working on it
This commit is contained in:
n0mad1k
+15
-7
@@ -60,13 +60,21 @@
|
||||
redirector_ip: "{{ redirector_instance.instance.ipv4[0] }}"
|
||||
redirector_instance_id: "{{ redirector_instance.instance.id }}"
|
||||
|
||||
- name: Wait for redirector SSH to be available
|
||||
wait_for:
|
||||
host: "{{ redirector_ip }}"
|
||||
port: 22
|
||||
delay: 30
|
||||
timeout: 300
|
||||
state: started
|
||||
- name: Enhanced wait for SSH with retry mechanism
|
||||
block:
|
||||
- name: Initial wait for instance to become reachable
|
||||
wait_for:
|
||||
host: "{{ linode_instance.instance.ipv4[0] }}"
|
||||
port: 22
|
||||
delay: 60 # Increased initial delay
|
||||
timeout: 180
|
||||
state: started
|
||||
register: initial_wait
|
||||
|
||||
- name: Additional pause to ensure SSH is fully initialized
|
||||
pause:
|
||||
seconds: 120
|
||||
when: initial_wait is succeeded
|
||||
|
||||
- name: Add redirector to inventory
|
||||
add_host:
|
||||
|
||||
+28
-6
@@ -42,13 +42,35 @@
|
||||
c2_ip: "{{ c2_instance.instance.ipv4[0] }}"
|
||||
c2_instance_id: "{{ c2_instance.instance.id }}"
|
||||
|
||||
# Enhanced SSH wait task for Linode/c2.yml
|
||||
- name: Wait for C2 SSH to be available
|
||||
wait_for:
|
||||
host: "{{ c2_ip }}"
|
||||
port: 22
|
||||
delay: 30
|
||||
timeout: 300
|
||||
state: started
|
||||
block:
|
||||
- name: Initial wait for port to be open
|
||||
wait_for:
|
||||
host: "{{ c2_instance.instance.ipv4[0] }}"
|
||||
port: 22
|
||||
delay: 60
|
||||
timeout: 180
|
||||
state: started
|
||||
|
||||
- name: Additional pause for SSH initialization
|
||||
pause:
|
||||
seconds: 60
|
||||
|
||||
- name: Test SSH connection
|
||||
command: >
|
||||
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=10
|
||||
-i {{ ssh_key_path | replace('.pub', '') }} root@{{ c2_instance.instance.ipv4[0] }} echo "SSH Ready"
|
||||
register: ssh_test
|
||||
retries: 5
|
||||
delay: 20
|
||||
until: ssh_test.rc == 0
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Fail if SSH test unsuccessful
|
||||
fail:
|
||||
msg: "Could not connect to C2 server via SSH after multiple attempts"
|
||||
when: ssh_test.rc != 0
|
||||
|
||||
- name: Add C2 to inventory
|
||||
add_host:
|
||||
|
||||
+20
-89
@@ -1,7 +1,5 @@
|
||||
# Linode/cleanup.yml
|
||||
---
|
||||
# Linode Cleanup Playbook
|
||||
# Used to tear down Linode infrastructure
|
||||
|
||||
- name: Clean up Linode infrastructure
|
||||
hosts: localhost
|
||||
connection: local
|
||||
@@ -20,94 +18,27 @@
|
||||
- linode_token is defined and linode_token != ""
|
||||
fail_msg: "Linode API token is required. Set linode_token in vars.yaml or via --linode-token."
|
||||
|
||||
- name: Confirm cleanup if required
|
||||
- name: Cleanup resources notice
|
||||
debug:
|
||||
msg: |
|
||||
===============================================
|
||||
CLEANUP CONFIRMATION REQUIRED
|
||||
===============================================
|
||||
The following resources will be PERMANENTLY DELETED:
|
||||
{% if cleanup_redirector %}
|
||||
- Redirector instance: {{ redirector_name }}
|
||||
{% endif %}
|
||||
{% if cleanup_c2 %}
|
||||
- C2 instance: {{ c2_name }}
|
||||
{% endif %}
|
||||
when: confirm_cleanup | bool
|
||||
|
||||
- name: Confirm cleanup
|
||||
pause:
|
||||
prompt: "WARNING: This will permanently delete all infrastructure. Type 'yes' to continue"
|
||||
prompt: "Type 'yes' to confirm deletion or 'no' to abort"
|
||||
register: confirmation
|
||||
when: confirm_cleanup
|
||||
when: confirm_cleanup | bool
|
||||
|
||||
- name: Exit if not confirmed
|
||||
meta: end_play
|
||||
when: confirm_cleanup and confirmation.user_input != 'yes'
|
||||
|
||||
- name: Get redirector instance info
|
||||
community.general.linode_v4:
|
||||
access_token: "{{ linode_token }}"
|
||||
command: list
|
||||
label: "{{ redirector_name }}"
|
||||
register: redirector_info
|
||||
failed_when: false
|
||||
when: cleanup_redirector
|
||||
|
||||
- name: Get C2 instance info
|
||||
community.general.linode_v4:
|
||||
access_token: "{{ linode_token }}"
|
||||
command: list
|
||||
label: "{{ c2_name }}"
|
||||
register: c2_info
|
||||
failed_when: false
|
||||
when: cleanup_c2
|
||||
|
||||
- name: Set redirector ID as fact
|
||||
set_fact:
|
||||
redirector_instance_id: "{{ redirector_info.instances[0].id }}"
|
||||
when:
|
||||
- cleanup_redirector
|
||||
- redirector_info.instances is defined
|
||||
- redirector_info.instances | length > 0
|
||||
|
||||
- name: Set C2 ID as fact
|
||||
set_fact:
|
||||
c2_instance_id: "{{ c2_info.instances[0].id }}"
|
||||
when:
|
||||
- cleanup_c2
|
||||
- c2_info.instances is defined
|
||||
- c2_info.instances | length > 0
|
||||
|
||||
- name: Delete redirector instance
|
||||
community.general.linode_v4:
|
||||
access_token: "{{ linode_token }}"
|
||||
command: delete
|
||||
label: "{{ redirector_name }}"
|
||||
state: absent
|
||||
when:
|
||||
- cleanup_redirector
|
||||
- redirector_instance_id is defined
|
||||
register: redirector_deletion
|
||||
|
||||
- name: Delete C2 instance
|
||||
community.general.linode_v4:
|
||||
access_token: "{{ linode_token }}"
|
||||
command: delete
|
||||
label: "{{ c2_name }}"
|
||||
state: absent
|
||||
when:
|
||||
- cleanup_c2
|
||||
- c2_instance_id is defined
|
||||
register: c2_deletion
|
||||
|
||||
- name: Remove SSH key file if it's not a shared key
|
||||
file:
|
||||
path: "{{ ssh_key_path | replace('.pub', '') }}"
|
||||
state: absent
|
||||
when:
|
||||
- ssh_key_path is defined
|
||||
- ssh_key_path is search('c2deploy_')
|
||||
ignore_errors: true
|
||||
|
||||
- name: Remove SSH public key file if it's not a shared key
|
||||
file:
|
||||
path: "{{ ssh_key_path }}"
|
||||
state: absent
|
||||
when:
|
||||
- ssh_key_path is defined
|
||||
- ssh_key_path is search('c2deploy_')
|
||||
ignore_errors: true
|
||||
|
||||
- name: Cleanup complete message
|
||||
debug:
|
||||
msg:
|
||||
- "Linode infrastructure cleanup complete!"
|
||||
- "Resources that were cleaned up:"
|
||||
- "{{ cleanup_redirector | ternary('- Redirector instance: ' + redirector_name, '') }}"
|
||||
- "{{ cleanup_c2 | ternary('- C2 instance: ' + c2_name, '') }}"
|
||||
when: confirm_cleanup | bool and confirmation.user_input != 'yes'
|
||||
@@ -0,0 +1,486 @@
|
||||
---
|
||||
# Linode/configure-c2.yml
|
||||
# This playbook handles only the configuration of an already-created C2 server
|
||||
|
||||
- name: Configure Linode C2 server
|
||||
hosts: c2
|
||||
gather_facts: false
|
||||
become: true
|
||||
vars_files:
|
||||
- vars.yaml
|
||||
vars:
|
||||
# Default values if not provided
|
||||
domain: "{{ domain | default('example.com') }}"
|
||||
c2_subdomain: "{{ c2_subdomain | default('mail') }}"
|
||||
mail_hostname: "{{ mail_hostname | default('mail.' + domain) }}"
|
||||
gophish_admin_port: "{{ gophish_admin_port | default('8090') }}"
|
||||
smtp_auth_user: "{{ smtp_auth_user | default('phishuser') }}"
|
||||
smtp_auth_pass: "{{ smtp_auth_pass | default(lookup('password', '/dev/null length=16 chars=ascii_letters,digits')) }}"
|
||||
|
||||
tasks:
|
||||
# Retry logic for SSH connection
|
||||
- name: Wait for SSH connection to stabilize
|
||||
wait_for_connection:
|
||||
delay: 10
|
||||
timeout: 300
|
||||
register: wait_result
|
||||
ignore_errors: true
|
||||
retries: 5
|
||||
delay: 30
|
||||
until: wait_result is success
|
||||
|
||||
- name: Gather facts after ensuring SSH connection
|
||||
setup:
|
||||
register: setup_result
|
||||
ignore_errors: true
|
||||
retries: 5
|
||||
delay: 30
|
||||
until: setup_result is success
|
||||
|
||||
- name: Wait for apt lock to be released
|
||||
shell: |
|
||||
while lsof /var/lib/dpkg/lock-frontend >/dev/null 2>&1; do
|
||||
echo "waiting for apt lock to be released..."
|
||||
sleep 5
|
||||
done
|
||||
changed_when: false
|
||||
|
||||
- name: Disable root password authentication for SSH immediately
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^#?PasswordAuthentication'
|
||||
line: 'PasswordAuthentication no'
|
||||
state: present
|
||||
register: ssh_config_result
|
||||
ignore_errors: true
|
||||
retries: 3
|
||||
delay: 10
|
||||
until: ssh_config_result is success
|
||||
|
||||
- name: Restart SSH service to apply changes
|
||||
service:
|
||||
name: ssh
|
||||
state: restarted
|
||||
register: ssh_restart_result
|
||||
ignore_errors: true
|
||||
retries: 3
|
||||
delay: 10
|
||||
until: ssh_restart_result is success
|
||||
|
||||
- name: Update apt cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
register: apt_update_result
|
||||
ignore_errors: true
|
||||
retries: 5
|
||||
delay: 10
|
||||
until: apt_update_result is success
|
||||
|
||||
- name: Set a custom MOTD
|
||||
template:
|
||||
src: "templates/motd-linode.j2"
|
||||
dest: /etc/motd
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
vars:
|
||||
letsencrypt_email: "{{ letsencrypt_email | default('admin@' + domain) }}"
|
||||
mail_hostname: "{{ mail_hostname }}"
|
||||
domain: "{{ domain }}"
|
||||
gophish_admin_port: "{{ gophish_admin_port }}"
|
||||
|
||||
- name: Hush Default Login Message
|
||||
shell: |
|
||||
rm -rf '/usr/bin/kali-motd'
|
||||
changed_when: false
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install base utilities and tools via apt
|
||||
apt:
|
||||
name:
|
||||
- git
|
||||
- wget
|
||||
- curl
|
||||
- unzip
|
||||
- python3-pip
|
||||
- python3-virtualenv
|
||||
- tmux
|
||||
- pipx
|
||||
- nmap
|
||||
- tcpdump
|
||||
- hydra
|
||||
- john
|
||||
- hashcat
|
||||
- sqlmap
|
||||
- gobuster
|
||||
- dirb
|
||||
- enum4linux
|
||||
- dnsenum
|
||||
- seclists
|
||||
- responder
|
||||
- golang
|
||||
- proxychains
|
||||
- tor
|
||||
- crackmapexec
|
||||
- jq
|
||||
- unzip
|
||||
- postfix
|
||||
- certbot
|
||||
- opendkim
|
||||
- opendkim-tools
|
||||
- dovecot-core
|
||||
- dovecot-imapd
|
||||
- dovecot-pop3d
|
||||
- dovecot-sieve
|
||||
- dovecot-managesieved
|
||||
- yq
|
||||
state: present
|
||||
register: apt_install_result
|
||||
ignore_errors: true
|
||||
retries: 3
|
||||
delay: 10
|
||||
until: apt_install_result is success
|
||||
|
||||
# Create Tools directory and ensure proper ownership
|
||||
- name: Create Tools directory
|
||||
file:
|
||||
path: ~/Tools
|
||||
state: directory
|
||||
mode: '0755'
|
||||
ignore_errors: true
|
||||
|
||||
- name: Ensure pipx path is configured
|
||||
shell: |
|
||||
pipx ensurepath
|
||||
args:
|
||||
executable: /bin/bash
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install tools via pipx
|
||||
shell: |
|
||||
export PATH=$PATH:/root/.local/bin
|
||||
pipx ensurepath
|
||||
pipx install git+https://github.com/Pennyw0rth/NetExec
|
||||
pipx install git+https://github.com/blacklanternsecurity/TREVORspray
|
||||
pipx install impacket
|
||||
args:
|
||||
executable: /bin/bash
|
||||
ignore_errors: true
|
||||
|
||||
- name: Download Kerbrute
|
||||
shell: |
|
||||
mkdir -p ~/Tools/Kerbrute
|
||||
wget https://github.com/ropnop/kerbrute/releases/latest/download/kerbrute_linux_amd64 -O ~/Tools/Kerbrute/kerbrute
|
||||
chmod +x ~/Tools/Kerbrute/kerbrute
|
||||
args:
|
||||
executable: /bin/bash
|
||||
creates: ~/Tools/Kerbrute/kerbrute
|
||||
ignore_errors: true
|
||||
|
||||
- name: Clone SharpCollection nightly builds
|
||||
git:
|
||||
repo: https://github.com/Flangvik/SharpCollection.git
|
||||
dest: ~/Tools/SharpCollection
|
||||
version: master
|
||||
ignore_errors: true
|
||||
|
||||
- name: Clone PEASS-ng
|
||||
git:
|
||||
repo: https://github.com/carlospolop/PEASS-ng.git
|
||||
dest: ~/Tools/PEASS-ng
|
||||
ignore_errors: true
|
||||
|
||||
- name: Clone MailSniper
|
||||
git:
|
||||
repo: https://github.com/dafthack/MailSniper.git
|
||||
dest: ~/Tools/MailSniper
|
||||
ignore_errors: true
|
||||
|
||||
- name: Clone Inveigh
|
||||
git:
|
||||
repo: https://github.com/Kevin-Robertson/Inveigh.git
|
||||
dest: ~/Tools/Inveigh
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install Sliver C2 server
|
||||
shell: |
|
||||
curl https://sliver.sh/install | bash
|
||||
systemctl enable sliver
|
||||
systemctl start sliver
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install Metasploit Framework (Nightly Build)
|
||||
shell: |
|
||||
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > ~/Tools/msfinstall
|
||||
chmod 755 ~/Tools/msfinstall
|
||||
~/Tools/msfinstall
|
||||
args:
|
||||
executable: /bin/bash
|
||||
ignore_errors: true
|
||||
|
||||
- name: Grab GoPhish
|
||||
shell: |
|
||||
curl -L "$(curl -s https://api.github.com/repos/gophish/gophish/releases/latest | jq -r '.assets[] | select(.browser_download_url | contains("linux-64bit.zip")) | .browser_download_url')" -o ~/Tools/gophish.zip
|
||||
unzip ~/Tools/gophish.zip -d ~/Tools/gophish
|
||||
rm -rf ~/Tools/gophish.zip
|
||||
chmod +x ~/Tools/gophish/gophish
|
||||
args:
|
||||
executable: /bin/bash
|
||||
creates: ~/Tools/gophish/gophish
|
||||
ignore_errors: true
|
||||
|
||||
- name: Deploy Gophish config.json with custom admin port
|
||||
template:
|
||||
src: "templates/gophish-config.j2"
|
||||
dest: ~/Tools/gophish/config.json
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
vars:
|
||||
gophish_admin_port: "{{ gophish_admin_port }}"
|
||||
domain: "{{ domain }}"
|
||||
ignore_errors: true
|
||||
|
||||
# Mail server configuration
|
||||
- name: Configure Postfix main.cf
|
||||
lineinfile:
|
||||
path: /etc/postfix/main.cf
|
||||
regexp: "{{ item.regexp }}"
|
||||
line: "{{ item.line }}"
|
||||
with_items:
|
||||
- { regexp: '^myhostname', line: "myhostname = {{ mail_hostname }}" }
|
||||
- { regexp: '^mydomain', line: "mydomain = {{ domain }}" }
|
||||
- { regexp: '^myorigin', line: "myorigin = $mydomain" }
|
||||
- { regexp: '^inet_interfaces', line: "inet_interfaces = all" }
|
||||
- { regexp: '^inet_protocols', line: "inet_protocols = ipv4" }
|
||||
- { regexp: '^smtpd_banner', line: "smtpd_banner = $myhostname ESMTP $mail_name" }
|
||||
- { regexp: '^mynetworks', line: "mynetworks = 127.0.0.0/8 [::1]/128" }
|
||||
- { regexp: '^relay_domains', line: "relay_domains = $mydestination" }
|
||||
- { regexp: '^smtpd_tls_cert_file', line: "smtpd_tls_cert_file = /etc/letsencrypt/live/{{ domain }}/fullchain.pem" }
|
||||
- { regexp: '^smtpd_tls_key_file', line: "smtpd_tls_key_file = /etc/letsencrypt/live/{{ domain }}/privkey.pem" }
|
||||
- { regexp: '^smtpd_tls_security_level', line: "smtpd_tls_security_level = encrypt" }
|
||||
- { regexp: '^smtpd_tls_session_cache_database', line: "smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache" }
|
||||
- { regexp: '^smtp_tls_session_cache_database', line: "smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache" }
|
||||
- { regexp: '^smtpd_use_tls', line: "smtpd_use_tls = yes" }
|
||||
- { regexp: '^smtpd_tls_auth_only', line: "smtpd_tls_auth_only = yes" }
|
||||
- { regexp: '^milter_default_action', line: "milter_default_action = accept" }
|
||||
- { regexp: '^milter_protocol', line: "milter_protocol = 6" }
|
||||
- { regexp: '^smtpd_milters', line: "smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock" }
|
||||
- { regexp: '^non_smtpd_milters', line: "non_smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock" }
|
||||
ignore_errors: true
|
||||
|
||||
- name: Configure OpenDKIM
|
||||
lineinfile:
|
||||
path: /etc/opendkim.conf
|
||||
regexp: "{{ item.regexp }}"
|
||||
line: "{{ item.line }}"
|
||||
with_items:
|
||||
- { regexp: '^Domain', line: "Domain {{ domain }}" }
|
||||
- { regexp: '^KeyFile', line: "KeyFile /etc/opendkim/keys/{{ domain }}/mail.private" }
|
||||
- { regexp: '^Selector', line: "Selector mail" }
|
||||
- { regexp: '^Socket', line: "Socket local:/var/spool/postfix/opendkim/opendkim.sock" }
|
||||
- { regexp: '^Syslog', line: "Syslog yes" }
|
||||
- { regexp: '^UMask', line: "UMask 002" }
|
||||
- { regexp: '^Mode', line: "Mode sv" }
|
||||
ignore_errors: true
|
||||
|
||||
- name: Create DKIM directory
|
||||
file:
|
||||
path: /etc/opendkim/keys/{{ domain }}
|
||||
state: directory
|
||||
owner: opendkim
|
||||
group: opendkim
|
||||
mode: 0700
|
||||
ignore_errors: true
|
||||
|
||||
- name: Generate DKIM keys
|
||||
command: >
|
||||
opendkim-genkey -D /etc/opendkim/keys/{{ domain }} -d {{ domain }} -s mail
|
||||
args:
|
||||
creates: /etc/opendkim/keys/{{ domain }}/mail.private
|
||||
ignore_errors: true
|
||||
|
||||
- name: Set permissions for DKIM keys
|
||||
file:
|
||||
path: /etc/opendkim/keys/{{ domain }}/mail.private
|
||||
owner: opendkim
|
||||
group: opendkim
|
||||
mode: 0600
|
||||
ignore_errors: true
|
||||
|
||||
- name: Configure OpenDKIM TrustedHosts
|
||||
copy:
|
||||
content: |
|
||||
127.0.0.1
|
||||
::1
|
||||
localhost
|
||||
{{ domain }}
|
||||
dest: /etc/opendkim/TrustedHosts
|
||||
owner: opendkim
|
||||
group: opendkim
|
||||
mode: 0644
|
||||
ignore_errors: true
|
||||
|
||||
- name: Enable submission port (587) in master.cf
|
||||
blockinfile:
|
||||
path: /etc/postfix/master.cf
|
||||
insertafter: '^#submission'
|
||||
block: |
|
||||
submission inet n - y - - smtpd
|
||||
-o syslog_name=postfix/submission
|
||||
-o smtpd_tls_security_level=encrypt
|
||||
-o smtpd_sasl_auth_enable=yes
|
||||
-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
|
||||
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
|
||||
ignore_errors: true
|
||||
|
||||
# Dovecot and authentication configuration
|
||||
- name: Configure Dovecot for Postfix SASL
|
||||
blockinfile:
|
||||
path: /etc/dovecot/conf.d/10-master.conf
|
||||
insertafter: '^service auth {'
|
||||
block: |
|
||||
# Postfix smtp-auth
|
||||
unix_listener /var/spool/postfix/private/auth {
|
||||
mode = 0660
|
||||
user = postfix
|
||||
group = postfix
|
||||
}
|
||||
ignore_errors: true
|
||||
|
||||
- name: Set Dovecot auth_mechanisms
|
||||
lineinfile:
|
||||
path: /etc/dovecot/conf.d/10-auth.conf
|
||||
regexp: '^auth_mechanisms'
|
||||
line: 'auth_mechanisms = plain login'
|
||||
ignore_errors: true
|
||||
|
||||
- name: Create Dovecot password file for SASL authentication
|
||||
file:
|
||||
path: /etc/dovecot/passwd
|
||||
state: touch
|
||||
mode: '0600'
|
||||
owner: dovecot
|
||||
group: dovecot
|
||||
ignore_errors: true
|
||||
|
||||
- name: Add SMTP auth user to Dovecot
|
||||
lineinfile:
|
||||
path: /etc/dovecot/passwd
|
||||
line: "{{ smtp_auth_user }}:{{ smtp_auth_pass | password_hash('sha512_crypt') }}"
|
||||
ignore_errors: true
|
||||
|
||||
- name: Disable system auth and use passwd-file
|
||||
lineinfile:
|
||||
path: /etc/dovecot/conf.d/10-auth.conf
|
||||
regexp: '^!include auth-system.conf.ext'
|
||||
line: '#!include auth-system.conf.ext'
|
||||
ignore_errors: true
|
||||
|
||||
- name: Add auth-passwdfile configuration
|
||||
blockinfile:
|
||||
path: /etc/dovecot/conf.d/10-auth.conf
|
||||
insertafter: '^auth_mechanisms ='
|
||||
block: |
|
||||
passdb {
|
||||
driver = passwd-file
|
||||
args = scheme=sha512_crypt /etc/dovecot/passwd
|
||||
}
|
||||
userdb {
|
||||
driver = static
|
||||
args = uid=vmail gid=vmail home=/var/vmail/%u
|
||||
}
|
||||
ignore_errors: true
|
||||
|
||||
- name: Create vmail user/group
|
||||
group:
|
||||
name: vmail
|
||||
gid: 5000
|
||||
state: present
|
||||
ignore_errors: true
|
||||
|
||||
- name: Create vmail user
|
||||
user:
|
||||
name: vmail
|
||||
uid: 5000
|
||||
group: vmail
|
||||
create_home: no
|
||||
ignore_errors: true
|
||||
|
||||
- name: Create vmail directory
|
||||
file:
|
||||
path: /var/vmail
|
||||
state: directory
|
||||
owner: vmail
|
||||
group: vmail
|
||||
mode: 0700
|
||||
ignore_errors: true
|
||||
|
||||
- name: Install Let's Encrypt certificate if domain specified
|
||||
shell: |
|
||||
certbot certonly --standalone -d {{ c2_subdomain }}.{{ domain }} --non-interactive --agree-tos -m {{ letsencrypt_email | default('admin@' + domain) }}
|
||||
certbot certonly --standalone -d {{ mail_hostname }} --non-interactive --agree-tos -m {{ letsencrypt_email | default('admin@' + domain) }}
|
||||
args:
|
||||
creates: /etc/letsencrypt/live/{{ domain }}/fullchain.pem
|
||||
when: domain != "example.com"
|
||||
ignore_errors: true
|
||||
|
||||
- name: Restart Postfix
|
||||
service:
|
||||
name: postfix
|
||||
state: restarted
|
||||
ignore_errors: true
|
||||
|
||||
- name: Restart Dovecot
|
||||
service:
|
||||
name: dovecot
|
||||
state: restarted
|
||||
ignore_errors: true
|
||||
|
||||
- name: Create operational scripts directory
|
||||
file:
|
||||
path: /opt/c2
|
||||
state: directory
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
ignore_errors: true
|
||||
|
||||
- name: Copy clean-logs.sh script
|
||||
copy:
|
||||
src: "../files/clean-logs.sh"
|
||||
dest: /opt/c2/clean-logs.sh
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
ignore_errors: true
|
||||
|
||||
- name: Copy secure-exit.sh script
|
||||
copy:
|
||||
src: "../files/secure-exit.sh"
|
||||
dest: /opt/c2/secure-exit.sh
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
ignore_errors: true
|
||||
|
||||
- name: Set up cron job for log cleaning if zero-logs enabled
|
||||
cron:
|
||||
name: "Clean logs"
|
||||
minute: "0"
|
||||
hour: "*/6"
|
||||
job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
|
||||
when: zero_logs | default(true) | bool
|
||||
ignore_errors: true
|
||||
|
||||
- name: Print deployment summary
|
||||
debug:
|
||||
msg:
|
||||
- "C2 Server Configuration Complete!"
|
||||
- "-----------------------------"
|
||||
- "C2 Server IP: {{ ansible_host }}"
|
||||
- "C2 Server Domain: {{ c2_subdomain }}.{{ domain }} (Update DNS A record)"
|
||||
- "Mail Server Domain: {{ mail_hostname }} (Update DNS A record)"
|
||||
- "GoPhish Admin Port: {{ gophish_admin_port }}"
|
||||
- "SMTP Auth User: {{ smtp_auth_user }}"
|
||||
- "SMTP Auth Password: {{ smtp_auth_pass }}"
|
||||
@@ -0,0 +1,218 @@
|
||||
---
|
||||
# Linode/configure-redirector.yml
|
||||
# This playbook handles only the configuration of an already-created redirector
|
||||
|
||||
- name: Configure Linode redirector
|
||||
hosts: redirector
|
||||
gather_facts: false
|
||||
become: true
|
||||
vars_files:
|
||||
- vars.yaml
|
||||
vars:
|
||||
# Default values if not provided
|
||||
shell_handler_port: "{{ shell_handler_port | default(4000 + 60000 | random) }}"
|
||||
domain: "{{ domain | default('example.com') }}"
|
||||
redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
|
||||
|
||||
tasks:
|
||||
# Retry logic for SSH connection
|
||||
- name: Wait for SSH connection to stabilize
|
||||
wait_for_connection:
|
||||
delay: 10
|
||||
timeout: 300
|
||||
register: wait_result
|
||||
ignore_errors: true
|
||||
retries: 5
|
||||
delay: 30
|
||||
until: wait_result is success
|
||||
|
||||
- name: Gather facts after ensuring SSH connection
|
||||
setup:
|
||||
register: setup_result
|
||||
ignore_errors: true
|
||||
retries: 5
|
||||
delay: 30
|
||||
until: setup_result is success
|
||||
|
||||
- name: Wait for apt lock to be released
|
||||
shell: |
|
||||
while lsof /var/lib/dpkg/lock-frontend >/dev/null 2>&1; do
|
||||
echo "waiting for apt lock to be released..."
|
||||
sleep 5
|
||||
done
|
||||
changed_when: false
|
||||
|
||||
- name: Disable root password authentication for SSH immediately
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^#?PasswordAuthentication'
|
||||
line: 'PasswordAuthentication no'
|
||||
state: present
|
||||
register: ssh_config_result
|
||||
ignore_errors: true
|
||||
retries: 3
|
||||
delay: 10
|
||||
until: ssh_config_result is success
|
||||
|
||||
- name: Restart SSH service to apply changes
|
||||
service:
|
||||
name: ssh
|
||||
state: restarted
|
||||
register: ssh_restart_result
|
||||
ignore_errors: true
|
||||
retries: 3
|
||||
delay: 10
|
||||
until: ssh_restart_result is success
|
||||
|
||||
- name: Update apt cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
register: apt_update_result
|
||||
ignore_errors: true
|
||||
retries: 5
|
||||
delay: 10
|
||||
until: apt_update_result is success
|
||||
|
||||
- name: Install nginx and other required packages
|
||||
apt:
|
||||
name:
|
||||
- nginx
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
- socat
|
||||
- netcat-openbsd
|
||||
- secure-delete
|
||||
state: present
|
||||
register: apt_install_result
|
||||
ignore_errors: true
|
||||
retries: 3
|
||||
delay: 10
|
||||
until: apt_install_result is success
|
||||
|
||||
- name: Create directories for operational scripts
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
with_items:
|
||||
- /opt/c2
|
||||
- /opt/shell-handler
|
||||
|
||||
- name: Copy clean-logs.sh script
|
||||
copy:
|
||||
src: "../files/clean-logs.sh"
|
||||
dest: /opt/c2/clean-logs.sh
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Copy shell handler script
|
||||
copy:
|
||||
src: "../files/persistent-listener.sh"
|
||||
dest: /opt/shell-handler/persistent-listener.sh
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Configure shell handler script with C2 IP
|
||||
replace:
|
||||
path: /opt/shell-handler/persistent-listener.sh
|
||||
regexp: 'C2_HOST="127.0.0.1"'
|
||||
replace: 'C2_HOST="{{ c2_ip | default("127.0.0.1") }}"'
|
||||
|
||||
- name: Configure shell handler script with listening port
|
||||
replace:
|
||||
path: /opt/shell-handler/persistent-listener.sh
|
||||
regexp: 'LISTEN_PORT=4444'
|
||||
replace: 'LISTEN_PORT={{ shell_handler_port }}'
|
||||
|
||||
- name: Create shell handler service
|
||||
template:
|
||||
src: "../FlokiNET/templates/shell-handler.service.j2"
|
||||
dest: /etc/systemd/system/shell-handler.service
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
vars:
|
||||
c2_ip: "{{ c2_ip | default('127.0.0.1') }}"
|
||||
shell_handler_port: "{{ shell_handler_port }}"
|
||||
|
||||
- name: Configure NGINX for zero-logging
|
||||
template:
|
||||
src: "../FlokiNET/templates/nginx.conf.j2"
|
||||
dest: /etc/nginx/nginx.conf
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
when: zero_logs | default(true) | bool
|
||||
|
||||
- name: Configure NGINX for C2 redirection
|
||||
template:
|
||||
src: "../FlokiNET/templates/default-site.j2"
|
||||
dest: /etc/nginx/sites-available/default
|
||||
mode: '0644'
|
||||
owner: root
|
||||
group: root
|
||||
vars:
|
||||
domain: "{{ domain }}"
|
||||
c2_host: "{{ c2_ip | default('127.0.0.1') }}"
|
||||
|
||||
- name: Create legitimate-looking index.html
|
||||
template:
|
||||
src: "../FlokiNET/templates/index.html.j2"
|
||||
dest: /var/www/html/index.html
|
||||
mode: '0644'
|
||||
owner: www-data
|
||||
group: www-data
|
||||
vars:
|
||||
domain: "{{ domain }}"
|
||||
redirector_subdomain: "{{ redirector_subdomain }}"
|
||||
|
||||
- name: Start and enable shell handler service
|
||||
systemd:
|
||||
name: shell-handler
|
||||
state: started
|
||||
enabled: yes
|
||||
daemon_reload: yes
|
||||
register: shell_handler_result
|
||||
ignore_errors: true
|
||||
retries: 3
|
||||
delay: 10
|
||||
until: shell_handler_result is success
|
||||
|
||||
- name: Set up cron job for log cleaning if zero-logs enabled
|
||||
cron:
|
||||
name: "Clean logs"
|
||||
minute: "0"
|
||||
hour: "*/6"
|
||||
job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
|
||||
when: zero_logs | default(true) | bool
|
||||
|
||||
- name: Install Let's Encrypt certificate if domain specified
|
||||
shell: |
|
||||
certbot --nginx -d {{ redirector_subdomain }}.{{ domain }} --non-interactive --agree-tos -m {{ letsencrypt_email | default('admin@' + domain) }}
|
||||
args:
|
||||
creates: /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/fullchain.pem
|
||||
when: domain != "example.com"
|
||||
ignore_errors: true
|
||||
|
||||
- name: Restart NGINX
|
||||
systemd:
|
||||
name: nginx
|
||||
state: restarted
|
||||
register: nginx_restart_result
|
||||
ignore_errors: true
|
||||
retries: 3
|
||||
delay: 10
|
||||
until: nginx_restart_result is success
|
||||
|
||||
- name: Print deployment summary
|
||||
debug:
|
||||
msg:
|
||||
- "Redirector Configuration Complete!"
|
||||
- "-------------------------------"
|
||||
- "Redirector IP: {{ ansible_host }}"
|
||||
- "Redirector Domain: {{ redirector_subdomain }}.{{ domain }} (Update DNS A record)"
|
||||
- "Shell Handler Port: {{ shell_handler_port }}"
|
||||
@@ -0,0 +1,85 @@
|
||||
---
|
||||
# Linode/initial-infrastructure.yml
|
||||
# This playbook only creates the Linode instances without trying to configure them
|
||||
# This separation makes the deployment more reliable
|
||||
|
||||
- name: Create Linode infrastructure
|
||||
hosts: localhost
|
||||
gather_facts: false
|
||||
connection: local
|
||||
vars_files:
|
||||
- vars.yaml
|
||||
vars:
|
||||
# Default values if not provided
|
||||
ssh_user: "{{ ssh_user | default('root') }}"
|
||||
linode_region: "{{ linode_region | default(region_choices | random) }}"
|
||||
plan: "{{ plan | default('g6-standard-2') }}"
|
||||
image: "{{ image | default('linode/kali') }}"
|
||||
|
||||
# Determine what to deploy based on configuration
|
||||
deploy_redirector: "{{ not (c2_only | default(false)) }}"
|
||||
deploy_c2: "{{ not (redirector_only | default(false)) }}"
|
||||
|
||||
# Generate random names if not provided
|
||||
redirector_name: "{{ redirector_name | default('srv-' + 100000000 | random | to_uuid | hash('md5') | truncate(8, True, '')) }}"
|
||||
c2_name: "{{ c2_name | default('node-' + 100000000 | random | to_uuid | hash('md5') | truncate(8, True, '')) }}"
|
||||
|
||||
tasks:
|
||||
- name: Validate required Linode token
|
||||
assert:
|
||||
that:
|
||||
- linode_token is defined and linode_token != ""
|
||||
fail_msg: "Linode API token is required. Set linode_token in vars.yaml or via --linode-token."
|
||||
|
||||
- name: Create redirector Linode instance
|
||||
community.general.linode_v4:
|
||||
access_token: "{{ linode_token }}"
|
||||
label: "{{ redirector_name }}"
|
||||
type: "{{ plan }}"
|
||||
region: "{{ linode_region }}"
|
||||
image: "{{ image }}"
|
||||
root_pass: "{{ lookup('password', '/dev/null length=24 chars=ascii_letters,digits') }}"
|
||||
authorized_keys:
|
||||
- "{{ lookup('file', ssh_key_path) }}"
|
||||
state: present
|
||||
register: redirector_instance
|
||||
when: deploy_redirector
|
||||
|
||||
- name: Set redirector_ip for later use
|
||||
set_fact:
|
||||
redirector_instance_id: "{{ redirector_instance.instance.id }}"
|
||||
redirector_ip: "{{ redirector_instance.instance.ipv4[0] }}"
|
||||
when: deploy_redirector and redirector_instance is defined
|
||||
|
||||
- name: Create C2 Linode instance
|
||||
community.general.linode_v4:
|
||||
access_token: "{{ linode_token }}"
|
||||
label: "{{ c2_name }}"
|
||||
type: "{{ plan }}"
|
||||
region: "{{ linode_region }}"
|
||||
image: "{{ image }}"
|
||||
root_pass: "{{ lookup('password', '/dev/null length=24 chars=ascii_letters,digits') }}"
|
||||
authorized_keys:
|
||||
- "{{ lookup('file', ssh_key_path) }}"
|
||||
state: present
|
||||
register: c2_instance
|
||||
when: deploy_c2
|
||||
|
||||
- name: Set c2_ip for later use
|
||||
set_fact:
|
||||
c2_instance_id: "{{ c2_instance.instance.id }}"
|
||||
c2_ip: "{{ c2_instance.instance.ipv4[0] }}"
|
||||
when: deploy_c2 and c2_instance is defined
|
||||
|
||||
- name: Display instance information
|
||||
debug:
|
||||
msg:
|
||||
- "Linode instances created successfully!"
|
||||
- "Waiting for instances to initialize..."
|
||||
- "{{ 'Redirector IP: ' + redirector_ip if redirector_ip is defined else 'No redirector deployed' }}"
|
||||
- "{{ 'C2 Server IP: ' + c2_ip if c2_ip is defined else 'No C2 server deployed' }}"
|
||||
|
||||
- name: Wait for instances to initialize (30 seconds)
|
||||
pause:
|
||||
seconds: 30
|
||||
when: (deploy_redirector and redirector_instance is defined) or (deploy_c2 and c2_instance is defined)
|
||||
+28
-6
@@ -45,13 +45,35 @@
|
||||
redirector_ip: "{{ redirector_instance.instance.ipv4[0] }}"
|
||||
redirector_instance_id: "{{ redirector_instance.instance.id }}"
|
||||
|
||||
# Enhanced SSH wait task for Linode/redirector.yml
|
||||
- name: Wait for redirector SSH to be available
|
||||
wait_for:
|
||||
host: "{{ redirector_ip }}"
|
||||
port: 22
|
||||
delay: 30
|
||||
timeout: 300
|
||||
state: started
|
||||
block:
|
||||
- name: Initial wait for port to be open
|
||||
wait_for:
|
||||
host: "{{ redirector_instance.instance.ipv4[0] }}"
|
||||
port: 22
|
||||
delay: 60
|
||||
timeout: 180
|
||||
state: started
|
||||
|
||||
- name: Additional pause for SSH initialization
|
||||
pause:
|
||||
seconds: 60
|
||||
|
||||
- name: Test SSH connection
|
||||
command: >
|
||||
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=10
|
||||
-i {{ ssh_key_path | replace('.pub', '') }} root@{{ redirector_instance.instance.ipv4[0] }} echo "SSH Ready"
|
||||
register: ssh_test
|
||||
retries: 5
|
||||
delay: 20
|
||||
until: ssh_test.rc == 0
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Fail if SSH test unsuccessful
|
||||
fail:
|
||||
msg: "Could not connect to redirector via SSH after multiple attempts"
|
||||
when: ssh_test.rc != 0
|
||||
|
||||
- name: Add redirector to inventory
|
||||
add_host:
|
||||
|
||||
Reference in New Issue
Block a user