n0mad1k
137 lines
4.3 KiB
YAML
137 lines
4.3 KiB
YAML
---
|
|
# Common task for configuring proper traffic flow between infrastructure components
|
|
|
|
- name: Determine server role in infrastructure
|
|
set_fact:
|
|
server_role: >-
|
|
{% if inventory_hostname in groups['c2servers'] | default([]) %}c2{%
|
|
elif inventory_hostname in groups['redirectors'] | default([]) %}redirector{%
|
|
elif inventory_hostname in groups['logservers'] | default([]) %}logserver{%
|
|
elif inventory_hostname in groups['payloadservers'] | default([]) %}payloadserver{%
|
|
elif inventory_hostname in groups['phishingservers'] | default([]) %}phishingserver{%
|
|
elif inventory_hostname in groups['sharedrives'] | default([]) %}sharedrive{%
|
|
else %}unknown{% endif %}
|
|
|
|
# Determine if we're using AWS provider
|
|
- name: Determine if using AWS provider
|
|
set_fact:
|
|
is_aws_provider: "{{ provider | default('unknown') == 'aws' }}"
|
|
|
|
# Skip firewall configuration for AWS instances
|
|
- name: Skip firewall configuration for AWS instances
|
|
debug:
|
|
msg: "Skipping host-based firewall configuration for AWS instance. Security Groups are handling this at the infrastructure level."
|
|
when: is_aws_provider
|
|
|
|
# UFW Configuration Block (non-AWS only)
|
|
- name: Configure C2 server routing with UFW
|
|
block:
|
|
- name: Allow SSH only from operator IP
|
|
ufw:
|
|
rule: allow
|
|
port: 22
|
|
src: "{{ operator_ip }}"
|
|
proto: tcp
|
|
|
|
- name: Allow teamserver access only from operator IP
|
|
ufw:
|
|
rule: allow
|
|
port: "{{ havoc_teamserver_port | default('40056') }}"
|
|
src: "{{ operator_ip }}"
|
|
proto: tcp
|
|
|
|
- name: Configure required flows for each connected component
|
|
ufw:
|
|
rule: allow
|
|
port: "{{ item.port }}"
|
|
src: "{{ item.ip }}"
|
|
proto: tcp
|
|
loop:
|
|
- { ip: "{{ redirector_ip }}", port: "80" }
|
|
- { ip: "{{ redirector_ip }}", port: "443" }
|
|
- { ip: "{{ redirector_ip }}", port: "{{ havoc_http_port | default('8080') }}" }
|
|
- { ip: "{{ redirector_ip }}", port: "{{ havoc_https_port | default('443') }}" }
|
|
- { ip: "{{ logserver_ip | default(omit) }}", port: "5144" }
|
|
- { ip: "{{ payloadserver_ip | default(omit) }}", port: "8888" }
|
|
when: item.ip != omit
|
|
when:
|
|
- server_role == 'c2'
|
|
- not is_aws_provider
|
|
|
|
# Rest of the original file for non-AWS providers only
|
|
- name: Configure redirector routing with UFW
|
|
block:
|
|
- name: Allow SSH only from operator IP
|
|
ufw:
|
|
rule: allow
|
|
port: 22
|
|
src: "{{ operator_ip }}"
|
|
proto: tcp
|
|
|
|
- name: Allow public web access
|
|
ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
loop:
|
|
- 80
|
|
- 443
|
|
|
|
- name: Allow shell handler access
|
|
ufw:
|
|
rule: allow
|
|
port: "{{ shell_handler_port | default('4444') }}"
|
|
proto: tcp
|
|
when:
|
|
- server_role == 'redirector'
|
|
- not is_aws_provider
|
|
|
|
- name: Configure logging server routing
|
|
block:
|
|
- name: Allow SSH only from operator IP
|
|
ufw:
|
|
rule: allow
|
|
port: 22
|
|
src: "{{ operator_ip }}"
|
|
proto: tcp
|
|
|
|
- name: Allow log ingestion from infrastructure
|
|
ufw:
|
|
rule: allow
|
|
port: 5144 # Logstash port
|
|
src: "{{ item }}"
|
|
proto: tcp
|
|
loop:
|
|
- "{{ c2_ip }}"
|
|
- "{{ redirector_ip }}"
|
|
- "{{ payloadserver_ip | default(omit) }}"
|
|
- "{{ phishingserver_ip | default(omit) }}"
|
|
when: item != omit
|
|
when:
|
|
- server_role == 'logserver'
|
|
- not is_aws_provider
|
|
|
|
- name: Update security group to allow SSH from C2 to redirector
|
|
block:
|
|
- name: Allow SSH from C2 to redirector (AWS)
|
|
amazon.aws.ec2_security_group:
|
|
name: "{{ redirector_name }}-sg"
|
|
description: "Security group for redirector {{ redirector_name }}"
|
|
vpc_id: "{{ vpc_id }}"
|
|
region: "{{ aws_redirector_region }}"
|
|
rules:
|
|
- proto: tcp
|
|
ports: 22
|
|
cidr_ip: "{{ c2_ip }}/32"
|
|
state: present
|
|
when: provider == "aws"
|
|
delegate_to: localhost
|
|
|
|
- name: Allow SSH from C2 to redirector (UFW)
|
|
ufw:
|
|
rule: allow
|
|
port: 22
|
|
src: "{{ c2_ip }}"
|
|
proto: tcp
|
|
when: provider != "aws" and not is_aws_provider
|
|
when: server_role == 'redirector' and c2_ip is defined and redirector_ip is defined |