socks - SOCKS5 Proxy

Start or stop a SOCKS5 proxy server on the Mythic server.

Description

The socks command starts or stops a SOCKS5 proxy server on the Mythic server. When started, the SOCKS proxy allows routing network traffic through the agent to access internal network resources. WARNING: SOCKS proxies generate continuous network traffic and may be detected by network monitoring tools.

Syntax

socks {"action":"start","port":7002}
socks {"action":"stop","port":7002}

Parameters

action (required): Either "start" or "stop"
port (optional): Port number for the SOCKS proxy (default: 7002)

Examples

socks {"action":"start","port":7002}
socks {"action":"stop","port":7002}

Features

When started, the SOCKS proxy allows routing network traffic through the agent to access internal network resources
The default port is 7002
The proxy runs on the Mythic server and uses the agent as a tunnel for network connections
WARNING: SOCKS proxies generate continuous network traffic and may be detected by network monitoring tools, firewall logging, EDR/XDR network monitoring, and network flow analysis
Use non-standard ports and be aware of high bandwidth usage

Output

[socks] SOCKS proxy started on port 7002

OPSEC Considerations

SOCKS proxies generate continuous network traffic
May be detected by network monitoring tools, firewall logging, EDR/XDR network monitoring, and network flow analysis
Use non-standard ports
Be aware of high bandwidth usage
Consider the operational impact before starting

SOCKS Proxy Support, Usage Examples

Command Category: Network Tunneling
Requires Admin: No

1.8 KiB Raw Blame History