sliver-n8n-notifications

Sliver C2 + n8n Integration Real-time notifications for Sliver C2 implant callbacks via Discord and Slack Overview This project integrates Sliver C2 Command & Control framework with n8n workflow automation to provide real-time notifications when new implant connections are established. When a...

CrystalSliver

crystal-kit-sliver Crystal Palace evasion kit ported to Sliver C2. This is the first public port of rasta-mouse's Crystal-Kit Cobalt Strike to Sliver. It follows the same cross-C2 pattern proven by Crystal-Kit-Xenon Mythic. License: MIT — Copyright c 2026 Simone Licitra Target: Windows x64 only...

linux-root-kit

About This Project This project was developed as part of the Digitale Forensik course at the Technische Hochschule Deggendorf. It demonstrates a full forensic investigation and attack simulation involving: A Python dependency confusion attack using a malicious PyPI package Privilege escalation vi...

sliver-tor-bridge

sliver-tor-bridge Sliver C2 のための Tor ベースのトランスポートブリッジ。隠しサービスを作成し、トラフィックを Sliver サーバーにプロキシすることで、実際の IP が露出するのを防ぎます。 機能 Tor の隠しサービスをセットアップし、ローカルの HTTP プロキシを指すようにします。プロキシはすべてのリクエストを Sliver の HTTPS リスナーに転送します。インプラントは Tor を経由して接続し、通常通り Sliver で制御できます。 root@kitploit: sliver server proxy tor hidden servi...

CVE-2026-32941

Sliver C2 中存在一个框架级漏洞，允许未认证的远程用户通过触发不受控制的内存分配（CWE-789 / CWE-400）来实施拒绝服务，导致进程级内存耗尽（OOM）崩溃。 参考：Tenable 复现步骤： 1. 提取凭据：从捕获或生成的 Sliver 植入体中获取 mTLS 证书和私钥。 2. 编辑 PoC：打开 mtlspoc.go，将 var 块中的占位符值（c2Endpoint、clientCertPEM、clientKeyPEM）替换为你提取的凭据。 对 Sliver 服务器运行漏洞利用程序： root@kitploit: go run mtlspoc.go...

RogueSliver

RogueSliver A suite of tools to disrupt campaigns using the Sliver C2 framework. This tool, its uses, and how it was created will be covered in depth on ACEResponder.com This tool is for educational purposes only...

PNGboomer-CVE-2026-77622

PNGboomer — CVE-2026-77622 Exploit de denegación de servicio para el listener HTTPS de Sliver C2. Fuerza bruta el nonce de codificación PNG por sesión y entrega una bomba de descompresión que agota la memoria del servidor. Publicado como GHSA-663m-7x7m-g4fw. Resumen El canal C2 HTTPS de Sliver...

CVE-2026-29781

Sliver C2 服务器中的架构性漏洞允许进行反向 C2 武器化。通过从捕获的植入体中提取凭据，防御者可以将 C2 关系武器化，以触发远程基础设施 Kill-Switch。此利用针对的是 Protobuf 处理器中系统性缺乏 nil 指针验证的问题，导致全局运行时崩溃。 CVE-2026-29781 的影响是 C2 基础设施的全面运营瘫痪。 1. 猎人反成猎物：捕获植入体二进制的防御者可以逆转攻击，并完全关闭 Sliver 服务器。 2. 跨传输层崩溃：由于 mTLS、WireGuard 和 DNS 传输层缺乏 recover 机制，单个畸形数据包会导致整个 Go...

SliverMirage

SliverMirage 本项目是 CrystalSliver 的一个分支，在 Crystal Palace PICO 加载器的基础上扩展了双层 AMSI 绕过、ETW 静默，以及面向 Sliver C2 的六种投递变体。 功能 SliverMirage 将 Sliver 植入体 DLL 通过 Crystal Palace PICO 虚拟化进行封装，然后通过一个无需修补 amsi.dll 或 ntdll.dll 即可绕过 AMSI 和 ETW 的加载器进行投递。 规避技术栈： 层| 技术| 详情 ---|---|--- AMSI L1| CLR 字符串破坏|...

CVE-2026-32941

Sliver is a command and control framework that uses a custom Wireguard netstack. Versions 1.7.3 and below contain a Remote OOM Out-of-Memory vulnerability in the Sliver C2 server's mTLS and WireGuard C2 transport layer. The socketReadEnvelope and socketWGReadEnvelope functions trust an...

GHSA-97VP-PWQJ-46QC Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports

Summary A Remote OOM Out-of-Memory vulnerability exists in the Sliver C2 server's mTLS and WireGuard C2 transport layer. The socketReadEnvelope and socketWGReadEnvelope functions trust an attacker-controlled 4-byte length prefix to allocate memory, with ServerMaxMessageSize allowing single...

Notorious Hacker Group TeamTNT Launches New Cloud Attacks for Crypto Mining

The infamous cryptojacking group known as TeamTNT appears to be readying for a new large-scale campaign targeting cloud-native environments for mining cryptocurrencies and renting out breached servers to third-parties. "The group is currently targeting exposed Docker daemons to deploy Sliver...

Malicious Python Package Hides Sliver C2 Framework in Fake Requests Library Logo

Cybersecurity researchers have identified a malicious Python package that purports to be an offshoot of the popular requests library and has been found concealing a Golang-version of the Sliver command-and-control C2 framework within a PNG image of the project's logo. The package employing this...

RCE to Sliver: IR Tales from the Field

Rapid7 Incident Response consultants Noah Hemker, Tyler Starks, and malware analyst Tom Elkins contributed analysis and insight to this blog. Rapid7 Incident Response was engaged to investigate an incident involving unauthorized access to two publicly-facing Confluence servers that were the sourc...

Hackers Exploit Vulnerabilities in Sunlogin to Deploy Sliver C2 Framework

Threat actors are leveraging known flaws in Sunlogin software to deploy the Sliver command-and-control C2 framework for carrying out post-exploitation activities. The findings come from AhnLab Security Emergency response Center ASEC, which found that security vulnerabilities in Sunlogin, a remote...

Threat Actors Turn to Sliver as Open Source Alternative to Popular C2 Frameworks

The legitimate command-and-control C2 framework known as Sliver is gaining more traction from threat actors as it emerges as an open source alternative to Cobalt Strike and Metasploit. The findings come from Cybereason, which detailed its inner workings in an exhaustive analysis last week. Sliver...

Cybercrime Groups Increasingly Adopting Sliver Command-and-Control Framework

Nation-state threat actors are increasingly adopting and integrating the Sliver command-and-control C2 framework in their intrusion campaigns as a replacement for Cobalt Strike. "Given Cobalt Strike's popularity as an attack tool, defenses against it have also improved over time," Microsoft...