n0mad1k
96 lines
2.7 KiB
Bash
96 lines
2.7 KiB
Bash
#!/bin/bash
|
|
# Secure cleanup script for terminating the C2 infrastructure
|
|
|
|
# Configuration
|
|
SECURE_DELETE_PASSES=7
|
|
MEMORY_WIPE=true
|
|
SELF_DESTRUCT=false # Set to true for complete instance termination (if API available)
|
|
|
|
# Set secure umask
|
|
umask 077
|
|
|
|
# Function to securely delete files
|
|
secure_delete() {
|
|
local target=$1
|
|
echo "[+] Securely deleting: $target"
|
|
|
|
if command -v srm > /dev/null; then
|
|
srm -vzf $target 2>/dev/null
|
|
elif command -v shred > /dev/null; then
|
|
shred -vzfn $SECURE_DELETE_PASSES $target 2>/dev/null
|
|
else
|
|
# Fallback to dd if specialized tools aren't available
|
|
dd if=/dev/urandom of=$target bs=1M count=10 conv=notrunc 2>/dev/null
|
|
dd if=/dev/zero of=$target bs=1M count=10 conv=notrunc 2>/dev/null
|
|
rm -f $target 2>/dev/null
|
|
fi
|
|
}
|
|
|
|
echo "[+] Beginning secure exit procedure..."
|
|
|
|
# Stop all operational services
|
|
echo "[+] Stopping operational services..."
|
|
services=("nginx" "sliver" "shell-handler" "gophish" "metasploit" "postgresql" "tor" "opendkim" "postfix" "dovecot")
|
|
for service in "${services[@]}"; do
|
|
systemctl stop $service 2>/dev/null
|
|
service $service stop 2>/dev/null
|
|
done
|
|
|
|
# Kill any remaining operational processes
|
|
echo "[+] Terminating operational processes..."
|
|
process_names=("nginx" "sliver" "msfconsole" "meterpreter" "ruby" "nc" "netcat" "socat" "python" "tor")
|
|
for proc in "${process_names[@]}"; do
|
|
pkill -9 $proc 2>/dev/null
|
|
done
|
|
|
|
# Clear all logs
|
|
echo "[+] Clearing logs..."
|
|
bash /opt/c2/clean-logs.sh
|
|
|
|
# Securely delete operational files
|
|
echo "[+] Removing operational files..."
|
|
operational_dirs=(
|
|
"/opt/c2"
|
|
"/opt/beacons"
|
|
"/opt/payloads"
|
|
"/root/.sliver"
|
|
"/root/.msf4"
|
|
"/root/.gophish"
|
|
"/root/Tools"
|
|
"/home/*/Tools"
|
|
"/var/www/html"
|
|
)
|
|
|
|
for dir in "${operational_dirs[@]}"; do
|
|
find $dir -type f 2>/dev/null | while read file; do
|
|
secure_delete "$file"
|
|
done
|
|
rm -rf $dir 2>/dev/null
|
|
done
|
|
|
|
# Remove SSH keys
|
|
echo "[+] Removing SSH keys and configs..."
|
|
find /home/*/.ssh /root/.ssh -type f 2>/dev/null | while read file; do
|
|
secure_delete "$file"
|
|
done
|
|
|
|
# Clean memory if requested
|
|
if $MEMORY_WIPE; then
|
|
echo "[+] Wiping system memory..."
|
|
sync
|
|
echo 3 > /proc/sys/vm/drop_caches
|
|
swapoff -a
|
|
swapon -a
|
|
fi
|
|
|
|
# Self-destruct if configured (for cloud providers with API access)
|
|
if $SELF_DESTRUCT; then
|
|
echo "[+] Initiating self-destruct sequence..."
|
|
# This would typically call the cloud provider's API to terminate the instance
|
|
# For FlokiNET, this would need to be handled manually
|
|
fi
|
|
|
|
echo "[+] Secure exit completed. Infrastructure has been sanitized."
|
|
|
|
# Remove this script itself
|
|
exec shred -n $SECURE_DELETE_PASSES -uz $0 |