Documentation on Goauld

Client authentication

Mon, 01 Jan 0001 00:00:00 +0000

User authentication

To interact with the server, users need an access token.

The access token can be provided through all means discussed here: general/variables

Flag

--access-token

access-token: XXXXX

Agent authentication

All interaction with the agents (including SSH, SCP/Rsync, Kill/Reset/Delete commands , Clipboard operations, etc.) requires the agent password. (see agent/password management)

Admin authentication

See server/access control

The --admin-token restricts access to administrative endpoints (/admin/).

Flag

--admin-token

admin-token: XXXXX

Agent binaries authentication

See server/agent downloading

Listening services

Mon, 01 Jan 0001 00:00:00 +0000

To allow agents to tunnel SSH connection over different transports, the server must expose the corresponding service, then decapsulate the traffic and forward it to the SSHD server.

Note

For all listeners, the listen address flag has the following format: [IP]:[PORT]

If no IP address is provided, the service will listen on all interfaces. However, the : is still required before the port

SSH

No encapsulation, directly exposed.

Quick start

Mon, 01 Jan 0001 00:00:00 +0000

This setup involves three components running on separate machines:

Server: publicly reachable machine
Client (tealc): operator machine
Agent: target machine

Prebuilt client and server binaries are available at https://github.com/Hazegard/Goauld/releases.

See general/compilation to compile the components.

Generate secrets

Install age, then run:

$ age-keygen
# created: 2026-03-27T21:44:18+01:00
# public key: age1krjxdnhmf2kqm8rdhyf6sr5nfvlwdcslux3fxt8amcrncwn3ss9sydlvd0
AGE-SECRET-KEY-1NJ4DRPNKNGEVFK50JHUD6RKZ3NJ3Q9S5KYMTARTLXU0P0KQU8AAQNE4C2F

The private key (AGE-SECRET-KEY-*) is used by the server, and the public key is embedded in agents.

Generate access token (and admin token)

openssl rand -base64 42

At this point, you should have:

Tunneling

Mon, 01 Jan 0001 00:00:00 +0000

The Goauld agent supports multiple transport mechanisms to communicate with the server. If a transport fails, the agent automatically falls back to the next available method.

The agent attempts to connect to the server using several transports:

Direct SSH connection
SSH over QUIC
SSH over TLS
SSH over WebSocket
SSH over HTTP
SSH over DNS

For each transport protocol, the agent tries establish a connection to the server, with a 60 seconds timeout (configurable using --ssh-timeout flag). If the connection is established, the agent finalizes the connection.

Compilation

Mon, 01 Jan 0001 00:00:00 +0000

Some components require specific Go build tags:

client: -tags client
mini_agent: -tags mini

The project can also be built using GoReleaser.

Optional build dependencies

garble for binary obfuscation (https://github.com/burrowers/garble)
upx for binary compression https://github.com/upx/upx
goreleaser for automated builds https://github.com/goreleaser/goreleaser

Agent

Direct compilation

go build -o tealc ./agent

Using the wrapper script

go run ./scripts/build/ --id agent --goos windows --goarch amd64 --no-seed --gen-age-key=false --gen-access-token=false

Using the client CLI

tealc compile --id agent --goarch amd64 --goos windows

Note

Compiling with the CLI is recommended as it allows passing compile-time variables to the agent (see [How to feed variables])

Deployment

Mon, 01 Jan 0001 00:00:00 +0000

Warning

Goauld is currently not designed to run behind a reverse proxy. In particular, the whitelisting feature will not work behind a reverse proxy.

Docker compose example

services:
 goauld_server:
 build:
 context: .
 args:
 - COMPRESS=1
 # platform: linux/amd64
 container_name: server
 image: goauld_server
 ports:
 - "X.X.X.X:53:53/tcp"
 - "X.X.X.X:53:53/udp"
 - "X.X.X.X:80:80"
 - "X.X.X.X:443:443"
 - "X.X.X.X:22222:22222"
 volumes:
 - ./certmagic:/root/.local/share/certmagic
 - ./Goauld.db:/app/Goauld.db
 - ./server_config.yaml:/app/server_config.yaml
 - ./binaries:/app/binaries

configuration file example

#Age private key used by the server.
age-privkey: ""

# Domains used to serve HTTP and WebSocket traffic.
http-domain:
- www.example.com

# Domains used to serve raw TLS traffic (SSH over TLS).
tls-domain:
- app.example.com

# Domain used to serve DNS-based traffic (SSH over DNS).
dns-domain: t.example.com

# Domain used to serve DNS-based traffic (SSH over DNS-ALT).
dns-domain-alt: s.example.com

# Address and port to bind for HTTP connections (port 0 = random).
http-listen-addr: :80

# Address and port to bind for HTTPS connections (port 0 = random).
https-listen-addr: :443

# Address and port to bind for SSH connections (port 0 = random).
ssh-listen-addr: :2222

# Address and port to bind for DNS connections (port 0 = random).
dns-listen-addr: :53

# Address and port to bind for QUIC connections (port 0 = random).
quic-listen-addr: :443

# Enable TLS support.
tls: true

# Path to the TLS private key file.
tls-key: ""

# Path to the TLS certificate file.
tls-cert: ""

# Email used when generating Let's Encrypt certificates.
letsencrypt-mail: mail@example.com

# Enable QUIC protocol support.
quic: true

# Enable DNS server for SSH-over-DNS connections.
dns: true

# Disable database usage.
db: false

# Path or filename of the database to use.
db-file-name: Goauld.db

# List of IP addresses allowed to access the /manage/ endpoint.
allowed-ips:
- 127.0.0.1
- 0.0.0.0/32

# Access token required for the /manage/ API endpoint.
access-token:
- TODO_TOKEN

# Admin token required for the /admin/ API endpoint.
admin-token:
- TODO_TOKEN

# HTTP Basic Auth credentials required to access the binaries endpoint.
binaries-basic-auth: username:password

# Filesystem path where agent binaries are stored.
binaries-path-location: ./binaries

DNS configuration

Three DNS records are required:

Exposed proxies

Mon, 01 Jan 0001 00:00:00 +0000

The agent exposes three proxies that allow interaction with the host’s network:

An HTTP proxy
An HTTP proxy that performs NTLM/Kerberos application-level authentication
A SOCKS proxy

Note

Given that performing NTLM/Kerberos application-level authentication requires to intercept the traffic (MITM) to inject appropriate headers, this feature has been implemented in a dedicated proxy.

HTTP proxy

For each incoming request, the HTTP proxy determines whether an upstream proxy should be used and which one.

Tui

Mon, 01 Jan 0001 00:00:00 +0000

The client provides a text-based user interface (TUI) to monitor and manage connected agents.

TUI keybinds

Key	Action
`[ctrl+r]`	Reset the agent
`[ctrl+k]`	Stop the agent
`[ctrl+d]`	Stop the agent and attempt to delete the binary
`[Enter]`	Start an SSH session
`[ctrl+e]`	Launch VSCode
`[+]`	Toggle agent details

The kill, reset and delete actions are also available as standalone commands:

tealc (kill|reset|delete) [AGENT_NAME]

Extended TUI

Some information is hidden by default. Press + to toggle the details.

Access Control

Mon, 01 Jan 0001 00:00:00 +0000

Certain components should be accessible only by authorized users.

Admin endpoints
Management endpoints
SSH access from the client

IP allowlisting

The server accepts a list of authorized IPs to restrict the access of

The /admin/ endpoints
The /manage/ endpoints
SSH access from the client (using password authentication)

Warning

IF the server runs in a docker environment, the deployment should ensure that the remote IP address is correctly forwarded to the server

Relay

Mon, 01 Jan 0001 00:00:00 +0000

If an agent A cannot reach the Goauld server, but can reach anothe agent B that can reach the server, then agent B can be configured to run as a relay.

Configure an agent as a relay

--relay: Enable relay mode on the agent

Note

The agent listens on all interfaces using a randomly assigned port. This port is logged in the agent logs:

INF agent/agent.go:468 > Relay listening on port Port=57129

Or in the TUI (Press + to view details about the agent)

ssh

Mon, 01 Jan 0001 00:00:00 +0000

Connect to an agent

This command is a wrapper around SSH that automatically connects to an agent through the server.

Example of the underlying SSH command

env SSH_ASKPASS_REQUIRE=force \
SSH_ASKPASS=/usr/local/bin/tealc \
TEALC_TYPE=agent \
TEALC_SERVER=http://localhost \
TEALC_SSH_SERVER=localhost:2222 \
TEALC_ACCESS_TOKEN=[ACCESS_TOKEN] \
TEALC_AGENT=user@hostname1 \
TEALC_PROMPT_STATIC_PASSWORD=true \
ssh -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null \
-oPubkeyAuthentication=no -oPreferredAuthentications=password 
-oLogLevel=ERROR -oExitOnForwardFailure=no \
-oNumberOfPasswordPrompts=1 \
-oProxyCommand='env SSH_ASKPASS_REQUIRE=force \
SSH_ASKPASS=/usr/local/bin/tealc \
TEALC_TYPE=otp \
TEALC_SERVER=http://localhost \
TEALC_SSH_SERVER=localhost:2222 \
TEALC_ACCESS_TOKEN=[ACCESS_TOKEN] \
TEALC_AGENT=user@hostname1 \
TEALC_PROMPT_STATIC_PASSWORD=true \
ssh -oClearAllForwardings=no -oStrictHostKeyChecking=no \
-oUserKnownHostsFile=/dev/null -oPubkeyAuthentication=no \
-oPreferredAuthentications=password -oLogLevel=ERROR \
-oExitOnForwardFailure=no -oNumberOfPasswordPrompts=1 \
-p2222 -W127.0.0.1:49521 -L3128:127.0.0.1:54079 \
-L1080:127.0.0.1:49524 user@hostname1@localhost' \
user@hostname1@39fce32832f3375a409d99a13a4f0c77

tealc ssh [AGENT_NAME]

You can also pass flags to the underlying SSH command:

Variables

Mon, 01 Jan 0001 00:00:00 +0000

Passing variables to components (agent, client & server)

Components can retrieve configuration parameters from several sources. The following order defines the precedence (from highest to lowest):

Command-line argument (--var=1)
Configuration file passed through command line (--config)
Environment variable (e.g. VAR=1)
Default configuration file (see general/configuration file)
Compile-time defined value (-ldflags, or compiling with tealc compile --env: general/compilation)
Hardcoded default value

Configuration file

Mon, 01 Jan 0001 00:00:00 +0000

The server, agent, and client share the same behavior when loading configuration files.

Each component looks for a configuration file in the $HOME/.config directory, then in the current directory.

The configuration filenames for each component are:

Server	Agent	Client
`goauld_server.yaml`	`goauld_agent.yaml` / `goauld.yaml`	`tealc.yaml`

Healthcheck

Mon, 01 Jan 0001 00:00:00 +0000

To ensure tunnels are functioning correctly, some healthcheck scripts/tools are provided.

Warning

The provided healthchecks only verify that the SSHD server is reachable through the tunnel by checking the SSHD banner.

SSH over TLS

echo "00000000000000000000000000000000\n" | timeout 1 openssl s_client -quiet -connect $TLS_DOMAIN$:$TLS_PORT$ 2>/dev/null | grep -q "SSH-2.0-"

SSH over WebSocket

Building

go build -o ws-healthcheck ./healthcheck/websocket

Running

{ echo "" ; sleep 1; } | ws-healthcheck "wss://$WS_DOMAIN/wssh/00000000000000000000000000000000" 2>/dev/null

SSH over DNS

Building

go build -o dns-healthcheck ./healthcheck/dns/dnstt-client

Running

{ echo "00000000000000000000000000000000S" ; sleep 1; } | dns-healthcheck -udp "$DNS_SERVER:$DNS_SERVER_PORT" "$DNS_DOMAIN" 2>/dev/null | grep -q "SSH-2.0-"

Note

The “S” is required at the end of the echo

Proxies

Mon, 01 Jan 0001 00:00:00 +0000

The client exposes the agent’s proxies locally on the host machine.

Proxy SOCKS

Exposed by default on the port 1080.

See agent/proxies#socks-proxy for details about the SOCKS proxy.

Proxy HTTP

Exposed by default on the port 3128.

See agent/proxies#socks-proxy for details about the HTTP proxy.

Proxy HTTP with NTLM/Kerberos application-level authentication

Exposed by default on the port 3129.

See agent/proxies#http-proxy-with-ntlmkerberos-authentication for details about the HTTP MITM proxy.

WireGuard

Mon, 01 Jan 0001 00:00:00 +0000

The agent exposes a virtual WireGuard interface, allowing TCP, UDP, and ICMP (ping) traffic without relying on a SOCKS proxy.

The virtual WireGuard interface uses the gVisor network stack (https://github.com/google/gvisor/tree/go).

The implementation works as follows:

The agent exposes a WireGuard server port on the host.
The agent forwards the WireGuard port to the server using UDP-over-TCP encapsulation to traverse the existing agent tunnel.
The client forwards the WireGuard port exposed on the server to the local machine.
The client decapsulates the UDP-over-TCP traffic to expose the WireGuard port.
The WireGuard client on the operator machine connects to the agent’s virtual WireGuard interface.

Note

This implementation uses TCP-over-TCP encapsulation, which reduces performance. However, this architecture was chosen because the server does not expose a WireGuard server common to all connected agents, which could result in unauthorized access between agents.

Agent Drop

Mon, 01 Jan 0001 00:00:00 +0000

In order to drop precompiled agents, a basicauth protected dirlisting is available through https://[SERVER]/binaries/.

To access this dirlisting, a custom password should be configured.

# HTTP Basic Auth credentials required to access the binaries endpoint.
binaries-basic-auth: user:password

Architecture

Mon, 01 Jan 0001 00:00:00 +0000

Password Management

Mon, 01 Jan 0001 00:00:00 +0000

For historical reasons, the agent password consists of two parts:

Part 1: Generated by the agent at each start and sent to the server through the control socket.
Part 2: It is stored only locally on the agent.

The second part can be generated through different methods:

1. At compile-time

When compiling an agent through the client (see client/compilation), the generated password is displayed either in the standard output during compilation or in the .env file that contains all the variables set for the agent.

SCP

Mon, 01 Jan 0001 00:00:00 +0000

Important

For windows paths, / must be used instead of \:

tealc scp [AGENT_NAME]:C:/PATH/TO/FOLDER .

SCP

Note

The -r flag is included by default.

Transfer files from the client to the agent

tealc scp /PATH/TO/SOURCE/FILE [AGENT_NAME]:/PATH/TO/TARGET/FILE

Transfer files from the agent to the client

tealc scp [AGENT_NAME]:/PATH/TO/TARGET/FILE /PATH/TO/SOURCE/FILE

RSYNC

tealc rsync -arvP [AGENT_NAME]:C:/Path1 [AGENT_NAME]:C:/Windows/PATH2 .

Warning

On Windows agents, you can only copy from or to one drive per command. you can copy multiple directories from the same drive, but cannot copy from C: and D: in the same command.

Database

Mon, 01 Jan 0001 00:00:00 +0000

The server uses an SQLite database to store information regarding previously connected agents.

Given that agents perform a full connection flow at each start, the data stored in the database isn’t required.

Flag:

--no-db Disable the database on disk.
--db-file-name Path or filename of the SQLite file .

Jump

Mon, 01 Jan 0001 00:00:00 +0000

In some assessments, the agent is deployed on a bounce (jump) machine, from which we can access another machine, from which the assessment is performed.

In order to simplify the access to the assessment machine, a wrapper has been implemented in the client:

tealc jump --print [AGENT_NAME] [REMOTE_SERVER] (-i ./id_ed25519)

Note

Although this command is simply :

ssh -oProxyCommand="tealc ssh [AGENT_NAME] -W %h:%p [REMOTE_SERVER]" (-i ./id_ed25519)

Although it simply wraps the underlying SSH ProxyCommand, it provides convenience for repeated jump connections.

Killswitch

Mon, 01 Jan 0001 00:00:00 +0000

To ensure that no agent runs indefinitely, a killswitch has been implemented. After a specified number of days, the agent automatically shuts down.

Flag

--kill-switch: Set the number of days before exiting

Note

The timer counts from the agent’s execution time. Consequently, if an external system (scheduled task, cron job, etc.) restarts the agent, the killswitch timer resets.

Clipboard

Mon, 01 Jan 0001 00:00:00 +0000

Access to the agent clipboard has been implemented to quickly share small text between the client and the agent.

Retrieve the agent clipboard

The content will be printed to STDOUT

tealc clip get [AGENT]

Set the agent clipboard

tealc clip set [AGENT] [CONTENT]

Warning

This feature is recommended for small content only. For larger content, use SCP or Rsync instead. (see client/scp)

Connection flow

Mon, 01 Jan 0001 00:00:00 +0000

The agent separates orchestration (control) from operational traffic (data):

Control socket: A Socket.IO component, which is used to transmit agent metadata and receive control instructions from the server (reset/kill, etc.)
Data socket: An SSH channel, which may be encapsulated depending on egress filtering restrictions, which is used to tunnel operational traffic (proxies, SSH access, pivoting services, etc.)

If a connection is lost, the agent automatically attempts to reconnect to both channels using an exponential backoff strategy.

Shell logging

Mon, 01 Jan 0001 00:00:00 +0000

The client allows logging of SSH sessions to keep a record of commands executed and their outputs.

Log files are saved in the current directory with the following format: [AGENT_NAME]-[CURRENT_DATE].

[TODO]: exemple du log

Flag

--log

Working days

Mon, 01 Jan 0001 00:00:00 +0000

During assessments, it may be necessary to keep an agent running for several days (it can be difficult to execute).

To reduce the agent’s network footprint, a mechanism allows it to pause all network activity at a specified time and automatically resume later at a specified hour.

If the agent starts outside the working period, it will wait until the next start hour.

Flags

--only-working-days: to enable the working days feature
--working-day-start : the given hour when the agent resumes network connection (format: [HOURS]:[MINUTES], 24-hour format)
--working-day-end: the given hour when the agent stops all network connection (format: [HOURS]:[MINUTES], 24-hour format)
--working-day-timezone: the timezone to use

Audit Mode

Mon, 01 Jan 0001 00:00:00 +0000

Audit Mode

This option enable redaction of sensitive information displayed on the TUI, providing privacy during demonstrations or shared sessions.

Flag

--audit-mode

Control Master

Mon, 01 Jan 0001 00:00:00 +0000

SSH ControlMaster

Note

This feature is not supported on Windows.

The client can leverage SSH ControlMaster mode to share multiple SSH sessions over a single network connection.

This improves connection speed and avoids repeating the authentication process for each session.

Wireguard

Mon, 01 Jan 0001 00:00:00 +0000

See agent/wireguard A TUN interface is available to the client.

The TUN interface is a WireGuard VPN that allows TCP, UDP, and ICMP (ping only) traffic from the agent without relying on a SOCKS proxy.

Note

The special range 240.0.0.0/8 is translated into 127.0.0.0/8 on the agent, enabling access to the loopback range.

How to use

Generate the WireGuard configuration and add it to the configuration file:

tealc wireguard generate

The content looks like:

Compile agent

Mon, 01 Jan 0001 00:00:00 +0000

The client can recompile agents for different platforms and architectures.

tealc compile (--id [ID]) (-O [OS]) (-A [ARCH])

The ARCH flag can be:

amd64
arm64
arm
386

The OS flag can be:

darwin
linux
windows

Compile the agent with custom default values

Generate the configuration file:

tealc compile --drop-env > ./env.txt

This configuration file can then be modified to set custom defaults before recompilation.

tealc compile --env [/PATH/TO/ENV]

Admin features

Mon, 01 Jan 0001 00:00:00 +0000

Dump the current configuration

$ tealc admin config

#Age private key used by the server.
age-privkey: "[REDACTED]"

# Domains used to serve HTTP and WebSocket traffic.
http-domain:
- 0.0.0.0

# Domains used to serve raw TLS traffic (SSH over TLS).
tls-domain:
- localhost

# Domain used to serve DNS-based traffic (SSH over DNS).
dns-domain: t.example.com

# Domain used to serve DNS-based traffic (SSH over DNS-ALT).
dns-domain-alt: s.example.com

# Address and port to bind for HTTP connections (port 0 = random).
http-listen-addr: 0.0.0.0:80

# Address and port to bind for HTTPS connections (port 0 = random).
https-listen-addr: 0.0.0.0:443

# Address and port to bind for SSH connections (port 0 = random).
ssh-listen-addr: 0.0.0.0:2222

# Address and port to bind for DNS connections (port 0 = random).
dns-listen-addr: 0.0.0.0:53

# Address and port to bind for QUIC connections (port 0 = random).
quic-listen-addr: 0.0.0.0:443

# Enable TLS support.
tls: true

# Path to the TLS private key file.
tls-key: ./local_config/cert/local.key

# Path to the TLS certificate file.
tls-cert: ./local_config/cert/local.pem

# Email used when generating Let's Encrypt certificates.
letsencrypt-mail: mail@example.com

# Enable QUIC protocol support.
quic: true

# Enable DNS server for SSH-over-DNS connections.
dns: true

# Disable database usage.
db: false

# Path or filename of the database to use.
db-file-name: Goauld.db

# List of IP addresses allowed to access the /manage/ endpoint.
allowed-ips: []

# Access token required for the /manage/ API endpoint.
access-token:
- "[REDACTED]"

# Admin token required for the /admin/ API endpoint.
admin-token:
- "[REDACTED]"

# HTTP Basic Auth credentials required to access the binaries endpoint.
binaries-basic-auth: "[REDACTED]"

# Filesystem path where agent binaries are stored.
binaries-path-location: ./binaries

# Increase log verbosity. Repeat for more detail.
verbose: 3

# Suppress all log output.
quiet: false

# Show version information and exit.
version: false

# Generate a configuration file from the current settings.
generate-config: false

# Path to the configuration file to use.
config-file: ./local_config/server.yaml

Dump the connected agent information

$ tealc admin dump

- id: 1ec1bd83de498e7da8852efe6d8c16c5
 name: user@Archamd2
 SSHMode: WS
 usedPorts: "0"
 lastUpdated: 2026-03-09T17:31:43.426417+01:00
 lastPing: 2026-03-09T17:32:22.788485+01:00
 platform: darwin
 architecture: arm64
 username: user
 hostname: Archamd2
 IPs: 172.16.22.101/24,192.168.29.1/24,172.16.40.1/24,192.168.139.3/23,fd07:b51a:cc66:0:a617:db5e:ab7:e9f1/64,10.10.20.19/24
 path: /Users/user/Library/Caches/go-build/c0/c0ece0fea100ea19cf4edec893a6caafb9f6b1f91c6f47ef3a1bab62d0455bbe-d/agent
 remoteAddr: 127.0.0.1
 TLSSH:
 agentId: 1ec1bd83de498e7da8852efe6d8c16c5
 QUIC:
 agentId: 1ec1bd83de498e7da8852efe6d8c16c5
 WSSH:
 agentId: 1ec1bd83de498e7da8852efe6d8c16c5
 sshConn:
 localAddr: 127.0.0.1:56748
 remoteAddr: 127.0.0.1:2222
 wsConn:
 localAddr: 127.0.0.1:80
 remoteAddr: 127.0.0.1:56747
 SSHTTP:
 agentId: 1ec1bd83de498e7da8852efe6d8c16c5
 socketIO:
 agentId: 1ec1bd83de498e7da8852efe6d8c16c5
 socketId: ltHwpaxDrVu0beeBAAAB
 connected: true
 ssh:
 agentId: 1ec1bd83de498e7da8852efe6d8c16c5
 SSHConnection:
 - agentId: 1ec1bd83de498e7da8852efe6d8c16c5
 sshConn:
 localAddr: 127.0.0.1:2222
 remoteAddr: 127.0.0.1:56748
 clientVersion: SSH-2.0-Goauld-dev
 sessionID: d7421e2ee9f35a1a6bf4e6908b0e7d19426565f85efc76d8458f5d2d39b55f33
 serverVersion: SSH-2.0-OpenSSH_8.7
 - agentId: 1ec1bd83de498e7da8852efe6d8c16c5
 sshConn:
 localAddr: 127.0.0.1:2222
 remoteAddr: 127.0.0.1:56748
 clientVersion: SSH-2.0-Goauld-dev
 sessionID: d7421e2ee9f35a1a6bf4e6908b0e7d19426565f85efc76d8458f5d2d39b55f33
 serverVersion: SSH-2.0-OpenSSH_8.7
 - agentId: 1ec1bd83de498e7da8852efe6d8c16c5
 sshConn:
 localAddr: 127.0.0.1:2222
 remoteAddr: 127.0.0.1:56748
 clientVersion: SSH-2.0-Goauld-dev
 sessionID: d7421e2ee9f35a1a6bf4e6908b0e7d19426565f85efc76d8458f5d2d39b55f33
 serverVersion: SSH-2.0-OpenSSH_8.7
 SSHListeners:
 - 127.0.0.1:56749
 - 127.0.0.1:56751
 - 127.0.0.1:56752
 dns:
 agentId: 1ec1bd83de498e7da8852efe6d8c16c5
 cdn: {}

Password

Mon, 01 Jan 0001 00:00:00 +0000

Note

This command is mostly an internal one. But it is still documented in case on manual connection to the agents through the server

Embed server

Mon, 01 Jan 0001 00:00:00 +0000

The client can enter in server mode allowing to reproduce the nc -lvp command.

tealc embed-server

Note

The deployed agent must embed or be passed an appropriate Age public key

Note

The agent automatically kills itself after the shell session ends

Demo

Your browser does not support the video tag.

Agent binding

Mon, 01 Jan 0001 00:00:00 +0000

When the agent is in bind mode, it exposes a port on which the client connects to. (see agent/tunnels)

Flags

--kill whether to kill the agent on disconnection
[AGENT_ADDR]: the agent to bind to, format: [IP]:[PORT]

Mon, 01 Jan 0001 00:00:00 +0000