sliver-n8n-notifications

Sliver C2 + n8n Integration Real-time notifications for Sliver C2 implant callbacks via Discord and Slack Overview This project integrates Sliver C2 Command & Control framework with n8n workflow automation to provide real-time notifications when new implant connections are established. When a...

PNGboomer-CVE-2026-77622

PNGboomer — CVE-2026-77622 Denial-of-service exploit for Sliver C2's HTTPS listener. Brute-forces the per-session PNG encoding nonce and delivers a decompression bomb that exhausts server memory. Published as GHSA-663m-7x7m-g4fw. Summary Sliver's HTTPS C2 channel wraps messages inside PNG images...

CVE-2026-29781

Architectural vulnerability in the Sliver C2 server allows for Reverse-C2 Weaponization. By extracting credentials from a captured implant, a defender can weaponize the C2 relationship to trigger a remote Infrastructure Kill-Switch. This exploitation targets a systemic lack of nil-pointer...

RogueSliver

RogueSliver A suite of tools to disrupt campaigns using the Sliver C2 framework. This tool, its uses, and how it was created will be covered in depth on ACEResponder.com This tool is for educational purposes only. | ---|--- ExtractCerts.py| Extract mtls certificates and private keys from a minidu...

CVE-2026-32941

A framework-wide vulnerability in Sliver C2 allows for an unauthenticated, remote Denial of Service by triggering Uncontrolled Memory Allocation CWE-789 / CWE-400, leading to a process-wide Out-of-Memory OOM crash. References: Tenable Reproduction Steps: 1. Extract Credentials: Obtain the mTLS...

sliver-tor-bridge

sliver-tor-bridge tor-based transport bridge for sliver c2. creates a hidden service and proxies traffic to your sliver server so your real ip is never exposed. what it does sets up a tor hidden service that points to a local http proxy. the proxy forwards everything to sliver's https listener...

SliverMirage

SliverMirage A fork of CrystalSliver, extending the Crystal Palace PICO loader with dual-layer AMSI bypass, ETW silencing, and six delivery variants for Sliver C2. What it does SliverMirage wraps a Sliver implant DLL through Crystal Palace PICO virtualization, then delivers it via a loader that...

CrystalSliver

crystal-kit-sliver Crystal Palace evasion kit ported to Sliver C2. This is the first public port of rasta-mouse's Crystal-Kit Cobalt Strike to Sliver. It follows the same cross-C2 pattern proven by Crystal-Kit-Xenon Mythic. License: MIT — Copyright c 2026 Simone Licitra Target: Windows x64 only...

linux-root-kit

About This Project This project was developed as part of the Digitale Forensik course at the Technische Hochschule Deggendorf. It demonstrates a full forensic investigation and attack simulation involving: A Python dependency confusion attack using a malicious PyPI package Privilege escalation vi...

CVE-2026-102507

Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. Attackers can send zero-length or 1-3...

EUVD-2026-88743

Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. Attackers can send zero-length or 1-3...

PT-2026-102506

Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. Attackers can send zero-length or 1-3...

CVE-2026-102507: Out-of-bounds Read

Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. Attackers can send zero-length or 1-3...

sliver-gui v1.2.0

Sliver GUI A desktop operator console for the Sliver C2 framework in the spirit of Cobalt Strike and Havoc. Designed and Developed by Raj Kumar Mullapudi Sliver GUI is a thin Wails v2 Go + plain HTML/CSS/JS frontend over Sliver's existing rpcpb.SliverRPC gRPC service. It reimplements no C2 logic...

CVE-2026-34227 Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to version 1.7.4, a single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating all collected target data e.g. SS...

CVE-2026-32941

Sliver is a command and control framework that uses a custom Wireguard netstack. Versions 1.7.3 and below contain a Remote OOM Out-of-Memory vulnerability in the Sliver C2 server's mTLS and WireGuard C2 transport layer. The socketReadEnvelope and socketWGReadEnvelope functions trust an...

GHSA-97VP-PWQJ-46QC Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports

Summary A Remote OOM Out-of-Memory vulnerability exists in the Sliver C2 server's mTLS and WireGuard C2 transport layer. The socketReadEnvelope and socketWGReadEnvelope functions trust an attacker-controlled 4-byte length prefix to allocate memory, with ServerMaxMessageSize allowing single...

Notorious Hacker Group TeamTNT Launches New Cloud Attacks for Crypto Mining

The infamous cryptojacking group known as TeamTNT appears to be readying for a new large-scale campaign targeting cloud-native environments for mining cryptocurrencies and renting out breached servers to third-parties. "The group is currently targeting exposed Docker daemons to deploy Sliver...

Malicious Python Package Hides Sliver C2 Framework in Fake Requests Library Logo

Cybersecurity researchers have identified a malicious Python package that purports to be an offshoot of the popular requests library and has been found concealing a Golang-version of the Sliver command-and-control C2 framework within a PNG image of the project's logo. The package employing this...

RCE to Sliver: IR Tales from the Field

Rapid7 Incident Response consultants Noah Hemker, Tyler Starks, and malware analyst Tom Elkins contributed analysis and insight to this blog. Rapid7 Incident Response was engaged to investigate an incident involving unauthorized access to two publicly-facing Confluence servers that were the sourc...