Is it possible to run local reactions?

[trane77]

Hello,

I'm wondering if it's possible to use the reaction command to configure an action to run locally on the server, every time a certain event occurs.

The scenario is the following:

• a new beacon is received
• local reaction detects the event
• a custom script is executed (e.g.: send a notification using an external service)

As far as I understood, reactions are used mostly to automate operations on the target, more than locally on the server.

Thanks

[moloch--]

Kind of but not really, you can currently do it from the sliver-server console if you have it running in tmux or if the server is running in daemon mode you can start a local sliver-client and set a reaction, but a remote operator can't really set a reaction on the server. This is a feature I've been meaning to add and not gotten around to it yet.

[trane77]

I see. I can't guarantee that (time is not on our side), but if you're interested I can try to implement a POC.

[moloch--]

The main thing to keep in mind is that we do keep a security boundary between the operators and the server; thus some commands like "upload" need to be restricted when evaluating server-side reactions so it's not a super-simple thing to implement. I'd recommend using sliver-py to do more complex event reactions.

[trane77]

My need is to run a command on the machine where sliver-server is running, it could be a bash script or anything else that can be run from terminal. To be precise, I wanted to send a telegram message, to be notified when a certain event occurs. If you say sliver-py is the way to go, I'll read the docs ;-)