MythicAgents / poseidon

Poseidon is a Golang agent targeting Linux and macOS
Other
118 stars 32 forks source link

Match proxy user-agent with payload user-agent #32

Closed coolcoolnoworries closed 1 year ago

coolcoolnoworries commented 1 year ago

When a proxy is set, poseidon sends CONNECT requests with the default golang user-agent "Go-http-client/1.1", rather than using the user-agent defined for the payload. This can create some opsec issues, as the traffic can be signatured as out of place.

normal-behavior-proxyUA

A quick fix for this would be to add a call to ProxyConnectHeader during the headers check in http.go, so that the user-agent matches what is defined during build.

fixed-behavior-proxyUA

Steps to reproduce:

  1. Set http/https proxy variables in environment
  2. Run poseidon payload with default config
  3. Have a netcat listener ready on the proxy:port
  4. Observe user-agent is golang default and not the one defined during payload generation