Operator
0799bfbae8
Sanitized version of red team infrastructure automation platform. Operational content (implant pipelines, lures, credential capture) replaced with documented stubs. Architecture and infrastructure automation code intact.
134 lines
3.8 KiB
YAML
134 lines
3.8 KiB
YAML
---
|
|
# Advanced evasion techniques for red team phishing
|
|
|
|
- name: Install advanced evasion tools
|
|
apt:
|
|
name:
|
|
- python3-dnspython
|
|
- python3-requests
|
|
- python3-selenium
|
|
- chromium-browser
|
|
- chromium-chromedriver
|
|
- tor
|
|
- proxychains4
|
|
state: present
|
|
|
|
- name: Create SMTP smuggling configuration
|
|
template:
|
|
src: "../templates/smtp-smuggling.py.j2"
|
|
dest: "/root/Tools/phishing/smtp-smuggling.py"
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
when: enable_smtp_smuggling | default(false) | bool
|
|
|
|
- name: Configure SPF bypass techniques
|
|
template:
|
|
src: "../templates/spf-bypass.sh.j2"
|
|
dest: "/root/Tools/phishing/spf-bypass.sh"
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
when: enable_spf_bypass | default(false) | bool
|
|
|
|
- name: Create domain aging simulation
|
|
template:
|
|
src: "../templates/domain-aging.py.j2"
|
|
dest: "/root/Tools/phishing/domain-aging.py"
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
when: aged_domain_mode | default(false) | bool
|
|
|
|
- name: Set up MTA fronting configuration
|
|
template:
|
|
src: "../templates/mta-fronting.conf.j2"
|
|
dest: "/etc/postfix/mta_fronting.cf"
|
|
mode: '0644'
|
|
owner: root
|
|
group: root
|
|
when: enable_mta_fronting | default(false) | bool
|
|
notify: restart postfix
|
|
|
|
- name: Create file format manipulation tools
|
|
copy:
|
|
src: "{{ item.src }}"
|
|
dest: "{{ item.dest }}"
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
with_items:
|
|
# Note: These files need to be created or paths need to be verified
|
|
# - { src: "../files/pdf-weaponizer.py", dest: "/root/Tools/phishing/pdf-weaponizer.py" }
|
|
# - { src: "../files/office-macro-generator.py", dest: "/root/Tools/phishing/office-macro-generator.py" }
|
|
# - { src: "../files/lnk-generator.py", dest: "/root/Tools/phishing/lnk-generator.py" }
|
|
[]
|
|
|
|
- name: Create Living off the Land (LOtL) payload templates
|
|
template:
|
|
src: "{{ item.src }}"
|
|
dest: "{{ item.dest }}"
|
|
mode: '0644'
|
|
owner: root
|
|
group: root
|
|
with_items:
|
|
- { src: "../templates/lotl-powershell.ps1.j2", dest: "/root/Tools/phishing/templates/lotl-powershell.ps1" }
|
|
- { src: "../templates/lotl-wmic.cmd.j2", dest: "/root/Tools/phishing/templates/lotl-wmic.cmd" }
|
|
- { src: "../templates/lotl-bitsadmin.cmd.j2", dest: "/root/Tools/phishing/templates/lotl-bitsadmin.cmd" }
|
|
|
|
- name: Set up CDN abuse configuration
|
|
template:
|
|
src: "../templates/cdn-abuse.py.j2"
|
|
dest: "/root/Tools/phishing/cdn-abuse.py"
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
when: enable_cdn_abuse | default(false) | bool
|
|
|
|
- name: Create domain reputation monitoring
|
|
template:
|
|
src: "../templates/reputation-monitor.py.j2"
|
|
dest: "/root/Tools/phishing/reputation-monitor.py"
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Set up cron job for reputation monitoring
|
|
cron:
|
|
name: "Domain reputation monitoring"
|
|
minute: "0"
|
|
hour: "*/4"
|
|
job: "/root/Tools/phishing/reputation-monitor.py >> /root/Tools/phishing/logs/reputation.log 2>&1"
|
|
|
|
- name: Create email header spoofing tools
|
|
template:
|
|
src: "../templates/header-spoofing.py.j2"
|
|
dest: "/root/Tools/phishing/header-spoofing.py"
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Configure Tor for anonymization
|
|
template:
|
|
src: "../templates/torrc-phishing.j2"
|
|
dest: "/etc/tor/torrc"
|
|
backup: yes
|
|
notify: restart tor
|
|
when: enable_tor_routing | default(false) | bool
|
|
|
|
- name: Create user-agent rotation script
|
|
template:
|
|
src: "../templates/user-agent-rotation.py.j2"
|
|
dest: "/root/Tools/phishing/user-agent-rotation.py"
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Set up automated evasion techniques
|
|
template:
|
|
src: "../templates/automated-evasion.py.j2"
|
|
dest: "/root/Tools/phishing/automated-evasion.py"
|
|
mode: '0755'
|
|
owner: root
|
|
group: root
|
|
when: enable_automated_evasion | default(false) | bool |