anthrax3 / sliver

Implant framework

Sliver

⚠️ Warning: Sliver is currently in beta, you've been warned :) and please consider contributing

Sliver is a general purpose cross-platform implant framework that supports C2 over Mutual-TLS, HTTP(S), and DNS. Implants are dynamically compiled with unique X.509 certificates signed by a per-instance certificate authority generated when you first run the binary.

The server, client, and implant all support MacOS, Windows, and Linux (and possibly every Golang compiler target but we've not tested them all).

Features

• Dynamic code generation
• Compile-time obfuscation
• Multiplayer-mode
• Procedurally generated C2 over HTTP(S)
• DNS canary blue team detection
• Secure C2 over mTLS, HTTP(S), and DNS
• Fully scriptable
• Local and remote process injection
• Windows process migration
• Windows user token manipulation
• Anti-anti-anti-forensics
• Let's Encrypt integration
• In-memory .NET assembly execution

Getting Started

Download the latest release and see the Sliver wiki for a quick tutorial on basic setup and usage. To get the very latest and greatest compile from source.

Help!

Please checkout the wiki, or join the #golang Slack channel on the Bloodhound Gang server.

Compile From Source

See the wiki.

License - GPLv3

Sliver is licensed under GPLv3, some sub-components may have separate licenses. See their respective subdirectories in this project for details.