{"id":13467065,"url":"https://github.com/q3k/crowbar","last_synced_at":"2025-04-06T00:09:49.157Z","repository":{"id":26799925,"uuid":"30258369","full_name":"q3k/crowbar","owner":"q3k","description":"Tunnel TCP over a plain HTTP session (warning: mediocre Go code)","archived":false,"fork":false,"pushed_at":"2021-01-24T08:21:05.000Z","size":37,"stargazers_count":476,"open_issues_count":6,"forks_count":41,"subscribers_count":23,"default_branch":"master","last_synced_at":"2025-03-29T23:09:46.404Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-2-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/q3k.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-02-03T18:40:00.000Z","updated_at":"2025-02-19T17:31:54.000Z","dependencies_parsed_at":"2022-08-31T23:21:03.114Z","dependency_job_id":null,"html_url":"https://github.com/q3k/crowbar","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/q3k%2Fcrowbar","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/q3k%2Fcrowbar/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/q3k%2Fcrowbar/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/q3k%2Fcrowbar/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/q3k","download_url":"https://codeload.github.com/q3k/crowbar/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247415967,"owners_count":20935387,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-31T15:00:52.761Z","updated_at":"2025-04-06T00:09:49.140Z","avatar_url":"https://github.com/q3k.png","language":"Go","funding_links":[],"categories":["Go","\u003ca id=\"01e6651181d405ecdcd92a452989e7e0\"\u003e\u003c/a\u003e工具"],"sub_categories":["\u003ca id=\"9d6789f22a280f5bb6491d1353b02384\"\u003e\u003c/a\u003e隧道\u0026\u0026穿透"],"readme":"Crowbar\n=======\n\nWhen a [corkscrew](http://www.agroman.net/corkscrew/) just isn't enough...\n\nIntro\n-----\n\n![Crowbar overview](http://q3k.org/crowbar-overview.png)\n\nCrowbar is an **EXPERIMENTAL** tool that allows you to establish a secure circuit with your existing encrypting TCP endpoints (an OpenVPN setup, an SSH server for forwarding...) when your network connection is limited by a Web proxy that only allows basic port 80 HTTP connectivity.\n\nCrowbar will tunnel TCP connections over an HTTP session using only GET and POST requests. This is in contrast to most tunneling systems that reuse the CONNECT verb. It also provides basic authentication to make sure nobody who stumbles upon the server steals your proxy to order drugs from Silkroad.\n\nFeatures\n--------\n\n - Establishes TCP connections via a proxy server using only HTTP GET and POST requests\n - Authenticates users from an authentication file\n - Will probably get you fired if you use this in an office setting\n\nSecurity \u0026 Confidentiality\n--------------------------\n\nCrowbar **DOES NOT PROVIDE ANY DATA CONFIDENTIALITY**. While the user authentication mechanism protects from replay attacks to establish connectivity, it will not prevent someone from MITMing the later connection transfer itself, or from MITMing whole sessions. So, yeah, make sure to **use it only tunnel an SSH or OpenVPN server**, and **firewall off most outgoing connections on your proxy server** (ie. only allow access to an already publicly-available SSH server)\n\nThe authentication code and crypto have not been reviewed by cryptographers. I am not a cryptographer. You should consider this when deploying Crowbar.\n\nKnown bugs\n----------\n\nThe crypto can be improved vastly to enable server authentication and make MITMing more difficult. It could also use a better authentication setup to allow the server to keep password hashes instead of plaintext.\n\nThe server should include some filtering functionality for allowed remote connections.\n\nThe server lacks any cleanup functions and rate limiting, so it will leak both descriptors and memory - this should be fixed soon.\n\nIs it any good?\n---------------\n\nEh, it works. I'm not an experienced Golang programmer though, so the codebase is probably butt-ugly.\n\nLicense\n-------\n\nBSD 2-clause, 'nuff said.\n\nUsage\n=====\n\nBinary releases\n---------------\n\nRelease and snapshot binaries can be downloaded from [this project's Github Releases page](https://github.com/q3k/crowbar/releases).\n\nServer setup\n------------\n\nThis assumes you're using Linux. If not, you're on your own.\n\nSet up an user for the service\n\n    useradd -rm crowbar\n    mkdir /etc/crowbar/\n    chown crowbar:crowbar /etc/crowbar\n\nCreate an authentication file - a new-line delimited file containing username:password pairs.\n\n    touch /etc/crowbar/userfile\n    chown crowbar:crowbar /etc/crowbar/userfile\n    chmod 600 /etc/crowbar/userfile\n    echo -ne \"q3k:supersecurepassword\\n1337h4xx0r:canttouchthis\" \u003e\u003e /etc/crowbar/userfile\n\nSet up an iptables rule to forward traffic from the :80 port to :8080, where the server will be running. Replace eth0 with your public network interface.\n\n    iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-port 8080\n\nRun the daemon in screen/tmux or write some unit files for your distribution:\n\n    crowbard -userfile=/etc/crowbar/userfile\n\nClient setup\n------------\n\nThis assumes you're running Linux on your personal computer. If not, you're on your own.\n\nCrowbar will honor the _de-facto_ standard HTTP\\_PROXY env var on Linux:\n\n    export HTTP_PROXY=evil.company.proxy.com:80\n\nFor netcat-like functionality:\n\n    crowbar-forward -local=- -username q3k -password secret -server http://your.proxy.server.com:80 -remote towel.blinkenlights.nl:23\n\nFor port-forwarding:\n\n\n    crowbar-forward -local=127.0.0.1:1337 -username q3k -password secret -server http://your.proxy.server.com:80 -remote towel.blinkenlights.nl:23 \u0026\n    nc 127.0.0.1 1337\n\n\nFor SSH ProxyCommand integration, place this in your .ssh/config, and then SSH into your.ssh.host.com as usual:\n\n    Host your.ssh.host.com\n        ProxyCommand crowbar-forward -local=- -username q3k -password secret -server http://your.proxy.server.com:80 -remote %h:%p\n\nBuilding from source\n--------------------\n\nI assume you have a working $GOPATH.\n\n    go get github.com/q3k/crowbar/...\n\ncrowbar-forward and crowbard will be in $GOPATH/bin.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fq3k%2Fcrowbar","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fq3k%2Fcrowbar","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fq3k%2Fcrowbar/lists"}