fixing port conflicts

AWS/c2.yml

@@ -207,8 +207,11 @@
               - 80
               - 443
               - "{{ havoc_http_port | default(8080) }}"
-              - "{{ havoc_https_port | default(443) }}"
-              - "{{ gophish_admin_port }}"
+              - "{{ havoc_https_port | default(9443) }}"  # Updated from 443
+              - "{{ havoc_payload_port | default(8443) }}"
+              - "{{ gophish_admin_port | default(2222) }}"
+              - "{{ gophish_phish_port | default(8081) }}"
+              - "{{ tracker_port | default(5000) }}"
             cidr_ip: "{{ redirector_ip }}/32"
         rules_egress:
           - proto: -1
@@ -355,7 +358,7 @@
         letsencrypt_email: "{{ letsencrypt_email }}"
         havoc_teamserver_port: "{{ havoc_teamserver_port | default(40056) }}"
         havoc_http_port: "{{ havoc_http_port | default(8080) }}"
-        havoc_https_port: "{{ havoc_https_port | default(443) }}"
+        havoc_https_port: "{{ havoc_https_port | default(9443) }}"
         zero_logs: "{{ zero_logs | default(true) }}"
         secure_memory: "{{ secure_memory | default(true) }}"
         disable_history: "{{ disable_history | default(true) }}"

AWS/redirector.yml

@@ -14,8 +14,7 @@
     instance_type: "{{ aws_instance_type | default('t2.micro') }}"
     deployment_id: "{{ deployment_id | default('') }}"
     redirector_name: "{{ redirector_name | default('r-' + deployment_id) }}"
-    # Calculate effective port: use shell_handler_port from vars or default to 8083
-    effective_listen_port: "{{ shell_handler_port | default(8083) }}"
+    effective_listen_port: "{{ shell_handler_port | default(4488) }}"
     # Check for shared infrastructure
     # Only use shared when C2 and redirector are in the same region
     use_shared_infra: "{{ not (c2_region is defined and redirector_region is defined and c2_region != redirector_region) and not c2_only | default(false) | bool and not redirector_only | default(false) | bool }}"

files/havoc_shell_handler.sh

@@ -2,7 +2,7 @@
 # Automated shell handler for catching and upgrading shells to Havoc C2 agents
 
 # Configuration 
-LISTEN_PORT=4444
+LISTEN_PORT=4488
 C2_HOST="127.0.0.1"  # This will be replaced by Ansible with actual C2 IP
 HAVOC_PORT=40056     # Havoc default Teamserver port
 HAVOC_USER="admin"

files/persistent-listener.sh

@@ -2,7 +2,7 @@
 # Automated shell handler for catching and upgrading reverse shells
 
 # Configuration 
-LISTEN_PORT=4444
+LISTEN_PORT=8844
 C2_HOST="127.0.0.1"  # This will be replaced by Ansible with actual C2 IP
 C2_PORT=50051        # Sliver default gRPC port
 WINDOWS_BEACON="/root/Tools/beacons/windows.exe"

tasks/configure_redirector.yml

@@ -138,6 +138,30 @@
   include_tasks: port_randomization.yml
   when: randomize_ports | default(true) | bool
 
+# Add just before configuring NGINX
+- name: Check if snakeoil certificates exist
+  stat:
+    path: /etc/ssl/certs/ssl-cert-snakeoil.pem
+  register: snakeoil_cert
+
+- name: Generate self-signed certificates if snakeoil not available
+  block:
+    - name: Create directory for self-signed certificates
+      file:
+        path: /etc/nginx/conf.d
+        state: directory
+        mode: '0755'
+
+    - name: Generate self-signed certificate
+      shell: |
+        openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
+        -keyout /etc/nginx/conf.d/selfsigned.key \
+        -out /etc/nginx/conf.d/selfsigned.crt \
+        -subj "/C=US/ST=State/L=City/O=Organization/CN=localhost"
+      args:
+        creates: /etc/nginx/conf.d/selfsigned.crt
+  when: not snakeoil_cert.stat.exists
+
 # Configure nginx for dual HTTP/HTTPS with complete encryption
 - name: Configure NGINX for secure C2 redirection
   template:

tasks/security_hardening.yml

@@ -89,8 +89,11 @@
             - "80"
             - "443"
             - "{{ havoc_http_port | default('8080') }}"
-            - "{{ havoc_https_port | default('443') }}" 
+            - "{{ havoc_https_port | default('9443') }}"  # Updated from 443
+            - "{{ havoc_payload_port | default('8443') }}"
             - "{{ gophish_admin_port }}"
+            - "{{ gophish_phish_port | default('8081') }}"
+            - "{{ tracker_port | default('5000') }}"
       when: "'c2servers' in group_names"
 
     - name: Configure UFW for redirector
@@ -116,7 +119,7 @@
           loop:
             - "80"
             - "443"
-            - "{{ shell_handler_port | default('4444') }}"
+            - "{{ shell_handler_port | default('4488') }}"
       when: "'redirectors' in group_names"
   # Only run UFW block if not AWS and UFW is available/installed
   when: not is_aws_provider and (ufw_check.rc == 0 or ufw_install is success)

tasks/traffic_flow_config.yml

@@ -50,7 +50,7 @@
         - { ip: "{{ redirector_ip }}", port: "80" }
         - { ip: "{{ redirector_ip }}", port: "443" }
         - { ip: "{{ redirector_ip }}", port: "{{ havoc_http_port | default('8080') }}" }
-        - { ip: "{{ redirector_ip }}", port: "{{ havoc_https_port | default('443') }}" }
+        - { ip: "{{ redirector_ip }}", port: "{{ havoc_https_port | default('9443') }}" }
         - { ip: "{{ logserver_ip | default(omit) }}", port: "5144" }
         - { ip: "{{ payloadserver_ip | default(omit) }}", port: "8888" }
       when: item.ip != omit

templates/generate_evasive_beacons.sh.j2

@@ -7,7 +7,7 @@ HAVOC_DIR="/root/Tools/Havoc"
 BEACONS_DIR="/root/Tools/beacons"
 C2_HOST="{{ ansible_host }}"
 REDIRECTOR_HOST="{{ redirector_subdomain }}.{{ domain }}"
-REDIRECTOR_PORT="{{ redirector_port | default('443') }}"
+REDIRECTOR_PORT="{{ redirector_port | default('9443') }}"
 PROFILE_FILE="$HAVOC_DIR/config/profile.json"
 
 # Ensure required directories exist

templates/generate_havoc_payloads.sh.j2

@@ -5,7 +5,7 @@
 PAYLOADS_DIR="/root/Tools/Havoc/payloads"
 C2_HOST="{{ ansible_host }}"
 REDIRECTOR_HOST="{{ redirector_subdomain }}.{{ domain }}"
-REDIRECTOR_PORT="{{ redirector_port | default('443') }}"
+REDIRECTOR_PORT="{{ redirector_port | default('9443') }}"
 TEAMSERVER_HOST="127.0.0.1"
 TEAMSERVER_PORT="40056"
 HAVOC_DIR="/root/Tools/Havoc"

templates/gophish-config.j2

@@ -7,7 +7,7 @@
                 "trusted_origins": []
         },
         "phish_server": {
-                "listen_url": "0.0.0.0:80",
+                "listen_url": "0.0.0.0:8081",
                 "use_tls": false,
                 "cert_path": "/etc/letsencrypt/live/{{ domain }}/fullchain.pem",
                 "key_path": "/etc/letsencrypt/live/{{ domain }}/privkey.pem"

templates/havoc-config.yaotl.j2

@@ -30,8 +30,8 @@ Listeners {
         ]
         HostBind = "0.0.0.0"
         HostRotation = "round-robin"
-        PortBind = {{ havoc_https_port | default(443) }}
-        PortConn = {{ havoc_https_port | default(443) }}
+        PortBind = {{ havoc_https_port | default(9443) }}
+        PortConn = {{ havoc_https_port | default(9443) }}
         UserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36"
         Headers = [
             "Accept: */*",

templates/redirector-havoc-fragment.j2

@@ -43,7 +43,7 @@ server {
     
     # Havoc C2 HTTPS listener paths
     location ~ ^/(dashboard|content)/ {
-        proxy_pass https://{{ c2_ip }}:443;
+        proxy_pass https://{{ c2_ip }}:9443;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

templates/redirector-site.conf.j2

@@ -165,7 +165,7 @@ server {
     # Valid C2 beacon routing - CRITICAL PATHS
     location ~ ^/api/beacon/ {
         # Only valid beacons proceed to C2
-        proxy_pass https://{{ c2_ip }}:{{ havoc_https_port | default(443) }};
+        proxy_pass https://{{ c2_ip }}:{{ havoc_https_port | default(9443) }};
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -287,8 +287,16 @@ server {
     listen 443 ssl default_server;
     listen [::]:443 ssl default_server;
     
+    # Use snakeoil or fallback to our generated certificates
+    {% raw %}
+    {% if snakeoil_cert.stat.exists %}
     ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
     ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
+    {% else %}
+    ssl_certificate /etc/nginx/conf.d/selfsigned.crt;
+    ssl_certificate_key /etc/nginx/conf.d/selfsigned.key;
+    {% endif %}
+    {% endraw %}
     
     # Redirect unknown hosts to legitimate sites
     return 301 https://www.google.com;

templates/serve-havoc-payloads.sh.j2

@@ -4,7 +4,8 @@
 # Configuration
 PAYLOADS_DIR="/root/Tools/Havoc/payloads"
 C2_HOST="{{ ansible_host }}"
-LISTEN_PORT=8443
+# Use templated variable with fallback - allow override from config
+LISTEN_PORT="{{ havoc_payload_port | default(8443) }}"
 
 # Check if manifest file exists (created by generate_havoc_payloads.sh)
 if [ -f "$PAYLOADS_DIR/manifest.json" ]; then

templates/stream.conf.j2

@@ -2,19 +2,21 @@
 stream {
     # TCP forwarding for Havoc Teamserver
     server {
-  listen {{ havoc_teamserver_port | default(40056) }};
-  proxy_pass {{ c2_ip }}:{{ havoc_teamserver_port | default(40056) }};
+        listen {{ havoc_teamserver_port | default(40056) }};
+        proxy_pass {{ c2_ip }}:{{ havoc_teamserver_port | default(40056) }};
     }
     
     # Additional Havoc ports
     server {
-  listen {{ havoc_http_port | default(8080) }};
-  proxy_pass {{ c2_ip }}:{{ havoc_http_port | default(8080) }};
+        listen {{ havoc_http_port | default(8080) }};
+        proxy_pass {{ c2_ip }}:{{ havoc_http_port | default(8080) }};
     }
     
-    # HTTPS for Havoc
+    # HTTPS for Havoc - Using a different port to avoid conflicts with web server
     server {
-  listen {{ havoc_https_port | default(8443) }};
-  proxy_pass {{ c2_ip }}:{{ havoc_https_port | default(443) }};
+        # Changed from default 443 to 9443 to avoid conflict with Nginx HTTPS
+        listen {{ havoc_https_port | default(9443) }};
+        # Still proxy to the C2's HTTPS port
+        proxy_pass {{ c2_ip }}:{{ havoc_https_port | default(443) }};
     }
 }