Operator
0799bfbae8
Sanitized version of red team infrastructure automation platform. Operational content (implant pipelines, lures, credential capture) replaced with documented stubs. Architecture and infrastructure automation code intact.
85 lines
2.4 KiB
YAML
85 lines
2.4 KiB
YAML
---
|
|
# Configure phishing web server with landing pages and credential capture
|
|
|
|
- name: Install required packages
|
|
apt:
|
|
name:
|
|
- nginx
|
|
- php-fpm
|
|
- php-json
|
|
- certbot
|
|
- python3-certbot-nginx
|
|
state: present
|
|
update_cache: yes
|
|
|
|
- name: Create web directories
|
|
file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: '0755'
|
|
owner: www-data
|
|
group: www-data
|
|
loop:
|
|
- /var/www/phishing
|
|
- /var/www/phishing/templates
|
|
- /var/www/phishing/static
|
|
- /var/www/phishing/captures
|
|
- /var/private/phishing_creds
|
|
|
|
- name: Deploy phishing templates
|
|
template:
|
|
src: "{{ item.src }}"
|
|
dest: "{{ item.dest }}"
|
|
mode: '0644'
|
|
owner: www-data
|
|
group: www-data
|
|
loop:
|
|
- { src: "../templates/phishing/phishing-landing-page.j2", dest: "/var/www/phishing/index.html" }
|
|
- { src: "../templates/phishing/email-templates/office365_login.j2", dest: "/var/www/phishing/templates/o365.html" }
|
|
- { src: "../templates/phishing/email-templates/password_expiry.j2", dest: "/var/www/phishing/templates/password.html" }
|
|
- { src: "../templates/phishing/email-templates/security_alert.j2", dest: "/var/www/phishing/templates/security.html" }
|
|
- { src: "../templates/phishing/email-templates/file_share.j2", dest: "/var/www/phishing/templates/share.html" }
|
|
|
|
- name: Deploy credential capture script
|
|
template:
|
|
src: "../templates/phishing/capture.php.j2"
|
|
dest: "/var/www/phishing/capture.php"
|
|
mode: '0640'
|
|
owner: www-data
|
|
group: www-data
|
|
|
|
- name: Configure NGINX for phishing sites
|
|
template:
|
|
src: "../templates/phishing/nginx-phishing-webserver.j2"
|
|
dest: /etc/nginx/sites-available/phishing
|
|
mode: '0644'
|
|
|
|
- name: Enable phishing site
|
|
file:
|
|
src: /etc/nginx/sites-available/phishing
|
|
dest: /etc/nginx/sites-enabled/phishing
|
|
state: link
|
|
|
|
- name: Remove default nginx site
|
|
file:
|
|
path: /etc/nginx/sites-enabled/default
|
|
state: absent
|
|
|
|
- name: Configure PHP-FPM for security
|
|
lineinfile:
|
|
path: /etc/php/7.4/fpm/php.ini
|
|
regexp: "{{ item.regexp }}"
|
|
line: "{{ item.line }}"
|
|
loop:
|
|
- { regexp: '^expose_php', line: 'expose_php = Off' }
|
|
- { regexp: '^display_errors', line: 'display_errors = Off' }
|
|
- { regexp: '^log_errors', line: 'log_errors = On' }
|
|
|
|
- name: Restart services
|
|
systemd:
|
|
name: "{{ item }}"
|
|
state: restarted
|
|
enabled: yes
|
|
loop:
|
|
- nginx
|
|
- php7.4-fpm |