marionette

This is a Go port of the marionette programmable networy proxy.

Installation

Marionette requires several dependencies to be installed first.

GMP

Download the latest version of GMP, unpack the archive and run:

$ wget https://gmplib.org/download/gmp/gmp-6.1.2.tar.bz2
$ tar -xvjf gmp-6.1.2.tar.bz2
$ cd gmp-6.1.2

$ ./configure --enable-cxx
$ make
$ sudo make install
$ make check

PyCrypto

Download the latest version of PyCrypto, unpack the archive and run:

$ wget https://ftp.dlitz.net/pub/dlitz/crypto/pycrypto/pycrypto-2.6.1.tar.gz
$ tar zxvf pycrypto-2.6.1.tar.gz
$ cd pycrypto-2.6.1

$ python setup.py build
$ sudo python setup.py install --user

regex2dfa

Download the latest version of regex2dfa, unpack the archive and run:

$ wget -O regex2dfa.zip https://github.com/kpdyer/regex2dfa/archive/master.zip
$ unzip regex2dfa.zip
$ cd regex2dfa-master

$ ./configure
$ make
$ sudo python setup.py install --user

libfte

Download the latest version of libfte, unpack the archive and run:

$ wget -O libfte.zip https://github.com/kpdyer/libfte/archive/master.zip
$ unzip libfte.zip
$ cd libfte-master

$ sudo python setup.py install --user

Building the Marionette Binary

First, make sure you have installed Go from https://golang.org/. Next, install dep using these instructions.

Finally, retrieve the source, update project dependencies, and install the marionette binary:

$ go get github.com/redjack/marionette
$ cd $GOPATH/src/github.com/redjack/marionette
$ dep ensure
$ go install ./cmd/marionette

The marionette binary is now installed in your $GOPATH/bin folder.

Installation (Docker)

You can also install marionette as a Docker image. You'll need to have Docker installed. You can find instructions for specific operating system here: https://docs.docker.com/install

The easiest way to setup marionette is to use the provided Dockerfile. First, build your docker image. Please note that this can take a while.

$ docker build -t redjack/marionette:latest .

Running using the Docker image

Next, run the Docker image and use the appropriate port mappings for the Marionette format you're using. For example, http_simple_blocking uses port 8081:

$ docker run -p 8081:8081 redjack/marionette server -format http_simple_blocking

$ docker run -p 8079:8079 redjack/marionette client -format http_simple_blocking

Using a fixed channel.bind() port

The ftp_simple_blocking uses randomized ports for the channel.bind() plugin. Unfortunately, docker does not support random port mappings so you can hardcode the port using the MARIONETTE_CHANNEL_BIND_PORT environment variable:

$ docker run -p 2121:2121 -e MARIONETTE_CHANNEL_BIND_PORT='6000' redjack/marionette server -format ftp_simple_blocking

$ docker run -p 8079:8079 redjack/marionette client -format ftp_simple_blocking

Demo

HTTP-over-FTP

In this example, we'll mask our HTTP traffic as FTP packets.

First, follow the installation instructions above on your client & server machines.

Start the server proxy on your server machine and forward traffic to a server such as google.com.

$ marionette server -format ftp_simple_blocking -proxy google.com:80
listening on [::]:2121, proxying to google.com:80

Start the client proxy on your client machine and connect to your server proxy. Replace $SERVER_IP with the IP address of your server.

$ marionette client -format ftp_simple_blocking -server $SERVER_IP
listening on 127.0.0.1:8079, connected to <SERVER_IP>

Finally, send a curl to 127.0.0.1:8079 and you should see a response from google.com:

$ curl 127.0.0.1:8079

Development

When adding new formats, you'll need to first install go-bindata:

$ go get -u github.com/jteeuwen/go-bindata/...

Then you can use go generate to convert the asset files to Go files:

$ go generate ./...

To install the original marionette library for comparing tests, download the latest version, unpack the archive and run:

Marionette

$ python setup.py install

Testing

Use the built-in go testing command to run the unit tests:

$ go test ./...

To run integration tests, specify the integration tag:

$ go test -tags integration ./...