Most often, during security assessment work, a perimeter breach occurs via remote code execution on the customer’s server. Next, the pentester faces a pivoting task: they need to turn the compromised machine into an intermediate communication node for access to other resources inside the target network.
Usually, Neo-reGeorg or suo5 is used for this. These tools are quite good for most tasks, but not everything always goes according to plan.
For example, on one of the projects, our specialists encountered the following problem: Linux collectors of the Bloodhound tool could not collect a dump. One could use SharpHound, but it does not support DNS over TCP. That means UDP traffic needs to be proxied — but none of the mentioned tools can do that.
Another time, we had to troubleshoot a problem specifically in the ashx/aspx templates of Neo-reGeorg: large files were simply corrupted and brought the tunnel down. While writing a fix, it became clear that the problem was more architectural, and a small patch would not suffice.
Our expert Alexey Alanov found ways to improve and extend Neo-reGeorg’s functionality, but the codebase had diverged significantly from the original. That is how Roger was created.
The new tool includes full SOCKS5 support per RFC 1928, can compress intermediate traffic, has a connection manager, and other nice features. Getting started is quite easy, especially if you have tried Neo-reGeorg before.
We generate the payload:
./roger-go generate -k 'testK3y123!'
Then we drop it onto the server and connect with the Roger client:
./roger-go -k 'testK3y123!' -u <roger url>
The Roger utility has many options that can be used to establish a stable and fast tunnel in various situations. Use it and add to favorites. More updates are coming!
