mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
130 lines
3.8 KiB
Markdown
130 lines
3.8 KiB
Markdown
# Havoc C2 Infrastructure Configuration Template
|
|
|
|
## Engagement Details
|
|
|
|
| Field | Value |
|
|
|---|---|
|
|
| Engagement ID | RT-YYYY-XXX |
|
|
| Client | [Organization] |
|
|
| Operators | [Names] |
|
|
| Start Date | YYYY-MM-DD |
|
|
| End Date | YYYY-MM-DD |
|
|
| Kill Date | YYYY-MM-DD |
|
|
|
|
## Infrastructure Inventory
|
|
|
|
### Teamserver
|
|
|
|
| Field | Value |
|
|
|---|---|
|
|
| Provider | [AWS/DigitalOcean/Linode] |
|
|
| IP Address | X.X.X.X |
|
|
| OS | Ubuntu 22.04 LTS |
|
|
| Port | 40056 |
|
|
| Havoc Version | 0.7 |
|
|
| Access | SSH Key: [key name] |
|
|
|
|
### Redirector(s)
|
|
|
|
| Name | Provider | IP | Domain | SSL Cert | Status |
|
|
|---|---|---|---|---|---|
|
|
| Redirector-1 | [Provider] | X.X.X.X | c2.domain.com | Let's Encrypt | Active |
|
|
| Redirector-2 | [Provider] | X.X.X.X | cdn.domain2.com | Let's Encrypt | Standby |
|
|
|
|
### Domains
|
|
|
|
| Domain | Purpose | Registered | Aged | Categorized | SSL |
|
|
|---|---|---|---|---|---|
|
|
| c2.domain.com | Primary C2 | YYYY-MM-DD | Yes (45 days) | Business | Yes |
|
|
| cdn.domain2.com | Backup C2 | YYYY-MM-DD | Yes (60 days) | Technology | Yes |
|
|
| phish.domain3.com | Phishing | YYYY-MM-DD | Yes (30 days) | Uncategorized | Yes |
|
|
|
|
## Havoc Profile Configuration
|
|
|
|
```yaml
|
|
Teamserver:
|
|
Host: "0.0.0.0"
|
|
Port: 40056
|
|
|
|
Operators:
|
|
- Username: operator1
|
|
Password: [REDACTED]
|
|
- Username: operator2
|
|
Password: [REDACTED]
|
|
|
|
Listeners:
|
|
- Name: "Primary HTTPS"
|
|
Type: HTTPS
|
|
Host: c2.domain.com
|
|
Port: 443
|
|
URIs: ["/api/v2/auth", "/api/v2/status", "/content/images/gallery"]
|
|
User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
|
|
Jitter: 30%
|
|
|
|
- Name: "SMB Pivot"
|
|
Type: SMB
|
|
PipeName: "\\ntsvcs"
|
|
|
|
Demon:
|
|
Sleep: 10
|
|
Jitter: 30
|
|
Spawn64: "C:\\Windows\\System32\\notepad.exe"
|
|
Spawn32: "C:\\Windows\\SysWOW64\\notepad.exe"
|
|
```
|
|
|
|
## Payload Inventory
|
|
|
|
| Payload | Format | Listener | Arch | Hash (SHA256) | Delivery |
|
|
|---|---|---|---|---|---|
|
|
| stage1.bin | Shellcode | Primary HTTPS | x64 | [hash] | Custom loader |
|
|
| beacon.dll | DLL | Primary HTTPS | x64 | [hash] | DLL sideloading |
|
|
| pivot.exe | Service EXE | SMB Pivot | x64 | [hash] | Lateral movement |
|
|
|
|
## OPSEC Checklist
|
|
|
|
### Pre-Engagement
|
|
- [ ] Domains registered 30+ days before engagement start
|
|
- [ ] Domains categorized in Bluecoat, Fortiguard, Palo Alto
|
|
- [ ] SSL certificates obtained from trusted CA (not self-signed)
|
|
- [ ] Teamserver hardened (SSH keys only, fail2ban, UFW)
|
|
- [ ] Redirector filtering non-C2 traffic to legitimate site
|
|
- [ ] Malleable profile customized (URIs, headers, user-agent)
|
|
- [ ] Payloads tested against target AV/EDR in isolated lab
|
|
- [ ] Kill date configured on all payloads
|
|
- [ ] Operator logs enabled and encrypted at rest
|
|
|
|
### During Engagement
|
|
- [ ] Beacon sleep/jitter appropriate for operation phase
|
|
- [ ] No default Havoc indicators in network traffic
|
|
- [ ] Post-exploitation tools loaded in-memory only
|
|
- [ ] Named pipes and service names randomized
|
|
- [ ] Token manipulation used instead of credential replay where possible
|
|
|
|
### Post-Engagement
|
|
- [ ] All Demon sessions terminated
|
|
- [ ] All persistence mechanisms removed from target
|
|
- [ ] All payloads removed from target systems
|
|
- [ ] Teamserver logs archived and encrypted
|
|
- [ ] VPS instances destroyed
|
|
- [ ] Domains released or parked
|
|
- [ ] IOC list provided to client
|
|
|
|
## Emergency Procedures
|
|
|
|
| Scenario | Action |
|
|
|---|---|
|
|
| Burned domain | Switch to backup redirector |
|
|
| Detected implant | Sleep beacon to 24h, assess exposure |
|
|
| Teamserver compromise | Kill all sessions, rotate infrastructure |
|
|
| Client emergency stop | Execute `killall` on all active Demons |
|
|
| Legal escalation | Contact [Legal Contact] at [phone] |
|
|
|
|
## Operator Communication
|
|
|
|
| Channel | Purpose |
|
|
|---|---|
|
|
| Signal Group | Real-time coordination |
|
|
| Encrypted Email | Reports and documentation |
|
|
| Havoc Chat | In-tool session coordination |
|
|
| Emergency Phone | [Phone number] for critical issues |
|