Adding websockets protocol + additional features

nicocha30 / ligolo-ng

An advanced, yet simple, tunneling/pivoting tool that uses a TUN interface.

GNU General Public License v3.0

2.61k stars 260 forks source link

Adding websockets protocol + additional features #51

Closed virusvfv closed 2 months ago

virusvfv commented 7 months ago

Hi again ) I re-coded my websocket branch according your December commits:

Mainly added websocket support. This is very useful when you trying to hide C2 server behind CDN (such as Cloudflare of AWS Cloudfront)
Added auto-start agent feature
Added httpproxy support. username and password field moved to proxy Url. ex: socks://admin:secret@127.0.0.1:1080 or http://admin:secret@127.0.0.1:8080
Added agent sname param to covering you C2 domain by google.com or microsoft.com ))

Please review commits and merge it.. Regards

nicocha30 commented 7 months ago

Hey @virusvfv! Thanks for the PR! I will review this ASAP

georak commented 6 months ago

@nicocha30 do you have an estimation when you ll be able to merge this? It is an excellent work by @virusvfv which adds some MUST HAVE features!

Cyb3rC3lt commented 5 months ago

I have continued to test this heavily and it is great for Cloudflare. I did notice 1 issue. When the autostart flag is used it struggles to receive a 2nd conection and won't open a second session. If I remove the autostart flag the 2nd session arrives without any problems. This is what I eventually see on session 2 when it is struggling:

Cyb3rC3lt commented 2 months ago

@nicocha30 do you have an estimation when you'll be able to merge this? It is an excellent work by @virusvfv which adds some MUST HAVE features!

Yes this is really amazing, would be great to use it with your recent fixes around listeners please.

nicocha30 commented 2 months ago

This PR will require significant work. The Ligolo-ng API has changed, and therefore some features in this PR will not work.

virusvfv commented 2 months ago

Hi all! I'll try to do this work at the weekend.

Cyb3rC3lt commented 2 months ago

Great job @virusvfv. I've done a recent blogpost in regards using your pull request if interested. It has been great for our team:

https://www.linkedin.com/posts/max-c-25571a191_putting-the-c2-in-c2loudflare-jumpsec-labs-activity-7212383613361754112-qvDE

nicocha30 commented 2 months ago

@virusvfv please make one PR per feature, it will be easier for me to review.

virusvfv commented 2 months ago

Added new PR with new branch with same name: Websockets