basic deployment of redirector and c2 working

tasks/configure-redirector.yml

@@ -0,0 +1,218 @@
+---
+# Linode/configure-redirector.yml
+# This playbook handles only the configuration of an already-created redirector
+
+- name: Configure Linode redirector
+  hosts: redirector
+  gather_facts: false
+  become: true
+  vars_files:
+    - vars.yaml
+  vars:
+    # Default values if not provided
+    shell_handler_port: "{{ shell_handler_port | default(4000 + 60000 | random) }}"
+    domain: "{{ domain | default('example.com') }}"
+    redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
+    
+  tasks:
+    # Retry logic for SSH connection
+    - name: Wait for SSH connection to stabilize
+      wait_for_connection:
+        delay: 10
+        timeout: 300
+      register: wait_result
+      ignore_errors: true
+      retries: 5
+      delay: 30
+      until: wait_result is success
+      
+    - name: Gather facts after ensuring SSH connection
+      setup:
+      register: setup_result
+      ignore_errors: true
+      retries: 5
+      delay: 30
+      until: setup_result is success
+      
+    - name: Wait for apt lock to be released
+      shell: |
+        while lsof /var/lib/dpkg/lock-frontend >/dev/null 2>&1; do
+          echo "waiting for apt lock to be released..."
+          sleep 5
+        done
+      changed_when: false
+      
+    - name: Disable root password authentication for SSH immediately
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: '^#?PasswordAuthentication'
+        line: 'PasswordAuthentication no'
+        state: present
+      register: ssh_config_result
+      ignore_errors: true
+      retries: 3
+      delay: 10
+      until: ssh_config_result is success
+      
+    - name: Restart SSH service to apply changes
+      service:
+        name: ssh
+        state: restarted
+      register: ssh_restart_result
+      ignore_errors: true
+      retries: 3
+      delay: 10
+      until: ssh_restart_result is success
+      
+    - name: Update apt cache
+      apt:
+        update_cache: yes
+      register: apt_update_result
+      ignore_errors: true
+      retries: 5
+      delay: 10
+      until: apt_update_result is success
+        
+    - name: Install nginx and other required packages
+      apt:
+        name:
+          - nginx
+          - certbot
+          - python3-certbot-nginx
+          - socat
+          - netcat-openbsd
+          - secure-delete
+        state: present
+      register: apt_install_result
+      ignore_errors: true
+      retries: 3
+      delay: 10
+      until: apt_install_result is success
+        
+    - name: Create directories for operational scripts
+      file:
+        path: "{{ item }}"
+        state: directory
+        mode: '0700'
+        owner: root
+        group: root
+      with_items:
+        - /opt/c2
+        - /opt/shell-handler
+        
+    - name: Copy clean-logs.sh script
+      copy:
+        src: "../files/clean-logs.sh"  # Fix the path to point to root files directory
+        dest: /opt/c2/clean-logs.sh
+        mode: '0700'
+        owner: root
+        group: root
+        
+    - name: Copy shell handler script
+      copy:
+        src: "../files/persistent-listener.sh"  # Use relative path with ../ prefix
+        dest: /opt/shell-handler/persistent-listener.sh
+        mode: '0700'
+        owner: root
+        group: root
+        
+    - name: Configure shell handler script with C2 IP
+      replace:
+        path: /opt/shell-handler/persistent-listener.sh
+        regexp: 'C2_HOST="127.0.0.1"'
+        replace: 'C2_HOST="{{ c2_ip | default("127.0.0.1") }}"'
+        
+    - name: Configure shell handler script with listening port
+      replace:
+        path: /opt/shell-handler/persistent-listener.sh
+        regexp: 'LISTEN_PORT=4444'
+        replace: 'LISTEN_PORT={{ shell_handler_port }}'
+        
+    - name: Create shell handler service
+      template:
+        src: "../FlokiNET/templates/shell-handler.service.j2"
+        dest: /etc/systemd/system/shell-handler.service
+        mode: '0644'
+        owner: root
+        group: root
+      vars:
+        c2_ip: "{{ c2_ip | default('127.0.0.1') }}"
+        shell_handler_port: "{{ shell_handler_port }}"
+        
+    - name: Configure NGINX for zero-logging
+      template:
+        src: "../FlokiNET/templates/nginx.conf.j2"
+        dest: /etc/nginx/nginx.conf
+        mode: '0644'
+        owner: root
+        group: root
+      when: zero_logs | default(true) | bool
+        
+    - name: Configure NGINX for C2 redirection
+      template:
+        src: "../FlokiNET/templates/default-site.j2"
+        dest: /etc/nginx/sites-available/default
+        mode: '0644'
+        owner: root
+        group: root
+      vars:
+        domain: "{{ domain }}"
+        c2_host: "{{ c2_ip | default('127.0.0.1') }}"
+        
+    - name: Create legitimate-looking index.html
+      template:
+        src: "../FlokiNET/templates/index.html.j2"
+        dest: /var/www/html/index.html
+        mode: '0644'
+        owner: www-data
+        group: www-data
+      vars:
+        domain: "{{ domain }}"
+        redirector_subdomain: "{{ redirector_subdomain }}"
+        
+    - name: Start and enable shell handler service
+      systemd:
+        name: shell-handler
+        state: started
+        enabled: yes
+        daemon_reload: yes
+      register: shell_handler_result
+      ignore_errors: true
+      retries: 3
+      delay: 10
+      until: shell_handler_result is success
+        
+    - name: Set up cron job for log cleaning if zero-logs enabled
+      cron:
+        name: "Clean logs"
+        minute: "0"
+        hour: "*/6"
+        job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
+      when: zero_logs | default(true) | bool
+        
+    - name: Install Let's Encrypt certificate if domain specified
+      shell: |
+        certbot --nginx -d {{ redirector_subdomain }}.{{ domain }} --non-interactive --agree-tos -m {{ letsencrypt_email | default('admin@' + domain) }}
+      args:
+        creates: /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/fullchain.pem
+      when: domain != "example.com"
+      ignore_errors: true
+        
+    - name: Restart NGINX
+      systemd:
+        name: nginx
+        state: restarted
+      register: nginx_restart_result
+      ignore_errors: true
+      retries: 3
+      delay: 10
+      until: nginx_restart_result is success
+      
+    - name: Print deployment summary
+      debug:
+        msg:
+          - "Redirector Configuration Complete!"
+          - "-------------------------------"
+          - "Redirector IP: {{ ansible_host }}"
+          - "Redirector Domain: {{ redirector_subdomain }}.{{ domain }} (Update DNS A record)"
+          - "Shell Handler Port: {{ shell_handler_port }}"

tasks/configure_c2.yml

@@ -1,5 +1,5 @@
 ---
-# Common task for configuring C2 server
+# Common tasks for configuring C2 server
 # Shared across all providers
 
 - name: Update apt cache
@@ -8,7 +8,7 @@
 
 - name: Set a custom MOTD
   template:
-    src: "motd.j2"
+    src: "../templates/motd-linode.j2"
     dest: /etc/motd
     owner: root
     group: root
@@ -55,6 +55,18 @@
       - yq
     state: present
 
+- name: Create directories for operational scripts
+  file:
+    path: "{{ item }}"
+    state: directory
+    mode: '0700'
+    owner: root
+    group: root
+  with_items:
+    - /opt/c2
+    - /opt/beacons
+    - /opt/payloads
+
 - name: Copy operational scripts
   copy:
     src: "{{ item }}"
@@ -67,45 +79,9 @@
     - secure-exit.sh
     - serve-beacons.sh
 
-- name: Create operational directories
-  file:
-    path: "{{ item }}"
-    state: directory
-    mode: '0700'
-    owner: root
-    group: root
-  with_items:
-    - /opt/c2
-    - /opt/beacons
-    - /opt/payloads
-
 - name: Create Sliver service file
-  copy:
-    content: |
-      [Unit]
-      Description=Sliver C2 Server
-      After=network.target
-      
-      [Service]
-      Type=simple
-      User=root
-      Group=root
-      WorkingDirectory=/root/.sliver
-      ExecStart=/usr/local/bin/sliver-server daemon
-      Restart=always
-      RestartSec=10
-      
-      # Security measures
-      PrivateTmp=true
-      ProtectHome=false
-      NoNewPrivileges=true
-      
-      # Hide process information
-      StandardOutput=null
-      StandardError=null
-      
-      [Install]
-      WantedBy=multi-user.target
+  template:
+    src: "../templates/sliver-server.service.j2"
     dest: /etc/systemd/system/sliver.service
     mode: '0644'
     owner: root

tasks/initial-infrastructure.yml

@@ -0,0 +1,85 @@
+---
+# Linode/initial-infrastructure.yml
+# This playbook only creates the Linode instances without trying to configure them
+# This separation makes the deployment more reliable
+
+- name: Create Linode infrastructure
+  hosts: localhost
+  gather_facts: false
+  connection: local
+  vars_files:
+    - vars.yaml
+  vars:
+    # Default values if not provided
+    ssh_user: "{{ ssh_user | default('root') }}"
+    linode_region: "{{ linode_region | default(region_choices | random) }}"
+    plan: "{{ plan | default('g6-standard-2') }}"
+    image: "{{ image | default('linode/kali') }}"
+    
+    # Determine what to deploy based on configuration
+    deploy_redirector: "{{ not (c2_only | default(false)) }}"
+    deploy_c2: "{{ not (redirector_only | default(false)) }}"
+    
+    # Generate random names if not provided
+    redirector_name: "{{ redirector_name | default('srv-' + 100000000 | random | to_uuid | hash('md5') | truncate(8, True, '')) }}"
+    c2_name: "{{ c2_name | default('node-' + 100000000 | random | to_uuid | hash('md5') | truncate(8, True, '')) }}"
+
+  tasks:
+    - name: Validate required Linode token
+      assert:
+        that:
+          - linode_token is defined and linode_token != ""
+        fail_msg: "Linode API token is required. Set linode_token in vars.yaml or via --linode-token."
+
+    - name: Create redirector Linode instance
+      community.general.linode_v4:
+        access_token: "{{ linode_token }}"
+        label: "{{ redirector_name }}"
+        type: "{{ plan }}"
+        region: "{{ linode_region }}"
+        image: "{{ image }}"
+        root_pass: "{{ lookup('password', '/dev/null length=24 chars=ascii_letters,digits') }}"
+        authorized_keys:
+          - "{{ lookup('file', ssh_key_path) }}"
+        state: present
+      register: redirector_instance
+      when: deploy_redirector
+
+    - name: Set redirector_ip for later use
+      set_fact:
+        redirector_instance_id: "{{ redirector_instance.instance.id }}"
+        redirector_ip: "{{ redirector_instance.instance.ipv4[0] }}"
+      when: deploy_redirector and redirector_instance is defined
+
+    - name: Create C2 Linode instance
+      community.general.linode_v4:
+        access_token: "{{ linode_token }}"
+        label: "{{ c2_name }}"
+        type: "{{ plan }}"
+        region: "{{ linode_region }}"
+        image: "{{ image }}"
+        root_pass: "{{ lookup('password', '/dev/null length=24 chars=ascii_letters,digits') }}"
+        authorized_keys:
+          - "{{ lookup('file', ssh_key_path) }}"
+        state: present
+      register: c2_instance
+      when: deploy_c2
+
+    - name: Set c2_ip for later use
+      set_fact:
+        c2_instance_id: "{{ c2_instance.instance.id }}"
+        c2_ip: "{{ c2_instance.instance.ipv4[0] }}"
+      when: deploy_c2 and c2_instance is defined
+
+    - name: Display instance information
+      debug:
+        msg: 
+          - "Linode instances created successfully!"
+          - "Waiting for instances to initialize..."
+          - "{{ 'Redirector IP: ' + redirector_ip if redirector_ip is defined else 'No redirector deployed' }}"
+          - "{{ 'C2 Server IP: ' + c2_ip if c2_ip is defined else 'No C2 server deployed' }}"
+
+    - name: Wait for instances to initialize (30 seconds)
+      pause:
+        seconds: 30
+      when: (deploy_redirector and redirector_instance is defined) or (deploy_c2 and c2_instance is defined)

tasks/install_tools.yml

@@ -164,7 +164,7 @@
 
 - name: Deploy Gophish config.json with custom admin port
   template:
-    src: gophish-config.j2
+    src: "../templates/gophish-config.j2"
     dest: "{{ tools_dir }}/gophish/config.json"
     owner: "{{ ansible_user }}"
     group: "{{ ansible_user }}"

tasks/security_hardening.yml

@@ -8,7 +8,7 @@
 
 - name: Set a custom MOTD
   template:
-    src: "motd.j2"
+    src: "../templates/motd.j2" 
     dest: /etc/motd
     owner: root
     group: root