC.Ps

• bool FullInfo = 1

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Cd, rpcpb.SliverRPC.Pwd

• string Path = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.Pwd

• optional commonpb.Request Request = 9

Used in: TunnelData

• uint32 Port = 1

• int32 Protocol = 2

• string Host = 3

• uint64 TunnelID = 8

  Bind to this tunnel

• optional commonpb.Response Response = 9

• uint32 Port = 1

• int32 Protocol = 2

• string Host = 3

• uint64 TunnelID = 8

  Bind to this tunnel

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Reconfigure

• optional commonpb.Response Response = 9

ReconfigureReq - Request the implant to reconfigure itself

Used as request type in: rpcpb.SliverRPC.Reconfigure

• int64 ReconnectInterval = 1

• int64 BeaconInterval = 2

• int64 BeaconJitter = 3

• optional commonpb.Request Request = 9

Register - First message the implant sends to the server

Used in: BeaconRegister, SessionRegister

• string Name = 1

• string Hostname = 2

• string Uuid = 3

• string Username = 4

• string Uid = 5

• string Gid = 6

• string Os = 7

• string Arch = 8

• int32 Pid = 9

• string Filename = 10

• string ActiveC2 = 11

• string Version = 12

• int64 ReconnectInterval = 13

• string ProxyURL = 14

• string ConfigID = 16

• int64 PeerID = 17

• string Locale = 18

Used as response type in: rpcpb.SliverRPC.RegisterExtension

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.RegisterExtension

• string Name = 1

• bytes Data = 2

• string OS = 3

• string Init = 4

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.RegisterWasmExtension

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.RegisterWasmExtension

• string Name = 1

• bytes WasmGz = 2

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.RegistryCreateKey

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.RegistryCreateKey

• string Hive = 1

• string Path = 2

• string Key = 3

• string Hostname = 4

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.RegistryDeleteKey

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.RegistryDeleteKey

• string Hive = 1

• string Path = 2

• string Key = 3

• string Hostname = 4

• optional commonpb.Request Request = 9

Used as request type in: rpcpb.SliverRPC.RegistryListValues

• string Hive = 1

• string Path = 2

• string Hostname = 4

  Keep the same ID as the other registry operations

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.RegistryRead

• string Value = 1

• optional commonpb.Response Response = 9

Used as response type in: rpcpb.SliverRPC.RegistryReadHive

• bytes Data = 1

• string Encoder = 2

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.RegistryReadHive

• string RootHive = 1

• string RequestedHive = 2

• optional commonpb.Request Request = 9

Used as request type in: rpcpb.SliverRPC.RegistryRead

• string Hive = 1

• string Path = 2

• string Key = 3

• string Hostname = 4

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.RegistryListSubKeys

• repeated string Subkeys = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.RegistryListSubKeys

• string Hive = 1

• string Path = 2

• string Hostname = 4

  Keep the same ID as the other registry operations

• optional commonpb.Request Request = 9

Registry - Registry related messages

• Unknown = 0

• Binary = 1

• String = 2

• DWORD = 3

• QWORD = 4

Used as response type in: rpcpb.SliverRPC.RegistryListValues

• repeated string ValueNames = 1

• optional commonpb.Response Response = 9

Used as response type in: rpcpb.SliverRPC.RegistryWrite

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.RegistryWrite

• string Hive = 1

• string Path = 2

• string Key = 3

• string Hostname = 4

• string StringValue = 5

• bytes ByteValue = 6

• uint32 DWordValue = 7

• uint64 QWordValue = 8

• uint32 Type = 10

• optional commonpb.Request Request = 9

Used as request type in: rpcpb.SliverRPC.RemoveService

• optional ServiceInfoReq ServiceInfo = 1

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.RevToSelf

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.RevToSelf

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Rm

• string Path = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.Rm

• string Path = 1

• bool Recursive = 2

• bool Force = 3

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.StartRportFwdListener, rpcpb.SliverRPC.StopRportFwdListener

Used as field type in: RportFwdListeners

• uint32 ID = 1

• string BindAddress = 2

• uint32 BindPort = 3

• string ForwardAddress = 4

• uint32 ForwardPort = 5

• optional commonpb.Response Response = 9

Used as response type in: rpcpb.SliverRPC.GetRportFwdListeners

• repeated RportFwdListener Listeners = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.GetRportFwdListeners

• optional commonpb.Request Request = 9

Used as request type in: rpcpb.SliverRPC.StartRportFwdListener

• string BindAddress = 1

• uint32 BindPort = 2

• uint32 ForwardPort = 3

• string ForwardAddress = 4

• optional commonpb.Request Request = 9

Used as request type in: rpcpb.SliverRPC.StopRportFwdListener

• uint32 ID = 1

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.RunAs

• string Output = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.RunAs

• string Username = 1

• string ProcessName = 2

• string Args = 3

• string Domain = 4

• string Password = 5

• bool HideWindow = 6

• bool NetOnly = 7

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.RunSSHCommand

• string StdOut = 1

• string StdErr = 2

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.RunSSHCommand

• string Username = 1

• string Hostname = 2

• uint32 Port = 3

• string Command = 4

• string Password = 5

• bytes PrivKey = 6

• string Krb5Conf = 7

• bytes Keytab = 8

• string Realm = 10

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Screenshot

• bytes Data = 1

• optional commonpb.Response Response = 9

ScreenshotReq - Request the implant take a screenshot

Used as request type in: rpcpb.SliverRPC.Screenshot

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.ServiceDetail

• optional ServiceDetails Detail = 1

• string Message = 2

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.ServiceDetail

• optional ServiceInfoReq ServiceInfo = 1

• optional commonpb.Request Request = 9

Used in: ServiceDetail, Services

• string Name = 1

• string DisplayName = 2

• string Description = 3

• uint32 Status = 4

• uint32 StartupType = 5

• string BinPath = 6

• string Account = 7

Used as response type in: rpcpb.SliverRPC.RemoveService, rpcpb.SliverRPC.StartService, rpcpb.SliverRPC.StartServiceByName, rpcpb.SliverRPC.StopService

• optional commonpb.Response Response = 9

Used in: RemoveServiceReq, ServiceDetailReq, StartServiceByNameReq, StopServiceReq

• string ServiceName = 1

• string Hostname = 2

Used as response type in: rpcpb.SliverRPC.Services

• repeated ServiceDetails Details = 1

• string Error = 2

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.Services

• string Hostname = 1

• optional commonpb.Request Request = 9

• string ID = 1

• optional Register Register = 2

Used as response type in: rpcpb.SliverRPC.SetEnv

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.SetEnv

• optional commonpb.EnvVar Variable = 1

• optional commonpb.Request Request = 9

Shell - Request the implant open a realtime shell tunnel

Used as response type in: rpcpb.SliverRPC.Shell

• string Path = 1

• bool EnablePTY = 2

• uint32 Pid = 3

• uint64 TunnelID = 8

• optional commonpb.Response Response = 9

ShellReq - Request the implant open a realtime shell tunnel

Used as request type in: rpcpb.SliverRPC.Shell

• string Path = 1

• bool EnablePTY = 2

• uint32 Pid = 3

• uint64 TunnelID = 8

  Bind to this tunnel

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Sideload

• string Result = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.Sideload

• bytes Data = 1

• string ProcessName = 2

• repeated string Args = 3

• string EntryPoint = 4

• bool Kill = 5

• bool isDLL = 6

• bool isUnicode = 7

• uint32 PPid = 10

• repeated string ProcessArgs = 11

• optional commonpb.Request Request = 9

Used in: Netstat

• optional SockTabEntry.SockAddr LocalAddr = 1

• optional SockTabEntry.SockAddr RemoteAddr = 2

• string SkState = 3

• uint32 UID = 4

• optional commonpb.Process Process = 5

• string Protocol = 6

Used in: SockTabEntry

• string Ip = 1

• uint32 Port = 2

Used as request type in: rpcpb.SliverRPC.CloseSocks, rpcpb.SliverRPC.CreateSocks

Used as response type in: rpcpb.SliverRPC.CreateSocks

• uint64 TunnelID = 8

• string SessionID = 9

Used as request type in: rpcpb.SliverRPC.SocksProxy

Used as response type in: rpcpb.SliverRPC.SocksProxy

• bytes Data = 1

• bool CloseConn = 2

• string Username = 3

• string Password = 4

• uint64 Sequence = 5

• uint64 TunnelID = 8

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.SpawnDll

• string Result = 1

• optional commonpb.Response Response = 9

• bytes Data = 1

• string ProcessName = 2

• uint32 Offset = 3

• repeated string Args = 4

• bool Kill = 5

• uint32 PPid = 10

• repeated string ProcessArgs = 11

• optional commonpb.Request Request = 9

Used as request type in: rpcpb.SliverRPC.StartServiceByName

• optional ServiceInfoReq ServiceInfo = 1

• optional commonpb.Request Request = 9

Used as request type in: rpcpb.SliverRPC.StartService

• string ServiceName = 1

• string ServiceDescription = 2

• string BinPath = 3

• string Hostname = 4

• string Arguments = 5

• optional commonpb.Request Request = 9

Used as request type in: rpcpb.SliverRPC.StopService

• optional ServiceInfoReq ServiceInfo = 1

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Msf, rpcpb.SliverRPC.MsfRemote, rpcpb.SliverRPC.Task

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.Task

• string Encoder = 1

• bool RWXPages = 2

• uint32 Pid = 3

• bytes Data = 4

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Terminate

• int32 Pid = 1

• optional commonpb.Response Response = 9

TerminateReq - Request the implant terminate a remote processes

Used as request type in: rpcpb.SliverRPC.Terminate

• int32 Pid = 1

• bool Force = 2

• optional commonpb.Request Request = 9

Tunnel - Tunnel related messages

Used as request type in: rpcpb.SliverRPC.CloseTunnel, rpcpb.SliverRPC.CreateTunnel

Used as response type in: rpcpb.SliverRPC.CreateTunnel

• uint64 TunnelID = 8

• string SessionID = 9

Used as request type in: rpcpb.SliverRPC.TunnelData

Used as response type in: rpcpb.SliverRPC.TunnelData

• bytes Data = 1

• bool Closed = 2

• uint64 Sequence = 3

• uint64 Ack = 4

• bool Resend = 5

• bool CreateReverse = 6

• optional RPortfwd rportfwd = 7

• uint64 TunnelID = 8

• string SessionID = 9

Used as response type in: rpcpb.SliverRPC.UnsetEnv

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.UnsetEnv

• string Name = 1

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.Upload

• string Path = 1

• int32 WrittenFiles = 2

• int32 UnwriteableFiles = 3

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.Upload

• string Path = 1

• string Encoder = 2

• bytes Data = 3

• bool IsIOC = 4

• string FileName = 5

• bool IsDirectory = 6

• bool Overwrite = 7

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.WGStartPortForward, rpcpb.SliverRPC.WGStopPortForward

• optional WGTCPForwarder Forwarder = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.WGStartPortForward

• int32 LocalPort = 1

• string RemoteAddress = 2

• optional commonpb.Request Request = 9

Used as request type in: rpcpb.SliverRPC.WGStopPortForward

• int32 ID = 1

• optional commonpb.Request Request = 9

Used as response type in: rpcpb.SliverRPC.WGStartSocks, rpcpb.SliverRPC.WGStopSocks

• optional WGSocksServer Server = 1

• optional commonpb.Response Response = 9

Used in: WGSocks, WGSocksServers

• int32 ID = 1

• string LocalAddr = 2

Used as response type in: rpcpb.SliverRPC.WGListSocksServers

• repeated WGSocksServer Servers = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.WGListSocksServers

• optional commonpb.Request Request = 9

Used as request type in: rpcpb.SliverRPC.WGStartSocks

• int32 Port = 1

• optional commonpb.Request Request = 9

Used as request type in: rpcpb.SliverRPC.WGStopSocks

• int32 ID = 1

• optional commonpb.Request Request = 9

Used in: WGPortForward, WGTCPForwarders

• int32 ID = 1

• string LocalAddr = 2

• string RemoteAddr = 3

Used as response type in: rpcpb.SliverRPC.WGListForwarders

• repeated WGTCPForwarder Forwarders = 1

• optional commonpb.Response Response = 9

Used as request type in: rpcpb.SliverRPC.WGListForwarders

• optional commonpb.Request Request = 9

Used in: GetPrivs

• string Name = 1

• string Description = 2

• bool Enabled = 3

• bool EnabledByDefault = 4

• bool Removed = 5

• bool UsedForAccess = 6