mirror of
https://github.com/wikiZ/RedGuard
synced 2026-06-08 18:18:32 +00:00
Compare commits
9 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 风起
|
fde5465503 | ||
|
风起
|
febd771e03 | ||
|
风起
|
fbbdd73c8f | ||
|
风起
|
cdd932df83 | ||
|
风起
|
5348ff449a | ||
|
风起
|
b910109b0c | ||
|
风起
|
88fc891a83 | ||
|
风起
|
eff36c678b | ||
|
风起
|
46f5aa34d5 |
@@ -1,3 +1,13 @@
|
||||
## [24.06.18.2001] - 2024-06-18
|
||||
### Update
|
||||
- Optimized the problem of requesting regional restriction matching errors
|
||||
|
||||
## [23.08.21.0113] - 2023-08-21
|
||||
### Added
|
||||
- Custom Delete Response Fields
|
||||
- Added Header Host information in log output
|
||||
- Solved the wrong package problem
|
||||
|
||||
## [23.05.14.2020] - 2023-05-14
|
||||
### Added
|
||||
- Sample Fingerprint Identify
|
||||
|
||||
@@ -53,11 +53,11 @@ chmod +x ./RedGuard&&./RedGuard
|
||||
|
||||
As shown in the figure below, Set executable permissions and initialize RedGuard. The first run will generate a configuration file in the current user home directory to achieve flexible function configuration. Configuration file name: **.RedGuard_CobaltStrike.ini**.
|
||||
|
||||
|
||||
|
||||
|
||||
**Configuration file content:**
|
||||
|
||||
|
||||
|
||||
|
||||
The configuration options of cert are mainly for the configuration information of SSL certificate encrypted HTTPS communication between the sample and the C2 front infrastructure. The proxy is mainly used to configure the control options in the reverse proxy traffic. The specific use will be explained in detail below.
|
||||
|
||||
@@ -86,12 +86,18 @@ HasCert = false
|
||||
root@VM-4-13-ubuntu:~# ./RedGuard -h
|
||||
|
||||
Usage of ./RedGuard:
|
||||
-DelHeader string
|
||||
Customize the header to be deleted
|
||||
-DropAction string
|
||||
RedGuard interception action (default "redirect")
|
||||
-EdgeHost string
|
||||
Set Edge Host Communication Domain (default "*")
|
||||
-EdgeTarget string
|
||||
Set Edge Host Proxy Target (default "*")
|
||||
-FieldFinger string
|
||||
Set HTTP Header identification field Info
|
||||
-FieldName string
|
||||
Set the name of the HTTP Header identification field
|
||||
-HasCert string
|
||||
Whether to use the certificate you have applied for (default "true")
|
||||
-allowIP string
|
||||
@@ -129,7 +135,6 @@ Usage of ./RedGuard:
|
||||
-type string
|
||||
C2 Server Type (default "CobaltStrike")
|
||||
-u Enable configuration file modification
|
||||
|
||||
```
|
||||
|
||||
**P.S. You can use the parameter command to modify the configuration file. Of course, I think it may be more convenient to modify it manually with vim.**
|
||||
@@ -293,6 +298,17 @@ The profile written by 风起 is recommended to use:
|
||||
|
||||
> <https://github.com/wikiZ/CobaltStrike-Malleable-Profile>
|
||||
|
||||
## Custom Delete Response Fields
|
||||
|
||||
In Cobalt Strike 4.7+, Teamserver automatically removes the Content-Encoding header without any notification, potentially causing a malleable http-(get|post).server violation. Moreover, if there is no Content-type in the CS Server response message, but after being forwarded by RedGuard, the Content-Type is added to the response message header, causing cf to cache the page and causing interference.
|
||||
|
||||
After RedGuard 23.08.21, the function of customizing the header of the response packet has been added. Users can customize and delete the header information in the response packet by modifying the configuration file to solve the problem of incorrect parsing.
|
||||
|
||||
```bash
|
||||
# Customize the header to be deleted example: Keep-Alive,Transfer-Encoding
|
||||
DelHeader = Keep-Alive,Transfer-Encoding
|
||||
```
|
||||
|
||||
## Sample FingerPrint
|
||||
|
||||
RedGuard 23.05.13 has updated the trojan sample fingerprint recognition function, which is based on customizing the HTTP Header field of the Malleable Profile as the fingerprint “**sample salt value**” for uniquely identifying the same **C2 listener**/Header Host. In addition, the trojan sample fingerprint generated by combining other relevant request fields can be used to detect the custom sample liveliness. According to the attacker’s task requirements, the trojan sample fingerprint recognition function can perform “**offline operation**” on the samples you want to disable, to better evade malicious traffic analysis of the sample communication and the staged sample PAYLOAD attack payload acquisition analysis, and provide more personalized stealth measures for the attacker.
|
||||
@@ -440,6 +456,7 @@ Thank you for your support. RedGuard will continue to improve and update it. I h
|
||||
> <https://isc.n.cn/m/pages/live/index?channel_id=iscyY043&ncode=UR6KZ&room_id=1981905&server_id=785016&tab_id=253>
|
||||
>
|
||||
> Exchange C2 traffic based on boundary node links
|
||||
>
|
||||
> <https://www.anquanke.com/post/id/278140>
|
||||
>
|
||||
> Analysis of cloud sandbox flow identification technology
|
||||
@@ -449,6 +466,10 @@ Thank you for your support. RedGuard will continue to improve and update it. I h
|
||||
> Realization of JARM Fingerprint Randomization Technology
|
||||
>
|
||||
> <https://www.anquanke.com/post/id/276546>
|
||||
>
|
||||
> C2 Infrastructure Threat Intelligence Countermeasures
|
||||
>
|
||||
> <https://paper.seebug.org/3022/>
|
||||
|
||||
**Kunyu: <https://github.com/knownsec/Kunyu>**
|
||||
|
||||
|
||||
+181
-1
@@ -316,4 +316,184 @@
|
||||
[2022-05-30 17:33:19] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /js/config.js
|
||||
[2022-05-30 17:33:19] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53L, like Gecko) Chrome/90.0.4430.212 Safari/537.36
|
||||
[2022-05-30 17:33:19] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 169
|
||||
[2022-05-30 17:33:20] [RedGuard/core.modifyResponse.func1.1] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2022-05-30 17:33:20] [RedGuard/core.modifyResponse.func1.1] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net[2023-08-19 22:28:45] [RedGuard/lib.CreateConfig] RedGuard initialization is complete!
|
||||
[2023-08-19 22:28:45] [RedGuard/lib.CreateConfig] RedGuard config path is: C:\Users\风起/.RedGuard_CobaltStrike.ini
|
||||
[2023-08-19 22:28:48] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:28:48] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:28:48] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:29:16] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:29:16] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:29:16] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:29:16] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:29:34] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:29:34] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:29:34] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:29:41] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:29:41] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:29:41] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:29:41] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:30:23] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:30:23] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:30:23] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:30:26] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:30:26] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:30:26] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:30:26] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:31:16] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:31:16] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:31:16] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:31:24] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:31:24] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:31:24] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:31:24] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:31:39] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:31:39] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:31:39] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:31:43] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:31:43] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:31:43] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:31:43] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:31:57] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 07f9ac0700dcc554249f644244e291a1
|
||||
[2023-08-19 22:31:57] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] POST /api/key/activate?readonly=false
|
||||
[2023-08-19 22:31:57] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - AcunetixWVS
|
||||
[2023-08-19 22:31:57] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:33:41] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:33:41] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:33:41] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:33:49] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:33:49] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:33:49] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:33:49] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:33:50] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:33:50] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:33:50] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:33:50] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:35:27] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:35:27] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:35:27] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:35:39] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:35:39] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:35:39] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:35:39] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:35:39] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:35:39] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:35:39] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:35:39] [RedGuard/core.(*baseHandle).ServeHTTP] [REDIRECT] Source IP: 127.0.0.1 -> Destination Site: https://360.net
|
||||
[2023-08-19 22:42:20] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:42:20] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:42:20] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:42:26] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:42:26] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:42:26] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:42:27] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:42:27] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 22:42:28] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:42:28] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /img/pv.gif?.stamp=1692456147940&Referer=
|
||||
[2023-08-19 22:42:28] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:42:28] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:42:29] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:42:29] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /favicon.ico
|
||||
[2023-08-19 22:42:29] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:42:29] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:42:29] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 22:43:32] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:43:32] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:43:32] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:43:37] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:43:37] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:43:37] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:43:38] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:43:38] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 22:43:39] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:43:39] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /img/pv.gif?.stamp=1692456219015&Referer=
|
||||
[2023-08-19 22:43:39] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:43:40] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:43:40] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:43:40] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /favicon.ico
|
||||
[2023-08-19 22:43:40] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:43:41] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:43:41] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 22:48:03] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 22:48:03] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 22:48:03] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 22:48:10] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:48:10] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:48:10] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:48:12] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:48:12] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 22:48:14] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:48:14] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /favicon.ico
|
||||
[2023-08-19 22:48:14] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:48:15] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:48:15] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 22:48:32] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:48:32] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:48:32] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:48:32] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:48:32] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 22:48:34] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:48:34] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /img/pv.gif?.stamp=1692456514051&Referer=
|
||||
[2023-08-19 22:48:34] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:48:34] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:48:44] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:48:44] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /favicon.ico
|
||||
[2023-08-19 22:48:44] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:48:44] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:48:44] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 22:48:53] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:48:53] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 22:48:53] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:48:53] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:48:53] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 22:48:54] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:48:54] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /img/pv.gif?.stamp=1692456534121&Referer=
|
||||
[2023-08-19 22:48:54] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:48:54] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:49:10] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 22:49:10] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /favicon.ico
|
||||
[2023-08-19 22:49:10] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 22:49:10] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 22:49:10] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 23:09:04] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 23:09:04] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 23:09:04] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 23:09:28] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 23:09:28] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 23:09:28] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 23:09:29] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 23:09:29] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 23:09:30] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 23:09:30] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /img/pv.gif?.stamp=1692457770219&Referer=
|
||||
[2023-08-19 23:09:30] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 23:09:30] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 23:13:22] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"}
|
||||
[2023-08-19 23:13:22] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP)
|
||||
[2023-08-19 23:13:22] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS)
|
||||
[2023-08-19 23:14:53] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 23:14:53] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 23:14:53] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 23:14:54] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 23:14:54] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 23:14:55] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 23:14:55] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /img/pv.gif?.stamp=1692458095001&Referer=
|
||||
[2023-08-19 23:14:55] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 23:14:55] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 23:14:56] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 23:14:56] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /favicon.ico
|
||||
[2023-08-19 23:14:56] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 23:14:57] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 23:14:57] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 23:15:09] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 23:15:09] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /
|
||||
[2023-08-19 23:15:09] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 23:15:09] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 23:15:09] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
[2023-08-19 23:15:09] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 23:15:09] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /img/pv.gif?.stamp=1692458109917&Referer=
|
||||
[2023-08-19 23:15:09] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 23:15:10] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 23:15:10] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e
|
||||
[2023-08-19 23:15:10] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /favicon.ico
|
||||
[2023-08-19 23:15:10] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
|
||||
[2023-08-19 23:15:11] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 200 OK, length: -1
|
||||
[2023-08-19 23:15:11] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://market.baidu.com
|
||||
|
||||
@@ -38,6 +38,8 @@ MalleableFile = *
|
||||
EdgeHost = *
|
||||
# Edge Host Proxy Target example: EdgeTarget = 360.com
|
||||
EdgeTarget = *
|
||||
# Customize the header to be deleted example: Keep-Alive,Transfer-Encoding
|
||||
DelHeader = *
|
||||
|
||||
[SampleFinger]
|
||||
# HTTP Request Header Field
|
||||
|
||||
+2
-2
@@ -21,11 +21,11 @@ Github:%s
|
||||
|
||||
RedGuard is a C2 front flow control tool,Can avoid Blue Teams,AVs,EDRs check.
|
||||
`
|
||||
VERSION = "23.05.13 Alpha"
|
||||
VERSION = "23.08.21 Alpha"
|
||||
TITLE = "RedGuard"
|
||||
LICENSE = "GPL-2.0"
|
||||
URL = "https://github.com/wikiZ/RedGuard"
|
||||
AUTHOR = "风起"
|
||||
TEAM = "0/00"
|
||||
TEAM = "Independent Security Researcher"
|
||||
COPYRIGHT = "Copyright (C) 2022 风起. All Rights Reserved"
|
||||
)
|
||||
|
||||
+15
-5
@@ -34,21 +34,28 @@ var (
|
||||
|
||||
type baseHandle struct{}
|
||||
|
||||
func NewProxy(proxyURL string, dropType bool) (*httputil.ReverseProxy, error) {
|
||||
func NewProxy(proxyURL string, dropType bool, delHeader string) (*httputil.ReverseProxy, error) {
|
||||
destinationURL, err := url.Parse(proxyURL)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
proxy := httputil.NewSingleHostReverseProxy(destinationURL)
|
||||
// dropType Check whether the response to the request is changed
|
||||
proxy.ModifyResponse = modifyResponse(dropType) // Modifies the response to the request
|
||||
proxy.ModifyResponse = modifyResponse(dropType, delHeader) // Modifies the response to the request
|
||||
return proxy, nil
|
||||
}
|
||||
|
||||
func modifyResponse(drop bool) func(*http.Response) error {
|
||||
func modifyResponse(drop bool, delHeader string) func(*http.Response) error {
|
||||
return func(resp *http.Response) error {
|
||||
defer func(Body io.ReadCloser) {
|
||||
logger.Warningf("[RESPONSE] HTTP %s, length: %d", resp.Status, resp.ContentLength)
|
||||
delHeaderList := strings.Split(delHeader, ",")
|
||||
if delHeader != "*" && delHeaderList != nil {
|
||||
// Delete the header field specified in the RG response type
|
||||
for _, header := range delHeaderList {
|
||||
resp.Header.Del(header)
|
||||
}
|
||||
}
|
||||
if drop {
|
||||
// DROP Request
|
||||
logger.Alertf("[DROP] Source IP: %s", resp.Request.RemoteAddr)
|
||||
@@ -77,6 +84,8 @@ func (h *baseHandle) ServeHTTP(write http.ResponseWriter, req *http.Request) {
|
||||
edgeHost = lib.ReadConfig("proxy", "EdgeHost", cfg)
|
||||
// Read the Edge Host Proxy Target
|
||||
edgeTarget = lib.ReadConfig("proxy", "EdgeTarget", cfg)
|
||||
// Customize the header to be deleted
|
||||
delHeader = lib.ReadConfig("proxy", "DelHeader", cfg)
|
||||
)
|
||||
var isDrop bool
|
||||
var proxy *httputil.ReverseProxy
|
||||
@@ -98,6 +107,7 @@ func (h *baseHandle) ServeHTTP(write http.ResponseWriter, req *http.Request) {
|
||||
// Check whether the host is verified
|
||||
if IPHash := lib.EncodeMD5(req.JA3); arrays.ContainsString(_addressArray, req.JA3) == -1 {
|
||||
logger.Noticef("JA3 FingerPrint: %s", IPHash)
|
||||
logger.Noticef("[REQUEST] Host:%s", req.Host)
|
||||
logger.Noticef("[REQUEST] %s %s", req.Method, req.RequestURI)
|
||||
logger.Noticef("[REQUEST] %s - %s", req.RemoteAddr, req.UserAgent())
|
||||
// Request filtering method
|
||||
@@ -114,7 +124,7 @@ func (h *baseHandle) ServeHTTP(write http.ResponseWriter, req *http.Request) {
|
||||
|
||||
// Check whether the domain name is in the whitelist
|
||||
if target, ok := hostTarget[*host]; ok {
|
||||
proxy, err := NewProxy(target, false)
|
||||
proxy, err := NewProxy(target, false, delHeader)
|
||||
if err != nil {
|
||||
logger.Error("Proxy Exception")
|
||||
}
|
||||
@@ -144,7 +154,7 @@ LOOK:
|
||||
break
|
||||
}
|
||||
// Determine whether to redirect or intercept intercepted traffic
|
||||
proxy, _ = NewProxy(redirectURL, isDrop)
|
||||
proxy, _ = NewProxy(redirectURL, isDrop, delHeader)
|
||||
// Unauthorized access is redirected to the specified URL
|
||||
proxy.ServeHTTP(write, req)
|
||||
REDIRECT:
|
||||
|
||||
@@ -38,5 +38,6 @@ func CmdParse(parse *parameter.Parses, cert *parameter.Cert, finger *parameter.S
|
||||
flag.StringVar(&proxy.EdgeTarget, "EdgeTarget", "*", "Set Edge Host Proxy Target")
|
||||
flag.StringVar(&finger.FieldName, "FieldName", "", "Set the name of the HTTP Header identification field")
|
||||
flag.StringVar(&finger.FieldFinger, "FieldFinger", "", "Set HTTP Header identification field Info")
|
||||
flag.StringVar(&finger.FieldFinger, "DelHeader", "", "Customize the header to be deleted")
|
||||
flag.Parse()
|
||||
}
|
||||
|
||||
+94
-92
@@ -1,92 +1,94 @@
|
||||
/**
|
||||
* @Author 风起
|
||||
* @contact: onlyzaliks@gmail.com
|
||||
* @File: ipLookUp.go
|
||||
* @Time: 2022/5/5 9:13
|
||||
**/
|
||||
|
||||
package core
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"RedGuard/lib"
|
||||
|
||||
"github.com/tidwall/gjson"
|
||||
)
|
||||
|
||||
// IPLookup IP origin,API is defined to extract relevant information
|
||||
type ipLookup struct {
|
||||
allowStatus int // API http request status code
|
||||
hasCount int // Check if the first character of location is in English
|
||||
body string // Get THE API response body JSON data
|
||||
Tag string // The json data Tag
|
||||
location string // Restrict the geographical location of the online
|
||||
}
|
||||
|
||||
var (
|
||||
_apiUrl = []string{
|
||||
// Chinese Users IP API
|
||||
"https://sp0.baidu.com/8aQDcjqpAAV3otqbppnN2DJv/api.php?query=%s&co=&resource_id=6006",
|
||||
// IP API for users in other countries
|
||||
"https://ipapi.co/%s/json/",
|
||||
}
|
||||
logger = lib.Logger() // logger output model
|
||||
)
|
||||
|
||||
// IPLookUp returns true if Check whether the IP address is the same as the owning place
|
||||
// @param ip string Specify IP address
|
||||
// @param location string Specify location
|
||||
// NOTE: other countries Server You are advised to set location to English
|
||||
// This will prioritize IP API that are more efficient for you
|
||||
func IPLookUp(location, ip string) (state bool) {
|
||||
var IPLook ipLookup
|
||||
for _, url := range _apiUrl {
|
||||
// Check preferentially invoked
|
||||
if IPLook.hasCount != 1 {
|
||||
// Check that the first character of location is in English
|
||||
if regexp.MustCompile("[a-zA-Z]").MatchString(location[0:1]) {
|
||||
// Other countries IP API are preferentially invoked if conditions are met
|
||||
url, IPLook.hasCount = _apiUrl[1], 1
|
||||
}
|
||||
} else {
|
||||
url = _apiUrl[0] // preferentially invoked Chinese Users IP API
|
||||
}
|
||||
|
||||
// Get json data for the IP API response body
|
||||
IPLook.allowStatus, IPLook.body = lib.HTTPRequest(fmt.Sprintf(url, ip))
|
||||
if IPLook.allowStatus == 200 {
|
||||
// Select the response JSON tag when json data is available
|
||||
if url == _apiUrl[0] {
|
||||
IPLook.Tag = `data.#.location` // Chinese Users IP API Tag
|
||||
break
|
||||
}
|
||||
IPLook.Tag = `city`
|
||||
IPLook.location += gjson.Get(IPLook.body, `region`).String()
|
||||
break
|
||||
}
|
||||
}
|
||||
// Check for valid JSON data
|
||||
if gjson.Valid(IPLook.body) {
|
||||
// Extracting JSON data
|
||||
result := gjson.Get(IPLook.body, IPLook.Tag)
|
||||
if result.Exists() {
|
||||
for _, name := range result.Array() {
|
||||
IPLook.location += name.String()
|
||||
}
|
||||
var prettyJSON bytes.Buffer
|
||||
// Format output JSON data
|
||||
_ = json.Indent(&prettyJSON, []byte(IPLook.body), "", "\t")
|
||||
logger.Emergency(string(prettyJSON.Bytes()))
|
||||
// Check whether the IP address is the same as the specified location
|
||||
if strings.Contains(strings.ToLower(IPLook.location), strings.ToLower(location)) {
|
||||
return true // The query result is true
|
||||
}
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
/**
|
||||
* @Author 风起
|
||||
* @contact: onlyzaliks@gmail.com
|
||||
* @File: ipLookUp.go
|
||||
* @Time: 2022/5/5 9:13
|
||||
**/
|
||||
|
||||
package core
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"RedGuard/lib"
|
||||
|
||||
"github.com/tidwall/gjson"
|
||||
)
|
||||
|
||||
// IPLookup IP origin,API is defined to extract relevant information
|
||||
type ipLookup struct {
|
||||
allowStatus int // API http request status code
|
||||
hasCount int // Check if the first character of location is in English
|
||||
body string // Get THE API response body JSON data
|
||||
Tag string // The json data Tag
|
||||
location string // Restrict the geographical location of the online
|
||||
}
|
||||
|
||||
var (
|
||||
_apiUrl = []string{
|
||||
// Chinese Users IP API
|
||||
"https://sp0.baidu.com/8aQDcjqpAAV3otqbppnN2DJv/api.php?query=%s&co=&resource_id=6006",
|
||||
// IP API for users in other countries
|
||||
"https://ipapi.co/%s/json/",
|
||||
}
|
||||
logger = lib.Logger() // logger output model
|
||||
)
|
||||
|
||||
// IPLookUp returns true if Check whether the IP address is the same as the owning place
|
||||
// @param ip string Specify IP address
|
||||
// @param location string Specify location
|
||||
// NOTE: other countries Server You are advised to set location to English
|
||||
// This will prioritize IP API that are more efficient for you
|
||||
func IPLookUp(location, ip string) (state bool) {
|
||||
var IPLook ipLookup
|
||||
for _, url := range _apiUrl {
|
||||
// Check preferentially invoked
|
||||
if IPLook.hasCount != 1 {
|
||||
// Check that the first character of location is in English
|
||||
if regexp.MustCompile("[a-zA-Z]").MatchString(location[0:1]) {
|
||||
// Other countries IP API are preferentially invoked if conditions are met
|
||||
url, IPLook.hasCount = _apiUrl[1], 1
|
||||
}
|
||||
} else {
|
||||
url = _apiUrl[0] // preferentially invoked Chinese Users IP API
|
||||
}
|
||||
|
||||
// Get json data for the IP API response body
|
||||
IPLook.allowStatus, IPLook.body = lib.HTTPRequest(fmt.Sprintf(url, ip))
|
||||
if IPLook.allowStatus == 200 {
|
||||
// Select the response JSON tag when json data is available
|
||||
if url == _apiUrl[0] {
|
||||
IPLook.Tag = `data.#.location` // Chinese Users IP API Tag
|
||||
break
|
||||
}
|
||||
IPLook.Tag = `city`
|
||||
IPLook.location += gjson.Get(IPLook.body, `region`).String()
|
||||
break
|
||||
}
|
||||
}
|
||||
// Check for valid JSON data
|
||||
if gjson.Valid(IPLook.body) {
|
||||
// Extracting JSON data
|
||||
result := gjson.Get(IPLook.body, IPLook.Tag)
|
||||
if result.Exists() {
|
||||
for _, name := range result.Array() {
|
||||
IPLook.location += name.String()
|
||||
}
|
||||
var prettyJSON bytes.Buffer
|
||||
// Format output JSON data
|
||||
_ = json.Indent(&prettyJSON, []byte(IPLook.body), "", "\t")
|
||||
logger.Emergency(string(prettyJSON.Bytes()))
|
||||
// Check whether the IP address is the same as the specified location
|
||||
for _, location := range strings.Split(location, ",") {
|
||||
if strings.Contains(strings.ToLower(IPLook.location), strings.ToLower(location)) {
|
||||
return true // The query result is true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
@@ -37,6 +37,7 @@ type Proxy struct {
|
||||
MalleableFile string
|
||||
EdgeHost string
|
||||
EdgeTarget string
|
||||
DelHeader string
|
||||
}
|
||||
|
||||
// ProxyConf Reverse proxy configuration structure
|
||||
|
||||
+29
-7
@@ -51,11 +51,11 @@ chmod +x ./RedGuard&&./RedGuard
|
||||
|
||||
如下图，首先对RedGuard赋予可执行权限并进行初始化操作，第一次运行会在当前用户目录下生成配置文件，以实现灵活的功能配置，**配置文件名：.RedGuard_CobaltStrike.ini**。
|
||||
|
||||
|
||||
|
||||
|
||||
**配置文件内容：**
|
||||
|
||||
|
||||
|
||||
|
||||
cert的配置选项主要是针对样本与C2前置设施的HTTPS流量交互证书的配置信息，proxy主要用于配置反向代理流量中的控制选项，具体使用会在下面进行详细讲解。
|
||||
|
||||
@@ -83,13 +83,19 @@ HasCert = false
|
||||
```bash
|
||||
root@VM-4-13-ubuntu:~# ./RedGuard -h
|
||||
|
||||
Usage of ./RedGuard.exe:
|
||||
Usage of ./RedGuard:
|
||||
-DelHeader string
|
||||
Customize the header to be deleted
|
||||
-DropAction string
|
||||
RedGuard interception action (default "redirect")
|
||||
-EdgeHost string
|
||||
Set Edge Host Communication Domain (default "*")
|
||||
-EdgeTarget string
|
||||
Set Edge Host Proxy Target (default "*")
|
||||
-FieldFinger string
|
||||
Set HTTP Header identification field Info
|
||||
-FieldName string
|
||||
Set the name of the HTTP Header identification field
|
||||
-HasCert string
|
||||
Whether to use the certificate you have applied for (default "true")
|
||||
-allowIP string
|
||||
@@ -291,11 +297,22 @@ MalleableFile = /root/cobaltstrike/Malleable.profile
|
||||
|
||||
> https://github.com/wikiZ/CobaltStrike-Malleable-Profile
|
||||
|
||||
## 自定义删除响应字段
|
||||
|
||||
在 Cobalt Strike 4.7+ 中，Teamserver 会在没有任何通知的情况下自动删除 Content-Encoding 标头，从而可能导致违反可延展http-(get|post).server。而且如果CS Server响应报文中没有Content-type，但经过RedGuard转发后，在响应报文头中添加了Content-Type，导致cf缓存页面，造成干扰。
|
||||
|
||||
在RedGuard 23.08.21版本后增加了自定义响应包Header头的功能，用户可以通过修改配置文件的方式进行自定义删除的响应包中的Header信息，以解决错误解析的问题。
|
||||
|
||||
```bash
|
||||
# Customize the header to be deleted example: Keep-Alive,Transfer-Encoding
|
||||
DelHeader = Keep-Alive,Transfer-Encoding
|
||||
```
|
||||
|
||||
## Sample FingerPrint
|
||||
|
||||
RedGuard 23.05.13已更新木马样本指纹识别功能，该功能基于对Malleable Profile自定义设置HTTP Header字段，作为该指纹“**样本Salt值**”为相同**C2监听器/**Header Host提供唯一辨识并结合其他相关请求字段生成木马样本指纹，用于自定义样本存活性。根据攻击方任务需求，针对希望失效的样本进行**“下线操作”**，更好的规避恶意研判流量的样本通联性关联及分阶段样本PAYLOAD攻击载荷获取分析，给予攻击方更加个性化的隐匿措施。
|
||||
RedGuard 23.05.13已更新木马样本指纹识别功能，该功能基于对Malleable Profile自定义设置HTTP Header字段作为该指纹“**样本Salt值**”，为相同**C2监听器/**Header Host提供唯一辨识。此外，结合其他相关请求字段生成的木马样本指纹，可用于检测自定义样本存活性。根据攻击方任务要求，木马样本指纹识别功能可针对希望失效的样本进行**“下线操作”**，更好地规避恶意研判流量的样本通联性关联及分阶段样本PAYLOAD攻击载荷获取分析，给予攻击方更加个性化的隐匿措施。
|
||||
|
||||
针对不同C2监听器，我们可以设置不同Malleable Profile配置别称并自定义相关header的字段名及值，作为样本Salt值并以此作为区分不同样本之间的辨识之一。下列代码是为了方便说明，而在实际攻防场景下我们可以给予更加贴合实际的HTTP请求包字段作为判断依据。
|
||||
针对不同C2监听器，我们可以给不同的Malleable Profile配置别称、自定义相关header的字段名和值作为样本Salt值，以此作为区分不同样本之间的辨识之一。下列代码是为了方便说明，而在实际攻防场景下我们可以给予更加贴合实际的HTTP请求包字段作为判断依据。
|
||||
|
||||
```bash
|
||||
http-get "listen2" {
|
||||
@@ -318,13 +335,13 @@ http-get "listen2" {
|
||||
- **Salt值：866e5289337ab033f89bc57c5274c7ca**
|
||||
- **Host字段值：redguard.com**
|
||||
|
||||
这里根据对上述值进行拼接得到sample指纹为：
|
||||
根据对上述值进行拼接得到sample指纹为：
|
||||
|
||||
```bash
|
||||
22e6db08c5ef1889d64103a290ac145c
|
||||
```
|
||||
|
||||
目前已知上述样本指纹，现在我们在RedGuard配置文件中设置自定义的Header字段及样本指纹用于恶意流量拦截，值得注意的是我们可以拓展多个样本指纹，不同指纹之间以逗号分隔，FieldName需要和Malleable Profile中配置的Header字段名称达成一致。
|
||||
目前已知上述样本指纹，现在我们在RedGuard配置文件中设置自定义的Header字段及样本指纹用于恶意流量拦截。值得注意的是，我们可以拓展多个样本指纹，不同指纹之间以逗号分隔，FieldName需要和Malleable Profile中配置的Header字段名称保持一致。
|
||||
|
||||
|
||||
|
||||
@@ -438,6 +455,7 @@ RedGuard接收到请求：
|
||||
> https://isc.n.cn/m/pages/live/index?channel_id=iscyY043&ncode=UR6KZ&room_id=1981905&server_id=785016&tab_id=253
|
||||
>
|
||||
> 基于边界节点链路交互C2流量
|
||||
>
|
||||
> https://www.anquanke.com/post/id/278140
|
||||
>
|
||||
> 云沙箱流量识别技术剖析
|
||||
@@ -447,6 +465,10 @@ RedGuard接收到请求：
|
||||
> JARM指纹随机化技术实现
|
||||
>
|
||||
> https://www.anquanke.com/post/id/276546
|
||||
>
|
||||
> C2 基础设施威胁情报对抗策略
|
||||
>
|
||||
> https://paper.seebug.org/3022/
|
||||
|
||||
**Kunyu: https://github.com/knownsec/Kunyu**
|
||||
|
||||
|
||||
@@ -83,7 +83,7 @@ func UpdateConfig(cert *parameter.Cert, proxy *parameter.Proxy, finger *paramete
|
||||
"Port_HTTP": proxy.HTTPort, "Port_HTTPS": proxy.HTTPSPort, "Redirect": proxy.Redirect,
|
||||
"AllowIP": proxy.AllowIP, "AllowTime": proxy.AllowTime, "AllowLocation": proxy.AllowLocation,
|
||||
"drop_action": proxy.DropAction, "HostTarget": proxy.HostTarget, "MalleableFile": proxy.MalleableFile,
|
||||
"EdgeHost": proxy.EdgeHost, "EdgeTarget": proxy.EdgeTarget,
|
||||
"EdgeHost": proxy.EdgeHost, "EdgeTarget": proxy.EdgeTarget, "DelHeader": proxy.DelHeader,
|
||||
}
|
||||
_sampleFinger = map[string]string{
|
||||
"FieldName": finger.FieldName, "FieldFinger": finger.FieldFinger,
|
||||
|
||||
Reference in New Issue
Block a user