Tunnels

Overview#

JustC2 supports several types of tunnels that route network traffic through agent sessions. This enables operators to access internal networks, pivot between segments, and interact with services that are not directly reachable.

Tunnel Types#

Creating Tunnels#

SOCKS5 Proxy#

The most common tunnel type. Creates a SOCKS5 proxy on your local machine that routes traffic through the agent.

1. Open the Tunnels tab
2. Click Start SOCKS5
3. Select the agent session to tunnel through
4. Configure:
   • Interface — Local bind address (e.g., 127.0.0.1)
   • Port — Local SOCKS port (e.g., 1080)
5. Click Start

Use with proxychains:

# /etc/proxychains4.conf
[ProxyList]
socks5 127.0.0.1 1080

proxychains4 nmap -sT -Pn 10.0.0.0/24

SOCKS5 with Authentication#

For added security, create a SOCKS5 proxy that requires credentials:

1. Click Start SOCKS5
2. Enable authentication
3. Set username and password
4. Start the tunnel

SOCKS4 Proxy#

For legacy tool compatibility:

1. Click Start SOCKS4
2. Configure interface and port
3. Start the tunnel

Local Port Forwarding#

Forward a local port to a specific target:port through the agent:

[Your Machine:8080] → [Agent] → [Target:80]

1. Click Start Local Port Forward
2. Configure:
   • Local Port — Port on your machine
   • Forward Host — Target host (from the agent’s perspective)
   • Forward Port — Target port
3. Start the tunnel

Now localhost:8080 connects to Target:80 through the agent.

Reverse Port Forwarding#

Forward a port on the agent’s host to your machine:

[Agent:8443] → [Your Machine:443]

1. Click Start Reverse Port Forward
2. Configure the agent port and local destination
3. Start the tunnel

Managing Tunnels#

The Tunnels tab shows all active tunnels with:

• Tunnel ID — Unique identifier
• Agent — The agent session providing the tunnel
• Type — SOCKS4/5, Local PF, Reverse PF
• Interface/Port — Local listening address
• Info — Additional details and notes

Stopping Tunnels#

Right-click a tunnel → Stop to tear down the tunnel and close the local listener.

Tunnel Notes#

Right-click a tunnel → Set Info to add notes about what the tunnel is used for.

Connection Flow#

SOCKS Proxy Flow#

Application → SOCKS Client → Local Listener → Agent → Target
                 ↓                                ↑
              SOCKS5 handshake              TCP Connection
              (optional auth)

1. An application sends traffic to the local SOCKS port
2. The SOCKS server performs the protocol handshake
3. Connection data is packed as a tunnel task and sent to the agent
4. The agent establishes the TCP connection to the target
5. Data flows bidirectionally through the tunnel

Port Forward Flow#

Application → Local Port → Agent → Target:Port

1. Traffic to the local forwarded port is captured
2. Data is relayed through the agent’s C2 channel
3. The agent connects to the destination and forwards the data

OPSEC Considerations#

• Tunnel traffic travels inside the agent’s C2 channel — it inherits the C2 protocol’s characteristics
• High-bandwidth tunneling (e.g., large file transfers through SOCKS) may affect the agent’s check-in behavior
• SOCKS proxy usage may be visible in the agent’s network connections on the target
• Use authenticated SOCKS5 to prevent unauthorized tunnel access if the port is exposed