diff --git a/Linode/c2.yml b/Linode/c2.yml index 5f48b8f..31a382b 100644 --- a/Linode/c2.yml +++ b/Linode/c2.yml @@ -118,10 +118,7 @@ - name: Include common C2 configuration tasks include_tasks: "../tasks/configure_c2.yml" - - - name: Include common security hardening tasks - include_tasks: "../tasks/security_hardening.yml" - + - name: Include common mail server configuration tasks include_tasks: "../tasks/configure_mail.yml" diff --git a/ansible.cfg b/ansible.cfg new file mode 100644 index 0000000..a0f8b3b --- /dev/null +++ b/ansible.cfg @@ -0,0 +1,8 @@ +[defaults] +host_key_checking = False +timeout = 30 + +[ssh_connection] +ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o ServerAliveInterval=30 -o ServerAliveCountMax=10 +pipelining = True +retries = 5 diff --git a/tasks/configure_c2.yml b/tasks/configure_c2.yml index 8d300be..8f7eadb 100644 --- a/tasks/configure_c2.yml +++ b/tasks/configure_c2.yml @@ -8,7 +8,7 @@ - name: Set a custom MOTD template: - src: "../templates/motd-linode.j2" + src: "../templates/motd.j2" dest: /etc/motd owner: root group: root @@ -134,8 +134,19 @@ - name: Install Havoc C2 Framework shell: "/root/Tools/havoc_installer.sh" args: - creates: "/root/Tools/havoc/Teamserver/teamserver" - register: havoc_installation_result + creates: "/root/Tools/havoc/teamserver/havoc" + async: 1800 # Allow 30 minutes for completion + poll: 0 # Don't wait for completion + register: havoc_installation_job + +- name: Wait for Havoc installation to complete + async_status: + jid: "{{ havoc_installation_job.ansible_job_id }}" + register: job_result + until: job_result.finished + retries: 60 # Check every 30 seconds for up to 30 minutes + delay: 30 + when: havoc_installation_job is defined - name: Display Havoc installation output debug: diff --git a/tasks/security_hardening.yml b/tasks/security_hardening.yml deleted file mode 100644 index 94588e0..0000000 --- a/tasks/security_hardening.yml +++ /dev/null @@ -1,136 +0,0 @@ ---- -# Common task for configuring C2 server -# Shared across all providers - -- name: Update apt cache - apt: - update_cache: yes - -- name: Set a custom MOTD - template: - src: "../templates/motd.j2" - dest: /etc/motd - owner: root - group: root - mode: '0644' - -- name: Install base utilities and tools via apt - apt: - name: - - git - - wget - - curl - - unzip - - python3-pip - - python3-venv - - tmux - - pipx - - nmap - - tcpdump - - hydra - - john - - hashcat - - sqlmap - - gobuster - - dirb - - enum4linux - - dnsenum - - seclists - - responder - - golang - - proxychains - - tor - - crackmapexec - - jq - - unzip - - postfix - - certbot - - opendkim - - opendkim-tools - - dovecot-core - - dovecot-imapd - - dovecot-pop3d - - dovecot-sieve - - dovecot-managesieved - - yq - state: present - -- name: Copy operational scripts - copy: - src: "{{ item }}" - dest: "/root/Tools/{{ item }}" - mode: '0700' - owner: root - group: root - with_items: - - clean-logs.sh - - secure-exit.sh - - serve-beacons.sh - -- name: Create operational directories - file: - path: "{{ item }}" - state: directory - mode: '0700' - owner: root - group: root - with_items: - - /root/Tools - - /root/Tools/beacons - - /root/Tools/payloads - -- name: Create Havoc service file - copy: - content: | - [Unit] - Description=Havoc C2 Server - After=network.target - - [Service] - Type=simple - User=root - Group=root - WorkingDirectory=/root/Tools/havoc/Teamserver - ExecStart=/root/Tools/havoc/Teamserver/havoc server -d - Restart=always - RestartSec=10 - - # Security measures - PrivateTmp=true - ProtectHome=false - NoNewPrivileges=true - - # Hide process information - StandardOutput=null - StandardError=null - - [Install] - WantedBy=multi-user.target - dest: /etc/systemd/system/havoc.service - mode: '0644' - owner: root - group: root - -- name: Set up cron job for log cleaning if zero-logs enabled - cron: - name: "Clean logs" - minute: "0" - hour: "*/6" - job: "/root/Tools/clean-logs.sh > /dev/null 2>&1" - when: zero_logs | bool - -- name: Install Let's Encrypt certificate if domain specified - shell: | - certbot certonly --standalone -d {{ c2_subdomain }}.{{ domain }} --non-interactive --agree-tos -m {{ letsencrypt_email }} - args: - creates: /etc/letsencrypt/live/{{ c2_subdomain }}.{{ domain }}/fullchain.pem - when: domain != "example.com" - -- name: Configure and start beacon server - shell: | - sed -i "s/C2_HOST=.*/C2_HOST=\"{{ ansible_host }}\"/g" /root/Tools/serve-havoc-payloads.sh - chmod +x /root/Tools/serve-havoc-payloads.sh - # Check if beacon server is already running - if ! pgrep -f "/root/Tools/serve-havoc-payloads.sh" > /dev/null; then - nohup /root/Tools/serve-havoc-payloads.sh > /dev/null 2>&1 & - fi \ No newline at end of file