Happy Halloween!

Hello Boys and Ghouls!

It’s Halloween and there has been a lot going on since I wrote last. I got a job at a power company as a cybersecurity SME, I’ve gotten really into using AI to combine my twin loves of Linux shell goodness and Transparent network design, and we’ve turned a positive new corner with my family. All in all, I couldn’t be happier with how everything is right now.

I’m writing today to talk about a fun app that I’m working on. It’s called “The Summoner”, and here’s how it works:

The user has a linux server on the internet. Now there are either cool tools on that server, or it’s a bastion box that’s hosting another linux box that’s got a reverse shell on it. Either way, the user only has a smartphone on him / her.

So, they pull out their phone, put in the creds or keys to the internet server, specify if it’s the box itself or an ssh proxy to the real server you want, and it creates a wireguard tunnel THROUGH THE PHONE to the wireless network that the phone is on.

Now, what’s cool about this is it doesn’t require root to do this at all. You just point to the server, “start the ritual”, and it summons the server into your network through your phone. My completely locked down Graphene OS phone has been able to “Summon” a kali cloud machine into my home network and after shelling into it, I can run some of the nmap varietals, some exploits, and some service checks through that wireguard proxy service.

I went with a kind of magic, occult theme for Halloween. Currently it can do Kali alright, but I’m trying to get it to work through some stuff with Alpine. I’m making it with Claude, because this is the sort of candy development that AI was made for.

Once I work out some more security kinks, work on securing the secrets, and creating a state saving mechanism, I’ll post the results to Github.

If I’m feeling brave and can snag some hardware, I might try to make a version for Iphone after I finish the version on Graphene. My family uses Imessage a lot and I don’t always have my Android on me.

Ultimately, this is a bit of an experiment for me. If I end up liking the results, I might make a version for desktop called the “Major Arcana” version that can do far more tunneling goodness (because of mobile device security policies, I can proxy UDP and TCP, but not ICMP and other raw protocols).

But really, I’m just seeing how good Claude is getting at development. I’ve been using it a lot for little gnu rec shell utilities and now I’m seeing if I can make my phone more useful.

Now, can’t you do the same thing with tailscale? Yes, absolutely.

But I want to build on this. I like the idea of building some cloud tools into the app to spin up servers, configure them, summon them, then decommission them, all through the phone.

It feels like Watch_dogs. Aiden can just pick up any smartphone and use it to hack stuff; no considerations about rooting or carriers. He just grabs an android or iphone and goes.

I could also see this becoming a hobby. I could see creating other apps like an AR game that doesn’t report your stuff to a foreign intelligence agency, a version of Atak with your servers on a map, or even a bomber’s notebook like app (If you ever played Majora’s mask as a kid, you know).

Regardless, summoning daemons to make the little black mirror in my pocket more powerful sounds like something very Halloweeny to do.