n0mad1k
155 lines
3.5 KiB
YAML
155 lines
3.5 KiB
YAML
---
|
|
# Common tasks for configuring C2 server with EDR evasion
|
|
# Shared across all providers
|
|
|
|
- name: Update apt cache
|
|
apt:
|
|
update_cache: yes
|
|
|
|
- name: Set a custom MOTD
|
|
template:
|
|
src: "../templates/motd-linode.j2"
|
|
dest: /etc/motd
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
|
|
- name: Install base utilities and tools via apt
|
|
apt:
|
|
name:
|
|
- git
|
|
- wget
|
|
- curl
|
|
- unzip
|
|
- python3-pip
|
|
- python3-venv
|
|
- tmux
|
|
- pipx
|
|
- nmap
|
|
- tcpdump
|
|
- hydra
|
|
- john
|
|
- hashcat
|
|
- sqlmap
|
|
- gobuster
|
|
- dirb
|
|
- enum4linux
|
|
- dnsenum
|
|
- seclists
|
|
- responder
|
|
- golang
|
|
- proxychains
|
|
- tor
|
|
- crackmapexec
|
|
- jq
|
|
- unzip
|
|
- postfix
|
|
- certbot
|
|
- opendkim
|
|
- opendkim-tools
|
|
- dovecot-core
|
|
- dovecot-imapd
|
|
- dovecot-pop3d
|
|
- dovecot-sieve
|
|
- dovecot-managesieved
|
|
- yq
|
|
- build-essential
|
|
state: present
|
|
|
|
- name: Create directories for operational scripts
|
|
file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: '0700'
|
|
owner: root
|
|
group: root
|
|
with_items:
|
|
- /opt/c2
|
|
- /opt/beacons
|
|
- /opt/payloads
|
|
|
|
- name: Copy operational scripts
|
|
copy:
|
|
src: "{{ item }}"
|
|
dest: "/opt/c2/{{ item | basename }}"
|
|
mode: '0700'
|
|
owner: root
|
|
group: root
|
|
with_items:
|
|
- ../files/clean-logs.sh
|
|
- ../files/secure-exit.sh
|
|
- ../files/serve-beacons.sh
|
|
- ../files/sliver_randomizer.sh
|
|
- ../files/generate_evasive_beacons.sh
|
|
|
|
- name: Remove standard Sliver if installed
|
|
apt:
|
|
name: sliver
|
|
state: absent
|
|
ignore_errors: yes
|
|
|
|
- name: Stop standard Sliver service if running
|
|
systemd:
|
|
name: sliver
|
|
state: stopped
|
|
enabled: no
|
|
ignore_errors: yes
|
|
|
|
- name: Run Sliver randomization for EDR evasion
|
|
shell: /opt/c2/sliver_randomizer.sh
|
|
args:
|
|
creates: /opt/c2/sliver-profiles/evasive-template.json
|
|
register: randomization_result
|
|
|
|
- name: Create custom Sliver service file
|
|
template:
|
|
src: "../templates/sliver-server.service.j2"
|
|
dest: /etc/systemd/system/sliver.service
|
|
mode: '0644'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Enable and start custom Sliver service
|
|
systemd:
|
|
name: sliver
|
|
state: started
|
|
enabled: yes
|
|
daemon_reload: yes
|
|
|
|
- name: Wait for Sliver to initialize
|
|
pause:
|
|
seconds: 10
|
|
|
|
- name: Generate evasive beacons
|
|
shell: /opt/c2/generate_evasive_beacons.sh {{ ansible_host }}
|
|
args:
|
|
creates: /opt/beacons/reference.txt
|
|
|
|
- name: Set up cron job for log cleaning if zero-logs enabled
|
|
cron:
|
|
name: "Clean logs"
|
|
minute: "0"
|
|
hour: "*/6"
|
|
job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
|
|
when: zero_logs | bool
|
|
|
|
- name: Configure and start beacon server
|
|
shell: |
|
|
sed -i "s/C2_HOST=.*/C2_HOST=\"{{ ansible_host }}\"/g" /opt/c2/serve-beacons.sh
|
|
chmod +x /opt/c2/serve-beacons.sh
|
|
# Check if beacon server is already running
|
|
if ! pgrep -f "/opt/c2/serve-beacons.sh" > /dev/null; then
|
|
nohup /opt/c2/serve-beacons.sh > /dev/null 2>&1 &
|
|
fi
|
|
|
|
- name: Install Let's Encrypt certificate if domain specified
|
|
shell: |
|
|
certbot certonly --standalone -d {{ c2_subdomain }}.{{ domain }} --non-interactive --agree-tos -m {{ letsencrypt_email }}
|
|
args:
|
|
creates: /etc/letsencrypt/live/{{ c2_subdomain }}.{{ domain }}/fullchain.pem
|
|
when: domain != "example.com"
|
|
|
|
# Include integrated tracker tasks if requested
|
|
- name: Include integrated tracker setup
|
|
include_tasks: "configure_integrated_tracker.yml"
|
|
when: setup_integrated_tracker | default(false) | bool |