RedCaddy

C2 redirector base on caddy

Table of content

Generate caddyfile with c2 malleable profiles

The "redwarden_parser.py" under modules is from RedWarden by mgeeky
Plenty of inspiration from this article: 🇬🇧 Carrying the Tortellini's golf sticks
IP Blacklists from RedGuard's IP Blacklists
User-Agent Blacklists from mitchellkrogza's UA blacklists
self-signed-cert.py modified from CarbonCopy

Generate self-signed certificates with self-signed-cert.py :
python3 self-signed-cert.py -t [Https Server]
As you can see, localhost.* are generated
Build the custom caddy with specific modules (optional)

git clone https://github.com/XiaoliChan/RedCaddy-core.git
cd cmd/caddy
CGO_ENABLED=0 go build
upx --best --lzma caddy

Enable set trust_x_forwarded_for "true"; in c2 profile
Copy the C2 profile into RedCaddy, in this case, I use threatexpress‘s jquery-c2.4.3.profile as demo
Edit redirection rules, here is the format:

443:https:192.168.85.133:10001:warden:50050
1443:https:192.168.85.133:10002
2443:https:192.168.85.133:10003
3433:https:192.168.85.133:10004

Q: What is "warden"?
A: Warden is a whitelist function feature to protect your teamserver port, this will generate a random link with random secure strings. The user without the ability to connect to teamserver before trigged it ("warden" behind 443 means handling the link on port 443).
Pass arguments the generator.py needed, then hit enter.
python generator.py -f jquery-c2.4.3.profile -l [Ethernet Interface IP Address] -r chains.list -c CN -o Caddyfile
Run caddy with caddyfile which is generated :)
sudo ./caddy run --config Caddyfile --adapter caddyfile
Q: Why not use json or yaml format?
A: Sorry, I don't know how to write caddyfile in json/yaml format.
Q: Can response 404 with unmatch routes?
A: Well, caddy can't do this ¯\(ツ)/¯.