Update RedGuard Version 22.7.21

CHANGELOG

@@ -1,11 +1,19 @@
+## [22.7.21.1632] - 2022-7-21
+### Added
+- Limit the maximum number of log backup files that can be generated
+
+## [22.7.14.1043] - 2022-7-14
+### Added
+- Resolve the problem that the custom certificate is overwritten
+
 ## [22.7.12.1111] - 2022-7-12
 ### Added
-Profile Header authentication ignores case
-Disable the default JARM fingerprint randomization parameter
-Change the long version name!!
-Forward the packet XFF header so that C2 gets the real IP address
-Custom configuration file path
-Added validity verification for parameter IP input
+- Profile Header authentication ignores case
+- Disable the default JARM fingerprint randomization parameter
+- Change the long version name!!
+- Forward the packet XFF header so that C2 gets the real IP address
+- Custom configuration file path
+- Added validity verification for parameter IP input
 
 ## [22.6.28.1712] - 2022-6-28
 ### Added
@@ -20,4 +28,4 @@ due to the incompatibility of TLS jarm fingerprint randomize with custom certifi
 
 ## [22.5.20.1220] - 2022-5-20
 ### Added
-- Initialize project
+- Initialize project

README.md

@@ -196,6 +196,17 @@ The blue team tracing behavior is analyzed through the interception log of the t
 
 ![image.png](https://github.com/wikiZ/RedGuardImage/raw/main/1656310909975.jpg)
 
+
+## RedGuard Obtain the real IP address
+
+This section describes how to configure RG to obtain the real IP address of a request. You only need to add the following configuration to the profile of the C2 device, that is, to obtain the real IP address of the target through the request header X-Forwarded-For.
+
+```bash
+http-config {
+    set trust_x_forwarded_for "true";
+}
+```
+
 ## Request geographic restrictions
 
 The configuration method takes AllowLocation = Jinan, Beijing as an example. It is worth noting here that RedGuard provides two APIs for IP attribution anti-check, one for domestic users and the other for overseas users. Dynamically assign which API to use. If the target is in China, enter Chinese for the set region. Otherwise, enter English place names. It is recommended that domestic users use Chinese names. In this way, the accuracy of the attribution found and the response speed of the API are both is the best choice.

RedGuard.log

@@ -538,4 +538,4 @@
 [2022-06-01 15:37:41] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
 [2022-06-01 15:37:41] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 404 Not Found, length: 0
 [2022-06-01 15:37:41] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://cloud.tencent.com/
-
+[2

cert-rsa/ca.crt

@@ -1,24 +1,24 @@
 -----BEGIN CERTIFICATE-----
-MIIEFTCCAv2gAwIBAgIIFwD2T6B86kAwDQYJKoZIhvcNAQELBQAwZjELMAkGA1UE
+MIIEFDCCAvygAwIBAgIIFwGR46UNXCwwDQYJKoZIhvcNAQELBQAwZjELMAkGA1UE
 BhMCQ04xETAPBgNVBAcTCEhhbmdaaG91MS0wKwYDVQQKEyRBbGliYWJhIChDaGlu
 YSkgVGVjaG5vbG9neSBDby4sIEx0ZC4xFTATBgNVBAMMDCouYWxpeXVuLmNvbTAe
-Fw0yMjA3MTIwMzExMjRaFw0yMzA3MTIwMzExMjRaMGYxCzAJBgNVBAYTAkNOMREw
+Fw0yMjA3MTQwMjQyMjRaFw0yMzA3MTQwMjQyMjRaMGYxCzAJBgNVBAYTAkNOMREw
 DwYDVQQHEwhIYW5nWmhvdTEtMCsGA1UEChMkQWxpYmFiYSAoQ2hpbmEpIFRlY2hu
 b2xvZ3kgQ28uLCBMdGQuMRUwEwYDVQQDDAwqLmFsaXl1bi5jb20wggEiMA0GCSqG
-SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOSqu2E65uDMrnqt+xeXZ7w+Tp+w0ATaL1
-k6f+ie0emIq/VExL1jzjjpByLEVXqskwIXDvIS7WXKTeudVSUZ1CRV3+o8Ztdsy5
-oSsfTQ3J1vqt7/qA6rMiqZAIfsvqt5Kz+yE1aB2o7IpLoseRW2PrXy30qbJ3xFKp
-Sn3Yl0J/no3egNTa096R0QGmpL23kG5YQ2s/YhgZQBLg+x/9tf0JGFWMO8/3bxvD
-iu9RuVmQpkYhwJvJSThbbg4yKAFmtBZvd6GycZjgyJzekTcU+T0DqawJW3s3r//R
-xuGI4yIesLi30MzZ0SoWvfCXxdYINPPXyYXwzpt2tIoLDJcgOBjfAgMBAAGjgcYw
-gcMwDgYDVR0PAQH/BAQDAgKkMBMGA1UdJQQMMAoGCCsGAQUFBwMBMIGbBgNVHREE
-gZMwgZCCDCouYWxpeXVuLmNvbYIabWFuYWdlci5jaGFubmVsLmFsaXl1bi5jb22C
-HCouYWNzLWludGVybmFsLmFsaXl1bmNzLmNvbSKCFCouY29ubmVjdC5hbGl5dW4u
-Y29tggphbGl5dW4uY29tghB3aG9pcy53d3cubmV0LmNughJ0aWFuY2hpLWdsb2Jh
-bC5jb20wDQYJKoZIhvcNAQELBQADggEBACgy5DMRqEpT2OcAo+n43CVKeus+lQ0+
-x0IqwDljmU42rkZQNgLGHB0YLnJrbMZ6l29dn3KAIMvIJacoLWcIFQAwqW9W6gB4
-zuFFydRMKwQuH42s2vnyCFJ2hwEWJHszA3r8xe4yBn7I/bKPEU+2UFhAHEO5bsFj
-SiX7Kc+MPQpAl9Sccmw+k9CdaftFsKcsaMzarnVzsQY7/2ZMNtiPnYRLONKgjtHl
-9EAIcB+CqBjZLTlnjxa+e93fqHhSIKtCe6qcyVL9jhPq5hygl1u6o1C4ht7hlC9y
-U2Ymn2o4OKQfh6Pio6eWRIU2ERkYCrfh7YNteYpQDC218k5IaG1nJsg=
+SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCakMhuxLECM6FM6J2tQisFnBdwgTDCNzA0
+WJQ6sOe0rIiMkQ5mhiSrDwUJ3ZFDtxeSxcWRmfcz4SiNMYwS1vGuIBLwNV2qRELk
+aFzM29xjMo0isbPvBM70kl29RUP1FT5SUI9ZjwKaVLIc7j0Ugei0+p0QvGtFvgfI
+pFpWbav3UqFwUtTcJwCiDTZZM4+94TVqEvFh5f/CM60rFijFZ/Kf16cVtOW0fKcX
+oAGA9hEPAYXbSBqBSWAykDBJ3RnbZvL6MD9hsSRgduiiC9t2q/xGRU5X+rKchliW
+bjLy+xHoq1asOZK0NxigLIc/6U54IV7nfL/tT40w1GFP/WhgY+0fAgMBAAGjgcUw
+gcIwDgYDVR0PAQH/BAQDAgKkMBMGA1UdJQQMMAoGCCsGAQUFBwMBMIGaBgNVHREE
+gZIwgY+CDCouYWxpeXVuLmNvbYIabWFuYWdlci5jaGFubmVsLmFsaXl1bi5jb22C
+GyouYWNzLWludGVybmFsLmFsaXl1bmNzLmNvbYIUKi5jb25uZWN0LmFsaXl1bi5j
+b22CCmFsaXl1bi5jb22CEHdob2lzLnd3dy5uZXQuY26CEnRpYW5jaGktZ2xvYmFs
+LmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAHPsbex1ZR9p/5p/EdJrvlM3IhMIXUo2D
+tm/NWbEB4IVBa+mX0YGs60DiH8R+4VFWKvVhIzcf2/iZuiDKO8jeeZ3mSyDqdPD+
+T40gcNQhvPAH6YMPg8LzYAXVAZcxYCw0PmHr/Sl7EJH8LlR84Nz26HjPqNdLmIZA
+ui0jz4zSGtrcqFZzA2+DKiHsnKeQ4685FBUHJP51gyimYiPpQQW3uKPE1uC+8Aq/
+omArVJf9wnBLUWa1vZ4B12G4NVQXHcLvg13tOR0YHnRBJ5OR8ibYBy5VChbqktc4
+9hgOKhm4RO/6XIg6Dey/mBefannq2DgTj2lv9NNXiFppj81ugWhOmQ==
 -----END CERTIFICATE-----

cert-rsa/ca.key

@@ -1,27 +1,27 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIEowIBAAKCAQEAzkqrthOubgzK56rfsXl2e8Pk6fsNAE2i9ZOn/ontHpiKv1RM
-S9Y8446QcixFV6rJMCFw7yEu1lyk3rnVUlGdQkVd/qPGbXbMuaErH00Nydb6re/6
-gOqzIqmQCH7L6reSs/shNWgdqOyKS6LHkVtj618t9Kmyd8RSqUp92JdCf56N3oDU
-2tPekdEBpqS9t5BuWENrP2IYGUAS4Psf/bX9CRhVjDvP928bw4rvUblZkKZGIcCb
-yUk4W24OMigBZrQWb3ehsnGY4Mic3pE3FPk9A6msCVt7N6//0cbhiOMiHrC4t9DM
-2dEqFr3wl8XWCDTz18mF8M6bdrSKCwyXIDgY3wIDAQABAoIBAQCA+w8BeKzHAhib
-YKscO+Vo3MJzyRQH7ILHKNsQuwwW5SlbF0nc4MaRQMHvoN56Qb4o6b/Cw+yU+rfa
-yjYmkgDRPq3WWG/oYS7/oVVk7LiCSnfR6QmnMRdvxLTZmu3Eg6KmBY5t5fslcz/E
-qrI8n/eJYqlJIBEF8Sn9zyWAFpLtVwVpZ9MxU28oHMdAcJXHXW64BGudpyTDWM1s
-LJqajk5kU1beMyIpZUkScXyBuISgJAYwHYQhf5ftE8FuCVtgwF5ThJnpBk6GZWad
-WGDzUx+Hb0rZRFrNaNP3WXThggwM6hAB4He0eRIqZJD1djhjRI9MbU98bXV3oPEL
-tUI4iGGBAoGBANk1Rrt6YmAnjZpbxRHf0vx60RlTgtY6T+r3V2d1zoQiQ7CNOyEC
-HGET7OLWoacJF/ZG5dl1Uha0C6KaWPicchrEFAevPyfv2dQH539spXtbG6tONCR4
-ba5VGZreVPLfO/Qzg2mOX4FjMmmMjZOZSBp8yUuIeAIm+5+adBPgaNZrAoGBAPMi
-TANtmMaDx1sdV6992uUvmEhP6nAWVOln7XMc/YH7T9ORe6IVw5HaiN0UTSMIDTkJ
-tov0lE+oHHT6Zx23/dDDD8AcySKXpKHWK2CeTj2k3Q7Fp5A2sJEPorQnqcn+cXz4
-Wp9wuX1L8YRIQEUSrihRhpnozqPgIDihVln6q5xdAoGAW6Sp0kIBrbYifaUIkdEQ
-0Ov0uy3L/x0dSPLQ0tsWphNa4evErdmZJbBlexO5oqMolAU3xzdDykZuvk1HCqXf
-UsG1/cQH7o65JkereczaSSCYnP9i6pxREoPfSMNTriFXx2HQqUGjtBCpXXUq6sJ6
-dIp/17mdgLL36VAed6BwOz8CgYBqEpx3Iml0silXZwXKWm4Vbx5Q7gypuhRxgBXo
-Es3G142MD/yQSk54Y48yZJkCn5ClQceSZ7IMzpsbreMu5Aan/XHxrp1Rqjb5JCbo
-kCgyXKrUtwbTtAh0QQ4K6wL4TTnV+8QNq3BBadCElcD0YaH5lRfULe15MV7dVgYG
-W4ZjQQKBgHOhzG1to2nT8qfug6jWLids7YxtunXW0q1LwotwVtzvbdj9Qv07LQnT
-dJO7AGw7sioa/50utwno8I5yPYsEUNuffH9/k8fP3Ydm686/hcp+hPMN/HXKp0sF
-bPzMXBfkOFQ5WAOA/eLTm2Z6P5YDw7aRdtYgCFH9SSMMZd4jzYYR
+MIIEowIBAAKCAQEAmpDIbsSxAjOhTOidrUIrBZwXcIEwwjcwNFiUOrDntKyIjJEO
+ZoYkqw8FCd2RQ7cXksXFkZn3M+EojTGMEtbxriAS8DVdqkRC5GhczNvcYzKNIrGz
+7wTO9JJdvUVD9RU+UlCPWY8CmlSyHO49FIHotPqdELxrRb4HyKRaVm2r91KhcFLU
+3CcAog02WTOPveE1ahLxYeX/wjOtKxYoxWfyn9enFbTltHynF6ABgPYRDwGF20ga
+gUlgMpAwSd0Z22by+jA/YbEkYHboogvbdqv8RkVOV/qynIZYlm4y8vsR6KtWrDmS
+tDcYoCyHP+lOeCFe53y/7U+NMNRhT/1oYGPtHwIDAQABAoIBABoQLewXuK1hXWKl
+muj7TlvczUsITduCCNvaz+vxprCdo0zorN/24LoDh1r5hKRBfHUgakc6CigyYG8m
+mrMWkZxGBkuBBDFQ32K6gmN883W6sXfXNTspuWgeQjZHNsVd9qtUsEduyQaTH5Gn
+Tp9lpILX+6I103ToLVHU/PKz/ZpvjnRdfL1pFvTAzGYRAddI+3Wp4phfzcqqXtpl
+WcZ4Uux+/GzFtSH9eXaevCC4p+jcrQY1mt3BPdcz5JU43uQ+diTfTwGvL+4dCUxO
+sboAjMkw2xMXNG2SQRMTPlhLfcKh8NK3pYyVRfzOXk6bnLeBsRaLV6uXoR5njk+M
+Kr0zzDECgYEAy9/5XwI4LiY1XcXJrJmvilqtHUH1cGG1x8Ob+gpGiJ8Ryk+6i7pi
+8KP+scDUOGFfFwRycNwIoGP0J1WB4pRkTDqE8FQyh4TeOsK57NGp8wLt6COOnmps
+/8QRH+YqPG5n0yI3aQNOqkPuKoFYCiGF79VuhCuOGLaplXlmyQl/TTcCgYEAwhVp
+lLuo5phLvRTr6pgGVPCOhirdTktuRUp4NaNuGveUDww2TjdKBmqLcwVPEtuI3G/f
+k2AUKlWH0Q3N8340hG7hloSVQRHfoALy0Iljc4dFO0HrzOvSoaVYkhODqz6M6gfJ
+B+8Qiku93JI7G4qalg1jr3ItBK46KVTCQl5RE1kCgYBYEiYww82vKfRN0P6BIFbz
+pp44EGFNrfgQFtFPn5a+uDDAO9bzO444NC/3a7yBqpagY9xoIrVbTDKRt1+HmOEH
+CRSamVTGtEAoFCyrQBtxjidl685VYtY5WuKm7A/80Rjq3VIgfDxEU1oUZJG6tqac
+Z4/5arNUu7vghXRAjmi+2wKBgGUb/psLgJxRLvPcWGMou/O4NqfS4OQPC+1xNFrN
+P2kxHaMRO6FX0GqzSt6rH1y1ngEpDxKZ9Sdw04anaGm3j+iGU2O0woTZqOSVZKYb
+TQI8sGaEmzFwkZTArPm8zNWDiqnJUIOfmcBSYSDt1XktpgcSBqK6GpXbplUt4N3u
+gNJRAoGBAIo2SQXHObtfphpMVoDZm3A2DubekPuY5aHx0x5U24IDcF/19AJ3SvOh
+U7NHpHgGDal5WhLN9dIRBxujP/BL1TAKPpf6P5x4o1Jva0tUWcLvTzAM6NgFMY+0
+p4z+rF2IIkG383nWDpSL3r+0mpUEaPY5iCO8fyUQQtIr6gt+o8PW
 -----END RSA PRIVATE KEY-----

config/version.go

@@ -21,7 +21,7 @@ Github:%s
 
 RedGuard is a C2 front flow control tool,Can avoid Blue Teams,AVs,EDRs check.
 `
-	VERSION   = "22.7.12 Alpha"
+	VERSION   = "22.7.21 Alpha"
 	TITLE     = "RedGuard"
 	LICENSE   = "GPL-2.0"
 	URL       = "https://github.com/wikiZ/RedGuard"

go.mod

@@ -13,3 +13,5 @@ require (
 	github.com/tidwall/gjson v1.14.1
 	github.com/wxnacy/wgo v1.0.4
 )
+
+replace github.com/phachon/go-logger v0.0.0-20191215032019-86e4227f71ea => github.com/wikiZ/go-logger v0.0.0-20201128041628-4404a90d93ec

go.sum

@@ -25,8 +25,6 @@ github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVc
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.11 h1:FxPOTFNqGkuDUGi3H/qkUbQO4ZiBa2brKq5r0l8TGeM=
 github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
-github.com/phachon/go-logger v0.0.0-20191215032019-86e4227f71ea h1:IkOONr/u7Wy+j2R4r1eMV8PEuN4kmOhZZNaYxDOF+KQ=
-github.com/phachon/go-logger v0.0.0-20191215032019-86e4227f71ea/go.mod h1:WBIWFH/iYYvuApCvPU+/R6hfX6v0Ogu4apwf0UgzVF0=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -43,6 +41,8 @@ github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
 github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
 github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
 github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/wikiZ/go-logger v0.0.0-20201128041628-4404a90d93ec h1:soPPf+s+iq4J5qFk0KziWKA6jO29bxonQe1yqNQkeic=
+github.com/wikiZ/go-logger v0.0.0-20201128041628-4404a90d93ec/go.mod h1:WBIWFH/iYYvuApCvPU+/R6hfX6v0Ogu4apwf0UgzVF0=
 github.com/wxnacy/wgo v1.0.4 h1:UEkzjlW3pMAXcTUCgMekrCvFYLKKwc0p5GAQrMIphs8=
 github.com/wxnacy/wgo v1.0.4/go.mod h1:8hqUwCgvMGgAIr4MLIeFur2YXS/Ns3vbyx5abx0e8iM=
 golang.org/x/crypto v0.0.0-20211117183948-ae814b36b871 h1:/pEO3GD/ABYAjuakUS6xSEmmlyVS4kxBNkeA9tLJiTI=

lib/CreateSSL.go

@@ -89,6 +89,12 @@ func GenerateSelfSignedCert(cert *parameter.Cert) {
 }
 
 func InitGenerateSelfSignedCert() {
+	// Check whether an SSL certificate is generated
+	if _existsCrt, _ := FileExists("cert-rsa/ca.crt"); _existsCrt {
+		if _existsKey, _ := FileExists("cert-rsa/ca.key"); _existsKey {
+			return
+		}
+	}
 	// Example Create a CA certificate storage directory
 	if _, err := os.Stat("cert-rsa"); err != nil {
 		_ = os.Mkdir("cert-rsa", 0766) // Directory permissions

lib/convert.go

@@ -11,6 +11,7 @@ import (
 	"crypto/md5"
 	"encoding/hex"
 	"encoding/json"
+	"os"
 	"regexp"
 )
 
@@ -45,3 +46,14 @@ func CheckIP(ip string) bool {
 	}
 	return true
 }
+
+func FileExists(path string) (bool, error) {
+	_, err := os.Stat(path)
+	if err == nil {
+		return true, nil
+	}
+	if os.IsNotExist(err) {
+		return false, nil
+	}
+	return false, err
+}

lib/logger.go

@@ -7,9 +7,7 @@
 
 package lib
 
-import (
-	"github.com/phachon/go-logger"
-)
+import "github.com/phachon/go-logger"
 
 func Logger() *go_logger.Logger {
 	logger := go_logger.NewLogger()
@@ -23,7 +21,8 @@ func Logger() *go_logger.Logger {
 	fileConfig := &go_logger.FileConfig{
 		Filename:  "./RedGuard.log",
 		MaxSize:   1024 * 1024, // Maximum file size (KB). The default value is 0
-		MaxLine:   100000,
+		MaxLine:   50000,
+		MaxBak:    1,
 		DateSlice: "d",
 		Format:    "[%timestamp_format%] [%function%] %body%",
 	}