Earthworm

中文页 Support List

EW is a simple network tunnel with SOCKS v5 sever and port transfer. It works well in various situations.

Update(03/09/2019): It is unfortunate to learn that my tool has been abused by attackers. I have to stop updating the tools and shutdown the download as a precaution to prevent further possible misuse from happening. Also there are existing yara rules can be used to detect the tools. Please visit here [https://github.com/rootkiter/Binary-files] for more details.

Description

Use case example:

It supports "forward", "backward" and "multi-transfer" modes and can penetrate deeply into the intranet.

It support various OS such as Linux, Windows, MacOS, Arm-Linux. More is coming...

Usage:

The following examples are with default proxy port 1080 and SOCKSv5.

It has 6 command types: ssocksd, rcsocks, rssocks, lcx_slave, lcx_listen, lcx_tran.

  • 1. Forward SOCKS v5
  •   $ ./ew -s ssocksd -l 1080

  • 2. Backward SOCKS v5
  •   2 steps:

      a) Run the following command in hostA with public ip;

      $ ./ew -s rcsocks -l 1080 -e 8888 

      b) Start SOCKS v5 server on hostB which will transfer the data to port 8888 of hostA.

      $ ./ew -s rssocks -d 1.1.1.1 -e 8888 

     enjoy now.

  • 3. multi-transfer
  •  It is realized with 3 port transfer commands,

     Transfer Example:

      $ ./ew -s lcx_listen -l  1080   -e 8888
      $ ./ew -s lcx_tran   -l  1080   -f 2.2.2.3 -g 9999
      $ ./ew -s lcx_slave  -d 1.1.1.1 -e 8888    -f 2.2.2.3  -g  9999

     Double transfer example:

      a) lcx_tran

      $ ./ew -s ssocksd  -l 9999
      $ ./ew -s lcx_tran -l 1080 -f 127.0.0.1 -g 9999

      b) lcx_listen、lcx_slave

      $ ./ew -s lcx_listen -l 1080 -e 8888
      $ ./ew -s ssocksd    -l 9999
      $ ./ew -s lcx_slave  -d 127.0.0.1 -e 8888 -f 127.0.0.1 -g 9999

     Triple transfer example:

      $ ./ew -s rcsocks -l 1080 -e 8888
      $ ./ew -s lcx_slave -d 127.0.0.1 -e 8888 -f 127.0.0.1 -g 9999
      $ ./ew -s lcx_listen -l 9999 -e 7777
      $ ./ew -s rssocks -d 127.0.0.1 -e 7777

     Data flow: SOCKS v5 -> 1080 -> 8888 -> 9999 -> 7777 -> rssocks .

    PS:

    1.Default timeout is 10s which can be set with -t arg.

    2.Multi-transfer works on any tcp service such as RDP and ssh.

    3.ew_for_arm_32 works well on Android, MiWiFi(base OpenWrt on ARM) and Raspberry Pi.

    4.Reference: http://www.freebuf.com/articles/system/12182.html

    5.Please use EW under the law.

    Contact:

    rootkiter@rootkiter.com

    You can email me with more ideas or bugs. I will try my best to make EW better.

    Thanks:

    I have many good friends and colleagues. We created this tool together. Hope they better than better.

    demi6od help me to translate this page into English. Special thanks to him.
    By adding -a arg ,you can see more of my friends ( Why -a? Because they are shy :-P ).