Proxychains and Metasploit

[1n50mn14c]

Hello,

I'm having trouble getting proxychains to work with msfconsole.


root@unknown:~# proxychains msfconsole
ProxyChains-3.1 (http://proxychains.sf.net)
|S-chain|-<>-127.0.0.1:9050-<><>-127.0.0.1:5432-<--timeout
|S-chain|-<>-127.0.0.1:9050-<><>-127.0.0.1:5432-<--timeout
[-] Failed to connect to the database: could not connect to server: Connection refused
Is the server running on host "localhost" (127.0.0.1) and accepting
TCP/IP connections on port 5432?

|DNS-request| 0.0.0.0
|S-chain|-<>-127.0.0.1:9050-<><>-4.2.2.2:53-<><>-OK
|DNS-response|: 0.0.0.0 is not exist

It looks like Metasploit is trying to connect to the PostgreSQL database via proxychains and failing. I should note that msf loads after this warning but I cannot connect to the database. Any ideas?

[root-boy]

try to add this in proxychains.conf:


localnet 127.0.0.1 000 255.255.255.255

[1n50mn14c]

Thanks! That appears to have fixed the problem connecting to the database:


root@unknown:~# proxychains msfconsole
ProxyChains-3.1 (http://proxychains.sf.net)
|DNS-request| localhost
|S-chain|-<>-127.0.0.1:9050-<><>-4.2.2.2:53-<><>-OK
|DNS-response| localhost is 127.0.0.1
|DNS-request| 0.0.0.0
|S-chain|-<>-127.0.0.1:9050-<><>-4.2.2.2:53-<><>-OK
|DNS-response|: 0.0.0.0 is not exist
[-] WARNING! The following modules could not be loaded!
[-] /opt/metasploit/apps/pro/msf3/modules/post/windows/gather/local_admin_search_enum.rb: NameError uninitialized constant Msf::Post::Windows
[-] /opt/metasploit/apps/pro/msf3/modules/post/windows/gather/netlm_downgrade.rb: NameError uninitialized constant Msf::Post::Windows::Priv
|DNS-request| localhost
|S-chain|-<>-127.0.0.1:9050-<><>-4.2.2.2:53-<><>-OK
|DNS-response| localhost is 127.0.0.1
_ _
/ \ /\ __ _ __ /_/ __
| |\ / | _____ \ \ ___ _____ | | / \ _ \ \
| | \/| | | ___\ |- -| /\ / __\ | -__/ | || | || | |- -|
|_| | | | _|__ | |_ / -\ __\ \ | | | | \__/| | | |_
|/ |____/ \___\/ /\ \\___/ \/ \__| |_\ \___\


Using notepad to track pentests? Have Metasploit Pro report on hosts,
services, sessions and evidence -- type 'go_pro' to launch it now.

=[ metasploit v4.6.2-2013052901 [core:4.6 api:1.0]
+ -- --=[ 1113 exploits - 700 auxiliary - 192 post
+ -- --=[ 300 payloads - 29 encoders - 8 nops

msf > db_status
postgresql connected to msf3


Out of curiosity, could you explain why adding that to the conf file fixed the problem?

[zimmaro]

Hello,

I'm having trouble getting proxychains to work with msfconsole.


root@unknown:~# proxychains msfconsole
ProxyChains-3.1 (http://proxychains.sf.net)
|S-chain|-<>-127.0.0.1:9050-<><>-127.0.0.1:5432-<--timeout
|S-chain|-<>-127.0.0.1:9050-<><>-127.0.0.1:5432-<--timeout
[-] Failed to connect to the database: could not connect to server: Connection refused
Is the server running on host "localhost" (127.0.0.1) and accepting
TCP/IP connections on port 5432?

|DNS-request| 0.0.0.0
|S-chain|-<>-127.0.0.1:9050-<><>-4.2.2.2:53-<><>-OK
|DNS-response|: 0.0.0.0 is not exist

It looks like Metasploit is trying to connect to the PostgreSQL database via proxychains and failing. I should note that msf loads after this warning but I cannot connect to the database. Any ideas?

hi :)
i'm not expert:
your service postgresql & metasploit are running before you type proxychains msfconsole?
because in my kali-worked (i've postgresql & metasploit service in AUTOstart)

root@KALI:~# proxychains msfconsole
ProxyChains-3.1 (http://proxychains.sf.net)

MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMM MMMMMMMMMM
MMMN$ vMMMM
MMMNl MMMMM MMMMM JMMMM
MMMNl MMMMMMMN NMMMMMMM JMMMM
MMMNl MMMMMMMMMNmmmNMMMMMMMMM JMMMM
MMMNI MMMMMMMMMMMMMMMMMMMMMMM jMMMM
MMMNI MMMMMMMMMMMMMMMMMMMMMMM jMMMM
MMMNI MMMMM MMMMMMM MMMMM jMMMM
MMMNI MMMMM MMMMMMM MMMMM jMMMM
MMMNI MMMNM MMMMMMM MMMMM jMMMM
MMMNI WMMMM MMMMMMM MMMM# JMMMM
MMMMR ?MMNM MMMMM .dMMMM
MMMMNm `?MMM MMMM` dMMMMM
MMMMMMN ?MM MM? NMMMMMN
MMMMMMMMNe JMMMMMNMMM
MMMMMMMMMMNm, eMMMMMNMMNMM
MMMMNNMNMMMMMNx MMMMMMNMMNMMNM
MMMMMMMMNMMNMMMMm+..+MMNMMNMNMMNMMNMM
http://metasploit.pro


Easy phishing: Set up email templates, landing pages and listeners
in Metasploit Pro’s wizard -- type 'go_pro' to launch it now.

=[ metasploit v4.6.2-2013052901 [core:4.6 api:1.0]
+ -- --=[ 1113 exploits - 700 auxiliary - 192 post
+ -- --=[ 300 payloads - 29 encoders - 8 nops

msf >

[AfterBurn]

What is the difference between proxy chains and tor?

Nevermind, I just read you can use them together.

Also, if you use armitage (which I suggest), there is an option in there to use a socks proxy.

[root-boy]

Thanks! That appears to have fixed the problem connecting to the database:


root@unknown:~# proxychains msfconsole
ProxyChains-3.1 (http://proxychains.sf.net)
|DNS-request| localhost
|S-chain|-<>-127.0.0.1:9050-<><>-4.2.2.2:53-<><>-OK
|DNS-response| localhost is 127.0.0.1
|DNS-request| 0.0.0.0
|S-chain|-<>-127.0.0.1:9050-<><>-4.2.2.2:53-<><>-OK
|DNS-response|: 0.0.0.0 is not exist
[-] WARNING! The following modules could not be loaded!
[-] /opt/metasploit/apps/pro/msf3/modules/post/windows/gather/local_admin_search_enum.rb: NameError uninitialized constant Msf::Post::Windows
[-] /opt/metasploit/apps/pro/msf3/modules/post/windows/gather/netlm_downgrade.rb: NameError uninitialized constant Msf::Post::Windows::Priv
|DNS-request| localhost
|S-chain|-<>-127.0.0.1:9050-<><>-4.2.2.2:53-<><>-OK
|DNS-response| localhost is 127.0.0.1
_ _
/ \ /\ __ _ __ /_/ __
| |\ / | _____ \ \ ___ _____ | | / \ _ \ \
| | \/| | | ___\ |- -| /\ / __\ | -__/ | || | || | |- -|
|_| | | | _|__ | |_ / -\ __\ \ | | | | \__/| | | |_
|/ |____/ \___\/ /\ \\___/ \/ \__| |_\ \___\


Using notepad to track pentests? Have Metasploit Pro report on hosts,
services, sessions and evidence -- type 'go_pro' to launch it now.

=[ metasploit v4.6.2-2013052901 [core:4.6 api:1.0]
+ -- --=[ 1113 exploits - 700 auxiliary - 192 post
+ -- --=[ 300 payloads - 29 encoders - 8 nops

msf > db_status
postgresql connected to msf3


Out of curiosity, could you explain why adding that to the conf file fixed the problem?

When you add that line in the proxychains.conf, proxychains will not tunnel connections made to localhost, in this example proxychains will not tunnel the connection to PostgreSQL.

[zimmaro]

When you add that line in the proxychains.conf, proxychains will not tunnel connections made to localhost, in this example proxychains will not tunnel the connection to PostgreSQL.

hi root-boy :)
thanks for explane
I'm not very knowledgeable!
but .. then my tunneling without errors does not work??
i used tor with proxychains (default127.0.0.1: 9050) in S-chain-mode
I've postgresql autostart in my kali && start after tor
type proxychains msfconsole
i do not retrive errors & my postgresql database is connect to msf3!
sorry for the question and thank you!
bye

[zimmaro]

hi root-boy :)
thanks for explane
I'm not very knowledgeable!
but .. then my tunneling without errors does not work??
i used tor with proxychains (default127.0.0.1: 9050) in S-chain-mode
I've postgresql autostart in my kali && start after tor
type proxychains msfconsole
i do not retrive errors & my postgresql database is connect to msf3!
sorry for the question and thank you!
bye

auto quote :)
sorry!!!!!!!!!!!!
my stupid question !!!
I "" locked "" # proxy_dns!!!!!!
sorry again

[1n50mn14c]

your service postgresql & metasploit are running before you type proxychains msfconsole?
because in my kali-worked (i've postgresql & metasploit service in AUTOstart)


Yes, I manually start both services before running proxychains msfconsole.

[R.3volv3.R]

try to add this in proxychains.conf:


localnet 127.0.0.1 000 255.255.255.255

nice bro root-boy ... work perfect

[nedst3r]

Adding localnet 127.0.0.1 000 255.255.255.255 does not work for me. Can there be any other reason for this problem? Metasploit runs fine when started without proxychains, but when $ sudo proxychains msfconsole is run it is always trying to connect to localhost through proxy. I searched and found that there was a patch for proxychains that allowed localnet exclusion, but it seemed that it was different proxychain than the one that is in Kali.

[nedst3r]

Is there any way to use proxy_dns option for all but localnet? When proxy_dns is commented out metasploit works fine with localnet exclusion added to proxychains.conf. But when proxy_dns is on, metasploit is always trying to connect to localhost through proxy.

[walnut2388]

I edited my /etc/proxychains.conf
dynamic_chain
localnet 127.0.0.1 000 255.255.255.255
socks4 127.0.0.1 9050
socks5 127.0.0.1 9050

but i experienced the following error afterwards.
Can help?

root@kali:~# proxychains msfconsole
ProxyChains-3.1 (http://proxychains.sf.net)
|DNS-response|: kali does not exist
[-] Failed to connect to the database: could not connect to server: Connection refused
Is the server running on host "localhost" (127.0.0.1) and accepting
TCP/IP connections on port 5432?

root@kali:~# cat /etc/resolv.conf
# Generated by NetworkManager
search Home
nameserver 192.168.1.254
nameserver fe80::e28e:3cff:fe1a:fdd1%eth0
nameserver 8.8.8.8

[cm0s]

hey 1n50mn14c,

this covers a bit on proxychains:
https://www.codeproject.com/tips/634228/how-to-use-proxychains-forwarding-ports

Adrian Crenshaw from Defcon 22 really covers this topic well:
edit: my bad on the youtube link
search 'Adrian Crenshaw Def Con 22 Dropping Docs on Darknets'

socat and metasploit:
http://securityblog.gr/1246/anonymity-first-tor-metasploit/

couple notes: might not be best idea to bundle the framework into one 'proxy script'
socat is more manual can set it to whatever actual pentest you are doing meaning adjust
it for different types of 'scans' attacks

also what proxy is being used, where, who, etc. proxy does not always mean 'safer' as
you probably already knew, in fact, it can actually mean 'worse' lol

for many the 'threat model' is the ISP, they have the resources, the actual network hardware etc
so as ya probably already guessed, it's not so much the ip today as it is the time allocation
the packet sizes etc.

look at openvpn with stunnel, consider transparent to that point then from there tor/proxy list/random

when in doubt, look at the packets: wireshark

cheerz