RAT Sliver Command & Control - C2 Framework

[dEEpEst]

Sliver Command & Control​

---

Sliver is a powerful command and control (C2) framework designed to provide advanced capabilities for covertly managing and controlling remote systems. With Sliver, security professionals, red teams, and penetration testers can easily establish a secure and reliable communication channel over Mutual TLS, HTTP(S), DNS, or Wireguard with target machines. Enabling them to execute commands, gather information, and perform various post-exploitation activities. The framework offers a user-friendly console interface, extensive functionality, and support for multiple operating systems as well as multiple CPU architectures, making it an indispensable tool for conducting comprehensive offensive security operations.

┌──(kali㉿kali)-[~]                                                        
└─$ ./sliver-server                                                      
                                                                         
          ██████  ██▓     ██▓ ██▒   █▓▓█████  ██▀███                      
        ▒██    ▒ ▓██▒    ▓██▒▓██░   █▒▓█   ▀ ▓██ ▒ ██▒                    
        ░ ▓██▄   ▒██░    ▒██▒ ▓██  █▒░▒███   ▓██ ░▄█ ▒                    
          ▒   ██▒▒██░    ░██░  ▒██ █░░▒▓█  ▄ ▒██▀▀█▄                      
        ▒██████▒▒░██████▒░██░   ▒▀█░  ░▒████▒░██▓ ▒██▒                    
        ▒ ▒▓▒ ▒ ░░ ▒░▓  ░░▓     ░ ▐░  ░░ ▒░ ░░ ▒▓ ░▒▓░                    
        ░ ░▒  ░ ░░ ░ ▒  ░ ▒ ░   ░ ░░   ░ ░  ░  ░▒ ░ ▒░                    
        ░  ░  ░    ░ ░    ▒ ░     ░░     ░     ░░   ░                    
                  ░      ░  ░ ░        ░     ░  ░   ░                    
                                                                         
All hackers gain jump-start                                              
[*] Server v1.5.41 - f2a3915c79b31ab31c0c2f0428bbd53d9e93c54b            
[*] Welcome to the sliver shell, please type 'help' for options          
                                                                         
[server] sliver >

Install

curl https://sliver.sh/install|sudo bash
sliver

Sliver Tutorials!

This link is hidden for visitors. Please Log in or register now.

 

[dEEpEst]

Showcasing Sliver C2 (Command and Control) \\UserWare​

Sliver C2 is brand new (and still in development) Command and Control Framework. It has only CLI version (for now) and is designed to be extremely easy to install and to work with. It is capable of:
* Generating beacons, completely evading Windows Defender!
* Establishing Persistence with various of way, including registry tweaking.
* Many more options that we did not have the time to walk through this stream, but surely there will be part 2
We also covered powershell coding and AMSI bypassing along with a Cyber-Friend of mine \\UserWare
--------------------------------------------------

• 00:00 - Intro
• 00:18 - Installing Sliver C2
• 04:49 - First Impressions and Generating Listeners
• 09:30 - Generating and Working with Beacons
• 17:20 - Bypassing Defender with HTTP Beacon
• 19:56 - C2 Walkthrough
• 38:39 - Establishing Persistence with Exe Hijacking
• 54:58 - Analyzing C2 Traffic
• 1:03:00 - Trying to figure out how to Establish Persistence with Registry Tweaks
• 1:33:50 - Establishing Persistence with Registry Tweaks
• 1:46:43 - Learning AMSI Bypass, loading PowerView
• 2:04:50 - Converting Beacons with MSFVenom
• 2:14:18 - Outro with Cyber Report about APT-29

 

[dEEpEst]

Using and Hunting Sliver c2 beacons​

In today's video, I show you how to work with the Sliver adversary emulation team framework. I will explain how to use Sliver, and I will show you four different ways to detect if a Sliver beacon is installed on a system.
--------------------------------------------------

• 00:00 Introduction
• 00:47 Sliver Setup
• 02:48 Sliver Beacon Generation and Usage
• 05:36 Sliver Armory
• 07:07 Sliver Shell Detection
• 10:25 Sliver Getsystem Detection
• 13:39 Sliver PSExec Detection
• 17:02 CyberChef Sliver Beacon Verification
• 18:00 Sliver SIEM Rule Creation
• 22:00 Hack the Planet to Defend Better!

CyberChef:

This link is hidden for visitors. Please Log in or register now.

 

[dEEpEst]

IRL Hacker: EP #36 - Checking out Sliver C2​

Checking out SliverC2 by the people over at BishopFox,

This link is hidden for visitors. Please Log in or register now.

SOCKS5 is freaking awesome, main benefit being able to connect over UDP and therefor DNS.

note: this is a somewhat annoying/lame video of a live stream where Flangvik is going through looking at Sliver. It might be interesting to those unfamiliar with Sliver.