working through issues

tasks/configure_redirector.yml

@@ -119,7 +119,7 @@
 # Configure nginx for dual HTTP/HTTPS with complete encryption
 - name: Configure NGINX for secure C2 redirection
   template:
-    src: "../templates/redirector-site-config.j2"
+    src: "../templates/redirector-site.conf.j2"
     dest: /etc/nginx/sites-available/default
     mode: '0644'
     owner: root
@@ -135,29 +135,7 @@
 
 - name: Create SSL certificate setup instructions
   template:
-    content: |
+    src: "../templates/setup-cert.sh.j2"
-      #!/bin/bash
-      # Let's Encrypt Certificate Setup Script
-      # Run this after setting up DNS records pointing to this server
-
-      # Replace these with your actual values if needed
-      DOMAIN="{{ domain }}"
-      SUBDOMAIN="{{ redirector_subdomain }}"
-      EMAIL="admin@${DOMAIN}"
-
-      echo "================================================"
-      echo "Let's Encrypt Certificate Setup"
-      echo "================================================"
-      echo
-      echo "Before running this script, make sure:"
-      echo "1. DNS records are set up correctly"
-      echo "   - ${SUBDOMAIN}.${DOMAIN} points to $(curl -s ifconfig.me)"
-      echo "2. Port 80 is open to the internet"
-      echo
-      echo "Run the following command to get your certificate:"
-      echo "certbot --nginx -d ${SUBDOMAIN}.${DOMAIN} --non-interactive --agree-tos -m ${EMAIL}"
-      echo
-      echo "================================================"
     dest: /root/Tools/setup-cert.sh
     mode: '0700'
     owner: root
@@ -165,27 +143,7 @@
 
 - name: Configure NGINX stream module for TCP traffic
   template:
-    content: |
+    src: "../templates/stream.conf.j2"
-      # TCP stream configuration for Havoc C2
-      stream {
-          # TCP forwarding for Havoc Teamserver
-          server {
-              listen {{ havoc_teamserver_port | default(40056) }};
-              proxy_pass {{ c2_ip }}:{{ havoc_teamserver_port | default(40056) }};
-          }
-          
-          # Additional Havoc ports
-          server {
-              listen {{ havoc_http_port | default(8080) }};
-              proxy_pass {{ c2_ip }}:{{ havoc_http_port | default(8080) }};
-          }
-          
-          # HTTPS for Havoc
-          server {
-              listen {{ havoc_https_port | default(443) }};
-              proxy_pass {{ c2_ip }}:{{ havoc_https_port | default(443) }};
-          }
-      }
     dest: /etc/nginx/modules-enabled/stream.conf
     mode: '0644'
     owner: root

tasks/port_randomization.yml

@@ -1,6 +1,6 @@
 ---
 # tasks/port_randomization.yml
-# Task file to randomize ports for C2 infrastructure
+# Task file to randomize ports for C2 infrastructure with improved host-based service management
 
 - name: Create port randomization script
   copy:
@@ -55,12 +55,38 @@
     insertafter: '^\\[Service\\]'
   when: randomize_ports | default(true) | bool and port_config_result.rc == 0
 
+# Improved service management - checks for service existence before restarting
+- name: Determine services to restart based on host type
+  set_fact:
+    services_to_restart: []
+  when: randomize_ports | default(true) | bool and port_config_result.rc == 0
+
+- name: Check if Havoc service exists
+  stat:
+    path: "/etc/systemd/system/havoc.service"
+  register: havoc_service_stat
+  when: randomize_ports | default(true) | bool and port_config_result.rc == 0
+
+- name: Add Havoc to services list if it exists
+  set_fact:
+    services_to_restart: "{{ services_to_restart + ['havoc'] }}"
+  when: randomize_ports | default(true) | bool and port_config_result.rc == 0 and havoc_service_stat.stat.exists | default(false)
+
+- name: Check if shell-handler service exists
+  stat:
+    path: "/etc/systemd/system/shell-handler.service"
+  register: shell_handler_service_stat
+  when: randomize_ports | default(true) | bool and port_config_result.rc == 0
+
+- name: Add shell-handler to services list if it exists
+  set_fact:
+    services_to_restart: "{{ services_to_restart + ['shell-handler'] }}"
+  when: randomize_ports | default(true) | bool and port_config_result.rc == 0 and shell_handler_service_stat.stat.exists | default(false)
+
 - name: Reload and restart services
   systemd:
     daemon_reload: yes
     name: "{{ item }}"
     state: restarted
-  with_items:
+  with_items: "{{ services_to_restart }}"
-    - havoc
+  when: randomize_ports | default(true) | bool and port_config_result.rc == 0 and services_to_restart | length > 0
-    - shell-handler
-  when: randomize_ports | default(true) | bool and port_config_result.rc == 0

templates/setup-cert.sh.j2

@@ -0,0 +1,22 @@
+#!/bin/bash
+# Let's Encrypt Certificate Setup Script
+# Run this after setting up DNS records pointing to this server
+
+# Replace these with your actual values if needed
+DOMAIN="{{ domain }}"
+SUBDOMAIN="{{ redirector_subdomain | default(cdn) }}"
+EMAIL="admin@${DOMAIN}"
+
+echo "================================================"
+echo "Let's Encrypt Certificate Setup"
+echo "================================================"
+echo
+echo "Before running this script, make sure:"
+echo "1. DNS records are set up correctly"
+echo "   - ${SUBDOMAIN}.${DOMAIN} points to $(curl -s ifconfig.me)"
+echo "2. Port 80 is open to the internet"
+echo
+echo "Run the following command to get your certificate:"
+echo "certbot --nginx -d ${SUBDOMAIN}.${DOMAIN} --non-interactive --agree-tos -m ${EMAIL}"
+echo
+echo "================================================"

templates/shell-handler.service.j2

@@ -19,10 +19,10 @@ NoNewPrivileges=true
 StandardOutput=null
 StandardError=null
 
-# Environment variables
+# Environment variables (configured via Ansible)
-Environment="C2_HOST={{ c2_ip }}"
+Environment="C2_HOST={{ c2_ip | default('127.0.0.1') }}"
-Environment="LISTEN_PORT={{ shell_handler_port }}"
+Environment="LISTEN_PORT={{ shell_handler_port | default('4444') }}"
-Environment="HAVOC_PORT={{ havoc_teamserver_port | default(40056) }}"
+Environment="HAVOC_PORT={{ havoc_teamserver_port | default('40056') }}"
 
 [Install]
 WantedBy=multi-user.target

templates/stream.conf.j2

@@ -0,0 +1,20 @@
+# TCP stream configuration for Havoc C2
+stream {
+    # TCP forwarding for Havoc Teamserver
+    server {
+  listen {{ havoc_teamserver_port | default(40056) }};
+  proxy_pass {{ c2_ip }}:{{ havoc_teamserver_port | default(40056) }};
+    }
+    
+    # Additional Havoc ports
+    server {
+  listen {{ havoc_http_port | default(8080) }};
+  proxy_pass {{ c2_ip }}:{{ havoc_http_port | default(8080) }};
+    }
+    
+    # HTTPS for Havoc
+    server {
+  listen {{ havoc_https_port | default(443) }};
+  proxy_pass {{ c2_ip }}:{{ havoc_https_port | default(443) }};
+    }
+}