reGeorg is the successor to reDuh, a self-hosted pivoting tool that uploads a tunnel webshell (tunnel.aspx/ashx/jsp/php) to a compromised, internet-facing web server and opens a local SOCKS proxy on the operator’s machine that relays traffic through it into the DMZ or internal network. Because the operator controls the compromised server, there is no vendor domain to block. It is heavily abused for tunneling into segmented networks over legitimate-looking web traffic, tracked as MITRE ATT&CK S1187 and observed with SamSam and Exchange server intrusions, among others.
Runs the reGeorg client, opening a local SOCKS proxy on port 8080 that relays traffic through the tunnel webshell hosted on the compromised web server.
python reGeorgSocksProxy.py -p 8080 -u http://<TARGET>/tunnel/tunnel.jsp