.. /suo5
Star

Access

suo5 is a self-hosted, high-performance HTTP proxy tunnel that uses bidirectional chunked-encoding over a single connection to relay traffic through a webshell (jsp/php/aspx) uploaded to a compromised web server, giving the operator a local SOCKS5 proxy into the internal network. Because the operator controls the compromised server, there is no vendor domain to block. It is abused for webshell-based pivoting, observed with the China-linked Houken/UNC5174 Ivanti CSA campaign and the JadeProx China-nexus operation, among others.

Paths:

Resources:

Detections:

Access

  1. Runs the suo5 client against an uploaded webshell, opening a local SOCKS5 proxy (default 127.0.0.1:1111) that relays traffic full-duplex over HTTP into the internal network.

    suo5 -t http://<TARGET>/suo5.jsp -l 127.0.0.1:1111
    Use case
    Pivoting into an internal network through a compromised, internet-facing web server.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  2. Connects through a redirect webshell, allowing the tunnel to traverse multi-layer reverse proxies and load balancers in front of the target.

    suo5 -t http://<TARGET>/suo5.jsp -r http://<REDIRECT>/suo5.jsp
    Use case
    Pivoting through targets fronted by load balancers or layered reverse proxies.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS