sliver-c2

What problem does it solve?

Operating Sliver C2 for post-exploitation requires manual coordination of sessions and beacons, complex credential access techniques, lateral movement workflows, and listener configuration across multiple C2 transports, which is time-consuming and error-prone for red teamers and penetration testers.

Core Features & Use Cases

• Unified Implant Management: Transparently handle both real-time interactive sessions and asynchronous beacons with automatic resolution of async beacon tasks, eliminating the need to switch between different workflows for each implant type.
• Streamlined Post-Exploitation: Built-in guidance and MCP tool wrappers for common post-exploitation tasks including LSASS credential dumping, in-memory .NET tooling execution, BOF usage, token manipulation for lateral movement, and multiple execution methods.
• Flexible C2 Infrastructure: Simplified setup and management of listeners for multiple C2 transport protocols (mTLS, HTTPS, DNS, WireGuard) to balance speed and stealth based on operational requirements, plus implant build management and lifecycle controls.
• Use Case: During a red team engagement, use this skill to quickly set up an HTTPS listener for stealthy C2, enumerate active beacons, dump LSASS memory for credential extraction, and perform lateral movement to a domain controller using token manipulation, all without manually switching between Sliver CLI contexts.

Quick Start

Use the sliver-c2 skill to connect to your Sliver C2 server, list all active sessions and beacons, and begin post-exploitation on a target implant of your choice.