LoadReload

LoadReload Shellcode Loader based on what i did for my Master Thesis, designed for Sliver-Shellcode smaller than 25MB..... !Note Features: Multibyte-XOR Decryption of Payload Fetches Payload locally Anti-Emulation by BusySleep-Function via KUSERSHAREDDATA RW-RX-Loop for EDR-Deconditioning / Wasti...

sliver-tor-bridge

sliver-tor-bridge tor-based transport bridge for sliver c2. creates a hidden service and proxies traffic to your sliver server so your real ip is never exposed. what it does sets up a tor hidden service that points to a local http proxy. the proxy forwards everything to sliver's https listener...

linux-root-kit

About This Project This project was developed as part of the Digitale Forensik course at the Technische Hochschule Deggendorf. It demonstrates a full forensic investigation and attack simulation involving: A Python dependency confusion attack using a malicious PyPI package Privilege escalation vi...

sliver-gui

Sliver GUI A desktop operator console for the Sliver C2 framework in the spirit of Cobalt Strike and Havoc. Designed and Developed by Raj Kumar Mullapudi Sliver GUI is a thin Wails v2 Go + plain HTML/CSS/JS frontend over Sliver's existing rpcpb.SliverRPC gRPC service. It reimplements no C2 logic...

sliver-n8n-notifications

Sliver C2 + n8n Integration Real-time notifications for Sliver C2 implant callbacks via Discord and Slack Overview This project integrates Sliver C2 Command & Control framework with n8n workflow automation to provide real-time notifications when new implant connections are established. When a...

CVE-2026-32941

A framework-wide vulnerability in Sliver C2 allows for an unauthenticated, remote Denial of Service by triggering Uncontrolled Memory Allocation CWE-789 / CWE-400, leading to a process-wide Out-of-Memory OOM crash. References: Tenable Reproduction Steps: 1. Extract Credentials: Obtain the mTLS...

RogueSliver

RogueSliver Un conjunto de herramientas para interrumpir campañas que utilizan el framework Sliver C2. Esta herramienta, sus usos y cómo fue creada se cubrirán en profundidad en ACEResponder.com Esta herramienta es solo para fines educativos. | ---|--- ExtractCerts.py| Extrae certificados mtls y...

sliver

go-fcm English | 繁體中文 | 简体中文 基于 github.com/edganiukov/fcm 分支 Firebase 云消息官方文档 目录 go-fcm 目录 功能特性 支持的消息类型 快速开始 认证与凭证 使用示例 高级配置 自定义 HTTP Client 代理支持 单元测试与模拟 最佳实践 故障排查 架构图 常见问题 许可证 功能特性 功能| 支持| 说明 ---|---|--- 单设备推送| ✅| 发送消息到单一设备 多设备推送| ✅| 发送消息到多个设备 主题推送| ✅| 发送消息到指定主题 条件推送| ✅| 支持 FCM 条件语法 自定义 HTTP...

nimcrypt

nimcrypt A Sliver shellcode loader written in Nim targeting Windows x64. Two variants covering the two most common delivery situations. Tested against Windows Defender with real-time protection enabled. Variants stager Reads an encrypted shellcode blob from disk, decrypts it in memory, and...

CaddySmith

CaddySmith CaddySmith is a small Python script that reads a Cobalt Strike or Sliver C2 profile and forges a Caddy web server config out of it. The generated Caddyfile turns a regular Linux box into a redirector: legitimate beacon traffic gets reverse-proxied to your team server, and anything else...

Lucky-Spark

LUCKY-SPARK ⟪ LUCKY-SPARK ⟫ is a stager designed for shellcode payloads staged with http/https like sliver or on github raw. It uses modern obfuscation and evaion methods like sliding window just-in-time decryption of the payload and cpu instruction patching. By default it creates an executable...

CrystalSliver

crystal-kit-sliver Crystal Palace evasion kit ported to Sliver C2. This is the first public port of rasta-mouse's Crystal-Kit Cobalt Strike to Sliver. It follows the same cross-C2 pattern proven by Crystal-Kit-Xenon Mythic. License: MIT — Copyright c 2026 Simone Licitra Target: Windows x64 only...

azbelt

azbelt Standalone DLL and sliver extension for enumerating Azure related credentials, primarily on AAD joined machines Modules aadjoin - Gets info about machine AAD status via NetGetAadJoinInformation credman - Gets credentials from Credential Manager env - Looks for Azure/AAD specific...

PNGboomer-CVE-2026-77622

PNGboomer — CVE-2026-77622 Denial-of-service exploit for Sliver C2's HTTPS listener. Brute-forces the per-session PNG encoding nonce and delivers a decompression bomb that exhausts server memory. Published as GHSA-663m-7x7m-g4fw. Summary Sliver's HTTPS C2 channel wraps messages inside PNG images...

CVE-2026-29781

Architectural vulnerability in the Sliver C2 server allows for Reverse-C2 Weaponization. By extracting credentials from a captured implant, a defender can weaponize the C2 relationship to trigger a remote Infrastructure Kill-Switch. This exploitation targets a systemic lack of nil-pointer...

CVE-2026-34227

Unauthenticated MCP Interface + CORS Bypass Sliver's MCP server spins up an unauthenticated SSE interface and fires back Access-Control-Allow-Origin: on every response. The mcp-go library doesn't validate Content-Type, so Simple Requests text/plain skip the browser's preflight check entirely. No...

krustyloader-analysis

KrustyLoader Analysis This repository contains resources related to the analysis made on KrustyLoader and available on this blog post: https://www.synacktiv.com/publications/krustyloader-rust-malware-linked-to-ivanti-connectsecure-compromises. a Python script to extract and decrypt URL used by th...

CVE-2026-102507

Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. Attackers can send zero-length or 1-3...

EUVD-2026-88743

Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. Attackers can send zero-length or 1-3...

CVE-2026-102507

The Sliver C2 framework (version 1.7.7 and earlier ) is vulnerable to an unhandled panic in the operator gRPC handler . A compromised implant can trigger a Denial of Service (DoS) by sending malformed or empty Download responses (specifically zero-length or 1-3 byte payloads). This triggers an ou...