.. /Venom
Star

Access

Venom is a multi-hop SOCKS5 proxy/pivoting tool written in Go, with separate admin and agent binaries. The admin binary provides an interactive console (goto, socks, sshtunnel and other commands) for building and operating a chain of agent nodes, each reachable actively or passively, optionally with password authentication and port reuse against an already-listening service.

Paths:

Resources:

Detections:

Access

  1. Starts the admin console listening for an agent connection.

    ./admin_linux_x64 -lport <PORT>
    Use case
    Operator side of a multi-hop SOCKS5 pivot.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  2. Connects an agent on a compromised host back to the admin console, joining the proxy chain.

    ./agent_linux_x64 -rhost <ADMIN_IP> -rport <PORT>
    Use case
    Pivoting into an internal network segment.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  3. Console command run from the admin interactive prompt after selecting a node (goto <id>), starting a local SOCKS5 server proxied through that node's position in the chain.

    socks <LOCAL_PORT>
    Use case
    Exposing a SOCKS5 proxy into the network reachable from a chosen pivot node.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS