kpcyrd / snail Goto Github PK

View Code? Open in Web Editor NEW

15.0 3.0 2.0 599 KB

Parasitic network manager

Home Page: https://crates.io/crates/snail

License: GNU General Public License v3.0

Makefile 0.10% Lua 1.42% Rust 96.85% Shell 1.56% Dockerfile 0.07%

network-manager sandboxed security parasitic rust lua scriptable

snail's Introduction

snail

Disclaimer: The project is in a very early state, you're very likely to experience bugs. I'm using it as my daily driver, but you should expect a very bare bone experience if you're considering doing the same.

Parasitic network manager. snail is trying to fill the gap of a metasploit-like network manager. Its core feature is a scripting engine that can be used to match known networks and also interact with captive portals if one is discovered. Have a look at the scripts/ folder for examples. The basic idea is that you're trying to get connectivity, but you don't really care where it's actually coming from. Please remain seated and keep your arms and legs inside the firewall at all times.

Installation

If possible, use the snail-git package for archlinux. For a manual setup on a debian based system, install the dependency libraries libseccomp-dev, libdbus-1-dev and libzmq3-dev.

Next, build the binary:

cargo build --release

And install it:

install -Dm755 target/release/snail{d,ctl} /usr/bin
install -Dm644 scripts/* -t /usr/lib/snaild/scripts

install -d /etc/snail/scripts
install -Dm644 contrib/snail.conf -t /etc/snail
install -Dm644 contrib/[email protected] -t /usr/lib/systemd/system
install -Dm644 contrib/snail-tmpfiles.conf /usr/lib/tmpfiles.d/snail.conf
install -Dm644 contrib/snail-sysuser.conf /usr/lib/sysusers.d/snail.conf

systemd-tmpfiles --create
systemd-sysusers
systemctl daemon-reload
systemctl enable --now snail@wlp3s0

You can monitor your network status with snailctl. Make sure your user is in the correct group which is specified in /etc/snail/snail.conf.

snailctl status

To add yourself to the correct group, run

usermod -aG snail user

snailctl decap

The captive portal engine should run automatically as part of snaild, but it's also possible to invoke it manually.

To execute the engine in verbose mode, run:

snailctl decap -v

Some portals also hijack the android captive portal probe, in that case you can bypass the captive portal test and execute the scripts directly by running:

snailctl decap -vf

If you are developing a new script, you can provide the path to that script using:

snailctl decap -v ~/scripts/foo.lua

By default, custom scripts are loaded from /etc/snail/scripts/*.lua, but you can also add additional folders to /etc/snail/snail.conf:

[scripts.paths."/home/user/snail/scripts"]
[scripts.paths."/opt/snail/scripts"]

To ensure your script is properly being picked up, run snailctl without any arguments:

snailctl

If you wrote a new script for a captive portal, please submit a pull request.

snaild dns

snaild contains a dns server that listens for dns queries on localhost and forwards them to a dns-over-https recursor. You can also configure your own zones that get forwarded to a different dns recursor, or hardcode static dns records.

[dns]
bind = "127.0.0.1:53"

# cloudflare
servers = ["1.1.1.1",
           "1.0.0.1",
           "2606:4700:4700::1111",
           "2606:4700:4700::1001"]
port = 443
sni = "cloudflare-dns.com"

[dns.records]
"foo.example.com" = ["192.0.2.10", "2001:DB8::10"]
"bar.example.com" = ["192.0.2.20", "2001:DB8::20"]

[dns.zones]
"example.com" = ["192.0.2.2", "2001:DB8::2"]
"corp.example.com" = ["192.0.2.3", "2001:DB8::3"]

snaild vpn

🔥🔥🔥 Highly experimental, use at your own risk 🔥🔥🔥

snaild contains a vpn server and client that can be used to setup an encrypted tunnel to a remote server. It features forward secrecy, identity hiding for the client and is going to support various transport channels in the future to evade egress firewalls.

The encrypted tunnel is setup using the noise protocol with Noise_XK_25519_ChaChaPoly_BLAKE2s. Unlike some traditional vpn clients, we do not leak any metadata during the handshake.

To setup the server, run snaild vpn-keygen to generate a keypair for the server. You also need to specify a range for the client ip pool and list the public keys of all clients that are authorized to connect to the server.

[vpn.server]
bind = "0.0.0.0:443"

server_pubkey = "s0c8xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx4D0="
server_privkey = "a0zxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxQg5o="

gateway_ip = "192.168.100.1/24"
pool_start = "192.168.100.5"
pool_end = "192.168.100.200"

clients = [
    "cn66xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxaXY=",
]

Next, use snaild vpn-keygen again and generate a key for the client. Copy the private key you generated into the client section together with the public key you generated for the server.

[vpn.client]
remote = "192.0.2.13:443"

server_pubkey = "s0c8xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx4D0="
client_privkey = "te4Pxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx4Qx8="

Starting the vpn on both the server and client should give you an encrypted tunnel between both:

server# snaild vpnd snail0
client# snaild vpn snail1

Trivia

The name snailctl is inspired by Leucochloridium, a parasite that lives inside a snail and is able to control its host. In the long term, snaild is the process that interfaces with the snails brain and snailctl is the utility to control the snail through snaild.

The logo has been created by Baudon in 1879.

License

GPLv3+

snail's People

Contributors

Stargazers

Watchers

Forkers

duzhanyuan kursh

snail's Issues

Audit networks for TLS man in the middle

As part of the connection process, we should create a tls connection and record if the certificate is signed by a trusted CA or not. The user should be able to provide custom urls since the common names (like google) are probably whitelisted.

In addition, we could record those certificates and submit them to certificate transparency or save them for later if certificate transparency can not be reached from that network (which would be likely in case of an attack that severe).

We could also accept a config that pins certificates for some domains and alerts if those pins are violated.

This feature should be standalone, so the recorder can be used without depending on snaild as a network manager.

Local dns recursor and dns over https

I'm currently running a dns recursor locally for two reasons:

I don't want to send all my dns lookups to the network provided dns recursor
I still need to send some dns lookups to the network provided dns recursors for non-public zones

I would also like to switch to encrypted dns with dns-over-https (or dns-over-tls), but it seems this would currently require running two recursors, one for custom rules and one for dns-over-https.

We could integrate this into snail and make the decision where a request should go either using a config or a script (so we can also make the decision based on SSIDs), while also supporting dns-over-https.

Integrating this into snail would also help avoiding issues that could be introduced by #11.

Content-Type of post with form= should have a sane default

If we send an http request and the form= option is set, we should set the Content-Type to application/x-www-form-urlencoded if none has been set explicitly.

Decap: Probe non-existent dns names to detect portal

I ran into a few networks that whitelist the clients3.google.com endpoint that we currently use to detect captive portals. We should evaluate if probing <18-random-characters>.com generally results in redirects as well or if the captive portals are able to detect that those records do, in fact, not exist. This might be more reliable than the current captive portal detection which has false-negatives occasionally.

Include speedtest in snailctl status

We could try to integrate fast.com into snail so the network speed is available in the status output.

html_select should return innerHTML

Currently we only return attributes and a concatenation of all text nodes, html_select should also return the innerHTML if the element has any children.

standalone snailctl decap

The decap commands should be usable without talking to snaild at all.

This is currently not possible.

Network namespaces

This is a bit of a long term issue, but it would greatly help to make snail more secure out of the box:

A new network namespace is create for snail
A veth pair is created between the newly created network namespace and the regular system
Move the wifi interface into the network namespace, this makes it unavailable to other applications
Automatically configure a transfer network on the veth pair when the wifi interface has established a working internet connection

In addition, since the network namespace has it's own set of iptables rules, we can easily setup source nat for the wifi interface and outbound routing. Also, we could run VPN software inside the network namespace and make sure that only the VPN and snail are able to use it directly, while everything else is forced through the VPN. There are already subcommands in place that can be used if direct access to the network is needed (http, dns and connect). Those probably need to request the connection/lookup through snaild in the future.

Implement dhcpc in rust

We're currently using dhcpcd, this should be replaced by a rust implementation:

allows adding a sandbox to dhcp code
allows removing some notification hacks
allows better control over what is sent in dhcp requests (see RFC7844 and dhcpcanon)
allows tightening the systemd service config

The dhcp client should be able to run standalone as well so in can be used outside of the snail project if needed.

Add wpa_supplicant support

We're currently not able to connect to a wifi on our own, if wpa_supplicant is used on the system, we should be able to use wpactrl to control it.

meta_redirect

There should be a function that takes an html string and returns Option<String> if the html contains a meta-tag redirect. This way we don't have to parse the content= of the metatag in lua.

url_join

There should be an url_join function that can be used to when resolving relative redirects.

Do not load default script if a custom script has the same description

If there are 10 default scripts and all of them are copied in the custom scripts folder, it's getting reported as:

-=[ default scripts: 10
-=[ private scripts: 10

instead, it should be reported as

-=[ default scripts: 0
-=[ private scripts: 10

snailctl repl

Developing scripts is currently a bit inconvenient, there should be an interactive interface that can be used to develop snail scripts, similar to the python repl.

html_form

Build a map based on the inputs found in the html provided. This is useful to bootstrap form data from hidden inputs. Depends on #18 to work reliably if the page may have multiple forms.

Add iwd support

Same as #8, but for iwd. Note that there is currently no rust library available to talk to the iwd dbus interface.

snaild vpn and pluggable transports

This is extremely long term (read: years). In addition to #11 we could evaluate implementing a simple VPN protocol similar to fastd.

In addition to external VPNs (openvpn, wireguard, tinc, cjdns, ...), we could allow the user to use a snail internal VPN that is specifically designed to subvert firewalls. This requires a server that runs snaild vpn. For example, it would try to establish a tunnel using one of the following techniques, and fall over to the next one if it fails:

udp on a snaild specific port
tcp on a snaild specific port
web sockets over https on port 443
(send a wpad request)
web sockets over https on port 443, using the proxy from wpad
https on port 443
https on port 443, using the proxy from wpad
ssh on port 22
http on port 80
http on port 80, using the proxy from wpad
dns lookups on port 53, directly to the snaild server
dns lookups to google/cloudflare
dns lookups to the network recursor

We should also have a pluggable transports interface so pluggable transports can be used as well.

snaild would automatically configure the MTU based on the data obtained from dhcp or lower if required by the transport. All data is going to be encrypted, this is especially interesting since iodine doesn't do encryption on it's own. All transports that are not packet based would need a framing format.

Static leases that map public keys to fixed clients should also be considered.

For the server side, there should be a docker container for this that just works™.

Automatically probe for active mitm

There should be a way to configure automatic checks for active man-in-the-middle by tracing the path and checking for known choke points and/or comparing the results with various encapsulated layer 4 protocols that are less viable to hijack in the same way you would hijack tcp.

This information should be tracked for the current network and exported to snailctl status.

Logo contribution for snail

Hello @kpcyrd , i am a graphic designer. I searched this project a bit. And i designed a logo for snail. Also, If there is another idea, feel free to say me.

Blue color: represents network

What do you think?