Skip to content

Commit

Permalink
update v2.0.0 README
Browse files Browse the repository at this point in the history
  • Loading branch information
@L-codes
L-codes committed Sep 14, 2020
1 parent 53bfe43 commit f317b11
Show file tree
Hide file tree
Showing 3 changed files with 103 additions and 78 deletions.
32 changes: 32 additions & 0 deletions CHANGELOG-en.md
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
# Change Log

### v2.0.0
实现单 Session 多 TCP 会话，解决部分环境仅支持单 Session HTTP 通讯导致的无法使用
支持同服务器多 URL 的请求路径，避免单路径访问频率过高
支持自定义服务端的 HTTP 响应码
修改了部分指令为 GET , 更接近正常请求
去除空行与去除部分特征
支持服务端的 DNS 解析，并默认使用 (使用本地 DNS 解析用 `--local-dns`)
优化了错误信息输出
修改了目录名称 scripts/ => templates/ 和 neoreg_server/ => neoreg_servers/
移除 socks4 的支持
移除 javascript tunnel 支持

### v1.5.0
修复 php >= 7.1 版本，无法正常使用的问题
修复 php 环境高占用 CPU 的问题 (特别感谢 @junmoxiao 提供的支持)
tunnel.nosocket.php 替换 tunnel.php

### v1.4.0
jsp(x) does not rely on the built-in `base64` method, compatible with jdk9 and above
jsp(x) remove `trimDirectiveWhitespaces="true"` to be compatible with versions less than jdk8
tunnel.tomcat.5.jsp(x) has been removed

### v1.3.0
Fixed `--cookie JSESSIONID` conflict, unavailable in load balancing environment

### v1.2.0
Added `-k debug_all (or debug_base64|debug_headers_key|debug_headers_values)`, Easy to debug

### v1.1.0
Added jspx support
143 changes: 69 additions & 74 deletions README-en.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,21 +12,25 @@ Neo-reGeorg



## Features
Features
----

* Transfer content through out-of-order base64 encryption
* GET request response can be customized (such as masquerading 404 pages)
* HTTP Headers instructions are randomly generated to avoid feature detection
* HTTP Headers can be customized
* Custom HTTP response code
* Multiple URLs random requests
* Server-node DNS resolution
* Compatible with python2 / python3
* jsp(x) is compatible with all jdk version platforms
* High compatibility of the server environment
* Refer to [pivotnacci](https://github.com/blackarrowsec/pivotnacci) to implement a single `SESSION` to create multiple TCP connections to deal with some load balancing scenarios


Version
----

1.4.0

2.0.0 - [Change Log](CHANGELOG.md)


Dependencies
Expand All @@ -46,35 +50,35 @@ Set the password to generate tunnel server.(aspx|ashx|jsp|jspx|php) and upload i
$ python neoreg.py generate -k password

[+] Create neoreg server files:
=> neoreg_server/tunnel.nosocket.php
=> neoreg_server/tunnel.js
=> neoreg_server/tunnel.php
=> neoreg_server/tunnel.ashx
=> neoreg_server/tunnel.aspx
=> neoreg_server/tunnel.jsp
=> neoreg_server/tunnel.jspx
=> neoreg_servers/tunnel.jspx
=> neoreg_servers/tunnel.php
=> neoreg_servers/tunnel.ashx
=> neoreg_servers/tunnel.aspx
=> neoreg_servers/tunnel.jsp

```

* **Step 2.**
Use `neoreg.py` to connect to the web server and create a socks proxy locally.
Use `neoreg.py` to connect to the web server and create a socks5 proxy locally.
```ruby
$ python3 neoreg.py -k password -u http://xx/tunnel.php
+------------------------------------------------------------------------+
Log Level set to [ERROR]
Starting socks server [127.0.0.1:1080], tunnel at [http://k/tunnel.php]
Log Level set to [DEBUG]
Starting socks server [127.0.0.1:1080]
Tunnel at:
http://xx/tunnel.php
+------------------------------------------------------------------------+
```

Note that if your tool, such as `nmap` does not support socks proxy, please use [proxychains](https://github.com/rofl0r/proxychains-ng)
Note that if your tool, such as `nmap` does not support socks5 proxy, please use [proxychains](https://github.com/rofl0r/proxychains-ng)




Advanced Usage
--------------

1. Support for generated tunnel server-side, the default GET request responds to the specified page content (eg camouflaged 404 page)
1. Support the generated server, by default directly requesting and responding to the specified page content (such as a disguised 404 page)
```ruby
$ python neoreg.py generate -k <you_password> --file 404.html
$ python neoreg.py -k <you_password> -u <server_url> --skip
Expand All @@ -90,83 +94,74 @@ $ python neoreg.py -k <you_password> -u <server_url> --proxy socks5://10.1.1.1:8
$ python neoreg.py -k <you_password> -u <server_url> -H 'Authorization: cm9vdDppcyB0d2VsdmU=' --cookie "key=value;key2=value2"
```

4. Need to disperse requests, upload to multiple paths, such as memory-webshell
```ruby
$ python neoreg.py -k <you_password> -u <url_1> -u <url_2> -u <url_3> ...
```

* For more information on performance and stability parameters, refer to -h help information
```ruby
# Generate server-side scripts
$ python neoreg.py generate -h
usage: neoreg.py [-h] -k KEY [-o DIR] [-f FILE] [--read-buff Bytes]
usage: neoreg.py [-h] -k KEY [-o DIR] [-f FILE] [-c CODE] [--read-buff Bytes]

Generate neoreg webshell
Generate neoreg webshell

optional arguments:
-h, --help show this help message and exit
-k KEY, --key KEY Specify connection key.
-o DIR, --outdir DIR Output directory.
-f FILE, --file FILE Camouflage html page file
--read-buff Bytes Remote read buffer.(default: 513)
optional arguments:
-h, --help show this help message and exit
-k KEY, --key KEY Specify connection key.
-o DIR, --outdir DIR Output directory.
-f FILE, --file FILE Camouflage html page file
-c CODE, --httpcode CODE
Specify HTTP response code. (default: 200)
--read-buff Bytes Remote read buffer. (default: 513)

# Connection server
$ python neoreg.py -h
usage: neoreg.py [-h] -u URI -k KEY [-l IP] [-p PORT] [-s] [-H LINE] [-c LINE]
[-x LINE] [--read-buff Bytes] [--read-interval MS]
[--max-threads N] [-v]

Socks server for Neoreg HTTP(s) tunneller
DEBUG MODE: -k (debug_all|debug_base64|debug_headers_key|debug_headers_values)

optional arguments:
-h, --help show this help message and exit
-u URI, --url URI The url containing the tunnel script
-k KEY, --key KEY Specify connection key
-l IP, --listen-on IP
The default listening address.(default: 127.0.0.1)
-p PORT, --listen-port PORT
The default listening port.(default: 1080)
-s, --skip Skip usability testing
-H LINE, --header LINE
Pass custom header LINE to server
-c LINE, --cookie LINE
Custom init cookies
-x LINE, --proxy LINE
proto://host[:port] Use proxy on given port
--read-buff Bytes Local read buffer, max data to be sent per
POST.(default: 1024)
--read-interval MS Read data interval in milliseconds.(default: 100)
--max-threads N Proxy max threads.(default: 1000)
-v Increase verbosity level (use -vv or more for greater
effect)
usage: neoreg.py [-h] -u URI -k KEY [-l IP] [-p PORT] [-s] [-H LINE] [-c LINE]
[-x LINE] [--local-dns] [--read-buff Bytes]
[--read-interval MS] [--max-threads N] [-v]

Socks server for Neoreg HTTP(s) tunneller. DEBUG MODE: -k
(debug_all|debug_base64|debug_headers_key|debug_headers_values)

optional arguments:
-h, --help show this help message and exit
-u URI, --url URI The url containing the tunnel script
-k KEY, --key KEY Specify connection key
-l IP, --listen-on IP
The default listening address.(default: 127.0.0.1)
-p PORT, --listen-port PORT
The default listening port.(default: 1080)
-s, --skip Skip usability testing
-H LINE, --header LINE
Pass custom header LINE to server
-c LINE, --cookie LINE
Custom init cookies
-x LINE, --proxy LINE
proto://host[:port] Use proxy on given port
--local-dns Local read buffer, max data to be sent per
POST.(default: 2048 max: 2600)
--read-buff Bytes Local read buffer, max data to be sent per
POST.(default: 2048 max: 2600)
--read-interval MS Read data interval in milliseconds.(default: 100)
--max-threads N Proxy max threads.(default: 1000)
-v Increase verbosity level (use -vv or more for greater
effect)
```



## TODO

* Solving tunnel.js cannot continue TCP connection problems
TODO
----

* HTTP body steganography

* Transfer Target field steganography

* ~~Confuse/Anti-Virus/Compress server-side scripts~~ Should be modular, standalone tool



## License
License
----

GPL 3.0

## Change log

### v1.1.0
Added jspx support

### v1.2.0
Added `-k debug_all (or debug_base64|debug_headers_key|debug_headers_values)`, Easy to debug

### v1.3.0
Fixed `--cookie JSESSIONID` conflict, unavailable in load balancing environment

### v1.4.0
jsp(x) does not rely on the built-in `base64` method, compatible with jdk9 and above
jsp(x) remove `trimDirectiveWhitespaces="true"` to be compatible with versions less than jdk8
tunnel.tomcat.5.jsp(x) has been removed
6 changes: 2 additions & 4 deletions README.md
View file
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
Neo-reGeorg
=========

[简体中文](README.md)　｜　[English](README-zh.md)
[简体中文](README.md)　｜　[English](README-en.md)

**Neo-reGeorg** 是一个旨在积极重构 [reGeorg](https://github.com/sensepost/reGeorg) 的项目，目的是：

Expand Down Expand Up @@ -31,9 +31,7 @@ Features
Version
----

2.0.0

[版本修改日志](CHANGELOG.md)
2.0.0 - [版本修改日志](CHANGELOG.md)



Expand Down

0 comments on commit f317b11

Please sign in to comment.