Cyber security

WolfPack – Scaling Red Team Redirectors

WolfPack combines the capabilities of Terraform and Packer to streamline the deployment of red team redirectors on a large scale.

This tool enables security professionals to efficiently scale out the creation and management of Apache redirectors, which mimic authentic websites.

These redirectors act as a bridge, seamlessly redirecting incoming traffic to a controlled C2 infrastructure.

WolfPack simplifies the process of setting up and configuring these deceptive elements, making it an invaluable asset for security testing and red teaming exercises.

Installation:

git clone https://github.com/RoseSecurity-Research/WolfPack.git

Ensure that you have downloaded Packer and Terraform before continuing! This can be simply done using the following methods:

Packer And Terraform Download Methods (MacOS):

1.) Install Homebrew by entering this command into your terminal application: /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)". Then install both packer and terraform via brew

$ brew tap hashicorp/tap && brew update
$ brew cask install packer
$ brew cask install terraform

Deployment:

To deploy WolfPack, ensure that you have an active AWS profile with credentials within your current terminal session before continuing with the following commands

$ vim playbooks/apache_install.yaml
    - name: Add .htaccess
      copy:
        dest: /var/www/.htaccess
        content: |
          # .htaccess Start
          RewriteEngine On
          RewriteCond %{REQUEST_METHOD} ^(GET|POST) [NC]
          RewriteCond %{REQUEST_URI} ^/api/v1/2023/(.*)$
          
          # Change the following to the User-Agent for callbacks
          RewriteCond %{HTTP_USER_AGENT} "Mozilla/5.0 \(Windows NT 10.0; Win64; x64) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/113.0.0.0 Safari/537.36"

          # Change the following to your C2 IP Address
          RewriteRule ^.*$ "https://10.8.0.2%{REQUEST_URI}" [P,L]

Deploy the AMI

$ cd images/redirector
$ packer init
$ packer build .

This will deploy a custom redirector AMI within your AWS account EC2 services.

Note
This code is undergoing development, so if you encounter any errors or have any enhancement requests, feel free to create an issue on this repository

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

Cybersecurity – Tools And Their Function

Cybersecurity tools play a critical role in safeguarding digital assets, systems, and networks from malicious…

14 hours ago

MODeflattener – Miasm’s OLLVM Deflattener

MODeflattener is a specialized tool designed to reverse OLLVM's control flow flattening obfuscation through static…

14 hours ago

My Awesome List : Tools And Their Functions

"My Awesome List" is a curated collection of tools, libraries, and resources spanning various domains…

14 hours ago

Chrome Browser Exploitation, Part 3 : Analyzing And Exploiting CVE-2018-17463

CVE-2018-17463, a type confusion vulnerability in Chrome’s V8 JavaScript engine, allowed attackers to execute arbitrary…

14 hours ago

Chrome Browser Exploitation, Part 1 : Introduction To V8 And JavaScript Internals

The blog post "Chrome Browser Exploitation, Part 1: Introduction to V8 and JavaScript Internals" provides…

15 hours ago

Chrome Browser Exploitation, Part 3: Analyzing and Exploiting CVE-2018-17463

The exploitation of CVE-2018-17463, a type confusion vulnerability in Chrome’s V8 JavaScript engine, relies on…

17 hours ago