zerotier is currently the main tool I use for internal network penetration. Recently, I reconfigured moon and ztncui on the cloud server, and there are quite a few commands used, so I made a simple record to avoid searching for tutorials in the future.
Setting up the Moon Server#
Installing zerotier#
curl -s https://install.zerotier.com | sudo bash
After installation, the ZeroTier address (node ID) of the cloud server will be generated.
Configuring the Moon service#
- Go to the configuration file directory
cd /var/lib/zerotier-one/
- Generate moon.json
zerotier-idtool initmoon identity.public >>moon.json
- Edit moon.json
nano moon.json
- Fill in the node IP and port (need to open port 9993 on the cloud server)
"stableEndpoints": ["xxx.xxx.xxx.xxx/9993"]
- Generate the moon server file
zerotier-idtool genmoon moon.json
- Create the service directory
mkdir /var/lib/zerotier-one/moons.d/
- Copy the signature file to the moons.d directory
cp 000000xxxxxxxxxx.moon /var/lib/zerotier-one/moons.d/
- Restart zerotier
systemctl restart zerotier-one
- Join the Moon
Use the terminal command on Windows and Linux
zerotier-cli orbit <node ID> <node ID>
Or copy the moon server file to the corresponding folder
Android devices need to download zerotier fix
Setting up the Node Controller#
In addition to the official website, you can also set up a third-party node controller to manage virtual LANs.
Installing ztncui#
Open port 3000 and use the following command line to set up
curl -O https://s3-us-west-1.amazonaws.com/key-networks/deb/ztncui/1/x86_64/ztncui_0.8.14_amd64.deb
sudo apt install ./ztncui_0.8.14_amd64.deb
sudo sh -c "echo ZT_TOKEN=`sudo cat /var/lib/zerotier-one/authtoken.secret` > /opt/key-networks/ztncui/.env"
sudo sh -c "echo HTTP_ALL_INTERFACES=yes >> /opt/key-networks/ztncui/.env"
sudo sh -c "echo NODE_ENV=production >> /opt/key-networks/ztncui/.env"
sudo chmod 400 /opt/key-networks/ztncui/.env
sudo chown ztncui:ztncui /opt/key-networks/ztncui/.env
sudo systemctl enable ztncui
sudo systemctl restart ztncui
Default username and password: admin password
Controller settings#
- Click "add network" - "create", then enter the desired network name
- After creating, click "networks" - "easy setup" - "generate network address" - "submit", and it can be used normally. The network ID is displayed in the mosaic area in the picture.
- Add devices to the network
Terminal on Windows/Linux
zerotier-cli join <network ID>