mirror of
https://github.com/wikiZ/RedGuard
synced 2026-06-08 18:18:32 +00:00
Compare commits
8 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 风起
|
eff36c678b | ||
|
风起
|
46f5aa34d5 | ||
|
风起
|
874a03793e | ||
|
风起
|
a49d862c79 | ||
|
风起
|
6f530eb667 | ||
|
风起
|
33b645381a | ||
|
风起
|
87a5c1c27d | ||
|
风起
|
266b93c758 |
@@ -1,3 +1,13 @@
|
||||
## [23.08.21.0113] - 2023-08-21
|
||||
### Added
|
||||
- Custom Delete Response Fields
|
||||
- Added Header Host information in log output
|
||||
- Solved the wrong package problem
|
||||
|
||||
## [23.05.14.2020] - 2023-05-14
|
||||
### Added
|
||||
- Sample Fingerprint Identify
|
||||
|
||||
## [22.08.03.1214] - 2022-08-03
|
||||
### Added
|
||||
- Support custom domain names for communication between intranet hosts
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<h1 align="center">RedGuard - Excellent C2 Front Flow Control tool</h1>
|
||||
|
||||
[](https://github.com/knownsec/Kunyu) [](https://github.com/knownsec/Kunyu/issues) [](https://github.com/knownsec/Kunyu/releases) [](https://github.com/wikiZ)
|
||||
[](https://github.com/knownsec/Kunyu) [](https://github.com/knownsec/Kunyu/issues) [](https://github.com/knownsec/Kunyu/releases) [](https://github.com/wikiZ)
|
||||
|
||||
--------------
|
||||
|
||||
@@ -10,27 +10,27 @@ English | [中文文档](https://github.com/wikiZ/RedGuard/blob/main/doc/README_
|
||||
|
||||
# 0x00 Introduction
|
||||
|
||||
## Tool introduction
|
||||
## What is RedGuard
|
||||
|
||||
RedGuard is a derivative work of the C2 facility pre-flow control technology. It has a lighter design, efficient flow interaction, and reliable compatibility with go language development. The core problem it solves is also in the face of increasingly complex red and blue attack and defense drills, giving the attack team a better C2 infrastructure concealment scheme, giving the interactive traffic of the C2 facility a flow control function, and intercepting those "malicious" analysis traffic, and better complete the entire attack mission.
|
||||
RedGuard, a derivative tool based on command and control (C2) front flow control technology, has a lighter design, efficient traffic interaction, and reliable compatibility with development in the go programming language.As cyber attacks are constantly evolving , the red and blue team exercises become progressively more complex, RedGuard is designed to provide a better C2 channel hiding solution for the red team, that provides the flow control for the C2 channel, blocks the "malicious" analysis traffic, and better completes the entire attack task.
|
||||
|
||||
RedGuard is a C2 facility pre-flow control tool that can avoid Blue Team, AVS, EDR, Cyberspace Search Engine checks.
|
||||
RedGuard is a C2 front flow control tool that can avoid Blue Team, AVS, EDR, Cyberspace Search Engine detects.
|
||||
|
||||
## Application scenarios
|
||||
## When is RedGuard Used?
|
||||
|
||||
- During the offensive and defensive drills, the defender analyzes and traces the source of C2 interaction traffic according to the situational awareness platform
|
||||
- Identify and prevent malicious analysis of Trojan samples in cloud sandbox environment based on JA3 fingerprint library
|
||||
- Block malicious requests to implement replay attacks and achieve the effect of confusing online
|
||||
- In the case of specifying the IP of the online server, the request to access the interactive traffic is restricted by means of a whitelist
|
||||
- In the offensive and defensive exercise, the investigators attempting to do cyber attribution analyze C2 traffic connected to the attackers with the situational awareness platform
|
||||
- Prevent malware sample analysis by identifying cloud sandboxes based on JA3 fingerprint libraries
|
||||
- Block malicious requests to perform replay attacks and achieve obfuscation online
|
||||
- Restrict access requests by whitelisting in the case of the IP of the connecting server is specified
|
||||
- Prevent the scanning and identification of C2 facilities by cyberspace mapping technology, and redirect or intercept the traffic of scanning probes
|
||||
- Supports pre-flow control for multiple C2 servers, and can achieve the effect of domain front-end, load balancing online, and achieve the effect of concealment
|
||||
- Able to perform regional host online restriction according to the attribution of IP address by requesting IP reverse lookup API interface
|
||||
- Supports front flow control for multiple C2 servers, and can realize domain fronting, load balancing connection to achieve hidden effect
|
||||
- Able to perform regional host connection restriction according to the attribution of IP address by requesting IP reverse lookup API interface
|
||||
- Resolve strong features of staged checksum8 rule path parsing without changing the source code.
|
||||
- Analyze blue team tracing behavior through interception logs of target requests, which can be used to track peer connection events/issues
|
||||
- It has the function of customizing the time period for the legal interaction of the sample to realize the function of only conducting traffic interaction during the working time period
|
||||
- Analyze blue team traceability behavior through interception logs of target requests, which can be used to track peer connection events/issues
|
||||
- With the ability to customize the time period for legal interaction of samples to realize the function of only conducting traffic interaction during the working time period
|
||||
- Malleable C2 Profile parser capable of validating inbound HTTP/S requests strictly against malleable profile and dropping outgoing packets in case of violation (supports Malleable Profiles 4.0+)
|
||||
- Built-in blacklist of IPV4 addresses for a large number of devices, honeypots, and cloud sandboxes associated with security vendors to automatically intercept redirection request traffic
|
||||
- SSL certificate information and redirect URLs that can interact with samples through custom tools to circumvent the fixed characteristics of tool traffic
|
||||
- Built-in blacklist of IPV4 addresses for a large number of devices, honeypots, and cloud sandboxes associated with cybersecurity vendors to automatically intercept redirection request traffic
|
||||
- SSL certificate information and redirect URLs that can interact with samples through custom tools to avoid the fixed signature of tool traffic
|
||||
- ..........
|
||||
|
||||
# 0x01 Install
|
||||
@@ -51,17 +51,17 @@ chmod +x ./RedGuard&&./RedGuard
|
||||
|
||||
## initialization
|
||||
|
||||
As shown in the figure below, first grant executable permissions to RedGuard and perform initialization operations. The first run will generate a configuration file in the current user directory to achieve flexible function configuration. Configuration file name: **.RedGuard_CobaltStrike.ini**.
|
||||
As shown in the figure below, Set executable permissions and initialize RedGuard. The first run will generate a configuration file in the current user home directory to achieve flexible function configuration. Configuration file name: **.RedGuard_CobaltStrike.ini**.
|
||||
|
||||
|
||||
|
||||
|
||||
**Configuration file content:**
|
||||
|
||||
|
||||
|
||||
|
||||
The configuration options of cert are mainly for the configuration information of the HTTPS traffic exchange certificate between the sample and the C2 front-end facility. The proxy is mainly used to configure the control options in the reverse proxy traffic. The specific use will be explained in detail below.
|
||||
The configuration options of cert are mainly for the configuration information of SSL certificate encrypted HTTPS communication between the sample and the C2 front infrastructure. The proxy is mainly used to configure the control options in the reverse proxy traffic. The specific use will be explained in detail below.
|
||||
|
||||
The SSL certificate used in the traffic interaction will be generated in the cert-rsa/ directory under the directory where RedGuard is executed. You can start and stop the basic functions of the tool by modifying the configuration file **(the serial number of the certificate is generated according to the timestamp , don't worry about being associated with this feature)**.If you want to use your own certificate,Just rename them to ca.crt and ca.key.
|
||||
The SSL certificate encrypted HTTPS communication will be generated in the cert-rsa/ directory under the directory where RedGuard is executed. You can start and stop the basic functions of the tool by modifying the configuration file **(the serial number of the certificate is generated according to the timestamp , don't worry about being associated with this feature)**.If you want to use your own certificate,Just rename them to ca.crt and ca.key.
|
||||
|
||||
```bash
|
||||
openssl x509 -in ca.crt -noout -text
|
||||
@@ -69,29 +69,35 @@ openssl x509 -in ca.crt -noout -text
|
||||
|
||||
|
||||
|
||||
Random TLS JARM fingerprints are updated each time RedGuard is started to prevent this from being used to authenticate C2 facilities.
|
||||
Random TLS JARM fingerprints are updated each time RedGuard is started to prevent this from being used to authenticate C2 infrastructure.
|
||||
|
||||
|
||||
|
||||
In the case of using your own certificate, modify the HasCert parameter in the configuration file to true to prevent normal communication problems caused by the incompatibility of the CipherSuites encryption suite with the custom certificate caused by the randomization of JARM confusion.
|
||||
In the case of using your own certificate, modify the HasCert parameter in the configuration file to `true` to prevent normal communication problems caused by the incompatibility of the CipherSuites encryption suite with the custom certificate caused by JARM obfuscation randomization.
|
||||
|
||||
```bash
|
||||
# Whether to use the certificate you have applied for true/false
|
||||
HasCert = false
|
||||
```
|
||||
|
||||
## RedGuard Usage
|
||||
## RedGuard Parameters
|
||||
|
||||
```bash
|
||||
root@VM-4-13-ubuntu:~# ./RedGuard -h
|
||||
|
||||
Usage of ./RedGuard:
|
||||
-DelHeader string
|
||||
Customize the header to be deleted
|
||||
-DropAction string
|
||||
RedGuard interception action (default "redirect")
|
||||
-EdgeHost string
|
||||
Set Edge Host Communication Domain (default "*")
|
||||
-EdgeTarget string
|
||||
Set Edge Host Proxy Target (default "*")
|
||||
-FieldFinger string
|
||||
Set HTTP Header identification field Info
|
||||
-FieldName string
|
||||
Set the name of the HTTP Header identification field
|
||||
-HasCert string
|
||||
Whether to use the certificate you have applied for (default "true")
|
||||
-allowIP string
|
||||
@@ -129,18 +135,17 @@ Usage of ./RedGuard:
|
||||
-type string
|
||||
C2 Server Type (default "CobaltStrike")
|
||||
-u Enable configuration file modification
|
||||
|
||||
```
|
||||
|
||||
**P.S. You can use the parameter command to modify the configuration file. Of course, I think it may be more convenient to modify it manually with vim. **
|
||||
**P.S. You can use the parameter command to modify the configuration file. Of course, I think it may be more convenient to modify it manually with vim.**
|
||||
|
||||
# 0x03 Tool usage
|
||||
|
||||
## basic interception
|
||||
|
||||
If you directly access the port of the reverse proxy, the interception rule will be triggered. Here you can see the root directory of the client request through the output log, but because the request process does not carry the requested credentials, that is, the correct HOST request header So the basic interception rule is triggered, and the traffic is redirected to https://360.net
|
||||
If you directly access the port of the reverse proxy, the interception rule will be triggered. Here you can see the root directory of the client request through the output log, but because the request does not carry the requested credentials that is the correct HOST request header, the basic interception rule is triggered, and the traffic is redirected to <https://360.net>
|
||||
|
||||
Here, in order to facilitate the display of the output effect, the actual use can be run in the background through `nohup ./RedGuard &`.
|
||||
Here is just a demonstration of the output, the actual use can be run in the background through `nohup ./RedGuard &`.
|
||||
|
||||
|
||||
|
||||
@@ -148,7 +153,7 @@ Here, in order to facilitate the display of the output effect, the actual use ca
|
||||
{"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
```
|
||||
|
||||
It is not difficult to see from the above slice that 360.net corresponds to the proxy to the local port 8080, 360.com points to the local port 4433, and corresponds to the difference in the HTTP protocol used. In the subsequent online, you need to pay attention to the protocol of the listener. The type needs to be consistent with the one set here, and set the corresponding HOST request header.
|
||||
It is not difficult to see from the above slice that 360.net is proxied to the local port 8080, 360.com is proxied to the local port 4433, and the HTTP protocol used is also different. In actual use, it is necessary to pay attention to the protocol type of the listener. Consistent with the settings here, and set the corresponding HOST request header.
|
||||
|
||||
|
||||
|
||||
@@ -156,11 +161,11 @@ As shown in the figure above, in the case of unauthorized access, the response i
|
||||
|
||||
## interception method
|
||||
|
||||
In the above basic interception case, the default interception method is used, that is, the illegal traffic is intercepted by redirection. By modifying the configuration file, we can change the interception method and the redirected site URL. In fact, this The other way is a redirect, which might be more aptly described as hijacking, cloning, since the response status code returned is 200, and the response is taken from another website to mimic the cloned/hijacked website as closely as possible.
|
||||
In the above basic interception case, the default interception method is used, the illegal traffic is intercepted by redirection. By modifying the configuration file, we can change the interception method and the redirected site URL. In fact, rather than calling this a redirect, I think it might be more appropriate to describe it as hijacking, cloning, since the response status code returned is 200, and the response is obtained from another website to mimic the cloned/hijacked website as closely as possible.
|
||||
|
||||
Invalid packets can be misrouted according to three strategies:
|
||||
Invalid packets can be incorrectly routed according to three strategies:
|
||||
|
||||
- **reset**: Terminate the TCP connection immediately.
|
||||
- **reset**: Disconnect the TCP connection immediately.
|
||||
- **proxy**: Get a response from another website to mimic the cloned/hijacked website as closely as possible.
|
||||
- **redirect**: redirect to the specified website and return HTTP status code 302, there is no requirement for the redirected website.
|
||||
|
||||
@@ -171,23 +176,31 @@ drop_action = proxy
|
||||
Redirect = https://360.net
|
||||
```
|
||||
|
||||
**Redirect = URL** in the configuration file points to the hijacked URL address. RedGuard supports "hot change", which means that while the tool is running in the background through nohup, we can still modify the configuration file. The content is started and stopped in real time.
|
||||
**Redirect = URL** in the configuration file points to the hijacked URL address. RedGuard supports "hot change", which means that while the tool is running in the background through `nohup`, we can still modify the configuration file. The content is started and stopped in real time.
|
||||
|
||||
```bash
|
||||
./RedGuard -u --drop true
|
||||
```
|
||||
|
||||
Note that when modifying the configuration file through the command line. The -u option should not be too small, otherwise the configuration file cannot be modified successfully. If you need to restore the default configuration file settings, you only need to enter `./RedGuard -u`.
|
||||
Note that when modifying the configuration file through the command line, The `-u` option should not be missing, otherwise the configuration file cannot be modified successfully. If you need to restore the default configuration file settings, you only need to enter `./RedGuard -u`.
|
||||
|
||||
Another interception method is DROP, which directly closes the HTTP communication response and is enabled by setting **DROP = true**. The specific interception effect is as follows:
|
||||
|
||||
|
||||
|
||||
It can be seen that the C2 pre-flow control directly responds to illegal requests without the HTTP response code. In the detection of cyberspace mapping, the DROP method can achieve the function of hiding the opening of ports. The specific effect can be seen in the following case. analyze.
|
||||
It can be seen that the C2 front flow control directly close response to illegal requests without the HTTP response code. In the detection of cyberspace mapping, the DROP method can hide the opening of ports. The specific effect can be seen in the following case. analyze.
|
||||
|
||||
## JA3 fingerprint recognition cloud sandbox analysis traffic
|
||||
|
||||
RedGuard currently supports the function of identifying cloud sandboxes based on JA3 fingerprints, which can identify and intercept network requests initiated in the cloud sandbox environment to prevent subsequent connectivity analysis, which further affects the security of C2 facilities.
|
||||
|
||||
Currently supports the identification and interception of the threatbook cloud sandbox as an effect demonstration
|
||||
|
||||
|
||||
|
||||
## Proxy port modification
|
||||
|
||||
In fact, it is easy to understand here. The configuration of the following two parameters in the configuration file realizes the effect of changing the reverse proxy port. It is recommended to use the default port on the premise of not conflicting with the current server port. If it must be modified, then pay attention to the **:** of the parameter value not to be missing
|
||||
The configuration of the following two parameters in the configuration file realizes the effect of changing the reverse proxy port. It is recommended to use the default port hiding as long as it does not conflict with the current server port. If it must be modified, then pay attention to the `:` of the parameter value not to be missing
|
||||
|
||||
```bash
|
||||
# HTTPS Reverse proxy port
|
||||
@@ -198,14 +211,13 @@ Port_HTTP = :80
|
||||
|
||||
## RedGuard logs
|
||||
|
||||
The blue team tracing behavior is analyzed through the interception log of the target request, which can be used to track peer connection events/problems. The log file is generated in the directory where RedGuard is running, **file name: RedGuard.log**.
|
||||
The blue team tracing behavior is analyzed through the interception log of the target request, which can be used to track peer connection events/issues. The log file is generated in the directory where RedGuard is running, **file name: RedGuard.log**.
|
||||
|
||||
|
||||
|
||||
|
||||
## RedGuard Obtain the real IP address
|
||||
|
||||
This section describes how to configure RG to obtain the real IP address of a request. You only need to add the following configuration to the profile of the C2 device, that is, to obtain the real IP address of the target through the request header X-Forwarded-For.
|
||||
This section describes how to configure RG to obtain the real IP address of a request. You only need to add the following configuration to the profile of the C2 device, the real IP address of the target is obtained through the request header X-Forwarded-For.
|
||||
|
||||
```bash
|
||||
http-config {
|
||||
@@ -215,12 +227,12 @@ http-config {
|
||||
|
||||
## Request geographic restrictions
|
||||
|
||||
The configuration method takes AllowLocation = Jinan, Beijing as an example. It is worth noting here that RedGuard provides two APIs for IP attribution anti-check, one for domestic users and the other for overseas users. Dynamically assign which API to use. If the target is in China, enter Chinese for the set region. Otherwise, enter English place names. It is recommended that domestic users use Chinese names. In this way, the accuracy of the attribution found and the response speed of the API are both is the best choice.
|
||||
The configuration method takes `AllowLocation = Jinan, Beijing` as an example. Note that RedGuard provides two APIs for reverse IP attribution, one for users in mainland China and the other for users in non-mainland China, and can dynamically assign which API to use according to the input geographical domain name, if the target is China Then use Chinese for the set region, otherwise use English place names. It is recommended that users in mainland China use Chinese names, so that the accuracy of the attribution and the response speed of the API obtained by reverse query are the best choices.
|
||||
|
||||
P.S. Domestic users, do not use **AllowLocation = Jinan,beijing** this way! It doesn't make much sense, the first character of the parameter value determines which API to use!
|
||||
P.S. Mainland Chinese users, do not use **AllowLocation = Jinan,beijing** this way! It doesn't make much sense, the first character of the parameter value determines which API to use!
|
||||
|
||||
```bash
|
||||
# IP address owning restrictions example:AllowLocation = 山东,上海,杭州 or shanghai,beijing
|
||||
# IP address owning restrictions example:AllowLocation = 山东，上海，杭州 or shanghai,beijing
|
||||
AllowLocation = *
|
||||
```
|
||||
|
||||
@@ -237,7 +249,7 @@ Here we set to allow only the Shandong region to go online
|
||||
|
||||
|
||||
|
||||
**Legit traffic:**
|
||||
**Legal traffic:**
|
||||
|
||||
|
||||
|
||||
@@ -245,11 +257,11 @@ Here we set to allow only the Shandong region to go online
|
||||
|
||||
|
||||
|
||||
Regarding the launch of geographical restrictions, it may be more practical in the current offensive and defensive drills. Basically, the targets of provincial and municipal protection network restrictions are in designated areas, and the traffic requested by other areas can naturally be ignored, and the function of RedGuard is Not only can a single region be restricted, but multiple online regions can be restricted based on provinces and cities, and traffic requested by other regions can be intercepted.
|
||||
Regarding the connections of geographical restrictions, it may be more practical in the current offensive and defensive exercise. Basically, the targets of provincial and municipal offensive and defensive exercise restrictions are in designated areas, and the traffic requested by other areas can naturally be ignored. This function of RedGuard can not only limit a single region, but also limit multiple connection regions according to provinces and cities, and intercept the traffic requested by other regions.
|
||||
|
||||
## Blocking based on whitelist
|
||||
|
||||
In addition to the built-in blacklist of security vendor IPs in RedGuard, we can also restrict according to the whitelist. In fact, I also suggest that when doing web management, we can restrict the addresses of the online IPs according to the whitelist, so as to divide multiple IPs way of address.
|
||||
In addition to the built-in IP blacklist of cybersecurity vendors in RedGuard, we can also restrict according to the whitelist method. In fact, I also suggest that during web penetration, we can restrict the online IP addresses according to the whitelist to split multiple way of IP address.
|
||||
|
||||
```bash
|
||||
# Whitelist list example: AllowIP = 172.16.1.1,192.168.1.1
|
||||
@@ -258,11 +270,11 @@ AllowIP = 127.0.0.1
|
||||
|
||||
|
||||
|
||||
As shown in the figure above, we only allow 127.0.0.1 to go online, then the request traffic of other IPs will be intercepted.
|
||||
As shown in the figure above, we restrict to allow only 127.0.0.1 connections, then the request traffic of other IPs will be blocked.
|
||||
|
||||
## Block based on time period
|
||||
|
||||
This function is more interesting. Setting the following parameter values in the configuration file means that the traffic control facility can only go online from 8:00 am to 9:00 pm. The specific application scenario here is that during the specified attack time, we allow communication with C2 Traffic interacts, and remains silent at other times. This also allows the red teams to get a good night's sleep without worrying about some blue team on the night shift being bored to analyze your Trojan and then wake up to something indescribable, hahaha.
|
||||
This function is more interesting. Setting the following parameter values in the configuration file means that the traffic control facility can only connect from 8:00 am to 9:00 pm. The specific application scenario here is that during the specified attack time, we allow communication with C2, and remains silent at other times. This also allows the red teams to get a good night's sleep without worrying about some blue team on duty at night being bored to analyze your Trojan and then wake up to something indescribable, hahaha.
|
||||
|
||||
```bash
|
||||
# Limit the time of requests example: AllowTime = 8:00 - 16:00
|
||||
@@ -273,7 +285,7 @@ AllowTime = 8:00 - 21：00
|
||||
|
||||
## Malleable Profile
|
||||
|
||||
RedGuard uses the Malleable C2 profile. It then parses the provided malleable configuration file section to understand the contract and pass only those inbound requests that satisfy it, while misleading others. Parts such as `http-stager`, `http-get` and `http-post` and their corresponding uris, headers, User-Agent etc. are used to distinguish legitimate beacon requests from irrelevant Internet noise or IR/AV/EDR Out-of-bounds packet.
|
||||
RedGuard uses the Malleable C2 profile. It parses the provided extensible configuration file section to understand the contract and pass only those inbound requests that satisfy it, while misleading other requests. Parts such as `http-stager`, `http-get` and `http-post` and their corresponding uris, headers, User-Agent etc. are used to distinguish legal beacon requests from irrelevant Internet noise or IR/AV/EDR Out-of-bounds packet.
|
||||
|
||||
```bash
|
||||
# C2 Malleable File Path
|
||||
@@ -284,17 +296,71 @@ MalleableFile = /root/cobaltstrike/Malleable.profile
|
||||
|
||||
The profile written by 风起 is recommended to use:
|
||||
|
||||
> https://github.com/wikiZ/CobaltStrike-Malleable-Profile
|
||||
> <https://github.com/wikiZ/CobaltStrike-Malleable-Profile>
|
||||
|
||||
# 0x04 Case Study
|
||||
## Custom Delete Response Fields
|
||||
|
||||
## Cyberspace Search Engine
|
||||
In Cobalt Strike 4.7+, Teamserver automatically removes the Content-Encoding header without any notification, potentially causing a malleable http-(get|post).server violation. For example, there is no Content-type in the CS Server response packet, but after being forwarded by RedGuard, the Content-Type is added to the header of the response packet, which causes cf to cache the page, causing interference.
|
||||
|
||||
As shown in the figure below, when our interception rule is set to DROP, the spatial mapping system probe will probe the / directory of our reverse proxy port several times. In theory, the request packet sent by mapping is faked as normal traffic. Show. But after several attempts, because the characteristics of the request packet do not meet the release requirements of RedGuard, they are all responded by Close HTTP. The final effect displayed on the surveying and mapping platform is that the reverse proxy port is not open.
|
||||
After RedGuard 23.08.21, the function of customizing the header of the response packet has been added. Users can customize and delete the header information in the response packet by modifying the configuration file to solve the problem of incorrect parsing.
|
||||
|
||||
```bash
|
||||
# Customize the header to be deleted example: Keep-Alive,Transfer-Encoding
|
||||
DelHeader = Keep-Alive,Transfer-Encoding
|
||||
```
|
||||
|
||||
## Sample FingerPrint
|
||||
|
||||
RedGuard 23.05.13 has updated the trojan sample fingerprint recognition function, which is based on customizing the HTTP Header field of the Malleable Profile as the fingerprint “**sample salt value**” for uniquely identifying the same **C2 listener**/Header Host. In addition, the trojan sample fingerprint generated by combining other relevant request fields can be used to detect the custom sample liveliness. According to the attacker’s task requirements, the trojan sample fingerprint recognition function can perform “**offline operation**” on the samples you want to disable, to better evade malicious traffic analysis of the sample communication and the staged sample PAYLOAD attack payload acquisition analysis, and provide more personalized stealth measures for the attacker.
|
||||
|
||||
For different C2 listeners, we can give different aliases to the Malleable Profile configurations, customize the field names and values of related headers as the sample salt value, and use it as one of the distinctions between different samples. The following code is for illustration purposes, and in actual attack and defense scenarios we can use more realistic HTTP request packet fields as the basis for judgment.
|
||||
|
||||
```bash
|
||||
http-get "listen2" {
|
||||
set uri "/image.gif";
|
||||
client {
|
||||
header "Accept-Finger" "866e5289337ab033f89bc57c5274c7ca"; //Custom HTTP Header and Value
|
||||
metadata {
|
||||
print
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**HTTP traffic**
|
||||
|
||||
|
||||
|
||||
As shown in the figure, we use the above sample Salt value and Host field as the basis for fingerprint generation. Here we know:
|
||||
|
||||
- **Salt Value：866e5289337ab033f89bc57c5274c7ca**
|
||||
- **Host ：redguard.com**
|
||||
|
||||
According to splicing the above values, the sample fingerprint is obtained as follows:
|
||||
|
||||
```bash
|
||||
22e6db08c5ef1889d64103a290ac145c
|
||||
```
|
||||
|
||||
Now that we know the above sample fingerprint, we can set the custom Header field and sample fingerprint in the RedGuard configuration file for malicious traffic interception. It is worth noting that we can extend multiple sample fingerprints, separated by commas, and the FieldName needs to be consistent with the Header field name configured in the Malleable Profile
|
||||
|
||||
|
||||
|
||||
Because RedGuard’s configuration file is a hot configuration, we don’t need to restart RedGuard to intercept the samples we want to disable. When we want the sample to be reactivated, we just need to delete the relevant sample fingerprint from the RedGuard configuration file.
|
||||
|
||||
**Demonstration effect:**
|
||||
|
||||
|
||||
|
||||
# 0x04 Case Analysis
|
||||
|
||||
## Cyberspace Search Mapping
|
||||
|
||||
As shown in the figure below, when our interception rule is set to DROP, the spatial mapping system probe will probe the / directory of our reverse proxy port several times. In theory, the request packet sent by mapping is faked as normal traffic as shown. But after several attempts, because the signature of the request packet do not meet the release requirements of RedGuard, they are all responded by Close HTTP. The final effect displayed on the surveying and mapping platform is that the reverse proxy port is not open.
|
||||
|
||||
|
||||
|
||||
The traffic shown in the figure below means that when the interception rule is set to Redirect, we will find that when the mapping probe receives a response, it will continue to scan our directory. UserAgent is random, which seems to be in line with normal traffic requests, but both successfully blocked.
|
||||
The traffic shown in the figure below means that when the interception rule is set to Redirect, we will find that when the mapping probe receives a response, it will continue to scan our directory. User-Agent is random, which seems to be in line with normal traffic requests, but both successfully blocked.
|
||||
|
||||
|
||||
|
||||
@@ -308,11 +374,11 @@ The traffic shown in the figure below means that when the interception rule is s
|
||||
|
||||
## Domain fronting
|
||||
|
||||
RedGuard supports Domain fronting. In my opinion, there are two forms of presentation. One is to use the traditional Domain fronting method, which can be achieved by setting the port of our reverse proxy in the site-wide acceleration back-to-source address. On the original basis, the function of traffic control is added to the domain fronting, and it can be redirected to the specified URL according to the setting we set to make it look more real. It should be noted that the RedGuard setting of the HTTPS HOST header must be consistent with the domain name of the site-wide acceleration.
|
||||
RedGuard supports Domain fronting. In my opinion, there are two forms of presentation. One is to use the traditional Domain fronting method, which can be achieved by setting the port of our reverse proxy in the site-wide acceleration back-to-origin address. On the original basis, the function of traffic control is added to the domain fronting, and it can be redirected to the specified URL according to the setting we set to make it look more real. It should be noted that the RedGuard setting of the HTTPS HOST header must be consistent with the domain name of the site-wide acceleration.
|
||||
|
||||
|
||||
|
||||
In individual combat, I suggest that the above method can be used, and in team tasks, it can also be achieved by self-built "Domain fronting".
|
||||
In single combat, I suggest that the above method can be used, and in team tasks, it can also be achieved by self-built "Domain fronting".
|
||||
|
||||
|
||||
|
||||
@@ -324,7 +390,7 @@ This can be achieved through multiple node servers, and configure multiple IPs o
|
||||
|
||||
## Edge Node
|
||||
|
||||
RedGuard 22.08.03 updated the edge host online settings - custom intranet host interaction domain name, and the edge host uses the domain front CDN node interaction. The asymmetry of the information exchanged between the two hosts is achieved, making it more difficult to trace the source and make it difficult to check.
|
||||
RedGuard 22.08.03 updated the edge host conection settings - custom intranet host interaction domain name, and the edge host uses the domain front CDN node interaction. This makes the information asymmetry between the two hosts, making it more difficult to trace the source and make it difficult to troubleshoot.
|
||||
|
||||
|
||||
|
||||
@@ -332,11 +398,11 @@ RedGuard 22.08.03 updated the edge host online settings - custom intranet host i
|
||||
|
||||
If there is a problem with the above method, the actual online C2 server cannot be directly intercepted by the firewall, because the actual load balancing request in the reverse proxy is made by the IP of the cloud server manufacturer.
|
||||
|
||||
If it is a single soldier, we can set an interception strategy on the cloud server firewall.
|
||||
In single combat, we can set an interception rules on the cloud server firewall.
|
||||
|
||||
|
||||
|
||||
Then set the address pointed to by the proxy to https://127.0.0.1:4433.
|
||||
Then set the address pointed to by the proxy to <https://127.0.0.1:4433>.
|
||||
|
||||
```bash
|
||||
{"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
@@ -346,7 +412,7 @@ And because our basic verification is based on the HTTP HOST request header, wha
|
||||
|
||||
|
||||
|
||||
For the listener settings, the online port is set to the RedGuard reverse proxy port, and the listening port is the actual online port of the local machine.
|
||||
For the listener settings, the `HTTPS Port (C2)` is set to the RedGuard reverse proxy port, and the `HTTPS Port (Bind)` is the actual connection port of the local machine.
|
||||
|
||||
## Metasploit
|
||||
|
||||
@@ -365,7 +431,7 @@ setg OverrideLPORT 443
|
||||
setg OverrideRequestHost true
|
||||
```
|
||||
|
||||
It is important to note that the `OverrideRequestHost` setting must be set to `true`. This is due to a quirk in the way Metasploit handles incoming HTTP/S requests by default when generating configuration for staging payloads. By default, Metasploit uses the incoming request's `Host` header value (if present) for second-stage configuration instead of the `LHOST` parameter. Therefore, the build stage is configured to send requests directly to your hidden domain name because CloudFront passes your internal domain in the `Host` header of forwarded requests. This is clearly not what we are asking for. Using the `OverrideRequestHost` configuration value, we can force Metasploit to ignore the incoming `Host` header and instead use the `LHOST` configuration value pointing to the origin CloudFront domain.
|
||||
It is important to note that the `OverrideRequestHost` setting must be set to `true`. This is due to a feature in the way Metasploit handles incoming HTTP/S requests by default when generating configuration for staging payloads. By default, Metasploit uses the incoming request's `Host` header value (if present) for second-stage configuration instead of the `LHOST` parameter. Therefore, the build stage is configured to send requests directly to your hidden domain name because CloudFront passes your internal domain in the `Host` header of forwarded requests. This is clearly not what we are asking for. Using the `OverrideRequestHost` configuration value, we can force Metasploit to ignore the incoming `Host` header and instead use the `LHOST` configuration value pointing to the origin CloudFront domain.
|
||||
|
||||
The listener is set to the actual line port that matches the address RedGuard actually forwards to.
|
||||
|
||||
@@ -379,31 +445,33 @@ RedGuard received the request:
|
||||
|
||||
Thank you for your support. RedGuard will continue to improve and update it. I hope that RedGuard can be known to more security practitioners. The tool refers to the design ideas of RedWarden.
|
||||
|
||||
**We welcome everyone to put forward your needs, RedGuard will continue to grow and improve in these needs! **
|
||||
**We welcome everyone to put forward your needs, RedGuard will continue to grow and improve in these needs!**
|
||||
|
||||
**About the developer 风起 related articles:https://www.anquanke.com/member.html?memberId=148652**
|
||||
**About the developer 风起 related articles:<https://www.anquanke.com/member.html?memberId=148652>**
|
||||
|
||||
> 2022Kcon Author of the weapon spectrum of the hacker conference
|
||||
>
|
||||
> The 10th ISC Internet Security Conference Advanced Offensive and Defense Forum "C2 Front Flow Control" topic
|
||||
> The 10th ISC Internet Security Conference Advanced Offensive and Defensive Forum "C2 Front Flow Control" topic
|
||||
>
|
||||
> https://isc.n.cn/m/pages/live/index?channel_id=iscyY043&ncode=UR6KZ&room_id=1981905&server_id=785016&tab_id=253
|
||||
> <https://isc.n.cn/m/pages/live/index?channel_id=iscyY043&ncode=UR6KZ&room_id=1981905&server_id=785016&tab_id=253>
|
||||
>
|
||||
> Exchange C2 traffic based on boundary node links
|
||||
> <https://www.anquanke.com/post/id/278140>
|
||||
>
|
||||
> Analysis of cloud sandbox flow identification technology
|
||||
>
|
||||
> https://www.anquanke.com/post/id/277431
|
||||
> <https://www.anquanke.com/post/id/277431>
|
||||
>
|
||||
> Realization of JARM Fingerprint Randomization Technology
|
||||
>
|
||||
> https://www.anquanke.com/post/id/276546
|
||||
> <https://www.anquanke.com/post/id/276546>
|
||||
|
||||
**Kunyu: https://github.com/knownsec/Kunyu**
|
||||
**Kunyu: <https://github.com/knownsec/Kunyu>**
|
||||
|
||||
> 风起于青萍之末，浪成于微澜之间。
|
||||
|
||||
|
||||
# 0x06 Community
|
||||
|
||||
If you have any questions or requirements, you can submit an issue under the project, or contact the tool author by adding WeChat.
|
||||
If you have any questions or requirements, you can submit an issue under the project, or contact the developer by adding WeChat.
|
||||
|
||||
|
||||
|
||||
+107
-106
@@ -1,106 +1,107 @@
|
||||
/**
|
||||
* @Author 风起
|
||||
* @contact: onlyzaliks@gmail.com
|
||||
* @File: RedGuard.go
|
||||
* @Time: 2022/5/4 10:44
|
||||
**/
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
|
||||
"RedGuard/config"
|
||||
"RedGuard/core"
|
||||
"RedGuard/core/parameter"
|
||||
"RedGuard/lib"
|
||||
)
|
||||
|
||||
var logger = lib.Logger() // logger output model
|
||||
|
||||
type C2 struct {
|
||||
Type string //Server interface{}
|
||||
}
|
||||
|
||||
type c2Action interface {
|
||||
serverInit()
|
||||
}
|
||||
|
||||
type cobaltStrike struct {
|
||||
action string
|
||||
}
|
||||
|
||||
// ServerInit CobaltStrike module core method entry
|
||||
func (cs *cobaltStrike) serverInit() {
|
||||
cs.action = "CobaltStrike"
|
||||
var (
|
||||
proxy parameter.ProxyConf // Proxy configuration structure
|
||||
cfg = lib.InitConfig() // config file object
|
||||
num int // counting variable
|
||||
)
|
||||
// HTTPS Reverse proxy SSL certificate is created
|
||||
lib.InitGenerateSelfSignedCert()
|
||||
for key, value := range map[string]string{
|
||||
"HTTPS": "/",
|
||||
"HTTP": "/http",
|
||||
} {
|
||||
proxy.Action = key // Gets the reverse proxy listening port type
|
||||
proxy.Pattern = value // Gets the pattern associated with the listening type
|
||||
proxy.Port = lib.ReadConfig("proxy", fmt.Sprintf("Port_%s", key), cfg)
|
||||
// When num is greater than 0, the main program is called out of the loop
|
||||
if num > 0 {
|
||||
break
|
||||
}
|
||||
num += 1
|
||||
logger.Noticef("HostTarget: %s", lib.ReadConfig("proxy", "HostTarget", cfg))
|
||||
// HTTP reverse proxy
|
||||
go core.ProxyManger(proxy.Action, proxy.Port, proxy.Pattern)
|
||||
}
|
||||
// HTTPS reverse proxy
|
||||
core.ProxyManger(proxy.Action, proxy.Port, proxy.Pattern)
|
||||
// TODO CobaltStrike Core flow control method
|
||||
}
|
||||
|
||||
func (c2 C2) configInit(args *parameter.Parses) {
|
||||
c2.Type = args.C2Type
|
||||
// Check C2 Server type
|
||||
switch strings.ToLower(c2.Type) {
|
||||
case "cobaltstrike":
|
||||
// CobaltStrike Server initialize method
|
||||
(&cobaltStrike{}).serverInit()
|
||||
}
|
||||
// TODO:Development Pending for other C2 frameworks
|
||||
}
|
||||
|
||||
func main() {
|
||||
fmt.Println(fmt.Sprintf(config.BANNER, config.VERSION, config.URL)) // output banner information.
|
||||
// Create the tool argument
|
||||
var (
|
||||
parse parameter.Parses // Basic parameter structure
|
||||
cert parameter.Cert // Certificate configuration parameter structure
|
||||
_proxy parameter.Proxy // Proxy configuration parameter structure
|
||||
)
|
||||
core.CmdParse(&parse, &cert, &_proxy)
|
||||
// Check whether RedGuard has been initialized
|
||||
if num, isExits := lib.CreateConfig(parse.C2Type /* C2 Facility Type */, parse.ConfigPath); isExits {
|
||||
switch {
|
||||
case parse.Update:
|
||||
lib.UpdateConfig(&cert, &_proxy) // Update RedGuard Config
|
||||
logger.Notice("RedGuard Configuration file updated successfully!")
|
||||
case parse.IP != "":
|
||||
if lib.CheckIP(parse.IP) == false {
|
||||
logger.Warning("Please enter a valid IP address")
|
||||
os.Exit(0)
|
||||
}
|
||||
logger.Noticef("Search ipLookUpHelper: %s", parse.IP)
|
||||
core.IPLookUp(parse.Location /* owning place to be verified */, parse.IP) // Query the location of an IP address
|
||||
case num == 0:
|
||||
// Select different C2 Server modes based on user parameters,default CobaltStrike.
|
||||
(C2{}).configInit(&parse)
|
||||
case num == 1: // Initialization is run for the first time
|
||||
os.Exit(0)
|
||||
}
|
||||
}
|
||||
}
|
||||
/**
|
||||
* @Author 风起
|
||||
* @contact: onlyzaliks@gmail.com
|
||||
* @File: RedGuard.go
|
||||
* @Time: 2022/5/4 10:44
|
||||
**/
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
|
||||
"RedGuard/config"
|
||||
"RedGuard/core"
|
||||
"RedGuard/core/parameter"
|
||||
"RedGuard/lib"
|
||||
)
|
||||
|
||||
var logger = lib.Logger() // logger output model
|
||||
|
||||
type C2 struct {
|
||||
Type string //Server interface{}
|
||||
}
|
||||
|
||||
type c2Action interface {
|
||||
serverInit()
|
||||
}
|
||||
|
||||
type cobaltStrike struct {
|
||||
action string
|
||||
}
|
||||
|
||||
// ServerInit CobaltStrike module core method entry
|
||||
func (cs *cobaltStrike) serverInit() {
|
||||
cs.action = "CobaltStrike"
|
||||
var (
|
||||
proxy parameter.ProxyConf // Proxy configuration structure
|
||||
cfg = lib.InitConfig() // config file object
|
||||
num int // counting variable
|
||||
)
|
||||
// HTTPS Reverse proxy SSL certificate is created
|
||||
lib.InitGenerateSelfSignedCert()
|
||||
for key, value := range map[string]string{
|
||||
"HTTPS": "/",
|
||||
"HTTP": "/http",
|
||||
} {
|
||||
proxy.Action = key // Gets the reverse proxy listening port type
|
||||
proxy.Pattern = value // Gets the pattern associated with the listening type
|
||||
proxy.Port = lib.ReadConfig("proxy", fmt.Sprintf("Port_%s", key), cfg)
|
||||
// When num is greater than 0, the main program is called out of the loop
|
||||
if num > 0 {
|
||||
break
|
||||
}
|
||||
num += 1
|
||||
logger.Noticef("HostTarget: %s", lib.ReadConfig("proxy", "HostTarget", cfg))
|
||||
// HTTP reverse proxy
|
||||
go core.ProxyManger(proxy.Action, proxy.Port, proxy.Pattern)
|
||||
}
|
||||
// HTTPS reverse proxy
|
||||
core.ProxyManger(proxy.Action, proxy.Port, proxy.Pattern)
|
||||
// TODO CobaltStrike Core flow control method
|
||||
}
|
||||
|
||||
func (c2 C2) configInit(args *parameter.Parses) {
|
||||
c2.Type = args.C2Type
|
||||
// Check C2 Server type
|
||||
switch strings.ToLower(c2.Type) {
|
||||
case "cobaltstrike":
|
||||
// CobaltStrike Server initialize method
|
||||
(&cobaltStrike{}).serverInit()
|
||||
}
|
||||
// TODO:Development Pending for other C2 frameworks
|
||||
}
|
||||
|
||||
func main() {
|
||||
fmt.Println(fmt.Sprintf(config.BANNER, config.VERSION, config.URL)) // output banner information.
|
||||
// Create the tool argument
|
||||
var (
|
||||
parse parameter.Parses // Basic parameter structure
|
||||
_cert parameter.Cert // Certificate configuration parameter structure
|
||||
_proxy parameter.Proxy // Proxy configuration parameter structure
|
||||
_finger parameter.SampleFinger
|
||||
)
|
||||
core.CmdParse(&parse, &_cert, &_finger, &_proxy)
|
||||
// Check whether RedGuard has been initialized
|
||||
if num, isExits := lib.CreateConfig(parse.C2Type /* C2 Facility Type */, parse.ConfigPath); isExits {
|
||||
switch {
|
||||
case parse.Update:
|
||||
lib.UpdateConfig(&_cert, &_proxy, &_finger) // Update RedGuard Config
|
||||
logger.Notice("RedGuard Configuration file updated successfully!")
|
||||
case parse.IP != "":
|
||||
if lib.CheckIP(parse.IP) == false {
|
||||
logger.Warning("Please enter a valid IP address")
|
||||
os.Exit(0)
|
||||
}
|
||||
logger.Noticef("Search ipLookUpHelper: %s", parse.IP)
|
||||
core.IPLookUp(parse.Location /* owning place to be verified */, parse.IP) // Query the location of an IP address
|
||||
case num == 0:
|
||||
// Select different C2 Server modes based on user parameters,default CobaltStrike.
|
||||
(C2{}).configInit(&parse)
|
||||
case num == 1: // Initialization is run for the first time
|
||||
os.Exit(0)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
+186
-6
@@ -3,8 +3,8 @@
|
||||
[2022-05-23 10:34:36] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2022-05-23 10:34:36] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2022-05-23 10:34:57] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-05-23 10:34:57] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 111.14.218.206 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Edg/101.0.1210.53
|
||||
[2022-05-23 10:34:57] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 111.14.218.206 -> Destination Site: https://360.net
|
||||
[2022-05-23 10:34:57] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 111.14.218.xxx - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Edg/101.0.1210.53
|
||||
[2022-05-23 10:34:57] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 111.14.218.xxx -> Destination Site: https://360.net
|
||||
[2022-05-23 10:35:52] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-05-23 10:35:52] [RedGuard/core.IPLookUp] {
|
||||
"status": "0",
|
||||
@@ -13,13 +13,13 @@
|
||||
"data": [
|
||||
{
|
||||
"ExtendedLocation": "",
|
||||
"OriginQuery": "111.14.218.206",
|
||||
"OriginQuery": "111.14.218.xxx",
|
||||
"appinfo": "",
|
||||
"disp_type": 0,
|
||||
"fetchkey": "111.14.218.206",
|
||||
"fetchkey": "111.14.218.xxx",
|
||||
"location": "山东省济南市 移动",
|
||||
"origip": "111.14.218.206",
|
||||
"origipquery": "111.14.218.206",
|
||||
"origipquery": "111.14.218.xxx",
|
||||
"resourceid": "6006",
|
||||
"role_id": 0,
|
||||
"shareImage": 1,
|
||||
@@ -316,4 +316,184 @@
|
||||
[2022-05-30 17:33:19] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /js/config.js
|
||||
[2022-05-30 17:33:19] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53L, like Gecko) Chrome/90.0.4430.212 Safari/537.36
|
||||
[2022-05-30 17:33:19] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 169
|
||||
[2022-05-30 17:33:20] [RedGuard/core.modifyResponse.func1.1] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2022-05-30 17:33:20] [RedGuard/core.modifyResponse.func1.1] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net[2023-08-19 22:28:45] [RedGuard/lib.CreateConfig] RedGuard initialization is complete!
|
||||
[2023-08-19 22:28:45] [RedGuard/lib.CreateConfig] RedGuard config path is: C:\Users\风起/.RedGuard_CobaltStrike.ini
|
||||
[2023-08-19 22:28:48] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:28:48] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:28:48] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:29:16] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:29:16] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:29:16] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:29:16] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:29:34] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:29:34] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:29:34] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:29:41] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:29:41] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:29:41] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:29:41] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:30:23] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:30:23] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:30:23] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:30:26] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:30:26] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:30:26] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:30:26] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:31:16] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:31:16] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:31:16] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:31:24] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:31:24] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:31:24] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:31:24] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:31:39] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:31:39] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:31:39] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:31:43] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:31:43] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:31:43] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:31:43] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:31:57] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 07f9ac0700dcc554249f644244e291a1
|
||||
[2023-08-19 22:31:57] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] POST /api/key/activate?readonly=false
|
||||
[2023-08-19 22:31:57] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - AcunetixWVS
|
||||
[2023-08-19 22:31:57] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:33:41] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:33:41] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:33:41] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:33:49] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:33:49] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:33:49] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:33:49] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:33:50] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:33:50] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:33:50] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:33:50] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:35:27] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:35:27] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:35:27] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:35:39] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:35:39] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:35:39] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:35:39] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:35:39] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:35:39] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:35:39] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:35:39] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:42:20] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:42:20] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:42:20] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:42:26] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:42:26] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:42:26] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:42:27] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:42:27] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 22:42:28] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:42:28] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /img/pv.gif?.stamp=1692456147940&Referer=
|
||||
[2023-08-19 22:42:28] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:42:28] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:42:29] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:42:29] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /favicon.ico
|
||||
[2023-08-19 22:42:29] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:42:29] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:42:29] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 22:43:32] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:43:32] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:43:32] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:43:37] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:43:37] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:43:37] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:43:38] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:43:38] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 22:43:39] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:43:39] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /img/pv.gif?.stamp=1692456219015&Referer=
|
||||
[2023-08-19 22:43:39] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:43:40] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:43:40] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:43:40] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /favicon.ico
|
||||
[2023-08-19 22:43:40] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:43:41] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:43:41] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 22:48:03] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:48:03] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:48:03] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:48:10] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:48:10] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:48:10] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:48:12] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:48:12] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 22:48:14] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:48:14] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /favicon.ico
|
||||
[2023-08-19 22:48:14] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:48:15] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:48:15] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 22:48:32] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:48:32] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:48:32] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:48:32] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:48:32] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 22:48:34] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:48:34] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /img/pv.gif?.stamp=1692456514051&Referer=
|
||||
[2023-08-19 22:48:34] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:48:34] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:48:44] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:48:44] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /favicon.ico
|
||||
[2023-08-19 22:48:44] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:48:44] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:48:44] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 22:48:53] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:48:53] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:48:53] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:48:53] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:48:53] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 22:48:54] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:48:54] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /img/pv.gif?.stamp=1692456534121&Referer=
|
||||
[2023-08-19 22:48:54] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:48:54] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:49:10] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:49:10] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /favicon.ico
|
||||
[2023-08-19 22:49:10] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:49:10] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:49:10] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 23:09:04] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 23:09:04] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 23:09:04] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 23:09:28] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 23:09:28] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 23:09:28] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 23:09:29] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 23:09:29] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 23:09:30] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 23:09:30] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /img/pv.gif?.stamp=1692457770219&Referer=
|
||||
[2023-08-19 23:09:30] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 23:09:30] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 23:13:22] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 23:13:22] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 23:13:22] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 23:14:53] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 23:14:53] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 23:14:53] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 23:14:54] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 23:14:54] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 23:14:55] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 23:14:55] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /img/pv.gif?.stamp=1692458095001&Referer=
|
||||
[2023-08-19 23:14:55] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 23:14:55] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 23:14:56] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 23:14:56] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /favicon.ico
|
||||
[2023-08-19 23:14:56] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 23:14:57] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 23:14:57] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 23:15:09] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 23:15:09] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 23:15:09] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 23:15:09] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 23:15:09] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 23:15:09] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 23:15:09] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /img/pv.gif?.stamp=1692458109917&Referer=
|
||||
[2023-08-19 23:15:09] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 23:15:10] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 23:15:10] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 23:15:10] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /favicon.ico
|
||||
[2023-08-19 23:15:10] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 23:15:11] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 23:15:11] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
|
||||
@@ -2,7 +2,7 @@ package config
|
||||
|
||||
var RedGuardConfig = `[cert]
|
||||
# User Optional name
|
||||
DNSName = *.aliyun.com,manager.channel.aliyun.com,*.acs-internal.aliyuncs.com,*.connect.aliyun.com,aliyun.com,whois.www.net.cn,tianchi-global.com
|
||||
DNSName = *.aliyun.com,manager.channel.aliyun.com,*.acs-internal.aliyuncs.com",*.connect.aliyun.com,aliyun.com,whois.www.net.cn,tianchi-global.com
|
||||
# Cert User CommonName
|
||||
CommonName = *.aliyun.com
|
||||
# Cert User Locality
|
||||
@@ -23,7 +23,7 @@ Port_HTTPS = :443
|
||||
# HTTP Reverse proxy port
|
||||
Port_HTTP = :80
|
||||
# RedGuard interception action: redirect / reset / proxy (Hijack HTTP Response)
|
||||
drop_action = proxy
|
||||
drop_action = redirect
|
||||
# URL to redirect to
|
||||
Redirect = https://360.net
|
||||
# IP address owning restrictions example:AllowLocation = 山东,上海,杭州 or shanghai,beijing
|
||||
@@ -35,7 +35,15 @@ AllowTime = *
|
||||
# C2 Malleable File Path
|
||||
MalleableFile = *
|
||||
# Edge Host Communication Domain
|
||||
EdgeHost = *
|
||||
EdgeHost = *
|
||||
# Edge Host Proxy Target example: EdgeTarget = 360.com
|
||||
EdgeTarget = *
|
||||
EdgeTarget = *
|
||||
# Customize the header to be deleted example: Keep-Alive,Transfer-Encoding
|
||||
DelHeader = *
|
||||
|
||||
[SampleFinger]
|
||||
# HTTP Request Header Field
|
||||
FieldName = *
|
||||
# Sample Finger example:xxxxxx,xxxxxx
|
||||
FieldFinger = *
|
||||
`
|
||||
|
||||
+2
-2
@@ -21,11 +21,11 @@ Github:%s
|
||||
|
||||
RedGuard is a C2 front flow control tool,Can avoid Blue Teams,AVs,EDRs check.
|
||||
`
|
||||
VERSION = "22.08.03 Alpha"
|
||||
VERSION = "23.08.21 Alpha"
|
||||
TITLE = "RedGuard"
|
||||
LICENSE = "GPL-2.0"
|
||||
URL = "https://github.com/wikiZ/RedGuard"
|
||||
AUTHOR = "风起"
|
||||
TEAM = "0/00"
|
||||
TEAM = "Independent Security Researcher"
|
||||
COPYRIGHT = "Copyright (C) 2022 风起. All Rights Reserved"
|
||||
)
|
||||
|
||||
@@ -119,9 +119,22 @@ func ProxyFilterManger(req *http.Request) (status bool) {
|
||||
allowIP = lib.ReadConfig("proxy", "AllowIP", cfg) // Obtain the online IP address whitelist
|
||||
allowTime = lib.ReadConfig("proxy", "AllowTime", cfg) // Gets the allowed online time in the configuration file
|
||||
malleableFile = lib.ReadConfig("proxy", "MalleableFile", cfg) // Obtain the profile path
|
||||
fieldName = lib.ReadConfig("SampleFinger", "FieldName", cfg)
|
||||
fieldFinger = lib.ReadConfig("SampleFinger", "FieldFinger", cfg)
|
||||
banJA3 = data.BANJA3
|
||||
banIP = data.BANIP
|
||||
)
|
||||
|
||||
// sample finger verify
|
||||
if f := req.Header.Get(fieldName); fieldName != "*" && fieldFinger != "*" && f != "" {
|
||||
finger := lib.EncodeMD5(req.Header.Get("Host") + f)
|
||||
logger.Noticef("Sample Finger: %s", finger)
|
||||
if strings.Contains(fieldFinger, finger) /* finger Check*/ {
|
||||
logger.Errorf("[DROP] Requested Sample Finger is forbidden to access")
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
// Check whether ban ip is matched
|
||||
for _, banAddr := range strings.Split(banIP, "\n") {
|
||||
// Check whether the requested IP address is in the correct IP address format or network segment format
|
||||
|
||||
+16
-6
@@ -34,21 +34,28 @@ var (
|
||||
|
||||
type baseHandle struct{}
|
||||
|
||||
func NewProxy(proxyURL string, dropType bool) (*httputil.ReverseProxy, error) {
|
||||
func NewProxy(proxyURL string, dropType bool, delHeader string) (*httputil.ReverseProxy, error) {
|
||||
destinationURL, err := url.Parse(proxyURL)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
proxy := httputil.NewSingleHostReverseProxy(destinationURL)
|
||||
// dropType Check whether the response to the request is changed
|
||||
proxy.ModifyResponse = modifyResponse(dropType) // Modifies the response to the request
|
||||
proxy.ModifyResponse = modifyResponse(dropType, delHeader) // Modifies the response to the request
|
||||
return proxy, nil
|
||||
}
|
||||
|
||||
func modifyResponse(drop bool) func(*http.Response) error {
|
||||
func modifyResponse(drop bool, delHeader string) func(*http.Response) error {
|
||||
return func(resp *http.Response) error {
|
||||
defer func(Body io.ReadCloser) {
|
||||
logger.Warningf("[RESPONSE] HTTP %s, length: %d", resp.Status, resp.ContentLength)
|
||||
delHeaderList := strings.Split(delHeader, ",")
|
||||
if delHeader != "*" && delHeaderList != nil {
|
||||
// Delete the header field specified in the RG response type
|
||||
for _, header := range delHeaderList {
|
||||
resp.Header.Del(header)
|
||||
}
|
||||
}
|
||||
if drop {
|
||||
// DROP Request
|
||||
logger.Alertf("[DROP] Source IP: %s", resp.Request.RemoteAddr)
|
||||
@@ -77,6 +84,8 @@ func (h *baseHandle) ServeHTTP(write http.ResponseWriter, req *http.Request) {
|
||||
edgeHost = lib.ReadConfig("proxy", "EdgeHost", cfg)
|
||||
// Read the Edge Host Proxy Target
|
||||
edgeTarget = lib.ReadConfig("proxy", "EdgeTarget", cfg)
|
||||
// Customize the header to be deleted
|
||||
delHeader = lib.ReadConfig("proxy", "DelHeader", cfg)
|
||||
)
|
||||
var isDrop bool
|
||||
var proxy *httputil.ReverseProxy
|
||||
@@ -98,12 +107,13 @@ func (h *baseHandle) ServeHTTP(write http.ResponseWriter, req *http.Request) {
|
||||
// Check whether the host is verified
|
||||
if IPHash := lib.EncodeMD5(req.JA3); arrays.ContainsString(_addressArray, req.JA3) == -1 {
|
||||
logger.Noticef("JA3 FingerPrint: %s", IPHash)
|
||||
logger.Noticef("[REQUEST] Host:%s", req.Host)
|
||||
logger.Noticef("[REQUEST] %s %s", req.Method, req.RequestURI)
|
||||
logger.Noticef("[REQUEST] %s - %s", req.RemoteAddr, req.UserAgent())
|
||||
// Request filtering method
|
||||
if !ProxyFilterManger(req) {
|
||||
goto LOOK // Redirect to the specified site
|
||||
}
|
||||
logger.Noticef("[REQUEST] %s - %s", req.RemoteAddr, req.UserAgent())
|
||||
_addressArray = append(_addressArray, IPHash) // Add to the list after verification for the first time
|
||||
}
|
||||
// Fetch directly from cache
|
||||
@@ -114,7 +124,7 @@ func (h *baseHandle) ServeHTTP(write http.ResponseWriter, req *http.Request) {
|
||||
|
||||
// Check whether the domain name is in the whitelist
|
||||
if target, ok := hostTarget[*host]; ok {
|
||||
proxy, err := NewProxy(target, false)
|
||||
proxy, err := NewProxy(target, false, delHeader)
|
||||
if err != nil {
|
||||
logger.Error("Proxy Exception")
|
||||
}
|
||||
@@ -144,7 +154,7 @@ LOOK:
|
||||
break
|
||||
}
|
||||
// Determine whether to redirect or intercept intercepted traffic
|
||||
proxy, _ = NewProxy(redirectURL, isDrop)
|
||||
proxy, _ = NewProxy(redirectURL, isDrop, delHeader)
|
||||
// Unauthorized access is redirected to the specified URL
|
||||
proxy.ServeHTTP(write, req)
|
||||
REDIRECT:
|
||||
|
||||
+4
-1
@@ -13,7 +13,7 @@ import (
|
||||
"RedGuard/core/parameter"
|
||||
)
|
||||
|
||||
func CmdParse(parse *parameter.Parses, cert *parameter.Cert, proxy *parameter.Proxy) {
|
||||
func CmdParse(parse *parameter.Parses, cert *parameter.Cert, finger *parameter.SampleFinger, proxy *parameter.Proxy) {
|
||||
flag.BoolVar(&parse.Update, "u", false, `Enable configuration file modification`)
|
||||
flag.StringVar(&parse.C2Type, "type", `CobaltStrike`, `C2 Server Type`)
|
||||
flag.StringVar(&parse.IP, "ip", ``, `IPLookUP IP`)
|
||||
@@ -36,5 +36,8 @@ func CmdParse(parse *parameter.Parses, cert *parameter.Cert, proxy *parameter.Pr
|
||||
flag.StringVar(&proxy.MalleableFile, "malleable", "*", "Set Proxy Requests Filter Malleable File")
|
||||
flag.StringVar(&proxy.EdgeHost, "EdgeHost", "*", "Set Edge Host Communication Domain")
|
||||
flag.StringVar(&proxy.EdgeTarget, "EdgeTarget", "*", "Set Edge Host Proxy Target")
|
||||
flag.StringVar(&finger.FieldName, "FieldName", "", "Set the name of the HTTP Header identification field")
|
||||
flag.StringVar(&finger.FieldFinger, "FieldFinger", "", "Set HTTP Header identification field Info")
|
||||
flag.StringVar(&finger.FieldFinger, "DelHeader", "", "Customize the header to be deleted")
|
||||
flag.Parse()
|
||||
}
|
||||
|
||||
@@ -37,6 +37,7 @@ type Proxy struct {
|
||||
MalleableFile string
|
||||
EdgeHost string
|
||||
EdgeTarget string
|
||||
DelHeader string
|
||||
}
|
||||
|
||||
// ProxyConf Reverse proxy configuration structure
|
||||
@@ -45,3 +46,10 @@ type ProxyConf struct {
|
||||
Action string
|
||||
Pattern string
|
||||
}
|
||||
|
||||
// SampleFinger Set listener fingerprint identification rules
|
||||
// example [Accept-Finger: 866e5289337ab033f89bc57c5274c7ca]
|
||||
type SampleFinger struct {
|
||||
FieldName string // Set the name of the HTTP Header identification field
|
||||
FieldFinger string
|
||||
}
|
||||
|
||||
+74
-3
@@ -51,11 +51,11 @@ chmod +x ./RedGuard&&./RedGuard
|
||||
|
||||
如下图，首先对RedGuard赋予可执行权限并进行初始化操作，第一次运行会在当前用户目录下生成配置文件，以实现灵活的功能配置，**配置文件名：.RedGuard_CobaltStrike.ini**。
|
||||
|
||||
|
||||
|
||||
|
||||
**配置文件内容：**
|
||||
|
||||
|
||||
|
||||
|
||||
cert的配置选项主要是针对样本与C2前置设施的HTTPS流量交互证书的配置信息，proxy主要用于配置反向代理流量中的控制选项，具体使用会在下面进行详细讲解。
|
||||
|
||||
@@ -83,13 +83,19 @@ HasCert = false
|
||||
```bash
|
||||
root@VM-4-13-ubuntu:~# ./RedGuard -h
|
||||
|
||||
Usage of ./RedGuard.exe:
|
||||
Usage of ./RedGuard:
|
||||
-DelHeader string
|
||||
Customize the header to be deleted
|
||||
-DropAction string
|
||||
RedGuard interception action (default "redirect")
|
||||
-EdgeHost string
|
||||
Set Edge Host Communication Domain (default "*")
|
||||
-EdgeTarget string
|
||||
Set Edge Host Proxy Target (default "*")
|
||||
-FieldFinger string
|
||||
Set HTTP Header identification field Info
|
||||
-FieldName string
|
||||
Set the name of the HTTP Header identification field
|
||||
-HasCert string
|
||||
Whether to use the certificate you have applied for (default "true")
|
||||
-allowIP string
|
||||
@@ -183,6 +189,14 @@ Redirect = https://360.net
|
||||
|
||||
可以看到，没有获取到HTTP响应码，C2前置流量控制对非法请求直接close响应，在网络空间测绘的探测中，DROP的方式可以实现隐藏端口开放情况的作用，具体效果可以看下面的案例分析。
|
||||
|
||||
## JA3指纹识别云沙箱分析流量
|
||||
|
||||
RedGuard目前已支持基于JA3指纹识别云沙箱的功能，可以对云沙箱环境下发起的网络请求进行识别并拦截，防止以此其进行后续的通联性分析，从而进一步影响C2设施安全性。
|
||||
|
||||
目前支持针对微步云沙箱的识别拦截作为效果演示
|
||||
|
||||
|
||||
|
||||
## 代理端口修改
|
||||
|
||||
这里其实就很好理解了，对配置文件中以下两个参数的配置实现更改反向代理端口的效果，这里建议在不与当前服务器端口冲突的前提下，使用默认的端口隐匿性会更好，如果一定要修改，那么注意参数值的 **:** 不要缺少
|
||||
@@ -283,6 +297,60 @@ MalleableFile = /root/cobaltstrike/Malleable.profile
|
||||
|
||||
> https://github.com/wikiZ/CobaltStrike-Malleable-Profile
|
||||
|
||||
## 自定义删除响应字段
|
||||
|
||||
在 Cobalt Strike 4.7+ 中，Teamserver 会在没有任何通知的情况下自动删除 Content-Encoding 标头，从而可能导致违反可延展http-(get|post).server。例如CS Server响应包中没有Content-type，但经过了RedGuard转发后，在响应包Header添加了Content-Type，然后导致cf对这个页面进行了缓存，造成了干扰。
|
||||
|
||||
在RedGuard 23.08.21版本后增加了自定义响应包Header头的功能，用户可以通过修改配置文件的方式进行自定义删除的响应包中的Header信息，以解决错误解析的问题。
|
||||
|
||||
```bash
|
||||
# Customize the header to be deleted example: Keep-Alive,Transfer-Encoding
|
||||
DelHeader = Keep-Alive,Transfer-Encoding
|
||||
```
|
||||
|
||||
## Sample FingerPrint
|
||||
|
||||
RedGuard 23.05.13已更新木马样本指纹识别功能，该功能基于对Malleable Profile自定义设置HTTP Header字段作为该指纹“**样本Salt值**”，为相同**C2监听器/**Header Host提供唯一辨识。此外，结合其他相关请求字段生成的木马样本指纹，可用于检测自定义样本存活性。根据攻击方任务要求，木马样本指纹识别功能可针对希望失效的样本进行**“下线操作”**，更好地规避恶意研判流量的样本通联性关联及分阶段样本PAYLOAD攻击载荷获取分析，给予攻击方更加个性化的隐匿措施。
|
||||
|
||||
针对不同C2监听器，我们可以给不同的Malleable Profile配置别称、自定义相关header的字段名和值作为样本Salt值，以此作为区分不同样本之间的辨识之一。下列代码是为了方便说明，而在实际攻防场景下我们可以给予更加贴合实际的HTTP请求包字段作为判断依据。
|
||||
|
||||
```bash
|
||||
http-get "listen2" {
|
||||
set uri "/image.gif";
|
||||
client {
|
||||
header "Accept-Finger" "866e5289337ab033f89bc57c5274c7ca"; //用户自定义字段名及值
|
||||
metadata {
|
||||
print
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**HTTP流量**
|
||||
|
||||
|
||||
|
||||
如图所示，我们根据上述样本Salt值及Host字段作为指纹生成依据，这里我们已知:
|
||||
|
||||
- **Salt值：866e5289337ab033f89bc57c5274c7ca**
|
||||
- **Host字段值：redguard.com**
|
||||
|
||||
根据对上述值进行拼接得到sample指纹为：
|
||||
|
||||
```bash
|
||||
22e6db08c5ef1889d64103a290ac145c
|
||||
```
|
||||
|
||||
目前已知上述样本指纹，现在我们在RedGuard配置文件中设置自定义的Header字段及样本指纹用于恶意流量拦截。值得注意的是，我们可以拓展多个样本指纹，不同指纹之间以逗号分隔，FieldName需要和Malleable Profile中配置的Header字段名称保持一致。
|
||||
|
||||
|
||||
|
||||
因为RedGuard的配置文件为热配置，所以这里我们不需要重新启停RG即可实现针对希望失效的样本进行拦截，当我们希望该样本重新生效时，只需在RG配置文件中删除相关样本指纹即可实现。
|
||||
|
||||
**演示效果**
|
||||
|
||||
|
||||
|
||||
# 0x04 案例分析
|
||||
|
||||
## 空间测绘
|
||||
@@ -385,6 +453,9 @@ RedGuard接收到请求：
|
||||
> 第十届ISC互联网安全大会 高级攻防论坛《C2设施前置流量控制技术》议题
|
||||
>
|
||||
> https://isc.n.cn/m/pages/live/index?channel_id=iscyY043&ncode=UR6KZ&room_id=1981905&server_id=785016&tab_id=253
|
||||
>
|
||||
> 基于边界节点链路交互C2流量
|
||||
> https://www.anquanke.com/post/id/278140
|
||||
>
|
||||
> 云沙箱流量识别技术剖析
|
||||
>
|
||||
|
||||
+10
-4
@@ -73,17 +73,20 @@ func ReadConfig(section, key string, cfg *ini.File) string {
|
||||
|
||||
// UpdateConfig Modify the content of the configuration file
|
||||
// Oh, my God, this is not elegant!
|
||||
func UpdateConfig(cert *parameter.Cert, proxy *parameter.Proxy) {
|
||||
func UpdateConfig(cert *parameter.Cert, proxy *parameter.Proxy, finger *parameter.SampleFinger) {
|
||||
var (
|
||||
_certList = map[string]string{
|
||||
"Locality": cert.Locality, "Country": cert.Country, "Organization": cert.Organization,
|
||||
"CommonName": cert.CommonName, "DNSName": cert.DNSNameTo, "HasCert": cert.HasCert,
|
||||
}
|
||||
_proxyLIst = map[string]string{
|
||||
_proxyList = map[string]string{
|
||||
"Port_HTTP": proxy.HTTPort, "Port_HTTPS": proxy.HTTPSPort, "Redirect": proxy.Redirect,
|
||||
"AllowIP": proxy.AllowIP, "AllowTime": proxy.AllowTime, "AllowLocation": proxy.AllowLocation,
|
||||
"drop_action": proxy.DropAction, "HostTarget": proxy.HostTarget, "MalleableFile": proxy.MalleableFile,
|
||||
"EdgeHost": proxy.EdgeHost, "EdgeTarget": proxy.EdgeTarget,
|
||||
"EdgeHost": proxy.EdgeHost, "EdgeTarget": proxy.EdgeTarget, "DelHeader": proxy.DelHeader,
|
||||
}
|
||||
_sampleFinger = map[string]string{
|
||||
"FieldName": finger.FieldName, "FieldFinger": finger.FieldFinger,
|
||||
}
|
||||
cfg = InitConfig()
|
||||
)
|
||||
@@ -92,7 +95,10 @@ func UpdateConfig(cert *parameter.Cert, proxy *parameter.Proxy) {
|
||||
WriteConfig("cert", k, v, cfg)
|
||||
}
|
||||
// re proxy Write Config
|
||||
for k, v := range _proxyLIst {
|
||||
for k, v := range _proxyList {
|
||||
WriteConfig("proxy", k, v, cfg)
|
||||
}
|
||||
for k, v := range _sampleFinger {
|
||||
WriteConfig("SampleFinger", k, v, cfg)
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user