n0mad1k/CoM-c2itall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

reconfiging everything

Browse Source
This commit is contained in:
n0mad1k
2025-04-10 11:45:38 -04:00
parent 97277b0f64
commit 19501b84a0
17 changed files with 1908 additions and 5627 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tasks/configure-c2.yml
+136
View File
@@ -0,0 +1,136 @@
---
# Common task for configuring C2 server
# Shared across all providers
- name: Update apt cache
apt:
update_cache: yes
- name: Set a custom MOTD
template:
src: "motd.j2"
dest: /etc/motd
owner: root
group: root
mode: '0644'
- name: Install base utilities and tools via apt
apt:
name:
- git
- wget
- curl
- unzip
- python3-pip
- python3-venv
- tmux
- pipx
- nmap
- tcpdump
- hydra
- john
- hashcat
- sqlmap
- gobuster
- dirb
- enum4linux
- dnsenum
- seclists
- responder
- golang
- proxychains
- tor
- crackmapexec
- jq
- unzip
- postfix
- certbot
- opendkim
- opendkim-tools
- dovecot-core
- dovecot-imapd
- dovecot-pop3d
- dovecot-sieve
- dovecot-managesieved
- yq
state: present
- name: Copy operational scripts
copy:
src: "{{ item }}"
dest: "/opt/c2/{{ item }}"
mode: '0700'
owner: root
group: root
with_items:
- clean-logs.sh
- secure-exit.sh
- serve-beacons.sh
- name: Create operational directories
file:
path: "{{ item }}"
state: directory
mode: '0700'
owner: root
group: root
with_items:
- /opt/c2
- /opt/beacons
- /opt/payloads
- name: Create Sliver service file
copy:
content: |
[Unit]
Description=Sliver C2 Server
After=network.target
[Service]
Type=simple
User=root
Group=root
WorkingDirectory=/root/.sliver
ExecStart=/usr/local/bin/sliver-server daemon
Restart=always
RestartSec=10
# Security measures
PrivateTmp=true
ProtectHome=false
NoNewPrivileges=true
# Hide process information
StandardOutput=null
StandardError=null
[Install]
WantedBy=multi-user.target
dest: /etc/systemd/system/sliver.service
mode: '0644'
owner: root
group: root
- name: Set up cron job for log cleaning if zero-logs enabled
cron:
name: "Clean logs"
minute: "0"
hour: "*/6"
job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
when: zero_logs | bool
- name: Install Let's Encrypt certificate if domain specified
shell: |
certbot certonly --standalone -d {{ c2_subdomain }}.{{ domain }} --non-interactive --agree-tos -m {{ letsencrypt_email }}
args:
creates: /etc/letsencrypt/live/{{ c2_subdomain }}.{{ domain }}/fullchain.pem
when: domain != "example.com"
- name: Configure and start beacon server
shell: |
sed -i "s/C2_HOST=.*/C2_HOST=\"{{ ansible_host }}\"/g" /opt/c2/serve-beacons.sh
chmod +x /opt/c2/serve-beacons.sh
# Check if beacon server is already running
if ! pgrep -f "/opt/c2/serve-beacons.sh" > /dev/null; then
nohup /opt/c2/serve-beacons.sh > /dev/null 2>&1 &
fi
tasks/configure_mail.yml
+170
View File
@@ -0,0 +1,170 @@
---
# Common task for configuring mail server
# Shared across all providers
- name: Configure Postfix main.cf
lineinfile:
path: /etc/postfix/main.cf
regexp: "{{ item.regexp }}"
line: "{{ item.line }}"
with_items:
- { regexp: '^myhostname', line: "myhostname = mail.{{ domain }}" }
- { regexp: '^mydomain', line: "mydomain = {{ domain }}" }
- { regexp: '^myorigin', line: "myorigin = $mydomain" }
- { regexp: '^inet_interfaces', line: "inet_interfaces = all" }
- { regexp: '^inet_protocols', line: "inet_protocols = ipv4" }
- { regexp: '^smtpd_banner', line: "smtpd_banner = $myhostname ESMTP $mail_name" }
- { regexp: '^mynetworks', line: "mynetworks = 127.0.0.0/8 [::1]/128" }
- { regexp: '^relay_domains', line: "relay_domains = $mydestination" }
- { regexp: '^smtpd_tls_cert_file', line: "smtpd_tls_cert_file = /etc/letsencrypt/live/{{ domain }}/fullchain.pem" }
- { regexp: '^smtpd_tls_key_file', line: "smtpd_tls_key_file = /etc/letsencrypt/live/{{ domain }}/privkey.pem" }
- { regexp: '^smtpd_tls_security_level', line: "smtpd_tls_security_level = encrypt" }
- { regexp: '^smtpd_tls_session_cache_database', line: "smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache" }
- { regexp: '^smtp_tls_session_cache_database', line: "smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache" }
- { regexp: '^smtpd_use_tls', line: "smtpd_use_tls = yes" }
- { regexp: '^smtpd_tls_auth_only', line: "smtpd_tls_auth_only = yes" }
- { regexp: '^milter_default_action', line: "milter_default_action = accept" }
- { regexp: '^milter_protocol', line: "milter_protocol = 6" }
- { regexp: '^smtpd_milters', line: "smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock" }
- { regexp: '^non_smtpd_milters', line: "non_smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock" }
- name: Configure OpenDKIM
lineinfile:
path: /etc/opendkim.conf
regexp: "{{ item.regexp }}"
line: "{{ item.line }}"
with_items:
- { regexp: '^Domain', line: "Domain {{ domain }}" }
- { regexp: '^KeyFile', line: "KeyFile /etc/opendkim/keys/{{ domain }}/mail.private" }
- { regexp: '^Selector', line: "Selector mail" }
- { regexp: '^Socket', line: "Socket local:/var/spool/postfix/opendkim/opendkim.sock" }
- { regexp: '^Syslog', line: "Syslog yes" }
- { regexp: '^UMask', line: "UMask 002" }
- { regexp: '^Mode', line: "Mode sv" }
- name: Create DKIM directory
file:
path: /etc/opendkim/keys/{{ domain }}
state: directory
owner: opendkim
group: opendkim
mode: 0700
- name: Generate DKIM keys
command: >
opendkim-genkey -D /etc/opendkim/keys/{{ domain }} -d {{ domain }} -s mail
args:
creates: /etc/opendkim/keys/{{ domain }}/mail.private
- name: Set permissions for DKIM keys
file:
path: /etc/opendkim/keys/{{ domain }}/mail.private
owner: opendkim
group: opendkim
mode: 0600
- name: Configure OpenDKIM TrustedHosts
copy:
content: |
127.0.0.1
::1
localhost
{{ domain }}
dest: /etc/opendkim/TrustedHosts
owner: opendkim
group: opendkim
mode: 0644
- name: Enable submission port (587) in master.cf
blockinfile:
path: /etc/postfix/master.cf
insertafter: '^#submission'
block: |
submission inet n - y - - smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
- name: Configure Dovecot for Postfix SASL
blockinfile:
path: /etc/dovecot/conf.d/10-master.conf
insertafter: '^service auth {'
block: |
# Postfix smtp-auth
unix_listener /var/spool/postfix/private/auth {
mode = 0660
user = postfix
group = postfix
}
- name: Set Dovecot auth_mechanisms
lineinfile:
path: /etc/dovecot/conf.d/10-auth.conf
regexp: '^auth_mechanisms'
line: 'auth_mechanisms = plain login'
- name: Create Dovecot password file for SASL authentication
file:
path: /etc/dovecot/passwd
state: touch
mode: '0600'
owner: dovecot
group: dovecot
- name: Add SMTP auth user to Dovecot
lineinfile:
path: /etc/dovecot/passwd
line: "{{ smtp_auth_user }}:{{ smtp_auth_pass | password_hash('sha512_crypt') }}"
- name: Disable system auth and use passwd-file
lineinfile:
path: /etc/dovecot/conf.d/10-auth.conf
regexp: '^!include auth-system.conf.ext'
line: '#!include auth-system.conf.ext'
- name: Add auth-passwdfile configuration
blockinfile:
path: /etc/dovecot/conf.d/10-auth.conf
insertafter: '^auth_mechanisms ='
block: |
passdb {
driver = passwd-file
args = scheme=sha512_crypt /etc/dovecot/passwd
}
userdb {
driver = static
args = uid=vmail gid=vmail home=/var/vmail/%u
}
- name: Create vmail group
group:
name: vmail
gid: 5000
state: present
- name: Create vmail user
user:
name: vmail
uid: 5000
group: vmail
create_home: no
- name: Create vmail directory structure
file:
path: /var/vmail
state: directory
owner: vmail
group: vmail
mode: 0700
- name: Restart Postfix
service:
name: postfix
state: restarted
- name: Restart Dovecot
service:
name: dovecot
state: restarted
tasks/configure_redirector.yml
+114
View File
@@ -0,0 +1,114 @@
---
# Common task for configuring redirector
# Shared across all providers
- name: Install required packages for redirector
apt:
name:
- nginx
- certbot
- python3-certbot-nginx
- socat
- netcat-openbsd
- secure-delete
state: present
update_cache: yes
- name: Create directories for operational scripts
file:
path: "{{ item }}"
state: directory
mode: '0700'
owner: root
group: root
with_items:
- /opt/c2
- /opt/shell-handler
- name: Copy clean-logs.sh script
copy:
src: "clean-logs.sh"
dest: /opt/c2/clean-logs.sh
mode: '0700'
owner: root
group: root
- name: Copy shell handler script
copy:
src: "persistent-listener.sh"
dest: /opt/shell-handler/persistent-listener.sh
mode: '0700'
owner: root
group: root
- name: Configure shell handler script with C2 IP
replace:
path: /opt/shell-handler/persistent-listener.sh
regexp: 'C2_HOST="127.0.0.1"'
replace: 'C2_HOST="{{ c2_ip }}"'
- name: Configure shell handler script with listening port
replace:
path: /opt/shell-handler/persistent-listener.sh
regexp: 'LISTEN_PORT=4444'
replace: 'LISTEN_PORT={{ shell_handler_port }}'
- name: Create shell handler service
template:
src: "shell-handler.service.j2"
dest: /etc/systemd/system/shell-handler.service
mode: '0644'
owner: root
group: root
- name: Configure NGINX for zero-logging if enabled
template:
src: "nginx.conf.j2"
dest: /etc/nginx/nginx.conf
mode: '0644'
owner: root
group: root
when: zero_logs | bool
- name: Configure NGINX for C2 redirection
template:
src: "redirector-site.conf.j2"
dest: /etc/nginx/sites-available/default
mode: '0644'
owner: root
group: root
- name: Create legitimate-looking index.html
template:
src: "redirector-index.html.j2"
dest: /var/www/html/index.html
mode: '0644'
owner: www-data
group: www-data
- name: Start and enable shell handler service
systemd:
name: shell-handler
state: started
enabled: yes
daemon_reload: yes
- name: Set up cron job for log cleaning if zero-logs enabled
cron:
name: "Clean logs"
minute: "0"
hour: "*/6"
job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
when: zero_logs | bool
- name: Install Let's Encrypt certificate if domain specified
shell: |
certbot --nginx -d {{ redirector_subdomain }}.{{ domain }} --non-interactive --agree-tos -m {{ letsencrypt_email }}
args:
creates: /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/fullchain.pem
when: domain != "example.com"
- name: Restart NGINX
systemd:
name: nginx
state: restarted
tasks/install_tools.yml
+110
View File
@@ -0,0 +1,110 @@
---
# Common task for installing offensive security tools
# Shared across all providers
- name: Create Tools directory
file:
path: /home/{{ ansible_user }}/Tools
state: directory
owner: "{{ ansible_user }}"
group: "{{ ansible_user }}"
mode: '0755'
- name: Ensure pipx path is configured
shell: |
pipx ensurepath
become: true
args:
executable: /bin/bash
- name: Install tools via pipx
shell: |
export PATH=$PATH:/root/.local/bin
pipx ensurepath
pipx install git+https://github.com/Pennyw0rth/NetExec
pipx install git+https://github.com/blacklanternsecurity/TREVORspray
pipx install impacket
become: true
args:
executable: /bin/bash
- name: Download Kerbrute
shell: |
mkdir -p /home/{{ ansible_user }}/Tools/Kerbrute
wget https://github.com/ropnop/kerbrute/releases/latest/download/kerbrute_linux_amd64 -O /home/{{ ansible_user }}/Tools/Kerbrute/kerbrute
chmod +x /home/{{ ansible_user }}/Tools/Kerbrute/kerbrute
become: true
args:
executable: /bin/bash
creates: /home/{{ ansible_user }}/Tools/Kerbrute/kerbrute
- name: Clone SharpCollection nightly builds
git:
repo: https://github.com/Flangvik/SharpCollection.git
dest: /home/{{ ansible_user }}/Tools/SharpCollection
version: master
ignore_errors: yes
- name: Clone PEASS-ng
git:
repo: https://github.com/carlospolop/PEASS-ng.git
dest: /home/{{ ansible_user }}/Tools/PEASS-ng
ignore_errors: yes
- name: Clone MailSniper
git:
repo: https://github.com/dafthack/MailSniper.git
dest: /home/{{ ansible_user }}/Tools/MailSniper
ignore_errors: yes
- name: Clone Inveigh
git:
repo: https://github.com/Kevin-Robertson/Inveigh.git
dest: /home/{{ ansible_user }}/Tools/Inveigh
ignore_errors: yes
- name: Install Sliver C2 server
shell: |
curl https://sliver.sh/install | bash
systemctl enable sliver
systemctl start sliver
become: true
- name: Install Metasploit Framework (Nightly Build)
shell: |
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > /tmp/msfinstall
chmod 755 /tmp/msfinstall
/tmp/msfinstall
rm -f /tmp/msfinstall
become: true
args:
executable: /bin/bash
creates: /usr/bin/msfconsole
- name: Grab GoPhish
shell: |
curl -L "$(curl -s https://api.github.com/repos/gophish/gophish/releases/latest | jq -r '.assets[] | select(.browser_download_url | contains("linux-64bit.zip")) | .browser_download_url')" -o /home/{{ ansible_user }}/Tools/gophish.zip
unzip /home/{{ ansible_user }}/Tools/gophish.zip -d /home/{{ ansible_user }}/Tools/gophish
rm -rf /home/{{ ansible_user }}/Tools/gophish.zip
chmod +x /home/{{ ansible_user }}/Tools/gophish/gophish
args:
creates: /home/{{ ansible_user }}/Tools/gophish/gophish
- name: Deploy Gophish config.json with custom admin port
template:
src: gophish-config.j2
dest: /home/{{ ansible_user }}/Tools/gophish/config.json
owner: "{{ ansible_user }}"
group: "{{ ansible_user }}"
mode: '0644'
vars:
gophish_admin_port: "{{ gophish_admin_port }}"
domain: "{{ domain }}"
- name: Set proper ownership for Tools directory
file:
path: /home/{{ ansible_user }}/Tools
owner: "{{ ansible_user }}"
group: "{{ ansible_user }}"
recurse: true
mode: '0755'
tasks/security_hardening.yml
+136
View File
@@ -0,0 +1,136 @@
---
# Common task for configuring C2 server
# Shared across all providers
- name: Update apt cache
apt:
update_cache: yes
- name: Set a custom MOTD
template:
src: "motd.j2"
dest: /etc/motd
owner: root
group: root
mode: '0644'
- name: Install base utilities and tools via apt
apt:
name:
- git
- wget
- curl
- unzip
- python3-pip
- python3-venv
- tmux
- pipx
- nmap
- tcpdump
- hydra
- john
- hashcat
- sqlmap
- gobuster
- dirb
- enum4linux
- dnsenum
- seclists
- responder
- golang
- proxychains
- tor
- crackmapexec
- jq
- unzip
- postfix
- certbot
- opendkim
- opendkim-tools
- dovecot-core
- dovecot-imapd
- dovecot-pop3d
- dovecot-sieve
- dovecot-managesieved
- yq
state: present
- name: Copy operational scripts
copy:
src: "{{ item }}"
dest: "/opt/c2/{{ item }}"
mode: '0700'
owner: root
group: root
with_items:
- clean-logs.sh
- secure-exit.sh
- serve-beacons.sh
- name: Create operational directories
file:
path: "{{ item }}"
state: directory
mode: '0700'
owner: root
group: root
with_items:
- /opt/c2
- /opt/beacons
- /opt/payloads
- name: Create Sliver service file
copy:
content: |
[Unit]
Description=Sliver C2 Server
After=network.target
[Service]
Type=simple
User=root
Group=root
WorkingDirectory=/root/.sliver
ExecStart=/usr/local/bin/sliver-server daemon
Restart=always
RestartSec=10
# Security measures
PrivateTmp=true
ProtectHome=false
NoNewPrivileges=true
# Hide process information
StandardOutput=null
StandardError=null
[Install]
WantedBy=multi-user.target
dest: /etc/systemd/system/sliver.service
mode: '0644'
owner: root
group: root
- name: Set up cron job for log cleaning if zero-logs enabled
cron:
name: "Clean logs"
minute: "0"
hour: "*/6"
job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
when: zero_logs | bool
- name: Install Let's Encrypt certificate if domain specified
shell: |
certbot certonly --standalone -d {{ c2_subdomain }}.{{ domain }} --non-interactive --agree-tos -m {{ letsencrypt_email }}
args:
creates: /etc/letsencrypt/live/{{ c2_subdomain }}.{{ domain }}/fullchain.pem
when: domain != "example.com"
- name: Configure and start beacon server
shell: |
sed -i "s/C2_HOST=.*/C2_HOST=\"{{ ansible_host }}\"/g" /opt/c2/serve-beacons.sh
chmod +x /opt/c2/serve-beacons.sh
# Check if beacon server is already running
if ! pgrep -f "/opt/c2/serve-beacons.sh" > /dev/null; then
nohup /opt/c2/serve-beacons.sh > /dev/null 2>&1 &
fi