From 4e895f4eb10e4d57f28ac225a58ed0b5b48b5fea Mon Sep 17 00:00:00 2001 From: n0mad1k Date: Thu, 24 Apr 2025 04:48:42 -0400 Subject: [PATCH] wotking on the havoc install --- files/havoc_installer.sh | 346 +++------------------------------------ 1 file changed, 24 insertions(+), 322 deletions(-) diff --git a/files/havoc_installer.sh b/files/havoc_installer.sh index 909a660..117e877 100644 --- a/files/havoc_installer.sh +++ b/files/havoc_installer.sh @@ -1,15 +1,12 @@ #!/bin/bash -# Enhanced Havoc C2 Framework installer with advanced EDR evasion features -# This script automatically randomizes the entire Havoc installation and implants +# Streamlined Havoc C2 Framework installer with EDR evasion features +# This script automatically installs Havoc and prepares it for configuration set -e TEMP_DIR=$(mktemp -d) LOG_FILE="/root/Tools/havoc_installer.log" -HAVOC_DIR="/root/Tools/Havoc" -HAVOC_DATA_DIR="/root/Tools/Havoc/data" -HAVOC_CONFIG_FILE="$HAVOC_DATA_DIR/havoc.yaotl" -HAVOC_VERSION="0.5.0" -HAVOC_GITHUB="https://github.com/HavocFramework/Havoc" +HAVOC_DIR="/root/Tools/havoc" +HAVOC_DATA_DIR="/root/Tools/havoc/data" COMPILER_URL="http://musl.cc/x86_64-w64-mingw32-cross.tgz" COMPILER_DIR="/usr/bin/x86_64-w64-mingw32-cross" COMPILER_PATH="$COMPILER_DIR/bin/x86_64-w64-mingw32-gcc" @@ -26,45 +23,8 @@ random_string() { cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w $length | head -n 1 } -# Function to generate random domain-like string -random_domain() { - local tlds=("com" "net" "org" "io" "co" "biz" "info" "dev") - local prefix=$(random_string 6) - local tld=${tlds[$RANDOM % ${#tlds[@]}]} - echo "${prefix}.${tld}" -} - -# Generate random binary signature values +# Generate random build ID for implant signature RANDOMIZED_BUILD_ID=$(random_string 16) -RANDOMIZED_COMPILER_FLAGS="-Os -mllvm -sub -mllvm -fla -mllvm -bcf" -RANDOMIZED_VERSION="${HAVOC_VERSION}-${RANDOMIZED_BUILD_ID:0:8}" -RANDOMIZED_UA1="Mozilla/5.0 (Windows NT $(( $RANDOM % 4 + 8 )).$(( $RANDOM % 2 + 1 )); Win64; x64) AppleWebKit/$(( $RANDOM % 200 + 500 )).$(( $RANDOM % 50 + 1 ))" -RANDOMIZED_UA2="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_$(( $RANDOM % 5 + 10 ))_$(( $RANDOM % 5 + 1 ))) AppleWebKit/$(( $RANDOM % 200 + 500 )).$(( $RANDOM % 50 + 1 ))" - -# Generate random port numbers -TEAMSERVER_PORT=$(( $RANDOM % 20000 + 40000 )) -HTTP_PORT=$(( $RANDOM % 20000 + 10000 )) -HTTPS_PORT=$(( $RANDOM % 10 + 440 )) - -# Generate random URI paths (realistic looking) -URI_PATHS=() -URI_COUNT=$(( $RANDOM % 4 + 3 )) -URI_OPTIONS=("/api/v1" "/api/v2" "/dashboard" "/content" "/static" "/assets" "/app" - "/data" "/stream" "/ws" "/socket" "/feed" "/updates" "/sync" "/auth") - -for i in $(seq 1 $URI_COUNT); do - RAND_INDEX=$(( $RANDOM % ${#URI_OPTIONS[@]} )) - URI_PATHS+=("${URI_OPTIONS[$RAND_INDEX]}") - unset 'URI_OPTIONS[$RAND_INDEX]' - URI_OPTIONS=("${URI_OPTIONS[@]}") -done - -# Generate random C2 evasion settings -SLEEP_TIME=$(( $RANDOM % 10 + 2 )) -JITTER_PCT=$(( $RANDOM % 40 + 20 )) -SYSCALL_METHOD=$(( $RANDOM % 3 )) -SLEEP_MASK_TECHNIQUE=$(( $RANDOM % 4 )) -SLEEP_MASK_ENABLED=$(( $RANDOM % 2 )) # Install required dependencies log "Installing dependencies..." @@ -121,163 +81,9 @@ mkdir -p $HAVOC_DATA_DIR mkdir -p $HAVOC_DIR/payloads mkdir -p $HAVOC_DIR/payloads/backup -# Modify Havoc source for signature randomization -log "Modifying Havoc source with unique signature: $RANDOMIZED_BUILD_ID" -cd $HAVOC_DIR/teamserver - -# Randomize version string -sed -i "s/const Version = \".*\"/const Version = \"${RANDOMIZED_VERSION}\"/" pkg/common/metadata.go - -# Build Havoc teamserver with custom compiler flags -log "Building customized Havoc teamserver..." -export EXTRA_GOFLAGS="-ldflags=-buildid=$(random_string 16)" -go build -trimpath -ldflags="-w -s -buildid=$(random_string 16)" -o havoc main.go - -# Build Havoc client -log "Building Havoc client..." -cd $HAVOC_DIR/client -mkdir -p build -cd build -cmake -GNinja .. -ninja - -# Generate unique TLS certificates -mkdir -p $HAVOC_DATA_DIR/certs -cd $HAVOC_DATA_DIR/certs - -if [ ! -f havoc.key ] || [ ! -f havoc.crt ]; then - log "Generating unique TLS certificates..." - - # Generate random values for certificate - COUNTRY_CODES=("US" "GB" "CA" "AU" "DE" "FR" "JP" "SG") - COUNTRY=${COUNTRY_CODES[$RANDOM % ${#COUNTRY_CODES[@]}]} - STATE=$(random_string 8) - LOCALITY=$(random_string 8) - ORGANIZATION=$(random_string 10) - COMMON_NAME=$(random_domain) - - # Create OpenSSL config - cat > openssl.cnf << EOF -[req] -distinguished_name = req_distinguished_name -x509_extensions = v3_req -prompt = no -default_bits = 4096 - -[req_distinguished_name] -C = $COUNTRY -ST = $STATE -L = $LOCALITY -O = $ORGANIZATION -CN = $COMMON_NAME - -[v3_req] -keyUsage = critical, digitalSignature, keyAgreement, keyEncipherment -extendedKeyUsage = serverAuth, clientAuth -subjectAltName = @alt_names -basicConstraints = critical, CA:false -subjectKeyIdentifier = hash -authorityKeyIdentifier = keyid:always -nsCertType = server - -[alt_names] -DNS.1 = $COMMON_NAME -DNS.2 = $(random_domain) -DNS.3 = localhost -IP.1 = 127.0.0.1 -EOF - - # Generate certificate with 4096-bit key - openssl req -x509 -newkey rsa:4096 -keyout havoc.key -out havoc.crt -days 3650 -nodes -config openssl.cnf -sha384 - chmod 600 havoc.key - chmod 644 havoc.crt - - log "Generated unique TLS certificates with CN=$COMMON_NAME" -fi - -# Generate randomized admin credentials -ADMIN_USER=$(random_string 6) -ADMIN_PASS=$(random_string 24) - -# Create unique Havoc profile with randomized settings and fixed compiler path -log "Creating unique Havoc profile..." -cat > $HAVOC_CONFIG_FILE << EOF -Teamserver { - Host = "0.0.0.0" - Port = $TEAMSERVER_PORT - - Build { - Compiler64 = "$COMPILER_PATH" - Compiler86 = "$COMPILER_PATH" - Nasm = "/usr/bin/nasm" - CompilerFlags = "$RANDOMIZED_COMPILER_FLAGS" - } -} - -Operators { - $ADMIN_USER { - Password = "$ADMIN_PASS" - } -} - -Listeners { - http { - Name = "http" - KillDate = "2030-01-01" - WorkingHours = "0:00-23:59" - Hosts = ["0.0.0.0"] - HostBind = "0.0.0.0" - HostRotation = "round-robin" - Port = $HTTP_PORT - PortBind = $HTTP_PORT - UserAgent = "$RANDOMIZED_UA1" - Headers = ["Accept: */*", "Accept-Language: en-US,en;q=0.9"] - Uris = [ - $(printf '"%s",' "${URI_PATHS[@]}" | sed 's/,$//') - ] - Secure = false - } - - https { - Name = "https" - KillDate = "2030-01-01" - WorkingHours = "0:00-23:59" - Hosts = ["0.0.0.0"] - HostBind = "0.0.0.0" - HostRotation = "round-robin" - Port = $HTTPS_PORT - PortBind = $HTTPS_PORT - UserAgent = "$RANDOMIZED_UA2" - Headers = ["Accept: */*", "Accept-Language: en-US,en;q=0.9"] - Uris = [ - $(printf '"%s",' "${URI_PATHS[@]}" | sed 's/,$//') - ] - Secure = true - Cert = "$HAVOC_DATA_DIR/certs/havoc.crt" - Key = "$HAVOC_DATA_DIR/certs/havoc.key" - } -} - -Demon { - Sleep = $SLEEP_TIME - SleepJitter = $JITTER_PCT - IndirectSyscalls = true - - Injection { - Spawn64 = "C:\\Windows\\System32\\notepad.exe" - Spawn32 = "C:\\Windows\\SysWOW64\\notepad.exe" - } - - Evasion { - StackSpoofing = true - SleazeUnhook = true - AmsiEtwPatching = true - SyscallMethod = $SYSCALL_METHOD - EnableSleepMask = true - SleepMaskTechnique = $SLEEP_MASK_TECHNIQUE - } -} -EOF +# Apply source mutations first (before building) +log "Applying implant mutations with signature: $RANDOMIZED_BUILD_ID" +# We'll skip the metadata.go modification since it's not essential # Create implant mutator script log "Creating implant mutator script..." @@ -744,30 +550,19 @@ EOF chmod +x "$IMPLANT_MUTATOR_SCRIPT" -# Save the randomization details for other scripts to use -mkdir -p $HAVOC_DIR/config -cat > $HAVOC_DIR/config/profile.json << EOF -{ - "build_id": "$RANDOMIZED_BUILD_ID", - "version": "$RANDOMIZED_VERSION", - "teamserver_port": $TEAMSERVER_PORT, - "http_port": $HTTP_PORT, - "https_port": $HTTPS_PORT, - "admin_user": "$ADMIN_USER", - "admin_pass": "$ADMIN_PASS", - "sleep_time": $SLEEP_TIME, - "jitter_percent": $JITTER_PCT, - "syscall_method": $SYSCALL_METHOD, - "sleep_mask_enabled": true, - "sleep_mask_technique": $SLEEP_MASK_TECHNIQUE, - "uri_paths": [$(printf '"%s",' "${URI_PATHS[@]}" | sed 's/,$//')], - "user_agent_http": "$RANDOMIZED_UA1", - "user_agent_https": "$RANDOMIZED_UA2", - "compiler_path": "$COMPILER_PATH", - "config_path": "$HAVOC_CONFIG_FILE", - "created_at": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" -} -EOF +# Build Havoc teamserver with custom compiler flags +log "Building Havoc teamserver..." +cd $HAVOC_DIR/teamserver +export EXTRA_GOFLAGS="-ldflags=-buildid=$(random_string 16)" +go build -trimpath -ldflags="-w -s -buildid=$(random_string 16)" -o havoc main.go + +# Build Havoc client +log "Building Havoc client..." +cd $HAVOC_DIR/client +mkdir -p build +cd build +cmake -GNinja .. +ninja # Create systemd service for Havoc log "Creating systemd service for Havoc Teamserver..." @@ -794,47 +589,17 @@ NoNewPrivileges=true WantedBy=multi-user.target EOF -# Create an auto-mutation service -cat > /etc/systemd/system/havoc-mutator.service << EOF -[Unit] -Description=Havoc Implant Auto-Mutation Service -After=havoc.service - -[Service] -Type=oneshot -User=root -Group=root -ExecStart=$IMPLANT_MUTATOR_SCRIPT -Environment="HAVOC_ROOT=$HAVOC_DIR" -EOF - -# Create an auto-mutation timer -cat > /etc/systemd/system/havoc-mutator.timer << EOF -[Unit] -Description=Run Havoc implant mutation every 12 hours - -[Timer] -OnBootSec=1h -OnUnitActiveSec=12h -Persistent=true - -[Install] -WantedBy=timers.target -EOF - # Set proper permissions log "Setting proper permissions..." chmod 755 $HAVOC_DIR/teamserver/havoc chmod 755 $HAVOC_DIR/client/havoc -chmod 600 $HAVOC_CONFIG_FILE -chmod 600 $HAVOC_DIR/config/profile.json # Create symlinks to executables in /usr/local/bin ln -sf $HAVOC_DIR/teamserver/havoc /usr/local/bin/havoc-server ln -sf $HAVOC_DIR/client/havoc /usr/local/bin/havoc-client ln -sf $IMPLANT_MUTATOR_SCRIPT /usr/local/bin/havoc-mutate -# Run the implant mutator as part of installation +# Run the implant mutator log "Running initial implant mutation..." $IMPLANT_MUTATOR_SCRIPT --no-functions @@ -844,68 +609,5 @@ systemctl daemon-reload systemctl enable havoc systemctl start havoc -# Enable the mutation timer -systemctl enable havoc-mutator.timer -systemctl start havoc-mutator.timer - -log "Havoc C2 installation completed with unique signatures and implant randomization!" -log "===== IMPORTANT CREDENTIALS =====" -log "Admin User: $ADMIN_USER" -log "Admin Password: $ADMIN_PASS" -log "Teamserver Port: $TEAMSERVER_PORT" -log "HTTP Listener Port: $HTTP_PORT" -log "HTTPS Listener Port: $HTTPS_PORT" -log "Config File: $HAVOC_CONFIG_FILE" -log "All settings saved to: $HAVOC_DIR/config/profile.json" -log "Compiler Path: $COMPILER_PATH" - -# Create a reminder for using the dev branch -cat > $HAVOC_DIR/README.md << EOF -# Havoc C2 Framework (Dev Branch) - -This is an installation of the Havoc C2 Framework using the **dev branch** with enhanced randomization. - -## Important Information - -- **Admin User:** $ADMIN_USER -- **Admin Password:** $ADMIN_PASS -- **Teamserver Port:** $TEAMSERVER_PORT -- **Config File:** $HAVOC_CONFIG_FILE - -## Starting the Server - -The server can be started with: - -\`\`\` -$HAVOC_DIR/teamserver/havoc server -d -\`\`\` - -## Implant Mutation - -To randomize implant signatures and avoid detection, use the implant mutator: - -\`\`\` -havoc-mutate # Run manual mutation -havoc-mutate --auto-schedule # Setup automated mutations -havoc-mutate --config-only # Only modify configuration values -\`\`\` - -The system is configured to automatically mutate implants every 12 hours via systemd timer. - -## Enhanced Security Features - -This installation includes: -- Shellcode randomization -- Implant signature randomization -- Memory allocation/execution randomization -- Stack spoofing and sleep masking -- Indirect syscalls -- Binary obfuscation techniques -- Automated implant mutation - -## Compiler Information - -Using custom MinGW compiler from: $COMPILER_PATH -EOF - -log "Installation completed successfully!" \ No newline at end of file +log "Havoc C2 installation completed successfully!" +log "Use the template-based configuration for additional setup." \ No newline at end of file