Giter VIP home page Giter VIP logo

erfrp's Introduction

Erfrp-frp二开-免杀与隐藏

本项目是frp的二开项目。frp是fatedier开发的一款优秀的反向代理工具,可以将本地服务器暴露在互联网上。但原程序对攻击队而言并不优雅,希望本项目可以为攻击队贡献一个完美的FRP二开项目!作者:0e0w

本项目创建于2022年4月18日,最近的更新时间为2022年12月2日。

01-项目功能修改

  • 程序运行判断是否存在frpc.ini或frps.ini文件,不存在则自动创建。

    // 自动生成frpc.ini和frps.ini
    func init() {
    	frpcini := "frpc.ini"
    	if _, errFileExist := os.Stat(frpcini); errFileExist != nil {
    		f, err := os.Create(frpcini)
    		if err != nil {
    			os.Exit(1)
    		}
    		_, err = f.Write(config.DefaultiniBytefrpc)
    	}
    
    }
    
  • 全部的参数都从ini文件获取?or 全部的参数都写到go文件中?#Todo

  • 加入命令执行模块#Todo

02-敏感信息隐藏

  • 配置文件自动删除:frpc.exe --delini

    	// 删除配置文件
    	// 程序运行时添加--delini命令
    	if delEnable == true {
    		err := os.Remove(cfgFile)
    		if err != nil {
    			return err
    		}
    	}
    
  • 远程加载配置文件:frpc.exe -c http://127.0.0.1/frpc.ini

    func GetRenderedConfFromFile(path string) (out []byte, err error) {
    	var b []byte
    	rawUrl := path
    	if strings.Contains(rawUrl, "http") {
    		log.Info("Remote load ini file")
    		response, _err1 := http.Get(path)
    		if _err1 != nil {
    			return
    		}
    		defer response.Body.Close()
    		body, _err := io.ReadAll(response.Body)
    		if _err != nil {
    			return
    		}
    		httpContent := string(body)
    		var content = []byte(httpContent)
    		out, err = RenderContent(content)
    		return
    
    	} else {
    		log.Info("Local load ini file")
    		b, err = os.ReadFile(path)
    		if err != nil {
    			return
    		}
    		localContent := string(b)
    		var content = []byte(localContent)
    		out, err = RenderContent(content)
    		return
    	}
    }
    
  • 服务端IP地址加密:需要在代码上面修改aes的key和加密后的字符

    使用说明:在代码中修改AESKey和AESencryptCode的值为自己的。AESKey可不修改,默认使用Erfrp的md5值。在frpc.ini中将server_addr的值修改为AESencryptCode。

    package dscrypto
    
    // 对服务器IP进行隐藏需要修改此处的AESKey和AESencryptCode。
    // 同时需要对frpc.ini中的server_addr进行修改,修改成AESencryptCode。
    // server_addr支持正常的ip和加密之后的ip,2种形式。
    var (
    	VpsIP          = "192.168.1.22"
    	AESKey         = "9d9d14b5f6650726afe17e1af4052632" //Erfrp
    	AESencryptCode = "J6X+PfMnVldSaM1tpjaNKw=="
    	//AESencryptCode = "2HrQDAPV5JgjckfYkO9u4g=="
    )
    

03-静态特征修改

  • 去除日志打印相关内容#Todo
  • 去除FRP相关的字段内容#Todo

04-流量特征修改

  • 0x17特征修改
  • 默认开启TLS

05-项目结构修改

本项目基于frp-0.45.0。对项目结构进行了调整,调整后的项目结构如下:

│  frpc.go
│  frps.go
├─cmd
│  ├─frpc
│  │      http.go
│  │      https.go
│  │      reload.go
│  │      root.go
│  │      status.go
│  │      stcp.go
│  │      sudp.go
│  │      tcp.go
│  │      tcpmux.go
│  │      udp.go
│  │      verify.go
│  │      xtcp.go
│  │      
│  └─frps
│          root.go
│          verify.go
│          
├─pkg
│  ├─assets
│  │  │  assets.go
│  │  │  
│  │  ├─frpc
│  │  │  │  embed.go
│  │  │  └─static
│  │  │          
│  │  └─frps
│  │      │  embed.go
│  │      └─static
│  │              
│  ├─auth
│  │      auth.go
│  │      oidc.go
│  │      token.go
│  │      
│  ├─client
│  │  │  admin.go
│  │  │  admin_api.go
│  │  │  control.go
│  │  │  service.go
│  │  │  visitor.go
│  │  │  visitor_manager.go
│  │  │  
│  │  ├─event
│  │  │      event.go
│  │  │      
│  │  ├─health
│  │  │      health.go
│  │  │      
│  │  └─proxy
│  │          proxy.go
│  │          proxy_manager.go
│  │          proxy_wrapper.go
│  │      
│  ├─config
│  │      client.go
│  │      client_test.go
│  │      DefaultiniBytefrpc.go
│  │      DefaultiniBytefrps.go
│  │      parse.go
│  │      proxy.go
│  │      proxy_test.go
│  │      README.md
│  │      server.go
│  │      server_test.go
│  │      types.go
│  │      types_test.go
│  │      utils.go
│  │      value.go
│  │      visitor.go
│  │      visitor_test.go
│  │      
│  ├─consts
│  │      consts.go
│  │      
│  ├─dscrypto
│  │      aes.go
│  │      des.go
│  │      md5.go
│  │      rsa.go
│  │      rsa_private_key.pem
│  │      rsa_public_key.pem
│  │      sha1.go
│  │      var.go
│  │      
│  ├─errors
│  │      errors.go
│  │      
│  ├─metrics
│  │  │  metrics.go
│  │  │  
│  │  ├─aggregate
│  │  │      server.go
│  │  │      
│  │  ├─mem
│  │  │      server.go
│  │  │      types.go
│  │  │      
│  │  └─prometheus
│  │          server.go
│  │          
│  ├─msg
│  │      ctl.go
│  │      msg.go
│  │      
│  ├─nathole
│  │      nathole.go
│  │      
│  ├─plugin
│  │  ├─client
│  │  │      http2https.go
│  │  │      https2http.go
│  │  │      https2https.go
│  │  │      http_proxy.go
│  │  │      plugin.go
│  │  │      socks5.go
│  │  │      static_file.go
│  │  │      unix_domain_socket.go
│  │  │      
│  │  └─server
│  │          http.go
│  │          manager.go
│  │          plugin.go
│  │          tracer.go
│  │          types.go
│  │          
│  ├─proto
│  │  └─udp
│  │          udp.go
│  │          udp_test.go
│  │          
│  ├─server
│  │  │  control.go
│  │  │  dashboard.go
│  │  │  dashboard_api.go
│  │  │  service.go
│  │  │  
│  │  ├─controller
│  │  │      resource.go
│  │  │      
│  │  ├─group
│  │  │      group.go
│  │  │      http.go
│  │  │      tcp.go
│  │  │      tcpmux.go
│  │  │      
│  │  ├─metrics
│  │  │      metrics.go
│  │  │      
│  │  ├─ports
│  │  │      ports.go
│  │  │      
│  │  ├─proxy
│  │  │      http.go
│  │  │      https.go
│  │  │      proxy.go
│  │  │      stcp.go
│  │  │      sudp.go
│  │  │      tcp.go
│  │  │      tcpmux.go
│  │  │      udp.go
│  │  │      xtcp.go
│  │  │      
│  │  └─visitor
│  │          visitor.go
│  │          
│  ├─transport
│  │      tls.go
│  │      
│  ├─util
│  │  ├─limit
│  │  │      reader.go
│  │  │      writer.go
│  │  │      
│  │  ├─log
│  │  │      log.go
│  │  │      
│  │  ├─metric
│  │  │      counter.go
│  │  │      counter_test.go
│  │  │      date_counter.go
│  │  │      date_counter_test.go
│  │  │      metrics.go
│  │  │      
│  │  ├─net
│  │  │      conn.go
│  │  │      dial.go
│  │  │      http.go
│  │  │      kcp.go
│  │  │      listener.go
│  │  │      tls.go
│  │  │      udp.go
│  │  │      websocket.go
│  │  │      
│  │  ├─tcpmux
│  │  │      httpconnect.go
│  │  │      
│  │  ├─util
│  │  │      http.go
│  │  │      util.go
│  │  │      util_test.go
│  │  │      
│  │  ├─version
│  │  │      version.go
│  │  │      version_test.go
│  │  │      
│  │  ├─vhost
│  │  │      http.go
│  │  │      https.go
│  │  │      https_test.go
│  │  │      resource.go
│  │  │      router.go
│  │  │      vhost.go
│  │  │      
│  │  └─xlog
│  │          ctx.go
│  │          xlog.go
│  │          
│  └─web
│      ├─frpc
│      │  └─src            
│      └─frps
│          └─src

06-参考项目资源

Stargazers over time

erfrp's People

Contributors

0e0w avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

erfrp's Issues

aes key配置

建议放在frpc.ini里面,方便随时修改。通常安全设备会加入一些默认的key或者捕获较多样本所提取的key去识别,每次改来改去麻烦

frpc.ini的问题

根据历史问题各个师傅们的方法 成功运行起来。发现命令行直接运行frpc 虽然会生成frpc.ini,但是根本不需要frpc.ini就已经运行起来了,看了一下生成的frpc.ini的内容 server_addr 是默认的值。但web里确实出现了隧道 那这样的话 frpc.ini的意义就消失了

11

这流量真的改了吗

关于什么都改了,还是无法连接

就我手动那个var文件改了,然后aes那个ip也成功加密,然后也重新生成了exe,但是配置文件里依然还是192地址,我不知道为什么

我这个怎么办呢

frpc.exe -c frpc.ini
2024/05/07 22:23:14 [I] [value.go:100] Local load ini file
2024/05/07 22:23:14 [I] [service.go:370] [1159d84bd6423eda] login to server success, get run id [1159d84bd6423eda], server udp port [0]
2024/05/07 22:23:14 [I] [proxy_manager.go:141] [1159d84bd6423eda] proxy added: [plugin_socks5]
2024/05/07 22:23:14 [W] [control.go:290] [1159d84bd6423eda] read error: message type error
2024/05/07 22:23:14 [I] [control.go:311] [1159d84bd6423eda] control writer is closing
2024/05/07 22:23:14 [I] [visitor_manager.go:59] [1159d84bd6423eda] gracefully shutdown visitor manager
2024/05/07 22:23:15 [I] [service.go:209] [1159d84bd6423eda] try to reconnect to server...
2024/05/07 22:23:15 [I] [service.go:370] [1159d84bd6423eda] login to server success, get run id [1159d84bd6423eda], server udp port [0]
2024/05/07 22:23:15 [I] [proxy_manager.go:141] [1159d84bd6423eda] proxy added: [plugin_socks5]
2024/05/07 22:23:15 [W] [control.go:290] [1159d84bd6423eda] read error: message type error
2024/05/07 22:23:15 [I] [control.go:311] [1159d84bd6423eda] control writer is closing
2024/05/07 22:23:15 [I] [visitor_manager.go:59] [1159d84bd6423eda] gracefully shutdown visitor manager
2024/05/07 22:23:16 [I] [service.go:209] [1159d84bd6423eda] try to reconnect to server...

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.