Merge pull request #797 from BishopFox/fix/extensions

Fix race condition in extensions
BishopFox · Aug 24, 2022 · 79f2d48 · 79f2d48
2 parents 166c494 + 0112192
commit 79f2d48
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 1 deletion.
diff --git a/client/command/extensions/load.go b/client/command/extensions/load.go
@@ -246,7 +246,7 @@ func loadExtension(goos string, goarch string, checkCache bool, ext *ExtensionMa
 		if !depLoaded && extName == ext.DependsOn {
 			depLoaded = true
 		}
-		if ext.Name == extName {
+		if ext.CommandName == extName {
 			return nil
 		}
 	}

diff --git a/implant/sliver/extension/extension_darwin.go b/implant/sliver/extension/extension_darwin.go
@@ -21,6 +21,7 @@ package extension
 import (
 	"bytes"
 	"runtime"
+	"sync"
 	"unsafe"
 
 	// {{if .Config.Debug}}
@@ -36,6 +37,7 @@ type DarwinExtension struct {
 	arch        string
 	serverStore bool
 	init        string
+	sync.Mutex
 }
 
 type extensionArguments struct {
@@ -64,6 +66,8 @@ func (d *DarwinExtension) GetArch() string {
 
 func (d *DarwinExtension) Load() error {
 	var err error
+	d.Lock()
+	defer d.Unlock()
 	loader, err := universal.NewLoader()
 	if err != nil {
 		return err
@@ -98,6 +102,8 @@ func (d *DarwinExtension) Call(export string, arguments []byte, onFinish func([]
 	// {{if .Config.Debug}}
 	log.Printf("Calling %s, arg size: %d\n", export, extArgs.inDataSize)
 	// {{end}}
+	d.Lock()
+	defer d.Unlock()
 	_, err := d.module.Call(export, uintptr(unsafe.Pointer(&extArgs)))
 	if err != nil {
 		return err

diff --git a/implant/sliver/extension/extension_windows.go b/implant/sliver/extension/extension_windows.go
@@ -21,6 +21,7 @@ package extension
 import (
 	"bytes"
 	"errors"
+	"sync"
 	"syscall"
 	"unsafe"
 
@@ -43,6 +44,7 @@ type WindowsExtension struct {
 	arch     string
 	init     string
 	onFinish func([]byte)
+	sync.Mutex
 }
 
 // NewWindowsExtension - Load a new windows extension
@@ -71,6 +73,8 @@ func (w *WindowsExtension) Load() error {
 	if len(w.data) == 0 {
 		return errors.New("{{if .Config.Debug}} extension data is empty {{end}}")
 	}
+	w.Lock()
+	defer w.Unlock()
 	w.module, err = memmod.LoadLibrary(w.data)
 	if err != nil {
 		return err
@@ -114,6 +118,8 @@ func (w *WindowsExtension) Call(export string, arguments []byte, onFinish func([
 	// The extension API must respect the following prototype:
 	// int Run(buffer char*, bufferSize uint32_t, goCallback callback)
 	// where goCallback = int(char *, int)
+	w.Lock()
+	defer w.Unlock()
 	_, _, errNo := syscall.Syscall(exportPtr, 3, argumentsPtr, argumentsSize, callback)
 	if errNo != 0 {
 		return errors.New(errNo.Error())