SSRF in sliver teamserver

QFinch assessment

The reverse port forwarding in sliver teamserver allows the implant to open a reverse tunnel on the sliver teamserver without verifying if the operator instructed the implant to do so

Potential impact

For current POC, mostly just leaking teamserver origin IP behind redirectors. I am 99% sure you can get full read SSRF but POC is blind only right now To exploit this for MTLS listeners, you will need MTLS keys For HTTP listeners, you will need to generate valid nonce Not sure about other transport types

Technical context

We see here an envelope is read from the connection and if the envelope.Type matches a handler the handler will be executed The available handlers: If we send an envelope with the envelope.Type equaling MsgTunnelData, we will enter the tunnelDataHandler function The createReverseTunnelHandler reads the envelope, creating a socket for req.Rportfwd.Host and req.Rportfwd.Port. It will write recv.Data to it