n0mad1k
247 lines
7.1 KiB
YAML
247 lines
7.1 KiB
YAML
---
|
|
# Common task for configuring redirector
|
|
# Shared across all providers
|
|
|
|
- name: Install required packages for redirector
|
|
apt:
|
|
name:
|
|
- nginx
|
|
- certbot
|
|
- python3-certbot-nginx
|
|
- socat
|
|
- netcat-openbsd
|
|
- secure-delete
|
|
state: present
|
|
update_cache: yes
|
|
|
|
- name: Create directories for operational scripts
|
|
file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: '0700'
|
|
owner: root
|
|
group: root
|
|
with_items:
|
|
- /opt/c2
|
|
- /opt/shell-handler
|
|
|
|
- name: Copy clean-logs.sh script
|
|
copy:
|
|
src: "../files/clean-logs.sh"
|
|
dest: /opt/c2/clean-logs.sh
|
|
mode: '0700'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Copy shell handler script
|
|
copy:
|
|
src: "../files/persistent-listener.sh"
|
|
dest: /opt/shell-handler/persistent-listener.sh
|
|
mode: '0700'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Configure shell handler script with C2 IP
|
|
replace:
|
|
path: /opt/shell-handler/persistent-listener.sh
|
|
regexp: 'C2_HOST="127.0.0.1"'
|
|
replace: 'C2_HOST="{{ c2_ip }}"'
|
|
|
|
- name: Configure shell handler script with listening port
|
|
replace:
|
|
path: /opt/shell-handler/persistent-listener.sh
|
|
regexp: 'LISTEN_PORT=4444'
|
|
replace: 'LISTEN_PORT={{ shell_handler_port }}'
|
|
|
|
- name: Create shell handler service
|
|
template:
|
|
src: "../templates/shell-handler.service.j2"
|
|
dest: /etc/systemd/system/shell-handler.service
|
|
mode: '0644'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Configure NGINX for zero-logging if enabled
|
|
template:
|
|
src: "../templates/nginx.conf.j2"
|
|
dest: /etc/nginx/nginx.conf
|
|
mode: '0644'
|
|
owner: root
|
|
group: root
|
|
when: zero_logs | bool
|
|
|
|
# Configure nginx sites with default values - no certificate
|
|
- name: Configure NGINX site with HTTP (no SSL)
|
|
copy:
|
|
content: |
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name cdn.{{ domain }};
|
|
|
|
root /var/www/html;
|
|
index index.html;
|
|
|
|
# Primary location for legitimate website traffic
|
|
location / {
|
|
try_files $uri $uri/ =404;
|
|
}
|
|
|
|
# Special URI patterns for C2 traffic
|
|
# These will redirect to the actual C2 server
|
|
location /ajax/ {
|
|
proxy_pass http://{{ c2_ip }}:8888;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
}
|
|
|
|
# Static resources that actually redirect to C2
|
|
location ~ ^/static/(css|js|images)/.*\.(css|js|png|jpg|jpeg|gif|ico)$ {
|
|
proxy_pass http://{{ c2_ip }}:8888;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
}
|
|
|
|
# Additional security headers
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-XSS-Protection "1" mode=block;
|
|
add_header Referrer-Policy "no-referrer" always;
|
|
}
|
|
|
|
# Catch-all server block to respond to unknown hosts
|
|
server {
|
|
listen 80 default_server;
|
|
listen [::]:80 default_server;
|
|
|
|
# Redirect all unknown traffic to a legitimate-looking site
|
|
return 301 https://www.google.com;
|
|
|
|
# Disable logs
|
|
access_log off;
|
|
error_log /dev/null crit;
|
|
}
|
|
dest: /etc/nginx/sites-available/default
|
|
mode: '0644'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Create legitimate-looking index.html
|
|
copy:
|
|
content: |
|
|
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>CDN - Content Delivery Network</title>
|
|
<style>
|
|
body {
|
|
font-family: Arial, sans-serif;
|
|
margin: 0;
|
|
padding: 0;
|
|
background-color: #f4f4f4;
|
|
color: #333;
|
|
}
|
|
header {
|
|
background-color: #2c3e50;
|
|
color: white;
|
|
padding: 1em;
|
|
text-align: center;
|
|
}
|
|
.container {
|
|
width: 80%;
|
|
margin: 0 auto;
|
|
padding: 2em;
|
|
}
|
|
.card {
|
|
background-color: white;
|
|
border-radius: 5px;
|
|
padding: 1.5em;
|
|
margin-bottom: 1.5em;
|
|
box-shadow: 0 2px 5px rgba(0,0,0,0.1);
|
|
}
|
|
footer {
|
|
background-color: #2c3e50;
|
|
color: white;
|
|
text-align: center;
|
|
padding: 1em;
|
|
position: fixed;
|
|
bottom: 0;
|
|
width: 100%;
|
|
}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<header>
|
|
<h1>cdn.{{ domain }}</h1>
|
|
<p>Enterprise Content Delivery Network</p>
|
|
</header>
|
|
|
|
<div class="container">
|
|
<div class="card">
|
|
<h2>Welcome to Our CDN</h2>
|
|
<p>This server is part of our global content delivery network.</p>
|
|
</div>
|
|
</div>
|
|
|
|
<footer>
|
|
<p>© 2025 {{ domain }} CDN Services. All rights reserved.</p>
|
|
</footer>
|
|
</body>
|
|
</html>
|
|
dest: /var/www/html/index.html
|
|
mode: '0644'
|
|
owner: www-data
|
|
group: www-data
|
|
|
|
- name: Create SSL certificate setup instructions
|
|
copy:
|
|
content: |
|
|
#!/bin/bash
|
|
# Let's Encrypt Certificate Setup Script
|
|
# Run this after setting up DNS records pointing to this server
|
|
|
|
# Replace these with your actual values if needed
|
|
DOMAIN="{{ domain }}"
|
|
SUBDOMAIN="cdn"
|
|
EMAIL="admin@${DOMAIN}"
|
|
|
|
echo "================================================"
|
|
echo "Let's Encrypt Certificate Setup"
|
|
echo "================================================"
|
|
echo
|
|
echo "Before running this script, make sure:"
|
|
echo "1. DNS records are set up correctly"
|
|
echo " - ${SUBDOMAIN}.${DOMAIN} points to $(curl -s ifconfig.me)"
|
|
echo "2. Port 80 is open to the internet"
|
|
echo
|
|
echo "Run the following command to get your certificate:"
|
|
echo "certbot --nginx -d ${SUBDOMAIN}.${DOMAIN} --non-interactive --agree-tos -m ${EMAIL}"
|
|
echo
|
|
echo "================================================"
|
|
dest: /opt/c2/setup-cert.sh
|
|
mode: '0700'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Start and enable shell handler service
|
|
systemd:
|
|
name: shell-handler
|
|
state: started
|
|
enabled: yes
|
|
daemon_reload: yes
|
|
|
|
- name: Set up cron job for log cleaning if zero-logs enabled
|
|
cron:
|
|
name: "Clean logs"
|
|
minute: "0"
|
|
hour: "*/6"
|
|
job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
|
|
when: zero_logs | bool |