Mr-In4inci3le-sliver-gui/README.md

Sliver GUI

A desktop operator console for the Sliver C2 framework in the spirit of Cobalt Strike and Havoc. Designed and Developed by Raj Kumar Mullapudi

Sliver GUI is a thin Wails v2 (Go + plain HTML/CSS/JS) frontend over Sliver's existing rpcpb.SliverRPC gRPC service. It reimplements no C2 logic and connects with the same mTLS operator .cfg files as the official sliver-client every command-and-control capability comes from Sliver itself. Because the backend is Go, it imports Sliver's real protobuf/gRPC stubs directly: no grpc-web proxy, no protocol reimplementation, no drift when upstream changes its .proto.

Authorized use only. This is an offensive-security tool. Use it solely on systems you own or have explicit written permission to test.

---

Screenshots

---

Features

Area	What you get
Agents	Unified sessions + beacons table, plus an interactive pivot graph firewall/egress boundary on the left, agents laid out in their real pivot topology (chains joined by session id, so same-host pivots render correctly), arrows colour-coded by agent: green session · red SYSTEM/privileged · blue beacon.
Per-agent console	Real-time (session) or queued (beacon) consoles with 70+ RPC-backed commands, a full interactive PTY shell (shell -i / pty) over a gRPC tunnel, and extensions / BOFs (ext …) run through the same flow as the official client.
Server console	A pinned sliver > prompt for ~45 teamserver commands.
Implants	Generate (mTLS · HTTP · DNS · WireGuard · tcp-pivot), profiles, builds, and armory install / remove.
Data	Loot · credentials · hosts · operators · full event log.
Operator QoL	JSONL audit log, per-teamserver persisted graph layout / notes / integrity, Ctrl+K command palette, live event stream with toasts, and auto-reconnect.

Full command reference

Per-agent:- ps · ls · cd · pwd · cat · mkdir · rm · mv · cp · chmod · chown · download · upload · screenshot · netstat · ifconfig · env · getenv · setenv · unsetenv · reg · grep · mount · memfiles · ssh · whoami · getprivs · getpid · procdump · kill · chtimes · execute · execute-assembly · execute-shellcode · sideload · spawndll · getsystem · make-token · impersonate · rev2self · runas · migrate · backdoor · dllhijack · msf · msf-inject · extensions · ext · socks · portfwd · rportfwd · wg-portfwd · wg-socks · pivot · services · loot · shell · shell -i / pty   ·  beacon-only: tasks · reconfig · interactive

Server:- sessions · beacons · jobs [kill] · restart-jobs · operators · loot · hosts · creds · builds · regenerate · profiles · c2profiles · certificates · compiler · builders · traffic-encoders · shellcode-encoders · armory [install/remove] · websites · canaries · stager · use · rename · kill-session · kill-beacon · version · mtls/http/https/dns/wg

---

Operator Toolkit — Script Manager, Panels & Pivot Graph

A cohesive operator layer on top of Sliver's RPCs — designed and built by Mr-In4inci3le aka Raj Kumar Mullapudi. No C2 logic is reimplemented; every action composes existing Sliver RPCs.

Script Manager

One-click post-exploitation recipes (Cobalt-Strike-style jump / spawn / remote-exec), each with a dry-run preview, a MITRE ATT&CK ID, and an OpSec noise rating:

• Spawn — spawn <os> <arch> <profile> builds + runs a fresh agent on the current host, with a pre-flight listener check and post-spawn verification (reports the real new agent ID).
• Lateral Movement — SSH deploy, PsExec, WMI, WinRM, SC, SMB (jump ssh|psexec|winrm|wmi).
• Privilege Escalation — Linux (sudo / SUID), Windows (privesc check, token impersonation, GetSystem, UAC bypass).
• Persistence — cron · SSH-key · systemd · Registry Run · scheduled task · service · WMI · startup.
• Credentials — Linux & Windows harvest, Kerberoast, DCSync (harvested creds routed to Loot).
• Enumeration — network scan, Active Directory enumeration, local Windows enum.

Operator Panels

• File Browser — visual remote filesystem (list / delete).
• Process Browser — visual process list + kill.
• Kill-Chain Tracker — record and visualise the current engagement stage.
• Engagement Timer — start / elapsed stopwatch.
• IOC Tracker — log indicators as you drop them (files, registry keys, services).
• Cleanup Script Generator — emit a teardown script from the tracked IOCs.
• Engagement Report Generator — one-click engagement report.

Interactive Pivot / Jump Graph

A Cobalt-Strike-style topology view: a firewall / egress boundary on the left, agents laid out left-to-right in their real pivot order (chains joined by session id so same-host pivots render correctly), edges colour-coded by agent (green session · red SYSTEM/privileged · blue beacon), and orange dashed lateral-move edges that show exactly where each jump came from. Drag nodes · scroll-zoom · pan · per-teamserver saved layout · one-click Reset Layout.

---

Quick start

Prerequisites

• Go 1.25.6+ with GOTOOLCHAIN=auto the right toolchain is fetched automatically
• Wails v2 CLI go install github.com/wailsapp/wails/v2/cmd/wails@latest
• Linux WebKit deps sudo apt install libgtk-3-dev libwebkit2gtk-4.1-dev build-essential pkg-config
• A Sliver operator .cfg sliver-server operator --name <you> --lhost <host> --save <you>.cfg

Build & run

go mod tidy
make build            # → build/bin/sliver-gui   (or: wails build -tags webkit2_41)
./build/bin/sliver-gui

Hot reload: make dev · tests & linters: make test · make lint · make vet On WebKit 4.0 systems, use make build TAGS= (drop the webkit2_41 tag).

---

Usage

1. Connect :- select your operator .cfg.
2. Listen :- start a listener (Listeners panel, or mtls 8443 in the server console).
3. Generate :- build an implant against that listener's C2 (or a tcppivot:// for pivots), then Save to disk.
4. Run it on the target the session/beacon appears in the table and graph.
5. Interact :- double-click the agent, or use <id> in the server console.

---

Notes

• Sessions vs. beacons sessions are real-time; beacon output is delayed by the check-in interval (± jitter).
• getsystem <profile> builds from a saved profile, so the profile must be complete and buildable.
• Symbol obfuscation is off by default so builds work on a stock teamserver (no garble required).
• Pinned to a bishopfox/sliver master commit to match recent / devel teamservers on a tagged teamserver, pin the matching Sliver release instead.

Roadmap

crack (hashcat cluster) · cursed (Chrome/Electron injection) · WASM extension execution (listing is wired) · external builder log streaming.

---

Credits

GUI designed and developed by Raj Kumar Mullapudi the Wails backend, the vanilla-JS/HTML/CSS frontend (pivot graph, per-agent & server consoles, panels, command palette, operator notes), and all RPC wiring.

Powered by the Sliver C2 framework (BishopFox) and Wails. Sliver GUI is a client interface only it does not modify or redistribute the framework.

_{© 2026 Raj Kumar Mullapudi (GUI frontend) · Sliver C2 © BishopFox}