gsocket is a C toolkit that lets two peers behind NAT or firewalls establish end-to-end encrypted TCP connections through the Global Socket Relay Network, intended for authorized administration and lab use.
| Tool | hackerschoice/gsocket — Global Socket Toolkit for secure TCP connections between NAT/firewalled hosts |
| Category | Network connectivity / encrypted tunneling toolkit written in C |
| Primary Use | Connecting two workstations you control across NAT and firewalls for shells, file transfer (blitz, gs-sftp), mounting (gs-mount) and forwarding existing services like sshd |
| Safe Use | Authorized system administration, penetration labs, and assessments where you own or have written permission for both endpoints; never deploy against third-party systems |
| Telemetry Note | All sessions traverse the public Global Socket Relay Network (GSRN) over TLS with OpenSSL SRP; defenders can flag outbound connections to GSRN relay hosts and the presence of gs-netcat/gsocket processes, including instances renamed via exec -a argv tricks documented in the README |
hackerschoice/gsocket — the Global Socket Toolkit — attacks one of the oldest practical problems in networking: two machines that both sit behind NAT or restrictive firewalls and cannot reach each other directly. Rather than punching holes with port forwarding, the project replaces the mental model of IP addresses and port numbers with a shared secret. Two programs that know the same secret can find each other through the Global Socket Relay Network (GSRN), a free cloud relay service, and then negotiate an end-to-end encrypted TLS session that the relay itself cannot read. It is written in C, licensed under BSD-2-Clause, and sits at roughly 1961 stars, with firewall, networking, and security among its GitHub topics.
The architecture is worth understanding because it drives every design decision in the toolkit. Each side locally derives temporary session keys and identifiers from the shared secret; the secret itself never leaves the workstation. The GSRN brokers the initial rendezvous and then relays ciphertext between the two peers, seeing only encrypted traffic. Encryption is end-to-end using OpenSSL's SRP implementation per RFC 5054, with AES-256 and key exchange over a 4096-bit prime. Notably, the scheme requires no PKI at all — no certificates, no certificate authorities — because authentication rests entirely on knowledge of the secret, and it provides perfect forward secrecy so a leaked secret does not decrypt past sessions.
The flagship tool is gsocket itself, which takes an existing TCP program and makes it reachable from anywhere in the world regardless of the host's network position. The README describes it as analyzing the target program and swapping the IP layer for a Gsocket layer, so that a client connection to a hostname ending in *.gsocket is transparently redirected via the GSRN to that program. The example directory shows this applied to real infrastructure: sshd, WireGuard, an IRCD via port forwarding, and OpenVPN between two firewalled machines. This is the killer feature for authorized administrators — you do not rewrite your services, you simply wrap them.
Alongside the wrapper, gs-netcat is described frankly as "netcat on steroids." It supports a true PTY interactive shell, integrated file transfer, a Socks4/4a/5 proxy mode, TCP forwarding, and daemonized operation with a watchdog that respawns the process if killed. The README is also explicit that it can function as an encrypted reverse backdoor with optional TOR support — language that should alert any blue team reading this analysis, and a reminder that the same capability set serves both legitimate remote administration and post-exploitation tradecraft. The -T flag routes traffic through TOR, and GSOCKET_SOCKS_IP/GSOCKET_SOCKS_PORT environment variables force that behavior process-wide.
The supporting tools round out a coherent workflow. gs-sftp provides an SFTP server and client between two firewalled workstations with a single shared-secret argument. gs-mount mounts a remote filesystem locally, turning a firewalled box into a network drive. blitz is the bulk data mover — the README's animated demo describes "blitzing files through firewalls" — and gs-full-pipe handles quick peer-to-peer piping including a simple secure chat between two people sharing a secret. For heavier proxying scenarios, the README shows composition with Gost multiplexing many streams over a single gs-netcat TCP connection, which is a genuinely elegant pattern for constrained egress paths in authorized lab environments.
Installation is deliberately low-friction: static pre-compiled binaries exist for AMD64, ARM64, MIPS and other architectures, alongside .deb packages, source tarballs for Linux/macOS/FreeBSD/OpenBSD/Solaris, and Docker images (docker run --rm -it hackerschoice/gsocket, plus a gsocket-tor variant). Windows support is limited to gs-netcat via Cygwin or Docker. A representative invocation from the README: gs-netcat -l -i on one workstation and gs-netcat -i on the other establishes an interactive shell between two peers you control.
Operational hygiene matters here, and the README's own Pro-Tips section is the best documentation of it. Passing secrets via -s on the command line exposes them in the process list, so the project recommends storing the secret in a file with -k, or supplying flags through the GSOCKET_ARGS environment variable. A built-in generator (gs-netcat -g) produces high-entropy secrets. Because rendezvous depends entirely on the secret's entropy, weak secrets are the realistic failure mode — guessing the secret is the only way for a third party to intercept the handshake, given the absence of PKI.
Defenders should read the Pro-Tips with equal attention. The README demonstrates hiding the binary from ps output by renaming the process via exec -a -bash, and the -D watchdog flag auto-respawns gs-netcat if it is killed. These are persistence-and-evasion-adjacent techniques documented in the tool's own manual, which makes gsocket a legitimate subject for detection engineering: inventory GSRN relay endpoints in your egress logs, monitor for the telltale process argument patterns, and treat unexplained long-lived outbound TLS sessions to the relay network as triage-worthy.
From an authorized-assessment perspective, the strongest use case is infrastructure you already own but cannot reach: a lab machine behind carrier-grade NAT, a home server with no port forwarding, a colleague's workstation on a locked-down network for a sanctioned exercise. The examples/sshd and examples/wireguard directories show the intended pattern — wrap a standard, authenticated service rather than exposing raw shells, so the underlying protocol's own security still applies on top of the tunnel.
The trade-offs are real. You are trusting a free, public relay network for availability even though it cannot read your traffic; the GSRN sees metadata — timing, volume, and the fact that two peers share a session. TOR support mitigates observer correlation but at the usual latency cost. And because the project is maintained by thc/The Hacker's Choice with a long history of offensive tooling, some enterprise EDR vendors may flag the binaries outright, which is worth testing before you rely on it in a client environment.
What gsocket ultimately delivers is a clean abstraction: connectivity bound to knowledge rather than topology. For authorized professionals it removes an entire class of networking friction — no port forwarding, no VPN concentrator, no cloud jump host — while keeping the crypto honest with SRP, AES-256, forward secrecy, and optional anonymity. Handled with strong secrets and used strictly on systems you are permitted to operate, it is one of the more thoughtfully engineered tools in the NAT-traversal niche; pointed at systems you do not own, the same properties make it a serious policy violation and a detection priority.
hackerschoice/gsocket.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.