Sliver Adversary Simulation Platform: Forensic Reverse-Engineering & Architectural Dossier

Sliver is an open-source, multi-platform post-exploitation framework developed by Bishop Fox. The server and implants are written in Go, supporting dynamic cross-compilation across Windows, Linux, and macOS. It features native support for four distinct network protocols: Mutual TLS (mTLS) with per-binary unique certificate generation, WireGuard kernel/userspace tunneling using the Noise protocol, HTTP/2 long-polling, and DNS canaries. The implant integrates advanced execution primitives including TartarusGate direct syscalls, in-memory .NET assembly hosting (execute-assembly), and unlinked COFF/BOF execution.

Detailed reverse-engineering specifications archived in laboratory telemetry.

{
  "structureType": "Embedded Protocol Buffers (Protobuf) Configuration Model",
  "decryptionRoutine": "At implant initialization, the Go bootstrap parses an embedded serialized Protobuf blob, decrypts it using an AES-256-GCM key or obfuscated XOR array, and unmarshals it into the runtime ImplantConfig struct.",
  "inMemoryLayout": "type ImplantConfig struct {\n    ID                  string            // Unique implant UUID\n    C2                  []*C2Endpoint     // List of C2 listener endpoints (mTLS, WireGuard, HTTP, DNS)\n    ReconnectInterval   time.Duration     // Check-in interval / beacon period\n    MaxRunTime          time.Duration     // Max execution duration before self-termination\n    CanaryDomains       []string          // DNS canary domains triggered on analysis\n    IsBeacon            bool              // True: Beacon mode (async), False: Interactive Session (sync)\n    ProxyURL            string            // SOCKS5 or HTTP proxy URL\n    EvasionOptions      *EvasionConfig    // Syscall engine and process injection parameters\n}",
  "panelConfigOptions": "Sliver CLI `generate` command flags: `--mtls <host>`, `--wg <host>`, `--http <host>`, `--dns <domain>`, `--os <windows|linux|darwin>`, `--arch <amd64|386|arm64>`, `--format <exe|shared|service|shellcode>`, `--evasion`, `--garble`, `--skip-symbols`, `--canary <domain>`, `--seconds <beacon_interval>`, `--jitter <percentage>`."
}

{
  "apiResolution": "Uses native Go runtime system calling mechanisms combined with custom Windows package extensions (golang.org/x/sys/windows). In evasion mode, dynamically parses memory export tables of loaded system modules.",
  "directSyscalls": "Integrates TartarusGate and Hell's Gate mechanisms written in Go and assembly. Directly resolves SSNs from ntdll.dll export addresses and executes syscall instructions to bypass AV/EDR inline hooks on memory allocation and thread creation routines.",
  "processInjection": "Provides modular injection strategies configurable via sliver/inject: (1) Process Hollowing (spawns notepad.exe/svchost.exe suspended, writes payload, resumes thread); (2) Early Bird APC Injection (creates suspended process, queues user APC via NtQueueApcThread, wakes thread); (3) Remote Thread Injection using indirect syscalls.",
  "inMemoryExecution": "Implements an in-memory .NET CLR execution engine (execute-assembly) that initializes the Common Language Runtime inside non-.NET host processes using ICLRMetaHost and ICLRRuntimeInfo COM interfaces, executing .NET binaries without touching disk."
}

Concrete technical breakdown of functional modules implemented in the Sliver Adversary Simulation Platform binary:

Sliver supports four distinct C2 framing transports: (1) Mutual TLS (mTLS): Operates over TLS 1.3/1.2 where both client and server present unique X.509 certificates. Frames are length-prefixed Protocol Buffers messages. (2) WireGuard: Transmits UDP packets conforming to the Noise_IKpsk2 handshake; payloads are encrypted with ChaCha20-Poly1305. (3) HTTP/HTTPS: Employs procedural HTTP pipelines where Protobuf payloads are encrypted with AES-256-GCM and masqueraded as image assets (.png, .jpg) or standard web forms. (4) DNS Canaries & C2: Encodes tasking in Base32 subdomains queried via TXT and A records to bypass air-gapped network egress filtering.

Indicators of compromise and forensic patterns recorded across laboratory triage:

// Decompiled Go Runtime Snippet: Sliver Protobuf Command Dispatcher
func (i *Implant) DispatchEnvelope(env *sliverpb.Envelope) error {
    switch env.Type {
    case sliverpb.MsgExecuteAssemblyReq:
        req := &sliverpb.ExecuteAssemblyReq{}
        proto.Unmarshal(env.Data, req)
        return i.ExecuteAssembly(req.Assembly, req.Arguments)
    case sliverpb.MsgProcessInjectReq:
        req := &sliverpb.ProcessInjectReq{}
        proto.Unmarshal(env.Data, req)
        return i.InjectPayload(req.Pid, req.Data)
    case sliverpb.MsgSocksData:
        return i.HandleSocksTraffic(env.Data)
    default:
        return fmt.Errorf("unsupported envelope type: %d", env.Type)
    }
}