This is a universal advice and not only works with pwncat, but with all other common tools.

When connected with a reverse or bind shell you'll notice that no interactive commands will work and hitting Ctrl+c will terminate your session. To fix this, you'll need to attach it to a TTY (make it interactive). Here's how:

Ctrl+z

^{[1] Reverse Shell Cheatsheet}

Without tricks a UDP reverse shell is not really possible. UDP is a stateless protocol compared to TCP and does not have a connect() method as TCP does. In TCP mode, the server will know the client IP and port, once the client issues a connects(). In UDP mode, as there is no connect(), the client simply sends data to an address/port without having to connect first. Therefore, in UDP mode, the server will not be able to know the IP and port of the client and hence, cannot send data to it first. The only way to make this possible is to have the client send some sort of data to the server first, so that the server can see what IP/port has sent data to it.

pwncat emulates the TCP connect() by having the client send a null byte to the server once or periodically via --ping-intvl or --ping-init.

Why unbreakable? Because it will keep coming back to you, even if you kill your listening server temporarily. In other words, the client will keep trying to connect to the specified server until success. If the connection is interrupted, it will keep trying again.

Why unbreakable? Because it will keep coming back to you, even if you kill your listening server temporarily. In other words, the client will keep sending null bytes to the server to constantly announce itself.

Let's imagine you are able to create a very simple and unstable reverse shell from the target to your machine, such as a web shell via a PHP script or similar. Knowing, that this will not persist very long or might break due to unstable network connection, you could use pwncat to hook into this connection and deploy itself unbreakably on the target - fully automated.

View on Youtube

All you have to do, is use pwncat as your local listener and start it with the --self-inject switch. As soon as the client (e.g.: the reverse web shell) connects to it, it will do a couple of things:

1. Enumerate Python availability and versions on the target
2. Dump itself base64 encoded onto the target
3. Use the target's Python to decode itself.
4. Use the target's Python to start itself as an unbreakable reverse shell back to you

Once this is done, you can keep using the current connection or simply abandon it and start a new listener (yes, you don't need to start the listener before starting the reverse shell) to have the new pwncat client connect to you. The new listener also doesn't have to be pwncat, it can also be netcat or ncat.

The --self-inject switch:

• : This is the command to start on the target (like -e/--exec, so you want it to be cmd.exe or /bin/bash)
• : This is for your local machine, the IP address to where the reverse shell shall connect back to
• : This is for your local machine, the port on which the reverse shell shall connect back to

So imagine your Kali machine is 10.0.0.1. You instruct your webshell that you inject onto a Linux server to connect to you at port 4444:

You will then see something like this:

And you are set. You can now start another listener locally at 4445 (again, it will connect back to you endlessly, so it is not required to start the listener first).

Instead of just asking for a single self-injecting reverse shell, you can instruct pwncat to spawn as many unbreakable reverse shells connecting back to you as you desire.

View on Youtube

The --self-inject argument allows you to not only define a single port, but also

1. A comma separated list of ports: 4445,4446,4447,4448
2. A range definition: 4446-4448
3. An increment: 4445+3

In order to spawn 4 reverse shells you would start your listener just as described above, but instead of a single port, you define multiple:

Each of the above three commands will achieve the same behaviour: spawning 4 reverse shells inside the target. Once the client connects, the output will look something like this:

Note: Ensure you have a reverse shell that keeps coming back to you. This way you can always change your logging settings without loosing the shell.

If you feel like, you can start a listener in full TRACE logging mode to figure out what's going on or simply to troubleshoot. Log message are colored depending on their severity. Colors are automatically turned off, if stderr is not a pty, e.g.: if piping those to a file. You can also manually disable colored logging for terminal outputs via the --color switch.

You will see (among all the gibberish) a TRACE message:

As soon as you saw this on the listener, you can issue commands to the client. All the debug messages are also not necessary, so you can safely Ctrl+c terminate your server and start it again in silent mode:

Now wait a maximum a few seconds, depending at what interval the client comes back to you and voila, your session is now again without logs.

Having no info messages at all, is also sometimes not desirable. You might want to know what is going on behind the scences or? Safely Ctrl+c terminate your server and redirect the notifications to a logfile:

Now all you'll see in your terminal session are the actual command inputs and outputs. If you want to see what's going on behind the scene, open a second terminal window and tail the comm.txt file:

Another useful feature is to display currently configured socket and network settings. Use the --info switch with either socket, ipv4, ipv6, tcp or all to display all available settings.

Note: In order to view those settings, you must at least be at INFO log level (-vv).

An example output in IPv4/TCP mode without any custom settings is shown below:

Scenario

1. Alice can be reached from the Outside (TCP/UDP)
2. Bob can only be reached from Alice's machine

Scenario

1. Alice can be reached from the Outside (but only via UDP)
2. Bob can only be reached from Alice's machine

Scenario

1. Alice cannot be reached from the Outside
2. Alice is allowed to connect to the Outside (TCP/UDP)
3. Bob can only be reached from Alice's machine

Scenario

1. Alice cannot be reached from the Outside
2. Alice is allowed to connect to the Outside (UDP: DNS only)
3. Bob can only be reached from Alice's machine

If you have no idea what outbound ports are allowed from the target machine, you can instruct the client (e.g.: in case of a reverse shell) to probe outbound ports endlessly.

Once the client is up and running, either use raw sockets to check for inbound traffic or use something like Wireshark or tcpdump to find out from where the client is able to connect back to you,

If you found one or more ports that the client is able to connect to you, simply start your listener locally and wait for it to come back.

If the client connects to you, you will have a working reverse shell. If you stop your local listening server accidentally or on purpose, the client will probe ports again until it connects successfully. In order to kill the reverse shell client, you can use --safe-word (when starting the client).

If none of this succeeds, you can add other measures such as using UDP or even wrapping your packets into higher level protocols, such as HTTP or others. See PSE or examples below for how to transform your traffic.

pwncat offers a Python based scripting engine to inject your custom code before sending and after receiving data.

You will simply need to provide a Python file with the following entrypoint function:

Both, the function name must be named transform and the parsed arguments must be named data and pse. Other than that you can add as much code as you like. Each instance of pwncat can take two scripts:

1. --script-send: script will be applied before sending
2. --script-recv: script will be applied after receiving

See here for API and more details

PSE: asym-enc source code

This will encrypt your traffic asymmetrically. It is just a very basic ROT13 implementation with different shift lengths on both sides to emulate asymmetry. You could do the same and implement GPG based asymmetric encryption for PSE.

PSE: http-post source code

This will wrap all traffic into a valid HTTP POST request, making it look like normal HTTP traffic.

The following UDP ports are exposing:

See complete FAQ here: https://docs.pwncat.org/en/latest/faq.html

Q: Is pwncat compatible with netcat?

A: Yes, it is fully compatible in the way it behaves in connect, listen and zero-i/o mode. You can even mix pwncat with netcat, ncat or similar tools.

Q: Does it work on X?

A: In its current state it works with Python 2, 3 pypy2 and pypy3 and is fully tested on Linux and MacOS. Windows support is available, but is considered experimental (see integration tests).

Q: I found a bug / I have to suggest a new feature! What can I do?

A: For bug reports or enhancements, please open an issue here.

Q: How can I support this project?

A: Thanks for asking! First of all, star this project to give me some feedback and see CONTRIBUTING.md for details.

Type	Artist	Image	License
Logo	maifz
Banner 1	maifz
Banner 2	maifz

Below is a list of sec tools and docs I am maintaining.

Name	Category	Language	Description
offsec	Documentation	Markdown	Offsec checklist, tools and examples
header-fuzz	Enumeration	Bash	Fuzz HTTP headers
smtp-user-enum	Enumeration	Python 2+3	SMTP users enumerator
urlbuster	Enumeration	Python 2+3	Mutable web directory fuzzer
pwncat	Pivoting	Python 2+3	Cross-platform netcat on steroids
kusanagi	Payload Generator	Python 3	Bind- and Reverse shell payload generator
badchars	Reverse Engineering	Python 2+3	Badchar generator
fuzza	Reverse Engineering	Python 2+3	TCP fuzzing tool
docker-dvwa	Playground	PHP	DVWA with local priv esc challenges

See Contributing guidelines to help to improve this project.

This tool may be used for legal purposes only. Users take full responsibility for any actions performed using this tool. The author accepts no liability for damage caused by this tool. If these terms are not acceptable to you, then do not use this tool.

MIT License

Copyright (c) 2020 cytopia