moved things around

2025-04-11 21:00:11 -04:00
parent 95f8c18118
commit 4acb02a88f
27 changed files with 487 additions and 127 deletions
@@ -0,0 +1,80 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ domain }};
+    
+    # Redirect to HTTPS
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name {{ domain }};
+    
+    # SSL Configuration
+    ssl_certificate /etc/letsencrypt/live/{{ domain }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ domain }}/privkey.pem;
+    
+    # Root directory
+    root /var/www/html;
+    index index.html;
+    
+    # Primary location for legitimate website traffic
+    location / {
+        try_files $uri $uri/ =404;
+    }
+    
+    # Special URI patterns for C2 traffic
+    # These will redirect to the actual C2 server
+    
+    # Sliver HTTP C2 channel
+    location /ajax/ {
+        proxy_pass http://{{ c2_host }}:8888;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+    
+    # Static resources that actually redirect to C2
+    location ~ ^/static/(css|js|images)/.*\.(css|js|png|jpg|jpeg|gif|ico)$ {
+        proxy_pass http://{{ c2_host }}:8888;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+    
+    # Additional security headers
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "no-referrer" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;" always;
+    
+    # Disable logging for this server block
+    access_log off;
+    error_log /dev/null crit;
+}
+
+# Catch-all server block to respond to unknown hosts
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    
+    # Self-signed cert for catch-all
+    ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
+    ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
+    
+    # Redirect all unknown traffic to a legitimate-looking site
+    return 301 https://www.google.com;
+    
+    # Disable logs
+    access_log off;
+    error_log /dev/null crit;
+}
@@ -0,0 +1,23 @@
+{
+        "admin_server": {
+                "listen_url": "0.0.0.0:{{ gophish_admin_port }}",
+                "use_tls": true,
+                "cert_path": "/etc/letsencrypt/live/{{ domain }}/fullchain.pem",
+                "key_path": "/etc/letsencrypt/live/{{ domain }}/privkey.pem",
+                "trusted_origins": []
+        },
+        "phish_server": {
+                "listen_url": "0.0.0.0:80",
+                "use_tls": false,
+                "cert_path": "/etc/letsencrypt/live/{{ domain }}/fullchain.pem",
+                "key_path": "/etc/letsencrypt/live/{{ domain }}/privkey.pem"
+        },
+        "db_name": "sqlite3",
+        "db_path": "gophish.db",
+        "migrations_prefix": "db/db_",
+        "contact_address": "",
+        "logging": {
+                "filename": "",
+                "level": ""
+        }
+}
@@ -0,0 +1,122 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>{{ redirector_subdomain }} - Content Delivery Network</title>
+    <style>
+        body {
+            font-family: Arial, sans-serif;
+            margin: 0;
+            padding: 0;
+            background-color: #f4f4f4;
+            color: #333;
+        }
+        header {
+            background-color: #2c3e50;
+            color: white;
+            padding: 1em;
+            text-align: center;
+        }
+        .container {
+            width: 80%;
+            margin: 0 auto;
+            padding: 2em;
+        }
+        .card {
+            background-color: white;
+            border-radius: 5px;
+            padding: 1.5em;
+            margin-bottom: 1.5em;
+            box-shadow: 0 2px 5px rgba(0,0,0,0.1);
+        }
+        .feature {
+            display: flex;
+            align-items: center;
+            margin-bottom: 1em;
+        }
+        .feature-icon {
+            background-color: #3498db;
+            color: white;
+            border-radius: 50%;
+            width: 40px;
+            height: 40px;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            margin-right: 1em;
+            font-weight: bold;
+        }
+        footer {
+            background-color: #2c3e50;
+            color: white;
+            text-align: center;
+            padding: 1em;
+            position: fixed;
+            bottom: 0;
+            width: 100%;
+        }
+        .btn {
+            display: inline-block;
+            background-color: #3498db;
+            color: white;
+            padding: 0.7em 1.5em;
+            border-radius: 5px;
+            text-decoration: none;
+            font-weight: bold;
+        }
+    </style>
+</head>
+<body>
+    <header>
+        <h1>{{ redirector_subdomain }}.{{ domain }}</h1>
+        <p>Enterprise Content Delivery Network</p>
+    </header>
+    
+    <div class="container">
+        <div class="card">
+            <h2>Welcome to Our CDN</h2>
+            <p>This server is part of our global content delivery network, optimizing digital asset delivery for enterprise applications. Our CDN provides fast, reliable, and secure content distribution across our global network.</p>
+            <p><em>This is a private service. Unauthorized access is prohibited.</em></p>
+        </div>
+        
+        <div class="card">
+            <h2>Our Features</h2>
+            
+            <div class="feature">
+                <div class="feature-icon">1</div>
+                <div>
+                    <h3>Global Distribution</h3>
+                    <p>Content cached and distributed across multiple geographic locations for minimum latency.</p>
+                </div>
+            </div>
+            
+            <div class="feature">
+                <div class="feature-icon">2</div>
+                <div>
+                    <h3>DDoS Protection</h3>
+                    <p>Enterprise-grade protection against distributed denial of service attacks.</p>
+                </div>
+            </div>
+            
+            <div class="feature">
+                <div class="feature-icon">3</div>
+                <div>
+                    <h3>Asset Optimization</h3>
+                    <p>Automatic compression and format optimization for images, scripts, and styles.</p>
+                </div>
+            </div>
+        </div>
+        
+        <div class="card" style="text-align: center;">
+            <h2>Need Access?</h2>
+            <p>If you're a client requiring access to our CDN services, please contact your account representative.</p>
+            <a href="#" class="btn">Contact Sales</a>
+        </div>
+    </div>
+    
+    <footer>
+        <p>&copy; 2025 {{ domain }} CDN Services. All rights reserved.</p>
+    </footer>
+</body>
+</html>
@@ -0,0 +1,59 @@
+Welcome to your secure FlokiNET C2 Server!
+
+╔═══════════════════════════════════════════════╗
+║             OPERATIONAL SECURITY               ║
+║                                               ║
+║ This server has enhanced security features    ║
+║ including hardened SSH, Tor routing, and      ║
+║ zero-logs configuration.                      ║
+╚═══════════════════════════════════════════════╝
+
+The following tools and utilities have been installed:
+
+Apt-Installed Tools:
+--------------------
+- git, wget, curl, unzip
+- python3-pip, python3-venv, pipx
+- tmux, nmap, tcpdump, hydra, john, hashcat
+- sqlmap, gobuster, dirb, enum4linux, dnsenum, seclists, responder
+- golang, proxychains, tor, crackmapexec, jq, unzip
+- postfix, certbot, opendkim, opendkim-tools
+
+Pipx-Installed Tools:
+---------------------
+- NetExec:      git+https://github.com/Pennyw0rth/NetExec
+- TREVORspray:  git+https://github.com/blacklanternsecurity/TREVORspray
+- impacket:     (various network protocols and service tools)
+
+Custom Tools Installed in ~/Tools:
+----------------------------------
+- SharpCollection:           ~/Tools/SharpCollection
+- Kerbrute:                  ~/Tools/Kerbrute
+- PEASS-ng:                  ~/Tools/PEASS-ng
+- MailSniper:                ~/Tools/MailSniper
+- Inveigh:                   ~/Tools/Inveigh
+- Gophish:                   ~/Tools/gophish (unzipped here)
+
+Other Installed C2 Frameworks:
+------------------------------
+- Metasploit Framework: system installed (run 'msfconsole')
+- Sliver C2: system installed (run 'sliver')
+
+Security Scripts in /opt/c2/:
+-----------------------------
+- clean-logs.sh:   Securely clears all logs on the system
+- secure-exit.sh:  Perform secure wipe for termination
+- serve-beacons.sh: Hosts generated implants for delivery
+
+Also, remember that many reconnaissance and attack tools are now available system-wide due to the apt and pipx installations.
+
+Once your DNS record points to this server's public IP, you can obtain a Let's Encrypt certificate by running:
+
+    sudo certbot certonly --non-interactive --agree-tos --email {{ letsencrypt_email }} --standalone -d {{ c2_subdomain }}.{{ domain }}
+
+**IMPORTANT:**  
+
+To route traffic through Tor for additional anonymity, prefix commands with 'proxychains':
+    proxychains curl ifconfig.me
+
+Don't forget to set up a DMARC record for your domain. Update your DNS provider's dashboard to add a TXT record named `_dmarc` with a suitable DMARC policy (e.g., `v=DMARC1; p=reject; rua=mailto:admin@{{ domain }}; ruf=mailto:admin@{{ domain }}; pct=100`). This ensures better email deliverability and security for your domain.
@@ -0,0 +1,46 @@
+Welcome to your new C2 Server!
+
+The following tools and utilities have been installed:
+
+Apt-Installed Tools:
+--------------------
+- git, wget, curl, unzip
+- python3-pip, python3-venv, pipx
+- tmux, nmap, tcpdump, hydra, john, hashcat
+- sqlmap, gobuster, dirb, enum4linux, dnsenum, seclists, responder
+- golang, proxychains, tor, crackmapexec, jq, unzip
+- postfix, certbot, opendkim, opendkim-tools
+
+Pipx-Installed Tools:
+---------------------
+- NetExec:      git+https://github.com/Pennyw0rth/NetExec
+- TREVORspray:  git+https://github.com/blacklanternsecurity/TREVORspray
+- impacket:     (various network protocols and service tools)
+
+Custom Tools Installed in ~/Tools:
+----------------------------------
+- SharpCollection:           ~/Tools/SharpCollection
+- Kerbrute:                  ~/Tools/Kerbrute
+- PEASS-ng:                  ~/Tools/PEASS-ng
+- MailSniper:                ~/Tools/MailSniper
+- Inveigh:                   ~/Tools/Inveigh
+- Gophish:                   ~/Tools/gophish (unzipped here)
+
+Other Installed C2 Frameworks:
+------------------------------
+- Metasploit Framework: system installed (run 'msfconsole')
+- Sliver C2: system installed (run 'sliver')
+
+Also, remember that many reconnaissance and attack tools are now available system-wide due to the apt and pipx installations.
+
+Once your DNS record points to this server’s public IP, you can obtain a Let’s Encrypt certificate by running:
+
+    sudo certbot certonly --non-interactive --agree-tos --email {{ letsencrypt_email }} --standalone -d {{ mail_hostname }}
+    sudo certbot certonly --non-interactive --agree-tos --email {{ letsencrypt_email }} --standalone -d {{ domain }}
+
+Remember to ensure your DNS is set correctly before running the above command.
+
+**IMPORTANT:**  
+
+Don’t forget to set up a DMARC record for your domain. Update your DNS provider’s dashboard (e.g., GoDaddy) to add a TXT record named `_dmarc` with a suitable DMARC policy (e.g., `v=DMARC1; p=reject; rua=mailto:admin@{{ domain }}; ruf=mailto:admin@{{ domain }}; pct=100`). This ensures better email deliverability and security for your domain.
+
@@ -0,0 +1,59 @@
+user www-data;
+worker_processes auto;
+pid /run/nginx.pid;
+include /etc/nginx/modules-enabled/*.conf;
+
+events {
+    worker_connections 1024;
+    multi_accept on;
+}
+
+http {
+    # Basic Settings
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    types_hash_max_size 2048;
+    server_tokens off;
+
+    # MIME
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    # Zero-logs configuration
+    # This completely disables all access logs
+    access_log off;
+    # Minimal error logs - critical only
+    error_log /dev/null crit;
+
+    # SSL Settings
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_tickets off;
+    
+    # Headers to confuse fingerprinting
+    # Microsoft-IIS/8.5 server header to throw off analysis
+    #more_set_headers 'Server: Microsoft-IIS/8.5';
+    add_header Server "Microsoft-IIS/8.5";
+    server_name_in_redirect off;
+
+    # OPSEC: Hide proxy headers
+    proxy_hide_header X-Powered-By;
+    proxy_hide_header X-AspNet-Version;
+    proxy_hide_header X-Runtime;
+    
+    # IP Rotation and proxying
+    real_ip_header X-Forwarded-For;
+    set_real_ip_from 127.0.0.1;
+    
+    # Gzip Settings
+    gzip off;  # Disabled to avoid BREACH attack
+    
+    # Virtual Host Configs
+    include /etc/nginx/conf.d/*.conf;
+    include /etc/nginx/sites-enabled/*;
+}
@@ -0,0 +1,67 @@
+# FlokiNET/templates/proxychains.conf.j2
+# ProxyChains configuration for C2 server
+# Routes traffic through Tor for anonymity
+
+# Dynamic chain - Each connection through the proxy list
+# Uses chained proxies in the order they appear in the list
+dynamic_chain
+
+# Proxy DNS requests - no leak for DNS data
+proxy_dns
+
+# Randomize the order of the proxies on each start
+# random_chain
+
+# Set the type of chain (dynamic, strict, random)
+# strict_chain
+# random_chain
+
+# Quiet mode (less console output)
+quiet_mode
+
+# ProxyList format:
+#       type  host  port [user pass]
+#       (values separated by 'tab' or 'blank')
+[ProxyList]
+# add proxy here ...
+# socks5 	127.0.0.1	1080
+socks5 	127.0.0.1	9050
+
+# FlokiNET/templates/iptables-rules.j2
+# Hardened iptables rules for FlokiNET C2 server
+# Applied at system startup
+
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+
+# Allow established and related connections
+-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+# Allow loopback
+-A INPUT -i lo -j ACCEPT
+
+# Allow SSH
+-A INPUT -p tcp -m state --state NEW -m tcp --dport {{ ssh_port | default(22) }} -j ACCEPT
+
+# Allow HTTP/HTTPS
+-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
+-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
+
+# Allow Sliver C2 ports
+-A INPUT -p tcp -m state --state NEW -m tcp --dport 8888 -j ACCEPT
+-A INPUT -p tcp -m state --state NEW -m tcp --dport 31337 -j ACCEPT
+
+# Allow shell handler port
+{% if shell_handler_port is defined %}
+-A INPUT -p tcp -m state --state NEW -m tcp --dport {{ shell_handler_port }} -j ACCEPT
+{% endif %}
+
+# Block all other incoming traffic
+-A INPUT -j DROP
+
+# Allow all outbound traffic by default
+-A OUTPUT -j ACCEPT
+
+COMMIT
@@ -0,0 +1,18 @@
+# FlokiNET/templates/resolv.conf.j2
+# Secure DNS configuration
+# Uses privacy-respecting DNS servers
+
+nameserver 9.9.9.9
+nameserver 1.1.1.1
+options edns0 single-request-reopen
+options timeout:1
+options attempts:2
+
+# FlokiNET/templates/dnscrypt.conf.j2
+[Resolve]
+DNS=9.9.9.9 1.1.1.1
+FallbackDNS=8.8.8.8 8.8.4.4
+DNSSEC=yes
+DNSOverTLS=yes
+Cache=yes
+DNSStubListener=yes
@@ -0,0 +1,27 @@
+[Unit]
+Description=Reverse Shell Handler Service
+After=network.target
+
+[Service]
+Type=simple
+User=root
+Group=root
+ExecStart=/opt/shell-handler/persistent-listener.sh
+Restart=always
+RestartSec=10
+
+# Hide process information
+PrivateTmp=true
+ProtectSystem=full
+NoNewPrivileges=true
+
+# Make shell handler hard to find
+StandardOutput=null
+StandardError=null
+
+# Environment variables
+Environment="C2_HOST={{ c2_ip }}"
+Environment="LISTEN_PORT={{ shell_handler_port }}"
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,24 @@
+[Unit]
+Description=Sliver C2 Server
+After=network.target
+
+[Service]
+Type=simple
+User=root
+Group=root
+WorkingDirectory=/root/.sliver
+ExecStart=/usr/local/bin/sliver-server daemon
+Restart=always
+RestartSec=10
+
+# Security measures
+PrivateTmp=true
+ProtectHome=false
+NoNewPrivileges=true
+
+# Hide process information
+StandardOutput=null
+StandardError=null
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,48 @@
+# FlokiNET/templates/torrc.j2
+#
+# Tor configuration for C2 server
+# Hardened configuration for operational security
+
+# General settings
+DataDirectory /var/lib/tor
+RunAsDaemon 1
+ControlPort 9051
+CookieAuthentication 1
+CookieAuthFileGroupReadable 0
+DisableDebuggerAttachment 1
+
+# Network settings
+SOCKSPort 127.0.0.1:9050
+SOCKSPolicy accept 127.0.0.1/8
+SOCKSPolicy reject *
+Log notice file /var/log/tor/notices.log
+SafeSocks 1
+TestSocks 0
+
+# Circuit settings
+NumEntryGuards 4
+EnforceDistinctSubnets 1
+CircuitBuildTimeout 60
+PathsNeededToBuildCircuits 0.95
+NewCircuitPeriod 900
+MaxCircuitDirtiness 1800
+
+# Security settings
+StrictNodes 1
+WarnPlaintextPorts 23,109,110,143,80,21
+ReachableAddresses *:80,*:443
+ReachableAddresses reject *:*
+ReachableAddresses accept *:80
+ReachableAddresses accept *:443
+
+# Obfuscation settings
+Bridge obfs4 {{ bridge_address | default('placeholderbridge.example.org:443') }} {{ bridge_fingerprint | default('PLACEHOLDERFINGERPRINT') }} cert=PLACEHOLDER
+UseBridges 1
+ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy
+ClientTransportPlugin meek exec /usr/bin/obfs4proxy
+
+# Exit policy (no exits allowed)
+ExitPolicy reject *:*
+
+# DNS resolution
+AutomapHostsOnResolve 1