ACE-Responder/RogueSliver

This tool is for educational purposes only.

RogueSliver is a suite of tools designed to disrupt campaigns using the Sliver C2 framework. It is intended for educational purposes only and is covered in depth on ACEResponder.com. The suite includes ExtractCerts.py, BeaconFlood.py, and HijackBeacon.py.

ExtractCerts.py is used to extract mtls certificates and private keys from a minidump of an infected process. It also extracts the implant ID and mtls endpoints. BeaconFlood.py is used to flood a Sliver C2 server with beacon and session registrations. It requires mtls certificates. HijackBeacon.py is used to hijack a beacon with a valid implant ID and certificates. It can log the attacker's requests and send them some memes. It can also create a new false beacon with just an mtls cert.

Installation of the suite is done by running the command "python -m pip install -r requirements.txt". To use ExtractCerts.py, the command "./ExtractCerts.py sliver.DMP" is used. To use BeaconFlood.py, the command "./BeaconFlood.py 127.0.0.1 8888" is used. To use HijackBeacon.py, the command "./HijackBeacon.py 2aa18069-652a-4484-8ebe-abae87ebc73e 127.0.0.1 8888 -r" is used.

RogueSliver is a suite of tools designed to disrupt campaigns using the Sliver C2 framework. It includes ExtractCerts.py, BeaconFlood.py, and HijackBeacon.py, which are used to extract mtls certificates and private keys, flood a Sliver C2 server with beacon and session registrations, and hijack a beacon with a valid implant ID and certificates, respectively. Installation is done by running the command "python -m pip install -r requirements.txt". The commands for each tool are also provided. This tool is for educational purposes only and is covered in depth on ACEResponder.com.

📓 ACE-Responder/RogueSliver

👉🏽 This tool is for educational purposes only. 👉🏽 RogueSliver disrupts campaigns using the Sliver C2 framework. 👉🏽 It includes ExtractCerts.py, BeaconFlood.py, and HijackBeacon.py tools. 👉🏽 ExtractCerts.py extracts mtls certificates, private keys, implant ID, and mtls endpoints. 👉🏽 BeaconFlood.py floods the Sliver C2 server with beacon and session registrations. 👉🏽 HijackBeacon.py hijacks a beacon with a valid implant ID and certificates. 👉🏽 Hijacked beacon can log attacker's requests and send memes or create a false beacon. 👉🏽 Installation is done by running the command "python -m pip install -r requirements.txt". 👉🏽 ExtractCerts.py is used with the command "./ExtractCerts.py sliver.DMP". 👉🏽 BeaconFlood.py is used with the command "./BeaconFlood.py 127.0.0.1 8888". 👉🏽 HijackBeacon.py is used with the command "./HijackBeacon.py 2aa18069-652a-4484-8ebe-abae87ebc73e 127.0.0.1 8888 -r".

🔗 source link: https://github.com/ACE-Responder/RogueSliver

🔗 summarized content: https://hut.threathunterz.com/battlefield-intel/tradecraft-tools/ace-responderroguesliver

#RogueSliver #SliverC2 #DisruptCampaigns #MTLSCertificates #EducationalTool