wikiZ / RedGuard

RedGuard is a C2 front flow control tool,Can avoid Blue Teams,AVs,EDRs check.
GNU General Public License v2.0
1.41k stars 196 forks source link

TLS handshake error #12

Closed useragent23253 closed 1 year ago

useragent23253 commented 1 year ago

Hello. I've got this error TLS handshake error from victimipv4address:28130: remote error: tls: unknown certificate authority. Soft started without problems but if i try to get request to my listener through RedGuard I've got this error. I tried to change "HasCert" but unsuccessfully. Any suggestions?

wikiZ commented 1 year ago

Sir, do not try to change the HasCert field, which may cause the program to be JARM obfuscated, and in some cases will result in a failure to communicate properly.

useragent23253 commented 1 year ago

I was delete and restart a program but got the same thing

` [2023-03-29 03:31:31] A default SSL certificate is being generated for the reverse proxy... [2023-03-29 03:31:31] HostTarget: {"mydomain.com":"http://127.0.0.1:8080","mydomain.com":"https://127.0.0.1:4433"} [2023-03-29 03:31:31] Proxy Listen Port :80 (HTTP) [2023-03-29 03:31:31] Proxy Listen Port :443 (HTTPS) [*] Web Server will use user-specified SSL certifcate [+] Listener: https started! 2023/03/29 03:32:15 http: TLS handshake error from victimip:16632: remote error: tls: unknown certificate authority 2023/03/29 03:32:19 http: TLS handshake error from [(victimip:)60436: remote error: tls: unknown certificate authority 2023/03/29 03:32:24 http: TLS handshake error from victimip:37882: remote error: tls: unknown certificate authority [2023-03-29 03:32:25] JA3 FingerPrint: d41d8cd98f00b204e9800998ecf8427e [2023-03-29 03:32:25] [REQUEST] GET /admin?auth=Z2RkY2RqZ2lmcGduZW1laGhrZGhncGhraGhmcGVpZGZnb2VrZWJoaGhnZWdnaWdmZWxoYmZpZ2VlbWZlZGVmamRjZ2ZmZWNuZ2JmYmVpZmdoamdqZXBlYmhiZmVnZ2RlZ2VkZmRqZGRlbGRiaGtmZGhqZGVna2doZ29mcGdjZW9naGViZ21kZWhrZWdoYmVjZGFmY2ZpaGFoZmhhZGpma2ZiZWJlamZoZ2Noa2hhZmpnaGVmZmZmamhiY25oaWRqZmNmY2dsZWNlbmRjZ2xkZ2hjaGplY2VmaGpnZWhhZ2hoYmRnZGlmZWVsZ3BoYWdlZGRkZWZkZGlkY2ZrZWxoY2hmZW9nZGhkZGVjbmZiZmZoaGdkZWVnZmhmZGNoZ2dvZW1ncGViZGVlZGduZmVkZmhnZGdoaWdrZGlnYmdqZGloa2NuZGJmZ2hlZW5oa2ZjZ29laGVm [2023-03-29 03:32:25] [DROP] Requested URI does not comply with Malleable Profile requirements 2023/03/29 03:32:25 http: TLS handshake error from 172.71.22.61:34398: remote error: tls: unknown certificate authority [2023-03-29 03:32:25] [RESPONSE] HTTP 526 , length: -1 [2023-03-29 03:32:25] [PROXY] Source IP: (victimip:) -> Destination Site: https://mydomain.com

Also if i try to compile it I've got this error: go build -ldflags "-s -w" -trimpath "build RedGuard: cannot load io/fs: malformed module path "io/fs": missing dot in first path element" It was tested on ubuntu 22 with default golang-go from apt.

wikiZ commented 1 year ago

From the output it appears that he has received the request, but because you configured the profile rule is blocked, you can try not to profile to see if you can communicate properly.

As for compilation issues, you can look at the method mentioned in the install title in the readme

Thank you for supporting RedGuard.