Mole
How It Works
⚠️ Authorized Testing Only
This tool interacts with live systems and must only be used for testing that has been explicitly authorized by the asset owner. Unauthorized use of this tool to probe, scan, exploit, or otherwise interact with systems you do not have written permission to test is illegal under computer fraud and abuse laws (CFAA, CMA, and international equivalents). pr0t31n does not condone or recommend any unauthorized use. Always obtain a signed Rules of Engagement (RoE) or Statement of Work (SoW) before beginning any assessment.
Mole is a Go-based transparent proxy client that establishes encrypted tunnels between a penetration testing appliance deployed on a target network and a remote command-and-control (C2) server. The tunnel carries SOCKS5 proxy traffic, allowing the tester's scanning tools to reach internal hosts through the deployed device as if they were on the local network.
The Mole binary is compiled for multiple platforms (Linux amd64/arm64, macOS amd64/arm64, Windows amd64). A Python launcher (mole.py) detects the host operating system and CPU architecture at runtime, selects the matching pre-compiled binary from its directory, and execs it directly — replacing the Python process so that signals (Ctrl+C) route to the Go binary and its exit code becomes the script's exit code. If the launcher is not already running as root/Administrator, it auto-elevates via sudo (Linux/macOS) or UAC (Windows).
Configuration is read from client.yaml, which specifies the C2 server address, port, authentication credentials, and tunnel parameters. A --check mode probes configured servers without making system-level changes, allowing operators to verify connectivity before committing to a full tunnel establishment.
Security
Requires root/Administrator for network configuration. Configuration in client.yaml specifies C2 server addresses and authentication tokens. Pre-compiled Go binaries — no source code modification needed on target.
Features
Configuration
Connectivity
Operations
Use Cases
Validating Firewall Egress Controls
During a penetration test, one of the most critical assessments is verifying that perimeter firewalls actually block unauthorized outbound traffic. Mole attempts to establish encrypted tunnels over various ports and protocols. If the tunnel succeeds, it demonstrates that the organization's egress filtering is insufficient to prevent an attacker from establishing persistent outbound communications from a compromised host.
Testing Data Exfiltration Controls
Once a Mole tunnel is established, the tester can demonstrate that data from the internal network can be exfiltrated through the encrypted channel. This directly tests the effectiveness of Data Loss Prevention (DLP) controls, network monitoring, and content inspection systems. A successful tunnel proves that encrypted exfiltration channels can bypass these controls undetected.
Verifying Network Segmentation
By deploying Mole on devices in different network segments, testers can verify whether segmentation controls prevent lateral C2 communication. If a device in a supposedly isolated VLAN can reach an external C2 server, the segmentation implementation has gaps that an attacker would exploit.
Post-Exploitation Lateral Movement
After gaining initial access to a target network, Mole enables the tester to proxy scanning tools through the compromised host to discover and assess additional internal systems. This demonstrates the real-world impact of an initial compromise and the attacker's ability to expand access across the network.
Incident Detection and Response Testing
The establishment and use of a Mole tunnel generates network artifacts (unusual outbound connections, encrypted traffic to unknown destinations, SOCKS5 proxy patterns) that a mature SOC should detect. Running Mole during a penetration test evaluates whether the organization's detection and response capabilities can identify covert C2 channels.
Remote Scanning Through Drop Devices
Mole is designed for use on drop devices (Raspberry Pi, small-form-factor PCs) deployed on-site during physical penetration tests. The tunnel allows the tester to conduct the entire internal assessment remotely, operating scanning tools from their workstation while traffic routes through the on-site device.
CLI Reference
Command Examples
Run Client
Auto-detect platform, elevate to root, and connect using client.yaml configuration.
Check Mode
Probe C2 servers for connectivity without making system changes.
Third-Party Tool Invocations
Commands and flags used when this tool invokes third-party dependencies during operation.
Integration
Depends On
- Mole-Client
- Mole-Server
Used By
- LandNav (traffic tunnelling)
Third-Party Dependencies & Credits
| Tool / Library | Developer | Type | Link |
|---|---|---|---|
| miekg/dns (Go) | Miek Gieben | go | https://github.com/miekg/dns |
Metadata
| Name | Mole |
| Category | Egress & Control |
| Version | 1.1.2 |
| Install Path | /opt/pr0t31n/Mole |
| Main File | main.go |
| GitHub | https://github.com/pr0t31n/Mole.git |
| Requires | Mole-Client, Mole-Server |