Documentation

Goauld is a remote access and tunneling framework for authorized security assessments and other controlled environments where direct inbound access is not available.

The agent makes an outbound connection to the server. The operator uses tealc to discover agents and open SSH sessions, file transfers, proxies, and forwards through that connection.

Choose a path

The three components

• Server: the publicly reachable broker and operator API.
• Agent: the program running on the target machine. It initiates the outbound connection and exposes SSH-based services through it.
• Client (tealc): the operator tool for connecting to agents, managing them, and compiling agent binaries.

The architecture overview explains how these components communicate.

Capabilities

The main agent features are:

• Cross-platform (Windows, Linux and macOS)
• SSH encapsulation over multiple transports:
  • Direct SSH
  • TLS
  • QUIC
  • WebSocket
  • HTTP
  • DNS
• Support for egress proxies, with automatic NTLM/Kerberos authentication when required by the proxy itself
• Automatic NTLM/Kerberos application-level authentication when the targeted application requires it
• Exposes SOCKS and HTTP proxies, which can themselves route through an upstream HTTP proxy
• Full-blown interactive shell
• Copy files via integrated SCP, rsync, or rclone
• Tun interface using an integrated virtual WireGuard embedded in the agent
• Agent binding: the agent can open a local port for the client to connect to
• Agent relaying

Demo

Operational traffic such as shells, file transfers, proxies, and forwards is carried through an outbound SSH connection. A separate Socket.IO control channel carries registration, heartbeats, metadata, and control instructions. Both connections are initiated by the agent; neither requires inbound access to the target machine.