Swego

Swego

Swiss army knife Webserver in Golang. Keep simple like the python SimpleHTTPServer but with many features

Usage

Run the binary

If you don't want to build it, binaries are availables on https://github.com/nodauf/Swego/releases

Otherwise, build-essential should be installed and GOPATH configured:

git clone https://github.com/nodauf/Swego.git
cd Swego/src
make compileLinux # Or make compileWindows

Usage

web subcommand:

…

run subcommand:

$ ./webserver web --help
Run an embedded binary

Usage:
  Swego run [flags]

Flags:
  -a, --args string     Arguments for the binary
  -b, --binary string   Binary to execute
  -l, --list            List embedded binaries

Global Flags:
      --config string   config file (default is $HOME/.Swego.yaml)
  -h, --help            Help message

Web server over HTTP

$ ./webserver
Sharing /tmp/ on 8080 ...
Sharing /tmp/private on 8080 ...

Web server over HTTPS

…

Web server using private directory and root directory

Private folder on same directory

$ ./webserver-linux-amd64 web --private ThePrivateFolder --username nodauf --password nodauf
Sharing /tmp/ on 8080 ...
Sharing /tmp/ThePrivateFolder on 8080 ...

Different path for root and private directory

$ ./webserver-linux-amd64 web --private /tmp/private --root /home/nodauf --username nodauf --password nodauf
Sharing /home/nodauf on 8080 ...
Sharing /tmp/private on 8080 ...

Embedded binary (only on Windows)

List the embedded binaries:

C:\Users\Nodauf>.\webserver.exe run  
Usage:
  Swego run [flags]

Flags:
  -a, --args string     Arguments for the binary
  -b, --binary string   Binary to execute
  -l, --list            List embedded binaries

Global Flags:
      --config string   config file (default is $HOME/.Swego.yaml)
  -h, --help            Help message

Run binary with arguments:

C:\Users\Nodauf>.\webserver.exe run --binary mimikatz.exe --args "privilege::debug sekurlsa::logonpasswords"
....

Running binary this way could help bypassing AV protections. Sometimes the arguments sent to the binary may be catch by the AV, if possible use the interactive CLI of the binary (like mimikatz) or recompile the binary to change the arguments name.

Features

• HTTPS (auto generate certificate / key if no certificate / key specified)
• Directory listing
• Define a private folder with basic authentication
• Upload multiple files
• Download file as an encrypted zip (password: infected)
• Download folder with a zip
• Embedded files
• Run embedded binary written in C# (only available on Windows)
• Create a folder from the browser
• Ability to execute embedded binary
• Feature for search and replace (for fill the IP address in reverse shell for example)
• Generate oneliners to download and execute a embedded file
• Config file examples .Swego.yaml
• Auto generate random certificate for TLS

Todo

• Webdav (with capture Net-NTLM hash)
• Log file
• JS/CSS menu to give command line in powershell, some lolbins, curl, wget to download and execute
• Use regex for search and replace
• Using virtual file system to manage embedded files