Sliver GUI is a thin Wails v2 (Go + plain HTML/CSS/JS) frontend over Sliver's existing rpcpb.SliverRPC gRPC service. It reimplements no C2 logic and connects with the same mTLS operator .cfg files as the official sliver-client every command-and-control capability comes from Sliver itself. Because the backend is Go, it imports Sliver's real protobuf/gRPC stubs directly: no grpc-web proxy, no protocol reimplementation, no drift when upstream changes its .proto.

Authorized use only. This is an offensive-security tool. Use it solely on systems you own or have explicit written permission to test.

Screenshots

Features

Area	What you get
Agents	Unified sessions + beacons table, plus an interactive pivot graph firewall/egress boundary on the left, agents laid out in their real pivot topology (chains joined by session id, so same-host pivots render correctly), arrows colour-coded by agent: green session · red SYSTEM/privileged · blue beacon.
Per-agent console	Real-time (session) or queued (beacon) consoles with 70+ RPC-backed commands, a full interactive PTY shell (`shell -i` / `pty`) over a gRPC tunnel, and extensions / BOFs (`ext …`) run through the same flow as the official client.
Server console	A pinned `sliver >` prompt for ~45 teamserver commands.
Implants	Generate (mTLS · HTTP · DNS · WireGuard · `tcp-pivot`), profiles, builds, and armory install / remove.
Data	Loot · credentials · hosts · operators · full event log.
Operator QoL	JSONL audit log, per-teamserver persisted graph layout / notes / integrity, `Ctrl+K` command palette, live event stream with toasts, and auto-reconnect.

Full command reference

Per-agent:- ps · ls · cd · pwd · cat · mkdir · rm · mv · cp · chmod · chown · download · upload · screenshot · netstat · ifconfig · env · getenv · setenv · unsetenv · reg · grep · mount · memfiles · ssh · whoami · getprivs · getpid · procdump · kill · chtimes · execute · execute-assembly · execute-shellcode · sideload · spawndll · getsystem · make-token · impersonate · rev2self · runas · migrate · backdoor · dllhijack · msf · msf-inject · extensions · ext · socks · portfwd · rportfwd · wg-portfwd · wg-socks · pivot · services · loot · shell · shell -i / pty · beacon-only: tasks · reconfig · interactive

Server:- sessions · beacons · jobs [kill] · restart-jobs · operators · loot · hosts · creds · builds · regenerate · profiles · c2profiles · certificates · compiler · builders · traffic-encoders · shellcode-encoders · armory [install/remove] · websites · canaries · stager · use · rename · kill-session · kill-beacon · version · mtls/http/https/dns/wg

Operator Toolkit — Script Manager, Panels & Pivot Graph

A cohesive operator layer on top of Sliver's RPCs — designed and built by Mr-In4inci3le aka Raj Kumar Mullapudi. No C2 logic is reimplemented; every action composes existing Sliver RPCs.

Script Manager

One-click post-exploitation recipes (Cobalt-Strike-style jump / spawn / remote-exec), each with a dry-run preview, a MITRE ATT&CK ID, and an OpSec noise rating:

Spawn — spawn <os> <arch> <profile> builds + runs a fresh agent on the current host, with a pre-flight listener check and post-spawn verification (reports the real new agent ID).
Lateral Movement — SSH deploy, PsExec, WMI, WinRM, SC, SMB (jump ssh|psexec|winrm|wmi).
Privilege Escalation — Linux (sudo / SUID), Windows (privesc check, token impersonation, GetSystem, UAC bypass).
Persistence — cron · SSH-key · systemd · Registry Run · scheduled task · service · WMI · startup.
Credentials — Linux & Windows harvest, Kerberoast, DCSync (harvested creds routed to Loot).
Enumeration — network scan, Active Directory enumeration, local Windows enum.

Operator Panels

File Browser — visual remote filesystem (list / delete).
Process Browser — visual process list + kill.
Kill-Chain Tracker — record and visualise the current engagement stage.
Engagement Timer — start / elapsed stopwatch.
IOC Tracker — log indicators as you drop them (files, registry keys, services).
Cleanup Script Generator — emit a teardown script from the tracked IOCs.
Engagement Report Generator — one-click engagement report.

Interactive Pivot / Jump Graph

A Cobalt-Strike-style topology view: a firewall / egress boundary on the left, agents laid out left-to-right in their real pivot order (chains joined by session id so same-host pivots render correctly), edges colour-coded by agent (green session · red SYSTEM/privileged · blue beacon), and orange dashed lateral-move edges that show exactly where each jump came from. Drag nodes · scroll-zoom · pan · per-teamserver saved layout · one-click Reset Layout.

Quick start

Prerequisites

Go 1.25.6+ with GOTOOLCHAIN=auto the right toolchain is fetched automatically
Wails v2 CLI go install github.com/wailsapp/wails/v2/cmd/wails@latest
Linux WebKit deps sudo apt install libgtk-3-dev libwebkit2gtk-4.1-dev build-essential pkg-config
A Sliver operator .cfg sliver-server operator --name <you> --lhost <host> --save <you>.cfg

Build & run

go mod tidy
make build            # → build/bin/sliver-gui   (or: wails build -tags webkit2_41)
./build/bin/sliver-gui

Hot reload: make dev · tests & linters: make test · make lint · make vet On WebKit 4.0 systems, use make build TAGS= (drop the webkit2_41 tag).

Usage

Connect :- select your operator .cfg.
Listen :- start a listener (Listeners panel, or mtls 8443 in the server console).
Generate :- build an implant against that listener's C2 (or a tcppivot:// for pivots), then Save to disk.
Run it on the target the session/beacon appears in the table and graph.
Interact :- double-click the agent, or use <id> in the server console.

Notes

Sessions vs. beacons sessions are real-time; beacon output is delayed by the check-in interval (± jitter).
getsystem <profile> builds from a saved profile, so the profile must be complete and buildable.
Symbol obfuscation is off by default so builds work on a stock teamserver (no garble required).
Pinned to a bishopfox/sliver master commit to match recent / devel teamservers on a tagged teamserver, pin the matching Sliver release instead.

Roadmap

crack (hashcat cluster) · cursed (Chrome/Electron injection) · WASM extension execution (listing is wired) · external builder log streaming.

Credits

GUI designed and developed by Raj Kumar Mullapudi the Wails backend, the vanilla-JS/HTML/CSS frontend (pivot graph, per-agent & server consoles, panels, command palette, operator notes), and all RPC wiring.

Powered by the Sliver C2 framework (BishopFox) and Wails. Sliver GUI is a client interface only it does not modify or redistribute the framework.