Anti-virus trigger in go-rod leakless usage

[farfiree]

I think there is a (Sliver) backdoor in one of the dependencies. I'm getting an error while running:
go install github.com/sensepost/gowitness@latest

Type:           Backdoor
Name:           OSX/Sliver.ext
Infected file:  /private/var/folders/_w/44dlnjtx0nqg9k3g2ygx627c0000gn/T/go-build987384094/b001/exe/a.out

What's up with that

[leonjza]

I doubt that is a true positive. What generated that output? Are you sure it's related to gowitness and not a sliver install you have?

I uploaded the compiled ARM darwin artefact to VirusTotal out of interest anyways. https://www.virustotal.com/gui/file/713f81ab9889e03dd07f5a56a9a4bed3d51ce133bbaef6f612dfee1b5effa529?nocache=1

[leonjza]

Also, can you share that a.out file and hash, please?

[farfiree]

We are running Intego AV on a mac. The a.out gets blocked as soon as the following command has run:

mkdir -p $WORK/b001/exe/
cd .
GOROOT='/Users/REDACTED/go/pkg/mod/golang.org/[email protected]' /Users/REDACTED/go/pkg/mod/golang.org/[email protected]/pkg/tool/darwin_arm64/link -o $WORK/b001/exe/a.out -importcfg $WORK/b001/importcfg.link -buildmode=pie -buildid=dcbGX_7BTSizGG4pnSb8/zGK6RljhxGqvJzyxtHZZ/D7BrStvtBhejyAowUzzj/dcbGX_7BTSizGG4pnSb8 -extld=clang /Users/REDACTED/Library/Caches/go-build/ac/acc89e6df0e91b624f755c4e3631a64fe97591843457f005848c0a9fbbe675fe-d
/Users/REDACTED/go/pkg/mod/golang.org/[email protected]/pkg/tool/darwin_arm64/buildid -w $WORK/b001/exe/a.out # internal
github.com/sensepost/gowitness: open /var/folders/_w/44dlnjtx0nqg9k3g2ygx627c0000gn/T/go-build3209052745/b001/exe/a.out: operation not permitted

I Would like to share the hash of the file with you but I don't know how to compile it without it being a risk. I'm unfamiliar with the compiling process and if that poses any risk.

I ran the following command for more verbose output

go install -x github.com/sensepost/gowitness@latest

[farfiree]

Also to add: I do not have Sliver framework installed. I'm familiar with it but it's not installed. Running the go install command on a different mac gives the same result.

[leonjza]

Unfortunately I don't know Intego AV, (it also doesn't seem to be listed on VirusTotal). I'm going to go with a false positive in your AV for now given the 64 vendors being okay with the arm Darwin binary at least.

Feel free to build and upload your own (in a sandbox without your AV) to test, ofc!

If you learn anything more about why this is happening, feel free to add, thanks!

[leonjza]

Sorry and just to be clear, there should be no sliver related dependency / artefact in gowitness.

[leonjza]

I think it's related to this issue: ysmood/leakless#8, which means I may temporarily remove the go-rod driver until that is resolved.