Red-Team Tutorial Demonstrates Lateral Movement with Sliver and Mythic C2

Summary

A lab-based red-team tutorial demonstrates lateral movement through C2 tunnels and built-in modules, using Sliver and Mythic with SMB, WMI, SSH and RDP. It explains beacon/session tradeoffs and credential- or token-based remote access.

Key points

• The presenter frames the walkthrough as red-team and penetration-testing work in a custom Active Directory lab.
• The tutorial explains that Sliver beacon callbacks can make SOCKS tunneling unreliable; an interactive session provides more direct traffic but may generate more network activity and risk detection.
• It routes tools through a SOCKS tunnel and ProxyChains, then demonstrates remote execution over SMB and WMI using assumed credentials.
• An SMBExec example succeeds after a PSExec attempt fails; the presenter notes that the resulting shell can run as SYSTEM.
• The tutorial describes using NetExec to execute a PowerShell beacon and establish a Mythic callback on a remote system.
• RDP through the SOCKS tunnel is described as slow and unstable; the presenter also demonstrates pass-the-hash as an authentication option.
• Sliver modules are shown using SSH credentials or an existing user token for remote execution, including deploying a beacon to a domain controller.

MITRE ATT&CK

Related Articles

• Kaspersky Details GenieLocker Ransomware Attributed to Toy Ghoulssecurelist.comT1003 · T1021.004 · T1090.001
• Chinese-Speaking Operator Used AI Agents to Target Government and Education Systems Across Asiahunt.ioT1003 · T1021.004
• Gambling Goblin Uses Compromised Brazilian Government Sites for SEO Phishing Campaignresearch.checkpoint.comT1003 · T1090.001
• TXTBOOK Campaign Targets T-Bank With 993 Malicious npm Packages and a Sliver Implantcloudsek.comT1021.004 · T1090.001
• Volexity Details VerdantBamboo Breach Using BRICKSTORM on Edge Appliancesvolexity.comT1021.004 · T1090.001