n0mad1k
118 lines
3.2 KiB
YAML
118 lines
3.2 KiB
YAML
---
|
|
- name: Configure FlokiNET redirector server
|
|
hosts: redirector
|
|
gather_facts: true
|
|
vars_files:
|
|
- vars.yaml
|
|
tasks:
|
|
- name: Install Nginx and required packages
|
|
ansible.builtin.apt:
|
|
name:
|
|
- nginx
|
|
- certbot
|
|
- python3-certbot-nginx
|
|
- socat
|
|
- netcat-openbsd
|
|
- cryptsetup
|
|
- secure-delete
|
|
- jq
|
|
state: present
|
|
become: true
|
|
|
|
- name: Add UFW rules for redirector
|
|
ansible.builtin.ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
with_items:
|
|
- 80
|
|
- 443
|
|
- "{{ shell_handler_port }}"
|
|
become: true
|
|
|
|
- name: Setup directory for shell handler
|
|
ansible.builtin.file:
|
|
path: /opt/shell-handler
|
|
state: directory
|
|
mode: '0700'
|
|
owner: root
|
|
group: root
|
|
become: true
|
|
|
|
- name: Copy shell handler script
|
|
ansible.builtin.copy:
|
|
src: "../files/persistent-listener.sh"
|
|
dest: "/opt/shell-handler/persistent-listener.sh"
|
|
mode: '0700'
|
|
owner: root
|
|
group: root
|
|
become: true
|
|
|
|
- name: Configure shell handler service
|
|
ansible.builtin.template:
|
|
src: templates/shell-handler.service.j2
|
|
dest: /etc/systemd/system/shell-handler.service
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
become: true
|
|
|
|
- name: Configure NGINX for zero-logging
|
|
ansible.builtin.template:
|
|
src: templates/nginx.conf.j2
|
|
dest: /etc/nginx/nginx.conf
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
become: true
|
|
|
|
- name: Configure NGINX default site for C2 redirection
|
|
ansible.builtin.template:
|
|
src: templates/default-site.j2
|
|
dest: /etc/nginx/sites-available/default
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
vars:
|
|
domain: "{{ redirector_subdomain }}.{{ domain }}"
|
|
c2_host: "{{ c2_ip }}"
|
|
become: true
|
|
|
|
- name: Create index.html for legitimate-looking website
|
|
ansible.builtin.template:
|
|
src: templates/index.html.j2
|
|
dest: /var/www/html/index.html
|
|
owner: www-data
|
|
group: www-data
|
|
mode: '0644'
|
|
become: true
|
|
|
|
- name: Start and enable shell handler service
|
|
ansible.builtin.systemd:
|
|
name: shell-handler
|
|
state: started
|
|
enabled: yes
|
|
daemon_reload: yes
|
|
become: true
|
|
|
|
- name: Install Let's Encrypt certificate if domain specified
|
|
ansible.builtin.command: >
|
|
certbot --nginx -d {{ redirector_subdomain }}.{{ domain }} --non-interactive --agree-tos -m {{ letsencrypt_email }}
|
|
args:
|
|
creates: /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/fullchain.pem
|
|
become: true
|
|
when: domain != "example.com"
|
|
|
|
- name: Restart Nginx
|
|
ansible.builtin.service:
|
|
name: nginx
|
|
state: restarted
|
|
become: true
|
|
|
|
- name: Display redirector setup information
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- "Redirector setup completed!"
|
|
- "IP Address: {{ ansible_host }}"
|
|
- "Domain: {{ redirector_subdomain }}.{{ domain }}"
|
|
- "Shell Handler Port: {{ shell_handler_port }}" |