Post-ex
Sliver
C2 framework for authorized post-exploitation on in-scope hosts when an implant is in the RoE.
What it is
Sliver is an open C2 for red-team style post-ex: session management, process context, and lateral movement modules. Most internal pentests never need it. Use it only when the RoE explicitly allows an implant, with a named callback channel and a hard kill date.
Reach for it when
Assumed-breach or red-team jobs where surviving on a host is in scope and the client has approved C2 infrastructure.
Watch-outs
Unauthorized C2 is a reportable incident, not a finding. No persistence, no start-up tasks, no touching backups or OT. Register callbacks with blue team. Wipe payloads and revoke certs at cleanup. Never reuse engagement C2 for another client.
Typical invocation
Generate a staged HTTPS implant for the approved lab host only; callback to the named C2, kill date = engagement end.
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- Impacket
Python collection of Windows/AD protocol tools for authorized authentication and post-ex proof.
- NetExec
Network execution and enumeration suite for SMB, LDAP, WinRM, and related Windows services.
- BloodHound
Graph analysis of Active Directory and hybrid identity attack paths from authorized collection.