mirror of
https://github.com/wikiZ/RedGuard
synced 2026-06-08 18:18:32 +00:00
Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 风起
|
2e211427ba |
@@ -1,3 +1,8 @@
|
||||
## [22.08.03.1214] - 2022-08-03
|
||||
### Added
|
||||
- Support custom domain names for communication between intranet hosts
|
||||
- Edge hosts uses domain fronting to establish hidden C2 channels with CDN
|
||||
|
||||
## [22.7.22.1036] - 2022-7-22
|
||||
### Added
|
||||
- Add ThreatBook Cloud SandBox to JA3 Fingerprint Base Interception rule library
|
||||
|
||||
@@ -88,8 +88,12 @@ root@VM-4-13-ubuntu:~# ./RedGuard -h
|
||||
Usage of ./RedGuard:
|
||||
-DropAction string
|
||||
RedGuard interception action (default "redirect")
|
||||
-EdgeHost string
|
||||
Set Edge Host Communication Domain (default "*")
|
||||
-EdgeTarget string
|
||||
Set Edge Host Proxy Target (default "*")
|
||||
-HasCert string
|
||||
Whether to use the certificate you have applied for (default "false")
|
||||
Whether to use the certificate you have applied for (default "true")
|
||||
-allowIP string
|
||||
Proxy Requests Allow IP (default "*")
|
||||
-allowLocation string
|
||||
@@ -98,6 +102,8 @@ Usage of ./RedGuard:
|
||||
Proxy Requests Allow Time (default "*")
|
||||
-common string
|
||||
Cert CommonName (default "*.aliyun.com")
|
||||
-config string
|
||||
Set Config Path
|
||||
-country string
|
||||
Cert Country (default "CN")
|
||||
-dns string
|
||||
@@ -316,6 +322,12 @@ In the self-built Domain fronting, keep multiple reverse proxy ports consistent,
|
||||
|
||||
This can be achieved through multiple node servers, and configure multiple IPs of our nodes in the CS listener HTTPS online IP.
|
||||
|
||||
## Edge Node
|
||||
|
||||
RedGuard 22.08.03 updated the edge host online settings - custom intranet host interaction domain name, and the edge host uses the domain front CDN node interaction. The asymmetry of the information exchanged between the two hosts is achieved, making it more difficult to trace the source and make it difficult to check.
|
||||
|
||||
|
||||
|
||||
## CobaltStrike
|
||||
|
||||
If there is a problem with the above method, the actual online C2 server cannot be directly intercepted by the firewall, because the actual load balancing request in the reverse proxy is made by the IP of the cloud server manufacturer.
|
||||
@@ -371,6 +383,20 @@ Thank you for your support. RedGuard will continue to improve and update it. I h
|
||||
|
||||
**About the developer 风起 related articles:https://www.anquanke.com/member.html?memberId=148652**
|
||||
|
||||
> 2022Kcon Author of the weapon spectrum of the hacker conference
|
||||
>
|
||||
> The 10th ISC Internet Security Conference Advanced Offensive and Defense Forum "C2 Front Flow Control" topic
|
||||
>
|
||||
> https://isc.n.cn/m/pages/live/index?channel_id=iscyY043&ncode=UR6KZ&room_id=1981905&server_id=785016&tab_id=253
|
||||
>
|
||||
> Analysis of cloud sandbox flow identification technology
|
||||
>
|
||||
> https://www.anquanke.com/post/id/277431
|
||||
>
|
||||
> Realization of JARM Fingerprint Randomization Technology
|
||||
>
|
||||
> https://www.anquanke.com/post/id/276546
|
||||
|
||||
**Kunyu: https://github.com/knownsec/Kunyu**
|
||||
|
||||
> 风起于青萍之末，浪成于微澜之间。
|
||||
@@ -378,6 +404,6 @@ Thank you for your support. RedGuard will continue to improve and update it. I h
|
||||
|
||||
# 0x06 Community
|
||||
|
||||
If you have any questions or requirements, you can submit an issue under the project, or contact the tool author by adding WeCat.
|
||||
If you have any questions or requirements, you can submit an issue under the project, or contact the tool author by adding WeChat.
|
||||
|
||||
|
||||
|
||||
-222
@@ -317,225 +317,3 @@
|
||||
[2022-05-30 17:33:19] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53L, like Gecko) Chrome/90.0.4430.212 Safari/537.36
|
||||
[2022-05-30 17:33:19] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 169
|
||||
[2022-05-30 17:33:20] [RedGuard/core.modifyResponse.func1.1] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2022-05-30 17:34:42] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy...
|
||||
[2022-05-30 17:34:42] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://47.94.170.143:4433/"}
|
||||
[2022-05-30 17:34:42] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2022-05-30 17:34:42] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2022-05-30 17:34:48] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /js/config.js
|
||||
[2022-05-30 17:34:48] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53L, like Gecko) Chrome/90.0.4430.212 Safari/537.36
|
||||
[2022-05-30 17:34:48] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 404 Not Found, length: 271
|
||||
[2022-05-30 17:34:48] [RedGuard/core.modifyResponse.func1.1] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2022-05-30 17:34:57] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy...
|
||||
[2022-05-30 17:34:57] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://47.94.170.143:4433/"}
|
||||
[2022-05-30 17:34:57] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2022-05-30 17:34:57] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2022-05-30 17:35:00] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-05-30 17:35:00] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53L, like Gecko) Chrome/90.0.4430.212 Safari/537.36
|
||||
[2022-05-30 17:35:00] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: 546
|
||||
[2022-05-30 17:35:00] [RedGuard/core.modifyResponse.func1.1] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2022-05-30 17:41:36] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy...
|
||||
[2022-05-30 17:41:36] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://47.94.170.143:4433/"}
|
||||
[2022-05-30 17:41:36] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2022-05-30 17:41:36] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2022-05-30 17:41:37] [RedGuard/core.(*baseHandle).ServeHTTP] [JA3] Hash: 3590d1b8f63dd1d590f0adea4227443d
|
||||
[2022-05-30 17:41:37] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-05-30 17:41:37] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53L, like Gecko) Chrome/90.0.4430.212 Safari/537.36
|
||||
[2022-05-30 17:41:37] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: 546
|
||||
[2022-05-30 17:41:37] [RedGuard/core.modifyResponse.func1.1] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2022-05-30 17:42:06] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy...
|
||||
[2022-05-30 17:42:06] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://47.94.170.143:4433/"}
|
||||
[2022-05-30 17:42:06] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2022-05-30 17:42:06] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2022-05-30 17:42:08] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 3590d1b8f63dd1d590f0adea4227443d
|
||||
[2022-05-30 17:42:08] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-05-30 17:42:08] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53L, like Gecko) Chrome/90.0.4430.212 Safari/537.36
|
||||
[2022-05-30 17:42:08] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: 546
|
||||
[2022-05-30 17:42:08] [RedGuard/core.modifyResponse.func1.1] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2022-05-30 17:42:23] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy...
|
||||
[2022-05-30 17:42:23] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://47.94.170.143:4433/"}
|
||||
[2022-05-30 17:42:23] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2022-05-30 17:42:23] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2022-05-30 17:42:24] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 3590d1b8f63dd1d590f0adea4227443d
|
||||
[2022-05-30 17:42:24] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-05-30 17:42:24] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53L, like Gecko) Chrome/90.0.4430.212 Safari/537.36
|
||||
[2022-05-30 17:42:24] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: 546
|
||||
[2022-05-30 17:42:24] [RedGuard/core.modifyResponse.func1.1] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2022-05-31 14:20:49] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy...
|
||||
[2022-05-31 14:20:49] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://47.94.170.143:4433/"}
|
||||
[2022-05-31 14:20:49] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2022-05-31 14:20:49] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2022-05-31 14:21:32] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 3590d1b8f63dd1d590f0adea4227443d
|
||||
[2022-05-31 14:21:32] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-05-31 14:21:32] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53L, like Gecko) Chrome/90.0.4430.212 Safari/537.36
|
||||
[2022-05-31 14:21:32] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 169
|
||||
[2022-05-31 14:21:32] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2022-05-31 14:21:41] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy...
|
||||
[2022-05-31 14:21:41] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://47.94.170.143:4433/"}
|
||||
[2022-05-31 14:21:41] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2022-05-31 14:21:41] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2022-05-31 14:21:59] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 3590d1b8f63dd1d590f0adea4227443d
|
||||
[2022-05-31 14:21:59] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-05-31 14:21:59] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53L, like Gecko) Chrome/90.0.4430.212 Safari/537.36
|
||||
[2022-05-31 14:21:59] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: 546
|
||||
[2022-05-31 14:22:31] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 3590d1b8f63dd1d590f0adea4227443d
|
||||
[2022-05-31 14:22:31] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-05-31 14:22:31] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53L, like Gecko) Chrome/90.0.4430.212 Safari/537.36
|
||||
[2022-05-31 14:22:31] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 169
|
||||
[2022-05-31 14:22:31] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2022-05-31 14:23:42] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy...
|
||||
[2022-05-31 14:23:42] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://47.94.170.143:4433/"}
|
||||
[2022-05-31 14:23:42] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2022-05-31 14:23:42] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2022-05-31 14:23:43] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 3590d1b8f63dd1d590f0adea4227443d
|
||||
[2022-05-31 14:23:43] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-05-31 14:23:43] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53L, like Gecko) Chrome/90.0.4430.212 Safari/537.36
|
||||
[2022-05-31 14:23:44] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 169
|
||||
[2022-05-31 14:23:44] [RedGuard/core.modifyResponse.func1.1] [DROP] Source IP: 127.0.0.1
|
||||
[2022-05-31 14:24:40] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy...
|
||||
[2022-05-31 14:24:40] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://47.94.170.143:4433/"}
|
||||
[2022-05-31 14:24:40] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2022-05-31 14:24:40] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2022-05-31 14:24:41] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 3590d1b8f63dd1d590f0adea4227443d
|
||||
[2022-05-31 14:24:41] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-05-31 14:24:41] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53L, like Gecko) Chrome/90.0.4430.212 Safari/537.36
|
||||
[2022-05-31 14:24:41] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 169
|
||||
[2022-05-31 14:24:41] [RedGuard/core.modifyResponse.func1.1] [DROP] Source IP: 127.0.0.1
|
||||
[2022-05-31 14:25:02] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 3590d1b8f63dd1d590f0adea4227443d
|
||||
[2022-05-31 14:25:02] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-05-31 14:25:02] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53L, like Gecko) Chrome/90.0.4430.212 Safari/537.36
|
||||
[2022-05-31 14:25:02] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: 546
|
||||
[2022-05-31 14:26:57] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy...
|
||||
[2022-05-31 14:26:57] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://47.94.170.143:4433/"}
|
||||
[2022-05-31 14:26:57] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2022-05-31 14:26:57] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2022-05-31 14:27:00] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 3590d1b8f63dd1d590f0adea4227443d
|
||||
[2022-05-31 14:27:00] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-05-31 14:27:00] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53L, like Gecko) Chrome/90.0.4430.212 Safari/537.36
|
||||
[2022-05-31 14:27:00] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: 546
|
||||
[2022-05-31 14:27:26] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy...
|
||||
[2022-05-31 14:27:26] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://47.94.170.143:4433/"}
|
||||
[2022-05-31 14:27:26] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2022-05-31 14:27:26] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2022-05-31 14:27:28] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 3590d1b8f63dd1d590f0adea4227443d
|
||||
[2022-05-31 14:27:28] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-05-31 14:27:28] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53L, like Gecko) Chrome/90.0.4430.212 Safari/537.36
|
||||
[2022-05-31 14:27:28] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: 546
|
||||
[2022-06-01 15:36:04] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy...
|
||||
[2022-06-01 15:36:04] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://47.94.170.143:4433/"}
|
||||
[2022-06-01 15:36:04] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2022-06-01 15:36:04] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2022-06-01 15:36:11] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 68a2a6353c17dc14caf39d4996d1661c
|
||||
[2022-06-01 15:36:11] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:36:11] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:36:11] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 404 Not Found, length: 0
|
||||
[2022-06-01 15:36:11] [RedGuard/core.modifyResponse.func1.1] [DROP] Source IP: 127.0.0.1
|
||||
[2022-06-01 15:36:11] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://cloud.tencent.com/
|
||||
[2022-06-01 15:36:12] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 68a2a6353c17dc14caf39d4996d1661c
|
||||
[2022-06-01 15:36:12] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:36:12] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:36:12] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 404 Not Found, length: 0
|
||||
[2022-06-01 15:36:12] [RedGuard/core.modifyResponse.func1.1] [DROP] Source IP: 127.0.0.1
|
||||
[2022-06-01 15:36:12] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://cloud.tencent.com/
|
||||
[2022-06-01 15:36:13] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 68a2a6353c17dc14caf39d4996d1661c
|
||||
[2022-06-01 15:36:13] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:36:13] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:36:13] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 404 Not Found, length: 0
|
||||
[2022-06-01 15:36:13] [RedGuard/core.modifyResponse.func1.1] [DROP] Source IP: 127.0.0.1
|
||||
[2022-06-01 15:36:13] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://cloud.tencent.com/
|
||||
[2022-06-01 15:36:13] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 68a2a6353c17dc14caf39d4996d1661c
|
||||
[2022-06-01 15:36:13] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:36:13] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:36:13] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 404 Not Found, length: 0
|
||||
[2022-06-01 15:36:13] [RedGuard/core.modifyResponse.func1.1] [DROP] Source IP: 127.0.0.1
|
||||
[2022-06-01 15:36:13] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://cloud.tencent.com/
|
||||
[2022-06-01 15:36:14] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 68a2a6353c17dc14caf39d4996d1661c
|
||||
[2022-06-01 15:36:14] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:36:14] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:36:14] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 404 Not Found, length: 0
|
||||
[2022-06-01 15:36:14] [RedGuard/core.modifyResponse.func1.1] [DROP] Source IP: 127.0.0.1
|
||||
[2022-06-01 15:36:14] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://cloud.tencent.com/
|
||||
[2022-06-01 15:36:24] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 68a2a6353c17dc14caf39d4996d1661c
|
||||
[2022-06-01 15:36:24] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:36:24] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:36:24] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 161
|
||||
[2022-06-01 15:36:24] [RedGuard/core.modifyResponse.func1.1] [DROP] Source IP: 127.0.0.1
|
||||
[2022-06-01 15:36:24] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: dfa1a04d7a3940d1792725df93f81719
|
||||
[2022-06-01 15:36:24] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:36:24] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:36:24] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 161
|
||||
[2022-06-01 15:36:24] [RedGuard/core.modifyResponse.func1.1] [DROP] Source IP: 127.0.0.1
|
||||
[2022-06-01 15:36:25] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 1b550bbdde0f6511638eb52cd2ef9787
|
||||
[2022-06-01 15:36:25] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:36:25] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:36:25] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://tencent.com/
|
||||
[2022-06-01 15:36:25] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: c0fc8d2a3090cfd5c5a4d6a027c0d9ee
|
||||
[2022-06-01 15:36:25] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:36:25] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:36:25] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 161
|
||||
[2022-06-01 15:36:25] [RedGuard/core.modifyResponse.func1.1] [DROP] Source IP: 127.0.0.1
|
||||
[2022-06-01 15:36:26] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: c21234fe03e9149213ede6ecf6333853
|
||||
[2022-06-01 15:36:26] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:36:26] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:36:26] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 161
|
||||
[2022-06-01 15:36:26] [RedGuard/core.modifyResponse.func1.1] [DROP] Source IP: 127.0.0.1
|
||||
[2022-06-01 15:36:26] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 9d92b5b69ad7e3ba6732b092276f2a40
|
||||
[2022-06-01 15:36:26] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:36:26] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:36:26] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 161
|
||||
[2022-06-01 15:36:26] [RedGuard/core.modifyResponse.func1.1] [DROP] Source IP: 127.0.0.1
|
||||
[2022-06-01 15:36:52] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: a1cf9cd9cf6ecfd42459643454d3d409
|
||||
[2022-06-01 15:36:52] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:36:52] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:36:53] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 169
|
||||
[2022-06-01 15:36:53] [RedGuard/core.modifyResponse.func1.1] [DROP] Source IP: 127.0.0.1
|
||||
[2022-06-01 15:36:54] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 0294d48ead6646ccd3446c0d79b953d4
|
||||
[2022-06-01 15:36:54] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:36:54] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:36:54] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 169
|
||||
[2022-06-01 15:36:54] [RedGuard/core.modifyResponse.func1.1] [DROP] Source IP: 127.0.0.1
|
||||
[2022-06-01 15:36:55] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: b9ddaf9bf0f00f86749f6e8b83b759ec
|
||||
[2022-06-01 15:36:55] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:36:55] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:36:55] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 169
|
||||
[2022-06-01 15:36:55] [RedGuard/core.modifyResponse.func1.1] [DROP] Source IP: 127.0.0.1
|
||||
[2022-06-01 15:36:55] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: ab6c50ef473b76a2aaf48bd06d20f8e1
|
||||
[2022-06-01 15:36:55] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:36:55] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:36:55] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 169
|
||||
[2022-06-01 15:36:55] [RedGuard/core.modifyResponse.func1.1] [DROP] Source IP: 127.0.0.1
|
||||
[2022-06-01 15:37:00] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 34bab37e854f9e9afb68e9a98bef9c81
|
||||
[2022-06-01 15:37:00] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:37:00] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:37:01] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 169
|
||||
[2022-06-01 15:37:01] [RedGuard/core.modifyResponse.func1.1] [DROP] Source IP: 127.0.0.1
|
||||
[2022-06-01 15:37:12] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 0bc598b11dd90ca04efaf1442167fc24
|
||||
[2022-06-01 15:37:12] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:37:12] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:37:12] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 161
|
||||
[2022-06-01 15:37:12] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://tencent.com/
|
||||
[2022-06-01 15:37:28] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 0bc598b11dd90ca04efaf1442167fc24
|
||||
[2022-06-01 15:37:28] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:37:28] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:37:28] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 404 Not Found, length: 0
|
||||
[2022-06-01 15:37:28] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://yun.tencent.com
|
||||
[2022-06-01 15:37:30] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 0bc598b11dd90ca04efaf1442167fc24
|
||||
[2022-06-01 15:37:30] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:37:30] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:37:30] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 404 Not Found, length: 0
|
||||
[2022-06-01 15:37:30] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://yun.tencent.com
|
||||
[2022-06-01 15:37:40] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 0bc598b11dd90ca04efaf1442167fc24
|
||||
[2022-06-01 15:37:40] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:37:40] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:37:40] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 404 Not Found, length: 0
|
||||
[2022-06-01 15:37:40] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://cloud.tencent.com/
|
||||
[2022-06-01 15:37:40] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 0bc598b11dd90ca04efaf1442167fc24
|
||||
[2022-06-01 15:37:40] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:37:41] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:37:41] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 404 Not Found, length: 0
|
||||
[2022-06-01 15:37:41] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://cloud.tencent.com/
|
||||
[2022-06-01 15:37:41] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 0bc598b11dd90ca04efaf1442167fc24
|
||||
[2022-06-01 15:37:41] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2022-06-01 15:37:41] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
|
||||
[2022-06-01 15:37:41] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 404 Not Found, length: 0
|
||||
[2022-06-01 15:37:41] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://cloud.tencent.com/
|
||||
[2
|
||||
@@ -1,37 +1,41 @@
|
||||
package config
|
||||
|
||||
var RedGuardConfig = `[cert]
|
||||
# User Optional name
|
||||
DNSName = *.aliyun.com,manager.channel.aliyun.com,*.acs-internal.aliyuncs.com,*.connect.aliyun.com,aliyun.com,whois.www.net.cn,tianchi-global.com
|
||||
# Cert User CommonName
|
||||
CommonName = *.aliyun.com
|
||||
# Cert User Locality
|
||||
Locality = HangZhou
|
||||
# Cert User Organization
|
||||
Organization = Alibaba (China) Technology Co., Ltd.
|
||||
# Cert User Country
|
||||
Country = CN
|
||||
# Whether to use the certificate you have applied for true/false
|
||||
HasCert = true
|
||||
|
||||
[proxy]
|
||||
# key : Header Host value of the reverse proxy
|
||||
# value : The actual address forwarded by the reverse proxy
|
||||
HostTarget = {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
# HTTPS Reverse proxy port
|
||||
Port_HTTPS = :443
|
||||
# HTTP Reverse proxy port
|
||||
Port_HTTP = :80
|
||||
# RedGuard interception action: redirect / reset / proxy (Hijack HTTP Response)
|
||||
drop_action = proxy
|
||||
# URL to redirect to
|
||||
Redirect = https://360.net
|
||||
# IP address owning restrictions example:AllowLocation = 山东,上海,杭州 or shanghai,beijing
|
||||
AllowLocation = *
|
||||
# Whitelist list example: AllowIP = 172.16.1.1,192.168.1.1
|
||||
AllowIP = *
|
||||
# Limit the time of requests example: AllowTime = 8:00 - 16:00
|
||||
AllowTime = *
|
||||
# C2 Malleable File Path
|
||||
MalleableFile = *
|
||||
`
|
||||
package config
|
||||
|
||||
var RedGuardConfig = `[cert]
|
||||
# User Optional name
|
||||
DNSName = *.aliyun.com,manager.channel.aliyun.com,*.acs-internal.aliyuncs.com,*.connect.aliyun.com,aliyun.com,whois.www.net.cn,tianchi-global.com
|
||||
# Cert User CommonName
|
||||
CommonName = *.aliyun.com
|
||||
# Cert User Locality
|
||||
Locality = HangZhou
|
||||
# Cert User Organization
|
||||
Organization = Alibaba (China) Technology Co., Ltd.
|
||||
# Cert User Country
|
||||
Country = CN
|
||||
# Whether to use the certificate you have applied for true/false
|
||||
HasCert = true
|
||||
|
||||
[proxy]
|
||||
# key : Header Host value of the reverse proxy
|
||||
# value : The actual address forwarded by the reverse proxy
|
||||
HostTarget = {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
# HTTPS Reverse proxy port
|
||||
Port_HTTPS = :443
|
||||
# HTTP Reverse proxy port
|
||||
Port_HTTP = :80
|
||||
# RedGuard interception action: redirect / reset / proxy (Hijack HTTP Response)
|
||||
drop_action = proxy
|
||||
# URL to redirect to
|
||||
Redirect = https://360.net
|
||||
# IP address owning restrictions example:AllowLocation = 山东,上海,杭州 or shanghai,beijing
|
||||
AllowLocation = *
|
||||
# Whitelist list example: AllowIP = 172.16.1.1,192.168.1.1
|
||||
AllowIP = *
|
||||
# Limit the time of requests example: AllowTime = 8:00 - 16:00
|
||||
AllowTime = *
|
||||
# C2 Malleable File Path
|
||||
MalleableFile = *
|
||||
# Edge Host Communication Domain
|
||||
EdgeHost = *
|
||||
# Edge Host Proxy Target example: EdgeTarget = 360.com
|
||||
EdgeTarget = *
|
||||
`
|
||||
|
||||
+31
-31
@@ -1,31 +1,31 @@
|
||||
/**
|
||||
* @Author 风起
|
||||
* @contact: onlyzaliks@gmail.com
|
||||
* @File: version.go
|
||||
* @Time: 2022/5/5 9:25
|
||||
**/
|
||||
|
||||
package config
|
||||
|
||||
const (
|
||||
BANNER = `
|
||||
|
||||
██████╗ ███████╗██████╗ ██████╗ ██╗ ██╗ █████╗ ██████╗ ██████╗
|
||||
██╔══██╗██╔════╝██╔══██╗ ██╔════╝ ██║ ██║██╔══██╗██╔══██╗██╔══██╗
|
||||
██████╔╝█████╗ ██║ ██║ ██║ ███╗██║ ██║███████║██████╔╝██║ ██║
|
||||
██╔══██╗██╔══╝ ██║ ██║ ██║ ██║██║ ██║██╔══██║██╔══██╗██║ ██║
|
||||
██║ ██║███████╗██████╔╝ ╚██████╔╝╚██████╔╝██║ ██║██║ ██║██████╔╝ -V %s
|
||||
╚═╝ ╚═╝╚══════╝╚═════╝ ╚═════╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚═════╝
|
||||
|
||||
Github:%s
|
||||
|
||||
RedGuard is a C2 front flow control tool,Can avoid Blue Teams,AVs,EDRs check.
|
||||
`
|
||||
VERSION = "22.7.21 Alpha"
|
||||
TITLE = "RedGuard"
|
||||
LICENSE = "GPL-2.0"
|
||||
URL = "https://github.com/wikiZ/RedGuard"
|
||||
AUTHOR = "风起"
|
||||
TEAM = "0/00"
|
||||
COPYRIGHT = "Copyright (C) 2022 风起. All Rights Reserved"
|
||||
)
|
||||
/**
|
||||
* @Author 风起
|
||||
* @contact: onlyzaliks@gmail.com
|
||||
* @File: version.go
|
||||
* @Time: 2022/5/5 9:25
|
||||
**/
|
||||
|
||||
package config
|
||||
|
||||
const (
|
||||
BANNER = `
|
||||
|
||||
██████╗ ███████╗██████╗ ██████╗ ██╗ ██╗ █████╗ ██████╗ ██████╗
|
||||
██╔══██╗██╔════╝██╔══██╗ ██╔════╝ ██║ ██║██╔══██╗██╔══██╗██╔══██╗
|
||||
██████╔╝█████╗ ██║ ██║ ██║ ███╗██║ ██║███████║██████╔╝██║ ██║
|
||||
██╔══██╗██╔══╝ ██║ ██║ ██║ ██║██║ ██║██╔══██║██╔══██╗██║ ██║
|
||||
██║ ██║███████╗██████╔╝ ╚██████╔╝╚██████╔╝██║ ██║██║ ██║██████╔╝ -V %s
|
||||
╚═╝ ╚═╝╚══════╝╚═════╝ ╚═════╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚═════╝
|
||||
|
||||
Github:%s
|
||||
|
||||
RedGuard is a C2 front flow control tool,Can avoid Blue Teams,AVs,EDRs check.
|
||||
`
|
||||
VERSION = "22.08.03 Alpha"
|
||||
TITLE = "RedGuard"
|
||||
LICENSE = "GPL-2.0"
|
||||
URL = "https://github.com/wikiZ/RedGuard"
|
||||
AUTHOR = "风起"
|
||||
TEAM = "0/00"
|
||||
COPYRIGHT = "Copyright (C) 2022 风起. All Rights Reserved"
|
||||
)
|
||||
|
||||
+204
-194
@@ -1,194 +1,204 @@
|
||||
/**
|
||||
* @Author 风起
|
||||
* @contact: onlyzaliks@gmail.com
|
||||
* @File: ProxyHandler.go
|
||||
* @Time: 2022/5/5 16:53
|
||||
**/
|
||||
|
||||
package core
|
||||
|
||||
import (
|
||||
"io"
|
||||
"math/rand"
|
||||
"net/url"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"RedGuard/lib"
|
||||
|
||||
"github.com/sleeyax/ja3rp/crypto/tls"
|
||||
"github.com/sleeyax/ja3rp/net/http"
|
||||
"github.com/sleeyax/ja3rp/net/http/httputil"
|
||||
"github.com/wxnacy/wgo/arrays"
|
||||
)
|
||||
|
||||
var (
|
||||
ip string // HTTP remote IP
|
||||
redirectURL string // Proxy redirect URL
|
||||
_addressArray []string // By request list
|
||||
_startUp sync.Mutex // mutex lock
|
||||
_hostProxy = make(map[string]*httputil.ReverseProxy) // Used to cache httputil.ReverseProxy
|
||||
)
|
||||
|
||||
type baseHandle struct{}
|
||||
|
||||
func NewProxy(proxyURL string, dropType bool) (*httputil.ReverseProxy, error) {
|
||||
destinationURL, err := url.Parse(proxyURL)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
proxy := httputil.NewSingleHostReverseProxy(destinationURL)
|
||||
// dropType Check whether the response to the request is changed
|
||||
proxy.ModifyResponse = modifyResponse(dropType) // Modifies the response to the request
|
||||
return proxy, nil
|
||||
}
|
||||
|
||||
func modifyResponse(drop bool) func(*http.Response) error {
|
||||
return func(resp *http.Response) error {
|
||||
defer func(Body io.ReadCloser) {
|
||||
logger.Warningf("[RESPONSE] HTTP %s, length: %d", resp.Status, resp.ContentLength)
|
||||
if drop {
|
||||
// DROP Request
|
||||
logger.Alertf("[DROP] Source IP: %s", resp.Request.RemoteAddr)
|
||||
_ = Body.Close() // Direct shutdown response
|
||||
return
|
||||
}
|
||||
}(resp.Body)
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
// ProxyRequestHandler A reverse proxy processes HTTP requests
|
||||
func (h *baseHandle) ServeHTTP(write http.ResponseWriter, req *http.Request) {
|
||||
var (
|
||||
host = &req.Host
|
||||
cfg = lib.InitConfig() // config file object
|
||||
// Obtain the domain name and target map
|
||||
hostTarget = lib.JsonToMap(lib.ReadConfig(
|
||||
"proxy",
|
||||
"HostTarget",
|
||||
cfg),
|
||||
)
|
||||
// Read the configuration file to check whether DROP is enabled
|
||||
dropAction = lib.ReadConfig("proxy", "drop_action", cfg)
|
||||
// IP address of the host that initiates the request
|
||||
)
|
||||
var isDrop bool
|
||||
var proxy *httputil.ReverseProxy
|
||||
// Determine the URL to be redirected to
|
||||
redirectURL = lib.ReadConfig("proxy", "Redirect", cfg)
|
||||
req.RemoteAddr = lib.ConvertIP(req.RemoteAddr)
|
||||
// Obtaining the real IP address
|
||||
if req.Header.Get("X-Forwarded-For") != "" {
|
||||
req.RemoteAddr = req.Header.Get("X-Forwarded-For")
|
||||
}
|
||||
// Set the forwarding header XFF so that C2 obtains the online real IP address
|
||||
req.Header.Set("X-Forwarded-For", req.RemoteAddr)
|
||||
// Check whether the host is verified
|
||||
if IPHash := lib.EncodeMD5(req.JA3); arrays.ContainsString(_addressArray, req.JA3) == -1 {
|
||||
logger.Noticef("JA3 FingerPrint: %s", IPHash)
|
||||
logger.Noticef("[REQUEST] %s %s", req.Method, req.RequestURI)
|
||||
// Request filtering method
|
||||
if !ProxyFilterManger(req) {
|
||||
goto LOOK // Redirect to the specified site
|
||||
}
|
||||
logger.Noticef("[REQUEST] %s - %s", req.RemoteAddr, req.UserAgent())
|
||||
_addressArray = append(_addressArray, IPHash) // Add to the list after verification for the first time
|
||||
}
|
||||
// Fetch directly from cache
|
||||
if fn, ok := _hostProxy[*host]; ok {
|
||||
fn.ServeHTTP(write, req)
|
||||
return
|
||||
}
|
||||
// Check whether the domain name is in the whitelist
|
||||
if target, ok := hostTarget[*host]; ok {
|
||||
proxy, err := NewProxy(target, false)
|
||||
if err != nil {
|
||||
logger.Error("Proxy Exception")
|
||||
}
|
||||
_hostProxy[*host] = proxy // Into the cache
|
||||
proxy.ServeHTTP(write, req)
|
||||
return
|
||||
}
|
||||
|
||||
LOOK:
|
||||
req.URL.Path = "/" // Url rewriting
|
||||
// condition is not met, the element is removed from the slice
|
||||
// Output The URL of each request for this IP address
|
||||
if len(_addressArray) > 0 {
|
||||
_addressArray = _addressArray[:len(_addressArray)-1]
|
||||
}
|
||||
// dropAction Select the reverse proxy interception mode
|
||||
switch dropAction {
|
||||
// redirect
|
||||
case "redirect":
|
||||
http.Redirect(write, req, redirectURL, http.StatusTemporaryRedirect)
|
||||
goto REDIRECT
|
||||
// reset Turning off the HTTP response
|
||||
case "reset":
|
||||
isDrop = true
|
||||
// proxy Hijacking target requests response information
|
||||
case "proxy":
|
||||
break
|
||||
}
|
||||
// Determine whether to redirect or intercept intercepted traffic
|
||||
proxy, _ = NewProxy(redirectURL, isDrop)
|
||||
// Unauthorized access is redirected to the specified URL
|
||||
proxy.ServeHTTP(write, req)
|
||||
REDIRECT:
|
||||
// REDIRECT Request
|
||||
logger.Alertf("[%s] Source IP: %s -> Destination Site: %s", strings.ToUpper(dropAction), req.RemoteAddr, redirectURL)
|
||||
}
|
||||
|
||||
// ProxyManger Initialize the reverse proxy and pass in the address of the real back-end service
|
||||
// handle all requests to your server using the proxy
|
||||
// @param action string reverse proxy listening port type
|
||||
// @param port string reverse proxy listening port
|
||||
// @param pattern string pattern associated with the listening port type
|
||||
func ProxyManger(action, port, pattern string) {
|
||||
var (
|
||||
handle = &baseHandle{}
|
||||
config = &tls.Config{} // Example Initialize TLS config
|
||||
_isHasCert, _ = strconv.ParseBool(lib.ReadConfig("cert", "HasCert", lib.InitConfig()))
|
||||
)
|
||||
_startUp.Lock() // 我知道这可能是一个bug哈哈哈，但是它可能不影响什么，就不修了。
|
||||
http.Handle(pattern, handle)
|
||||
// Cancels the validity verification of the destination TLS certificate
|
||||
http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{
|
||||
InsecureSkipVerify: true,
|
||||
}
|
||||
// Disable client connection caching to connection pools
|
||||
http.DefaultTransport.(*http.Transport).DisableKeepAlives = true
|
||||
rand.Seed(time.Now().UnixNano())
|
||||
if !_isHasCert {
|
||||
config = &tls.Config{
|
||||
// JARM FingerPrint Random
|
||||
CipherSuites: lib.MicsSlice([]uint16{
|
||||
0x0005, 0x000a, 0x002f,
|
||||
0x0035, 0x003c, 0x009c,
|
||||
0x009d, 0xc011, 0xc012,
|
||||
0xc013, 0xc014, 0xc027,
|
||||
0xc02f, 0xc030, 0xcca8,
|
||||
}, rand.Intn(2)+1),
|
||||
}
|
||||
}
|
||||
server := &http.Server{
|
||||
Addr: port, // proxy port
|
||||
Handler: handle, // Cache structure
|
||||
TLSConfig: config, // TLS Server Config
|
||||
TLSNextProto: make(map[string]func(*http.Server, *tls.Conn, http.Handler), 1),
|
||||
}
|
||||
logger.Warningf("Proxy Listen Port %s (%s)", port, action)
|
||||
_startUp.Unlock()
|
||||
if action == "HTTPS" {
|
||||
// HTTPS reverse proxy
|
||||
_ = server.ListenAndServeTLS(
|
||||
"cert-rsa/ca.crt", // rsa cert crt
|
||||
"cert-rsa/ca.key", // rsa cert key
|
||||
)
|
||||
} else {
|
||||
_ = server.ListenAndServe() // HTTP reverse proxy
|
||||
}
|
||||
}
|
||||
/**
|
||||
* @Author 风起
|
||||
* @contact: onlyzaliks@gmail.com
|
||||
* @File: ProxyHandler.go
|
||||
* @Time: 2022/5/5 16:53
|
||||
**/
|
||||
|
||||
package core
|
||||
|
||||
import (
|
||||
"io"
|
||||
"math/rand"
|
||||
"net/url"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"RedGuard/lib"
|
||||
|
||||
"github.com/sleeyax/ja3rp/crypto/tls"
|
||||
"github.com/sleeyax/ja3rp/net/http"
|
||||
"github.com/sleeyax/ja3rp/net/http/httputil"
|
||||
"github.com/wxnacy/wgo/arrays"
|
||||
)
|
||||
|
||||
var (
|
||||
ip string // HTTP remote IP
|
||||
redirectURL string // Proxy redirect URL
|
||||
_addressArray []string // By request list
|
||||
_startUp sync.Mutex // mutex lock
|
||||
_hostProxy = make(map[string]*httputil.ReverseProxy) // Used to cache httputil.ReverseProxy
|
||||
)
|
||||
|
||||
type baseHandle struct{}
|
||||
|
||||
func NewProxy(proxyURL string, dropType bool) (*httputil.ReverseProxy, error) {
|
||||
destinationURL, err := url.Parse(proxyURL)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
proxy := httputil.NewSingleHostReverseProxy(destinationURL)
|
||||
// dropType Check whether the response to the request is changed
|
||||
proxy.ModifyResponse = modifyResponse(dropType) // Modifies the response to the request
|
||||
return proxy, nil
|
||||
}
|
||||
|
||||
func modifyResponse(drop bool) func(*http.Response) error {
|
||||
return func(resp *http.Response) error {
|
||||
defer func(Body io.ReadCloser) {
|
||||
logger.Warningf("[RESPONSE] HTTP %s, length: %d", resp.Status, resp.ContentLength)
|
||||
if drop {
|
||||
// DROP Request
|
||||
logger.Alertf("[DROP] Source IP: %s", resp.Request.RemoteAddr)
|
||||
_ = Body.Close() // Direct shutdown response
|
||||
return
|
||||
}
|
||||
}(resp.Body)
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
// ProxyRequestHandler A reverse proxy processes HTTP requests
|
||||
func (h *baseHandle) ServeHTTP(write http.ResponseWriter, req *http.Request) {
|
||||
var (
|
||||
host = &req.Host
|
||||
cfg = lib.InitConfig() // config file object
|
||||
// Obtain the domain name and target map
|
||||
hostTarget = lib.JsonToMap(lib.ReadConfig(
|
||||
"proxy",
|
||||
"HostTarget",
|
||||
cfg),
|
||||
)
|
||||
// Read the configuration file to check whether DROP is enabled
|
||||
dropAction = lib.ReadConfig("proxy", "drop_action", cfg)
|
||||
// Read the Edge Host Communication Domain
|
||||
edgeHost = lib.ReadConfig("proxy", "EdgeHost", cfg)
|
||||
// Read the Edge Host Proxy Target
|
||||
edgeTarget = lib.ReadConfig("proxy", "EdgeTarget", cfg)
|
||||
)
|
||||
var isDrop bool
|
||||
var proxy *httputil.ReverseProxy
|
||||
req.RemoteAddr = lib.ConvertIP(req.RemoteAddr)
|
||||
// Determine the URL to be redirected to
|
||||
redirectURL = lib.ReadConfig("proxy", "Redirect", cfg)
|
||||
// Obtaining the real IP address
|
||||
if req.Header.Get("X-Forwarded-For") != "" {
|
||||
req.RemoteAddr = req.Header.Get("X-Forwarded-For")
|
||||
}
|
||||
// Check whether Edge HOST Domain is enabled
|
||||
if edgeHost != "*" && edgeTarget != "*" && edgeHost != "" && edgeTarget != "" {
|
||||
// Replace request HOST
|
||||
hostTarget[edgeHost], req.Host = hostTarget[*host], edgeHost
|
||||
delete(hostTarget, edgeTarget)
|
||||
}
|
||||
// Set the forwarding header XFF so that C2 obtains the online real IP address
|
||||
req.Header.Set("X-Forwarded-For", req.RemoteAddr)
|
||||
// Check whether the host is verified
|
||||
if IPHash := lib.EncodeMD5(req.JA3); arrays.ContainsString(_addressArray, req.JA3) == -1 {
|
||||
logger.Noticef("JA3 FingerPrint: %s", IPHash)
|
||||
logger.Noticef("[REQUEST] %s %s", req.Method, req.RequestURI)
|
||||
// Request filtering method
|
||||
if !ProxyFilterManger(req) {
|
||||
goto LOOK // Redirect to the specified site
|
||||
}
|
||||
logger.Noticef("[REQUEST] %s - %s", req.RemoteAddr, req.UserAgent())
|
||||
_addressArray = append(_addressArray, IPHash) // Add to the list after verification for the first time
|
||||
}
|
||||
// Fetch directly from cache
|
||||
if fn, ok := _hostProxy[*host]; ok {
|
||||
fn.ServeHTTP(write, req)
|
||||
return
|
||||
}
|
||||
|
||||
// Check whether the domain name is in the whitelist
|
||||
if target, ok := hostTarget[*host]; ok {
|
||||
proxy, err := NewProxy(target, false)
|
||||
if err != nil {
|
||||
logger.Error("Proxy Exception")
|
||||
}
|
||||
_hostProxy[*host] = proxy // Into the cache
|
||||
proxy.ServeHTTP(write, req)
|
||||
return
|
||||
}
|
||||
|
||||
LOOK:
|
||||
req.URL.Path = "/" // Url rewriting
|
||||
// condition is not met, the element is removed from the slice
|
||||
// Output The URL of each request for this IP address
|
||||
if len(_addressArray) > 0 {
|
||||
_addressArray = _addressArray[:len(_addressArray)-1]
|
||||
}
|
||||
// dropAction Select the reverse proxy interception mode
|
||||
switch dropAction {
|
||||
// redirect
|
||||
case "redirect":
|
||||
http.Redirect(write, req, redirectURL, http.StatusTemporaryRedirect)
|
||||
goto REDIRECT
|
||||
// reset Turning off the HTTP response
|
||||
case "reset":
|
||||
isDrop = true
|
||||
// proxy Hijacking target requests response information
|
||||
case "proxy":
|
||||
break
|
||||
}
|
||||
// Determine whether to redirect or intercept intercepted traffic
|
||||
proxy, _ = NewProxy(redirectURL, isDrop)
|
||||
// Unauthorized access is redirected to the specified URL
|
||||
proxy.ServeHTTP(write, req)
|
||||
REDIRECT:
|
||||
// REDIRECT Request
|
||||
logger.Alertf("[%s] Source IP: %s -> Destination Site: %s", strings.ToUpper(dropAction), req.RemoteAddr, redirectURL)
|
||||
}
|
||||
|
||||
// ProxyManger Initialize the reverse proxy and pass in the address of the real back-end service
|
||||
// handle all requests to your server using the proxy
|
||||
// @param action string reverse proxy listening port type
|
||||
// @param port string reverse proxy listening port
|
||||
// @param pattern string pattern associated with the listening port type
|
||||
func ProxyManger(action, port, pattern string) {
|
||||
var (
|
||||
handle = &baseHandle{}
|
||||
config = &tls.Config{} // Example Initialize TLS config
|
||||
_isHasCert, _ = strconv.ParseBool(lib.ReadConfig("cert", "HasCert", lib.InitConfig()))
|
||||
)
|
||||
_startUp.Lock() // 我知道这可能是一个bug哈哈哈，但是它可能不影响什么，就不修了。
|
||||
http.Handle(pattern, handle)
|
||||
// Cancels the validity verification of the destination TLS certificate
|
||||
http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{
|
||||
InsecureSkipVerify: true,
|
||||
}
|
||||
// Disable client connection caching to connection pools
|
||||
http.DefaultTransport.(*http.Transport).DisableKeepAlives = true
|
||||
rand.Seed(time.Now().UnixNano())
|
||||
if !_isHasCert {
|
||||
config = &tls.Config{
|
||||
// JARM FingerPrint Random
|
||||
CipherSuites: lib.MicsSlice([]uint16{
|
||||
0x0005, 0x000a, 0x002f,
|
||||
0x0035, 0x003c, 0x009c,
|
||||
0x009d, 0xc011, 0xc012,
|
||||
0xc013, 0xc014, 0xc027,
|
||||
0xc02f, 0xc030, 0xcca8,
|
||||
}, rand.Intn(2)+1),
|
||||
}
|
||||
}
|
||||
server := &http.Server{
|
||||
Addr: port, // proxy port
|
||||
Handler: handle, // Cache structure
|
||||
TLSConfig: config, // TLS Server Config
|
||||
TLSNextProto: make(map[string]func(*http.Server, *tls.Conn, http.Handler), 1),
|
||||
}
|
||||
logger.Warningf("Proxy Listen Port %s (%s)", port, action)
|
||||
_startUp.Unlock()
|
||||
if action == "HTTPS" {
|
||||
// HTTPS reverse proxy
|
||||
_ = server.ListenAndServeTLS(
|
||||
"cert-rsa/ca.crt", // rsa cert crt
|
||||
"cert-rsa/ca.key", // rsa cert key
|
||||
)
|
||||
} else {
|
||||
_ = server.ListenAndServe() // HTTP reverse proxy
|
||||
}
|
||||
}
|
||||
|
||||
+40
-38
@@ -1,38 +1,40 @@
|
||||
/**
|
||||
* @Author 风起
|
||||
* @contact: onlyzaliks@gmail.com
|
||||
* @File: arguments.go
|
||||
* @Time: 2022/5/5 9:46
|
||||
**/
|
||||
|
||||
package core
|
||||
|
||||
import (
|
||||
"flag"
|
||||
|
||||
"RedGuard/core/parameter"
|
||||
)
|
||||
|
||||
func CmdParse(parse *parameter.Parses, cert *parameter.Cert, proxy *parameter.Proxy) {
|
||||
flag.BoolVar(&parse.Update, "u", false, `Enable configuration file modification`)
|
||||
flag.StringVar(&parse.C2Type, "type", `CobaltStrike`, `C2 Server Type`)
|
||||
flag.StringVar(&parse.IP, "ip", ``, `IPLookUP IP`)
|
||||
flag.StringVar(&parse.ConfigPath, "config", ``, `Set Config Path`)
|
||||
flag.StringVar(&parse.Location, "location", `风起`, `IPLookUP Location`)
|
||||
flag.StringVar(&cert.Country, "country", `CN`, `Cert Country`)
|
||||
flag.StringVar(&cert.CommonName, "common", `*.aliyun.com`, `Cert CommonName`)
|
||||
flag.StringVar(&cert.Organization, "organization", `Alibaba (China) Technology Co., Ltd.`, `Cert Organization`)
|
||||
flag.StringVar(&cert.HasCert, "HasCert", `true`, `Whether to use the certificate you have applied for`)
|
||||
flag.StringVar(&cert.DNSNameTo, "dns", `*.aliyun.com,manager.channel.aliyun.com,*.acs-internal.aliyuncs.com",*.connect.aliyun.com,aliyun.com,whois.www.net.cn,tianchi-global.com`, `Cert DNSName`)
|
||||
flag.StringVar(&cert.Locality, "locality", `HangZhou`, `Cert Locality`)
|
||||
flag.StringVar(&proxy.HostTarget, "host", `{"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}`, `Set Proxy HostTarget`)
|
||||
flag.StringVar(&proxy.HTTPSPort, "https", `:443`, `Set Proxy HTTPS Port`)
|
||||
flag.StringVar(&proxy.HTTPort, "http", `:80`, `Set Proxy HTTP Port`)
|
||||
flag.StringVar(&proxy.DropAction, "DropAction", "redirect", `RedGuard interception action`)
|
||||
flag.StringVar(&proxy.Redirect, "redirect", `https://360.net`, `Proxy redirect URL`)
|
||||
flag.StringVar(&proxy.AllowLocation, "allowLocation", "*", "Proxy Requests Allow Location")
|
||||
flag.StringVar(&proxy.AllowIP, "allowIP", "*", "Proxy Requests Allow IP")
|
||||
flag.StringVar(&proxy.AllowTime, "allowTime", "*", "Proxy Requests Allow Time")
|
||||
flag.StringVar(&proxy.MalleableFile, "malleable", "*", "Set Proxy Requests Filter Malleable File")
|
||||
flag.Parse()
|
||||
}
|
||||
/**
|
||||
* @Author 风起
|
||||
* @contact: onlyzaliks@gmail.com
|
||||
* @File: arguments.go
|
||||
* @Time: 2022/5/5 9:46
|
||||
**/
|
||||
|
||||
package core
|
||||
|
||||
import (
|
||||
"flag"
|
||||
|
||||
"RedGuard/core/parameter"
|
||||
)
|
||||
|
||||
func CmdParse(parse *parameter.Parses, cert *parameter.Cert, proxy *parameter.Proxy) {
|
||||
flag.BoolVar(&parse.Update, "u", false, `Enable configuration file modification`)
|
||||
flag.StringVar(&parse.C2Type, "type", `CobaltStrike`, `C2 Server Type`)
|
||||
flag.StringVar(&parse.IP, "ip", ``, `IPLookUP IP`)
|
||||
flag.StringVar(&parse.ConfigPath, "config", ``, `Set Config Path`)
|
||||
flag.StringVar(&parse.Location, "location", `风起`, `IPLookUP Location`)
|
||||
flag.StringVar(&cert.Country, "country", `CN`, `Cert Country`)
|
||||
flag.StringVar(&cert.CommonName, "common", `*.aliyun.com`, `Cert CommonName`)
|
||||
flag.StringVar(&cert.Organization, "organization", `Alibaba (China) Technology Co., Ltd.`, `Cert Organization`)
|
||||
flag.StringVar(&cert.HasCert, "HasCert", `true`, `Whether to use the certificate you have applied for`)
|
||||
flag.StringVar(&cert.DNSNameTo, "dns", `*.aliyun.com,manager.channel.aliyun.com,*.acs-internal.aliyuncs.com",*.connect.aliyun.com,aliyun.com,whois.www.net.cn,tianchi-global.com`, `Cert DNSName`)
|
||||
flag.StringVar(&cert.Locality, "locality", `HangZhou`, `Cert Locality`)
|
||||
flag.StringVar(&proxy.HostTarget, "host", `{"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}`, `Set Proxy HostTarget`)
|
||||
flag.StringVar(&proxy.HTTPSPort, "https", `:443`, `Set Proxy HTTPS Port`)
|
||||
flag.StringVar(&proxy.HTTPort, "http", `:80`, `Set Proxy HTTP Port`)
|
||||
flag.StringVar(&proxy.DropAction, "DropAction", "redirect", `RedGuard interception action`)
|
||||
flag.StringVar(&proxy.Redirect, "redirect", `https://360.net`, `Proxy redirect URL`)
|
||||
flag.StringVar(&proxy.AllowLocation, "allowLocation", "*", "Proxy Requests Allow Location")
|
||||
flag.StringVar(&proxy.AllowIP, "allowIP", "*", "Proxy Requests Allow IP")
|
||||
flag.StringVar(&proxy.AllowTime, "allowTime", "*", "Proxy Requests Allow Time")
|
||||
flag.StringVar(&proxy.MalleableFile, "malleable", "*", "Set Proxy Requests Filter Malleable File")
|
||||
flag.StringVar(&proxy.EdgeHost, "EdgeHost", "*", "Set Edge Host Communication Domain")
|
||||
flag.StringVar(&proxy.EdgeTarget, "EdgeTarget", "*", "Set Edge Host Proxy Target")
|
||||
flag.Parse()
|
||||
}
|
||||
|
||||
+47
-45
@@ -1,45 +1,47 @@
|
||||
/**
|
||||
* @Author 风起
|
||||
* @contact: onlyzaliks@gmail.com
|
||||
* @File: options.go
|
||||
* @Time: 2022/5/5 9:44
|
||||
**/
|
||||
|
||||
package parameter
|
||||
|
||||
type Parses struct {
|
||||
Update bool
|
||||
IP string
|
||||
C2Type string
|
||||
Location string
|
||||
ConfigPath string
|
||||
}
|
||||
|
||||
type Cert struct {
|
||||
Country string
|
||||
CommonName string
|
||||
Locality string
|
||||
Organization string
|
||||
DNSNameTo string
|
||||
HasCert string
|
||||
DNSName []string
|
||||
}
|
||||
|
||||
type Proxy struct {
|
||||
HostTarget string
|
||||
HTTPSPort string
|
||||
HTTPort string
|
||||
DropAction string
|
||||
Redirect string
|
||||
AllowLocation string
|
||||
AllowIP string
|
||||
AllowTime string
|
||||
MalleableFile string
|
||||
}
|
||||
|
||||
// ProxyConf Reverse proxy configuration structure
|
||||
type ProxyConf struct {
|
||||
Port string
|
||||
Action string
|
||||
Pattern string
|
||||
}
|
||||
/**
|
||||
* @Author 风起
|
||||
* @contact: onlyzaliks@gmail.com
|
||||
* @File: options.go
|
||||
* @Time: 2022/5/5 9:44
|
||||
**/
|
||||
|
||||
package parameter
|
||||
|
||||
type Parses struct {
|
||||
Update bool
|
||||
IP string
|
||||
C2Type string
|
||||
Location string
|
||||
ConfigPath string
|
||||
}
|
||||
|
||||
type Cert struct {
|
||||
Country string
|
||||
CommonName string
|
||||
Locality string
|
||||
Organization string
|
||||
DNSNameTo string
|
||||
HasCert string
|
||||
DNSName []string
|
||||
}
|
||||
|
||||
type Proxy struct {
|
||||
HostTarget string
|
||||
HTTPSPort string
|
||||
HTTPort string
|
||||
DropAction string
|
||||
Redirect string
|
||||
AllowLocation string
|
||||
AllowIP string
|
||||
AllowTime string
|
||||
MalleableFile string
|
||||
EdgeHost string
|
||||
EdgeTarget string
|
||||
}
|
||||
|
||||
// ProxyConf Reverse proxy configuration structure
|
||||
type ProxyConf struct {
|
||||
Port string
|
||||
Action string
|
||||
Pattern string
|
||||
}
|
||||
|
||||
+31
-5
@@ -83,11 +83,15 @@ HasCert = false
|
||||
```bash
|
||||
root@VM-4-13-ubuntu:~# ./RedGuard -h
|
||||
|
||||
Usage of ./RedGuard:
|
||||
Usage of ./RedGuard.exe:
|
||||
-DropAction string
|
||||
RedGuard interception action (default "redirect")
|
||||
-EdgeHost string
|
||||
Set Edge Host Communication Domain (default "*")
|
||||
-EdgeTarget string
|
||||
Set Edge Host Proxy Target (default "*")
|
||||
-HasCert string
|
||||
Whether to use the certificate you have applied for (default "false")
|
||||
Whether to use the certificate you have applied for (default "true")
|
||||
-allowIP string
|
||||
Proxy Requests Allow IP (default "*")
|
||||
-allowLocation string
|
||||
@@ -96,12 +100,14 @@ Usage of ./RedGuard:
|
||||
Proxy Requests Allow Time (default "*")
|
||||
-common string
|
||||
Cert CommonName (default "*.aliyun.com")
|
||||
-config string
|
||||
Set Config Path
|
||||
-country string
|
||||
Cert Country (default "CN")
|
||||
-dns string
|
||||
Cert DNSName (default "*.aliyun.com,manager.channel.aliyun.com,*.acs-internal.aliyuncs.com\",*.connect.aliyun.com,aliyun.com,whois.www.net.cn,tianchi-global.com")
|
||||
Cert DNSName
|
||||
-host string
|
||||
Set Proxy HostTarget (default "{\"360.net\":\"http://127.0.0.1:8080\",\"360.com\":\"https://127.0.0.1:4433\"}")
|
||||
Set Proxy HostTarget
|
||||
-http string
|
||||
Set Proxy HTTP Port (default ":80")
|
||||
-https string
|
||||
@@ -313,6 +319,12 @@ RedGuard是支持域前置的，在我看来一共有两种展现形式，一种
|
||||
|
||||
这里可以通过多个节点服务器实现，在CS监听器HTTPS上线IP配置多个我们的节点IP。
|
||||
|
||||
## 边缘节点
|
||||
|
||||
RedGuard 22.08.03更新了边缘主机上线设置-自定义内网主机交互域名，而边缘主机使用域前置CDN节点交互。达到了两台主机之间交互信息的不对称，使溯源难度更大，难以排查。
|
||||
|
||||
|
||||
|
||||
## CobaltStrike上线
|
||||
|
||||
如果说上面的这种方式有一个问题就是，实际上线的C2服务器是不能通过防火墙直接拦截掉的，因为在反向代理中实际进行负载均衡请求的是云服务器厂商IP进行的。
|
||||
@@ -368,6 +380,20 @@ RedGuard接收到请求：
|
||||
|
||||
**关于开发者 风起 相关文章：https://www.anquanke.com/member.html?memberId=148652**
|
||||
|
||||
> 2022Kcon黑客大会兵器谱作者
|
||||
>
|
||||
> 第十届ISC互联网安全大会 高级攻防论坛《C2设施前置流量控制技术》议题
|
||||
>
|
||||
> https://isc.n.cn/m/pages/live/index?channel_id=iscyY043&ncode=UR6KZ&room_id=1981905&server_id=785016&tab_id=253
|
||||
>
|
||||
> 云沙箱流量识别技术剖析
|
||||
>
|
||||
> https://www.anquanke.com/post/id/277431
|
||||
>
|
||||
> JARM指纹随机化技术实现
|
||||
>
|
||||
> https://www.anquanke.com/post/id/276546
|
||||
|
||||
**Kunyu: https://github.com/knownsec/Kunyu**
|
||||
|
||||
> 风起于青萍之末，浪成于微澜之间。
|
||||
@@ -375,6 +401,6 @@ RedGuard接收到请求：
|
||||
|
||||
# 0x06 Community
|
||||
|
||||
如果有问题或者需求可以在项目下提交issue，或通过添加WeCat联系工具作者。
|
||||
如果有问题或者需求可以在项目下提交issue，或通过添加WeChat联系工具作者。
|
||||
|
||||
|
||||
|
||||
+98
-97
@@ -1,97 +1,98 @@
|
||||
/**
|
||||
* @Author 风起
|
||||
* @contact: onlyzaliks@gmail.com
|
||||
* @File: handle_config.go
|
||||
* @Time: 2022/5/5 9:15
|
||||
**/
|
||||
|
||||
package lib
|
||||
|
||||
import (
|
||||
"RedGuard/config"
|
||||
"RedGuard/core/parameter"
|
||||
"fmt"
|
||||
"io/ioutil"
|
||||
"os"
|
||||
"os/user"
|
||||
|
||||
"github.com/go-ini/ini"
|
||||
)
|
||||
|
||||
var (
|
||||
_ConfigFilename string // Config Filename
|
||||
logger = Logger() // logger output model
|
||||
//localPath, _ = os.Getwd() // Current project root directory
|
||||
)
|
||||
|
||||
func InitConfig() *ini.File {
|
||||
// Check whether the configuration file has been created
|
||||
cfg, err := ini.Load(_ConfigFilename) // Loading a Configuration File
|
||||
// Check whether loading failed
|
||||
if err != nil {
|
||||
logger.Errorf("Fail to read file: %v", err)
|
||||
os.Exit(0)
|
||||
}
|
||||
// return *ini.File object
|
||||
return cfg
|
||||
}
|
||||
|
||||
func CreateConfig(C2Server string, ConfigPath string) (int, bool) {
|
||||
currentUser, _ := user.Current() // Current operating system user directory
|
||||
_ConfigFilename = fmt.Sprintf("%s/.RedGuard_%s.ini", currentUser.HomeDir, C2Server)
|
||||
// Verify that the configuration file is customized
|
||||
if file, _ := ioutil.ReadFile(ConfigPath); len(file) != 0 {
|
||||
_ConfigFilename = ConfigPath // Configuration file using a custom path
|
||||
}
|
||||
// Check whether the current operating system user directory configuration file exists
|
||||
if _, err := os.Stat(_ConfigFilename); err == nil || os.IsExist(err) {
|
||||
return 0, true
|
||||
}
|
||||
destination, err := os.Create(_ConfigFilename) // Operating system user directory location
|
||||
_, _ = destination.WriteString(config.RedGuardConfig)
|
||||
defer func(destination *os.File) {
|
||||
_ = destination.Close() // close destination File
|
||||
}(destination)
|
||||
logger.Notice("RedGuard initialization is complete!")
|
||||
logger.Noticef("RedGuard config path is: %s", _ConfigFilename)
|
||||
return 1, err == nil
|
||||
}
|
||||
|
||||
// WriteConfig Write data to config file
|
||||
func WriteConfig(section, key, value string, cfg *ini.File) bool {
|
||||
cfg.Section(section).Key(key).SetValue(value)
|
||||
if err := cfg.SaveTo(_ConfigFilename); err != nil {
|
||||
return false
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
// ReadConfig Return Field data specified in the configuration file
|
||||
func ReadConfig(section, key string, cfg *ini.File) string {
|
||||
return cfg.Section(section).Key(key).String()
|
||||
}
|
||||
|
||||
// UpdateConfig Modify the content of the configuration file
|
||||
// Oh, my God, this is not elegant!
|
||||
func UpdateConfig(cert *parameter.Cert, proxy *parameter.Proxy) {
|
||||
var (
|
||||
_certList = map[string]string{
|
||||
"Locality": cert.Locality, "Country": cert.Country, "Organization": cert.Organization,
|
||||
"CommonName": cert.CommonName, "DNSName": cert.DNSNameTo, "HasCert": cert.HasCert,
|
||||
}
|
||||
_proxyLIst = map[string]string{
|
||||
"Port_HTTP": proxy.HTTPort, "Port_HTTPS": proxy.HTTPSPort, "Redirect": proxy.Redirect,
|
||||
"AllowIP": proxy.AllowIP, "AllowTime": proxy.AllowTime, "AllowLocation": proxy.AllowLocation,
|
||||
"DropAction": proxy.DropAction, "HostTarget": proxy.HostTarget, "MalleableFile": proxy.MalleableFile,
|
||||
}
|
||||
cfg = InitConfig()
|
||||
)
|
||||
// re cert Write Config
|
||||
for k, v := range _certList {
|
||||
WriteConfig("cert", k, v, cfg)
|
||||
}
|
||||
// re proxy Write Config
|
||||
for k, v := range _proxyLIst {
|
||||
WriteConfig("proxy", k, v, cfg)
|
||||
}
|
||||
}
|
||||
/**
|
||||
* @Author 风起
|
||||
* @contact: onlyzaliks@gmail.com
|
||||
* @File: handle_config.go
|
||||
* @Time: 2022/5/5 9:15
|
||||
**/
|
||||
|
||||
package lib
|
||||
|
||||
import (
|
||||
"RedGuard/config"
|
||||
"RedGuard/core/parameter"
|
||||
"fmt"
|
||||
"io/ioutil"
|
||||
"os"
|
||||
"os/user"
|
||||
|
||||
"github.com/go-ini/ini"
|
||||
)
|
||||
|
||||
var (
|
||||
_ConfigFilename string // Config Filename
|
||||
logger = Logger() // logger output model
|
||||
//localPath, _ = os.Getwd() // Current project root directory
|
||||
)
|
||||
|
||||
func InitConfig() *ini.File {
|
||||
// Check whether the configuration file has been created
|
||||
cfg, err := ini.Load(_ConfigFilename) // Loading a Configuration File
|
||||
// Check whether loading failed
|
||||
if err != nil {
|
||||
logger.Errorf("Fail to read file: %v", err)
|
||||
os.Exit(0)
|
||||
}
|
||||
// return *ini.File object
|
||||
return cfg
|
||||
}
|
||||
|
||||
func CreateConfig(C2Server string, ConfigPath string) (int, bool) {
|
||||
currentUser, _ := user.Current() // Current operating system user directory
|
||||
_ConfigFilename = fmt.Sprintf("%s/.RedGuard_%s.ini", currentUser.HomeDir, C2Server)
|
||||
// Verify that the configuration file is customized
|
||||
if file, _ := ioutil.ReadFile(ConfigPath); len(file) != 0 {
|
||||
_ConfigFilename = ConfigPath // Configuration file using a custom path
|
||||
}
|
||||
// Check whether the current operating system user directory configuration file exists
|
||||
if _, err := os.Stat(_ConfigFilename); err == nil || os.IsExist(err) {
|
||||
return 0, true
|
||||
}
|
||||
destination, err := os.Create(_ConfigFilename) // Operating system user directory location
|
||||
_, _ = destination.WriteString(config.RedGuardConfig)
|
||||
defer func(destination *os.File) {
|
||||
_ = destination.Close() // close destination File
|
||||
}(destination)
|
||||
logger.Notice("RedGuard initialization is complete!")
|
||||
logger.Noticef("RedGuard config path is: %s", _ConfigFilename)
|
||||
return 1, err == nil
|
||||
}
|
||||
|
||||
// WriteConfig Write data to config file
|
||||
func WriteConfig(section, key, value string, cfg *ini.File) bool {
|
||||
cfg.Section(section).Key(key).SetValue(value)
|
||||
if err := cfg.SaveTo(_ConfigFilename); err != nil {
|
||||
return false
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
// ReadConfig Return Field data specified in the configuration file
|
||||
func ReadConfig(section, key string, cfg *ini.File) string {
|
||||
return cfg.Section(section).Key(key).String()
|
||||
}
|
||||
|
||||
// UpdateConfig Modify the content of the configuration file
|
||||
// Oh, my God, this is not elegant!
|
||||
func UpdateConfig(cert *parameter.Cert, proxy *parameter.Proxy) {
|
||||
var (
|
||||
_certList = map[string]string{
|
||||
"Locality": cert.Locality, "Country": cert.Country, "Organization": cert.Organization,
|
||||
"CommonName": cert.CommonName, "DNSName": cert.DNSNameTo, "HasCert": cert.HasCert,
|
||||
}
|
||||
_proxyLIst = map[string]string{
|
||||
"Port_HTTP": proxy.HTTPort, "Port_HTTPS": proxy.HTTPSPort, "Redirect": proxy.Redirect,
|
||||
"AllowIP": proxy.AllowIP, "AllowTime": proxy.AllowTime, "AllowLocation": proxy.AllowLocation,
|
||||
"drop_action": proxy.DropAction, "HostTarget": proxy.HostTarget, "MalleableFile": proxy.MalleableFile,
|
||||
"EdgeHost": proxy.EdgeHost, "EdgeTarget": proxy.EdgeTarget,
|
||||
}
|
||||
cfg = InitConfig()
|
||||
)
|
||||
// re cert Write Config
|
||||
for k, v := range _certList {
|
||||
WriteConfig("cert", k, v, cfg)
|
||||
}
|
||||
// re proxy Write Config
|
||||
for k, v := range _proxyLIst {
|
||||
WriteConfig("proxy", k, v, cfg)
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user