n0mad1k/CoM-c2itall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

trying to fix it all

Browse Source
This commit is contained in:
n0mad1k
2025-04-17 14:55:17 -04:00
parent 17b9191553
commit 2086110117
7 changed files with 210 additions and 156 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tasks/configure_redirector.yml
+86 -77
View File
@@ -1,5 +1,5 @@
---
# Common task for configuring redirector
# Common task for configuring redirector with full encryption
# Shared across all providers
- name: Install required packages for redirector
@@ -70,15 +70,36 @@
group: root
when: zero_logs | bool
# Configure nginx sites with default values - no certificate
- name: Configure NGINX site with HTTP (no SSL)
copy:
# Configure nginx for dual HTTP/HTTPS with complete encryption
- name: Configure NGINX for secure C2 redirection
template:
content: |
# HTTP server - redirects all to HTTPS
server {
listen 80;
listen [::]:80;
server_name cdn.{{ domain }};
server_name {{ redirector_subdomain }}.{{ domain }};
# Force redirect to HTTPS for all traffic
return 301 https://$host$request_uri;
}
# HTTPS server - handles both HTTP and MTLS C2 traffic
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name {{ redirector_subdomain }}.{{ domain }};
# SSL Configuration
ssl_certificate /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305';
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
# Root directory
root /var/www/html;
index index.html;
@@ -87,8 +108,7 @@
try_files $uri $uri/ =404;
}
# Special URI patterns for C2 traffic
# These will redirect to the actual C2 server
# HTTP C2 paths (still over HTTPS)
location /ajax/ {
proxy_pass http://{{ c2_ip }}:8888;
proxy_http_version 1.1;
@@ -99,7 +119,19 @@
proxy_set_header Connection "upgrade";
}
# Static resources that actually redirect to C2
# MTLS/TCP passthrough for direct Sliver communication
location /mtls/ {
proxy_pass https://{{ c2_ip }}:443;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_ssl_verify off;
}
# Static resources that redirect to C2
location ~ ^/static/(css|js|images)/.*\.(css|js|png|jpg|jpeg|gif|ico)$ {
proxy_pass http://{{ c2_ip }}:8888;
proxy_http_version 1.1;
@@ -108,19 +140,32 @@
proxy_set_header X-Real-IP $remote_addr;
}
# Additional security headers
# Security headers
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1" mode=block;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "no-referrer" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'" always;
# Disable logging if zero-logs is enabled
{% if zero_logs | default(true) | bool %}
access_log off;
error_log /dev/null crit;
{% endif %}
}
# Catch-all server block to respond to unknown hosts
# Catch-all server block
server {
listen 80 default_server;
listen [::]:80 default_server;
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
# Redirect all unknown traffic to a legitimate-looking site
# Self-signed cert for catch-all
ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
# Redirect unknown traffic to a legitimate-looking site
return 301 https://www.google.com;
# Disable logs
@@ -133,76 +178,15 @@
group: root
- name: Create legitimate-looking index.html
copy:
content: |
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>CDN - Content Delivery Network</title>
<style>
body {
font-family: Arial, sans-serif;
margin: 0;
padding: 0;
background-color: #f4f4f4;
color: #333;
}
header {
background-color: #2c3e50;
color: white;
padding: 1em;
text-align: center;
}
.container {
width: 80%;
margin: 0 auto;
padding: 2em;
}
.card {
background-color: white;
border-radius: 5px;
padding: 1.5em;
margin-bottom: 1.5em;
box-shadow: 0 2px 5px rgba(0,0,0,0.1);
}
footer {
background-color: #2c3e50;
color: white;
text-align: center;
padding: 1em;
position: fixed;
bottom: 0;
width: 100%;
}
</style>
</head>
<body>
<header>
<h1>cdn.{{ domain }}</h1>
<p>Enterprise Content Delivery Network</p>
</header>
<div class="container">
<div class="card">
<h2>Welcome to Our CDN</h2>
<p>This server is part of our global content delivery network.</p>
</div>
</div>
<footer>
<p>&copy; 2025 {{ domain }} CDN Services. All rights reserved.</p>
</footer>
</body>
</html>
template:
src: "../templates/redirector-index.html.j2"
dest: /var/www/html/index.html
mode: '0644'
owner: www-data
group: www-data
- name: Create SSL certificate setup instructions
copy:
template:
content: |
#!/bin/bash
# Let's Encrypt Certificate Setup Script
@@ -210,7 +194,7 @@
# Replace these with your actual values if needed
DOMAIN="{{ domain }}"
SUBDOMAIN="cdn"
SUBDOMAIN="{{ redirector_subdomain }}"
EMAIL="admin@${DOMAIN}"
echo "================================================"
@@ -231,6 +215,31 @@
owner: root
group: root
# Add stream module configuration for pure TCP forwarding
- name: Configure NGINX stream module for TCP traffic
template:
content: |
# TCP stream configuration for MTLS
stream {
# TCP forwarding for MTLS
server {
listen 31337;
proxy_pass {{ c2_ip }}:31337;
}
# Additional C2 ports
server {
listen 50051;
proxy_pass {{ c2_ip }}:50051;
}
}
dest: /etc/nginx/modules-enabled/stream.conf
mode: '0644'
owner: root
group: root
notify:
- restart nginx
- name: Start and enable shell handler service
systemd:
name: shell-handler