R2Socks

SOCKS5 proxy tunneled through Cloudflare R2 buckets.

[Client App] ◄─SOCKS5─► [Proxy] ◄─── R2 Bucket ───► [Agent] ◄─TCP─► [Target]

The proxy runs a local SOCKS5 server on the operator's machine. Every CONNECT request is serialized as binary packets and stored as R2 objects. The agent polls the same bucket from the target network, picks up connection requests, establishes real TCP connections, and relays data back through R2.

Components

The C++ agent is protocol-compatible with the Python proxy. It uses only Windows-native APIs (WinHTTP, bcrypt, Winsock2) no external libraries required.

Quick Start

1. Create an R2 Bucket

1. Go to Cloudflare Dashboard → R2 Object Storage
2. Click Create bucket and give it a name
3. Note your Account ID from the URL: dash.cloudflare.com/<ACCOUNT_ID>/r2/...

2. Create an R2 API Token

1. In R2 → Manage R2 API Tokens → Create API Token
2. Set permissions to Object Read & Write
3. Select your bucket (or all buckets)
4. Copy the Access Key ID and Secret Access Key (shown only once)

3. Start the Proxy

pip install boto3
python r2socks.py proxy -b my-bucket -a <account_id> \
    --access-key <R2_ACCESS_KEY> --secret-key <R2_SECRET_KEY>

The proxy generates a channel ID and prints the command to start the agent.

4. Start the Agent

Python agent:

python r2socks.py agent -b my-bucket -a <account_id> -c <channel_id> \
    --access-key <R2_ACCESS_KEY> --secret-key <R2_SECRET_KEY>

C++ agent (Windows):

.\r2agent.exe -b my-bucket -a <account_id> -c <channel_id> -k <access_key> -s <secret_key>

Usage

Proxy (Operator Side)

python r2socks.py proxy [options]

Required:
  -b, --bucket BUCKET         R2 bucket name
  -a, --account-id ID         Cloudflare account ID

Optional:
  -c, --channel ID            Channel ID (auto-generated if omitted)
  -l, --listen ADDR           Listen address (default: 127.0.0.1:1080)
  --access-key KEY            R2 API token Access Key ID
  --secret-key KEY            R2 API token Secret Access Key
  --socks-user USER           Enable SOCKS5 user/pass authentication
  --socks-pass PASS           SOCKS5 password
  -p, --password PWD          AES-256-GCM encryption password
  -v, --verbose               Debug logging

Agent (Target Side)

Python:

python r2socks.py agent [options]

Required:
  -b, --bucket BUCKET         R2 bucket name
  -a, --account-id ID         Cloudflare account ID
  -c, --channel ID            Channel ID (from proxy output)

C++ (Windows):

r2agent.exe [options]

Required:
  -b, --bucket BUCKET         R2 bucket name
  -a, --account-id ID         Cloudflare account ID
  -c, --channel ID            Channel ID (from proxy output)

Credentials (flags override env vars):
  -k, --access-key KEY        R2 API token Access Key ID
  -s, --secret-key KEY        R2 API token Secret Access Key

Optional:
  -v, --verbose               Debug logging

Cleanup

Remove all R2 objects from a channel when done:

python r2socks.py clean -b my-bucket -a <account_id> -c <channel_id>

Protocol

Binary packet format shared between proxy and agent:

┌──────────┬────────────────────┬────────────┬──────────────────┐
│ CMD (1B) │ ConnectionID (16B) │ Len (4B BE)│ Payload (var)    │
└──────────┴────────────────────┴────────────┴──────────────────┘

Multiple packets are batched into a single R2 object (up to 4MB) to reduce API calls. Objects are named with microsecond timestamps for ordering and deleted after consumption.

Encryption

Optional AES-256-GCM encryption for all R2 payloads:

pip install cryptography

# Both sides must use the same password
python r2socks.py proxy -b bucket -a account_id -p "my-secret-password"
python r2socks.py agent -b bucket -a account_id -c channel -p "my-secret-password"

The key is derived using PBKDF2-SHA256 with 600,000 iterations.

Building the C++ Agent

From a Visual Studio Developer Command Prompt:

cl /std:c++17 /EHsc /O2 r2agent.cpp /link ws2_32.lib winhttp.lib bcrypt.lib

Adaptive Polling

Both proxy and agent use adaptive sleep intervals:

• Active traffic: Polls every 50ms for low latency
• Idle: Interval grows by 1.3x each cycle, up to 2 seconds max
• Traffic resumes: Interval drops by 0.5x, back to 50ms quickly

This balances responsiveness against API call volume. Stats are logged every 30 seconds showing active connections, objects transferred, and bytes moved.

Troubleshooting

SignatureDoesNotMatch

• Verify your R2 API token credentials are correct
• Ensure the token has Object Read & Write permissions on the bucket
• Check system clock: w32tm /resync /force (Windows) or sudo ntpdate pool.ntp.org (Linux)

RequestTimeTooSkewed

• System clock is out of sync. Sync it:
  root@kitploit:~

  w32tm /resync /force
  

AccessDenied

• The API token may lack permissions on the target bucket
• Regenerate the token with Object Read & Write on the correct bucket

Requirements

Proxy (Python):

• Python 3.8+
• boto3 (required)
• cryptography (optional, for encryption)

Agent (C++):

• Windows 10/11
• No runtime dependencies