Sliver is a general purpose cross-platform implant framework that supports C2 over Mutual-TLS, HTTP(S), and DNS. Implants are dynamically compiled with unique X.509 certificates signed by a per-instance certificate authority generated when you first run the binary.
The server, client, and implant all support MacOS, Windows, and Linux (and possibly every Golang compiler target but we've not tested them all).
Features
- Dynamic code generation
- Compile-time obfuscation
- Local and remote process injection
- Anti-anti-anti-forensics
- Secure C2 over mTLS, HTTP(S), and DNS
- Windows process migration
- Windows user token manipulation
- Multiplayer-mode
- Procedurally generated C2 over HTTP (work in progress)
- Let's Encrypt integration
- In-memory .NET assembly execution
- DNS CanaryBlue Team Detection
Getting Started
Download the latest release and see the Sliver wiki for a quick tutorial on basic setup and usage. To get the very latest and greatest compile from source.
Compile From Source
See the wiki.
Source Code
The source code repo contains the following directories:
assets/- Static assets that are embedded into the server binary, generated bygo-assets.shclient/- Client code, the majority of this code is also used by the serverprotobuf/- Protobuf codeserver/- Server-side codesliver/- Implant code, rendered by the server at runtimeutil/- Utility functions that may be shared by the server and client