Quickly Implement Mod-Rewrite in your infastructure
Switch branches/tags
Nothing to show
Clone or download
jcatrambone94
jcatrambone94 Added Readme
Latest commit aa792ba Apr 22, 2017
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
.gitattributes 🎪 Added .gitattributes & .gitignore files Apr 14, 2017
.gitignore 🎪 Added .gitattributes & .gitignore files Apr 14, 2017
README.md Added Readme Apr 21, 2017
apache_redirector_setup.py Small tweaks Apr 16, 2017

README.md

Setting up infrastructure for a Red Team engagement can be time consuming and difficult. Jeff Dimmock and Steve Borosh have done a lot of work to make this process easier and more transparent. They gave a great presentation. that went over the fundamentals of setting up good Red Team nfrastructure. As part of this effort they released a wiki.

One of the most interesting bits of tradecraft released in this talk and on Jeff's blog is their very creative use of apache2’s mod_rewrite functionality. Mod_Rewrite is very powerful for a few reasons:

  1. It can be used to hide the true location of your Teamserver
  2. It can be used to evade detection from Incident Response
  3. It can be used to redirect mobile users away from a payload to a spoofed login portal, to capture credentials
  4. It can be used to block specific ip addresses from your teamserver, to aid in IR evasion
  5. It can be used to only allow your Malleable C2 traffic to the Teamserver

In a Red Team engagement, there are often multiple teamservers, and multiple redirectors in front of each teamserver. In the event that a defender identifies and blocks one of the redirectors, they should be easy to recreate. However, manually setting up mod_rewrite ruleset for each redirector can be very difficult and time consuming. To make this easier, I automated some of the setup process and tried to include as much functionality as possible.

For a more detailed description of the tool and how to use it please refer to this Blog Post