klsecservices / rpivot

socks4 reverse proxy for penetration testing

RPIVOT - reverse socks 4 proxy for penetration tests

RPIVOT allows to tunnel traffic into internal network via socks 4. It works like ssh dynamic port forwarding but in the opposite direction.

---

Description

This tool is Python 2.6-2.7 compatible and has no dependencies beyond the standard library. It has client-server architecture. Just run the client on the machine you want to tunnel the traffic through. Server should be started on pentester's machine and listen to incoming connections from the client.

Works on Kali Linux, Solaris 10, Windows, Mac OS.

Usage example

Start server listener on port 9999, which creates a socks 4 proxy on 127.0.0.1:1080 upon connection from client:

python server.py --server-port 9999 --server-ip 0.0.0.0 --proxy-ip 127.0.0.1 --proxy-port 1080

Connect to the server:

python client.py --server-ip <rpivot_server_ip> --server-port 9999

To pivot through an NTLM proxy:

python client.py --server-ip <rpivot_server_ip> --server-port 9999 --ntlm-proxy-ip <proxy_ip> --ntlm-proxy-port 8080 --domain CONTOSO.COM --username Alice --password P@ssw0rd

Pass-the-hash is supported:

python client.py --server-ip <rpivot_server_ip> --server-port 9999 --ntlm-proxy-ip <proxy_ip> --ntlm-proxy-port 8080 --domain CONTOSO.COM --username Alice --hashes 9b9850751be2515c8231e5189015bbe6:49ef7638d69a01f26d96ed673bf50c45

You can use proxychains to tunnel traffic through socks proxy.

Edit /etc/proxychains.conf:

[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks4 127.0.0.1 1080

Using single zip file mode:

zip rpivot.zip -r *.py ./ntlm_auth/
python rpivot.zip server <server_options>
python rpivot.zip client <client_options> 

Pivot and have fun:

proxychains <tool_name>

Pre-built Windows client binary available in release section.

Author

Artem Kondratenko https://twitter.com/artkond

rpivot's Issues

socks5

please add socks5 support too

Standalone client.py and server.py + pip package

Hello @artkond,

First let me greet you for this cool tool you developed !

Then, I have few improvement ideas to share:

• Have single standalone client.py and server.py files: today they both depend on relay.py. Having just to download a single file on each side (either client or server) would be awesome
• Have a pip package: it would be even more awesome if we could just pip install rpivot after gaining access on a target. I can help on that point if you are interested

Cheers !

Encrypt communication

How can I encrypt the traffic between the client and server?

Error when using proxy

Hello, and thank you for this great tool.

I recently noticed that rpivot doesn't seem to work well when proxy parameters are set.

Here is the error:

Traceback (most recent call last):
File "client.py", line 499, in
main()
File "client.py", line 467, in main
bc_sock.connect((backconnect_host, backconnect_port))
File "client.py", line 341, in connect
logger.error("Couldn't parse proxy challenge. Code {0}. Msg {1}".format(code, msg))
UnboundLocalError: local variable 'code' referenced before assignment

Tested it with free HTTP proxy and free SOCKS proxy publicly available. NTLM (http) proxy doesn't work either. @artkond @klsecurityservices any clue on the origin of this error?

Python 3 support

please add Python 3 support too