fixing port conflicts

templates/generate_evasive_beacons.sh.j2

@@ -7,7 +7,7 @@ HAVOC_DIR="/root/Tools/Havoc"
 BEACONS_DIR="/root/Tools/beacons"
 C2_HOST="{{ ansible_host }}"
 REDIRECTOR_HOST="{{ redirector_subdomain }}.{{ domain }}"
-REDIRECTOR_PORT="{{ redirector_port | default('443') }}"
+REDIRECTOR_PORT="{{ redirector_port | default('9443') }}"
 PROFILE_FILE="$HAVOC_DIR/config/profile.json"
 
 # Ensure required directories exist

templates/generate_havoc_payloads.sh.j2

@@ -5,7 +5,7 @@
 PAYLOADS_DIR="/root/Tools/Havoc/payloads"
 C2_HOST="{{ ansible_host }}"
 REDIRECTOR_HOST="{{ redirector_subdomain }}.{{ domain }}"
-REDIRECTOR_PORT="{{ redirector_port | default('443') }}"
+REDIRECTOR_PORT="{{ redirector_port | default('9443') }}"
 TEAMSERVER_HOST="127.0.0.1"
 TEAMSERVER_PORT="40056"
 HAVOC_DIR="/root/Tools/Havoc"

templates/gophish-config.j2

@@ -7,7 +7,7 @@
                 "trusted_origins": []
         },
         "phish_server": {
-                "listen_url": "0.0.0.0:80",
+                "listen_url": "0.0.0.0:8081",
                 "use_tls": false,
                 "cert_path": "/etc/letsencrypt/live/{{ domain }}/fullchain.pem",
                 "key_path": "/etc/letsencrypt/live/{{ domain }}/privkey.pem"

templates/havoc-config.yaotl.j2

@@ -30,8 +30,8 @@ Listeners {
         ]
         HostBind = "0.0.0.0"
         HostRotation = "round-robin"
-        PortBind = {{ havoc_https_port | default(443) }}
-        PortConn = {{ havoc_https_port | default(443) }}
+        PortBind = {{ havoc_https_port | default(9443) }}
+        PortConn = {{ havoc_https_port | default(9443) }}
         UserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36"
         Headers = [
             "Accept: */*",

templates/redirector-havoc-fragment.j2

@@ -43,7 +43,7 @@ server {
     
     # Havoc C2 HTTPS listener paths
     location ~ ^/(dashboard|content)/ {
-        proxy_pass https://{{ c2_ip }}:443;
+        proxy_pass https://{{ c2_ip }}:9443;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

templates/redirector-site.conf.j2

@@ -165,7 +165,7 @@ server {
     # Valid C2 beacon routing - CRITICAL PATHS
     location ~ ^/api/beacon/ {
         # Only valid beacons proceed to C2
-        proxy_pass https://{{ c2_ip }}:{{ havoc_https_port | default(443) }};
+        proxy_pass https://{{ c2_ip }}:{{ havoc_https_port | default(9443) }};
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -287,8 +287,16 @@ server {
     listen 443 ssl default_server;
     listen [::]:443 ssl default_server;
     
+    # Use snakeoil or fallback to our generated certificates
+    {% raw %}
+    {% if snakeoil_cert.stat.exists %}
     ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
     ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
+    {% else %}
+    ssl_certificate /etc/nginx/conf.d/selfsigned.crt;
+    ssl_certificate_key /etc/nginx/conf.d/selfsigned.key;
+    {% endif %}
+    {% endraw %}
     
     # Redirect unknown hosts to legitimate sites
     return 301 https://www.google.com;

templates/serve-havoc-payloads.sh.j2

@@ -4,7 +4,8 @@
 # Configuration
 PAYLOADS_DIR="/root/Tools/Havoc/payloads"
 C2_HOST="{{ ansible_host }}"
-LISTEN_PORT=8443
+# Use templated variable with fallback - allow override from config
+LISTEN_PORT="{{ havoc_payload_port | default(8443) }}"
 
 # Check if manifest file exists (created by generate_havoc_payloads.sh)
 if [ -f "$PAYLOADS_DIR/manifest.json" ]; then

templates/stream.conf.j2

@@ -2,19 +2,21 @@
 stream {
     # TCP forwarding for Havoc Teamserver
     server {
-  listen {{ havoc_teamserver_port | default(40056) }};
-  proxy_pass {{ c2_ip }}:{{ havoc_teamserver_port | default(40056) }};
+        listen {{ havoc_teamserver_port | default(40056) }};
+        proxy_pass {{ c2_ip }}:{{ havoc_teamserver_port | default(40056) }};
     }
     
     # Additional Havoc ports
     server {
-  listen {{ havoc_http_port | default(8080) }};
-  proxy_pass {{ c2_ip }}:{{ havoc_http_port | default(8080) }};
+        listen {{ havoc_http_port | default(8080) }};
+        proxy_pass {{ c2_ip }}:{{ havoc_http_port | default(8080) }};
     }
     
-    # HTTPS for Havoc
+    # HTTPS for Havoc - Using a different port to avoid conflicts with web server
     server {
-  listen {{ havoc_https_port | default(8443) }};
-  proxy_pass {{ c2_ip }}:{{ havoc_https_port | default(443) }};
+        # Changed from default 443 to 9443 to avoid conflict with Nginx HTTPS
+        listen {{ havoc_https_port | default(9443) }};
+        # Still proxy to the C2's HTTPS port
+        proxy_pass {{ c2_ip }}:{{ havoc_https_port | default(443) }};
     }
 }