SOCKS5 Tunnel

SOCKS5 Tunnel

XoloC2 beacons include a built-in SOCKS5 proxy. Traffic is multiplexed over the existing HTTPS polling channel — no additional binaries needed on the target.

Step 1 — Start the tunnel

In the session panel, click SOCKS5 Tunnel, set a local port (default 1080), and click Start.

Or send directly in the terminal:

__tunnel__ 1080

This opens a SOCKS5 listener on port 1080 of your XoloC2 server.

Step 2 — Configure proxychains

Edit /etc/proxychains4.conf:

[ProxyList]
socks5 127.0.0.1 1080

Step 3 — Route your tools through the tunnel

# Network scan
proxychains4 nmap -sT -Pn 192.168.1.0/24

# HTTP request to internal host
proxychains4 curl http://192.168.1.10/

# SSH to internal host
proxychains4 ssh user@192.168.1.10

# SMB enumeration
proxychains4 crackmapexec smb 192.168.1.0/24

Step 4 — Stop the tunnel

__tunnel__ stop

Or click Stop in the session panel.

Multiple tunnels

Run simultaneous tunnels on different ports from different sessions:

# Session A — first pivot
__tunnel__ 1080

# Session B — deeper pivot
__tunnel__ 1081

Notes

• UDP is not supported
• All TCP protocols work: HTTP, SSH, SMB, RDP, etc.
• The tunnel survives beacon sleep cycles — traffic queues and resumes on the next poll