Affected by GO-2024-2993 and 1 other vulnerabilities

GO-2024-2993: Sliver Allows Authenticated Operator-to-Server Remote Code Execution in github.com/bishopfox/sliver

GO-2026-4280: Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass in github.com/bishopfox/sliver

loot

package

v1.6.5 Latest Latest Go to latest Published: Jan 16, 2026 License: GPL-3.0 Imports: 30 Imported by: 11

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/bishopfox/sliver

Links

Open Source Insights

README ¶

client/command/loot

Overview

Implements the 'loot' command group for the Sliver client console. Handlers map Cobra invocations to loot workflows such as fetch, local, remote, and rename.

Go Files

commands.go – Declares the loot command tree and binds fetch/local/removal subcommands.
fetch.go – Downloads remote loot artifacts and writes them to local storage.
helpers.go – Provides helper functions for lookup, filtering, and formatting loot entries.
local.go – Lists, inspects, and opens loot stored on the client filesystem.
loot.go – Shows remote loot inventory and renders summaries.
remote.go – Interacts with server-side loot, supporting filtering and detail views.
rename.go – Renames loot items while synchronizing local and remote metadata.
rm.go – Deletes loot entries from the server or local cache with confirmation prompts.

Documentation ¶

Index ¶

Variables
func AddLootFile(rpc rpcpb.SliverRPCClient, name string, fileName string, data []byte, ...) error
func Commands(con *console.SliverClient) []*cobra.Command
func CreateLootMessage(hostUUID string, fileName string, lootName string, ...) *clientpb.Loot
func FileTypeCompleter(con *console.SliverClient) carapace.Action
func LootAddLocalCmd(cmd *cobra.Command, con *console.SliverClient, args []string)
func LootAddRemoteCmd(cmd *cobra.Command, con *console.SliverClient, args []string)
func LootBinary(data []byte, lootName string, lootFileName string, fileType clientpb.FileType, ...)
func LootCmd(cmd *cobra.Command, con *console.SliverClient, args []string)
func LootDownload(download *sliverpb.Download, lootName string, fileType clientpb.FileType, ...)
func LootFetchCmd(cmd *cobra.Command, con *console.SliverClient, args []string)
func LootRenameCmd(cmd *cobra.Command, con *console.SliverClient, args []string)
func LootRmCmd(cmd *cobra.Command, con *console.SliverClient, args []string)
func LootText(text string, lootName string, lootFileName string, fileType clientpb.FileType, ...)
func LootTypeCompleter(con *console.SliverClient) carapace.Action
func PerformDownload(remotePath string, fileName string, cmd *cobra.Command, ...) (*sliverpb.Download, error)
func PrintAllFileLootTable(allLoot *clientpb.AllLoot, con *console.SliverClient)
func PrintLootFile(loot *clientpb.Loot, con *console.SliverClient)
func SelectLoot(cmd *cobra.Command, rpc rpcpb.SliverRPCClient) (*clientpb.Loot, error)
func SendLootMessage(loot *clientpb.Loot, con *console.SliverClient)
func ValidateLootFileType(lootFileTypeInput string, data []byte) clientpb.FileType

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	// ErrInvalidFileType - Invalid file type
	ErrInvalidFileType = errors.New("invalid file type")
	// ErrInvalidLootType - Invalid loot type
	ErrInvalidLootType = errors.New("invalid loot type")
	// ErrNoLootFileData - No loot file data
	ErrNoLootFileData = errors.New("no loot file data")
)

Functions ¶

func AddLootFile ¶

func AddLootFile(rpc rpcpb.SliverRPCClient, name string, fileName string, data []byte, isCredential bool) error

AddLootFile - Add a file as loot

func Commands ¶ added in v1.6.0

func Commands(con *console.SliverClient) []*cobra.Command

Commands returns the “ command and its subcommands.

func CreateLootMessage ¶ added in v1.5.13

func CreateLootMessage(hostUUID string, fileName string, lootName string, lootFileType clientpb.FileType, data []byte) *clientpb.Loot

func FileTypeCompleter ¶ added in v1.6.0

func FileTypeCompleter(con *console.SliverClient) carapace.Action

FileTypeCompleter completes valid filetypes for loot.

func LootAddLocalCmd ¶

func LootAddLocalCmd(cmd *cobra.Command, con *console.SliverClient, args []string)

LootAddLocalCmd - Add a local file to the server as loot

func LootAddRemoteCmd ¶

func LootAddRemoteCmd(cmd *cobra.Command, con *console.SliverClient, args []string)

LootAddRemoteCmd - Add a file from the remote system to the server as loot

func LootBinary ¶ added in v1.6.0

func LootBinary(data []byte, lootName string, lootFileName string, fileType clientpb.FileType, con *console.SliverClient)

func LootCmd ¶

func LootCmd(cmd *cobra.Command, con *console.SliverClient, args []string)

LootCmd - The loot root command

func LootDownload ¶ added in v1.5.13

func LootDownload(download *sliverpb.Download, lootName string, fileType clientpb.FileType, cmd *cobra.Command, con *console.SliverClient)

func LootFetchCmd ¶

func LootFetchCmd(cmd *cobra.Command, con *console.SliverClient, args []string)

LootFetchCmd - Display the contents of or download a piece of loot

func LootRenameCmd ¶

func LootRenameCmd(cmd *cobra.Command, con *console.SliverClient, args []string)

LootRenameCmd - Rename a piece of loot

func LootRmCmd ¶

func LootRmCmd(cmd *cobra.Command, con *console.SliverClient, args []string)

func LootText ¶ added in v1.6.0

func LootText(text string, lootName string, lootFileName string, fileType clientpb.FileType, con *console.SliverClient)

func LootTypeCompleter ¶ added in v1.6.0

func LootTypeCompleter(con *console.SliverClient) carapace.Action

LootTypeCompleter completes valid loot type for a loot.

func PerformDownload ¶ added in v1.5.13

func PerformDownload(remotePath string, fileName string, cmd *cobra.Command, con *console.SliverClient) (*sliverpb.Download, error)

Eventually this function needs to be refactored out, but we made the decision to duplicate it for now

func PrintAllFileLootTable ¶

func PrintAllFileLootTable(allLoot *clientpb.AllLoot, con *console.SliverClient)

PrintAllFileLootTable - Displays a table of all file loot

func PrintLootFile ¶

func PrintLootFile(loot *clientpb.Loot, con *console.SliverClient)

PrintLootFile - Display the contents of a piece of loot

func SelectLoot ¶

func SelectLoot(cmd *cobra.Command, rpc rpcpb.SliverRPCClient) (*clientpb.Loot, error)

SelectLoot - Interactive menu for the user to select a piece loot (all types)

func SendLootMessage ¶ added in v1.5.13

func SendLootMessage(loot *clientpb.Loot, con *console.SliverClient)

func ValidateLootFileType ¶ added in v1.5.13

func ValidateLootFileType(lootFileTypeInput string, data []byte) clientpb.FileType

Types ¶

This section is empty.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL