Package: pivotnacci
pivotnacciPivot into the internal network by deploying HTTP agents.Pivotnacciallows you to create a socks server which communicates with HTTPagents. The architecture looks like the following:This tool was inspired by the greatreGeorg. However, it includes some improvements:Support forbalanced serversCustomizable polling interval, useful to reducedetection ratesAuto drop connections closed by a serverModular and cleaner codeInstallation through pipPassword-protected agentsSupported socks protocolsSocks 4Socks 5No authenticationUser passwordGSSAPIInstallationFrom python packages:pip3installpivotnacciFrom repository:gitclonehttps://github.com/blackarrowsec/pivotnacci.gitcdpivotnacci/
pip3install-rrequirements.txt# to avoid installing on the OSpython3setup.pyinstall# to install on the OSUsageUpload the required agent (php, jsp or aspx) to a webserverStart the socks server once the agent is deployedConfigure proxychains or any other proxy client (the default listening port for pivotnacci socks server is 1080)$pivotnacci-h
usage:pivotnacci[-h][-saddr][-pport][--verbose][--ack-messagemessage][--passwordpassword][--user-agentuser_agent][--headerheader][--proxy[protocol://]host[:port]][--typetype][--polling-intervalmilliseconds][--request-triesnumber][--retry-intervalmilliseconds]url

SocksserverforHTTPagents

positionalarguments:urlTheurloftheagent

optionalarguments:-h,--helpshowthishelpmessageandexit-saddr,--sourceaddrThedefaultlisteningaddress(default:127.0.0.1)-pport,--portportThedefaultlisteningport(default:1080)--verbose,-v--ack-messagemessage,-amessageMessagereturnedbytheagentwebpage(default:ServerError500(InternalError))--passwordpasswordPasswordtocommunicatewiththeagent(default:)--user-agentuser_agent,-Auser_agentTheUser-Agentheadersenttotheagent(default:pivotnacci/0.0.1)--headerheader,-HheaderSendcustomheader.Specifyintheform'Name: Value'(default:None)--proxy[protocol://]host[:port],-x[protocol://]host[:port]SettheHTTPproxytouse.(EnvironmentvariablesHTTP_PROXYandHTTPS_PROXYarealsosupported)(default:None)--typetype,-ttypeTospecifyagenttypeincaseisnotautomaticallydetected.Optionsare['php','jsp','aspx'](default:None)--polling-intervalmillisecondsIntervaltopolltheagents(forrecvoperations)(default:100)--request-triesnumberThenumberofretriesforeachrequesttoanagent.Touseincaseofbalancedservers(default:50)--retry-intervalmillisecondsIntervaltoretryafailurerequest(dueabalancedserver)(default:100)ExamplesUsing an agent with passwords3cr3t(AGENT_PASSWORDvariable must be modified at the agent side as well):pivotnaccihttps://domain.com/agent.php--password"s3cr3t"Using a custom HTTPHostheader and a customCustomAgentUser-Agent:pivotnaccihttps://domain.com/agent.jsp-H'Host: vhost.domain.com'-A'CustomAgent'Setting a different agent message418 I'm a teapot(ACK_MESSAGEvariable must be modified at the agent side as well):pivotnaccihttps://domain.com/agent.aspx--ack-message"418 I'm a teapot"Reduce detection rate (e.g. WAF) by setting the polling interval to2seconds:pivotnaccihttps://domain.com/agent.php--polling-interval2000AuthorEloy Pérez (@Zer1t0) [www.blackarrow.net-www.tarlogic.com]LicenseAll the code included in this project is licensed under the terms of the GNU AGPLv3 license.