From 30626a14bfb9f8c945f440ccd8267216fc38d3c1 Mon Sep 17 00:00:00 2001 From: n0mad1k Date: Mon, 21 Apr 2025 16:27:35 -0400 Subject: [PATCH] fixing things --- Linode/tracker.yml | 12 +- files/persistent-listener.sh | 8 +- files/post_install_c2.sh | 405 +++++++++++++++++++++++ files/post_install_redirector.sh | 156 +++++++++ files/randomize_ports.sh | 224 +++++++++++++ files/secure-exit.sh | 8 +- files/simple_email_tracker.py | 4 +- files/sliver_randomizer.sh | 2 +- files/tracker-stats.sh | 2 +- files/tracker.service | 4 +- tasks/configure_c2.yml | 83 +++-- tasks/configure_integrated_tracker.yml | 24 +- tasks/configure_redirector.yml | 76 ++++- tasks/port_randomization.yml | 66 ++++ tasks/security_hardening.yml | 18 +- templates/generate_evasive_beacons.sh.j2 | 8 +- templates/motd-aws.j2 | 2 +- templates/serve-beacons.sh.j2 | 2 +- templates/shell-handler.service.j2 | 2 +- templates/simple_email_tracker.py.j2 | 4 +- templates/sliver-guide.j2 | 4 +- templates/tracker.service.j2 | 4 +- 22 files changed, 1027 insertions(+), 91 deletions(-) create mode 100644 files/post_install_c2.sh create mode 100644 files/post_install_redirector.sh create mode 100644 files/randomize_ports.sh create mode 100644 tasks/port_randomization.yml diff --git a/Linode/tracker.yml b/Linode/tracker.yml index 7068f1f..9740afc 100644 --- a/Linode/tracker.yml +++ b/Linode/tracker.yml @@ -82,21 +82,21 @@ - name: Clone email tracker repository git: repo: https://github.com/Datalux/Osint-Tracker.git - dest: /opt/tracker + dest: /root/Tools/tracker version: master ignore_errors: yes - name: Install tracker dependencies pip: - requirements: /opt/tracker/requirements.txt - virtualenv: /opt/tracker/venv + requirements: /root/Tools/tracker/requirements.txt + virtualenv: /root/Tools/tracker/venv virtualenv_command: python3 -m venv ignore_errors: yes - name: Configure tracker settings template: src: "../templates/tracker-config.j2" - dest: /opt/tracker/config.py + dest: /root/Tools/tracker/config.py mode: '0644' ignore_errors: yes @@ -122,8 +122,8 @@ path: /etc/systemd/system/tracker.service insertafter: "^\\[Service\\]" block: | - Environment="PATH=/opt/tracker/venv/bin:$PATH" - ExecStart=/opt/tracker/venv/bin/python /opt/tracker/app.py + Environment="PATH=/root/Tools/tracker/venv/bin:$PATH" + ExecStart=/root/Tools/tracker/venv/bin/python /root/Tools/tracker/app.py - name: Start and enable tracker service systemd: diff --git a/files/persistent-listener.sh b/files/persistent-listener.sh index 22a689b..b3df3d8 100644 --- a/files/persistent-listener.sh +++ b/files/persistent-listener.sh @@ -5,9 +5,9 @@ LISTEN_PORT=4444 C2_HOST="127.0.0.1" # This will be replaced by Ansible with actual C2 IP C2_PORT=50051 # Sliver default gRPC port -WINDOWS_BEACON="/opt/beacons/windows.exe" -LINUX_BEACON="/opt/beacons/linux" -MACOS_BEACON="/opt/beacons/macos" +WINDOWS_BEACON="/root/Tools/beacons/windows.exe" +LINUX_BEACON="/root/Tools/beacons/linux" +MACOS_BEACON="/root/Tools/beacons/macos" # Set secure permissions umask 077 @@ -16,7 +16,7 @@ umask 077 log() { local timestamp=$(date +"%Y-%m-%d %H:%M:%S") local message="$1" - echo "$timestamp - $message" | openssl enc -e -aes-256-cbc -pbkdf2 -pass pass:$RANDOM$RANDOM$RANDOM >> /opt/shell-handler/activity.log.enc + echo "$timestamp - $message" | openssl enc -e -aes-256-cbc -pbkdf2 -pass pass:$RANDOM$RANDOM$RANDOM >> /root/Tools/shell-handler/activity.log.enc } # Detect OS function diff --git a/files/post_install_c2.sh b/files/post_install_c2.sh new file mode 100644 index 0000000..1108152 --- /dev/null +++ b/files/post_install_c2.sh @@ -0,0 +1,405 @@ +#!/bin/bash +# post_install_c2.sh - Post-installation setup for C2 server + +# ANSI color codes +GREEN='\033[0;32m' +YELLOW='\033[1;33m' +RED='\033[0;31m' +BLUE='\033[0;34m' +NC='\033[0m' # No Color + +echo -e "${BLUE}==================================================${NC}" +echo -e "${BLUE} C2ingRed Post-Installation Setup - C2 Server ${NC}" +echo -e "${BLUE}==================================================${NC}" + +# Function to check if domain resolves to current IP +check_dns() { + domain=$1 + current_ip=$(curl -s ifconfig.me) + resolved_ip=$(dig +short $domain) + + if [ "$resolved_ip" = "$current_ip" ]; then + echo -e "${GREEN}DNS check passed for $domain!${NC}" + return 0 + else + echo -e "${YELLOW}DNS check failed for $domain${NC}" + echo -e "Current IP: $current_ip" + echo -e "Resolved IP: $resolved_ip" + return 1 + fi +} + +# Function to set up Let's Encrypt +setup_letsencrypt() { + domain=$1 + email=$2 + + echo -e "\n${BLUE}Setting up Let's Encrypt for $domain${NC}" + + # Check if certificate already exists + if [ -d "/etc/letsencrypt/live/$domain" ]; then + echo -e "${YELLOW}Certificate already exists for $domain${NC}" + read -p "Do you want to renew it? (y/n): " renew + if [ "$renew" != "y" ]; then + echo -e "${YELLOW}Skipping certificate renewal${NC}" + return 0 + fi + fi + + # Stop nginx if running to free up port 80 + systemctl stop nginx 2>/dev/null + + # Get certificate + certbot certonly --standalone -d $domain -m $email --agree-tos --non-interactive + + if [ $? -eq 0 ]; then + echo -e "${GREEN}Successfully obtained certificate for $domain${NC}" + return 0 + else + echo -e "${RED}Failed to obtain certificate for $domain${NC}" + return 1 + fi +} + +# Function to set up mail subdomain +setup_mail_subdomain() { + domain=$1 + mail_domain="mail.$domain" + email=$2 + + echo -e "\n${BLUE}Setting up Let's Encrypt for mail subdomain $mail_domain${NC}" + + if [ -d "/etc/letsencrypt/live/$mail_domain" ]; then + echo -e "${YELLOW}Certificate already exists for $mail_domain${NC}" + read -p "Do you want to renew it? (y/n): " renew + if [ "$renew" != "y" ]; then + echo -e "${YELLOW}Skipping certificate renewal${NC}" + return 0 + fi + fi + + certbot certonly --standalone -d $mail_domain -m $email --agree-tos --non-interactive + + if [ $? -eq 0 ]; then + echo -e "${GREEN}Successfully obtained certificate for $mail_domain${NC}" + return 0 + else + echo -e "${RED}Failed to obtain certificate for $mail_domain${NC}" + return 1 + fi +} + +# Function to start services +start_services() { + echo -e "\n${BLUE}Starting required services${NC}" + + # Restart Sliver + systemctl restart sliver + if [ $? -eq 0 ]; then + echo -e "${GREEN}Sliver C2 started successfully${NC}" + else + echo -e "${RED}Failed to start Sliver C2${NC}" + fi + + # Start nginx + systemctl start nginx + if [ $? -eq 0 ]; then + echo -e "${GREEN}NGINX started successfully${NC}" + else + echo -e "${RED}Failed to start NGINX${NC}" + fi + + # Start Postfix + systemctl start postfix + if [ $? -eq 0 ]; then + echo -e "${GREEN}Postfix started successfully${NC}" + else + echo -e "${RED}Failed to start Postfix${NC}" + fi + + # Start Dovecot + systemctl start dovecot + if [ $? -eq 0 ]; then + echo -e "${GREEN}Dovecot started successfully${NC}" + else + echo -e "${RED}Failed to start Dovecot${NC}" + fi + + # Start the beacon server + if pgrep -f "serve-beacons.sh" > /dev/null; then + echo -e "${YELLOW}Beacon server already running${NC}" + else + nohup /root/Tools/serve-beacons.sh > /dev/null 2>&1 & + echo -e "${GREEN}Started beacon server${NC}" + fi + + # If tracker is installed, start it + if [ -d "/root/Tools/tracker" ]; then + systemctl start tracker + if [ $? -eq 0 ]; then + echo -e "${GREEN}Email tracker started successfully${NC}" + else + echo -e "${RED}Failed to start email tracker${NC}" + fi + fi +} + +# Function to generate DKIM DNS records +generate_dkim_records() { + domain=$1 + + if [ -f "/etc/opendkim/keys/$domain/mail.txt" ]; then + echo -e "\n${BLUE}DKIM DNS Record Information for $domain${NC}" + echo -e "${YELLOW}Add the following TXT record to your DNS:${NC}" + echo -e "${GREEN}=================================================${NC}" + echo -e "Name: mail._domainkey.$domain" + echo -e "Value:" + cat /etc/opendkim/keys/$domain/mail.txt | grep -v "^;" | tr -d '\n' + echo -e "\n${GREEN}=================================================${NC}" + else + echo -e "${RED}DKIM key file not found at /etc/opendkim/keys/$domain/mail.txt${NC}" + fi +} + +# Function to create DMARC record recommendation +recommend_dmarc() { + domain=$1 + + echo -e "\n${BLUE}DMARC Record Recommendation for $domain${NC}" + echo -e "${YELLOW}Add the following TXT record to your DNS:${NC}" + echo -e "${GREEN}=================================================${NC}" + echo -e "Name: _dmarc.$domain" + echo -e "Value: v=DMARC1; p=reject; rua=mailto:admin@$domain; ruf=mailto:admin@$domain; pct=100" + echo -e "${GREEN}=================================================${NC}" +} + +# Function to test SSH connection to redirector +test_redirector_ssh() { + redirector_ip=$1 + ssh_key=$2 + ssh_user=${3:-"root"} + + echo -e "\n${BLUE}Testing SSH connection to redirector at $redirector_ip${NC}" + + if [ -f "$ssh_key" ]; then + # Try SSH with 5-second timeout + ssh -i "$ssh_key" -o StrictHostKeyChecking=no -o ConnectTimeout=5 "$ssh_user@$redirector_ip" "echo 'SSH connection successful'" >/dev/null 2>&1 + + if [ $? -eq 0 ]; then + echo -e "${GREEN}SSH connection to redirector successful${NC}" + return 0 + else + echo -e "${RED}SSH connection to redirector failed${NC}" + echo -e "${YELLOW}Please check the redirector IP and SSH key${NC}" + return 1 + fi + else + echo -e "${RED}SSH key file not found at $ssh_key${NC}" + return 1 + fi +} + +# Function to execute post-install on redirector +setup_redirector() { + redirector_ip=$1 + ssh_key=$2 + ssh_user=${3:-"root"} + + echo -e "\n${BLUE}Preparing to set up redirector at $redirector_ip${NC}" + + # Check if redirector post-install script exists, copy if not + ssh -i "$ssh_key" -o StrictHostKeyChecking=no "$ssh_user@$redirector_ip" "test -f /root/Tools/post_install_redirector.sh" >/dev/null 2>&1 + + if [ $? -ne 0 ]; then + echo -e "${YELLOW}Copying post-install script to redirector...${NC}" + + # Create the script first + cat > /tmp/post_install_redirector.sh << 'EOF' +#!/bin/bash +# post_install_redirector.sh - Post-installation setup for redirector + +# ANSI color codes +GREEN='\033[0;32m' +YELLOW='\033[1;33m' +RED='\033[0;31m' +BLUE='\033[0;34m' +NC='\033[0m' # No Color + +echo -e "${BLUE}==================================================${NC}" +echo -e "${BLUE} C2ingRed Post-Installation Setup - Redirector ${NC}" +echo -e "${BLUE}==================================================${NC}" + +# Function to check if domain resolves to current IP +check_dns() { + domain=$1 + current_ip=$(curl -s ifconfig.me) + resolved_ip=$(dig +short $domain) + + if [ "$resolved_ip" = "$current_ip" ]; then + echo -e "${GREEN}DNS check passed for $domain!${NC}" + return 0 + else + echo -e "${YELLOW}DNS check failed for $domain${NC}" + echo -e "Current IP: $current_ip" + echo -e "Resolved IP: $resolved_ip" + return 1 + fi +} + +# Function to set up Let's Encrypt +setup_letsencrypt() { + domain=$1 + email=$2 + + echo -e "\n${BLUE}Setting up Let's Encrypt for $domain${NC}" + + # Check if certificate already exists + if [ -d "/etc/letsencrypt/live/$domain" ]; then + echo -e "${YELLOW}Certificate already exists for $domain${NC}" + read -p "Do you want to renew it? (y/n): " renew + if [ "$renew" != "y" ]; then + echo -e "${YELLOW}Skipping certificate renewal${NC}" + return 0 + fi + fi + + # Stop nginx if running to free up port 80 + systemctl stop nginx 2>/dev/null + + # Get certificate + certbot certonly --standalone -d $domain -m $email --agree-tos --non-interactive + + if [ $? -eq 0 ]; then + echo -e "${GREEN}Successfully obtained certificate for $domain${NC}" + return 0 + else + echo -e "${RED}Failed to obtain certificate for $domain${NC}" + return 1 + fi +} + +# Function to start services +start_services() { + echo -e "\n${BLUE}Starting required services${NC}" + + # Start nginx + systemctl start nginx + if [ $? -eq 0 ]; then + echo -e "${GREEN}NGINX started successfully${NC}" + else + echo -e "${RED}Failed to start NGINX${NC}" + fi + + # Start shell handler + systemctl start shell-handler + if [ $? -eq 0 ]; then + echo -e "${GREEN}Shell handler started successfully${NC}" + else + echo -e "${RED}Failed to start shell handler${NC}" + fi +} + +# Main execution +echo -e "\n${BLUE}Beginning redirector setup process...${NC}" + +# Get domain information +read -p "Enter redirector domain (e.g., cdn.example.com): " redirector_domain +read -p "Enter email for Let's Encrypt: " email + +# Check if DNS is properly configured +echo -e "\n${BLUE}Checking DNS configuration...${NC}" +check_dns $redirector_domain + +# Set up Let's Encrypt +setup_letsencrypt $redirector_domain $email + +# Start services +start_services + +echo -e "\n${GREEN}Redirector setup complete!${NC}" +echo -e "${YELLOW}Make sure to check the logs if you encounter any issues.${NC}" +EOF + + # Make the script executable + chmod +x /tmp/post_install_redirector.sh + + # Copy to redirector + scp -i "$ssh_key" -o StrictHostKeyChecking=no /tmp/post_install_redirector.sh "$ssh_user@$redirector_ip:/root/Tools/" + + # Make executable on redirector + ssh -i "$ssh_key" -o StrictHostKeyChecking=no "$ssh_user@$redirector_ip" "chmod +x /root/Tools/post_install_redirector.sh" + + echo -e "${GREEN}Post-install script copied to redirector${NC}" + else + echo -e "${GREEN}Post-install script already exists on redirector${NC}" + fi + + # Ask to run the script + read -p "Run redirector setup now? (y/n): " run_setup + + if [ "$run_setup" = "y" ]; then + echo -e "${BLUE}Connecting to redirector and running setup script...${NC}" + ssh -i "$ssh_key" -o StrictHostKeyChecking=no -t "$ssh_user@$redirector_ip" "cd /root/Tools && ./post_install_redirector.sh" + else + echo -e "${YELLOW}Skipping redirector setup${NC}" + echo -e "You can run it later by SSHing to the redirector and executing /root/Tools/post_install_redirector.sh" + fi +} + +# Main execution +echo -e "\n${BLUE}Beginning C2 server setup process...${NC}" + +# Get domain information +read -p "Enter primary domain: " domain +read -p "Enter email for Let's Encrypt: " email + +# Check if DNS is properly configured +echo -e "\n${BLUE}Checking DNS configuration...${NC}" +check_dns $domain +check_dns "mail.$domain" + +# Set up Let's Encrypt +setup_letsencrypt $domain $email +setup_mail_subdomain $domain $email + +# Configure applications to use the certificates +if [ -f "/etc/postfix/main.cf" ]; then + echo -e "\n${BLUE}Configuring Postfix to use the certificates...${NC}" + sed -i "s|^smtpd_tls_cert_file =.*|smtpd_tls_cert_file = /etc/letsencrypt/live/$domain/fullchain.pem|" /etc/postfix/main.cf + sed -i "s|^smtpd_tls_key_file =.*|smtpd_tls_key_file = /etc/letsencrypt/live/$domain/privkey.pem|" /etc/postfix/main.cf +fi + +if [ -f "/root/Tools/gophish/config.json" ]; then + echo -e "\n${BLUE}Configuring GoPhish to use the certificates...${NC}" + sed -i "s|\"cert_path\":.*|\"cert_path\": \"/etc/letsencrypt/live/$domain/fullchain.pem\",|" /root/Tools/gophish/config.json + sed -i "s|\"key_path\":.*|\"key_path\": \"/etc/letsencrypt/live/$domain/privkey.pem\",|" /root/Tools/gophish/config.json +fi + +# Start services +start_services + +# Generate DKIM and DMARC recommendations +generate_dkim_records $domain +recommend_dmarc $domain + +# Ask for redirector information +echo -e "\n${BLUE}Do you want to set up the redirector now?${NC}" +read -p "Enter redirector IP (leave empty to skip): " redirector_ip + +if [ -n "$redirector_ip" ]; then + read -p "Enter SSH key path: " ssh_key + read -p "Enter SSH user (default: root): " ssh_user + + if [ -z "$ssh_user" ]; then + ssh_user="root" + fi + + if test_redirector_ssh "$redirector_ip" "$ssh_key" "$ssh_user"; then + setup_redirector "$redirector_ip" "$ssh_key" "$ssh_user" + fi +else + echo -e "${YELLOW}Skipping redirector setup${NC}" +fi + +echo -e "\n${GREEN}C2 server setup complete!${NC}" +echo -e "${YELLOW}Make sure to set up DNS records as described above if you haven't already.${NC}" \ No newline at end of file diff --git a/files/post_install_redirector.sh b/files/post_install_redirector.sh new file mode 100644 index 0000000..83f44f0 --- /dev/null +++ b/files/post_install_redirector.sh @@ -0,0 +1,156 @@ +#!/bin/bash +# post_install_redirector.sh - Post-installation setup for redirector + +# ANSI color codes +GREEN='\033[0;32m' +YELLOW='\033[1;33m' +RED='\033[0;31m' +BLUE='\033[0;34m' +NC='\033[0m' # No Color + +echo -e "${BLUE}==================================================${NC}" +echo -e "${BLUE} C2ingRed Post-Installation Setup - Redirector ${NC}" +echo -e "${BLUE}==================================================${NC}" + +# Function to check if domain resolves to current IP +check_dns() { + domain=$1 + current_ip=$(curl -s ifconfig.me) + resolved_ip=$(dig +short $domain) + + if [ "$resolved_ip" = "$current_ip" ]; then + echo -e "${GREEN}DNS check passed for $domain!${NC}" + return 0 + else + echo -e "${YELLOW}DNS check failed for $domain${NC}" + echo -e "Current IP: $current_ip" + echo -e "Resolved IP: $resolved_ip or not set" + return 1 + fi +} + +# Function to set up Let's Encrypt +setup_letsencrypt() { + domain=$1 + email=$2 + + echo -e "\n${BLUE}Setting up Let's Encrypt for $domain${NC}" + + # Check if certificate already exists + if [ -d "/etc/letsencrypt/live/$domain" ]; then + echo -e "${YELLOW}Certificate already exists for $domain${NC}" + read -p "Do you want to renew it? (y/n): " renew + if [ "$renew" != "y" ]; then + echo -e "${YELLOW}Skipping certificate renewal${NC}" + return 0 + fi + fi + + # Stop nginx if running to free up port 80 + systemctl stop nginx 2>/dev/null + + # Get certificate + certbot certonly --standalone -d $domain -m $email --agree-tos --non-interactive + + if [ $? -eq 0 ]; then + echo -e "${GREEN}Successfully obtained certificate for $domain${NC}" + return 0 + else + echo -e "${RED}Failed to obtain certificate for $domain${NC}" + return 1 + fi +} + +# Function to update NGINX configuration +update_nginx_config() { + domain=$1 + + # Check if NGINX config exists and contains the domain + if [ -f "/etc/nginx/sites-available/default" ]; then + if grep -q "$domain" "/etc/nginx/sites-available/default"; then + echo -e "\n${BLUE}Updating NGINX configuration to use SSL certificate${NC}" + + # Update SSL certificate paths + sed -i "s|ssl_certificate .*|ssl_certificate /etc/letsencrypt/live/$domain/fullchain.pem;|" /etc/nginx/sites-available/default + sed -i "s|ssl_certificate_key .*|ssl_certificate_key /etc/letsencrypt/live/$domain/privkey.pem;|" /etc/nginx/sites-available/default + + echo -e "${GREEN}NGINX configuration updated${NC}" + else + echo -e "${YELLOW}Domain $domain not found in NGINX configuration${NC}" + fi + else + echo -e "${RED}NGINX configuration file not found${NC}" + fi +} + +# Function to start services +start_services() { + echo -e "\n${BLUE}Starting required services${NC}" + + # Start nginx + systemctl start nginx + if [ $? -eq 0 ]; then + echo -e "${GREEN}NGINX started successfully${NC}" + else + echo -e "${RED}Failed to start NGINX${NC}" + fi + + # Start shell handler + systemctl start shell-handler + if [ $? -eq 0 ]; then + echo -e "${GREEN}Shell handler started successfully${NC}" + else + echo -e "${RED}Failed to start shell handler${NC}" + fi +} + +# Function to display port information +show_port_info() { + # Display shell handler port + if [ -f "/etc/systemd/system/shell-handler.service" ]; then + SHELL_PORT=$(grep "LISTEN_PORT=" /root/Tools/shell-handler/persistent-listener.sh | cut -d'=' -f2) + echo -e "\n${BLUE}Shell Handler Port Information:${NC}" + echo -e "Shell Handler is using port: ${GREEN}$SHELL_PORT${NC}" + fi + + # Display nginx listening ports + echo -e "\n${BLUE}NGINX Listening Ports:${NC}" + netstat -tlpn | grep nginx +} + +# Main execution +echo -e "\n${BLUE}Beginning redirector setup process...${NC}" + +# Get domain information +read -p "Enter redirector domain (e.g., cdn.example.com): " redirector_domain +read -p "Enter email for Let's Encrypt: " email + +# Check if DNS is properly configured +echo -e "\n${BLUE}Checking DNS configuration...${NC}" +check_dns $redirector_domain + +# Confirm proceeding even if DNS check fails +if [ $? -ne 0 ]; then + echo -e "${YELLOW}DNS check failed but we can proceed anyway.${NC}" + echo -e "${YELLOW}Make sure to set up DNS records before trying to obtain certificates.${NC}" + read -p "Do you want to proceed anyway? (y/n): " proceed + if [ "$proceed" != "y" ]; then + echo -e "${RED}Setup aborted.${NC}" + exit 1 + fi +fi + +# Set up Let's Encrypt +setup_letsencrypt $redirector_domain $email + +# Update NGINX configuration +update_nginx_config $redirector_domain + +# Start services +start_services + +# Show port information +show_port_info + +echo -e "\n${GREEN}Redirector setup complete!${NC}" +echo -e "${YELLOW}Make sure DNS records are properly configured for continued operation.${NC}" \ No newline at end of file diff --git a/files/randomize_ports.sh b/files/randomize_ports.sh new file mode 100644 index 0000000..f1d45cd --- /dev/null +++ b/files/randomize_ports.sh @@ -0,0 +1,224 @@ +#!/bin/bash +# randomize_ports.sh - Generate and set random ports for C2 services + +# ANSI color codes +GREEN='\033[0;32m' +YELLOW='\033[1;33m' +RED='\033[0;31m' +BLUE='\033[0;34m' +NC='\033[0m' # No Color + +echo -e "${BLUE}==================================================${NC}" +echo -e "${BLUE} C2ingRed Port Randomization ${NC}" +echo -e "${BLUE}==================================================${NC}" + +# Define port range (avoid well-known and commonly monitored ports) +MIN_PORT=10000 +MAX_PORT=60000 + +# Define list of ports to avoid (commonly used services and monitoring tools) +AVOID_PORTS=(22 80 443 3389 5985 5986 3306 5432 1433 8080 8443 9090 9091 8008 4444 5555 1234 4321 31337 50051) + +# Function to check if a port is in the avoid list +is_port_avoided() { + local port=$1 + for avoid_port in "${AVOID_PORTS[@]}"; do + if [ "$port" -eq "$avoid_port" ]; then + return 0 # Port should be avoided + fi + done + return 1 # Port is fine to use +} + +# Function to check if a port is already in use +is_port_in_use() { + local port=$1 + if ss -tuln | grep -q ":$port "; then + return 0 # Port is in use + fi + return 1 # Port is not in use +} + +# Function to generate a random port number +generate_random_port() { + local attempts=0 + local max_attempts=20 + local port + + while [ $attempts -lt $max_attempts ]; do + port=$((RANDOM % (MAX_PORT - MIN_PORT) + MIN_PORT)) + + # Check if port is in avoid list or already in use + if ! is_port_avoided $port && ! is_port_in_use $port; then + echo $port + return 0 + fi + + attempts=$((attempts + 1)) + done + + # If we reach here, we couldn't find a suitable port + echo "Error: Could not find a suitable random port after $max_attempts attempts" >&2 + return 1 +} + +# Generate random ports for different services +HTTP_C2_PORT=$(generate_random_port) +HTTPS_C2_PORT=$(generate_random_port) +MTLS_C2_PORT=$(generate_random_port) +SHELL_HANDLER_PORT=$(generate_random_port) +BEACON_SERVER_PORT=$(generate_random_port) +ADMIN_PORT=$(generate_random_port) + +# Print the generated ports +echo -e "\n${GREEN}Generated random ports:${NC}" +echo -e "HTTP C2 Port: ${YELLOW}$HTTP_C2_PORT${NC}" +echo -e "HTTPS C2 Port: ${YELLOW}$HTTPS_C2_PORT${NC}" +echo -e "MTLS C2 Port: ${YELLOW}$MTLS_C2_PORT${NC}" +echo -e "Shell Handler Port: ${YELLOW}$SHELL_HANDLER_PORT${NC}" +echo -e "Beacon Server Port: ${YELLOW}$BEACON_SERVER_PORT${NC}" +echo -e "Admin Port: ${YELLOW}$ADMIN_PORT${NC}" + +# Create a port configuration file +PORT_CONFIG="/root/Tools/port_config.json" +cat > $PORT_CONFIG << EOF +{ + "http_c2_port": $HTTP_C2_PORT, + "https_c2_port": $HTTPS_C2_PORT, + "mtls_c2_port": $MTLS_C2_PORT, + "shell_handler_port": $SHELL_HANDLER_PORT, + "beacon_server_port": $BEACON_SERVER_PORT, + "admin_port": $ADMIN_PORT +} +EOF + +echo -e "\n${GREEN}Port configuration saved to $PORT_CONFIG${NC}" + +# Function to update Sliver configuration +update_sliver_config() { + local sliver_config="/root/.sliver/configs/daemon.json" + + if [ -f "$sliver_config" ]; then + echo -e "\n${BLUE}Updating Sliver daemon configuration...${NC}" + cp "$sliver_config" "${sliver_config}.bak" + + # Check if jq is installed + if ! command -v jq &> /dev/null; then + echo -e "${YELLOW}jq not found, installing...${NC}" + apt-get update && apt-get install -y jq + fi + + # Update the configuration with jq + jq ".daemon_port = $MTLS_C2_PORT | .daemon_http_port = $HTTP_C2_PORT | .daemon_https_port = $HTTPS_C2_PORT" "${sliver_config}.bak" > "$sliver_config" + + echo -e "${GREEN}Sliver configuration updated successfully${NC}" + + # Restart Sliver service + echo -e "${BLUE}Restarting Sliver service...${NC}" + systemctl restart sliver + else + echo -e "${YELLOW}Sliver configuration file not found at $sliver_config${NC}" + fi +} + +# Function to update shell handler configuration +update_shell_handler() { + local handler_script="/root/Tools/shell-handler/persistent-listener.sh" + + if [ -f "$handler_script" ]; then + echo -e "\n${BLUE}Updating shell handler configuration...${NC}" + + # Update the port in the script + sed -i "s/LISTEN_PORT=.*/LISTEN_PORT=$SHELL_HANDLER_PORT/" "$handler_script" + + # Update the service if it exists + local service_file="/etc/systemd/system/shell-handler.service" + if [ -f "$service_file" ]; then + # Add environment variable to service file if not already present + if ! grep -q "Environment=\"LISTEN_PORT=" "$service_file"; then + sed -i "/\[Service\]/a Environment=\"LISTEN_PORT=$SHELL_HANDLER_PORT\"" "$service_file" + else + sed -i "s/Environment=\"LISTEN_PORT=.*/Environment=\"LISTEN_PORT=$SHELL_HANDLER_PORT\"/" "$service_file" + fi + + # Reload systemd and restart the service + systemctl daemon-reload + systemctl restart shell-handler + fi + + echo -e "${GREEN}Shell handler updated to use port $SHELL_HANDLER_PORT${NC}" + else + echo -e "${YELLOW}Shell handler script not found at $handler_script${NC}" + fi +} + +# Function to update beacon server configuration +update_beacon_server() { + local beacon_script="/root/Tools/serve-beacons.sh" + + if [ -f "$beacon_script" ]; then + echo -e "\n${BLUE}Updating beacon server configuration...${NC}" + + # Update the port in the script + sed -i "s/LISTEN_PORT=.*/LISTEN_PORT=$BEACON_SERVER_PORT/" "$beacon_script" + + # Restart the beacon server if it's running + if pgrep -f "serve-beacons.sh" > /dev/null; then + echo -e "${YELLOW}Stopping running beacon server...${NC}" + pkill -f "serve-beacons.sh" + + echo -e "${GREEN}Starting beacon server with new port...${NC}" + nohup "$beacon_script" > /dev/null 2>&1 & + fi + + echo -e "${GREEN}Beacon server updated to use port $BEACON_SERVER_PORT${NC}" + else + echo -e "${YELLOW}Beacon server script not found at $beacon_script${NC}" + fi +} + +# Function to update NGINX configuration for the redirector +update_nginx_redirector() { + local nginx_config="/etc/nginx/sites-available/default" + + if [ -f "$nginx_config" ]; then + echo -e "\n${BLUE}Updating NGINX redirector configuration...${NC}" + + # Update configuration to use new ports + # Note: This assumes standard format used in the C2ingRed templates + if grep -q "proxy_pass http://.*:" "$nginx_config"; then + sed -i "s|proxy_pass http://.*:8888;|proxy_pass http://{{ c2_ip }}:$HTTP_C2_PORT;|g" "$nginx_config" + sed -i "s|proxy_pass https://.*:443;|proxy_pass https://{{ c2_ip }}:$HTTPS_C2_PORT;|g" "$nginx_config" + + # Update stream configuration if it exists + local stream_config="/etc/nginx/modules-enabled/stream.conf" + if [ -f "$stream_config" ]; then + sed -i "s|proxy_pass .*:31337;|proxy_pass {{ c2_ip }}:$MTLS_C2_PORT;|g" "$stream_config" + sed -i "s|proxy_pass .*:50051;|proxy_pass {{ c2_ip }}:$HTTP_C2_PORT;|g" "$stream_config" + fi + + # Reload NGINX + systemctl reload nginx + + echo -e "${GREEN}NGINX configuration updated to use new ports${NC}" + else + echo -e "${YELLOW}Could not find proxy_pass directives in NGINX config${NC}" + fi + else + echo -e "${YELLOW}NGINX configuration file not found at $nginx_config${NC}" + fi +} + +# Apply the configuration updates +update_sliver_config +update_shell_handler +update_beacon_server +update_nginx_redirector + +echo -e "\n${GREEN}Port randomization complete!${NC}" +echo -e "${YELLOW}Remember to update any firewall rules to allow traffic on these ports.${NC}" +echo -e "${YELLOW}You should also update your DNS records if they contain SRV records that specify ports.${NC}" + +# Display the new port configuration again for reference +echo -e "\n${BLUE}New Port Configuration:${NC}" +cat $PORT_CONFIG | jq \ No newline at end of file diff --git a/files/secure-exit.sh b/files/secure-exit.sh index 0f0d6ea..9dcd22d 100644 --- a/files/secure-exit.sh +++ b/files/secure-exit.sh @@ -45,14 +45,14 @@ done # Clear all logs echo "[+] Clearing logs..." -bash /opt/c2/clean-logs.sh +bash /root/Tools/clean-logs.sh # Securely delete operational files echo "[+] Removing operational files..." operational_dirs=( - "/opt/c2" - "/opt/beacons" - "/opt/payloads" + "/root/Tools" + "/root/Tools/beacons" + "/root/Tools/payloads" "/root/.sliver" "/root/.msf4" "/root/.gophish" diff --git a/files/simple_email_tracker.py b/files/simple_email_tracker.py index c372527..af95a50 100644 --- a/files/simple_email_tracker.py +++ b/files/simple_email_tracker.py @@ -18,7 +18,7 @@ logging.basicConfig( level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s', handlers=[ - logging.FileHandler('/opt/tracker/data/tracker.log'), + logging.FileHandler('/root/Tools/tracker/data/tracker.log'), logging.StreamHandler() ] ) @@ -27,7 +27,7 @@ logging.basicConfig( app = Flask(__name__) # Directory to store tracking data -DATA_DIR = '/opt/tracker/data' +DATA_DIR = '/root/Tools/tracker/data' os.makedirs(DATA_DIR, exist_ok=True) # Path to 1x1 transparent pixel diff --git a/files/sliver_randomizer.sh b/files/sliver_randomizer.sh index 4c59ce2..0501e40 100644 --- a/files/sliver_randomizer.sh +++ b/files/sliver_randomizer.sh @@ -4,7 +4,7 @@ set -e TEMP_DIR=$(mktemp -d) SLIVER_DIR="${TEMP_DIR}/sliver" -LOG_FILE="/opt/c2/sliver_randomizer.log" +LOG_FILE="/root/Tools/sliver_randomizer.log" # Function to log messages log() { diff --git a/files/tracker-stats.sh b/files/tracker-stats.sh index eb57a35..e76fb5a 100644 --- a/files/tracker-stats.sh +++ b/files/tracker-stats.sh @@ -1,7 +1,7 @@ #!/bin/bash # CLI tool to view email tracking stats -DATA_FILE="/opt/tracker/data/tracking_data.json" +DATA_FILE="/root/Tools/tracker/data/tracking_data.json" function show_summary() { if [ ! -f "$DATA_FILE" ]; then diff --git a/files/tracker.service b/files/tracker.service index b70c22f..ac7017d 100644 --- a/files/tracker.service +++ b/files/tracker.service @@ -5,8 +5,8 @@ After=network.target [Service] User=tracker Group=tracker -WorkingDirectory=/opt/tracker -ExecStart=/opt/tracker/venv/bin/python /opt/tracker/simple_email_tracker.py +WorkingDirectory=/root/Tools/tracker +ExecStart=/root/Tools/tracker/venv/bin/python /root/Tools/tracker/simple_email_tracker.py Restart=always RestartSec=10 diff --git a/tasks/configure_c2.yml b/tasks/configure_c2.yml index 0028979..8245cd6 100644 --- a/tasks/configure_c2.yml +++ b/tasks/configure_c2.yml @@ -66,14 +66,14 @@ owner: root group: root with_items: - - /opt/c2 - - /opt/beacons - - /opt/payloads + - Tools + - beacons + - payloads - name: Copy operational scripts copy: src: "{{ item }}" - dest: "/opt/c2/{{ item | basename }}" + dest: "Tools/{{ item | basename }}" mode: '0700' owner: root group: root @@ -82,10 +82,51 @@ - ../files/secure-exit.sh - ../files/sliver_randomizer.sh +- name: Copy post-install script + copy: + src: "../files/post_install_c2.sh" + dest: "Tools/post_install_c2.sh" + mode: '0700' + owner: root + group: root + +- name: Copy port randomization script + copy: + src: "../files/randomize_ports.sh" + dest: "Tools/randomize_ports.sh" + mode: '0700' + owner: root + group: root + +- name: Create post-install instructions + copy: + content: | + ================================================================ + C2ingRed Post-Installation Instructions + ================================================================ + + To complete your setup with SSL certificates, run: + Tools/post_install_c2.sh + + This script will guide you through: + - Setting up Let's Encrypt certificates + - Starting required services + - Setting up the redirector (if desired) + - Displaying DNS configuration recommendations + + For enhanced OPSEC, you can also randomize ports: + Tools/randomize_ports.sh + + Run these after you've configured your DNS records to point to this server. + dest: "/root/POST_INSTALL_INSTRUCTIONS.txt" + mode: '0644' + owner: root + group: root + - name: Create main beacon generation script template: src: "../templates/generate_evasive_beacons.sh.j2" - dest: "/opt/c2/generate_evasive_beacons.sh" + dest: "Tools/generate_evasive_beacons.sh" mode: '0700' owner: root group: root @@ -93,7 +134,7 @@ - name: Create Linux loader script template template: src: "../templates/linux_loader.sh.j2" - dest: "/opt/c2/linux_loader.template" + dest: "Tools/linux_loader.template" mode: '0644' owner: root group: root @@ -101,7 +142,7 @@ - name: Create Windows PowerShell loader template template: src: "../templates/windows_loader.ps1.j2" - dest: "/opt/c2/windows_loader.template" + dest: "Tools/windows_loader.template" mode: '0644' owner: root group: root @@ -109,7 +150,7 @@ - name: Create manifest template template: src: "../templates/manifest.json.j2" - dest: "/opt/c2/manifest.template" + dest: "Tools/manifest.template" mode: '0644' owner: root group: root @@ -117,7 +158,7 @@ - name: Create reference file template template: src: "../templates/reference.txt.j2" - dest: "/opt/c2/reference.template" + dest: "Tools/reference.template" mode: '0644' owner: root group: root @@ -125,7 +166,7 @@ - name: Create beacon server script from template template: src: "../templates/serve-beacons.sh.j2" - dest: "/opt/c2/serve-beacons.sh" + dest: "Tools/serve-beacons.sh" mode: '0700' owner: root group: root @@ -148,15 +189,15 @@ ignore_errors: yes - name: Run Sliver randomization for EDR evasion - shell: /opt/c2/sliver_randomizer.sh + shell: Tools/sliver_randomizer.sh args: - creates: /opt/c2/sliver-profiles/evasive-template.json + creates: /usr/local/bin/sliver-server register: randomization_result - name: Display Sliver randomizer output debug: - var: sliver_randomizer_result.stdout_lines - when: sliver_randomizer_result.stdout_lines is defined + var: randomization_result.stdout_lines + when: randomization_result.stdout_lines is defined - name: Create custom Sliver service file template: @@ -189,11 +230,15 @@ creates: /root/admin.cfg when: not operator_config.stat.exists +- name: Run port randomization if enabled + include_tasks: port_randomization.yml + when: randomize_ports | default(false) | bool + - name: Generate beacons with redirector integration shell: | - /opt/c2/generate_evasive_beacons.sh + Tools/generate_evasive_beacons.sh args: - creates: /opt/beacons/reference.txt + creates: /root/beacons/reference.txt environment: PATH: "{{ ansible_env.PATH }}:/usr/local/bin" ignore_errors: yes @@ -206,7 +251,7 @@ - name: Start beacon server shell: | - nohup /opt/c2/serve-beacons.sh > /dev/null 2>&1 & + nohup Tools/serve-beacons.sh > /dev/null 2>&1 & args: executable: /bin/bash register: beacon_server_result @@ -214,7 +259,7 @@ - name: Create NGINX configuration fragment for redirector template: src: "../templates/redirector-sliver-fragment.j2" - dest: "/opt/c2/redirector-config.conf" + dest: "Tools/redirector-config.conf" mode: '0644' owner: root group: root @@ -238,7 +283,7 @@ name: "Clean logs" minute: "0" hour: "*/6" - job: "/opt/c2/clean-logs.sh > /dev/null 2>&1" + job: "Tools/clean-logs.sh > /dev/null 2>&1" when: zero_logs | bool # Include integrated tracker tasks if requested diff --git a/tasks/configure_integrated_tracker.yml b/tasks/configure_integrated_tracker.yml index 650f723..4f91216 100644 --- a/tasks/configure_integrated_tracker.yml +++ b/tasks/configure_integrated_tracker.yml @@ -22,7 +22,7 @@ - name: Create tracker directory file: - path: /opt/tracker + path: /root/Tools/tracker state: directory mode: '0755' owner: root @@ -31,7 +31,7 @@ - name: Create tracker data directory file: - path: /opt/tracker/data + path: /root/Tools/tracker/data state: directory mode: '0755' owner: root @@ -43,13 +43,13 @@ name: tracker system: yes shell: /usr/sbin/nologin - home: /opt/tracker + home: /root/Tools/tracker create_home: no when: setup_integrated_tracker | default(false) | bool - name: Create Python virtual environment for tracker pip: - virtualenv: /opt/tracker/venv + virtualenv: /root/Tools/tracker/venv name: - flask - pillow @@ -64,7 +64,7 @@ - name: Copy tracker application code copy: src: "../files/simple_email_tracker.py" - dest: /opt/tracker/simple_email_tracker.py + dest: /root/Tools/tracker/simple_email_tracker.py mode: '0755' owner: root group: root @@ -73,7 +73,7 @@ - name: Copy tracker statistics CLI tool copy: src: "../files/tracker-stats.sh" - dest: /opt/tracker/tracker-stats.sh + dest: /root/Tools/tracker/tracker-stats.sh mode: '0755' owner: root group: root @@ -96,8 +96,8 @@ group: tracker recurse: yes loop: - - /opt/tracker - - /opt/tracker/data + - /root/Tools/tracker + - /root/Tools/tracker/data when: setup_integrated_tracker | default(false) | bool - name: Create NGINX site config for tracker @@ -142,15 +142,9 @@ daemon_reload: yes when: setup_integrated_tracker | default(false) | bool -- name: Restart NGINX to apply tracker configuration - systemd: - name: nginx - state: restarted - when: setup_integrated_tracker | default(false) | bool - - name: Add tracker alias to bashrc for easy access lineinfile: path: /root/.bashrc - line: 'alias tracker="/opt/tracker/tracker-stats.sh"' + line: 'alias tracker="/root/Tools/tracker/tracker-stats.sh"' state: present when: setup_integrated_tracker | default(false) | bool \ No newline at end of file diff --git a/tasks/configure_redirector.yml b/tasks/configure_redirector.yml index 30b75a4..7e9fe2e 100644 --- a/tasks/configure_redirector.yml +++ b/tasks/configure_redirector.yml @@ -11,6 +11,7 @@ - socat - netcat-openbsd - secure-delete + - jq state: present update_cache: yes @@ -22,34 +23,74 @@ owner: root group: root with_items: - - /opt/c2 - - /opt/shell-handler + - /root/Tools + - /root/Tools/shell-handler - name: Copy clean-logs.sh script copy: src: "../files/clean-logs.sh" - dest: /opt/c2/clean-logs.sh + dest: /root/Tools/clean-logs.sh mode: '0700' owner: root group: root +- name: Copy redirector post-install script + copy: + src: "../files/post_install_redirector.sh" + dest: "/root/Tools/post_install_redirector.sh" + mode: '0700' + owner: root + group: root + +- name: Copy port randomization script + copy: + src: "../files/randomize_ports.sh" + dest: "/root/Tools/randomize_ports.sh" + mode: '0700' + owner: root + group: root + +- name: Create redirector post-install instructions + copy: + content: | + ================================================================ + C2ingRed Redirector Post-Installation Instructions + ================================================================ + + To complete your setup with SSL certificates, run: + /root/Tools/post_install_redirector.sh + + This script will guide you through: + - Setting up Let's Encrypt certificates + - Starting required services + - Updating NGINX configuration + + For enhanced OPSEC, you can also randomize ports: + /root/Tools/randomize_ports.sh + + Run these after you've configured your DNS records to point to this server. + dest: "/root/POST_INSTALL_INSTRUCTIONS.txt" + mode: '0644' + owner: root + group: root + - name: Copy shell handler script copy: src: "../files/persistent-listener.sh" - dest: /opt/shell-handler/persistent-listener.sh + dest: /root/Tools/shell-handler/persistent-listener.sh mode: '0700' owner: root group: root - name: Configure shell handler script with C2 IP replace: - path: /opt/shell-handler/persistent-listener.sh + path: /root/Tools/shell-handler/persistent-listener.sh regexp: 'C2_HOST="127.0.0.1"' replace: 'C2_HOST="{{ c2_ip }}"' - name: Configure shell handler script with listening port replace: - path: /opt/shell-handler/persistent-listener.sh + path: /root/Tools/shell-handler/persistent-listener.sh regexp: 'LISTEN_PORT=4444' replace: 'LISTEN_PORT={{ shell_handler_port }}' @@ -70,6 +111,11 @@ group: root when: zero_logs | bool +# Run port randomization if enabled +- name: Run port randomization if enabled + include_tasks: port_randomization.yml + when: randomize_ports | default(false) | bool + # Configure nginx for dual HTTP/HTTPS with complete encryption - name: Configure NGINX for secure C2 redirection template: @@ -110,7 +156,7 @@ # HTTP C2 paths (still over HTTPS) location /ajax/ { - proxy_pass http://{{ c2_ip }}:8888; + proxy_pass http://{{ c2_ip }}:{{ randomized_http_port | default(8888) }}; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; @@ -121,7 +167,7 @@ # MTLS/TCP passthrough for direct Sliver communication location /mtls/ { - proxy_pass https://{{ c2_ip }}:443; + proxy_pass https://{{ c2_ip }}:{{ randomized_https_port | default(443) }}; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; @@ -133,7 +179,7 @@ # Static resources that redirect to C2 location ~ ^/static/(css|js|images)/.*\.(css|js|png|jpg|jpeg|gif|ico)$ { - proxy_pass http://{{ c2_ip }}:8888; + proxy_pass http://{{ c2_ip }}:{{ randomized_http_port | default(8888) }}; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; @@ -210,7 +256,7 @@ echo "certbot --nginx -d ${SUBDOMAIN}.${DOMAIN} --non-interactive --agree-tos -m ${EMAIL}" echo echo "================================================" - dest: /opt/c2/setup-cert.sh + dest: /root/Tools/setup-cert.sh mode: '0700' owner: root group: root @@ -223,14 +269,14 @@ stream { # TCP forwarding for MTLS server { - listen 31337; - proxy_pass {{ c2_ip }}:31337; + listen {{ randomized_mtls_port | default(31337) }}; + proxy_pass {{ c2_ip }}:{{ randomized_mtls_port | default(31337) }}; } # Additional C2 ports server { - listen 50051; - proxy_pass {{ c2_ip }}:50051; + listen {{ randomized_http_port | default(50051) }}; + proxy_pass {{ c2_ip }}:{{ randomized_http_port | default(50051) }}; } } dest: /etc/nginx/modules-enabled/stream.conf @@ -252,5 +298,5 @@ name: "Clean logs" minute: "0" hour: "*/6" - job: "/opt/c2/clean-logs.sh > /dev/null 2>&1" + job: "/root/Tools/clean-logs.sh > /dev/null 2>&1" when: zero_logs | bool \ No newline at end of file diff --git a/tasks/port_randomization.yml b/tasks/port_randomization.yml new file mode 100644 index 0000000..e9e0ed4 --- /dev/null +++ b/tasks/port_randomization.yml @@ -0,0 +1,66 @@ +--- +# tasks/port_randomization.yml +# Task file to randomize ports for C2 infrastructure + +- name: Create port randomization script + copy: + src: "../files/randomize_ports.sh" + dest: "/root/Tools/randomize_ports.sh" + mode: '0700' + owner: root + group: root + +- name: Execute port randomization script + shell: | + cd /root/Tools && ./randomize_ports.sh + register: randomize_result + when: randomize_ports | default(true) | bool + +- name: Display port randomization results + debug: + msg: "{{ randomize_result.stdout_lines }}" + when: randomize_ports | default(true) | bool + +- name: Store randomized ports in variables + shell: | + PORT_CONFIG="/root/Tools/port_config.json" + if [ -f "$PORT_CONFIG" ]; then + cat "$PORT_CONFIG" + else + echo '{"error": "Port configuration not found"}' + fi + register: port_config_result + when: randomize_ports | default(true) | bool + +- name: Set port fact variables + set_fact: + randomized_http_port: "{{ (port_config_result.stdout | from_json).http_c2_port | default(8888) }}" + randomized_https_port: "{{ (port_config_result.stdout | from_json).https_c2_port | default(443) }}" + randomized_mtls_port: "{{ (port_config_result.stdout | from_json).mtls_c2_port | default(31337) }}" + randomized_shell_handler_port: "{{ (port_config_result.stdout | from_json).shell_handler_port | default(shell_handler_port) }}" + when: randomize_ports | default(true) | bool and port_config_result.rc == 0 + +- name: Update shell handler configuration with randomized port + replace: + path: "/opt/shell-handler/persistent-listener.sh" + regexp: "LISTEN_PORT=.*" + replace: "LISTEN_PORT={{ randomized_shell_handler_port | default(shell_handler_port) }}" + when: randomize_ports | default(true) | bool and port_config_result.rc == 0 + +- name: Update shell handler service with randomized port + lineinfile: + path: "/etc/systemd/system/shell-handler.service" + regexp: 'Environment="LISTEN_PORT=' + line: 'Environment="LISTEN_PORT={{ randomized_shell_handler_port | default(shell_handler_port) }}"' + insertafter: '^\\[Service\\]' + when: randomize_ports | default(true) | bool and port_config_result.rc == 0 + +- name: Reload and restart services + systemd: + daemon_reload: yes + name: "{{ item }}" + state: restarted + with_items: + - sliver + - shell-handler + when: randomize_ports | default(true) | bool and port_config_result.rc == 0 \ No newline at end of file diff --git a/tasks/security_hardening.yml b/tasks/security_hardening.yml index 7eeb2ef..ccb6843 100644 --- a/tasks/security_hardening.yml +++ b/tasks/security_hardening.yml @@ -58,7 +58,7 @@ - name: Copy operational scripts copy: src: "{{ item }}" - dest: "/opt/c2/{{ item }}" + dest: "/root/Tools/{{ item }}" mode: '0700' owner: root group: root @@ -75,9 +75,9 @@ owner: root group: root with_items: - - /opt/c2 - - /opt/beacons - - /opt/payloads + - /root/Tools + - /root/Tools/beacons + - /root/Tools/payloads - name: Create Sliver service file copy: @@ -116,7 +116,7 @@ name: "Clean logs" minute: "0" hour: "*/6" - job: "/opt/c2/clean-logs.sh > /dev/null 2>&1" + job: "/root/Tools/clean-logs.sh > /dev/null 2>&1" when: zero_logs | bool - name: Install Let's Encrypt certificate if domain specified @@ -128,9 +128,9 @@ - name: Configure and start beacon server shell: | - sed -i "s/C2_HOST=.*/C2_HOST=\"{{ ansible_host }}\"/g" /opt/c2/serve-beacons.sh - chmod +x /opt/c2/serve-beacons.sh + sed -i "s/C2_HOST=.*/C2_HOST=\"{{ ansible_host }}\"/g" /root/Tools/serve-beacons.sh + chmod +x /root/Tools/serve-beacons.sh # Check if beacon server is already running - if ! pgrep -f "/opt/c2/serve-beacons.sh" > /dev/null; then - nohup /opt/c2/serve-beacons.sh > /dev/null 2>&1 & + if ! pgrep -f "/root/Tools/serve-beacons.sh" > /dev/null; then + nohup /root/Tools/serve-beacons.sh > /dev/null 2>&1 & fi \ No newline at end of file diff --git a/templates/generate_evasive_beacons.sh.j2 b/templates/generate_evasive_beacons.sh.j2 index ea5818e..8c20d56 100644 --- a/templates/generate_evasive_beacons.sh.j2 +++ b/templates/generate_evasive_beacons.sh.j2 @@ -100,7 +100,7 @@ sliver-client generate stager --profile $stager_profile --os windows --arch amd6 echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)" # Create manifest file from template -cp /opt/c2/manifest.template "$BEACONS_DIR/manifest.json" +cp /root/Tools/manifest.template "$BEACONS_DIR/manifest.json" sed -i "s/WINDOWS_EXE/$win_output/g" "$BEACONS_DIR/manifest.json" sed -i "s/WINDOWS_DLL/$dll_output/g" "$BEACONS_DIR/manifest.json" sed -i "s/LINUX_BINARY/$linux_output/g" "$BEACONS_DIR/manifest.json" @@ -117,16 +117,16 @@ sed -i "s/C2_HOST/$C2_HOST/g" "$BEACONS_DIR/manifest.json" sed -i "s/GENERATED_DATE/$(date)/g" "$BEACONS_DIR/manifest.json" # Create Linux loader from template -cp /opt/c2/linux_loader.template "$BEACONS_DIR/linux_loader.sh" +cp /root/Tools/linux_loader.template "$BEACONS_DIR/linux_loader.sh" sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/linux_loader.sh" chmod +x "$BEACONS_DIR/linux_loader.sh" # Create Windows PowerShell loader from template -cp /opt/c2/windows_loader.template "$BEACONS_DIR/windows_loader.ps1" +cp /root/Tools/windows_loader.template "$BEACONS_DIR/windows_loader.ps1" sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/windows_loader.ps1" # Create reference file from template -cp /opt/c2/reference.template "$BEACONS_DIR/reference.txt" +cp /root/Tools/reference.template "$BEACONS_DIR/reference.txt" sed -i "s/C2_HOST/$C2_HOST/g" "$BEACONS_DIR/reference.txt" sed -i "s/REDIRECTOR_HOST/$REDIRECTOR_HOST/g" "$BEACONS_DIR/reference.txt" sed -i "s/WINDOWS_EXE/$win_output/g" "$BEACONS_DIR/reference.txt" diff --git a/templates/motd-aws.j2 b/templates/motd-aws.j2 index 871d77d..f59c9f2 100644 --- a/templates/motd-aws.j2 +++ b/templates/motd-aws.j2 @@ -39,7 +39,7 @@ Other Installed C2 Frameworks: - Metasploit Framework: system installed (run 'msfconsole') - Sliver C2: system installed (run 'sliver') -Security Scripts in /opt/c2/: +Security Scripts in /root/Tools/: ----------------------------- - clean-logs.sh: Securely clears all logs on the system - secure-exit.sh: Perform secure wipe for termination diff --git a/templates/serve-beacons.sh.j2 b/templates/serve-beacons.sh.j2 index 183b7b2..740a34b 100644 --- a/templates/serve-beacons.sh.j2 +++ b/templates/serve-beacons.sh.j2 @@ -2,7 +2,7 @@ # Script to serve Sliver beacons generated by generate_evasive_beacons.sh # Configuration -BEACONS_DIR="/opt/beacons" +BEACONS_DIR="/root/Tools/beacons" C2_HOST="{{ ansible_host }}" LISTEN_PORT=8443 diff --git a/templates/shell-handler.service.j2 b/templates/shell-handler.service.j2 index 15be079..2b9fd7d 100644 --- a/templates/shell-handler.service.j2 +++ b/templates/shell-handler.service.j2 @@ -6,7 +6,7 @@ After=network.target Type=simple User=root Group=root -ExecStart=/opt/shell-handler/persistent-listener.sh +ExecStart=/root/Tools/shell-handler/persistent-listener.sh Restart=always RestartSec=10 diff --git a/templates/simple_email_tracker.py.j2 b/templates/simple_email_tracker.py.j2 index de11cb5..1c10def 100644 --- a/templates/simple_email_tracker.py.j2 +++ b/templates/simple_email_tracker.py.j2 @@ -18,7 +18,7 @@ logging.basicConfig( level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s', handlers=[ - logging.FileHandler('/opt/tracker/data/tracker.log'), + logging.FileHandler('/root/Tools/tracker/data/tracker.log'), logging.StreamHandler() ] ) @@ -27,7 +27,7 @@ logging.basicConfig( app = Flask(__name__) # Directory to store tracking data -DATA_DIR = '/opt/tracker/data' +DATA_DIR = '/root/Tools/tracker/data' os.makedirs(DATA_DIR, exist_ok=True) # Path to 1x1 transparent pixel diff --git a/templates/sliver-guide.j2 b/templates/sliver-guide.j2 index d04b996..8a6db0d 100644 --- a/templates/sliver-guide.j2 +++ b/templates/sliver-guide.j2 @@ -42,7 +42,7 @@ Once connected to the server, you can: IMPLANT RESOURCES ---------------- Pre-generated implants are available in: -- /opt/beacons/ +- /root/Tools/beacons/ These implants are already configured to connect through the redirector at {{ redirector_domain }}. @@ -59,7 +59,7 @@ TIPS FOR OPSEC - Use HTTPS for all communications To regenerate beacons with different properties: -$ /opt/c2/generate_evasive_beacons.sh +$ /root/Tools/generate_evasive_beacons.sh TROUBLESHOOTING -------------- diff --git a/templates/tracker.service.j2 b/templates/tracker.service.j2 index b257a00..5d73fb7 100644 --- a/templates/tracker.service.j2 +++ b/templates/tracker.service.j2 @@ -5,8 +5,8 @@ After=network.target [Service] User=tracker Group=tracker -WorkingDirectory=/opt/tracker -ExecStart=/opt/tracker/venv/bin/python /opt/tracker/simple_email_tracker.py +WorkingDirectory=/root/Tools/tracker +ExecStart=/root/Tools/tracker/venv/bin/python /root/Tools/tracker/simple_email_tracker.py Restart=always RestartSec=10