n0mad1k/CoM-c2itall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

making progress

Browse Source
This commit is contained in:
n0mad1k
2025-04-14 06:25:26 -04:00
parent d936575312
commit b2fdee77b6
24 changed files with 1342 additions and 121 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tasks/configure-redirector.yml
-218
View File
@@ -1,218 +0,0 @@
---
# Linode/configure-redirector.yml
# This playbook handles only the configuration of an already-created redirector
- name: Configure Linode redirector
hosts: redirector
gather_facts: false
become: true
vars_files:
- vars.yaml
vars:
# Default values if not provided
shell_handler_port: "{{ shell_handler_port | default(4000 + 60000 | random) }}"
domain: "{{ domain | default('example.com') }}"
redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
tasks:
# Retry logic for SSH connection
- name: Wait for SSH connection to stabilize
wait_for_connection:
delay: 10
timeout: 300
register: wait_result
ignore_errors: true
retries: 5
delay: 30
until: wait_result is success
- name: Gather facts after ensuring SSH connection
setup:
register: setup_result
ignore_errors: true
retries: 5
delay: 30
until: setup_result is success
- name: Wait for apt lock to be released
shell: |
while lsof /var/lib/dpkg/lock-frontend >/dev/null 2>&1; do
echo "waiting for apt lock to be released..."
sleep 5
done
changed_when: false
- name: Disable root password authentication for SSH immediately
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^#?PasswordAuthentication'
line: 'PasswordAuthentication no'
state: present
register: ssh_config_result
ignore_errors: true
retries: 3
delay: 10
until: ssh_config_result is success
- name: Restart SSH service to apply changes
service:
name: ssh
state: restarted
register: ssh_restart_result
ignore_errors: true
retries: 3
delay: 10
until: ssh_restart_result is success
- name: Update apt cache
apt:
update_cache: yes
register: apt_update_result
ignore_errors: true
retries: 5
delay: 10
until: apt_update_result is success
- name: Install nginx and other required packages
apt:
name:
- nginx
- certbot
- python3-certbot-nginx
- socat
- netcat-openbsd
- secure-delete
state: present
register: apt_install_result
ignore_errors: true
retries: 3
delay: 10
until: apt_install_result is success
- name: Create directories for operational scripts
file:
path: "{{ item }}"
state: directory
mode: '0700'
owner: root
group: root
with_items:
- /opt/c2
- /opt/shell-handler
- name: Copy clean-logs.sh script
copy:
src: "../files/clean-logs.sh" # Fix the path to point to root files directory
dest: /opt/c2/clean-logs.sh
mode: '0700'
owner: root
group: root
- name: Copy shell handler script
copy:
src: "../files/persistent-listener.sh" # Use relative path with ../ prefix
dest: /opt/shell-handler/persistent-listener.sh
mode: '0700'
owner: root
group: root
- name: Configure shell handler script with C2 IP
replace:
path: /opt/shell-handler/persistent-listener.sh
regexp: 'C2_HOST="127.0.0.1"'
replace: 'C2_HOST="{{ c2_ip | default("127.0.0.1") }}"'
- name: Configure shell handler script with listening port
replace:
path: /opt/shell-handler/persistent-listener.sh
regexp: 'LISTEN_PORT=4444'
replace: 'LISTEN_PORT={{ shell_handler_port }}'
- name: Create shell handler service
template:
src: "../FlokiNET/templates/shell-handler.service.j2"
dest: /etc/systemd/system/shell-handler.service
mode: '0644'
owner: root
group: root
vars:
c2_ip: "{{ c2_ip | default('127.0.0.1') }}"
shell_handler_port: "{{ shell_handler_port }}"
- name: Configure NGINX for zero-logging
template:
src: "../FlokiNET/templates/nginx.conf.j2"
dest: /etc/nginx/nginx.conf
mode: '0644'
owner: root
group: root
when: zero_logs | default(true) | bool
- name: Configure NGINX for C2 redirection
template:
src: "../FlokiNET/templates/default-site.j2"
dest: /etc/nginx/sites-available/default
mode: '0644'
owner: root
group: root
vars:
domain: "{{ domain }}"
c2_host: "{{ c2_ip | default('127.0.0.1') }}"
- name: Create legitimate-looking index.html
template:
src: "../FlokiNET/templates/index.html.j2"
dest: /var/www/html/index.html
mode: '0644'
owner: www-data
group: www-data
vars:
domain: "{{ domain }}"
redirector_subdomain: "{{ redirector_subdomain }}"
- name: Start and enable shell handler service
systemd:
name: shell-handler
state: started
enabled: yes
daemon_reload: yes
register: shell_handler_result
ignore_errors: true
retries: 3
delay: 10
until: shell_handler_result is success
- name: Set up cron job for log cleaning if zero-logs enabled
cron:
name: "Clean logs"
minute: "0"
hour: "*/6"
job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
when: zero_logs | default(true) | bool
- name: Install Let's Encrypt certificate if domain specified
shell: |
certbot --nginx -d {{ redirector_subdomain }}.{{ domain }} --non-interactive --agree-tos -m {{ letsencrypt_email | default('admin@' + domain) }}
args:
creates: /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/fullchain.pem
when: domain != "example.com"
ignore_errors: true
- name: Restart NGINX
systemd:
name: nginx
state: restarted
register: nginx_restart_result
ignore_errors: true
retries: 3
delay: 10
until: nginx_restart_result is success
- name: Print deployment summary
debug:
msg:
- "Redirector Configuration Complete!"
- "-------------------------------"
- "Redirector IP: {{ ansible_host }}"
- "Redirector Domain: {{ redirector_subdomain }}.{{ domain }} (Update DNS A record)"
- "Shell Handler Port: {{ shell_handler_port }}"
tasks/configure_c2.yml
+6 -1
View File
@@ -109,4 +109,9 @@
# Check if beacon server is already running
if ! pgrep -f "/opt/c2/serve-beacons.sh" > /dev/null; then
nohup /opt/c2/serve-beacons.sh > /dev/null 2>&1 &
fi
fi
# Include integrated tracker tasks if requested
- name: Include integrated tracker setup
include_tasks: "configure_integrated_tracker.yml"
when: setup_integrated_tracker | default(false) | bool
tasks/configure_integrated_tracker.yml
+156
View File
@@ -0,0 +1,156 @@
---
# Common task for configuring integrated email tracker on C2 server
- name: Check if integrated tracker setup is requested
debug:
msg: "Setting up integrated email tracker on C2 server"
when: setup_integrated_tracker | default(false) | bool
- name: Install required packages for tracker
apt:
name:
- python3-pip
- python3-venv
- python3-pillow
- nginx
- certbot
- python3-certbot-nginx
- jq
state: present
update_cache: yes
when: setup_integrated_tracker | default(false) | bool
- name: Create tracker directory
file:
path: /opt/tracker
state: directory
mode: '0755'
owner: root
group: root
when: setup_integrated_tracker | default(false) | bool
- name: Create tracker data directory
file:
path: /opt/tracker/data
state: directory
mode: '0755'
owner: root
group: root
when: setup_integrated_tracker | default(false) | bool
- name: Create tracker system user
user:
name: tracker
system: yes
shell: /usr/sbin/nologin
home: /opt/tracker
create_home: no
when: setup_integrated_tracker | default(false) | bool
- name: Create Python virtual environment for tracker
pip:
virtualenv: /opt/tracker/venv
name:
- flask
- pillow
- gunicorn
virtualenv_command: /usr/bin/python3 -m venv
environment:
PATH: "/usr/local/bin:/usr/bin:/bin"
vars:
ansible_python_interpreter: /usr/bin/python3
when: setup_integrated_tracker | default(false) | bool
- name: Copy tracker application code
copy:
src: "../files/simple_email_tracker.py"
dest: /opt/tracker/simple_email_tracker.py
mode: '0755'
owner: root
group: root
when: setup_integrated_tracker | default(false) | bool
- name: Copy tracker statistics CLI tool
copy:
src: "../files/tracker-stats.sh"
dest: /opt/tracker/tracker-stats.sh
mode: '0755'
owner: root
group: root
when: setup_integrated_tracker | default(false) | bool
- name: Copy systemd service file for tracker
copy:
src: "../files/tracker.service"
dest: /etc/systemd/system/tracker.service
mode: '0644'
owner: root
group: root
when: setup_integrated_tracker | default(false) | bool
- name: Set correct permissions for tracker directories
file:
path: "{{ item }}"
state: directory
owner: tracker
group: tracker
recurse: yes
loop:
- /opt/tracker
- /opt/tracker/data
when: setup_integrated_tracker | default(false) | bool
- name: Create NGINX site config for tracker
template:
src: "../files/tracker-nginx.conf"
dest: /etc/nginx/sites-available/tracker
mode: '0644'
owner: root
group: root
vars:
tracker_domain: "{{ tracker_domain | default('track.' + domain) }}"
when: setup_integrated_tracker | default(false) | bool
- name: Enable tracker NGINX site
file:
src: /etc/nginx/sites-available/tracker
dest: /etc/nginx/sites-enabled/tracker
state: link
when: setup_integrated_tracker | default(false) | bool
- name: Configure redirector to proxy tracking requests
lineinfile:
path: /etc/nginx/sites-available/default
insertafter: "^\\s*location / {"
line: " # Email tracker proxy path\n location /px/(.*)\\.png$ {\n proxy_pass http://{{ c2_ip }}:443/pixel/$1.png;\n proxy_set_header Host {{ tracker_domain }};\n proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Forwarded-Proto https;\n }"
delegate_to: "{{ groups['redirectors'][0] }}"
when: setup_integrated_tracker | default(false) | bool and groups['redirectors'] is defined
- name: Set up SSL if requested
shell: |
certbot --nginx -d {{ tracker_domain }} --non-interactive --agree-tos -m {{ tracker_email }}
args:
creates: /etc/letsencrypt/live/{{ tracker_domain }}/fullchain.pem
when: setup_integrated_tracker | default(false) | bool and tracker_setup_ssl | default(true) | bool
ignore_errors: yes
- name: Start and enable tracker service
systemd:
name: tracker
state: started
enabled: yes
daemon_reload: yes
when: setup_integrated_tracker | default(false) | bool
- name: Restart NGINX to apply tracker configuration
systemd:
name: nginx
state: restarted
when: setup_integrated_tracker | default(false) | bool
- name: Add tracker alias to bashrc for easy access
lineinfile:
path: /root/.bashrc
line: 'alias tracker="/opt/tracker/tracker-stats.sh"'
state: present
when: setup_integrated_tracker | default(false) | bool
tasks/configure_redirector.yml
+14 -55
View File
@@ -27,7 +27,7 @@
- name: Copy clean-logs.sh script
copy:
src: "clean-logs.sh"
src: "../files/clean-logs.sh"
dest: /opt/c2/clean-logs.sh
mode: '0700'
owner: root
@@ -35,7 +35,7 @@
- name: Copy shell handler script
copy:
src: "persistent-listener.sh"
src: "../files/persistent-listener.sh"
dest: /opt/shell-handler/persistent-listener.sh
mode: '0700'
owner: root
@@ -72,15 +72,25 @@
- name: Set subdomain value explicitly
set_fact:
redirector_subdomain: "cdn"
redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
- name: Configure NGINX for C2 redirection
- name: Configure NGINX for C2 redirection (standard)
template:
src: "../templates/redirector-site.conf.j2"
dest: /etc/nginx/sites-available/default
mode: '0644'
owner: root
group: root
when: not (setup_integrated_tracker | default(false) | bool)
- name: Configure NGINX for C2 redirection with tracker support
template:
src: "../templates/redirector-site-with-tracker.conf.j2"
dest: /etc/nginx/sites-available/default
mode: '0644'
owner: root
group: root
when: setup_integrated_tracker | default(false) | bool
- name: Create legitimate-looking index.html
template:
@@ -122,57 +132,6 @@
var: nginx_config_test.stderr_lines
when: nginx_config_test.rc != 0
- name: Ensure NGINX configurations are valid
block:
- name: Fix NGINX configuration if test failed
copy:
content: |
server {
listen 80;
listen [::]:80;
server_name cdn.{{ domain }};
# Root directory
root /var/www/html;
index index.html;
# Primary location for legitimate traffic
location / {
try_files $uri $uri/ =404;
}
# Special URI patterns for C2 traffic
location /ajax/ {
proxy_pass http://{{ c2_ip }}:8888;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
# Static resources
location ~ ^/static/(css|js|images)/.*\.(css|js|png|jpg|jpeg|gif|ico)$ {
proxy_pass http://{{ c2_ip }}:8888;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
# Catch-all server block
server {
listen 80 default_server;
listen [::]:80 default_server;
# Redirect unknown traffic
return 301 https://www.google.com;
}
dest: /etc/nginx/sites-available/default
mode: '0644'
owner: root
group: root
when: nginx_config_test.rc != 0
when: nginx_config_test.rc != 0
- name: Restart NGINX
systemd:
name: nginx
tasks/clean-logs.sh → tasks/files/clean-logs.sh
View File
tasks/persistent-listener.sh → tasks/files/persistent-listener.sh
View File
tasks/rubber-ducky.txt → tasks/files/rubber-ducky.txt
View File
tasks/secure-exit.sh → tasks/files/secure-exit.sh
View File
tasks/serve-beacons.sh → tasks/files/serve-beacons.sh
View File
tasks/files/simple_email_tracker.py
+214
View File
@@ -0,0 +1,214 @@
#!/usr/bin/env python3
"""
Simple Email Tracking Server
A minimal Flask application that serves transparent tracking pixels
and logs email opens with metadata.
"""
import os
import json
import time
import logging
from datetime import datetime
from flask import Flask, request, send_file, render_template_string
# Configure logging
logging.basicConfig(
level=logging.INFO,
format='%(asctime)s - %(levelname)s - %(message)s',
handlers=[
logging.FileHandler('/opt/tracker/data/tracker.log'),
logging.StreamHandler()
]
)
# Create Flask app
app = Flask(__name__)
# Directory to store tracking data
DATA_DIR = '/opt/tracker/data'
os.makedirs(DATA_DIR, exist_ok=True)
# Path to 1x1 transparent pixel
PIXEL_PATH = os.path.join(DATA_DIR, 'pixel.png')
# Create 1x1 transparent PNG if it doesn't exist
if not os.path.exists(PIXEL_PATH):
from PIL import Image
img = Image.new('RGBA', (1, 1), color=(0, 0, 0, 0))
img.save(PIXEL_PATH)
# Path to tracking data
TRACKING_DATA_PATH = os.path.join(DATA_DIR, 'tracking_data.json')
def load_tracking_data():
"""Load existing tracking data from JSON file"""
if os.path.exists(TRACKING_DATA_PATH):
try:
with open(TRACKING_DATA_PATH, 'r') as f:
return json.load(f)
except json.JSONDecodeError:
logging.error("Error loading tracking data, starting fresh")
return {}
def save_tracking_data(data):
"""Save tracking data to JSON file"""
with open(TRACKING_DATA_PATH, 'w') as f:
json.dump(data, f, indent=2)
@app.route('/pixel/<tracking_id>.png')
def tracking_pixel(tracking_id):
"""Serve a tracking pixel and log the request"""
# Get client information
user_agent = request.headers.get('User-Agent', 'Unknown')
ip_address = request.remote_addr
timestamp = datetime.now().isoformat()
referer = request.headers.get('Referer', 'Unknown')
# Log the tracking event
logging.info(f"Pixel loaded - ID: {tracking_id}, IP: {ip_address}")
# Add tracking event to data
tracking_data = load_tracking_data()
if tracking_id not in tracking_data:
tracking_data[tracking_id] = []
tracking_data[tracking_id].append({
'timestamp': timestamp,
'ip_address': ip_address,
'user_agent': user_agent,
'referer': referer
})
save_tracking_data(tracking_data)
# Return the 1x1 transparent pixel
return send_file(PIXEL_PATH, mimetype='image/png')
@app.route('/')
def dashboard():
"""Display tracking statistics dashboard"""
tracking_data = load_tracking_data()
# Prepare data for the dashboard
stats = []
for tracking_id, events in tracking_data.items():
stats.append({
'id': tracking_id,
'views': len(events),
'last_view': events[-1]['timestamp'] if events else 'Never',
'unique_ips': len(set(e['ip_address'] for e in events))
})
# Sort by most views
stats.sort(key=lambda x: x['views'], reverse=True)
# Simple HTML dashboard template
template = """
<!DOCTYPE html>
<html>
<head>
<title>Email Tracking Dashboard</title>
<style>
body { font-family: Arial, sans-serif; margin: 0; padding: 20px; }
h1 { color: #333; }
table { border-collapse: collapse; width: 100%; }
th, td { text-align: left; padding: 8px; border-bottom: 1px solid #ddd; }
tr:hover { background-color: #f5f5f5; }
th { background-color: #4CAF50; color: white; }
.container { max-width: 800px; margin: 0 auto; }
</style>
</head>
<body>
<div class="container">
<h1>Email Tracking Dashboard</h1>
<p>To track email opens, add this HTML to your emails:</p>
<pre>&lt;img src="https://YOUR_DOMAIN/px/YOUR_TRACKING_ID.png" height="1" width="1" /&gt;</pre>
<h2>Tracking Statistics</h2>
<table>
<tr>
<th>Tracking ID</th>
<th>Views</th>
<th>Unique IPs</th>
<th>Last View</th>
<th>Details</th>
</tr>
{% for stat in stats %}
<tr>
<td>{{ stat.id }}</td>
<td>{{ stat.views }}</td>
<td>{{ stat.unique_ips }}</td>
<td>{{ stat.last_view }}</td>
<td><a href="/details/{{ stat.id }}">View Details</a></td>
</tr>
{% endfor %}
</table>
</div>
</body>
</html>
"""
return render_template_string(template, stats=stats)
@app.route('/details/<tracking_id>')
def tracking_details(tracking_id):
"""Display detailed tracking information for a specific ID"""
tracking_data = load_tracking_data()
if tracking_id not in tracking_data:
return f"No data found for tracking ID: {tracking_id}", 404
events = tracking_data[tracking_id]
# Simple HTML template for details
template = """
<!DOCTYPE html>
<html>
<head>
<title>Tracking Details: {{ tracking_id }}</title>
<style>
body { font-family: Arial, sans-serif; margin: 0; padding: 20px; }
h1, h2 { color: #333; }
table { border-collapse: collapse; width: 100%; }
th, td { text-align: left; padding: 8px; border-bottom: 1px solid #ddd; }
tr:hover { background-color: #f5f5f5; }
th { background-color: #4CAF50; color: white; }
.container { max-width: 800px; margin: 0 auto; }
.back { margin-bottom: 20px; }
</style>
</head>
<body>
<div class="container">
<div class="back"><a href="/">&laquo; Back to Dashboard</a></div>
<h1>Tracking Details: {{ tracking_id }}</h1>
<p>Total views: {{ events|length }}</p>
<h2>Events</h2>
<table>
<tr>
<th>Time</th>
<th>IP Address</th>
<th>User Agent</th>
<th>Referer</th>
</tr>
{% for event in events %}
<tr>
<td>{{ event.timestamp }}</td>
<td>{{ event.ip_address }}</td>
<td>{{ event.user_agent }}</td>
<td>{{ event.referer }}</td>
</tr>
{% endfor %}
</table>
</div>
</body>
</html>
"""
return render_template_string(template, tracking_id=tracking_id, events=events)
if __name__ == '__main__':
app.run(host='127.0.0.1', port=5000, debug=False)
tasks/files/tracker-nginx.conf
+47
View File
@@ -0,0 +1,47 @@
server {
listen 80;
listen [::]:80;
server_name {{ tracker_domain }};
# Redirect to HTTPS if SSL is enabled
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name {{ tracker_domain }};
# SSL Configuration
ssl_certificate /etc/letsencrypt/live/{{ tracker_domain }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{ tracker_domain }}/privkey.pem;
# Restrict dashboard to localhost only
location / {
allow 127.0.0.1;
deny all;
proxy_pass http://127.0.0.1:5000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
# Allow public access only to pixel endpoints
location ~ ^/pixel/(.+)\.png$ {
# Public access allowed
proxy_pass http://127.0.0.1:5000/pixel/$1.png;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# Cache control - don't cache tracking pixels
add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
expires off;
}
# Security headers
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "no-referrer" always;
}
tasks/files/tracker-stats.sh
+45
View File
@@ -0,0 +1,45 @@
#!/bin/bash
# CLI tool to view email tracking stats
DATA_FILE="/opt/tracker/data/tracking_data.json"
function show_summary() {
if [ ! -f "$DATA_FILE" ]; then
echo "No tracking data found."
exit 1
fi
echo "Email Tracking Summary:"
echo "======================="
jq -r 'to_entries | sort_by(.value | length) | reverse | .[] | "\(.key): \(.value | length) views"' $DATA_FILE
}
function show_details() {
ID=$1
if [ ! -f "$DATA_FILE" ]; then
echo "No tracking data found."
exit 1
fi
echo "Details for tracking ID: $ID"
echo "=========================="
jq -r --arg id "$ID" '.[$id] | if . then .[] | "\(.timestamp) | \(.ip_address) | \(.user_agent)" else "No data found for this ID" end' $DATA_FILE
}
case "$1" in
"list")
show_summary
;;
"details")
if [ -z "$2" ]; then
echo "Usage: $0 details TRACKING_ID"
exit 1
fi
show_details "$2"
;;
*)
echo "Usage: $0 [list|details TRACKING_ID]"
echo " list - Show summary of all tracking IDs"
echo " details ID - Show details for specific tracking ID"
;;
esac
tasks/files/tracker.service
+19
View File
@@ -0,0 +1,19 @@
[Unit]
Description=Email Tracking Server
After=network.target
[Service]
User=tracker
Group=tracker
WorkingDirectory=/opt/tracker
ExecStart=/opt/tracker/venv/bin/python /opt/tracker/simple_email_tracker.py
Restart=always
RestartSec=10
# Security settings
PrivateTmp=true
ProtectSystem=full
NoNewPrivileges=true
[Install]
WantedBy=multi-user.target