slipstream —— red team ssh wrapper

SLIPSTREAM

Red team SSH wrapper — tunnels, transfers, mapping, logging.
All flags pass through. Linux + Windows targets.

2.4 MB
Binary Size
118
Tests
~6.4K
Lines of Rust
0
Dependencies

Wrapped. Logged. Mapped.

Everything you need during an engagement without changing how you work. All SSH flags pass through unchanged — Slipstream stays invisible while building a full picture of the target.

PTY Wrapper

Wraps the real ssh binary. All flags, -o options, and ~/.ssh/config pass through unchanged. Your workflow doesn't change — Slipstream just listens.

Tunnel Management

iptables-style syntax. Real SSH forwarding via control socket. Add, delete, list, flush, save, and restore tunnels per target. SOCKS, local, and reverse forwards.

File Transfers

Upload and download with SFTP→SCP→cat→base64 fallback chain. Windows paths handled automatically via forward-slash conversion. Works even on locked-down targets.

Filesystem Mapper

Passive output parsing. Builds a searchable map from ls, dir, find, net user, and ipconfig. No extra commands sent — it reads what's already on screen.

Session Logging

Per-command log files with timestamps. Session index for OSCP proof and engagement reporting. Every command, every response, automatically captured.

Auto-Loot

One command grabs passwd, shadow, SAM, systeminfo, ipconfig, privileges, users, processes, and network connections. Triage in seconds, not minutes.

Data flow & component model.

Slipstream sits transparently between the operator and the SSH child process. The PTY layer intercepts all I/O — commands trigger built-in handlers, output feeds the passive mapper and logger.

slipstream —— data flow
Operator
Terminal
stdin
stdout
Slipstream PTY
Interceptor
passthrough
output
SSH Child
Real Binary
encrypted
encrypted
Target
Linux / Windows

! Commands
!tunnel, !upload, !download
!loot, !map, !exec
!note, !help, !sessions
Log Engine
Per-command log files
Timestamped session index
Boundary detection
FS Mapper
Passive output parsing
ls / dir / find parsers
CWD tracker

Master Socket
ControlMaster multiplexing
ssh -O tunnel operations
Fingerprint capture
Tunnels / Transfers
SOCKS / local / reverse
SFTP → SCP → cat → b64
Save / restore per target

Linux targets and Windows targets.

Slipstream adapts to the remote OS automatically. Parser selection, prompt injection, and path handling all switch based on detected target type.

linux —— target detection

Linux Targets

Parse ls, find, tree, /etc/passwd, ip a output passively
PROMPT_COMMAND injection for CWD tracking
Forward-slash paths throughout — no conversion needed
SFTP-first transfer with cat/base64 fallback
loot targets /etc/passwd, /etc/shadow, privileges, processes
windows —— target detection

Windows Targets

Parse dir, net user, ipconfig, systeminfo passively
PowerShell prompt injection for CWD tracking
Auto forward-slash conversion for SCP compatibility
loot targets SAM, systeminfo, ipconfig, net user
Backslash-to-slash path rewriting on all transfers

Every capability, mapped.

Six subsystems. Thirty capabilities. One binary that wraps your existing ssh workflow without altering it.

slipstream —— component map
PTY Spawn
Argument Passthrough
Binary Discovery
Master Socket
Fingerprint Capture
SOCKS Proxy
Local Forward
Reverse Forward
Save / Restore
SSH -O Forward
SFTP Method
SCP Method
Cat Method
Base64 Method
Fallback Chain
ls Parser
dir Parser
find Parser
net user Parser
ipconfig Parser
CWD Tracker
Per-Command Logs
Session Index
Boundary Detection
Target Identity
Auto-Loot
Target Notes
Exec via Socket
Help System
SSH Tunnels Transfers Mapper Session QOL

Build and connect.

Cargo build. Drop in your PATH. Connect exactly as you would with ssh — every flag, every option, every config entry still works.

bash —— build & connect
# Build
$ cargo build --release
# Connect (all SSH flags work)
$ slipstream ssh user@10.10.10.5
# Inside the session — use ! commands
slipstream> !help
# Add a SOCKS proxy on port 1080
slipstream> !tunnel add --type socks -p 1080
# Upload a file to the target
slipstream> !upload linpeas.sh /tmp/
# Grab common loot (passwd, shadow, SAM, etc.)
slipstream> !loot
# Search the passive filesystem map
slipstream> !map
# Run a command via the control socket (no new pty)
slipstream> !exec whoami
# Add a note about this target
slipstream> !note This is the DC