|
1 |
| - |
2 | 1 | ## Verification Steps
|
3 | 2 |
|
4 |
| - 1. Start msfconsole |
5 |
| - 2. Do: ```use auxiliary/server/socks4a``` |
6 |
| - 3. Do: ```run``` |
7 |
| - 4. Do: ```curl --proxy socks4a://localhost:1080 https://github.com``` |
8 |
| - 5. You should see the source for the github homepage |
| 3 | + 1. Start `msfconsole` |
| 4 | + 2. Do: `use auxiliary/server/socks4a` |
| 5 | + 3. Do: `run` |
| 6 | + 4. Do: `curl --proxy socks4a://localhost:1080 https://github.com` |
| 7 | + 5. You should see the source for the Github homepage |
9 | 8 |
|
10 | 9 | ## Options
|
11 | 10 |
|
12 | 11 | **SRVHOST**
|
13 | 12 |
|
14 |
| - The local IP address to bind the proxy to. The default value of `0.0.0.0` will expose the proxy to everything on the attackers network. |
| 13 | + The local IP address to bind the proxy to. The default value of `0.0.0.0` will expose the proxy to everything on the attacker's network. |
15 | 14 |
|
16 | 15 | **SRVPORT**
|
17 | 16 |
|
18 |
| - The local port to bind the proxy to. The default value is `1080`, the standard port for a SOCKS4a proxy. |
| 17 | + The local port to bind the proxy to. The default value is `1080`, the standard port for a socks4a proxy. |
19 | 18 |
|
20 | 19 | ## Scenarios
|
21 | 20 |
|
22 | 21 | This module is great when pivoting across a network. Suppose we have two machines:
|
23 | 22 |
|
24 |
| - 1. Attackers machine, on the `192.168.1.0/24` subnet. |
| 23 | + 1. Attacker's machine, on the `192.168.1.0/24` subnet. |
25 | 24 | 2. Victim machine with two network interfaces, one attached to the `192.168.1.0/24` subnet and the other attached to the non-routable `10.0.0.0/24` subnet.
|
26 | 25 |
|
27 | 26 | We'll begin by starting the socks4a proxy:
|
|
33 | 32 | msf auxiliary(socks4a) >
|
34 | 33 | ```
|
35 | 34 |
|
36 |
| - Preparing to pivot across a network requires us to first establish a meterpreter session on the victim machine. From there, we can use the `autoroute` module to enable access to the non-routable subnet: |
| 35 | + Preparing to pivot across a network requires us to first establish a Meterpreter session on the victim machine. From there, we can use the `autoroute` script to enable access to the non-routable subnet: |
37 | 36 |
|
38 | 37 | ```
|
39 |
| - meterpreter > run autoroute -s 10.0.0.0/24; |
| 38 | + meterpreter > run autoroute -s 10.0.0.0/24 |
40 | 39 | ```
|
41 | 40 |
|
42 |
| - The `autoroute` module will enable our local socks4a proxy to direct all traffic to the `10.0.0.0/24` subnet through our meterpreter session causing it to emerge from the victim's machine and thus giving us access to the non-routable subnet. We can now use curl to connect to a machine on the non-routable subnet via the socks4a proxy: |
| 41 | + The `autoroute` module will enable our local socks4a proxy to direct all traffic to the `10.0.0.0/24` subnet through our Meterpreter session, causing it to emerge from the victim's machine and thus giving us access to the non-routable subnet. We can now use `curl` to connect to a machine on the non-routable subnet via the socks4a proxy: |
43 | 42 | ```
|
44 | 43 | curl --proxy socks4a://localhost:1080 http://10.0.0.15:8080/robots.txt
|
45 | 44 | ```
|
46 | 45 |
|
47 |
| - We can take this a step further and use `proxychains` to enable other tools to access the non-routable subnet that don't have built-in support for proxies. The short-and-sweet guide to installing and configuring proxychains looks something like this: |
| 46 | + We can take this a step further and use proxychains to enable other tools that don't have built-in support for proxies to access the non-routable subnet. The short-and-sweet guide to installing and configuring proxychains looks something like this: |
48 | 47 |
|
49 | 48 | ```
|
50 | 49 | # apt-get install proxychains
|
| 50 | + # cp /etc/proxychains.conf /etc/proxychains.conf.backup |
51 | 51 | # echo "socks4 127.0.0.1 8080" > /etc/proxychains.conf
|
52 | 52 | ```
|
53 | 53 |
|
54 |
| - From there, we can use our other tools by simply prefixing them with proxychains: |
| 54 | + From there, we can use our other tools by simply prefixing them with `proxychains`: |
55 | 55 |
|
56 | 56 | ```
|
57 | 57 | # proxychains curl http://10.0.0.15:8080/robots.txt
|
58 |
| - # proxychains nmap -sSV -p 22 10.0.0.15 |
| 58 | + # proxychains nmap -sT -Pn -n -p 22 10.0.0.15 |
59 | 59 | # proxychains firefox
|
60 | 60 | ```
|
0 commit comments