n0mad1k/CoM-c2itall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixing things

Browse Source
This commit is contained in:
n0mad1k
2025-04-21 16:27:35 -04:00
parent 2086110117
commit 30626a14bf
22 changed files with 1027 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tasks/configure_c2.yml
+64 -19
View File
@@ -66,14 +66,14 @@
owner: root
group: root
with_items:
- /opt/c2
- /opt/beacons
- /opt/payloads
- Tools
- beacons
- payloads
- name: Copy operational scripts
copy:
src: "{{ item }}"
dest: "/opt/c2/{{ item | basename }}"
dest: "Tools/{{ item | basename }}"
mode: '0700'
owner: root
group: root
@@ -82,10 +82,51 @@
- ../files/secure-exit.sh
- ../files/sliver_randomizer.sh
- name: Copy post-install script
copy:
src: "../files/post_install_c2.sh"
dest: "Tools/post_install_c2.sh"
mode: '0700'
owner: root
group: root
- name: Copy port randomization script
copy:
src: "../files/randomize_ports.sh"
dest: "Tools/randomize_ports.sh"
mode: '0700'
owner: root
group: root
- name: Create post-install instructions
copy:
content: |
================================================================
C2ingRed Post-Installation Instructions
================================================================
To complete your setup with SSL certificates, run:
Tools/post_install_c2.sh
This script will guide you through:
- Setting up Let's Encrypt certificates
- Starting required services
- Setting up the redirector (if desired)
- Displaying DNS configuration recommendations
For enhanced OPSEC, you can also randomize ports:
Tools/randomize_ports.sh
Run these after you've configured your DNS records to point to this server.
dest: "/root/POST_INSTALL_INSTRUCTIONS.txt"
mode: '0644'
owner: root
group: root
- name: Create main beacon generation script
template:
src: "../templates/generate_evasive_beacons.sh.j2"
dest: "/opt/c2/generate_evasive_beacons.sh"
dest: "Tools/generate_evasive_beacons.sh"
mode: '0700'
owner: root
group: root
@@ -93,7 +134,7 @@
- name: Create Linux loader script template
template:
src: "../templates/linux_loader.sh.j2"
dest: "/opt/c2/linux_loader.template"
dest: "Tools/linux_loader.template"
mode: '0644'
owner: root
group: root
@@ -101,7 +142,7 @@
- name: Create Windows PowerShell loader template
template:
src: "../templates/windows_loader.ps1.j2"
dest: "/opt/c2/windows_loader.template"
dest: "Tools/windows_loader.template"
mode: '0644'
owner: root
group: root
@@ -109,7 +150,7 @@
- name: Create manifest template
template:
src: "../templates/manifest.json.j2"
dest: "/opt/c2/manifest.template"
dest: "Tools/manifest.template"
mode: '0644'
owner: root
group: root
@@ -117,7 +158,7 @@
- name: Create reference file template
template:
src: "../templates/reference.txt.j2"
dest: "/opt/c2/reference.template"
dest: "Tools/reference.template"
mode: '0644'
owner: root
group: root
@@ -125,7 +166,7 @@
- name: Create beacon server script from template
template:
src: "../templates/serve-beacons.sh.j2"
dest: "/opt/c2/serve-beacons.sh"
dest: "Tools/serve-beacons.sh"
mode: '0700'
owner: root
group: root
@@ -148,15 +189,15 @@
ignore_errors: yes
- name: Run Sliver randomization for EDR evasion
shell: /opt/c2/sliver_randomizer.sh
shell: Tools/sliver_randomizer.sh
args:
creates: /opt/c2/sliver-profiles/evasive-template.json
creates: /usr/local/bin/sliver-server
register: randomization_result
- name: Display Sliver randomizer output
debug:
var: sliver_randomizer_result.stdout_lines
when: sliver_randomizer_result.stdout_lines is defined
var: randomization_result.stdout_lines
when: randomization_result.stdout_lines is defined
- name: Create custom Sliver service file
template:
@@ -189,11 +230,15 @@
creates: /root/admin.cfg
when: not operator_config.stat.exists
- name: Run port randomization if enabled
include_tasks: port_randomization.yml
when: randomize_ports | default(false) | bool
- name: Generate beacons with redirector integration
shell: |
/opt/c2/generate_evasive_beacons.sh
Tools/generate_evasive_beacons.sh
args:
creates: /opt/beacons/reference.txt
creates: /root/beacons/reference.txt
environment:
PATH: "{{ ansible_env.PATH }}:/usr/local/bin"
ignore_errors: yes
@@ -206,7 +251,7 @@
- name: Start beacon server
shell: |
nohup /opt/c2/serve-beacons.sh > /dev/null 2>&1 &
nohup Tools/serve-beacons.sh > /dev/null 2>&1 &
args:
executable: /bin/bash
register: beacon_server_result
@@ -214,7 +259,7 @@
- name: Create NGINX configuration fragment for redirector
template:
src: "../templates/redirector-sliver-fragment.j2"
dest: "/opt/c2/redirector-config.conf"
dest: "Tools/redirector-config.conf"
mode: '0644'
owner: root
group: root
@@ -238,7 +283,7 @@
name: "Clean logs"
minute: "0"
hour: "*/6"
job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
job: "Tools/clean-logs.sh > /dev/null 2>&1"
when: zero_logs | bool
# Include integrated tracker tasks if requested
tasks/configure_integrated_tracker.yml
+9 -15
View File
@@ -22,7 +22,7 @@
- name: Create tracker directory
file:
path: /opt/tracker
path: /root/Tools/tracker
state: directory
mode: '0755'
owner: root
@@ -31,7 +31,7 @@
- name: Create tracker data directory
file:
path: /opt/tracker/data
path: /root/Tools/tracker/data
state: directory
mode: '0755'
owner: root
@@ -43,13 +43,13 @@
name: tracker
system: yes
shell: /usr/sbin/nologin
home: /opt/tracker
home: /root/Tools/tracker
create_home: no
when: setup_integrated_tracker | default(false) | bool
- name: Create Python virtual environment for tracker
pip:
virtualenv: /opt/tracker/venv
virtualenv: /root/Tools/tracker/venv
name:
- flask
- pillow
@@ -64,7 +64,7 @@
- name: Copy tracker application code
copy:
src: "../files/simple_email_tracker.py"
dest: /opt/tracker/simple_email_tracker.py
dest: /root/Tools/tracker/simple_email_tracker.py
mode: '0755'
owner: root
group: root
@@ -73,7 +73,7 @@
- name: Copy tracker statistics CLI tool
copy:
src: "../files/tracker-stats.sh"
dest: /opt/tracker/tracker-stats.sh
dest: /root/Tools/tracker/tracker-stats.sh
mode: '0755'
owner: root
group: root
@@ -96,8 +96,8 @@
group: tracker
recurse: yes
loop:
- /opt/tracker
- /opt/tracker/data
- /root/Tools/tracker
- /root/Tools/tracker/data
when: setup_integrated_tracker | default(false) | bool
- name: Create NGINX site config for tracker
@@ -142,15 +142,9 @@
daemon_reload: yes
when: setup_integrated_tracker | default(false) | bool
- name: Restart NGINX to apply tracker configuration
systemd:
name: nginx
state: restarted
when: setup_integrated_tracker | default(false) | bool
- name: Add tracker alias to bashrc for easy access
lineinfile:
path: /root/.bashrc
line: 'alias tracker="/opt/tracker/tracker-stats.sh"'
line: 'alias tracker="/root/Tools/tracker/tracker-stats.sh"'
state: present
when: setup_integrated_tracker | default(false) | bool
tasks/configure_redirector.yml
+61 -15
View File
@@ -11,6 +11,7 @@
- socat
- netcat-openbsd
- secure-delete
- jq
state: present
update_cache: yes
@@ -22,34 +23,74 @@
owner: root
group: root
with_items:
- /opt/c2
- /opt/shell-handler
- /root/Tools
- /root/Tools/shell-handler
- name: Copy clean-logs.sh script
copy:
src: "../files/clean-logs.sh"
dest: /opt/c2/clean-logs.sh
dest: /root/Tools/clean-logs.sh
mode: '0700'
owner: root
group: root
- name: Copy redirector post-install script
copy:
src: "../files/post_install_redirector.sh"
dest: "/root/Tools/post_install_redirector.sh"
mode: '0700'
owner: root
group: root
- name: Copy port randomization script
copy:
src: "../files/randomize_ports.sh"
dest: "/root/Tools/randomize_ports.sh"
mode: '0700'
owner: root
group: root
- name: Create redirector post-install instructions
copy:
content: |
================================================================
C2ingRed Redirector Post-Installation Instructions
================================================================
To complete your setup with SSL certificates, run:
/root/Tools/post_install_redirector.sh
This script will guide you through:
- Setting up Let's Encrypt certificates
- Starting required services
- Updating NGINX configuration
For enhanced OPSEC, you can also randomize ports:
/root/Tools/randomize_ports.sh
Run these after you've configured your DNS records to point to this server.
dest: "/root/POST_INSTALL_INSTRUCTIONS.txt"
mode: '0644'
owner: root
group: root
- name: Copy shell handler script
copy:
src: "../files/persistent-listener.sh"
dest: /opt/shell-handler/persistent-listener.sh
dest: /root/Tools/shell-handler/persistent-listener.sh
mode: '0700'
owner: root
group: root
- name: Configure shell handler script with C2 IP
replace:
path: /opt/shell-handler/persistent-listener.sh
path: /root/Tools/shell-handler/persistent-listener.sh
regexp: 'C2_HOST="127.0.0.1"'
replace: 'C2_HOST="{{ c2_ip }}"'
- name: Configure shell handler script with listening port
replace:
path: /opt/shell-handler/persistent-listener.sh
path: /root/Tools/shell-handler/persistent-listener.sh
regexp: 'LISTEN_PORT=4444'
replace: 'LISTEN_PORT={{ shell_handler_port }}'
@@ -70,6 +111,11 @@
group: root
when: zero_logs | bool
# Run port randomization if enabled
- name: Run port randomization if enabled
include_tasks: port_randomization.yml
when: randomize_ports | default(false) | bool
# Configure nginx for dual HTTP/HTTPS with complete encryption
- name: Configure NGINX for secure C2 redirection
template:
@@ -110,7 +156,7 @@
# HTTP C2 paths (still over HTTPS)
location /ajax/ {
proxy_pass http://{{ c2_ip }}:8888;
proxy_pass http://{{ c2_ip }}:{{ randomized_http_port | default(8888) }};
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -121,7 +167,7 @@
# MTLS/TCP passthrough for direct Sliver communication
location /mtls/ {
proxy_pass https://{{ c2_ip }}:443;
proxy_pass https://{{ c2_ip }}:{{ randomized_https_port | default(443) }};
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -133,7 +179,7 @@
# Static resources that redirect to C2
location ~ ^/static/(css|js|images)/.*\.(css|js|png|jpg|jpeg|gif|ico)$ {
proxy_pass http://{{ c2_ip }}:8888;
proxy_pass http://{{ c2_ip }}:{{ randomized_http_port | default(8888) }};
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -210,7 +256,7 @@
echo "certbot --nginx -d ${SUBDOMAIN}.${DOMAIN} --non-interactive --agree-tos -m ${EMAIL}"
echo
echo "================================================"
dest: /opt/c2/setup-cert.sh
dest: /root/Tools/setup-cert.sh
mode: '0700'
owner: root
group: root
@@ -223,14 +269,14 @@
stream {
# TCP forwarding for MTLS
server {
listen 31337;
proxy_pass {{ c2_ip }}:31337;
listen {{ randomized_mtls_port | default(31337) }};
proxy_pass {{ c2_ip }}:{{ randomized_mtls_port | default(31337) }};
}
# Additional C2 ports
server {
listen 50051;
proxy_pass {{ c2_ip }}:50051;
listen {{ randomized_http_port | default(50051) }};
proxy_pass {{ c2_ip }}:{{ randomized_http_port | default(50051) }};
}
}
dest: /etc/nginx/modules-enabled/stream.conf
@@ -252,5 +298,5 @@
name: "Clean logs"
minute: "0"
hour: "*/6"
job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
job: "/root/Tools/clean-logs.sh > /dev/null 2>&1"
when: zero_logs | bool
tasks/port_randomization.yml
+66
View File
@@ -0,0 +1,66 @@
---
# tasks/port_randomization.yml
# Task file to randomize ports for C2 infrastructure
- name: Create port randomization script
copy:
src: "../files/randomize_ports.sh"
dest: "/root/Tools/randomize_ports.sh"
mode: '0700'
owner: root
group: root
- name: Execute port randomization script
shell: |
cd /root/Tools && ./randomize_ports.sh
register: randomize_result
when: randomize_ports | default(true) | bool
- name: Display port randomization results
debug:
msg: "{{ randomize_result.stdout_lines }}"
when: randomize_ports | default(true) | bool
- name: Store randomized ports in variables
shell: |
PORT_CONFIG="/root/Tools/port_config.json"
if [ -f "$PORT_CONFIG" ]; then
cat "$PORT_CONFIG"
else
echo '{"error": "Port configuration not found"}'
fi
register: port_config_result
when: randomize_ports | default(true) | bool
- name: Set port fact variables
set_fact:
randomized_http_port: "{{ (port_config_result.stdout | from_json).http_c2_port | default(8888) }}"
randomized_https_port: "{{ (port_config_result.stdout | from_json).https_c2_port | default(443) }}"
randomized_mtls_port: "{{ (port_config_result.stdout | from_json).mtls_c2_port | default(31337) }}"
randomized_shell_handler_port: "{{ (port_config_result.stdout | from_json).shell_handler_port | default(shell_handler_port) }}"
when: randomize_ports | default(true) | bool and port_config_result.rc == 0
- name: Update shell handler configuration with randomized port
replace:
path: "/opt/shell-handler/persistent-listener.sh"
regexp: "LISTEN_PORT=.*"
replace: "LISTEN_PORT={{ randomized_shell_handler_port | default(shell_handler_port) }}"
when: randomize_ports | default(true) | bool and port_config_result.rc == 0
- name: Update shell handler service with randomized port
lineinfile:
path: "/etc/systemd/system/shell-handler.service"
regexp: 'Environment="LISTEN_PORT='
line: 'Environment="LISTEN_PORT={{ randomized_shell_handler_port | default(shell_handler_port) }}"'
insertafter: '^\\[Service\\]'
when: randomize_ports | default(true) | bool and port_config_result.rc == 0
- name: Reload and restart services
systemd:
daemon_reload: yes
name: "{{ item }}"
state: restarted
with_items:
- sliver
- shell-handler
when: randomize_ports | default(true) | bool and port_config_result.rc == 0
tasks/security_hardening.yml
+9 -9
View File
@@ -58,7 +58,7 @@
- name: Copy operational scripts
copy:
src: "{{ item }}"
dest: "/opt/c2/{{ item }}"
dest: "/root/Tools/{{ item }}"
mode: '0700'
owner: root
group: root
@@ -75,9 +75,9 @@
owner: root
group: root
with_items:
- /opt/c2
- /opt/beacons
- /opt/payloads
- /root/Tools
- /root/Tools/beacons
- /root/Tools/payloads
- name: Create Sliver service file
copy:
@@ -116,7 +116,7 @@
name: "Clean logs"
minute: "0"
hour: "*/6"
job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
job: "/root/Tools/clean-logs.sh > /dev/null 2>&1"
when: zero_logs | bool
- name: Install Let's Encrypt certificate if domain specified
@@ -128,9 +128,9 @@
- name: Configure and start beacon server
shell: |
sed -i "s/C2_HOST=.*/C2_HOST=\"{{ ansible_host }}\"/g" /opt/c2/serve-beacons.sh
chmod +x /opt/c2/serve-beacons.sh
sed -i "s/C2_HOST=.*/C2_HOST=\"{{ ansible_host }}\"/g" /root/Tools/serve-beacons.sh
chmod +x /root/Tools/serve-beacons.sh
# Check if beacon server is already running
if ! pgrep -f "/opt/c2/serve-beacons.sh" > /dev/null; then
nohup /opt/c2/serve-beacons.sh > /dev/null 2>&1 &
if ! pgrep -f "/root/Tools/serve-beacons.sh" > /dev/null; then
nohup /root/Tools/serve-beacons.sh > /dev/null 2>&1 &
fi