Headline
GHSA-8jxm-xp43-qh3q: Silver vulnerable to MitM attack against implants due to a cryptography vulnerability
Summary
The current cryptography implementation in Sliver up to version 1.5.39 allows a MitM with access to the corresponding implant binary to execute arbitrary codes on implanted devices via intercepted and crafted responses. (Reserved CVE ID: CVE-2023-34758)
Details
Please see the PoC repo.
PoC
Please also see the PoC repo. To setup a simple PoC environment,
- Generate an implant with its C2 set to the PoC server’s address and copy the embedded private implant key and public server key into the config json.
- Run the implant on a separate VM and a
notepad.exewindow should pop up on the implanted VM.
Impact
A successful attack grants the attacker permission to execute arbitrary code on the implanted device.
References
https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/implant.go
https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/crypto.go
https://github.com/tangent65536/Slivjacker
Credits
Package
gomod github.com/bishopfox/sliver (Go)
Affected versions
>= 1.5.0, < 1.5.40
Patched versions
1.5.40
Description
Summary
The current cryptography implementation in Sliver up to version 1.5.39 allows a MitM with access to the corresponding implant binary to execute arbitrary codes on implanted devices via intercepted and crafted responses. (Reserved CVE ID: CVE-2023-34758)
Details
Please see the PoC repo.
PoC
Please also see the PoC repo.
To setup a simple PoC environment,
- Generate an implant with its C2 set to the PoC server’s address and copy the embedded private implant key and public server key into the config json.
- Run the implant on a separate VM and a notepad.exe window should pop up on the implanted VM.
Impact
A successful attack grants the attacker permission to execute arbitrary code on the implanted device.
References
https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/implant.go
https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/crypto.go
https://github.com/tangent65536/Slivjacker
Credits
Ting-Wei Hsieh from CHT Security Co. Ltd.
References
- GHSA-8jxm-xp43-qh3q
- BishopFox/sliver@2d1ea61
- https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/crypto.go
- https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/implant.go
- https://github.com/BishopFox/sliver/releases/tag/v1.5.40
- https://github.com/tangent65536/Slivjacker
moloch-- published to BishopFox/sliver
Jun 20, 2023
Published to the GitHub Advisory Database
Jun 21, 2023
Reviewed
Jun 21, 2023
Last updated
Jun 21, 2023
Related news
Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-the-middle attack via intercepted and crafted responses.
Sliver is an open source cross-platform adversary emulation/red team framework. The cryptography implementation in Sliver up to and including version 1.5.39 allows a man in the middle (MitM) attack with access to the corresponding implant binary to execute arbitrary codes on implanted devices via intercepted and crafted responses. A successful attack grants the attacker permission to execute arbitrary code on the implanted device. Users are advised to upgrade. There are no known workarounds for this vulnerability.