Ansible Cobalt Strike (Docker)

Install Evilginx2 in Docker

This role is part of the Warhorse Automation Framework. You can use this role with Warhorse or on its own.

Docker Image

ghcr.io/warhorse/docker-evilginx2

Role Variables

You can find the list of variables in ./defaults/main.yml.

• evilginx2_dir: Directory for Cobalt Strike container
• evilginx2_ports: Cobalt Strike container ports
• evilginx2_hostname: Hostname for Cobalt Strike container
• evilginx2_container_name: Name of the Cobalt Strike container
• cs_key: Cobalt Strike teamserver license key (REQUIRED)
• cs_password: Cobalt Strike teamserver password (REQUIRED)
• cs_exp_date: Cobalt Strike beacon expiration date (REQUIRED)
• cs_profile_location: Location of your Cobalt Strike profile file
• evilginx2_docker_network: Docker network for Cobalt Strike container

Dependencies

To install required dependencies, use:

ansible-galaxy install geerlingguy.docker geerlingguy.pip

Install

To install this role, run:

ansible-galaxy install warhorse.cobaltstrike_docker

Example Playbook

Use the following playbook example:

- hosts: servers
  roles:
      - { role: warhorse.evilginx2_docker }

Example Variables

Here's a sample of the variables you can set:

cs_hostname: "cobaltstrike"
cs_container_name: "cobaltstrike"
cs_key: '000-000-000-000-000'
cs_password: 'Password'
cs_exp_date: '2020-12-20'
cs_profile_location: 'clean.profile.j2'
cs_docker_network: "cobaltstrike"
cs_dir: '/opt/docker/cobaltstrike'
cs_ports:
  - "50050:50050"
  - "80:80"
  - "443:443"

License

This project uses the MIT/BSD license.

Author Information

Ralph May