forked from cytopia/pwncat
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathpwncat.man.html
561 lines (425 loc) · 19 KB
/
pwncat.man.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
<!-- Creator : groff version 1.22.4 -->
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta name="generator" content="groff -Thtml, see www.gnu.org">
<meta http-equiv="Content-Type" content="text/html; charset=US-ASCII">
<meta name="Content-Style" content="text/css">
<style type="text/css">
p { margin-top: 0; margin-bottom: 0; vertical-align: top }
pre { margin-top: 0; margin-bottom: 0; vertical-align: top }
table { margin-top: 0; margin-bottom: 0; vertical-align: top }
h1 { text-align: center }
</style>
<title>PWNCAT:</title>
</head>
<body>
<h1 align="center">PWNCAT:</h1>
<a href="#NAME">NAME</a><br>
<a href="#DESCRIPTION">DESCRIPTION</a><br>
<hr>
<h2>NAME
<a name="NAME"></a>
</h2>
<p style="margin-left:11%; margin-top: 1em">pwncat: −
pwncat</p>
<h2>DESCRIPTION
<a name="DESCRIPTION"></a>
</h2>
<p style="margin-left:11%; margin-top: 1em">usage: pwncat
[options] hostname port</p>
<p style="margin-left:22%; margin-top: 1em">pwncat
[options] <b>−l</b> [hostname] port pwncat [options]
<b>−z</b> hostname port pwncat [options]
<b>−L</b> [addr:]port hostname port pwncat [options]
<b>−R</b> addr:port hostname port pwncat
<b>−V</b>, <b>−−version</b> pwncat
<b>−h</b>, <b>−−help</b></p>
<p style="margin-left:11%; margin-top: 1em">Enhanced and
comptaible Netcat implementation written in Python (2 and 3)
with connect, zero−i/o, listen and forward modes and
techniques to detect and evade firewalls and intrusion
detection/prevention systems.</p>
<p style="margin-left:11%; margin-top: 1em">If no mode
arguments are specified, pwncat will run in connect mode and
act as a client to connect to a remote endpoint. If the
connection to the remote endoint is lost, pwncat will quit.
See options for how to automatically reconnect.</p>
<p style="margin-left:11%; margin-top: 1em"><b>positional
arguments:</b> <br>
hostname</p>
<p style="margin-left:22%;">Address to listen, forward,
scan or connect to.</p>
<table width="100%" border="0" rules="none" frame="void"
cellspacing="0" cellpadding="0">
<tr valign="top" align="left">
<td width="11%"></td>
<td width="6%">
<p>port</p></td>
<td width="5%"></td>
<td width="78%">
<p>[All modes] Single port to listen, forward or connect
to. [Zero−I/O mode] Specify multiple ports to scan:
Via list: 4444,4445,4446 Via range: 4444−4446 Via
incr: 4444+2</p></td></tr>
</table>
<p style="margin-left:11%; margin-top: 1em"><b>mode
arguments: <br>
−l</b>, <b>−−listen</b></p>
<p style="margin-left:22%;">[Listen mode]: Start a server
and listen for incoming connections. If using TCP and a
connected client disconnects or the connection is
interrupted otherwise, the server will quit. See
<b>−k</b>/−−keep−open to change this
behaviour.</p>
<p style="margin-left:11%;"><b>−z</b>,
<b>−−zero</b></p>
<p style="margin-left:22%;">[Zero−I/0 mode]: Connect
to a remote endpoint and report status only. Used for port
scanning. See <b>−−banner</b> for version
detection.</p>
<p style="margin-left:11%;"><b>−L</b> [addr:]port,
<b>−−local</b> [addr:]port</p>
<p style="margin-left:22%;">[Local forward mode]: This mode
will start a server and a client internally. The internal
server will listen locally on specified addr/port (given by
<b>−−local</b> [addr:]port). The server will
then forward traffic to the internal client which connects
to another server specified by hostname/port given via
positional arguments. (I.e.: proxies a remote service to a
local address)</p>
<p style="margin-left:11%;"><b>−R</b> addr:port,
<b>−−remote</b> addr:port</p>
<p style="margin-left:22%;">[Remote forward mode]: This
mode will start two clients internally. One is connecting to
the target and one is connecting to another pwncat/netcat
server you have started somewhere. Once connected, it will
then proxy traffic between you and the target. This mode
should be applied on machines that block incoming traffic
and only allow outbound. The connection to your listening
server is given by <b>−R</b>/−−remote
addr:port and the connection to the target machine via the
positional arguments.</p>
<p style="margin-left:11%; margin-top: 1em"><b>optional
arguments: <br>
−e</b> cmd, <b>−−exec</b> cmd</p>
<p style="margin-left:22%;">Execute shell command. Only for
connect or listen mode.</p>
<p style="margin-left:11%;"><b>−C</b> lf,
<b>−−crlf</b> lf</p>
<p style="margin-left:22%;">Specify, ’lf’,
’crlf’ or ’cr’ to always force
replacing line endings for input and outout accordingly.
Specify ’no’ to completely remove any line
feeds. By default it will not replace anything and takes
what is entered (usually CRLF on Windows, LF on Linux and
some times CR on MacOS).</p>
<p style="margin-left:11%;"><b>−n</b>,
<b>−−nodns</b></p>
<p style="margin-left:22%;">Do not resolve DNS.</p>
<p style="margin-left:11%;"><b>−−send−on−eof</b></p>
<p style="margin-left:22%;">Buffer data received on stdin
until EOF and send everything in one chunk.</p>
<p style="margin-left:11%;"><b>−−no−shutdown</b></p>
<p style="margin-left:22%;">Do not shutdown into
half−duplex mode. If this option is passed, pwncat
won’t invoke shutdown on a socket after seeing EOF on
stdin. This is provided for backward−compatibility
with OpenBSD netcat, which exhibits this behavior.</p>
<p style="margin-left:11%;"><b>−v</b>,
<b>−−verbose</b></p>
<p style="margin-left:22%;">Be verbose and print info to
stderr. Use <b>−v</b>, <b>−vv</b>,
<b>−vvv</b> or <b>−vvvv</b> for more verbosity.
The server performance will decrease drastically if you use
more than three times.</p>
<p style="margin-left:11%;"><b>−−info</b>
type</p>
<p style="margin-left:22%;">Show additional info about
sockets, IPv4/6 or TCP opts applied to the current socket
connection. Valid parameter are ’sock’,
’ipv4’, ’ipv6’, ’tcp’ or
’all’. Note, you must at least be in INFO
verbose mode in order to see them (<b>−vv</b>).</p>
<p style="margin-left:11%;"><b>−c</b> str,
<b>−−color</b> str</p>
<p style="margin-left:22%;">Colored log output. Specify
’always’, ’never’ or
’auto’. In ’auto’ mode, color is
displayed as long as the output goes to a terminal. If it is
piped into a file, color will automatically be disabled.
This mode also disables color on Windows by default.
(default: auto)</p>
<p style="margin-left:11%;"><b>−−safe−word</b>
str</p>
<p style="margin-left:22%;">All modes: If pwncat is started
with this argument, it will shut down as soon as it receives
the specified string. The
<b>−−keep−open</b> (server) or
<b>−−reconn</b> (client) options will be ignored
and it won’t listen again or reconnect to you. Use a
very unique string to not have it shut down accidentally by
other input.</p>
<p style="margin-left:11%; margin-top: 1em"><b>protocol
arguments:</b></p>
<table width="100%" border="0" rules="none" frame="void"
cellspacing="0" cellpadding="0">
<tr valign="top" align="left">
<td width="11%"></td>
<td width="3%">
<p><b>−4</b></p></td>
<td width="8%"></td>
<td width="75%">
<p>Only Use IPv4 (default: IPv4 and IPv6 dualstack).</p></td>
<td width="3%">
</td></tr>
<tr valign="top" align="left">
<td width="11%"></td>
<td width="3%">
<p><b>−6</b></p></td>
<td width="8%"></td>
<td width="75%">
<p>Only Use IPv6 (default: IPv4 and IPv6 dualstack).</p></td>
<td width="3%">
</td></tr>
</table>
<p style="margin-left:11%;"><b>−u</b>,
<b>−−udp</b></p>
<p style="margin-left:22%;">Use UDP for the connection
instead of TCP.</p>
<p style="margin-left:11%;"><b>−T</b> str,
<b>−−tos</b> str</p>
<p style="margin-left:22%;">Specifies IP Type of Service
(ToS) for the connection. Valid values are the tokens
’mincost’, ’lowcost’,
’reliability’, ’throughput’ or
’lowdelay’.</p>
<table width="100%" border="0" rules="none" frame="void"
cellspacing="0" cellpadding="0">
<tr valign="top" align="left">
<td width="11%"></td>
<td width="9%">
<p><b>−−http</b></p></td>
<td width="2%"></td>
<td width="78%">
<p>Connect / Listen mode (TCP and UDP): Hide traffic in
http packets to fool Firewalls/IDS/IPS.</p></td></tr>
</table>
<p style="margin-left:11%;"><b>−−https</b></p>
<p style="margin-left:22%;">Connect / Listen mode (TCP and
UDP): Hide traffic in https packets to fool
Firewalls/IDS/IPS.</p>
<p style="margin-left:11%;"><b>−H</b> [str [str
...]], <b>−−header</b> [str [str ...]]</p>
<p style="margin-left:22%;">Add HTTP headers to your
request when using <b>−−http</b>(s).</p>
<p style="margin-left:11%; margin-top: 1em"><b>command
& control arguments: <br>
−−self−inject</b> cmd:host:port[s]</p>
<p style="margin-left:22%;">Listen mode (TCP only): If you
are about to inject a reverse shell onto the victim machine
(via php, bash, nc, ncat or similar), start your listening
server with this argument. This will then (as soon as the
reverse shell connects) automatically deploy and
background−run an unbreakable pwncat reverse shell
onto the victim machine which then also connects back to you
with specified arguments. Example:
’−−self−inject
/bin/bash:10.0.0.1:4444’ It is also possible to launch
multiple reverse shells by specifying multiple ports. Via
list: <b>−−self−inject</b>
/bin/sh:10.0.0.1:4444,4445,4446 Via range:
<b>−−self−inject</b>
/bin/sh:10.0.0.1:4444−4446 Via incr:
<b>−−self−inject</b>
/bin/sh:10.0.0.1:4444+2 Note: this is currently an
experimental feature and does not work on Windows remote
hosts yet.</p>
<p style="margin-left:11%; margin-top: 1em"><b>pwncat
scripting engine: <br>
−−script−send</b> file</p>
<p style="margin-left:22%;">All modes (TCP and UDP): A
Python scripting engine to define your own custom
transformer function which will be executed before sending
data to a remote endpoint. Your file must contain the exact
following function which will: be applied as the
transformer: def transform(data, pse):</p>
<p style="margin-left:11%;"># NOTE: the function name must
be ’transform’</p>
<p style="margin-left:22%;"># NOTE: the function param name
must be ’data’ # NOTE: indentation must be 4
spaces # ... your transformations goes here return data</p>
<p style="margin-left:11%;">You can also define as many
custom functions or classes</p>
<p style="margin-left:22%;">within this file, but ensure to
prefix them uniquely to not collide with pwncat’s
function or classes, as the file will be called with
exec().</p>
<p style="margin-left:11%;"><b>−−script−recv</b>
file</p>
<p style="margin-left:22%;">All modes (TCP and UDP): A
Python scripting engine to define your own custom
transformer function which will be executed after receiving
data from a remote endpoint. Your file must contain the
exact following function which will: be applied as the
transformer: def transform(data, pse):</p>
<p style="margin-left:11%;"># NOTE: the function name must
be ’transform’</p>
<p style="margin-left:22%;"># NOTE: the function param name
must be ’data’ # NOTE: indentation must be 4
spaces # ... your transformations goes here return data</p>
<p style="margin-left:11%;">You can also define as many
custom functions or classes</p>
<p style="margin-left:22%;">within this file, but ensure to
prefix them uniquely to not collide with pwncat’s
function or classes, as the file will be called with
exec().</p>
<p style="margin-left:11%; margin-top: 1em"><b>zero-i/o
mode arguments: <br>
−−banner</b></p>
<p style="margin-left:22%;">Zero−I/O (TCP and UDP):
Try banner grabbing during port scan.</p>
<p style="margin-left:11%; margin-top: 1em"><b>listen mode
arguments: <br>
−k</b>, <b>−−keep−open</b></p>
<p style="margin-left:22%;">Listen mode (TCP only):
Re−accept new clients in listen mode after a client
has disconnected or the connection is unterrupted otherwise.
(default: server will quit after connection is gone)</p>
<p style="margin-left:11%;"><b>−−rebind</b>
[x]</p>
<p style="margin-left:22%;">Listen mode (TCP and UDP): If
the server is unable to bind, it will re−initialize
itself x many times before giving up. Omit the quantifier to
rebind endlessly or specify a positive integer for how many
times to rebind before giving up. See
<b>−−rebind−robin</b> for an interesting
use−case. (default: fail after first unsuccessful
try).</p>
<p style="margin-left:11%;"><b>−−rebind−wait</b>
s</p>
<p style="margin-left:22%;">Listen mode (TCP and UDP): Wait
x seconds between re−initialization. (default: 1)</p>
<p style="margin-left:11%;"><b>−−rebind−robin</b>
port</p>
<p style="margin-left:22%;">Listen mode (TCP and UDP): If
the server is unable to initialize (e.g: cannot bind and
<b>−−rebind</b> is specified, it it will shuffle
ports in round−robin mode to bind to. Use comma
separated string such as ’80,81,82,83’, a range
of ports ’80−83’ or an increment
’80+3’. Set <b>−−rebind</b> to at
least the number of ports to probe +1 This option requires
<b>−−rebind</b> to be specified.</p>
<p style="margin-left:11%; margin-top: 1em"><b>connect mode
arguments: <br>
−−source−addr</b> addr</p>
<p style="margin-left:22%;">Specify source bind IP address
for connect mode.</p>
<p style="margin-left:11%;"><b>−−source−port</b>
port</p>
<p style="margin-left:22%;">Specify source bind port for
connect mode.</p>
<p style="margin-left:11%;"><b>−−reconn</b>
[x]</p>
<p style="margin-left:22%;">Connect mode (TCP and UDP): If
the remote server is not reachable or the connection is
interrupted, the client will connect again x many times
before giving up. Omit the quantifier to retry endlessly or
specify a positive integer for how many times to retry
before giving up. (default: quit if the remote is not
available or the connection was interrupted) This might be
handy for stable TCP reverse shells ;−) Note on UDP:
By default UDP does not know if it is connected, so it will
stop at the first port and assume it has a connection.
Consider using <b>−−udp−sconnect</b> with
this option to make UDP aware of a successful
connection.</p>
<p style="margin-left:11%;"><b>−−reconn−wait</b>
s</p>
<p style="margin-left:22%;">Connect mode (TCP and UDP):
Wait x seconds between re−connects. (default: 1)</p>
<p style="margin-left:11%;"><b>−−reconn−robin</b>
port</p>
<p style="margin-left:22%;">Connect mode (TCP and UDP): If
the remote server is not reachable or the connection is
interrupted and <b>−−reconn</b> is specified,
the client will shuffle ports in round−robin mode to
connect to. Use comma separated string such as
’80,81,82,83’, a range of ports
’80−83’ or an increment
’80+3’. Set <b>−−reconn</b> to at
least the number of ports to probe +1 This helps reverse
shell to evade intrusiona prevention systems that will cut
your connection and block the outbound port. This is also
useful in Connect or Zero−I/O mode to figure out what
outbound ports are allowed.</p>
<p style="margin-left:11%;"><b>−−ping−init</b></p>
<p style="margin-left:22%;">Connect mode (TCP and UDP): UDP
is a stateless protocol unlike TCP, so no handshake
communication takes place and the client just sends data to
a server without being "accepted" by the server
first. This means a server waiting for an UDP client to
connect to, is unable to send any data to the client, before
the client hasn’t send data first. The server simply
doesn’t know the IP address before an initial connect.
The <b>−−ping−init</b> option instructs
the client to send one single initial ping packet to the
server, so that it is able to talk to the client. This is a
way to make a UDP reverse shell work. See
<b>−−ping−word</b> for what char/string to
send as initial ping packet (default: ’\0’)</p>
<p style="margin-left:11%;"><b>−−ping−intvl</b>
s</p>
<p style="margin-left:22%;">Connect mode (TCP and UDP):
Instruct the client to send ping intervalls every s sec.
This allows you to restart your UDP server and just wait for
the client to report back in. This might be handy for stable
UDP reverse shells ;−) See
<b>−−ping−word</b> for what char/string to
send as initial ping packet (default: ’\0’)</p>
<p style="margin-left:11%;"><b>−−ping−word</b>
str</p>
<p style="margin-left:22%;">Connect mode (TCP and UDP):
Change the default character ’\0’ to use for upd
ping. Single character or strings are supported.</p>
<p style="margin-left:11%;"><b>−−ping−robin</b>
port</p>
<p style="margin-left:22%;">Connect mode (TCP and UDP):
Instruct the client to shuffle the specified ports in
round−robin mode for a remote server to ping. This
might be handy to scan outbound allowed ports. Use comma
separated string such as ’80,81,82,83’, a range
of ports ’80−83’ or an increment
’80+3’. Use
<b>−−ping−intvl</b> 0 to be faster.</p>
<p style="margin-left:11%;"><b>−−udp−sconnect</b></p>
<p style="margin-left:22%;">Connect mode (UDP only):
Emulating stateful behaviour for UDP connect phase by
sending an initial packet to the server to validate if it is
actually connected. By default, UDP will simply issue a
connect and is not aware if it is really connected or not.
The default connect packet to be send is ’\0’,
you can change this with
<b>−−udp−sconnect−word</b>.</p>
<p style="margin-left:11%;"><b>−−udp−sconnect−word</b>
[str]</p>
<p style="margin-left:22%;">Connect mode (UDP only): Change
the the data to be send for UDP stateful connect behaviour.
Note you can also omit the string to send an empty packet
(EOF), but be aware that some servers such as netcat will
instantly quit upon receive of an EOF packet. The default is
to send a null byte sting: ’\0’.</p>
<p style="margin-left:11%; margin-top: 1em"><b>misc
arguments: <br>
−h</b>, <b>−−help</b></p>
<p style="margin-left:22%;">Show this help message and
exit</p>
<p style="margin-left:11%;"><b>−V</b>,
<b>−−version</b></p>
<p style="margin-left:22%;">Show version information and
exit</p>
<hr>
</body>
</html>