n0mad1k
479 lines
17 KiB
YAML
479 lines
17 KiB
YAML
---
|
|
- name: Create and configure AWS EC2 instance for C2 Server
|
|
hosts: localhost
|
|
gather_facts: false
|
|
connection: local
|
|
vars_files:
|
|
- vars.yaml
|
|
vars:
|
|
ssh_user: "kali"
|
|
|
|
tasks:
|
|
- block:
|
|
- name: Select a random AWS region
|
|
set_fact:
|
|
selected_aws_region: "{{ aws_region_choices | random }}"
|
|
|
|
- name: Set AMI ID based on region
|
|
set_fact:
|
|
aws_ami: "{{ ami_map[selected_aws_region] }}"
|
|
|
|
- name: Create an EC2 key pair
|
|
amazon.aws.ec2_key:
|
|
access_key: "{{ aws_access_key }}"
|
|
secret_key: "{{ aws_secret_key }}"
|
|
name: "{{ instance_label }}"
|
|
region: "{{ selected_aws_region }}"
|
|
state: present
|
|
register: key_pair
|
|
|
|
- name: Save private key locally
|
|
copy:
|
|
content: "{{ key_pair.key.private_key }}"
|
|
dest: "~/.ssh/{{ instance_label }}.pem"
|
|
mode: "0600"
|
|
when: key_pair.changed
|
|
|
|
- name: Check if a security group with required properties already exists
|
|
amazon.aws.ec2_security_group_info:
|
|
filters:
|
|
group-name: "security-sg"
|
|
region: "{{ selected_aws_region }}"
|
|
aws_access_key: "{{ aws_access_key }}"
|
|
aws_secret_key: "{{ aws_secret_key }}"
|
|
register: existing_sg
|
|
ignore_errors: yes
|
|
|
|
- name: Create a security group for the instance if it doesn't exist
|
|
amazon.aws.ec2_group:
|
|
name: "security-sg"
|
|
description: "Completely open security group for instance {{ instance_label }}"
|
|
region: "{{ selected_aws_region }}"
|
|
aws_access_key: "{{ aws_access_key }}"
|
|
aws_secret_key: "{{ aws_secret_key }}"
|
|
rules:
|
|
- proto: -1 # Allow all protocols
|
|
cidr_ip: "0.0.0.0/0" # Open to all IPv4 addresses
|
|
rules_egress:
|
|
- proto: -1
|
|
cidr_ip: "0.0.0.0/0"
|
|
when: existing_sg.security_groups | length == 0
|
|
register: c2_sg_result
|
|
|
|
- name: Launch EC2 instance
|
|
amazon.aws.ec2_instance:
|
|
aws_access_key: "{{ aws_access_key | default(omit) }}"
|
|
aws_secret_key: "{{ aws_secret_key | default(omit) }}"
|
|
region: "{{ selected_aws_region }}"
|
|
name: "{{ instance_label }}"
|
|
image_id: "{{ aws_ami }}"
|
|
instance_type: "{{ aws_instance_type }}"
|
|
key_name: "{{ instance_label }}"
|
|
security_groups:
|
|
- "security-sg"
|
|
wait: no
|
|
volumes:
|
|
- device_name: "/dev/xvda"
|
|
ebs:
|
|
volume_size: 100
|
|
delete_on_termination: true
|
|
register: ec2_instance
|
|
|
|
- name: Set instance_id fact for cleanup
|
|
set_fact:
|
|
instance_id: "{{ ec2_instance.instance_ids[0] | default('') }}"
|
|
when: ec2_instance.instances is defined and ec2_instance.instances | length > 0
|
|
|
|
- name: Wait for EC2 instance to reach running state
|
|
amazon.aws.ec2_instance_info:
|
|
aws_access_key: "{{ aws_access_key | default(omit) }}"
|
|
aws_secret_key: "{{ aws_secret_key | default(omit) }}"
|
|
region: "{{ selected_aws_region }}"
|
|
instance_ids: "{{ ec2_instance.instance_ids }}"
|
|
register: instance_info
|
|
retries: 10
|
|
delay: 30
|
|
until: instance_info.instances[0].state.name == "running"
|
|
|
|
- name: Fetch the public IP of the instance
|
|
command: >
|
|
aws ec2 describe-instances
|
|
--filters "Name=tag:Name,Values={{ instance_label }}"
|
|
"Name=instance-state-name,Values=running"
|
|
--query "Reservations[*].Instances[*].PublicIpAddress"
|
|
--output text
|
|
register: instance_ip_result
|
|
environment:
|
|
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
|
|
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
|
|
AWS_DEFAULT_REGION: "{{ selected_aws_region }}"
|
|
retries: 3
|
|
delay: 200
|
|
until: instance_ip_result.stdout is not none and instance_ip_result.stdout != ""
|
|
|
|
- name: Set instance_public_ip variable
|
|
ansible.builtin.set_fact:
|
|
instance_public_ip: "{{ instance_ip_result.stdout | trim }}"
|
|
when: instance_ip_result is defined and instance_ip_result.stdout != ""
|
|
|
|
- name: Add EC2 instance to inventory
|
|
add_host:
|
|
name: "{{ instance_label }}"
|
|
ansible_host: "{{ instance_public_ip }}"
|
|
ansible_user: kali
|
|
ansible_ssh_private_key_file: "{{ private_key_path }}.pem"
|
|
ansible_ssh_common_args: '-o IdentitiesOnly=yes'
|
|
|
|
- name: Pause for 300 seconds to allow instance initialization
|
|
ansible.builtin.pause:
|
|
seconds: 300
|
|
|
|
- name: Validate SSH connection with retries
|
|
block:
|
|
- name: Attempt SSH connection
|
|
ansible.builtin.command:
|
|
cmd: ssh -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -i "{{ private_key_path }}.pem" kali@{{ instance_public_ip }} echo "SSH connection successful"
|
|
delay: 100 # Adjust delay if needed
|
|
retries: 2
|
|
register: ssh_validation_result
|
|
ignore_errors: yes
|
|
|
|
- name: Fail if SSH validation fails
|
|
ansible.builtin.fail:
|
|
msg: "SSH connection validation failed. Check instance settings, SSH key, and security group."
|
|
when: (ssh_validation_result is not defined or ssh_validation_result.rc != 0)
|
|
|
|
- name: Configure AWS EC2 instance
|
|
hosts: "{{ instance_label }}"
|
|
gather_facts: true
|
|
tasks:
|
|
|
|
- name: Set a custom MOTD
|
|
template:
|
|
src: motd-aws.j2
|
|
dest: /etc/motd
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
become: true
|
|
vars:
|
|
letsencrypt_email: "{{ letsencrypt_email }}"
|
|
mail_hostname: "{{ mail_hostname }}"
|
|
domain: "{{ domain }}"
|
|
gophish_admin_domain: "{{ gophish_admin_domain }}"
|
|
gophish_site_domain: "{{ gophish_site_domain }}"
|
|
|
|
- name: Hush Default Login Message
|
|
become: true
|
|
ansible.builtin.shell: |
|
|
rm -rf '/usr/bin/kali-motd'
|
|
|
|
- name: Update apt package list
|
|
ansible.builtin.apt:
|
|
update_cache: yes
|
|
become: true
|
|
|
|
- name: Install base utilities and tools via apt
|
|
become: true
|
|
ansible.builtin.apt:
|
|
name:
|
|
- git
|
|
- wget
|
|
- curl
|
|
- unzip
|
|
- python3-pip
|
|
- python3-venv
|
|
- tmux
|
|
- pipx
|
|
- nmap
|
|
- tcpdump
|
|
- hydra
|
|
- john
|
|
- hashcat
|
|
- sqlmap
|
|
- gobuster
|
|
- dirb
|
|
- enum4linux
|
|
- dnsenum
|
|
- seclists
|
|
- responder
|
|
- golang
|
|
- proxychains
|
|
- tor
|
|
- crackmapexec
|
|
- jq
|
|
- unzip
|
|
- postfix
|
|
- certbot
|
|
- opendkim
|
|
- opendkim-tools
|
|
- dovecot-core
|
|
- dovecot-imapd
|
|
- dovecot-pop3d
|
|
- dovecot-sieve
|
|
- dovecot-managesieved
|
|
- yq
|
|
state: present
|
|
|
|
- name: Ensure pipx path is configured
|
|
ansible.builtin.shell: |
|
|
pipx ensurepath
|
|
become: true
|
|
args:
|
|
executable: /bin/bash
|
|
|
|
- name: Create Tools dir
|
|
ansible.builtin.shell: |
|
|
mkdir /home/kali/Tools
|
|
|
|
- name: Install tools via pipx
|
|
ansible.builtin.shell: |
|
|
export PATH=$PATH:/root/.local/bin
|
|
pipx ensurepath
|
|
pipx install git+https://github.com/Pennyw0rth/NetExec
|
|
pipx install git+https://github.com/blacklanternsecurity/TREVORspray
|
|
pipx install impacket
|
|
become: true
|
|
args:
|
|
executable: /bin/bash
|
|
|
|
- name: Download Kerbrute
|
|
ansible.builtin.shell: |
|
|
mkdir -p /home/kali/Tools/Kerbrute
|
|
wget https://github.com/ropnop/kerbrute/releases/latest/download/kerbrute_linux_amd64 -O /home/kali/Tools/Kerbrute/kerbrute
|
|
chmod +x /home/kali/Tools/Kerbrute/kerbrute
|
|
become: true
|
|
args:
|
|
executable: /bin/bash
|
|
|
|
- name: Clone SharpCollection nightly builds
|
|
ansible.builtin.git:
|
|
repo: https://github.com/Flangvik/SharpCollection.git
|
|
dest: /home/kali/Tools/SharpCollection
|
|
version: master
|
|
|
|
- name: Clone PEASS-ng
|
|
ansible.builtin.git:
|
|
repo: https://github.com/carlospolop/PEASS-ng.git
|
|
dest: /home/kali/Tools/PEASS-ng
|
|
|
|
- name: Clone MailSniper
|
|
ansible.builtin.git:
|
|
repo: https://github.com/dafthack/MailSniper.git
|
|
dest: /home/kali/Tools/MailSniper
|
|
|
|
- name: Clone Inveigh
|
|
ansible.builtin.git:
|
|
repo: https://github.com/Kevin-Robertson/Inveigh.git
|
|
dest: /home/kali/Tools/Inveigh
|
|
|
|
- name: Install Sliver C2 server
|
|
ansible.builtin.shell: |
|
|
curl https://sliver.sh/install | bash
|
|
systemctl enable sliver
|
|
systemctl start sliver
|
|
become: true
|
|
|
|
- name: Install Metasploit Framework (Nightly Build)
|
|
ansible.builtin.shell: |
|
|
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > /home/kali/Tools/msfinstall
|
|
chmod 755 /home/kali/Tools/msfinstall
|
|
/home/kali/Tools/msfinstall
|
|
become: true
|
|
args:
|
|
executable: /bin/bash
|
|
|
|
- name: Grab GoPhish
|
|
ansible.builtin.shell: |
|
|
curl -L "$(curl -s https://api.github.com/repos/gophish/gophish/releases/latest | jq -r '.assets[] | select(.browser_download_url | contains("linux-64bit.zip")) | .browser_download_url')" -o /home/kali/Tools/gophish.zip
|
|
unzip /home/kali/Tools/gophish.zip -d /home/kali/Tools/gophish
|
|
rm -rf /home/kali/Tools/gophish.zip
|
|
chmod +x /home/kali/Tools/gophish
|
|
|
|
- name: Deploy Gophish config.json with custom admin port
|
|
become: true
|
|
template:
|
|
src: gophish-config.j2
|
|
dest: /home/kali/Tools/gophish/config.json
|
|
owner: kali
|
|
group: kali
|
|
mode: '0644'
|
|
vars:
|
|
gophish_admin_port: "{{ gophish_admin_port }}"
|
|
domain: "{{ domain }}"
|
|
|
|
- name: Configure Postfix main.cf
|
|
lineinfile:
|
|
path: /etc/postfix/main.cf
|
|
regexp: "{{ item.regexp }}"
|
|
line: "{{ item.line }}"
|
|
with_items:
|
|
- { regexp: '^myhostname', line: "myhostname = mail.{{ domain }}" }
|
|
- { regexp: '^mydomain', line: "mydomain = {{ domain }}" }
|
|
- { regexp: '^myorigin', line: "myorigin = $mydomain" }
|
|
- { regexp: '^inet_interfaces', line: "inet_interfaces = all" }
|
|
- { regexp: '^inet_protocols', line: "inet_protocols = ipv4" }
|
|
- { regexp: '^smtpd_banner', line: "smtpd_banner = $myhostname ESMTP $mail_name" }
|
|
- { regexp: '^mynetworks', line: "mynetworks = 127.0.0.0/8 [::1]/128" }
|
|
- { regexp: '^relay_domains', line: "relay_domains = $mydestination" }
|
|
- { regexp: '^smtpd_tls_cert_file', line: "smtpd_tls_cert_file = /etc/letsencrypt/live/{{ domain }}/fullchain.pem" }
|
|
- { regexp: '^smtpd_tls_key_file', line: "smtpd_tls_key_file = /etc/letsencrypt/live/{{ domain }}/privkey.pem" }
|
|
- { regexp: '^smtpd_tls_security_level', line: "smtpd_tls_security_level = encrypt" }
|
|
- { regexp: '^smtpd_tls_session_cache_database', line: "smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache" }
|
|
- { regexp: '^smtp_tls_session_cache_database', line: "smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache" }
|
|
- { regexp: '^smtpd_use_tls', line: "smtpd_use_tls = yes" }
|
|
- { regexp: '^smtpd_tls_auth_only', line: "smtpd_tls_auth_only = yes" }
|
|
- { regexp: '^milter_default_action', line: "milter_default_action = accept" }
|
|
- { regexp: '^milter_protocol', line: "milter_protocol = 6" }
|
|
- { regexp: '^smtpd_milters', line: "smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock" }
|
|
- { regexp: '^non_smtpd_milters', line: "non_smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock" }
|
|
become: true
|
|
|
|
- name: Configure OpenDKIM
|
|
lineinfile:
|
|
path: /etc/opendkim.conf
|
|
regexp: "{{ item.regexp }}"
|
|
line: "{{ item.line }}"
|
|
with_items:
|
|
- { regexp: '^Domain', line: "Domain {{ domain }}" }
|
|
- { regexp: '^KeyFile', line: "KeyFile /etc/opendkim/keys/{{ domain }}/mail.private" }
|
|
- { regexp: '^Selector', line: "Selector mail" }
|
|
- { regexp: '^Socket', line: "Socket local:/var/spool/postfix/opendkim/opendkim.sock" }
|
|
- { regexp: '^Syslog', line: "Syslog yes" }
|
|
- { regexp: '^UMask', line: "UMask 002" }
|
|
- { regexp: '^Mode', line: "Mode sv" }
|
|
become: true
|
|
|
|
- name: Create DKIM directory
|
|
file:
|
|
path: /etc/opendkim/keys/{{ domain }}
|
|
state: directory
|
|
owner: opendkim
|
|
group: opendkim
|
|
mode: 0700
|
|
become: true
|
|
|
|
- name: Generate DKIM keys
|
|
command: >
|
|
opendkim-genkey -D /etc/opendkim/keys/{{ domain }} -d {{ domain }} -s mail
|
|
args:
|
|
creates: /etc/opendkim/keys/{{ domain }}/mail.private
|
|
become: true
|
|
|
|
- name: Set permissions for DKIM keys
|
|
file:
|
|
path: /etc/opendkim/keys/{{ domain }}/mail.private
|
|
owner: opendkim
|
|
group: opendkim
|
|
mode: 0600
|
|
become: true
|
|
|
|
- name: Configure OpenDKIM TrustedHosts
|
|
copy:
|
|
content: |
|
|
127.0.0.1
|
|
::1
|
|
localhost
|
|
{{ domain }}
|
|
dest: /etc/opendkim/TrustedHosts
|
|
owner: opendkim
|
|
group: opendkim
|
|
mode: 0644
|
|
become: true
|
|
|
|
- name: Enable submission port (587) in master.cf
|
|
blockinfile:
|
|
path: /etc/postfix/master.cf
|
|
insertafter: '^#submission'
|
|
block: |
|
|
submission inet n - y - - smtpd
|
|
-o syslog_name=postfix/submission
|
|
-o smtpd_tls_security_level=encrypt
|
|
-o smtpd_sasl_auth_enable=yes
|
|
-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
|
|
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
|
|
become: true
|
|
|
|
- name: Configure Dovecot for Postfix SASL
|
|
blockinfile:
|
|
path: /etc/dovecot/conf.d/10-master.conf
|
|
insertafter: '^service auth {'
|
|
block: |
|
|
# Postfix smtp-auth
|
|
unix_listener /var/spool/postfix/private/auth {
|
|
mode = 0660
|
|
user = postfix
|
|
group = postfix
|
|
}
|
|
become: true
|
|
|
|
- name: Set Dovecot auth_mechanisms
|
|
lineinfile:
|
|
path: /etc/dovecot/conf.d/10-auth.conf
|
|
regexp: '^auth_mechanisms'
|
|
line: 'auth_mechanisms = plain login'
|
|
become: true
|
|
|
|
- name: Create Dovecot password file for SASL authentication
|
|
file:
|
|
path: /etc/dovecot/passwd
|
|
state: touch
|
|
mode: '0600'
|
|
owner: dovecot
|
|
group: dovecot
|
|
become: true
|
|
|
|
- name: Add SMTP auth user to Dovecot
|
|
lineinfile:
|
|
path: /etc/dovecot/passwd
|
|
line: "{{ smtp_auth_user }}:{{ smtp_auth_pass | password_hash('sha512_crypt') }}"
|
|
become: true
|
|
|
|
- name: Disable system auth and use passwd-file
|
|
lineinfile:
|
|
path: /etc/dovecot/conf.d/10-auth.conf
|
|
regexp: '^!include auth-system.conf.ext'
|
|
line: '#!include auth-system.conf.ext'
|
|
become: true
|
|
|
|
- name: Add auth-passwdfile configuration
|
|
blockinfile:
|
|
path: /etc/dovecot/conf.d/10-auth.conf
|
|
insertafter: '^auth_mechanisms ='
|
|
block: |
|
|
passdb {
|
|
driver = passwd-file
|
|
args = scheme=sha512_crypt /etc/dovecot/passwd
|
|
}
|
|
userdb {
|
|
driver = static
|
|
args = uid=vmail gid=vmail home=/var/vmail/%u
|
|
}
|
|
become: true
|
|
|
|
- name: Create vmail group
|
|
group:
|
|
name: vmail
|
|
gid: 5000
|
|
state: present
|
|
become: true
|
|
|
|
- name: Create vmail user
|
|
user:
|
|
name: vmail
|
|
uid: 5000
|
|
group: vmail
|
|
create_home: no
|
|
become: true
|
|
|
|
- name: Restart Postfix
|
|
service:
|
|
name: postfix
|
|
state: restarted
|
|
become: true
|
|
|
|
- name: Restart Dovecot
|
|
service:
|
|
name: dovecot
|
|
state: restarted
|
|
become: true |