.. /Neo-reGeorg
Star

Access

Neo-reGeorg is an aggressive refactor of reGeorg, a self-hosted pivoting tool that generates an encrypted tunnel webshell (tunnel.php/jsp/jspx/aspx/ashx) uploaded to a compromised web server and opens a local SOCKS5 proxy that relays traffic through it into the internal network. Because the operator controls the compromised server, there is no vendor domain to block. It is heavily abused for webshell-based pivoting, tracked as MITRE ATT&CK S1189 and observed with the China-linked Houken/UNC5174 Ivanti CSA campaign, ChamelGang and Earth Estries, among others.

Paths:

Resources:

Detections:

Access

  1. Generates the encrypted tunnel webshells (tunnel.php, tunnel.jsp, tunnel.jspx, tunnel.aspx, tunnel.ashx) keyed with a shared password for upload to a compromised web server.

    python neoreg.py generate -k <KEY>
    Use case
    Preparing the server-side webshell that the tunnel will relay through.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  2. Runs the client against the uploaded webshell, opening a local SOCKS5 proxy (default 127.0.0.1:1080) that relays traffic through the tunnel into the internal network.

    python neoreg.py -k <KEY> -u http://<TARGET>/tunnel.php
    Use case
    Pivoting into an internal network through a compromised, internet-facing web server.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS