audibleblink / doxycannon Goto Github PK

A poorman's proxycannon and botnet, using docker, ovpn files, tor nodes, and dante socks5 proxies

License: GNU General Public License v3.0

Python 97.27% Dockerfile 2.73%

docker redteam pentest proxy openvpn botnet tor proxychains

doxycannon's Introduction

doxycannon

Doxycannon uses docker to create multiple socks proxies where the upstream internet connections are either VPN connections or Tor nodes

In VPN mode, it takes a pool of OpenVPN files and creates a Docker container for each one. After a successful VPN connection, each container spawns a SOCKS5 proxy server and binds it to a port on the Docker host.

In Tor mode, containers initiate a connection to the Tor network.

Both VPN and Tor nodes can be rotated through, giving you a new egress IP with each request.

Combined with tools like Burp suite or proxychains, this creates your very own (small) private botnet on the cheap.

Password Spraying Blog Post Using DoxyCannon

Prerequisites

If using VPN mode, you'll need a VPN subscription to a provider that distributes *.ovpn files

Install the required pip modules:
```
pip install -r requirements.txt
```
Ensure docker is installed and enabled. Refer to the Wiki for installation instructions on Kali/Debian
proxychains4 is required for interactive mode

Setup

Create a NAME.txt file with your ovpn credentials in VPN. The format is:
```
username
password
```
Fill the VPN folder with *.ovpn files and ensure that the auth-user-pass directive in your ./VPN/*.ovpn files says auth-user-pass NAME.txt
- Check out this wiki section for installation instructions for individual VPN providers

Within the VPN folder, you may divide/organize your VPN file into subdirectories and use the --dir flag with the --up or --single commands to only use those configs

mkdir -p VPN/US
mv US.opvn auth-us.txt VPN/US
doxycannon vpn --dir VPN/US --up

mkdir -p VPN/FR
mv FR.opvn auth-fr.txt VPN/FR
doxycannon vpn --dir VPN/FR --up

If --dir is equal to VPN, a container will be launched for each ovpn file inside the folder. Use --single to have HAproxy load-balance between all VPNs.
```
 doxycannon vpn --dir VPN --up
 doxycannon vpn --dir VPN --single # Launch HAproxy to load balance
```
--single does not stop proxy containers when it quits, it only stops HAproxy. Use --down to bring them down.
Alternatively, use the tor subcommand to just spin up tor nodes
```
doxycannon tor --nodes 7 --single
```

Usage

note: Before 14 May 21, versions of rofl0r/proxychains-ng use a second-based seed for the PRNG that determines random proxy selection. Be sure to use a version based on or after this commit

One-off, random commands

While your containers are up, you can use proxychains-ng to issue commands through random proxies

proxychains4 -q curl -s ipconfig.io/json
proxychains4 -q hydra -L users.txt -p Winter2020 manager.example.com -t 8 ssh

GUI Tools

Use the --single flag to create a proxy rotator.

❯❯ ./doxycannon.py [vpn|tor] --single
[+] Writing HAProxy configuration
[*] Image doxyproxy built.
[*] Staring single-port mode...
[*] Proxy rotator listening on port 1337. Ctrl-c to quit
^C
[*] doxyproxy was issued a stop command
[*] Your proxies are still running.

To see what's happening, checkout out the haproxy folder. Essentially, the tool builds a layer 4 load-balancer between all the VPNs. This allows rotatation of proxies through a single port. One can then point browsers or BURPSuite at it and have every request use a different VPN.

Specific SOCKS proxies

Example: To make a request through Japan, use docker ps and find the local port to which the Japanese VPN is bound.

Configure your tool to use that port:

curl --socks5 localhost:50xx ipconfig.io/json

Interactive

Once you've started your containers, run the utility with the --interactive flag to get a bash session where all network traffic is redirected through proxychains4

./doxycannon.py --interactive

Credit

pry0cc for the idea

This was originally a fork of pry0cc's ProxyDock. It's been modified to an extent where less than 1% of the original code remains.

doxycannon's People

Contributors

Stargazers

Watchers

Forkers

clr2of8 w00t3k vysecurity ryanbreed bilportistivraboti gpsbird cclauss neo4reo ro9ueadmin quikilr tjwallas r00tarded juan157 jbarcia c0debr8kr ethicalredteam pry0cc ashr peytondodd routeback dannymas attackgithub rev-lulz 1nf1natel00p3r ankushgoel27 ajgappmark modulexcite 303sec an0nym0u5101 htoochonaung snifer nextgenhacker 0xrake vltraheaven snifer-l4b-s oxis therealelyayo slooppe kc0021 sts0mrg0 daed5 darksidesfear kopfjager007 juliandaz11-company 0xjson deltared1a powned

doxycannon's Issues

Q: proxychains-ng PRNG

hello, do the problems you state about the randomchain seed also affect proxychains-ng ?

btw note that "the original proxychains" repo you quote isn't original at all, it's a fork by some random person.

add pre-reqs and docker installation docs

dante won't start. How to troubleshoot?

I can't seem to connect to any of my VPN containers. If I run docker logs <container>, all of them say:

2020-11-25 18:57:10,984 CRIT Supervisor is running as root.  Privileges were not dropped because no user is specified in the config file.  If you intend to run as root, you can set user=root in the config file to avoid this message.
2020-11-25 18:57:10,984 INFO Included extra file "/etc/supervisor.d/01_openvpn.ini" during parsing
2020-11-25 18:57:10,984 INFO Included extra file "/etc/supervisor.d/02_proxy.ini" during parsing
2020-11-25 18:57:10,990 INFO RPC interface 'supervisor' initialized
2020-11-25 18:57:10,990 CRIT Server 'unix_http_server' running without any HTTP authentication checking
2020-11-25 18:57:10,991 INFO supervisord started with pid 1
2020-11-25 18:57:11,993 INFO spawned: 'openvpn' with pid 7
2020-11-25 18:57:11,995 INFO spawned: 'dante' with pid 8
2020-11-25 18:57:11,999 INFO exited: dante (exit status 1; not expected)
2020-11-25 18:57:13,319 INFO success: openvpn entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
2020-11-25 18:57:13,320 INFO spawned: 'dante' with pid 9
2020-11-25 18:57:13,326 INFO exited: dante (exit status 1; not expected)
2020-11-25 18:57:15,522 INFO spawned: 'dante' with pid 16
2020-11-25 18:57:15,526 INFO exited: dante (exit status 1; not expected)
2020-11-25 18:57:18,531 INFO spawned: 'dante' with pid 17
2020-11-25 18:57:18,536 INFO exited: dante (exit status 1; not expected)
2020-11-25 18:57:22,542 INFO spawned: 'dante' with pid 18
2020-11-25 18:57:22,547 INFO exited: dante (exit status 1; not expected)
2020-11-25 18:57:27,555 INFO spawned: 'dante' with pid 19
2020-11-25 18:57:27,562 INFO exited: dante (exit status 1; not expected)
2020-11-25 18:57:33,571 INFO spawned: 'dante' with pid 20
2020-11-25 18:57:33,575 INFO exited: dante (exit status 1; not expected)
2020-11-25 18:57:40,585 INFO spawned: 'dante' with pid 21
2020-11-25 18:57:40,592 INFO exited: dante (exit status 1; not expected)
2020-11-25 18:57:48,604 INFO spawned: 'dante' with pid 22
2020-11-25 18:57:48,610 INFO exited: dante (exit status 1; not expected)
2020-11-25 18:57:57,622 INFO spawned: 'dante' with pid 23
2020-11-25 18:57:57,627 INFO exited: dante (exit status 1; not expected)
2020-11-25 18:58:07,641 INFO spawned: 'dante' with pid 24
2020-11-25 18:58:07,646 INFO exited: dante (exit status 1; not expected)
2020-11-25 18:58:18,661 INFO spawned: 'dante' with pid 25
2020-11-25 18:58:18,665 INFO exited: dante (exit status 1; not expected)
2020-11-25 18:58:30,682 INFO spawned: 'dante' with pid 26
2020-11-25 18:58:30,690 INFO exited: dante (exit status 1; not expected)
2020-11-25 18:58:43,707 INFO spawned: 'dante' with pid 32
2020-11-25 18:58:43,711 INFO exited: dante (exit status 1; not expected)
2020-11-25 18:58:57,730 INFO spawned: 'dante' with pid 35
2020-11-25 18:58:57,734 INFO exited: dante (exit status 1; not expected)
2020-11-25 18:59:12,754 INFO spawned: 'dante' with pid 36
2020-11-25 18:59:12,758 INFO exited: dante (exit status 1; not expected)
2020-11-25 18:59:13,760 INFO gave up: dante entered FATAL state, too many start retries too quickly

If I docker exec -it <container> sh, then run:

ip addr show:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: sit0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
    link/sit 0.0.0.0 brd 0.0.0.0
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
    link/none
    inet 10.10.8.46 peer 10.10.8.45/32 scope global tun0
       valid_lft forever preferred_lft forever
152: eth0@if153: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.17.0.3/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever

ss -tlpm:

/ # ss -tlpm
State                Recv-Q                 Send-Q                                 Local Address:Port                                 Peer Address:Port                Process
/ #

$>curl --socks5 localhost:9000 www.google.com
curl: (7) Unable to receive initial SOCKS5 response.

$>curl --socks5 localhost:1337 www.google.com
curl: (7) Failed to connect to localhost port 1337: Connection refused

I'm able to use the .ovpn file with OpenVPN just fine, but can't seem to get doxycannon working. Any idea what's going on?

I'm running Docker v2.5.0.1 on Windows 10 with Linux Containers.

[provider] - HideMyAss issues

HideMyAss provides ovpn files whose connection protocols include both UDP/TCP.

The connections also prefer IPv6.

Additional investigation is required to ensure doxycannon work with this provider

Unable to resolve DNS names

I had to edit the doxycannon.py template that generates proxychains.conf and comment out proxy_dns for DNS requests to successfully resolve. I also created a symlink after referencing this blogpost: https://stackoverflow.com/questions/25679367/proxychains-unable-to-locate-file-on-kali-linux

ln -s /usr/lib/proxychains3/proxyresolv /usr/bin/

Before changes:

root@:$ proxychains4 ping 8.8.8.8
[proxychains] config file found: /root/scripts/doxycannon/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=128 time=22.7 ms
^C
--- 8.8.8.8 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 22.777/22.777/22.777/0.000 ms

root@root:$ proxychains4 ping google.com
[proxychains] config file found: /root/scripts/doxycannon/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
PING google.com (224.0.0.1) 56(84) bytes of data.
^C
--- google.com ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1009ms

After change

root@root:$ proxychains4 ping google.com
[proxychains] config file found: /root/scripts/doxycannon/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
PING google.com (216.58.216.110) 56(84) bytes of data.
64 bytes from ord30s22-in-f110.1e100.net (216.58.216.110): icmp_seq=1 ttl=128 time=15.1 ms
64 bytes from ord30s22-in-f110.1e100.net (216.58.216.110): icmp_seq=2 ttl=128 time=16.4 ms
^C
--- google.com ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 15.148/15.803/16.458/0.655 ms

Ideally for opsec purposes you would want all DNS requests routed through tun0, but for the sake of getting things working I used the above fix.

Warn if Doxycannon (containers) are already running

If you try to start DoxyCannon after you already have containers running, it will provide a very long error message and stop accepting terminal input (Ctrl + C will not break, must kill DoxyCannon process manually in another terminal).

Is it possible to add a check for running containers that match the *.ovpn configuration files and notify the user that 'The cannon is already armed' prior to performing any work?

root@:$ ./doxycannon.py --build
[*] Image audibleblink/doxycannon built.
root@:$ ./doxycannon.py --up
[+] Writing HAProxy configuration
[+] Writing Proxychains4 configuration
Starting: us-tx-108.protonvpn.com.udp1194
Starting: us-il-105.protonvpn.com.udp1194
Starting: us-nj-04.protonvpn.com.udp1194
Exception in thread Thread-2:
Traceback (most recent call last):
  File "/usr/lib/python2.7/threading.py", line 801, in __bootstrap_inner
    self.run()
  File "/usr/lib/python2.7/threading.py", line 754, in run
    self.__target(*self.__args, **self.__kwargs)
  File "./doxycannon.py", line 166, in multistart
    detach=True)
  File "/usr/local/lib/python2.7/dist-packages/docker/models/containers.py", line 766, in run
    detach=detach, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/docker/models/containers.py", line 824, in create
    resp = self.client.api.create_container(**create_kwargs)
  File "/usr/local/lib/python2.7/dist-packages/docker/api/container.py", line 411, in create_container
    return self.create_container_from_config(config, name)
  File "/usr/local/lib/python2.7/dist-packages/docker/api/container.py", line 422, in create_container_from_config
    return self._result(res, True)
  File "/usr/local/lib/python2.7/dist-packages/docker/api/client.py", line 235, in _result
    self._raise_for_status(response)
  File "/usr/local/lib/python2.7/dist-packages/docker/api/client.py", line 231, in _raise_for_status
    raise create_api_error_from_http_exception(e)
  File "/usr/local/lib/python2.7/dist-packages/docker/errors.py", line 31, in create_api_error_from_http_exception
    raise cls(e, response=response, explanation=explanation)
APIError: 409 Client Error: Conflict ("Conflict. The container name "/us-il-105.protonvpn.com.udp1194" is already in use by container "9103148a541a0cc19ea824b1290e179f85a1f8067bd091f762aa0f4fc79b29ad". You have to remove (or rename) that container to be able to reuse that name.")
Exception in thread Thread-1:
Traceback (most recent call last):
  File "/usr/lib/python2.7/threading.py", line 801, in __bootstrap_inner
    self.run()
  File "/usr/lib/python2.7/threading.py", line 754, in run
    self.__target(*self.__args, **self.__kwargs)
  File "./doxycannon.py", line 166, in multistart
    detach=True)
  File "/usr/local/lib/python2.7/dist-packages/docker/models/containers.py", line 766, in run
    detach=detach, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/docker/models/containers.py", line 824, in create
    resp = self.client.api.create_container(**create_kwargs)
  File "/usr/local/lib/python2.7/dist-packages/docker/api/container.py", line 411, in create_container
    return self.create_container_from_config(config, name)
  File "/usr/local/lib/python2.7/dist-packages/docker/api/container.py", line 422, in create_container_from_config
    return self._result(res, True)
  File "/usr/local/lib/python2.7/dist-packages/docker/api/client.py", line 235, in _result
    self._raise_for_status(response)
  File "/usr/local/lib/python2.7/dist-packages/docker/api/client.py", line 231, in _raise_for_status
    raise create_api_error_from_http_exception(e)
  File "/usr/local/lib/python2.7/dist-packages/docker/errors.py", line 31, in create_api_error_from_http_exception
    raise cls(e, response=response, explanation=explanation)
APIError: 409 Client Error: Conflict ("Conflict. The container name "/us-tx-108.protonvpn.com.udp1194" is already in use by container "9c850136d9effbe6cd5b310c4302850bc4160788a858296c57e6276b57c1bf0a". You have to remove (or rename) that container to be able to reuse that name.")


Exception in thread Thread-3:
Traceback (most recent call last):
  File "/usr/lib/python2.7/threading.py", line 801, in __bootstrap_inner
    self.run()
  File "/usr/lib/python2.7/threading.py", line 754, in run
    self.__target(*self.__args, **self.__kwargs)
  File "./doxycannon.py", line 166, in multistart
    detach=True)
  File "/usr/local/lib/python2.7/dist-packages/docker/models/containers.py", line 766, in run
    detach=detach, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/docker/models/containers.py", line 824, in create
    resp = self.client.api.create_container(**create_kwargs)
  File "/usr/local/lib/python2.7/dist-packages/docker/api/container.py", line 411, in create_container
    return self.create_container_from_config(config, name)
  File "/usr/local/lib/python2.7/dist-packages/docker/api/container.py", line 422, in create_container_from_config
    return self._result(res, True)
  File "/usr/local/lib/python2.7/dist-packages/docker/api/client.py", line 235, in _result
    self._raise_for_status(response)
  File "/usr/local/lib/python2.7/dist-packages/docker/api/client.py", line 231, in _raise_for_status
    raise create_api_error_from_http_exception(e)
  File "/usr/local/lib/python2.7/dist-packages/docker/errors.py", line 31, in create_api_error_from_http_exception
    raise cls(e, response=response, explanation=explanation)
APIError: 409 Client Error: Conflict ("Conflict. The container name "/us-nj-04.protonvpn.com.udp1194" is already in use by container "29dc5360e957294ce41683a57bda9b624ee926230ef7f49e732a41bab22c389b". You have to remove (or rename) that container to be able to reuse that name.")

A help wanted

How to spray using other software like Openbullet? is it possible to use those proxies on it? thank you I've tried multiple time but I failed

Add the option of setting only Tor exit nodes (no VPNs)

As proposed here: #6 (comment)

It'll be awesome to have the option of allowing doxycannon to pop only docker tor containers that will be used as round-robin outgoing proxies for Haproxy.

./doxycannon.py --only-tor --nodes 16

That will popup 16 tor docker containers that will be used as outgoing proxies for Haproxy.

Multiple VPN folders

Hi, many VPN services limit 5 connections at the same time, is it run with each VPN accounts in different forder(multiple vpn services). Thanks.

access from outside localhost

Hello,

How would it be possible to access the proxies from outside the localhost?
When i tried to access them with the servers ip address and the corresponding 9000 ports its not working, however the ports are accessible from the machine trying to access, when i run a normal http server there it works fine.
I also tried using the docker containers individual ip address instead of the servers and i have tried to look for 127.0.0.1 in doxycannon and replaced it with 0.0.0.0.
The server i am running the doxycannon on is a kali linux machine.
Sorry if this is a dumb question i am not very experienced in linux

Thanks in advance for every help!

Connection - "First Hop over Tor"

So looking at this, it should be reasonably trivial to do your first hop over Tor, by putting a Tor daemon in the containers, and telling the OpenVPN connection to use the local SOCKS5 proxy offered by the Tor daemon.

The reason I personally think this would be an excellent feature, is in the cases where you don't trust your VPN provider all that much to not immediately give you trouble, or for the ultra-paranoid, etc etc.

Wiki Addition - ProtonVPN

ProtonVPN configuration files use update-resolv-conf instead of the up/down.sh script. This will prevent OpenVPN from being able to successfully connect within the Docker containers unless the configuration files are changed.

cd VPN
sed -i 's/up \/etc\/openvpn\/update-resolv-conf/up \/etc\/openvpn\/up.sh/g' *.ovpn
sed -i 's/down \/etc\/openvpn\/update-resolv-conf/down \/etc\/openvpn\/down.sh/g' *.ovpn

temp

NordVpn

Hello,

i tried to set it up with NordVpn but keep getting this error when doing --build

┌──(kali㉿kali)-[~/Desktop/doxy/doxycannon]
└─$ python3 doxycannon.py vpn --dir VPN --build
[+] Building image: audibleblink/doxycannon.
The command '/bin/sh -c apk --no-cache add openvpn dante-server supervisor &&   rm -rf /var/cache/' returned a non-zero code: 3
Traceback (most recent call last):
  File "/home/kali/Desktop/doxy/doxycannon/doxycannon.py", line 576, in <module>
    main(args)
  File "/home/kali/Desktop/doxy/doxycannon/doxycannon.py", line 552, in main
    handle_vpn(args)
  File "/home/kali/Desktop/doxy/doxycannon/doxycannon.py", line 537, in handle_vpn
    build(IMAGE)
  File "/home/kali/Desktop/doxy/doxycannon/doxycannon.py", line 69, in build
    doxy.images.build(path=path, tag=image, forcerm=True)
  File "/home/kali/.local/lib/python3.9/site-packages/docker/models/images.py", line 285, in build
    raise BuildError(chunk['error'], result_stream)
docker.errors.BuildError: The command '/bin/sh -c apk --no-cache add openvpn dante-server supervisor &&         rm -rf /var/cache/' returned a non-zero code: 3

i put the credentials in the NAME.txt file like described and changed the .ovpn files to auth-user-pass NAME.txt.
In Tor mode everything works as expected so my installation should be alright

i will be happy about any ideas which can help : )

Automation

Automatically move your cards to the right place based on the status and activity of your issues and pull requests.

Problem while building containers - doxycannon --build

Hi,

I found recently a problem while building the alpine containers, I found out this problem is due the dante-server package, which is not listed anymore on the provided index.

I just fixed this problem by addind the following line after the first echo on the Dockerfile:

echo 'http://dl-4.alpinelinux.org/alpine/v3.12/community' >> /etc/apk/repositories && \

Warn if Docker service is not started

If the Docker service is not running when you attempt to use Doxycannon, it will spit out a big python error. Add a catch for this error and instruct the user to start docker.

root:$ ./doxycannon.py --build
('Connection aborted.', error(2, 'No such file or directory'))
Traceback (most recent call last):
  File "./doxycannon.py", line 312, in <module>
    main()
  File "./doxycannon.py", line 300, in main
    build(IMAGE)
  File "./doxycannon.py", line 66, in build
    doxy.images.build(path=path, tag=image_name)
  File "/usr/local/lib/python2.7/dist-packages/docker/models/images.py", line 258, in build
    resp = self.client.api.build(**kwargs)
  File "/usr/local/lib/python2.7/dist-packages/docker/api/build.py", line 259, in build
    timeout=timeout,
  File "/usr/local/lib/python2.7/dist-packages/docker/utils/decorators.py", line 46, in inner
    return f(self, *args, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/docker/api/client.py", line 194, in _post
    return self.post(url, **self._set_request_timeout(kwargs))
  File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 555, in post
    return self.request('POST', url, data=data, json=json, **kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 508, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 618, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/adapters.py", line 490, in send
    raise ConnectionError(err, request=request)
requests.exceptions.ConnectionError: ('Connection aborted.', error(2, 'No such file or directory'))

root:$ service docker status
● docker.service - Docker Application Container Engine
   Loaded: loaded (/lib/systemd/system/docker.service; disabled; vendor preset: disabled)
   Active: inactive (dead)
     Docs: https://docs.docker.com
root:$ service docker start
root:$ ./doxycannon.py --build
[*] Image audibleblink/doxycannon built.

being able to start multiple single instances

It would be nice to have a option to be able toset up multiple single instances for multithreaded GUI Tools
like:
./doxycannon.py --single --instances 10
[+] Writing HAProxy configuration
[] 10 Images with doxyproxy built.
[] Staring single-port mode...
[*] Proxy rotator listening on ports 1337, 1338, 1339, 1340, 1341, 1342, 1343, 1344, 1345, 1346
Ctrl-c to quit