Skip to content

Fetch useful data from ZeroTier config and state files on all OSes#1282

Open
misje wants to merge 2 commits into
Velocidex:masterfrom
misje:add-zerotier-artifact
Open

Fetch useful data from ZeroTier config and state files on all OSes#1282
misje wants to merge 2 commits into
Velocidex:masterfrom
misje:add-zerotier-artifact

Conversation

@misje

@misje misje commented Jul 4, 2026

Copy link
Copy Markdown
Contributor

This artifact tries to fetch all information of value from files left by ZeroTier (a VPN client) on endpoints on all OSes. Some useful information includes:

  • IDs
  • IP addresses of nodes this computer has been in contact with
  • Evidence of custom infrastructure and their IP addresses
  • IP addresses, routes and DNS servers pushed for networks

It was a fun challenge to piece together the binary format used by ZeroTier from the public source code and get familiar with the binary parser format.

I have had access to a lot of real-world data to test this artifact against, with the only exception of custom root servers and planets/moons (but the format is the same as for the public infrastructure, which has been tested).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant