marcos.luna
58 lines
1.8 KiB
Markdown
58 lines
1.8 KiB
Markdown
# socks - SOCKS5 Proxy
|
|
|
|
Start or stop a SOCKS5 proxy server on the Mythic server.
|
|
|
|
## Description
|
|
|
|
The `socks` command starts or stops a SOCKS5 proxy server on the Mythic server. When started, the SOCKS proxy allows routing network traffic through the agent to access internal network resources. WARNING: SOCKS proxies generate continuous network traffic and may be detected by network monitoring tools.
|
|
|
|
## Syntax
|
|
|
|
```
|
|
socks {"action":"start","port":7002}
|
|
socks {"action":"stop","port":7002}
|
|
```
|
|
|
|
## Parameters
|
|
|
|
- `action` (required): Either `"start"` or `"stop"`
|
|
- `port` (optional): Port number for the SOCKS proxy (default: 7002)
|
|
|
|
## Examples
|
|
|
|
```
|
|
socks {"action":"start","port":7002}
|
|
socks {"action":"stop","port":7002}
|
|
```
|
|
|
|
## Features
|
|
|
|
- When started, the SOCKS proxy allows routing network traffic through the agent to access internal network resources
|
|
- The default port is 7002
|
|
- The proxy runs on the Mythic server and uses the agent as a tunnel for network connections
|
|
- WARNING: SOCKS proxies generate continuous network traffic and may be detected by network monitoring tools, firewall logging, EDR/XDR network monitoring, and network flow analysis
|
|
- Use non-standard ports and be aware of high bandwidth usage
|
|
|
|
## Output
|
|
|
|
```
|
|
[socks] SOCKS proxy started on port 7002
|
|
```
|
|
|
|
## OPSEC Considerations
|
|
|
|
- SOCKS proxies generate continuous network traffic
|
|
- May be detected by network monitoring tools, firewall logging, EDR/XDR network monitoring, and network flow analysis
|
|
- Use non-standard ports
|
|
- Be aware of high bandwidth usage
|
|
- Consider the operational impact before starting
|
|
|
|
## Related
|
|
|
|
[SOCKS Proxy Support](../../../features.md#socks-proxy-support), [Usage Examples](../../../examples.md#socks-proxy-example)
|
|
|
|
---
|
|
|
|
**Command Category:** Network Tunneling
|
|
**Requires Admin:** No
|