mirror of
https://github.com/wikiZ/RedGuard
synced 2026-06-08 18:18:32 +00:00
Update RedGuard Version 22.5.26.1716
This commit is contained in:
风起
@@ -1,3 +1,7 @@
|
||||
## [22.5.26.1716] - 2022-5-26
|
||||
### Added
|
||||
- TLS jarm fingerprint randomize
|
||||
|
||||
## [22.5.20.1220] - 2022-5-20
|
||||
### Added
|
||||
- Initialize project
|
||||
@@ -10,9 +10,9 @@ English | [中文文档](https://github.com/wikiZ/RedGuard/blob/main/doc/README_
|
||||
|
||||
## Tool introduction
|
||||
|
||||
RedGuard is a derivative work of the C2 facility pre-flow control technology. It has a lighter design, efficient flow interaction, and reliable compatibility with go language development. The core problem it solves is also in the face of increasingly complex red and blue attack and defense drills, giving the attack team a better C2 infrastructure concealment scheme, giving the interactive traffic of the C2 facility a flow control function, and intercepting those "malicious" analysis traffic, and better complete the entire attack mission.
|
||||
RedGuard is a derivative work of the C2 facility pre-flow control technology. It has a lighter design, efficient flow interaction, and reliable compatibility with go language development. The core problem it solves is also in the face of increasingly complex red and blue attack and defense drills, giving the attack team a better C2 infrastructure concealment scheme, giving the interactive traffic of the C2 facility a flow control function, and intercepting those "malicious" analysis traffic, and better complete the entire attack mission.
|
||||
|
||||
RedGuard is a C2 facility pre-flow control tool that can avoid Blue Team, AVS, EDR, Cyberspace Search Engine checks.
|
||||
RedGuard is a C2 facility pre-flow control tool that can avoid Blue Team, AVS, EDR, Cyberspace Search Engine checks.
|
||||
|
||||
## Application scenarios
|
||||
|
||||
@@ -32,7 +32,7 @@ English | [中文文档](https://github.com/wikiZ/RedGuard/blob/main/doc/README_
|
||||
|
||||
# 0x01 Install
|
||||
|
||||
You can directly download and use the compiled version, or you can download the go package remotely for independent compilation and execution.
|
||||
You can directly download and use the compiled version, or you can download the go package remotely for independent compilation and execution.
|
||||
|
||||
```bash
|
||||
git clone https://github.com/wikiZ/RedGuard.git
|
||||
@@ -48,7 +48,7 @@ chmod +x ./RedGuard&&./RedGuard
|
||||
|
||||
## initialization
|
||||
|
||||
As shown in the figure below, first grant executable permissions to RedGuard and perform initialization operations. The first run will generate a configuration file in the current user directory to achieve flexible function configuration. Configuration file name: **.RedGuard_CobaltStrike.ini**.
|
||||
As shown in the figure below, first grant executable permissions to RedGuard and perform initialization operations. The first run will generate a configuration file in the current user directory to achieve flexible function configuration. Configuration file name: **.RedGuard_CobaltStrike.ini**.
|
||||
|
||||
|
||||
|
||||
@@ -66,6 +66,10 @@ openssl x509 -in ca.crt -noout -text
|
||||
|
||||
|
||||
|
||||
Random TLS JARM fingerprints are updated each time RedGuard is started to prevent this from being used to authenticate C2 facilities.
|
||||
|
||||
|
||||
|
||||
## RedGuard Usage
|
||||
|
||||
```bash
|
||||
@@ -116,7 +120,7 @@ Usage of ./RedGuard:
|
||||
|
||||
## basic interception
|
||||
|
||||
If you directly access the port of the reverse proxy, the interception rule will be triggered. Here you can see the root directory of the client request through the output log, but because the request process does not carry the requested credentials, that is, the correct HOST request header So the basic interception rule is triggered, and the traffic is redirected to https://360.net
|
||||
If you directly access the port of the reverse proxy, the interception rule will be triggered. Here you can see the root directory of the client request through the output log, but because the request process does not carry the requested credentials, that is, the correct HOST request header So the basic interception rule is triggered, and the traffic is redirected to https://360.net
|
||||
|
||||
Here, in order to facilitate the display of the output effect, the actual use can be run in the background through `nohup ./RedGuard &`.
|
||||
|
||||
@@ -134,7 +138,7 @@ As shown in the figure above, in the case of unauthorized access, the response i
|
||||
|
||||
## interception method
|
||||
|
||||
In the above basic interception case, the default interception method is used, that is, the illegal traffic is intercepted by redirection. By modifying the configuration file, we can change the interception method and the redirected site URL. In fact, this The other way is a redirect, which might be more aptly described as hijacking, cloning, since the response status code returned is 200, and the response is taken from another website to mimic the cloned/hijacked website as closely as possible.
|
||||
In the above basic interception case, the default interception method is used, that is, the illegal traffic is intercepted by redirection. By modifying the configuration file, we can change the interception method and the redirected site URL. In fact, this The other way is a redirect, which might be more aptly described as hijacking, cloning, since the response status code returned is 200, and the response is taken from another website to mimic the cloned/hijacked website as closely as possible.
|
||||
|
||||
Invalid packets can be misrouted according to two strategies:
|
||||
|
||||
@@ -164,7 +168,7 @@ It can be seen that the C2 pre-flow control directly responds to illegal request
|
||||
|
||||
## Proxy port modification
|
||||
|
||||
In fact, it is easy to understand here. The configuration of the following two parameters in the configuration file realizes the effect of changing the reverse proxy port. It is recommended to use the default port on the premise of not conflicting with the current server port. If it must be modified, then pay attention to the **:** of the parameter value not to be missing
|
||||
In fact, it is easy to understand here. The configuration of the following two parameters in the configuration file realizes the effect of changing the reverse proxy port. It is recommended to use the default port on the premise of not conflicting with the current server port. If it must be modified, then pay attention to the **:** of the parameter value not to be missing
|
||||
|
||||
```bash
|
||||
# HTTPS Reverse proxy port
|
||||
@@ -181,7 +185,7 @@ The blue team tracing behavior is analyzed through the interception log of the t
|
||||
|
||||
## Request geographic restrictions
|
||||
|
||||
The configuration method takes AllowLocation = Jinan, Beijing as an example. It is worth noting here that RedGuard provides two APIs for IP attribution anti-check, one for domestic users and the other for overseas users. Dynamically assign which API to use. If the target is in China, enter Chinese for the set region. Otherwise, enter English place names. It is recommended that domestic users use Chinese names. In this way, the accuracy of the attribution found and the response speed of the API are both is the best choice.
|
||||
The configuration method takes AllowLocation = Jinan, Beijing as an example. It is worth noting here that RedGuard provides two APIs for IP attribution anti-check, one for domestic users and the other for overseas users. Dynamically assign which API to use. If the target is in China, enter Chinese for the set region. Otherwise, enter English place names. It is recommended that domestic users use Chinese names. In this way, the accuracy of the attribution found and the response speed of the API are both is the best choice.
|
||||
|
||||
P.S. Domestic users, do not use **AllowLocation = Jinan,beijing** this way! It doesn't make much sense, the first character of the parameter value determines which API to use!
|
||||
|
||||
@@ -215,7 +219,7 @@ Regarding the launch of geographical restrictions, it may be more practical in t
|
||||
|
||||
## Blocking based on whitelist
|
||||
|
||||
In addition to the built-in blacklist of security vendor IPs in RedGuard, we can also restrict according to the whitelist. In fact, I also suggest that when doing web management, we can restrict the addresses of the online IPs according to the whitelist, so as to divide multiple IPs way of address.
|
||||
In addition to the built-in blacklist of security vendor IPs in RedGuard, we can also restrict according to the whitelist. In fact, I also suggest that when doing web management, we can restrict the addresses of the online IPs according to the whitelist, so as to divide multiple IPs way of address.
|
||||
|
||||
```bash
|
||||
# Whitelist list example: AllowIP = 172.16.1.1,192.168.1.1
|
||||
@@ -228,7 +232,7 @@ As shown in the figure above, we only allow 127.0.0.1 to go online, then the req
|
||||
|
||||
## Block based on time period
|
||||
|
||||
This function is more interesting. Setting the following parameter values in the configuration file means that the traffic control facility can only go online from 8:00 am to 9:00 pm. The specific application scenario here is that during the specified attack time, we allow communication with C2 Traffic interacts, and remains silent at other times. This also allows the red teams to get a good night's sleep without worrying about some blue team on the night shift being bored to analyze your Trojan and then wake up to something indescribable, hahaha.
|
||||
This function is more interesting. Setting the following parameter values in the configuration file means that the traffic control facility can only go online from 8:00 am to 9:00 pm. The specific application scenario here is that during the specified attack time, we allow communication with C2 Traffic interacts, and remains silent at other times. This also allows the red teams to get a good night's sleep without worrying about some blue team on the night shift being bored to analyze your Trojan and then wake up to something indescribable, hahaha.
|
||||
|
||||
```bash
|
||||
# Limit the time of requests example: AllowTime = 8:00 - 16:00
|
||||
@@ -256,7 +260,7 @@ The profile written by 风起 is recommended to use:
|
||||
|
||||
## Cyberspace Search Engine
|
||||
|
||||
As shown in the figure below, when our interception rule is set to DROP, the spatial mapping system probe will probe the / directory of our reverse proxy port several times. In theory, the request packet sent by mapping is faked as normal traffic. Show. But after several attempts, because the characteristics of the request packet do not meet the release requirements of RedGuard, they are all responded by Close HTTP. The final effect displayed on the surveying and mapping platform is that the reverse proxy port is not open.
|
||||
As shown in the figure below, when our interception rule is set to DROP, the spatial mapping system probe will probe the / directory of our reverse proxy port several times. In theory, the request packet sent by mapping is faked as normal traffic. Show. But after several attempts, because the characteristics of the request packet do not meet the release requirements of RedGuard, they are all responded by Close HTTP. The final effect displayed on the surveying and mapping platform is that the reverse proxy port is not open.
|
||||
|
||||
|
||||
|
||||
@@ -270,7 +274,7 @@ The traffic shown in the figure below means that when the interception rule is s
|
||||
|
||||
## Domain fronting
|
||||
|
||||
RedGuard supports Domain fronting. In my opinion, there are two forms of presentation. One is to use the traditional Domain fronting method, which can be achieved by setting the port of our reverse proxy in the site-wide acceleration back-to-source address. On the original basis, the function of traffic control is added to the domain fronting, and it can be redirected to the specified URL according to the setting we set to make it look more real. It should be noted that the RedGuard setting of the HTTPS HOST header must be consistent with the domain name of the site-wide acceleration.
|
||||
RedGuard supports Domain fronting. In my opinion, there are two forms of presentation. One is to use the traditional Domain fronting method, which can be achieved by setting the port of our reverse proxy in the site-wide acceleration back-to-source address. On the original basis, the function of traffic control is added to the domain fronting, and it can be redirected to the specified URL according to the setting we set to make it look more real. It should be noted that the RedGuard setting of the HTTPS HOST header must be consistent with the domain name of the site-wide acceleration.
|
||||
|
||||
|
||||
|
||||
@@ -286,7 +290,7 @@ This can be achieved through multiple node servers, and configure multiple IPs o
|
||||
|
||||
## CobaltStrike
|
||||
|
||||
If there is a problem with the above method, the actual online C2 server cannot be directly intercepted by the firewall, because the actual load balancing request in the reverse proxy is made by the IP of the cloud server manufacturer.
|
||||
If there is a problem with the above method, the actual online C2 server cannot be directly intercepted by the firewall, because the actual load balancing request in the reverse proxy is made by the IP of the cloud server manufacturer.
|
||||
|
||||
If it is a single soldier, we can set an interception strategy on the cloud server firewall.
|
||||
|
||||
@@ -306,13 +310,13 @@ For the listener settings, the online port is set to the RedGuard reverse proxy
|
||||
|
||||
# 0x05 Loading
|
||||
|
||||
Thank you for your support. RedGuard will continue to improve and update it. I hope that RedGuard can be known to more security practitioners. The tool refers to the design ideas of RedWarden.
|
||||
Thank you for your support. RedGuard will continue to improve and update it. I hope that RedGuard can be known to more security practitioners. The tool refers to the design ideas of RedWarden.
|
||||
|
||||
**We welcome everyone to put forward your needs, RedGuard will continue to grow and improve in these needs! **
|
||||
**We welcome everyone to put forward your needs, RedGuard will continue to grow and improve in these needs! **
|
||||
|
||||
**About the developer 风起 related articles:https://www.anquanke.com/member.html?memberId=148652**
|
||||
**About the developer 风起 related articles:https://www.anquanke.com/member.html?memberId=148652**
|
||||
|
||||
**Kunyu: https://github.com/knownsec/Kunyu**
|
||||
**Kunyu: https://github.com/knownsec/Kunyu**
|
||||
|
||||
> 风起于青萍之末，浪成于微澜之间。
|
||||
|
||||
@@ -322,4 +326,3 @@ For the listener settings, the online port is set to the RedGuard reverse proxy
|
||||
If you have any questions or requirements, you can submit an issue under the project, or contact the tool author by adding WeCat.
|
||||
|
||||
|
||||
|
||||
|
||||
+14
-14
@@ -1,24 +1,24 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEFTCCAv2gAwIBAgIIFvGc286sybwwDQYJKoZIhvcNAQELBQAwZjELMAkGA1UE
|
||||
MIIEFTCCAv2gAwIBAgIIFvKTM+hcLlgwDQYJKoZIhvcNAQELBQAwZjELMAkGA1UE
|
||||
BhMCQ04xETAPBgNVBAcTCEhhbmdaaG91MS0wKwYDVQQKEyRBbGliYWJhIChDaGlu
|
||||
YSkgVGVjaG5vbG9neSBDby4sIEx0ZC4xFTATBgNVBAMMDCouYWxpeXVuLmNvbTAe
|
||||
Fw0yMjA1MjMwMzAzMjZaFw0yMzA1MjMwMzAzMjZaMGYxCzAJBgNVBAYTAkNOMREw
|
||||
Fw0yMjA1MjYwNjE3NDRaFw0yMzA1MjYwNjE3NDRaMGYxCzAJBgNVBAYTAkNOMREw
|
||||
DwYDVQQHEwhIYW5nWmhvdTEtMCsGA1UEChMkQWxpYmFiYSAoQ2hpbmEpIFRlY2hu
|
||||
b2xvZ3kgQ28uLCBMdGQuMRUwEwYDVQQDDAwqLmFsaXl1bi5jb20wggEiMA0GCSqG
|
||||
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5OppFjIh2aKOBgUBzW0HKeg1t0Nzq/HaE
|
||||
QAMNvMBUHXjJL7jKEXpXo6ylGYie3ItTZN6x4aYLH8kjwhMJKilAHn4vQM1CAx0k
|
||||
JGcAz15RSICYRGG8tYn3hApXMZqJpB8IXpt+e4aoxJVSZwR+YljtwiuzN8MWhHxW
|
||||
nkhYxKi+IVL5TZ6QD/8QG4PU+zjO9osAH6NLI1eXDwng3iDs776TaQVkwew1Qpzv
|
||||
IAvjw81t30fETBcUX2P0Fge0DnvWaoSNEk9A9t2Pdi0uAmTgfaxAFz1HdGrCfJGH
|
||||
IFBy+ieKdveG2F29ydZhsRjTQYUfIRDQ8s1HLQxw1f8KT41vnj69AgMBAAGjgcYw
|
||||
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDYtBVVKEmf9SAEXNavZYLH2STQJZmmzLaX
|
||||
aoQbYO/OXOoyZIHIHTmi6On/X1VPnldTizN5f6m9Ff99A50x4cASiICgXJrb/YIJ
|
||||
oiOmSgmC9gEoteHeOzrLRZcESC3V5JmGY7DXKeRwcusBK0Nbi82nbz3IvxbTUCbw
|
||||
LXYobOPtsFrX3p7Zc/XaBgFkIiIekuU4JalaJjOOh+tpDhAkoFPUvRFNg6wehu8G
|
||||
qFGhkEdhVqsQCglZcJFQjCA34FY4cm2sLIoTqB9yuECammagT3g6Ua4RUo5nEiU4
|
||||
a8/AYjbPvjZkqB7ieZK8EBMn1W6MG4OGQ11RNt0vTyKBjPHI+5DBAgMBAAGjgcYw
|
||||
gcMwDgYDVR0PAQH/BAQDAgKkMBMGA1UdJQQMMAoGCCsGAQUFBwMBMIGbBgNVHREE
|
||||
gZMwgZCCDCouYWxpeXVuLmNvbYIabWFuYWdlci5jaGFubmVsLmFsaXl1bi5jb22C
|
||||
HCouYWNzLWludGVybmFsLmFsaXl1bmNzLmNvbSKCFCouY29ubmVjdC5hbGl5dW4u
|
||||
Y29tggphbGl5dW4uY29tghB3aG9pcy53d3cubmV0LmNughJ0aWFuY2hpLWdsb2Jh
|
||||
bC5jb20wDQYJKoZIhvcNAQELBQADggEBABwc43OobML5fyDq1+N7c49V3LenFXPx
|
||||
pMABhFG0Ln2AtkVgQ6w6a8qPa6/gc11XgTepqD5np2HdYtb6A5hAcNAYeLrF97pV
|
||||
Vo6JWgNJGD1Jh0n5kFo8e07VdNRQ/OLvA/wQNlZo3uAkqiNufc1pWJyGq7L+ALrE
|
||||
Uvvu67NoAg01MNbr0yluEYSX/rT+RuaJP1IeerrwujZ9Mp+EGgakqXpXmr8NB7EJ
|
||||
Po8eDyF8mZ8eg2aiopDR/s3be1FSW+czBy5Q0HWHAHO0bB9AB83D21N5sVZp4qOK
|
||||
Edf13JfJ9kUfjj13E3mJrBqJ1+RtjHxL2YZEWtib1Hwhj1/yDNkCryc=
|
||||
bC5jb20wDQYJKoZIhvcNAQELBQADggEBACKuf9U4bAL+P0YicjnRIY80gPQl5bJz
|
||||
4zdqV3D0VUWPrJfsUhBrp2LQQOdlvcyvwwE6No27GnvRQw7p5rYDviTk7jitAixx
|
||||
6+2iKivvR2/zlsulL5LgLXH1+6VQtGCa7FjvTO0hLUBgqY+FkKNZVQ3qtVnX37Op
|
||||
2X1d3GMsYot1hrJOhnoIhXhhWiRpW4Ux2yaSTM3P/YuPCwumO8zkRO85r5exNXIH
|
||||
UWwVWOv1NZg+N5y64ulpbYCqGp2v1vMzpj55HWuEr+xm9PhO7wIO0xD95vizuyzL
|
||||
+yz2GhGUzlLvrpWhEyqiIuX+0FRUcrYmwlHqe/j8XEI/tBKH7Tr9Rl8=
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
+25
-25
@@ -1,27 +1,27 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEowIBAAKCAQEAuTqaRYyIdmijgYFAc1tBynoNbdDc6vx2hEADDbzAVB14yS+4
|
||||
yhF6V6OspRmIntyLU2TeseGmCx/JI8ITCSopQB5+L0DNQgMdJCRnAM9eUUiAmERh
|
||||
vLWJ94QKVzGaiaQfCF6bfnuGqMSVUmcEfmJY7cIrszfDFoR8Vp5IWMSoviFS+U2e
|
||||
kA//EBuD1Ps4zvaLAB+jSyNXlw8J4N4g7O++k2kFZMHsNUKc7yAL48PNbd9HxEwX
|
||||
FF9j9BYHtA571mqEjRJPQPbdj3YtLgJk4H2sQBc9R3RqwnyRhyBQcvoninb3hthd
|
||||
vcnWYbEY00GFHyEQ0PLNRy0McNX/Ck+Nb54+vQIDAQABAoIBAQCXj80V5YTvpnVL
|
||||
jXAoM96kh7QfTEzH9mYflqUpA244JZlkvaitpxl9Ro8I1NjGbF2QkjPqR2HvLkYN
|
||||
/UpIMHhqX8kOby7EufmJTkP+FK/vQK0AasuydrT6k89GQ29Y+rLtzUPcfcTUqW4p
|
||||
a+PwahasDTpmvdTiwutekMtP3zLXxtZGPlyAQrX/H0sWfz2yXTtEUiRqwb9tKqeY
|
||||
UyJj3f4diTvWu/Pa6MNZsT0YabfkzaQt8K/Mi1xBAxVXpWT28Q4fli7/1/ACzPQR
|
||||
deEhuGc0GViv4Kn5EnUWi/96uQP4oDyXdMGWSbIt4zcdrN/A9o1MTkbJSkj5uX/7
|
||||
YtxuSeZhAoGBANVBJ30WWjiFSusXY1EEB7mz+qJ/e+0B7MQbL+86pI3Kg8yUHy/I
|
||||
u1Kb8vGWmImgXqs/bRgNcBGCNhaMpI72tTFGouMAjW17IqGK4611aS9lN0EeeSOd
|
||||
yppyNNXMz6FLdaWOcuhX36acs0oyr+y9KIjYSAaDpVieNR0RkC5oHW5ZAoGBAN5b
|
||||
WxMPYVCKvekeoD6X8EGa+8IHY48xpnyU02JVNx3OVgIVG88GED9PMlwceK598pt2
|
||||
Epk0IOeYAcv4rbnZUOMV6XSAMjbQIuBRvVwSXnbduiN7SCNnB/iJqQMWmTVkdJIK
|
||||
zEr1Pqr+xdLcuEarM2zncK1+LLS8CnfhymeQdu8FAoGARB10hILQPH9ux5qH0YfN
|
||||
A+bV5nN73N8hhh38+JetmdCWupCRSYz/MEq5lar5e/QqaN5wdR9NrXn+1sMDiNqK
|
||||
U3vxaTpy8gZDsH+Ra4U2HLpipL0cCmFLJnvWHng11ZopsMDIOShgOnKQ3eFEygQ9
|
||||
X0Bd+R6xgJW/91H10KzWwbkCgYALU0fePqhMO+TUXNT4mzCHhudPyKSPhI3gRoxF
|
||||
s+VsxTeoP379Gmf1cYk1G9YhvRSASpFD8F3Erf9Zbj8a+jCegF01q9ni5NMB7efh
|
||||
KqZZE44JhJv2AadsR0aue5YuHAG79oTVRIx+lR9qUAeqwcmKwHcCvyxzwCggVwXC
|
||||
JJ+KKQKBgHhQHAlGocYw89t5VvXMq9Ob7HjMOcAoB/5U++1YJRe6HI+QRYVwAB/D
|
||||
AZlFljjdBaQFcVWmeKVF8f+JaNzY+AsfiTQ8vmfpTNubRsIW+lTkoHzaKAr0tds2
|
||||
6vcD+UwbKOXTvpQ4aofM58EUswGhl+kVupddPRX2PC5YI+vzBwcB
|
||||
MIIEowIBAAKCAQEA2LQVVShJn/UgBFzWr2WCx9kk0CWZpsy2l2qEG2DvzlzqMmSB
|
||||
yB05oujp/19VT55XU4szeX+pvRX/fQOdMeHAEoiAoFya2/2CCaIjpkoJgvYBKLXh
|
||||
3js6y0WXBEgt1eSZhmOw1ynkcHLrAStDW4vNp289yL8W01Am8C12KGzj7bBa196e
|
||||
2XP12gYBZCIiHpLlOCWpWiYzjofraQ4QJKBT1L0RTYOsHobvBqhRoZBHYVarEAoJ
|
||||
WXCRUIwgN+BWOHJtrCyKE6gfcrhAmppmoE94OlGuEVKOZxIlOGvPwGI2z742ZKge
|
||||
4nmSvBATJ9VujBuDhkNdUTbdL08igYzxyPuQwQIDAQABAoIBAQDKl0keTMTQAyVE
|
||||
jtqyLU+fsHTHF2/XTakiU5Vf1zc6EQltxSLDx/a7Q86HTUP/ZEO1ufyMiPpR6P/q
|
||||
ivdpy+h6Kx09TnYEVrM8eFWlv6+2vHAG9EtOLMdhhBSUDzqyrb2NsyN/dA25xuXH
|
||||
OQAG1OOVtdzoESWwtk1A2u+NCYfpC+5ommo3bPjPG/TESGbCBPONrt6fvqlOSRl6
|
||||
OqhKoCramEKaODHQ91eJl+5yrNa7RpRajxMLt5WkSEvbDOU7KsDTiFCNcVsIv1r3
|
||||
x9e2HReNLPx6p/smphGph9Q/kGlcfyfSAjPKG2vHL/IUYznU9fAp1zd881D3azIQ
|
||||
+03i2DvxAoGBAOBr3oW81nPTYkPR1I2DSi0Firt3bDzB+SaMo1BD3BIK2X6J4azY
|
||||
OzsGaEhqJl1rMDrNUv05ckSPbpXyfCIq/5kCC6QUJ5eQs6NF3r+6V5O75PacHz49
|
||||
eQpS5qovZwwp4FPHrL+i7MDxGEtS90OC5HwQzKPSIXaD+wJ2ltZsuolFAoGBAPcy
|
||||
MtX89a+JHK+cXiweQQMpeU4iYa4+QGkEOiukttjJ/0MVA6ooaXEvpZKVcN57t2fx
|
||||
+d04ZWobgTVnfMMd+212sW8FqDbZPOBjTKHwWRkLDBHmBVcUQSE3P+vyLIM4RaXO
|
||||
SBLp5ffVbFMeJ2ROnyBt5B+gNK0KjSG+HeSmLhtNAoGACbVA3AIuOLZ1Mr/Z9QEv
|
||||
7UCnHrLs0LgHYh6FVgyJcZJclDe8tnBoJ4aAblmBLVtcq76ED4YzpjmaLAxgSE4Z
|
||||
3nGTNVbV252b171HBH44GaDwJ6bbRyL7oHGznrsMNx98n8MseuG+Yh5L0b5WCeqY
|
||||
nbFQWOnXHrxY2GNu5PmxHA0CgYBbNgSX/OzSxm71RWdiNA+dERKXiAwu9P1jQpIM
|
||||
RIzLVU2A/SILCTpO71vSyJ2LGm9ERX8C56pUCq4UfIkGneuGKoOyCY5WHrZdvYYr
|
||||
Qro9iVv8xrk1tl2J2g8WCpfuGzdnxMPHZtLaLb/4s2mpk3EX0DSajsyhBQGqb7Is
|
||||
Cj19CQKBgC6L+d36jti+XOs6nhCLs1lwXr4oRm1SLW7Fqm4QF88MqCfoUHUaGnWe
|
||||
jUO3pWQlcVu2pt2Ud1AsbOUhGWXbJjksf7n7TKlRLTv/BcQnOxcI2lCa6IALbjlu
|
||||
eeVkk5HyHb76p6+OpR113EM3f5MJvQoIPA/+hlHMWcT2tl+v/h1V
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
+1
-1
@@ -21,7 +21,7 @@ Github:%s
|
||||
|
||||
RedGuard is a C2 front flow control tool,Can avoid Blue Teams,AVs,EDRs check.
|
||||
`
|
||||
VERSION = "22.5.20.1220 Alpha"
|
||||
VERSION = "22.5.26.1716 Alpha"
|
||||
TITLE = "RedGuard"
|
||||
LICENSE = "GPL-2.0"
|
||||
URL = "https://github.com/wikiZ/RedGuard"
|
||||
|
||||
+16
-2
@@ -10,14 +10,15 @@ package core
|
||||
import (
|
||||
"RedGuard/lib"
|
||||
"crypto/tls"
|
||||
"github.com/wxnacy/wgo/arrays"
|
||||
"io"
|
||||
"math/rand"
|
||||
"net/http"
|
||||
"net/http/httputil"
|
||||
"net/url"
|
||||
"strconv"
|
||||
"sync"
|
||||
|
||||
"github.com/wxnacy/wgo/arrays"
|
||||
"time"
|
||||
)
|
||||
|
||||
var (
|
||||
@@ -124,9 +125,22 @@ func ProxyManger(action, port, pattern string) {
|
||||
http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{
|
||||
InsecureSkipVerify: true,
|
||||
}
|
||||
// Disable client connection caching to connection pools
|
||||
http.DefaultTransport.(*http.Transport).DisableKeepAlives = true
|
||||
rand.Seed(time.Now().UnixNano())
|
||||
server := &http.Server{
|
||||
Addr: port, // proxy port
|
||||
Handler: handle, // Cache structure
|
||||
TLSConfig: &tls.Config{
|
||||
CipherSuites: lib.MicsSlice([]uint16{
|
||||
0x0005, 0x000a, 0x002f,
|
||||
0x0035, 0x003c, 0x009c,
|
||||
0x009d, 0xc011, 0xc012,
|
||||
0xc013, 0xc014, 0xc027,
|
||||
0xc02f, 0xc030, 0xcca8,
|
||||
}, rand.Intn(2)+1),
|
||||
},
|
||||
TLSNextProto: make(map[string]func(*http.Server, *tls.Conn, http.Handler), 1),
|
||||
}
|
||||
logger.Warningf("Proxy Listen Port %s (%s)", port, action)
|
||||
_startUp.Unlock()
|
||||
|
||||
+21
-18
@@ -10,9 +10,9 @@
|
||||
|
||||
## 工具介绍
|
||||
|
||||
RedGuard，是一款C2设施前置流量控制技术的衍生作品，有着更加轻量的设计、高效的流量交互、以及使用go语言开发具有的可靠兼容性。它所解决的核心问题也是在面对日益复杂的红蓝攻防演练行动中，给予攻击队更加优秀的C2基础设施隐匿方案，赋予C2设施的交互流量以流量控制功能，拦截那些“恶意”的分析流量，更好的完成整个攻击任务。
|
||||
RedGuard，是一款C2设施前置流量控制技术的衍生作品，有着更加轻量的设计、高效的流量交互、以及使用go语言开发具有的可靠兼容性。它所解决的核心问题也是在面对日益复杂的红蓝攻防演练行动中，给予攻击队更加优秀的C2基础设施隐匿方案，赋予C2设施的交互流量以流量控制功能，拦截那些“恶意”的分析流量，更好的完成整个攻击任务。
|
||||
|
||||
RedGuard是一个C2设施前置流量控制工具，可以避免Blue Team,AVS,EDR,Cyberspace Search Engine的检查。
|
||||
RedGuard是一个C2设施前置流量控制工具，可以避免Blue Team,AVS,EDR,Cyberspace Search Engine的检查。
|
||||
|
||||
## 应用场景
|
||||
|
||||
@@ -32,7 +32,7 @@
|
||||
|
||||
# 0x01 安装
|
||||
|
||||
可以直接下载并使用已经编译好的版本，也可以远程下载go包进行自主编译执行。
|
||||
可以直接下载并使用已经编译好的版本，也可以远程下载go包进行自主编译执行。
|
||||
|
||||
```bash
|
||||
git clone https://github.com/wikiZ/RedGuard.git
|
||||
@@ -48,7 +48,7 @@ chmod +x ./RedGuard&&./RedGuard
|
||||
|
||||
## 初始化
|
||||
|
||||
如下图，首先对RedGuard赋予可执行权限并进行初始化操作，第一次运行会在当前用户目录下生成配置文件，以实现灵活的功能配置，**配置文件名：.RedGuard_CobaltStrike.ini**。
|
||||
如下图，首先对RedGuard赋予可执行权限并进行初始化操作，第一次运行会在当前用户目录下生成配置文件，以实现灵活的功能配置，**配置文件名：.RedGuard_CobaltStrike.ini**。
|
||||
|
||||
|
||||
|
||||
@@ -66,6 +66,10 @@ openssl x509 -in ca.crt -noout -text
|
||||
|
||||
|
||||
|
||||
每次启动RedGuard都会更新随机TLS JARM指纹，防止被以此佐证C2设施。
|
||||
|
||||
|
||||
|
||||
## RedGuard Usage
|
||||
|
||||
```bash
|
||||
@@ -116,7 +120,7 @@ Usage of ./RedGuard:
|
||||
|
||||
## 基础拦截
|
||||
|
||||
如果直接对反向代理的端口进行访问，则会触发拦截规则，这里通过输出的日志可以看到客户端请求根目录，但是因为其请求过程未带有请求的凭证，也就是正确的HOST请求头所以触发了基础拦截的规则，流量被重定向到了https://360.net
|
||||
如果直接对反向代理的端口进行访问，则会触发拦截规则，这里通过输出的日志可以看到客户端请求根目录，但是因为其请求过程未带有请求的凭证，也就是正确的HOST请求头所以触发了基础拦截的规则，流量被重定向到了https://360.net
|
||||
|
||||
这里为了方便展示输出效果，实际使用可以通过`nohup ./RedGuard &`后台运行。
|
||||
|
||||
@@ -134,7 +138,7 @@ Usage of ./RedGuard:
|
||||
|
||||
## 拦截方式
|
||||
|
||||
上述的基础拦截案例中，使用的是默认的拦截方式，也就是将非法流量以重定向的方式拦截，而通过配置文件的修改，我们可以更改拦截的方式，以及重定向的站点URL，其实这种方式与之说是重定向，描述为劫持、克隆或许更贴切，因为返回的响应状态码为200，是从另一个网站获取响应，以尽可能接近地模仿克隆/劫持的网站。
|
||||
上述的基础拦截案例中，使用的是默认的拦截方式，也就是将非法流量以重定向的方式拦截，而通过配置文件的修改，我们可以更改拦截的方式，以及重定向的站点URL，其实这种方式与之说是重定向，描述为劫持、克隆或许更贴切，因为返回的响应状态码为200，是从另一个网站获取响应，以尽可能接近地模仿克隆/劫持的网站。
|
||||
|
||||
无效数据包可能会根据两种策略被错误路由：
|
||||
|
||||
@@ -164,7 +168,7 @@ Redirect = https://360.net
|
||||
|
||||
## 代理端口修改
|
||||
|
||||
这里其实就很好理解了，对配置文件中以下两个参数的配置实现更改反向代理端口的效果，这里建议在不与当前服务器端口冲突的前提下，使用默认的端口隐匿性会更好，如果一定要修改，那么注意参数值的 **:** 不要缺少
|
||||
这里其实就很好理解了，对配置文件中以下两个参数的配置实现更改反向代理端口的效果，这里建议在不与当前服务器端口冲突的前提下，使用默认的端口隐匿性会更好，如果一定要修改，那么注意参数值的 **:** 不要缺少
|
||||
|
||||
```bash
|
||||
# HTTPS Reverse proxy port
|
||||
@@ -181,7 +185,7 @@ Port_HTTP = :80
|
||||
|
||||
## 请求地域限制
|
||||
|
||||
配置方式以AllowLocation = 济南,北京 为例，这里值得注意的是，RedGuard提供了两个IP归属地反查的API，一个适用于国内用户，另一个适用于海外用户，并且可以根据输入的地域名动态的分配使用哪个API，如果目标是中国的那么设置的地域就输入中文，反之输入英文地名，建议国内的用户使用中文名即可，这样反查到的归属地准确度以及API的响应速度都是最好的选择。
|
||||
配置方式以AllowLocation = 济南,北京 为例，这里值得注意的是，RedGuard提供了两个IP归属地反查的API，一个适用于国内用户，另一个适用于海外用户，并且可以根据输入的地域名动态的分配使用哪个API，如果目标是中国的那么设置的地域就输入中文，反之输入英文地名，建议国内的用户使用中文名即可，这样反查到的归属地准确度以及API的响应速度都是最好的选择。
|
||||
|
||||
P.S. 国内用户，不要使用**AllowLocation = 济南,beijing**这种方式！没啥意义，参数值的首个字符决定使用哪个API！
|
||||
|
||||
@@ -215,7 +219,7 @@ AllowLocation = *
|
||||
|
||||
## 基于白名单拦截
|
||||
|
||||
除了RedGuard内置的安全厂商IP的黑名单，我们还可以依据白名单的方式进行限制，其实我也是建议在web打点的时候，我们可以根据白名单限制上线的IP的地址，以，分割多个IP地址的方式。
|
||||
除了RedGuard内置的安全厂商IP的黑名单，我们还可以依据白名单的方式进行限制，其实我也是建议在web打点的时候，我们可以根据白名单限制上线的IP的地址，以，分割多个IP地址的方式。
|
||||
|
||||
```bash
|
||||
# Whitelist list example: AllowIP = 172.16.1.1,192.168.1.1
|
||||
@@ -228,7 +232,7 @@ AllowIP = 127.0.0.1
|
||||
|
||||
## 基于时间段拦截
|
||||
|
||||
这个功能就比较有意思了，在配置文件中设置以下参数值，代表了流量控制设施仅可以上午8点至晚上9点上线，这里具体的应用场景也就是在指定攻击时间内，我们允许与C2进行流量交互，其他时间保持静默状态。这也能让红队们睡一个好觉，不用担心一些夜班的蓝队无聊去分析你的木马，然后醒来发生不可描述的事情，哈哈哈。
|
||||
这个功能就比较有意思了，在配置文件中设置以下参数值，代表了流量控制设施仅可以上午8点至晚上9点上线，这里具体的应用场景也就是在指定攻击时间内，我们允许与C2进行流量交互，其他时间保持静默状态。这也能让红队们睡一个好觉，不用担心一些夜班的蓝队无聊去分析你的木马，然后醒来发生不可描述的事情，哈哈哈。
|
||||
|
||||
```bash
|
||||
# Limit the time of requests example: AllowTime = 8:00 - 16:00
|
||||
@@ -256,7 +260,7 @@ MalleableFile = /root/cobaltstrike/Malleable.profile
|
||||
|
||||
## 空间测绘
|
||||
|
||||
如下图所示，当我们的拦截规则设置为DROP的时候，空间测绘系统探针会对我们反向代理端口的/目录进行几次探测，理论上测绘发送的请求包就是伪造成正常的流量所示。但是当尝试几次因为请求包特征不符合RedGuard的放行要求，所以均被Close HTTP响应。最终展现在测绘平台上的效果也就是认为反向代理端口未开放。
|
||||
如下图所示，当我们的拦截规则设置为DROP的时候，空间测绘系统探针会对我们反向代理端口的/目录进行几次探测，理论上测绘发送的请求包就是伪造成正常的流量所示。但是当尝试几次因为请求包特征不符合RedGuard的放行要求，所以均被Close HTTP响应。最终展现在测绘平台上的效果也就是认为反向代理端口未开放。
|
||||
|
||||
|
||||
|
||||
@@ -270,7 +274,7 @@ MalleableFile = /root/cobaltstrike/Malleable.profile
|
||||
|
||||
## 域前置
|
||||
|
||||
RedGuard是支持域前置的，在我看来一共有两种展现形式，一种是利用传统的域前置方式，在全站加速回源地址中设置为我们反向代理的端口即可实现。在原有的基础上给域前置增加了流量控制的功能，并且可以根据我们设置的重定向到指定URL使其看起来更像是真的。需要注意HTTPS HOST头RedGuard设置的要与全站加速的域名一致才可以。
|
||||
RedGuard是支持域前置的，在我看来一共有两种展现形式，一种是利用传统的域前置方式，在全站加速回源地址中设置为我们反向代理的端口即可实现。在原有的基础上给域前置增加了流量控制的功能，并且可以根据我们设置的重定向到指定URL使其看起来更像是真的。需要注意HTTPS HOST头RedGuard设置的要与全站加速的域名一致才可以。
|
||||
|
||||
|
||||
|
||||
@@ -286,7 +290,7 @@ MalleableFile = /root/cobaltstrike/Malleable.profile
|
||||
|
||||
## CobaltStrike上线
|
||||
|
||||
如果说上面的这种方式有一个问题就是，实际上线的C2服务器是不能通过防火墙直接拦截掉的，因为在反向代理中实际进行负载均衡请求的是云服务器厂商IP进行的。
|
||||
如果说上面的这种方式有一个问题就是，实际上线的C2服务器是不能通过防火墙直接拦截掉的，因为在反向代理中实际进行负载均衡请求的是云服务器厂商IP进行的。
|
||||
|
||||
如果是单兵作战的话，我们可以在云服务器防火墙设置拦截策略。
|
||||
|
||||
@@ -306,13 +310,13 @@ MalleableFile = /root/cobaltstrike/Malleable.profile
|
||||
|
||||
# 0x05 Loading
|
||||
|
||||
感谢各位用户的支持，RedGuard也会坚持进行完善更新的，希望 RedGuard 能够让更多安全从业者所知，工具参考了RedWarden的设计思想。
|
||||
感谢各位用户的支持，RedGuard也会坚持进行完善更新的，希望 RedGuard 能够让更多安全从业者所知，工具参考了RedWarden的设计思想。
|
||||
|
||||
**欢迎大家多多提出需求，RedGuard也会在这些需求中不断地成长，完善！**
|
||||
**欢迎大家多多提出需求，RedGuard也会在这些需求中不断地成长，完善！**
|
||||
|
||||
**关于开发者 风起 相关文章：https://www.anquanke.com/member.html?memberId=148652**
|
||||
**关于开发者 风起 相关文章：https://www.anquanke.com/member.html?memberId=148652**
|
||||
|
||||
**Kunyu: https://github.com/knownsec/Kunyu**
|
||||
**Kunyu: https://github.com/knownsec/Kunyu**
|
||||
|
||||
> 风起于青萍之末，浪成于微澜之间。
|
||||
|
||||
@@ -322,4 +326,3 @@ MalleableFile = /root/cobaltstrike/Malleable.profile
|
||||
如果有问题或者需求可以在项目下提交issue，或通过添加WeCat联系工具作者。
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,34 @@
|
||||
/**
|
||||
* @Author 风起
|
||||
* @contact: onlyzaliks@gmail.com
|
||||
* @File: MicsSlice.go
|
||||
* @Time: 2022/5/26 13:54
|
||||
**/
|
||||
|
||||
package lib
|
||||
|
||||
import (
|
||||
"math/rand"
|
||||
"time"
|
||||
)
|
||||
|
||||
// MicsSlice Returns a random element of the specified array
|
||||
// @param origin []int16 Gets an array of values
|
||||
// @param count int Gets the number of random elements
|
||||
func MicsSlice(origin []uint16, count int) []uint16 {
|
||||
tmpOrigin := make([]uint16, len(origin))
|
||||
copy(tmpOrigin, origin)
|
||||
rand.Seed(time.Now().Unix())
|
||||
rand.Shuffle(len(tmpOrigin), func(i int, j int) {
|
||||
tmpOrigin[i], tmpOrigin[j] = tmpOrigin[j], tmpOrigin[i]
|
||||
})
|
||||
|
||||
result := make([]uint16, 0, count)
|
||||
for index, value := range tmpOrigin {
|
||||
if index == count {
|
||||
break
|
||||
}
|
||||
result = append(result, value)
|
||||
}
|
||||
return result
|
||||
}
|
||||
Reference in New Issue
Block a user