Linux TPROXY path
Rosemary configures Linux forwarding and policy routing so traffic can enter the Rosemary path while preserving destination awareness.
Rosemary
Kernel-level pivoting
Reach internal networks through Rosemary agents.
Rosemary is a cross-platform kernel-level pivoting platform over QUIC. Once an agent connects, the operator gains routed access through that agent’s network path, reaching internal segments without proxychains, TUN/TAP setup, or per-application proxy edits.
QUIC transportKernel pivotingTCP / UDP / ICMP / DNSAgent chainingSOCKS5PowerShell agentChrome extensionReverse forwardsWeb dashboard
agent graph
Kernel pivoting layer
Rosemary works below the application layer.
The routing model is not just a SOCKS wrapper. Rosemary installs platform-specific packet paths so the operator machine can reach networks exposed by connected agents while Rosemary preserves destination awareness and flow handling.
Windows WinDivert path
On Windows, Rosemary loads the WinDivert kernel driver, captures outbound TCP and UDP packets, rewrites loopback proxy traffic, and injects responses back to the original client flow.
Route ownership
Agent subnets become reachable from the operator side through Rosemary’s route table, so internal paths stay tied to the agent that exposes them.
Agent internet egress
When the server has no internet access, Rosemary can use a selected online agent as the egress path so operator-side traffic exits from the agent network.
Traffic flow
One control surface, multiple reachable paths.
Rosemary keeps the operator workflow focused: once agents connect, their reachable networks become operator-side paths, and default egress can let the server use an internet-connected agent for outbound access.
Agent-managed path selection
Hover to see traffic units move from the Rosemary control surface toward available agents.
Forwarding from one console
SOCKS5, local forwards, reverse forwards, and discovery actions share the same operator surface.
PowerShell and native agents
Use native agents where possible, or Invoke-Rosemary.ps1 for Windows agent workflows and bind-mode access.
Dashboard
Visual control for agents, routes, and pivots.
Rosemary includes a web dashboard for operating the pivoting layer without losing visibility. The graph view shows connected agents and their relationships, while the table view keeps host, subnet, route, and connection details easy to scan.
real-time agent graphagent table and route statusforwards and SOCKS5 managementweb CLI and log visibilitysettings and API token control
graph view
table view
Operator focused
Native paths for discovery, access, and movement.
Rosemary is designed for authorized security assessments where the operator needs to work from inside reachable agent networks without redesigning every command around proxy configuration.
Kernel-Level Pivoting
Intercept traffic below the application layer with Linux policy routing and Windows WinDivert packet handling.
QUIC Transport
Outbound agents dial home over QUIC/UDP, while bind mode keeps an encrypted TCP option for stricter networks.
Agent Chaining
Move through several connected agents and keep destination ownership clear across deeper internal paths.
SOCKS5 And Forwards
Expose per-agent SOCKS5 listeners, local forwards, UDP forwards, and reverse forwards from one control plane.
Transparent Protocol Flow
Carry TCP, UDP, DNS, and ICMP-oriented workflows across internal routes without per-tool proxy settings.
Agent-Side Discovery
Run ping checks, subnet sweeps, and TCP or UDP scans from the agent side before expanding access.
Dashboard And API
Work from the web UI, interactive CLI, or REST API with scoped tokens for read, write, and admin usage.
Chrome Extension
Use the browser extension for quick access to Rosemary controls without leaving Chrome.
PowerShell Agent
Use Invoke-Rosemary.ps1 as a Windows agent path, including bind mode, outbound mode, and background execution.
Default Egress
Select an agent with internet access so the Rosemary server can reach the internet through that agent when the server itself has no direct internet path.
Workflow
Start, connect, operate.
The flow stays simple: run the server, connect agents, then operate through the networks those agents expose using routes, forwards, SOCKS5 listeners, discovery, and egress from the same console.
Start the control server
Run Rosemary on the operator host. The dashboard is exposed on the web port and agents connect to the transport listener.
sudo rosemaryConnect an agent
Deploy a platform-specific agent. Once it connects, its discovered subnets can become routable paths.
./agent-linux-amd64 -s server-ip:2048 -k YOUR_KEYUse normal tools
The operator can use normal tools as routed access appears through the connected agent’s network path.
curl http://192.168.1.50
ssh [email protected]
ping 192.168.1.1Quick start
One server, many agents, one routing surface.
rosemary
$ sudo rosemary
$ ./agent-linux-amd64 -s server-ip:2048 -k YOUR_KEY
$ . .\Invoke-Rosemary.ps1
$ Invoke-Rosemary -Mode agent -Server 192.168.1.10:2048 -Key YOUR_KEY -Background
$ Invoke-Rosemary -Mode agent-bind -Listen 0.0.0.0:9001 -Key YOUR_KEY
$ rosemary> routes
$ rosemary> egress agent-1
$ rosemary> socks agent-1 1080
$ rosemary> forward add 8080 agent-1 192.168.1.10 80 tcp
$ rosemary> rforward add 9001 agent-1 127.0.0.1 22
$ rosemary> discover agent-1 192.168.1.0/24 800 128
$ rosemary> portscan agent-1 tcp 192.168.1.10 22,80,443,3389
$ rosemary> egress none
Platforms
Agent support across desktop and server targets.
LinuxWindowsmacOSFreeBSDOpenBSD
Rosemary is intended for lawful administration, research, and security testing on systems you own or are explicitly authorized to assess.