Operator
0799bfbae8
Sanitized version of red team infrastructure automation platform. Operational content (implant pipelines, lures, credential capture) replaced with documented stubs. Architecture and infrastructure automation code intact.
80 lines
2.5 KiB
Django/Jinja
80 lines
2.5 KiB
Django/Jinja
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name {{ domain }};
|
|
|
|
# Redirect to HTTPS
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
server_name {{ domain }};
|
|
|
|
# SSL Configuration
|
|
ssl_certificate /etc/letsencrypt/live/{{ domain }}/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/{{ domain }}/privkey.pem;
|
|
|
|
# Root directory
|
|
root /var/www/html;
|
|
index index.html;
|
|
|
|
# Primary location for legitimate website traffic
|
|
location / {
|
|
try_files $uri $uri/ =404;
|
|
}
|
|
|
|
# Special URI patterns for C2 traffic
|
|
# These will redirect to the actual C2 server
|
|
|
|
# Sliver HTTP C2 channel
|
|
location /ajax/ {
|
|
proxy_pass http://{{ c2_host }}:8888;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
}
|
|
|
|
# Static resources that actually redirect to C2
|
|
location ~ ^/static/(css|js|images)/.*\.(css|js|png|jpg|jpeg|gif|ico)$ {
|
|
proxy_pass http://{{ c2_host }}:8888;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
}
|
|
|
|
# Additional security headers
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header Referrer-Policy "no-referrer" always;
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;" always;
|
|
|
|
# Disable logging for this server block
|
|
access_log off;
|
|
error_log /dev/null crit;
|
|
}
|
|
|
|
# Catch-all server block to respond to unknown hosts
|
|
server {
|
|
listen 80 default_server;
|
|
listen [::]:80 default_server;
|
|
listen 443 ssl default_server;
|
|
listen [::]:443 ssl default_server;
|
|
|
|
# Self-signed cert for catch-all
|
|
ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
|
|
ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
|
|
|
|
# Redirect all unknown traffic to a legitimate-looking site
|
|
return 301 https://www.google.com;
|
|
|
|
# Disable logs
|
|
access_log off;
|
|
error_log /dev/null crit;
|
|
} |