# GHSA-wxrw-gvg8-fqjp

## Summary

Sliver has DNS C2 OTP Bypass that Allows Unauthenticated Session Flooding and Denial of Service

## Description

## Summary
The DNS C2 listener accepts unauthenticated `TOTP` bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when `EnforceOTP` is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion.

## Vulnerable Component
- `server/c2/dns.go:84-90` (`EnforceOTP` stored but not enforced in bootstrap)
- `server/c2/dns.go:378-390` (`TOTP` requests routed directly to bootstrap)
- `server/c2/dns.go:490-521` (`handleHello` allocates session without OTP validation)
- `server/c2/dns.go:495` (`sessions.Store` with no lifecycle control in this path)
- `client/command/jobs/dns.go:46-52` (operator-facing `EnforceOTP` control implies auth gate)
- `implant/sliver/transports/dnsclient/dnsclient.go:896-900` (`otpMsg` sends `TOTP` with `ID=0`)
- `protobuf/dnspb/dns.proto:22` (documents TOTP in `ID` field)

## Attack Vector
- Network-accessible DNS listener
- No authentication required
- Low-complexity repeated DNS query loop
- Trigger path: `DNSMessageType_TOTP` bootstrap handling

## Proof of Concept
### Preconditions
- DNS listener is reachable
- DNS C2 job is active

### Reproduction Steps
1. Send repeated DNS queries with a minimal protobuf message of type `TOTP`.
2. Observe repeated session allocation/issuance behavior.
3. Continue requests to increase active in-memory session state.

### Example
```bash
while true; do
  dig +short @<DNS_C2_IP> baa8.<parent-domain> A >/dev/null
done
```

`baa8` is a base32 payload for a minimal TOTP-type protobuf message.

### Observable Indicators
- Repeated bootstrap/session-allocation log entries from `handleHello`
- Rising memory usage in the Sliver server process
- Service slowdown or instability under sustained request volume

## Impact
- Unauthenticated remote denial of service (availability)
- Resource exhaustion through unbounded session growth in DNS bootstrap path