basic deployment of redirector and c2 working

2025-04-12 13:21:31 -04:00
parent 50dd4f99e4
commit bd0dcf693c
11 changed files with 162 additions and 484 deletions
@@ -0,0 +1,213 @@
+---
+# Linode C2 Deployment Playbook
+# This playbook handles both redirector and C2 deployment for Linode
+
+- name: Create and configure Linode infrastructure
+  hosts: localhost
+  gather_facts: false
+  connection: local
+  vars_files:
+    - vars.yaml
+  vars:
+    # Default values for required variables
+    ssh_user: "{{ ssh_user | default('root') }}"
+    linode_region: "{{ linode_region | default(region_choices | random) }}"
+    plan: "{{ plan | default('g6-standard-1') }}"
+    image: "{{ image | default('linode/debian11') }}"
+    
+    # Deployment mode flags
+    redirector_only: "{{ redirector_only | default(false) }}"
+    c2_only: "{{ c2_only | default(false) }}"
+    
+    # Generate random instance names if not provided
+    redirector_name: "{{ redirector_name | default('srv-' + 9999999999 | random | to_uuid | hash('md5') | truncate(8, True, '')) }}"
+    c2_name: "{{ c2_name | default('node-' + 9999999999 | random | to_uuid | hash('md5') | truncate(8, True, '')) }}"
+    
+    # Generate random shell handler port if not provided
+    shell_handler_port: "{{ shell_handler_port | default(4000 + 60000 | random) }}"
+
+  tasks:
+    - name: Validate required Linode token
+      assert:
+        that:
+          - linode_token is defined and linode_token != ""
+        fail_msg: "Linode API token is required. Set linode_token in vars.yaml or via --linode-token."
+    
+    - name: Set the target instances to deploy based on configuration
+      set_fact:
+        deploy_redirector: "{{ not c2_only }}"
+        deploy_c2: "{{ not redirector_only }}"
+    
+    # REDIRECTOR DEPLOYMENT
+    - name: Deploy redirector Linode instance
+      when: deploy_redirector
+      block:
+        - name: Create redirector Linode instance
+          community.general.linode_v4:
+            access_token: "{{ linode_token }}"
+            label: "{{ redirector_name }}"
+            type: "{{ plan }}"
+            region: "{{ linode_region }}"
+            image: "{{ image }}"
+            root_pass: "{{ lookup('password', '/dev/null length=24 chars=ascii_letters,digits') }}"
+            authorized_keys:
+              - "{{ lookup('file', ssh_key_path) }}"
+            state: present
+          register: redirector_instance
+
+        - name: Set redirector_ip for later use
+          set_fact:
+            redirector_ip: "{{ redirector_instance.instance.ipv4[0] }}"
+            redirector_instance_id: "{{ redirector_instance.instance.id }}"
+
+        - name: Enhanced wait for SSH with retry mechanism
+          block:
+            - name: Initial wait for instance to become reachable
+              wait_for:
+                host: "{{ linode_instance.instance.ipv4[0] }}"
+                port: 22
+                delay: 60  # Increased initial delay
+                timeout: 180
+                state: started
+              register: initial_wait
+            
+            - name: Additional pause to ensure SSH is fully initialized
+              pause: 
+                seconds: 120
+              when: initial_wait is succeeded
+
+        - name: Add redirector to inventory
+          add_host:
+            name: "redirector"
+            groups: "redirectors"
+            ansible_host: "{{ redirector_ip }}"
+            ansible_user: "{{ ssh_user }}"
+            ansible_ssh_private_key_file: "{{ ssh_key_path | replace('.pub', '') }}"
+            ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
+
+    # C2 SERVER DEPLOYMENT
+    - name: Deploy C2 Linode instance
+      when: deploy_c2
+      block:
+        - name: Create C2 Linode instance
+          community.general.linode_v4:
+            access_token: "{{ linode_token }}"
+            label: "{{ c2_name }}"
+            type: "{{ plan }}"
+            region: "{{ linode_region }}"
+            image: "{{ image }}"
+            root_pass: "{{ lookup('password', '/dev/null length=24 chars=ascii_letters,digits') }}"
+            authorized_keys:
+              - "{{ lookup('file', ssh_key_path) }}"
+            state: present
+          register: c2_instance
+
+        - name: Set c2_ip for later use
+          set_fact:
+            c2_ip: "{{ c2_instance.instance.ipv4[0] }}"
+            c2_instance_id: "{{ c2_instance.instance.id }}"
+
+        - name: Wait for C2 SSH to be available
+          wait_for:
+            host: "{{ c2_ip }}"
+            port: 22
+            delay: 30
+            timeout: 300
+            state: started
+
+        - name: Add C2 to inventory
+          add_host:
+            name: "c2"
+            groups: "c2servers"
+            ansible_host: "{{ c2_ip }}"
+            ansible_user: "{{ ssh_user }}"
+            ansible_ssh_private_key_file: "{{ ssh_key_path | replace('.pub', '') }}"
+            ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
+
+- name: Configure redirector server
+  hosts: redirectors
+  become: true
+  gather_facts: true
+  vars_files:
+    - vars.yaml
+  vars:
+    c2_ip: "{{ hostvars['localhost']['c2_ip'] | default('127.0.0.1') }}"
+    redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
+  tasks:
+    - name: Wait for apt to be available
+      apt:
+        update_cache: yes
+      register: apt_result
+      until: apt_result is success
+      retries: 5
+      delay: 10
+    
+    - name: Disable root password authentication for SSH immediately
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?PasswordAuthentication'
+        line: 'PasswordAuthentication no'
+        state: present
+      
+    - name: Restart SSH service to apply changes
+      service:
+        name: ssh
+        state: restarted
+      
+    - name: Include common redirector configuration tasks
+      include_tasks: "../tasks/configure_redirector.yml"
+
+- name: Configure C2 server
+  hosts: c2servers
+  become: true
+  gather_facts: true
+  vars_files:
+    - vars.yaml
+  vars:
+    redirector_ip: "{{ hostvars['localhost']['redirector_ip'] | default('127.0.0.1') }}"
+    c2_subdomain: "{{ c2_subdomain | default('mail') }}"
+  tasks:
+    - name: Wait for apt to be available
+      apt:
+        update_cache: yes
+      register: apt_result
+      until: apt_result is success
+      retries: 5
+      delay: 10
+    
+    - name: Disable root password authentication for SSH immediately
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?PasswordAuthentication'
+        line: 'PasswordAuthentication no'
+        state: present
+      
+    - name: Restart SSH service to apply changes
+      service:
+        name: ssh
+        state: restarted
+
+    - name: Include common tool installation tasks
+      include_tasks: "../tasks/install_tools.yml"
+      
+    - name: Include common C2 configuration tasks
+      include_tasks: "../tasks/configure_c2.yml"
+      
+    - name: Include common security hardening tasks
+      include_tasks: "../tasks/security_hardening.yml"
+      
+    - name: Include common mail server configuration tasks
+      include_tasks: "../tasks/configure_mail.yml"
+      
+    - name: Print deployment summary
+      debug:
+        msg:
+          - "C2 Infrastructure Deployment Complete!"
+          - "--------------------------------------"
+          - "Redirector IP: {{ hostvars['localhost']['redirector_ip'] | default('Not deployed') }}"
+          - "Redirector Domain: {{ redirector_subdomain }}.{{ domain }}"
+          - "C2 Server IP: {{ ansible_host }}"
+          - "C2 Server Domain: {{ c2_subdomain }}.{{ domain }}"
+          - "GoPhish Admin Port: {{ gophish_admin_port }}"
+          - "Shell Handler Port: {{ shell_handler_port }}"
+      when: not disable_summary | default(false)