Mole-Client
How It Works
⚠️ Authorized Testing Only
This tool interacts with live systems and must only be used for testing that has been explicitly authorized by the asset owner. Unauthorized use of this tool to probe, scan, exploit, or otherwise interact with systems you do not have written permission to test is illegal under computer fraud and abuse laws (CFAA, CMA, and international equivalents). pr0t31n does not condone or recommend any unauthorized use. Always obtain a signed Rules of Engagement (RoE) or Statement of Work (SoW) before beginning any assessment.
Mole-Client is the Python launcher and management wrapper for the Mole transparent proxy system. It serves as the operator-facing entry point that handles platform detection, privilege elevation, configuration management, and binary lifecycle for the Mole Go-based tunnel agent.
When invoked, Mole-Client detects the host's operating system and CPU architecture, then maps this to the correct pre-compiled Mole binary (e.g., mole_linux_amd64, mole_darwin_arm64). It verifies the binary exists and has the correct execute permissions, injects the client.yaml configuration path if not explicitly provided, and then replaces itself with the binary via os.execv. This exec approach means the Go binary inherits the Python process's PID, ensuring clean signal delivery and accurate exit codes for any parent process or service manager.
If the launcher detects it is not running with root privileges, it automatically re-executes under sudo (Linux/macOS) or requests UAC elevation (Windows). This is necessary because the Mole binary requires elevated privileges to manipulate network routes and establish transparent proxy listeners. The --check mode allows operators to verify C2 server reachability without committing to system-level network changes.
Security
Python launcher that inherits Mole's security model. Handles platform detection and privilege elevation.
Features
Configuration
Operations
Platform
Use Cases
Validating Firewall Egress Controls
Mole-Client launches the tunnel agent that attempts to establish encrypted outbound connections to C2 servers. A successful connection proves that the organization's egress firewall rules do not adequately block unauthorized outbound traffic, which is one of the most fundamental network security controls an organization should have in place.
Testing Data Exfiltration Controls
By establishing an encrypted SOCKS5 tunnel through the Mole agent, the penetration tester can route arbitrary data from the internal network to an external server. This directly tests whether Data Loss Prevention (DLP) systems, network monitoring tools, and content inspection proxies can detect or prevent exfiltration through encrypted covert channels.
Verifying Network Segmentation
Deploying Mole-Client across different network segments validates whether segmentation controls prevent unauthorized outbound communications. If the agent can establish a tunnel from a supposedly restricted VLAN, it demonstrates that the segmentation architecture has exploitable gaps.
Demonstrating Post-Exploitation Impact
Mole-Client enables the tester to demonstrate that initial access to any host on the network can be leveraged into full remote access capability. Through the established tunnel, scanning tools can reach every host visible from the compromised device, illustrating the lateral movement potential of an attacker.
Testing Incident Detection Capabilities
The tunnel traffic generated by Mole produces detectable network artifacts: encrypted connections to unknown external IPs, sustained bidirectional data flow, and SOCKS5 proxy patterns. Whether the SOC detects and responds to this activity is a direct measure of the organization's incident detection and response maturity.
Drop Device Operations
Mole-Client is the primary launch mechanism for drop devices planted during physical penetration tests. The Python launcher handles the complexity of platform detection and privilege management, allowing the operator to deploy a single script across diverse hardware (Raspberry Pi, Intel NUC, etc.) with confidence that the correct binary will be selected.
CLI Reference
Command Examples
Launch
Auto-detect platform and launch the appropriate Mole binary.
Third-Party Tool Invocations
Commands and flags used when this tool invokes third-party dependencies during operation.
Invocation Methods
| Method | Usage |
|---|---|
| CLI — Direct |
cd /opt/pr0t31n/Mole-Client && python3 mole.py
Run directly with command-line arguments. |
Integration
Metadata
| Name | Mole-Client |
| Category | Egress & Control |
| Version | 1.1.1 |
| Install Path | /opt/pr0t31n/Mole-Client |
| Main File | mole.py |
| GitHub | https://github.com/pr0t31n/Mole-Client.git |