Goauld

Documentation | Releases

Goauld is a post-exploitation and remote access tool designed for restricted environments.

Use Goauld only on systems and networks you are authorized to assess.

During penetration tests, operators are sometimes forced to work from a client-provided laptop behind VPNs, authenticated egress proxies, or restrictive network controls. In other cases, gaining remote code execution on a system still requires establishing a stable and fully interactive access channel.

Goauld solves these problems by providing a tunneling and access tool that allows operators to interact with remote agents through multiple transport protocols while maintaining a secure SSH-based architecture.

Goauld is composed of three components:

• The server: exposes an SSH server both directly and through multiple tunneling transports
• The agent: runs on the target host, and embeds an SSH server, SOCKS and HTTP proxies
• The client: used by the operator to access agents and manage sessions

Persistent shell sessions

Use the SSH session picker to reconnect to an existing persistent shell or create a new one:

tealc ssh --session AGENT

The picker lists running sessions. A session that is already attached is marked [RO] and opens as a read-only observer; detached sessions open with normal input. Select [NEW] to create and attach a new persistent shell. Press q, Escape, or Ctrl-C to cancel. While attached, press Ctrl-g followed by d to detach and leave the shell running.

Quick start

After connecting to an agent, use tealc ssh --session AGENT to select or create a persistent shell.

The typical deployment uses three machines:

• A publicly reachable server
• An operator client (tealc)
• A target agent

Start with the quick-start guide. It covers key and token generation, server configuration, agent compilation, and connecting to an agent.

Before deploying, configure the server's allowed-ips; access control is fail-closed. Protect the Age private key, access/admin tokens, and agent passwords. See access control and deployment.

Prebuilt binaries are available from Releases. Building from source requires Go; see the compilation guide.

Use cases

• Post-exploitation remote access
• Pivoting through compromised hosts
• Working from restricted corporate assessment laptops
• Bypassing authenticated proxies

Features

The main agent features are:

• Cross-platform (Windows, Linux and MacOS)
• SSH encapsulation over multiple transports:
  • Direct SSH
  • TLS
  • QUIC
  • WebSocket
  • HTTP
  • DNS
• Support for egress proxies with automatic NTLM/Kerberos authentication if required by the proxy
• Automatic NTLM/Kerberos application-level authentication when required by the target application
• Exposes SOCKS and HTTP proxies (which can themselves operate through upstream HTTP proxies)
• Fully interactive shell access
• File transfer via integrated SCP, Rsync, or Rclone
• TUN interface using an embedded WireGuard implementation
• Remote socket binding and listening on the agent
• Agent relaying

Demo

Demo.webm

The architecture is based on an outbound SSH tunnel established from the agent to the server. All communications are encapsulated within this tunnel, simplifying network traversal while preserving security and segmentation.

Acknowledgments

This project takes inspiration from several tools:

• Chisel
• DNSTT
• Champa
• Ligolo-ng
• gVisor