Using Sliver C2 and an Internal Redirector to Bypass Server Egress Restrictions
· 15:47 · Watch on YouTube ↗
Summary
A red-team tutorial demonstrates using a workstation as an internal redirector so a Sliver HTTPS beacon can communicate through a server that cannot connect directly outside the network.
Key points
- The video uses a simulated Active Directory environment to demonstrate restrictive outbound firewall rules on a server.
- A workstation that can communicate externally is configured as an internal redirector between the restricted server and the Sliver listener.
- The presenter’s port forwarder accepts traffic on a chosen port and forwards it to a specified destination; it can also forward SMB traffic.
- The Sliver beacon is configured to connect to the workstation’s internal address, rather than directly to the external C2 host.
- The demonstration downloads and runs the beacon in the lab, then shows it connecting through the redirector.
- The beacon depends on the redirector system staying operational; sleep or reboot interrupts forwarding and causes the beacon to time out.
Article Details
- Topics
- [00:22] Simulated network and restrictive server egress rules
- [03:36] Using an internal system as a redirector
- [05:15] Port forwarder behavior, including SMB forwarding
- [07:01] Configuring the workstation redirector and Sliver beacon
- [12:11] Running the beacon through the redirector
- [14:09] Beacon dependence on the redirector remaining operational
MITRE ATT&CK
T1071.001 · Web ProtocolsThe Sliver beacon is configured to communicate with its listener over HTTPS in the lab demonstration.T1090.001 · Internal ProxyThe lab demonstrates using an internal workstation as a proxy to relay beacon traffic; this behavior aligns with Internal Proxy.T1105 · Ingress Tool TransferThe demonstration downloads the beacon payload onto a system in the lab.