n0mad1k/CoM-c2itall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wotking on the havoc install

Browse Source
This commit is contained in:
n0mad1k
2025-04-24 04:48:42 -04:00
parent 57e2a6e90b
commit 4e895f4eb1
1 changed files with 24 additions and 322 deletions
Download Patch File Download Diff File Expand all files Collapse all files
files/havoc_installer.sh
+24 -322
View File
@@ -1,15 +1,12 @@
#!/bin/bash
# Enhanced Havoc C2 Framework installer with advanced EDR evasion features
# This script automatically randomizes the entire Havoc installation and implants
# Streamlined Havoc C2 Framework installer with EDR evasion features
# This script automatically installs Havoc and prepares it for configuration
set -e
TEMP_DIR=$(mktemp -d)
LOG_FILE="/root/Tools/havoc_installer.log"
HAVOC_DIR="/root/Tools/Havoc"
HAVOC_DATA_DIR="/root/Tools/Havoc/data"
HAVOC_CONFIG_FILE="$HAVOC_DATA_DIR/havoc.yaotl"
HAVOC_VERSION="0.5.0"
HAVOC_GITHUB="https://github.com/HavocFramework/Havoc"
HAVOC_DIR="/root/Tools/havoc"
HAVOC_DATA_DIR="/root/Tools/havoc/data"
COMPILER_URL="http://musl.cc/x86_64-w64-mingw32-cross.tgz"
COMPILER_DIR="/usr/bin/x86_64-w64-mingw32-cross"
COMPILER_PATH="$COMPILER_DIR/bin/x86_64-w64-mingw32-gcc"
@@ -26,45 +23,8 @@ random_string() {
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w $length | head -n 1
}
# Function to generate random domain-like string
random_domain() {
local tlds=("com" "net" "org" "io" "co" "biz" "info" "dev")
local prefix=$(random_string 6)
local tld=${tlds[$RANDOM % ${#tlds[@]}]}
echo "${prefix}.${tld}"
}
# Generate random binary signature values
# Generate random build ID for implant signature
RANDOMIZED_BUILD_ID=$(random_string 16)
RANDOMIZED_COMPILER_FLAGS="-Os -mllvm -sub -mllvm -fla -mllvm -bcf"
RANDOMIZED_VERSION="${HAVOC_VERSION}-${RANDOMIZED_BUILD_ID:0:8}"
RANDOMIZED_UA1="Mozilla/5.0 (Windows NT $(( $RANDOM % 4 + 8 )).$(( $RANDOM % 2 + 1 )); Win64; x64) AppleWebKit/$(( $RANDOM % 200 + 500 )).$(( $RANDOM % 50 + 1 ))"
RANDOMIZED_UA2="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_$(( $RANDOM % 5 + 10 ))_$(( $RANDOM % 5 + 1 ))) AppleWebKit/$(( $RANDOM % 200 + 500 )).$(( $RANDOM % 50 + 1 ))"
# Generate random port numbers
TEAMSERVER_PORT=$(( $RANDOM % 20000 + 40000 ))
HTTP_PORT=$(( $RANDOM % 20000 + 10000 ))
HTTPS_PORT=$(( $RANDOM % 10 + 440 ))
# Generate random URI paths (realistic looking)
URI_PATHS=()
URI_COUNT=$(( $RANDOM % 4 + 3 ))
URI_OPTIONS=("/api/v1" "/api/v2" "/dashboard" "/content" "/static" "/assets" "/app"
"/data" "/stream" "/ws" "/socket" "/feed" "/updates" "/sync" "/auth")
for i in $(seq 1 $URI_COUNT); do
RAND_INDEX=$(( $RANDOM % ${#URI_OPTIONS[@]} ))
URI_PATHS+=("${URI_OPTIONS[$RAND_INDEX]}")
unset 'URI_OPTIONS[$RAND_INDEX]'
URI_OPTIONS=("${URI_OPTIONS[@]}")
done
# Generate random C2 evasion settings
SLEEP_TIME=$(( $RANDOM % 10 + 2 ))
JITTER_PCT=$(( $RANDOM % 40 + 20 ))
SYSCALL_METHOD=$(( $RANDOM % 3 ))
SLEEP_MASK_TECHNIQUE=$(( $RANDOM % 4 ))
SLEEP_MASK_ENABLED=$(( $RANDOM % 2 ))
# Install required dependencies
log "Installing dependencies..."
@@ -121,163 +81,9 @@ mkdir -p $HAVOC_DATA_DIR
mkdir -p $HAVOC_DIR/payloads
mkdir -p $HAVOC_DIR/payloads/backup
# Modify Havoc source for signature randomization
log "Modifying Havoc source with unique signature: $RANDOMIZED_BUILD_ID"
cd $HAVOC_DIR/teamserver
# Randomize version string
sed -i "s/const Version = \".*\"/const Version = \"${RANDOMIZED_VERSION}\"/" pkg/common/metadata.go
# Build Havoc teamserver with custom compiler flags
log "Building customized Havoc teamserver..."
export EXTRA_GOFLAGS="-ldflags=-buildid=$(random_string 16)"
go build -trimpath -ldflags="-w -s -buildid=$(random_string 16)" -o havoc main.go
# Build Havoc client
log "Building Havoc client..."
cd $HAVOC_DIR/client
mkdir -p build
cd build
cmake -GNinja ..
ninja
# Generate unique TLS certificates
mkdir -p $HAVOC_DATA_DIR/certs
cd $HAVOC_DATA_DIR/certs
if [ ! -f havoc.key ] || [ ! -f havoc.crt ]; then
log "Generating unique TLS certificates..."
# Generate random values for certificate
COUNTRY_CODES=("US" "GB" "CA" "AU" "DE" "FR" "JP" "SG")
COUNTRY=${COUNTRY_CODES[$RANDOM % ${#COUNTRY_CODES[@]}]}
STATE=$(random_string 8)
LOCALITY=$(random_string 8)
ORGANIZATION=$(random_string 10)
COMMON_NAME=$(random_domain)
# Create OpenSSL config
cat > openssl.cnf << EOF
[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no
default_bits = 4096
[req_distinguished_name]
C = $COUNTRY
ST = $STATE
L = $LOCALITY
O = $ORGANIZATION
CN = $COMMON_NAME
[v3_req]
keyUsage = critical, digitalSignature, keyAgreement, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @alt_names
basicConstraints = critical, CA:false
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always
nsCertType = server
[alt_names]
DNS.1 = $COMMON_NAME
DNS.2 = $(random_domain)
DNS.3 = localhost
IP.1 = 127.0.0.1
EOF
# Generate certificate with 4096-bit key
openssl req -x509 -newkey rsa:4096 -keyout havoc.key -out havoc.crt -days 3650 -nodes -config openssl.cnf -sha384
chmod 600 havoc.key
chmod 644 havoc.crt
log "Generated unique TLS certificates with CN=$COMMON_NAME"
fi
# Generate randomized admin credentials
ADMIN_USER=$(random_string 6)
ADMIN_PASS=$(random_string 24)
# Create unique Havoc profile with randomized settings and fixed compiler path
log "Creating unique Havoc profile..."
cat > $HAVOC_CONFIG_FILE << EOF
Teamserver {
Host = "0.0.0.0"
Port = $TEAMSERVER_PORT
Build {
Compiler64 = "$COMPILER_PATH"
Compiler86 = "$COMPILER_PATH"
Nasm = "/usr/bin/nasm"
CompilerFlags = "$RANDOMIZED_COMPILER_FLAGS"
}
}
Operators {
$ADMIN_USER {
Password = "$ADMIN_PASS"
}
}
Listeners {
http {
Name = "http"
KillDate = "2030-01-01"
WorkingHours = "0:00-23:59"
Hosts = ["0.0.0.0"]
HostBind = "0.0.0.0"
HostRotation = "round-robin"
Port = $HTTP_PORT
PortBind = $HTTP_PORT
UserAgent = "$RANDOMIZED_UA1"
Headers = ["Accept: */*", "Accept-Language: en-US,en;q=0.9"]
Uris = [
$(printf '"%s",' "${URI_PATHS[@]}" | sed 's/,$//')
]
Secure = false
}
https {
Name = "https"
KillDate = "2030-01-01"
WorkingHours = "0:00-23:59"
Hosts = ["0.0.0.0"]
HostBind = "0.0.0.0"
HostRotation = "round-robin"
Port = $HTTPS_PORT
PortBind = $HTTPS_PORT
UserAgent = "$RANDOMIZED_UA2"
Headers = ["Accept: */*", "Accept-Language: en-US,en;q=0.9"]
Uris = [
$(printf '"%s",' "${URI_PATHS[@]}" | sed 's/,$//')
]
Secure = true
Cert = "$HAVOC_DATA_DIR/certs/havoc.crt"
Key = "$HAVOC_DATA_DIR/certs/havoc.key"
}
}
Demon {
Sleep = $SLEEP_TIME
SleepJitter = $JITTER_PCT
IndirectSyscalls = true
Injection {
Spawn64 = "C:\\Windows\\System32\\notepad.exe"
Spawn32 = "C:\\Windows\\SysWOW64\\notepad.exe"
}
Evasion {
StackSpoofing = true
SleazeUnhook = true
AmsiEtwPatching = true
SyscallMethod = $SYSCALL_METHOD
EnableSleepMask = true
SleepMaskTechnique = $SLEEP_MASK_TECHNIQUE
}
}
EOF
# Apply source mutations first (before building)
log "Applying implant mutations with signature: $RANDOMIZED_BUILD_ID"
# We'll skip the metadata.go modification since it's not essential
# Create implant mutator script
log "Creating implant mutator script..."
@@ -744,30 +550,19 @@ EOF
chmod +x "$IMPLANT_MUTATOR_SCRIPT"
# Save the randomization details for other scripts to use
mkdir -p $HAVOC_DIR/config
cat > $HAVOC_DIR/config/profile.json << EOF
{
"build_id": "$RANDOMIZED_BUILD_ID",
"version": "$RANDOMIZED_VERSION",
"teamserver_port": $TEAMSERVER_PORT,
"http_port": $HTTP_PORT,
"https_port": $HTTPS_PORT,
"admin_user": "$ADMIN_USER",
"admin_pass": "$ADMIN_PASS",
"sleep_time": $SLEEP_TIME,
"jitter_percent": $JITTER_PCT,
"syscall_method": $SYSCALL_METHOD,
"sleep_mask_enabled": true,
"sleep_mask_technique": $SLEEP_MASK_TECHNIQUE,
"uri_paths": [$(printf '"%s",' "${URI_PATHS[@]}" | sed 's/,$//')],
"user_agent_http": "$RANDOMIZED_UA1",
"user_agent_https": "$RANDOMIZED_UA2",
"compiler_path": "$COMPILER_PATH",
"config_path": "$HAVOC_CONFIG_FILE",
"created_at": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
}
EOF
# Build Havoc teamserver with custom compiler flags
log "Building Havoc teamserver..."
cd $HAVOC_DIR/teamserver
export EXTRA_GOFLAGS="-ldflags=-buildid=$(random_string 16)"
go build -trimpath -ldflags="-w -s -buildid=$(random_string 16)" -o havoc main.go
# Build Havoc client
log "Building Havoc client..."
cd $HAVOC_DIR/client
mkdir -p build
cd build
cmake -GNinja ..
ninja
# Create systemd service for Havoc
log "Creating systemd service for Havoc Teamserver..."
@@ -794,47 +589,17 @@ NoNewPrivileges=true
WantedBy=multi-user.target
EOF
# Create an auto-mutation service
cat > /etc/systemd/system/havoc-mutator.service << EOF
[Unit]
Description=Havoc Implant Auto-Mutation Service
After=havoc.service
[Service]
Type=oneshot
User=root
Group=root
ExecStart=$IMPLANT_MUTATOR_SCRIPT
Environment="HAVOC_ROOT=$HAVOC_DIR"
EOF
# Create an auto-mutation timer
cat > /etc/systemd/system/havoc-mutator.timer << EOF
[Unit]
Description=Run Havoc implant mutation every 12 hours
[Timer]
OnBootSec=1h
OnUnitActiveSec=12h
Persistent=true
[Install]
WantedBy=timers.target
EOF
# Set proper permissions
log "Setting proper permissions..."
chmod 755 $HAVOC_DIR/teamserver/havoc
chmod 755 $HAVOC_DIR/client/havoc
chmod 600 $HAVOC_CONFIG_FILE
chmod 600 $HAVOC_DIR/config/profile.json
# Create symlinks to executables in /usr/local/bin
ln -sf $HAVOC_DIR/teamserver/havoc /usr/local/bin/havoc-server
ln -sf $HAVOC_DIR/client/havoc /usr/local/bin/havoc-client
ln -sf $IMPLANT_MUTATOR_SCRIPT /usr/local/bin/havoc-mutate
# Run the implant mutator as part of installation
# Run the implant mutator
log "Running initial implant mutation..."
$IMPLANT_MUTATOR_SCRIPT --no-functions
@@ -844,68 +609,5 @@ systemctl daemon-reload
systemctl enable havoc
systemctl start havoc
# Enable the mutation timer
systemctl enable havoc-mutator.timer
systemctl start havoc-mutator.timer
log "Havoc C2 installation completed with unique signatures and implant randomization!"
log "===== IMPORTANT CREDENTIALS ====="
log "Admin User: $ADMIN_USER"
log "Admin Password: $ADMIN_PASS"
log "Teamserver Port: $TEAMSERVER_PORT"
log "HTTP Listener Port: $HTTP_PORT"
log "HTTPS Listener Port: $HTTPS_PORT"
log "Config File: $HAVOC_CONFIG_FILE"
log "All settings saved to: $HAVOC_DIR/config/profile.json"
log "Compiler Path: $COMPILER_PATH"
# Create a reminder for using the dev branch
cat > $HAVOC_DIR/README.md << EOF
# Havoc C2 Framework (Dev Branch)
This is an installation of the Havoc C2 Framework using the **dev branch** with enhanced randomization.
## Important Information
- **Admin User:** $ADMIN_USER
- **Admin Password:** $ADMIN_PASS
- **Teamserver Port:** $TEAMSERVER_PORT
- **Config File:** $HAVOC_CONFIG_FILE
## Starting the Server
The server can be started with:
\`\`\`
$HAVOC_DIR/teamserver/havoc server -d
\`\`\`
## Implant Mutation
To randomize implant signatures and avoid detection, use the implant mutator:
\`\`\`
havoc-mutate # Run manual mutation
havoc-mutate --auto-schedule # Setup automated mutations
havoc-mutate --config-only # Only modify configuration values
\`\`\`
The system is configured to automatically mutate implants every 12 hours via systemd timer.
## Enhanced Security Features
This installation includes:
- Shellcode randomization
- Implant signature randomization
- Memory allocation/execution randomization
- Stack spoofing and sleep masking
- Indirect syscalls
- Binary obfuscation techniques
- Automated implant mutation
## Compiler Information
Using custom MinGW compiler from: $COMPILER_PATH
EOF
log "Installation completed successfully!"
log "Havoc C2 installation completed successfully!"
log "Use the template-based configuration for additional setup."