Skip to content

Commit d160ac8

Browse files
L-codesL-codes
committed
push v5.0.0
1 parent a86a78d commit d160ac8

File tree

2 files changed

+80
-112
lines changed

2 files changed

+80
-112
lines changed

‎README-en.md‎

Lines changed: 43 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -4,39 +4,33 @@
44

55
**Neo-reGeorg** is a project designed to actively restructure [reGeorg](https://github.com/sensepost/reGeorg) with the aim of:
66

7-
* Improve tunnel connection security
87
* Improve usability and avoid feature detection
8+
* Improve tunnel connection security
99
* Improve the confidentiality of transmission content
1010
* Solve the existing problems of reGeorg and fix some small bugs
1111

1212
> This tool is limited to safety research and teaching, and the user assumes all legal and related responsibilities caused by the use of this tool! The author does not bear any legal and related responsibilities!
1313
1414
## Version
1515

16-
3.8.1 - [Change Log](CHANGELOG-en.md)
16+
5.0.0 - [Change Log](CHANGELOG-en.md)
1717

1818

1919
## Features
2020

21-
* Transfer content through out-of-order base64 encryption
22-
* GET request response can be customized (such as masquerading 404 pages)
23-
* HTTP Headers instructions are randomly generated to avoid feature detection
21+
* The transmission content is encrypted by deformed base64 and disguised as base64 encoding
22+
* Use BLV (Byte-LengthOffset-Value) data format to transmit data
23+
* Direct request response can be customized (such as a disguised 404 page)
2424
* HTTP Headers can be customized
2525
* Custom HTTP response code
26-
* Multiple URLs random requests
27-
* Server-node DNS resolution
26+
* Multiple URL random requests
27+
* Server-side DNS resolution
2828
* Compatible with python2 / python3
29-
* High compatibility of the server environment
30-
* (only php) Refer to [pivotnacci](https://github.com/blackarrowsec/pivotnacci) to implement a single `SESSION` to create multiple TCP connections to deal with some load balancing scenarios
31-
* aspx/ashx/jsp/jspx no longer relies on Session, and can run normally in harsh environments such as cookie-free
32-
* (non-php) Support HTTP forwarding, coping with load balancing environment
33-
34-
35-
## Dependencies
36-
37-
* [**requests**] - https://github.com/kennethreitz/requests
38-
39-
29+
* High compatibility of the server environment, such as the server is unstable, the server is only deployed on some machines under load balancing and other special circumstances
30+
* (php only) Refer to [pivotnacci](https://github.com/blackarrowsec/pivotnacci) to create multiple TCP connections for a single session, to deal with some load balancing scenarios
31+
* aspx/ashx/jsp/jspx no longer depends on Session, and can run normally in harsh environments such as no cookies
32+
* (non-php) supports intranet forwarding to deal with load balancing environment
33+
* Support process to start the server to deal with more scenarios
4034

4135

4236
## Basic Usage
@@ -47,14 +41,12 @@ Set the password to generate tunnel server.(aspx|ashx|jsp|jspx|php) and upload i
4741
$ python neoreg.py generate -k password
4842

4943
[+] Create neoreg server files:
44+
=> neoreg_servers/tunnel.jsp
5045
=> neoreg_servers/tunnel.jspx
51-
=> neoreg_servers/tunnel_compatibility.jspx
52-
=> neoreg_servers/tunnel.php
5346
=> neoreg_servers/tunnel.ashx
5447
=> neoreg_servers/tunnel.aspx
55-
=> neoreg_servers/tunnel.jsp
56-
=> neoreg_servers/tunnel_compatibility.jsp
57-
48+
=> neoreg_servers/tunnel.php
49+
=> neoreg_servers/tunnel.go
5850
```
5951

6052
* **Step 2.**
@@ -69,10 +61,6 @@ $ python3 neoreg.py -k password -u http://xx/tunnel.php
6961
+------------------------------------------------------------------------+
7062
```
7163

72-
Note that if your tool, such as `nmap` does not support socks5 proxy, please use [proxychains](https://github.com/rofl0r/proxychains-ng)
73-
74-
75-
7664

7765
## Advanced Usage
7866

@@ -107,6 +95,12 @@ $ python neoreg.py -k <you_password> -u <url> -r <redirect_url>
10795
$ python neoreg.py -k <you_password> -u <url> -t <ip:port>
10896
```
10997

98+
7. Support the creation process to start a new Neoreg server-side, which can deal with harsh special environments
99+
```ruby
100+
$ go run neoreg_servers/tunnel.go 8000
101+
$ python3 neoreg.py -k password -u http://127.0.0.1:8000/anysting
102+
```
103+
110104
* For more information on performance and stability parameters, refer to -h help information
111105
```ruby
112106
# Generate server-side scripts
@@ -123,35 +117,35 @@ $ python neoreg.py generate -h
123117
-f FILE, --file FILE Camouflage html page file
124118
-c CODE, --httpcode CODE
125119
Specify HTTP response code. When using -r, it is
126-
recommended to <400. (default: 200)
127-
--read-buff Bytes Remote read buffer. (default: 513)
128-
--max-read-size KB Remote max read size. (default: 512)
120+
recommended to <400 (default: 200)
121+
--read-buff Bytes Remote read buffer (default: 513)
122+
--max-read-size KB Remote max read size (default: 512)
129123

130124
# Connection server
131-
$ python neoreg.py -h
132-
usage: neoreg.py [-h] -u URI [-r URL] [-t IP:PORT] -k KEY [-l IP] [-p PORT]
133-
[-s] [-H LINE] [-c LINE] [-x LINE] [--php-connect-timeout S]
134-
[--local-dns] [--read-buff KB] [--read-interval MS]
135-
[--write-interval MS] [--max-threads N] [--cut-left N]
136-
[--cut-right N] [-v]
125+
usage: neoreg.py [-h] -u URI [-r URL] [-R] [-t IP:PORT] -k KEY [-l IP]
126+
[-p PORT] [-s] [-H LINE] [-c LINE] [-x LINE]
127+
[--php-connect-timeout S] [--local-dns] [--read-buff KB]
128+
[--read-interval MS] [--write-interval MS] [--max-threads N]
129+
[--max-retry N] [--cut-left N] [--cut-right N]
130+
[--extract EXPR] [-v]
137131

138-
Socks server for Neoreg HTTP(s) tunneller. DEBUG MODE: -k
139-
(debug_all|debug_base64|debug_headers_key|debug_headers_values)
132+
Socks server for Neoreg HTTP(s) tunneller (DEBUG MODE: -k debug)
140133

141134
optional arguments:
142135
-h, --help show this help message and exit
143136
-u URI, --url URI The url containing the tunnel script
144137
-r URL, --redirect-url URL
145138
Intranet forwarding the designated server (only
146139
jsp(x))
140+
-R, --force-redirect Forced forwarding (only jsp -r)
147141
-t IP:PORT, --target IP:PORT
148142
Network forwarding Target, After setting this
149143
parameter, port forwarding will be enabled
150144
-k KEY, --key KEY Specify connection key
151145
-l IP, --listen-on IP
152-
The default listening address.(default: 127.0.0.1)
146+
The default listening address (default: 127.0.0.1)
153147
-p PORT, --listen-port PORT
154-
The default listening port.(default: 1080)
148+
The default listening port (default: 1080)
155149
-s, --skip Skip usability testing
156150
-H LINE, --header LINE
157151
Pass custom header LINE to server
@@ -160,16 +154,18 @@ $ python neoreg.py -h
160154
-x LINE, --proxy LINE
161155
Proto://host[:port] Use proxy on given port
162156
--php-connect-timeout S
163-
PHP connect timeout.(default: 0.5)
157+
PHP connect timeout (default: 0.5)
164158
--local-dns Use local resolution DNS
165-
--read-buff KB Local read buffer, max data to be sent per
166-
POST.(default: 7, max: 50)
167-
--read-interval MS Read data interval in milliseconds.(default: 300)
168-
--write-interval MS Write data interval in milliseconds.(default: 200)
169-
--max-threads N Proxy max threads.(default: 1000)
159+
--read-buff KB Local read buffer, max data to be sent per POST
160+
(default: 7, max: 50)
161+
--read-interval MS Read data interval in milliseconds (default: 300)
162+
--write-interval MS Write data interval in milliseconds (default: 200)
163+
--max-threads N Proxy max threads (default: 400)
164+
--max-retry N Proxy max threads (default: 10)
170165
--cut-left N Truncate the left side of the response body
171166
--cut-right N Truncate the right side of the response body
172-
--extract EXPR Manually extract BODY content. (eg: <html><p>REGBODY</p></html> )
167+
--extract EXPR Manually extract BODY content (eg:
168+
<html><p>NEOREGBODY</p></html> )
173169
-v Increase verbosity level (use -vv or more for greater
174170
effect)
175171
```
@@ -179,19 +175,6 @@ $ python neoreg.py -h
179175

180176
* When running `neoreg.py` with high concurrency on Mac OSX, a large number of network requests will be lost. You can use `ulimit -n 2560` to modify the "maximum number of open files" of the current shell.
181177

182-
* For Tomcat5 and other low jdk versions, use `tunnel_compatibility.jsp(x)`
183-
184-
185-
186-
## TODO
187-
188-
* HTTP body steganography
189-
190-
* Transfer Target field steganography
191-
192-
* Problem of ignoring the verification of https in the intranet forwarding
193-
194-
195178

196179
## License
197180

‎README.md‎

Lines changed: 37 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -4,41 +4,34 @@
44

55
**Neo-reGeorg** 是一个旨在积极重构 [reGeorg](https://github.com/sensepost/reGeorg) 的项目，目的是：
66

7-
* 提高 tunnel 连接安全性
87
* 提高可用性，避免特征检测
8+
* 提高 tunnel 连接安全性
99
* 提高传输内容保密性
10-
* 应对更多的网络环境场景
10+
* 应对更多的网络环境场景下使用
1111

1212
> 此工具仅限于安全研究和教学，用户承担因使用此工具而导致的所有法律和相关责任！ 作者不承担任何法律和相关责任！
1313
1414

1515
## Version
1616

17-
3.8.1 - [版本修改日志](CHANGELOG.md)
18-
17+
5.0.0 - [版本修改日志](CHANGELOG.md)
1918

2019

2120
## Features
2221

2322
* 传输内容经过变形 base64 加密，伪装成 base64 编码
23+
* 采用 BLV (Byte-LengthOffset-Value) 数据格式传输数据
2424
* 直接请求响应可定制化 (如伪装的404页面)
25-
* HTTP Headers 的指令随机生成，避免特征检测
2625
* HTTP Headers 可定制化
2726
* 自定义 HTTP 响应码
2827
* 多 URL 随机请求
2928
* 服务端 DNS 解析
3029
* 兼容 python2 / python3
31-
* 服务端环境的高兼容性
30+
* 服务端环境的高兼容性，如服务器不稳定、负载均衡下只在部分机器上部署了服务端等特殊情况
3231
* (仅 php) 参考 [pivotnacci](https://github.com/blackarrowsec/pivotnacci) 实现单 Session 创建多 TCP 连接，应对部分负载均衡场景
3332
* aspx/ashx/jsp/jspx 已不再依赖 Session，可在无 Cookie 等恶劣环境正常运行
3433
* (非 php) 支持内网转发，应对负载均衡环境
35-
36-
37-
38-
## Dependencies
39-
40-
* [**requests**] - https://github.com/kennethreitz/requests
41-
34+
* 支持进程形式启动服务端，应对更多场景
4235

4336

4437
## Basic Usage
@@ -49,14 +42,12 @@
4942
$ python neoreg.py generate -k password
5043

5144
[+] Create neoreg server files:
45+
=> neoreg_servers/tunnel.jsp
5246
=> neoreg_servers/tunnel.jspx
53-
=> neoreg_servers/tunnel_compatibility.jspx
54-
=> neoreg_servers/tunnel.php
5547
=> neoreg_servers/tunnel.ashx
5648
=> neoreg_servers/tunnel.aspx
57-
=> neoreg_servers/tunnel.jsp
58-
=> neoreg_servers/tunnel_compatibility.jsp
59-
49+
=> neoreg_servers/tunnel.php
50+
=> neoreg_servers/tunnel.go
6051
```
6152

6253
* **Step 2.**
@@ -71,10 +62,6 @@ $ python3 neoreg.py -k password -u http://xx/tunnel.php
7162
+------------------------------------------------------------------------+
7263
```
7364

74-
注意，如果你的工具，如 nmap 不支持 socks5 代理设置，请使用 [proxychains](https://github.com/rofl0r/proxychains-ng) 等
75-
76-
77-
7865

7966
## Advanced Usage
8067

@@ -109,6 +96,12 @@ $ python neoreg.py -k <you_password> -u <url> -r <redirect_url>
10996
$ python neoreg.py -k <you_password> -u <url> -t <ip:port>
11097
```
11198

99+
7. 支持创建进程另起 Neoreg 服务端，可应对恶劣的特殊环境 (自行脑补) :)
100+
```ruby
101+
$ go run neoreg_servers/tunnel.go 8000
102+
$ python3 neoreg.py -k password -u http://127.0.0.1:8000/anysting
103+
```
104+
112105
* 更多关于性能和稳定性的参数设置参考 -h 帮助信息
113106
```ruby
114107
# 生成服务端脚本
@@ -125,35 +118,36 @@ $ python neoreg.py generate -h
125118
-f FILE, --file FILE Camouflage html page file
126119
-c CODE, --httpcode CODE
127120
Specify HTTP response code. When using -r, it is
128-
recommended to <400. (default: 200)
129-
--read-buff Bytes Remote read buffer. (default: 513)
130-
--max-read-size KB Remote max read size. (default: 512)
121+
recommended to <400 (default: 200)
122+
--read-buff Bytes Remote read buffer (default: 513)
123+
--max-read-size KB Remote max read size (default: 512)
131124

132125
# 连接服务端
133126
$ python neoreg.py -h
134-
usage: neoreg.py [-h] -u URI [-r URL] [-t IP:PORT] -k KEY [-l IP] [-p PORT]
135-
[-s] [-H LINE] [-c LINE] [-x LINE] [--php-connect-timeout S]
136-
[--local-dns] [--read-buff KB] [--read-interval MS]
137-
[--write-interval MS] [--max-threads N] [--cut-left N]
138-
[--cut-right N] [-v]
127+
usage: neoreg.py [-h] -u URI [-r URL] [-R] [-t IP:PORT] -k KEY [-l IP]
128+
[-p PORT] [-s] [-H LINE] [-c LINE] [-x LINE]
129+
[--php-connect-timeout S] [--local-dns] [--read-buff KB]
130+
[--read-interval MS] [--write-interval MS] [--max-threads N]
131+
[--max-retry N] [--cut-left N] [--cut-right N]
132+
[--extract EXPR] [-v]
139133

140-
Socks server for Neoreg HTTP(s) tunneller. DEBUG MODE: -k
141-
(debug_all|debug_base64|debug_headers_key|debug_headers_values)
134+
Socks server for Neoreg HTTP(s) tunneller (DEBUG MODE: -k debug)
142135

143136
optional arguments:
144137
-h, --help show this help message and exit
145138
-u URI, --url URI The url containing the tunnel script
146139
-r URL, --redirect-url URL
147140
Intranet forwarding the designated server (only
148141
jsp(x))
142+
-R, --force-redirect Forced forwarding (only jsp -r)
149143
-t IP:PORT, --target IP:PORT
150144
Network forwarding Target, After setting this
151145
parameter, port forwarding will be enabled
152146
-k KEY, --key KEY Specify connection key
153147
-l IP, --listen-on IP
154-
The default listening address.(default: 127.0.0.1)
148+
The default listening address (default: 127.0.0.1)
155149
-p PORT, --listen-port PORT
156-
The default listening port.(default: 1080)
150+
The default listening port (default: 1080)
157151
-s, --skip Skip usability testing
158152
-H LINE, --header LINE
159153
Pass custom header LINE to server
@@ -162,16 +156,18 @@ $ python neoreg.py -h
162156
-x LINE, --proxy LINE
163157
Proto://host[:port] Use proxy on given port
164158
--php-connect-timeout S
165-
PHP connect timeout.(default: 0.5)
159+
PHP connect timeout (default: 0.5)
166160
--local-dns Use local resolution DNS
167-
--read-buff KB Local read buffer, max data to be sent per
168-
POST.(default: 7, max: 50)
169-
--read-interval MS Read data interval in milliseconds.(default: 300)
170-
--write-interval MS Write data interval in milliseconds.(default: 200)
171-
--max-threads N Proxy max threads.(default: 1000)
161+
--read-buff KB Local read buffer, max data to be sent per POST
162+
(default: 7, max: 50)
163+
--read-interval MS Read data interval in milliseconds (default: 300)
164+
--write-interval MS Write data interval in milliseconds (default: 200)
165+
--max-threads N Proxy max threads (default: 400)
166+
--max-retry N Proxy max threads (default: 10)
172167
--cut-left N Truncate the left side of the response body
173168
--cut-right N Truncate the right side of the response body
174-
--extract EXPR Manually extract BODY content. (eg: <html><p>REGBODY</p></html> )
169+
--extract EXPR Manually extract BODY content (eg:
170+
<html><p>NEOREGBODY</p></html> )
175171
-v Increase verbosity level (use -vv or more for greater
176172
effect)
177173
```
@@ -181,17 +177,6 @@ $ python neoreg.py -h
181177

182178
* Mac OSX 上运行 `neoreg.py` 时，高并发请求会出现网络丢包情况，可通过 `ulimit -n 2560` 修改当前 shell 的 "最大文件打开数"
183179

184-
* Tomcat5 等 jdk 低版本情况，用 `tunnel_compatibility.jsp(x)` 即可
185-
186-
187-
188-
## TODO
189-
190-
* HTTP body 隐写
191-
192-
* 传输 Target 隐写
193-
194-
* 内网转发 https 的验证忽略
195180

196181

197182
## License

0 commit comments

Comments
 (0)