1 year ago
#384645
ExecutionByFork
Proxychains routes differently with and without sudo
EDIT: Any ideas would be appreciated. I am encountering this again and have no direction on how to troubleshoot this. I never solved this originally and have not been able to find any answers via google.
I am getting some very strange behavior from proxychains which I am unsure how to approach and troubleshoot. When I access a box, I ssh in with -R to open a reverse tunnel back out to my local machine.
ssh -R 1234 user@host
On this remote host, I have proxychains configured as follows (/etc/proxychains4.conf)
strict_chain
proxy_dns
remote_dns_subnet 224
tcp_read_time_out 15000
tcp_connect_time_out 8000
socks4 127.0.0.1 1234
I have two machines, BadHost and GoodHost. I am using the exact same tunneling technique on both of these hosts. On GoodHost, everything works as expected. Proxychains on the remote host sends traffic to port 1234, which is carried by ssh back to my local machine, where it reaches out to the internet.
$ proxychains curl www.example.com
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.14
[proxychains] Strict chain ... 127.0.0.1:1234 ... www.example.com:80 ... OK
<!doctype html>
<html>
...
On BadHost, I get the following
$ proxychains curl www.example.com
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.14
[proxychains] Strict chain ... 127.0.0.1:1234 ... 159.x.x.7:8080 <--socket error or timeout!
curl: (7) Couldn't connect to server
On both hosts, nslookup returns the same results
$ nslookup www.example.com
Server: 159.x.x.156
Address: 159.x.x.156#53
Non-authoritative answer:
Name: www.example.com
Address: 93.184.216.34
Name: www.example.com
Address: 2606:2800:220:1:248:1893:25c8:1946
It especially confuses me that using sudo seems to solve the problem on BadHost
$ sudo proxychains curl www.example.com
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.14
[proxychains] Strict chain ... 127.0.0.1:1234 ... www.example.com:80 ... OK
<!doctype html>
<html>
...
Both proxychains ... and sudo proxychains ... on BadHost are using the same configuration file, as shown in my outputs...
Why is proxychains routing to this unknown IP on the subnet over port 8080?
159.x.x.7:8080
How can I troubleshoot what is happening?
proxy
routes
dns
reverse-proxy
ssh-tunnel
0 Answers
Your Answer