General information

Goauld is a post-exploitation and remote access tool built for engagements where regular remote-access tooling struggles: restricted corporate networks, authenticated egress proxies, and environments where only a narrow set of protocols is allowed to leave the network.

It is composed of three components:

• Server: the publicly reachable component. It exposes an SSH server both directly and through a range of tunneling transports (TLS, WebSocket, HTTP, DNS, and QUIC), and brokers access between operators and agents.
• Agent: deployed on the target machine. It embeds an SSH server along with SOCKS and HTTP proxies, and establishes outbound connections back to the server. In normal brokered deployments, no inbound access to the target is required; agent-binding mode is the exception because it deliberately exposes a listener on the target side.
• Client (tealc): the operator’s tool. It connects to the server to interact with agents: opening SSH sessions, forwarding proxies, transferring files, and compiling new agents.

Operational traffic between an agent and the server is carried by an outbound SSH connection, whichever transport encapsulates it. Registration, heartbeats, metadata, and control instructions use a separate Socket.IO control channel. In normal brokered deployments, both connections are initiated by the agent, keeping the target free from inbound listener requirements.

This section covers the fundamentals shared across all three components:

• Concepts and terminology: the vocabulary used throughout the documentation.
• Quick start: get a server, agent, and client running end to end.
• Compilation: build each component from source.
• Variables: how configuration values are sourced and prioritized.
• Configuration file: where each component looks for its config file.
• Architecture: a diagram of how the pieces fit together.
• Minimal HTTP(S)-only setup: run the deployment with only HTTP/HTTPS exposed.