Disclaimer
It is the final user’s responsibility to obey all applicable local, state, and federal laws.
Authors assume no liability and are not responsible for any misuse or damage caused by this program.
Usage
GoSpy consists of 2 binaries, the client is what you execute on your target machine and the server is what you run on your machine to interact with the client.
Features
These are almost all currently a WIP
- Cross-platform with
CGO_ENABLED=0(compiles to any target that Go supports) - Safe error handling so the client / server won’t suddenly drop on error
- Automatic reconnect for both client and server
- Reverse shell
- File grab (send a file from the client to the server)
- File drop (send a file from the server to the client)
- Execute Lua scripts on target machine (using gopher-lua)
- Useful if you have managed to execute the client on your target but (for whatever reason) the reverse shell can’t execute things / isn’t working
- More?
- SSL/TLS?
Screenshot
Why?
I wrote this project to learn more about both Go and penetration testing, as I recently completed an “Ethical Hacking” unit for my university course and am interested in learning more.
Architecture
The client maintains a main connection to the server, nicknamed CmdCon. This is only used to exchange commands and arguments.
Any other time data needs to be transferred, a new connection is initiated (e.g. when sending a file). This means that if anything goes wrong (e.g. a file read/write error) then the connection can just be closed instead of having to deal with complicated communication logic (e.g. letting the client know an error ocurred when it’s trying to send file data).
Credits
- gopherize.me for the icon
- c-bata/go-prompt for the interactive prompt on the server
- vfedoroff/go-netcat for some reverse shell net logic
GoSpy (this link opens in a new window) by psidex (this link opens in a new window)
A cross-platform remote access tool