goshs is a single Go binary that consolidates HTTP/S, WebDAV, FTP/SFTP, SMB and LDAP services with hash capture and CTF team tooling for red teamers working inside authorized environments.
| Tool | goshs-labs/goshs — feature-rich single-binary file server written in Go |
| Category | file transfer / engagement infrastructure tooling |
| Primary Use | Serving files over HTTP/S, WebDAV, FTP/SFTP and SMB plus catching DNS/SMTP callbacks during authorized assessments and CTF events |
| Safe Use | Deployment in authorized penetration tests, lab environments, capture-the-flag events, and internal developer file-sharing workflows only |
| Telemetry Note | Every protocol listener (HTTP, DNS, SMB, LDAP, SMTP) is a visible network service; blue teams can fingerprint unusual listeners on engagement VLANs and correlate callback patterns |
There is a moment in nearly every engagement when you need a file server that does more than python3 -m http.server but less than a fully configured Apache. goshs, hosted at goshs-labs/goshs and written in Go, occupies exactly that niche. It packs HTTP/S, WebDAV, FTP/SFTP, SMB, LDAP/S, a DNS server, an SMTP server, basic and certificate authentication, share links, and even NTLM hash capture with optional cracking into a single static binary you can drop on any box. The project credits *sc0tfree*'s Python-based updog as its inspiration, but it has long since outgrown that lineage in both scope and polish.
The quick-start section of the README tells you a lot about the intended operator profile. Running bare goshs serves the current directory on port 8000, which is deliberately the same muscle memory as Python's SimpleHTTPServer. From there the flags escalate in capability: -s -ss -b user:password gives you a self-signed TLS server with basic auth, --ttl 2h arms a self-destruct timer, and --tui launches an interactive terminal dashboard that the README explicitly recommends for headless SSH sessions. The design goal is obvious — one binary, zero config files, every protocol an operator might need mid-engagement.
Architecturally, the most interesting choice is the web front end. Screenshots show a full browser UI with drag-and-drop upload, dark and light themes, QR codes, bulk ZIP downloads, and a live team chat with markdown, emoji shortcodes, image paste, message editing, and reactions. That chat — optionally persisted to disk and shared between the web UI and the TUI — reveals the tool's second audience: CTF teams. goshs is not just a file exfiltration endpoint; it is positioned as engagement infrastructure where multiple operators coordinate through the same server instance.
The protocol coverage is unusually broad for a single binary. On the transfer side you get HTTP/S with resumable, seekable downloads via HTTP Range headers, upload via both POST and PUT, WebDAV, and FTP/SFTP. On the capture side, SMB and LDAP/S listeners can harvest NTLM hashes and credentials from unauthenticated authentication attempts, with an optional -ldap-wordlist flag feeding a local cracking routine against a supplied wordlist. The LDAP module also includes a JNDI mode explicitly referencing Log4Shell-era callback techniques — a capability that only makes sense in a lab or a scoped, authorized engagement where you control both ends.
Beyond capture, goshs functions as a callback sink. The -dns -dns-ip and -smtp -smtp-domain flags stand up DNS and SMTP receivers for out-of-band interactions, complemented by a redirect endpoint and a reverse shell catcher with an integrated payload generator. The TUI dashboard ties all of this together with live panes for HTTP, DNS, SMB, LDAP, SMTP, reverse shells, and team chat, including the ability to attach to and upgrade caught shells directly from the terminal. For operators who live in tmux over SSH, that consolidation removes the need to run five separate tools in five panes.
One of the more thoughtful features is payload templating. With --template and --tpl-var, served files can contain {{.LHOST}} and {{.LPORT}} placeholders plus arbitrary custom variables, rendered at download time when the client appends ?tpl to the request. This solves a real operational annoyance: instead of regenerating payload files every time your callback IP changes, you template once and let the server interpolate per-request. It is the kind of quality-of-life detail that distinguishes a tool built by active practitioners from a weekend project.
Access control is layered for a tool in this category. Basic auth, certificate-based client authentication, IP whitelisting, and file-based ACLs are all supported, and TLS can come from self-signed generation, Let's Encrypt, or custom certificates. Server modes include read-only, upload-only, no-delete, silent, and invisible variants — the latter two presumably reducing the server's visibility or response behavior for scenarios where discretion matters within the engagement scope. A --ttl self-destruct mode bounds the lifetime of the infrastructure, which is good hygiene for anyone leaving listeners running on cloud VMs.
The engineering posture is worth noting because it is unusually strong for offensive tooling. The README badges show goreleaser CI workflows, codecov coverage tracking, an OpenSSF Scorecard, and OpenSSF Best Practices participation. There is a dedicated security contributors section listing researchers who have reported issues, signaling that the maintainers actively solicit and credit vulnerability reports. For a binary that frequently handles attacker-controlled or at least untrusted input across six protocols, that maturity is not cosmetic — it materially reduces the chance your own engagement box becomes the incident.
Distribution is where goshs arguably leads every peer. It is packaged natively in Kali and Parrot via sudo apt install goshs, plus AUR, BlackArch, Alpine edge, snap, Fedora COPR, openSUSE, Nix, Homebrew, Scoop, winget, Chocolatey, and Docker with goshs-labs/goshs:latest. A curl -sSfL https://goshs.de/install.sh | sh one-liner and go install goshs.de/goshs/v2@latest round it out. Shell completion for bash, fish, and zsh is built in via --completion, and the web assets are committed to the repository so a plain git clone followed by go build -o goshs . produces a working binary without a JavaScript toolchain — only asset changes require esbuild and sass via make generate.
From a defensive perspective, goshs is trivially observable if you are looking. Every enabled module is a network listener, and its DNS, SMTP, SMB, and LDAP capture behaviors generate the same signatures defenders already hunt: unsolicited authentication attempts against decoy services, odd zone-transfer-like DNS query patterns, and NTLM challenge traffic to non-domain hosts. The webhook and localhost.run tunnel integration means egress can be tunneled through a third-party relay, which is worth remembering when tracing engagement infrastructure. Its telemetry note cuts both ways: the same visibility that makes it useful for authorized operators makes it a clean detection canary for blue teams monitoring lab ranges.
With roughly 984 stars, an MIT license, and a topic list spanning red-teaming, penetration-testing, ctf, and devtools, goshs has clearly found its community. The public demo at demo.goshs.de and full documentation at docs.goshs.de lower the barrier to evaluation considerably. For authorized professionals who keep repeating the same python -m http.server plus smbserver.py plus responder dance on every engagement, consolidating that stack into one auditable, well-packaged binary is a defensible architectural improvement — provided it is only ever pointed at systems you are explicitly permitted to test.
goshs-labs/goshs.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.