https://github.com/infosecn1nja/ycsm

This is a quick script installation for resilient redirector using nginx reverse proxy and letsencrypt compatible with some popular Post-Ex Tools (Cobalt Strike, Empire, Metasploit, PoshC2).
https://github.com/infosecn1nja/ycsm

infrastructure nginx nginx-reverse-proxy red-team redirector staging

Last synced: 3 months ago
JSON representation

This is a quick script installation for resilient redirector using nginx reverse proxy and letsencrypt compatible with some popular Post-Ex Tools (Cobalt Strike, Empire, Metasploit, PoshC2).

• Host: GitHub
• URL: https://github.com/infosecn1nja/ycsm
• Owner: infosecn1nja
• License: apache-2.0
• Created: 2019-02-16T08:22:46.000Z (almost 6 years ago)
• Default Branch: master
• Last Pushed: 2019-07-02T07:32:52.000Z (over 5 years ago)
• Last Synced: 2024-08-03T17:12:10.463Z (6 months ago)
• Topics: infrastructure, nginx, nginx-reverse-proxy, red-team, redirector, staging
• Language: Shell
• Homepage:
• Size: 81.1 KB
• Stars: 84
• Watchers: 6
• Forks: 36
• Open Issues: 2
• Metadata Files:
  • Readme: README.md
  • License: LICENSE
  • Security: security/block-ip.conf

Awesome Lists containing this project

• awesome-network-stuff - **43**星 - Ex Tools (Cobalt Strike, Empire, Metasploit, PoshC2). (<a id="6e80463404d46f0493cf6e84597e4b5c"></a>工具 / <a id="e99ba5f3de02f68412b13ca718a0afb6"></a>Tor&&&Onion&&洋葱)

README

        
# You Can't See Me (YCSM)

This is a quick script installation for resilient redirector using nginx reverse proxy and letsencrypt compatible with some popular RATS (Cobalt Strike, Empire, Metasploit).

If HTTPS was selected, it will automatically setup letsencrypt certbot and obtain valid letsencrypt SSL certificates for your redirector domain name, and start nginx using the generated configuration. Using redirector an added benefit of using a separate host if domain is burned, real IP of C2 will still be useable. 

## Features

* Evade Vendor Sandboxes.

* Block Shodan Access.

* Block Vulnerability Scanners & Bots.

* Auto SSL setup for HTTPS using letsencrypt certbot.

* Adds original source ip to user-agent header for easy tracking.

* Auto-Renew for Let's Encrypt SSL Certificates.

* Nginx Hardening Servers with Fail2Ban.

* Block Accessing Redirector From Mobile.

* JQuery profiling users inspired by APT29 useful to sniff tier 1 SOC (https://github.com/samsayen/JQueryingU).

## Getting Started

```

git clone https://github.com/infosecn1nja/ycsm

cd ycsm

chmod +x ycsm-setup.sh

1) Setup Nginx Redirector

2) Check Status

3) Blocking Shodan

4) Configure Fail2Ban

5) Quit

  YCSM - Select an Option:

```

## Resources

* [Cobalt Strike Team Server Population Study](https://blog.cobaltstrike.com/2019/02/19/cobalt-strike-team-server-population-study/)

* [Red Team Infrastructure Wiki](https://github.com/bluscreenofjeff/Red-Team-Infrastructure-Wiki)