@@ -118,6 +118,7 @@ I used 8080 with a Cloudflare proxy via HTTP for the firs test. Less overhead.
118
118
- ** Reverse Proxy Support** : The client now supports SOCKS5 and HTTP(s) proxies.
119
119
- ** Custom 302** : Server now has defined 302 redirects for non-auth users.
120
120
- ** stdin: stdout ** : stdin: stdout client mode for client to avoid firewall restrictions and binding to local ports.
121
+ - ** Fileless Execution on Windows** : PowerShell script to execute the client without saving any files to disk.
121
122
122
123
## 🚀 Quick Start
123
124
@@ -298,6 +299,40 @@ Host remote.example.com
298
299
ProxyCommand powershell -Command "$script = (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/doxx/darkflare/main/examples/memory-exec.ps1'); powershell -Command $script -t cdn.example.com -d localhost:22"
299
300
```
300
301
302
+ ### Linux/Unix Memory Execution
303
+ On Linux and Unix-like systems, you can use curl and bash to achieve similar fileless execution:
304
+
305
+ ``` bash
306
+ # Basic usage with curl
307
+ curl -s https://github.com/doxx/darkflare/releases/latest/download/darkflare-client-linux-amd64 | bash -s -- -l stdin:stdout -t cdn.example.com -d localhost:22
308
+
309
+ # Direct SSH ProxyCommand usage
310
+ ssh -o ProxyCommand=" curl -s https://github.com/doxx/darkflare/releases/latest/download/darkflare-client-linux-amd64 | bash -s -- -l stdin:stdout -t cdn.example.com -d localhost:22" user@remote
311
+
312
+ # With a SOCKS5 proxy
313
+ curl -s https://github.com/doxx/darkflare/releases/latest/download/darkflare-client-linux-amd64 | bash -s -- -l stdin:stdout -t cdn.example.com -d localhost:22 -p socks5://proxy:1080
314
+ ```
315
+
316
+ For macOS, replace ` linux-amd64 ` with ` darwin-amd64 ` (Intel) or ` darwin-arm64 ` (Apple Silicon).
317
+
318
+ ### SSH Configuration for Unix Systems
319
+ Add to your ` ~/.ssh/config ` :
320
+ ```
321
+ Host remote.example.com
322
+ ProxyCommand curl -s https://github.com/doxx/darkflare/releases/latest/download/darkflare-client-linux-amd64 | bash -s -- -l stdin:stdout -t cdn.example.com -d localhost:22
323
+ ```
324
+
325
+ ### Security Note for Unix Systems
326
+ While this method works, it's important to note:
327
+ - The binary is executed with your current user permissions
328
+ - Consider using checksum verification for enhanced security:
329
+ ``` bash
330
+ # Verify checksum before execution
331
+ curl -s https://github.com/doxx/darkflare/releases/latest/download/checksums.txt | grep linux-amd64 | sha256sum -c - && \
332
+ curl -s https://github.com/doxx/darkflare/releases/latest/download/darkflare-client-linux-amd64 | bash -s -- [options]
333
+ ```
334
+
335
+
301
336
## 📖 Command Line Reference
302
337
303
338
### Client Usage
0 commit comments