Mole-Server
How It Works
⚠️ Authorized Testing Only
This tool interacts with live systems and must only be used for testing that has been explicitly authorized by the asset owner. Unauthorized use of this tool to probe, scan, exploit, or otherwise interact with systems you do not have written permission to test is illegal under computer fraud and abuse laws (CFAA, CMA, and international equivalents). pr0t31n does not condone or recommend any unauthorized use. Always obtain a signed Rules of Engagement (RoE) or Statement of Work (SoW) before beginning any assessment.
Mole-Server is the installer and service manager for the Proxysuite SOCKS5 + DNS server daemon (moled). It deploys the server-side component of the Mole tunneling system on a Linux C2 server, enabling it to accept incoming connections from Mole client agents deployed on target networks.
The installer detects the host's OS and CPU architecture, selects the matching pre-compiled moled binary from its directory, and deploys it to /usr/local/bin/moled. It creates a dedicated service user (proxysuite), configuration directory (/etc/proxysuite/), and log directory (/var/log/proxysuite/). The server configuration (server-config.yaml) is deployed from the script's directory to the system config path.
For persistent operation, the installer creates a systemd service unit (proxysuite-server.service) that starts the daemon on boot and restarts it on failure. The --check mode verifies the installation state without making changes, while --uninstall cleanly removes the service, binary, and configuration. Currently supported on Linux x86_64 and ARM64 platforms.
Phase Pipeline
- Phase 1 — Binary Installation
- Phase 2 — Configuration Generation
- Phase 3 — Log Directory Setup
- Phase 4 — User Creation
- Phase 5 — Ownership Assignment
- Phase 6 — Service Registration
- Phase 7 — Service Start
Security
Server installer requiring root. Creates a dedicated unprivileged service user for the Mole service. Systemd service runs with minimum necessary permissions.
Features
Deployment
Networking
Operations
Use Cases
Establishing C2 Infrastructure for Egress Testing
Mole-Server provides the server-side infrastructure required for egress testing. Without a reliable, persistent server accepting connections, client-side egress tests cannot be conducted. The server must be deployed and operational before any Mole client can validate whether firewall egress controls block outbound tunneling attempts.
Validating Firewall Egress Controls
The Mole-Server daemon listens for inbound connections from Mole clients deployed inside target networks. A successful connection from a client to this server proves that the target's egress firewall rules do not block the specific port and protocol combination used. By configuring multiple listeners on different ports, the tester can systematically map which egress paths are open.
Testing Data Exfiltration Paths
Once a client tunnel is established to the Mole-Server, the server acts as the exfiltration endpoint. Data leaving the target network passes through the encrypted tunnel to the server. This tests the full exfiltration chain end-to-end, validating whether DLP controls, CASB solutions, or network monitoring can detect the outbound data transfer.
Persistent Remote Access Infrastructure
The systemd integration ensures the SOCKS5/DNS server is always available. During multi-day penetration test engagements, this persistence guarantees that remote scanning sessions are not interrupted by server reboots or process crashes, maintaining continuous access to target networks through deployed drop devices.
Supporting Network Segmentation Verification
By running Mole-Server and having clients attempt connections from various network segments, the tester can determine which segments have unrestricted outbound access. This maps the real egress posture across the organization's network topology.
Incident Detection Validation
The server-side logs record all inbound tunnel connections, providing the tester with a timeline of successful C2 establishment. This data is compared against the organization's SOC alerts to determine whether the detection team identified the covert C2 channels during the engagement.
CLI Reference
Command Examples
Install
Run the multi-phase server installer.
Third-Party Tool Invocations
Commands and flags used when this tool invokes third-party dependencies during operation.
Invocation Methods
| Method | Usage |
|---|---|
| CLI — Direct |
cd /opt/pr0t31n/Mole-Server && python3 Mole-Server-Install.py [OPTIONS]
Run directly with command-line arguments. |
Integration
Metadata
| Name | Mole-Server |
| Category | Egress & Control |
| Version | 1.0.0 |
| Install Path | /opt/pr0t31n/Mole-Server |
| Main File | Mole-Server-Install.py |
| GitHub | https://github.com/pr0t31n/Mole-Server.git |