sliver-tor-bridge

sliver-tor-bridge tor-based transport bridge for sliver c2. creates a hidden service and proxies traffic to your sliver server so your real ip is never exposed. what it does sets up a tor hidden service that points to a local http proxy. the proxy forwards everything to sliver's https listener...

RogueSliver

RogueSliver A suite of tools to disrupt campaigns using the Sliver C2 framework. This tool, its uses, and how it was created will be covered in depth on ACEResponder.com This tool is for educational purposes only. | ---|--- ExtractCerts.py| Extract mtls certificates and private keys from a minidu...

sliver-n8n-notifications

Sliver C2 + n8n Integration Real-time notifications for Sliver C2 implant callbacks via Discord and Slack Overview This project integrates Sliver C2 Command & Control framework with n8n workflow automation to provide real-time notifications when new implant connections are established. When a...

CrystalSliver

crystal-kit-sliver Crystal Palace evasion kit ported to Sliver C2. This is the first public port of rasta-mouse's Crystal-Kit Cobalt Strike to Sliver. It follows the same cross-C2 pattern proven by Crystal-Kit-Xenon Mythic. License: MIT — Copyright c 2026 Simone Licitra Target: Windows x64 only...

CVE-2026-32941

Sliver C2 のフレームワーク全体に存在する脆弱性により、無制御のメモリ割り当て CWE-789 / CWE-400 を引き起こして、プロセス全体で Out-of-Memory OOM クラッシュを発生させる、認証不要のリモートサービス拒否 DoS が可能になります。 参照: Tenable 再現手順: 1. 認証情報の取得: 取得または生成された Sliver インプラントから mTLS 証明書と秘密鍵を入手します。 2. PoC の編集: mtlspoc.go を開き、var ブロック内のプレースホルダー値 c2Endpoint、clientCertPEM、clientKeyP...

linux-root-kit

About This Project 本项目是在 Technische Hochschule Deggendorf 的 Digitale Forensik 课程中开发的。 它展示了一次完整的法证调查和攻击模拟，涉及： 使用恶意 PyPI 包的 Python 依赖混淆攻击 通过易受攻击的 sudo 版本 CVE-2025-32463 进行权限提升 部署 Sliver C2 信标 一个自定义 rootkit，包含内核模块加载、系统调用挂钩和基于 udev 的持久化 使用 Volatility、NetworkMiner 和手动逆向等工具对内存和网络工件进行完整分析...

PNGboomer-CVE-2026-77622

PNGboomer — CVE-2026-77622 Sliver C2のHTTPSリスナーに対するサービス拒否DoSエクスプロイト。セッションごとのPNGエンコードnonceをブルートフォースし、サーバーのメモリを枯渇させる解凍爆弾decompression bombを送信します。 GHSA-663m-7x7m-g4fwとして公開されています。 概要 SliverのHTTPS C2チャネルは、メッセージをPNG画像内にラップします。各セッションには1,...

CVE-2026-29781

Sliver C2 サーバーにおけるアーキテクチャ上の脆弱性により、Reverse-C2 Weaponization（リバースC2の武器化）が可能になります。捕捉したインプラントから認証情報を抽出することで、防御側はC2の関係性を武器化し、リモートからのインフラストラクチャ・キルスイッチを発動できます。この悪用は、Protobufハンドラーにおけるnilポインタ検証の体系的な欠如を標的とし、グローバルなランタイムパニックを引き起こします。 CVE-2026-29781の影響は、C2インフラストラクチャの完全な運用麻痺です。 1...

CVE-2026-102507

Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. Attackers can send zero-length or 1-3...

EUVD-2026-88743

Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. Attackers can send zero-length or 1-3...

CVE-2026-102507: Out-of-bounds Read

Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. Attackers can send zero-length or 1-3...

SliverMirage

SliverMirage CrystalSliver のフォークであり、Crystal Palace PICO ローダーを拡張して、二層の AMSI バイパス、ETW の無効化、および Sliver C2 向けの 6 種類の配信バリアントを提供します。 概要 SliverMirage は、Crystal Palace PICO 仮想化を通じて Sliver インプラント DLL をラップし、amsi.dll や ntdll.dll にパッチを当てずに AMSI と ETW を無効化するローダーを介して配信します。 回避スタック: レイヤー| 技術| 詳細 ---|---|--- AMSI...

CVE-2026-32941

Sliver is a command and control framework that uses a custom Wireguard netstack. Versions 1.7.3 and below contain a Remote OOM Out-of-Memory vulnerability in the Sliver C2 server's mTLS and WireGuard C2 transport layer. The socketReadEnvelope and socketWGReadEnvelope functions trust an...

GHSA-97VP-PWQJ-46QC Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports

Summary A Remote OOM Out-of-Memory vulnerability exists in the Sliver C2 server's mTLS and WireGuard C2 transport layer. The socketReadEnvelope and socketWGReadEnvelope functions trust an attacker-controlled 4-byte length prefix to allocate memory, with ServerMaxMessageSize allowing single...

Notorious Hacker Group TeamTNT Launches New Cloud Attacks for Crypto Mining

The infamous cryptojacking group known as TeamTNT appears to be readying for a new large-scale campaign targeting cloud-native environments for mining cryptocurrencies and renting out breached servers to third-parties. "The group is currently targeting exposed Docker daemons to deploy Sliver...

Malicious Python Package Hides Sliver C2 Framework in Fake Requests Library Logo

Cybersecurity researchers have identified a malicious Python package that purports to be an offshoot of the popular requests library and has been found concealing a Golang-version of the Sliver command-and-control C2 framework within a PNG image of the project's logo. The package employing this...

RCE to Sliver: IR Tales from the Field

Rapid7 Incident Response consultants Noah Hemker, Tyler Starks, and malware analyst Tom Elkins contributed analysis and insight to this blog. Rapid7 Incident Response was engaged to investigate an incident involving unauthorized access to two publicly-facing Confluence servers that were the sourc...

Hackers Exploit Vulnerabilities in Sunlogin to Deploy Sliver C2 Framework

Threat actors are leveraging known flaws in Sunlogin software to deploy the Sliver command-and-control C2 framework for carrying out post-exploitation activities. The findings come from AhnLab Security Emergency response Center ASEC, which found that security vulnerabilities in Sunlogin, a remote...

Threat Actors Turn to Sliver as Open Source Alternative to Popular C2 Frameworks

The legitimate command-and-control C2 framework known as Sliver is gaining more traction from threat actors as it emerges as an open source alternative to Cobalt Strike and Metasploit. The findings come from Cybereason, which detailed its inner workings in an exhaustive analysis last week. Sliver...

Cybercrime Groups Increasingly Adopting Sliver Command-and-Control Framework

Nation-state threat actors are increasingly adopting and integrating the Sliver command-and-control C2 framework in their intrusion campaigns as a replacement for Cobalt Strike. "Given Cobalt Strike's popularity as an attack tool, defenses against it have also improved over time," Microsoft...