This release fixes an arbitrary file write in the link command, adds a new map command and fixes a small bug in how the multiplexer handles incoming data.
It is recommended to update as soon as possible due to the arbitrary file write.
Additionally, there is a known bug in how the golang compiler outputs .def files when building windows shared libraries. As such, until golang 1.26.6 is released the compilation of shared libraries in RSSH may randomly fail for no apparent reason:
E.g
/usr/lib/golang/pkg/tool/linux_amd64/link: running x86_64-w64-mingw32-gcc failed: exit status 1
/usr/bin/x86_64-w64-mingw32-gcc -m64 -s -mconsole -Wl,--tsaware -Wl,--nxcompat -Wl,--major-os-version=6 -Wl,--minor-os-version=1 -Wl,--major-subsystem-version=6 -Wl,--minor-subsystem-version=1 -shared -Wl,--dynamicbase -Wl,--high-entropy-va -o 11fb5ca480fcf8e92e3bae9a96dea482.dll /tmp/go-link-749114620/export_file.def -Wl,--no-insert-timestamp /tmp/go-link-749114620/go.o /tmp/go-link-749114620/000000.o /tmp/go-link-749114620/000001.o /tmp/go-link-749114620/000002.o /tmp/go-link-749114620/000003.o /tmp/go-link-749114620/000004.o /tmp/go-link-749114620/000005.o /tmp/go-link-749114620/000006.o /tmp/go-link-749114620/000007.o /tmp/go-link-749114620/000008.o /tmp/go-link-749114620/000009.o /tmp/go-link-749114620/000010.o -O2 -g -O2 -g -Wl,-T,/tmp/go-link-749114620/fix_debug_gdb_scripts.ld -Wl,--start-group -lmingwex -lmingw32 -Wl,--end-group -lkernel32
/usr/x86_64-w64-mingw32/bin/ld: /tmp/go-link-749114620/export_file.def:1: syntax error
/usr/x86_64-w64-mingw32/bin/ld:/tmp/go-link-749114620/export_file.def: file format not recognized; treating as linker script
/usr/x86_64-w64-mingw32/bin/ld:/tmp/go-link-749114620/export_file.def:1: syntax error
collect2: error: ld returned 1 exit status
Features:
mapcommand, when chaining RSSH clients together using the server port forward (link -c <client_id> --on :port)mapcan be used to display what clients are children of other clients, helpful when you want to know what client to connect to when pivoting thanks to @kavishkagihan- RSSH can now specify that a client with a specific public key can only connect once, using the
--single-sessionlinkcommand flag or by editing theauthorized_controllee_keysfile to add thesingle_sessionoption. Useful for when you have an injection point that is calling your rssh binary multiple times thanks @nicolascbl
Fixes:
- Prevent multiplexer from blocking randomly even when content has already been read #221 thanks @durck
Security:
linkcommand arguments that are passed asldflagsto the go compiler are now properly sanitized to prevent arbitrary write. This does change the allowed characters within the flags and will error if those are encountered. Thanks to @sudo-awk for discovering this