# pwncat pwncat is a raw bind and reverse shell handler. It streamlines common red team operations and all staging code is from your own attacker machine, not the target. After receiving a connection, **pwncat** will setup some common configurations when working with remote shells. - Unset the `HISTFILE` environment variable to disable command history - Normalize shell prompt - Locate useful binaries (using `which`) - Attempt to spawn a pseudoterminal (pty) for a full interactive session `pwncat` knows how to spawn pty's with a few different methods and will cross-reference the methods with the executables previously enumerated. After spawning a pty, it will setup the controlling terminal in raw mode, so you can interact in a similar fashion to `ssh`. `pwncat` will also synchronize the remote pty settings (such as rows, columns, `TERM` environment variable) with your local settings to ensure the shell behaves correctly. To showcase a little bit of the cool functionality, I have recorded a short [asciinema cast](https://asciinema.org/a/YFF84YCJfp9tQHhTuGkA2PJ4T). pwncat documentation is being built out on [Read the Docs]. Head there for the latest usage and development documentation! ## Install ### Dependencies The python3 development files are required for building python dependencies. All of the dependencies are managed through `pip`. To install **pwncat** into its own python virtual environment: ``` bash git clone https://github.com/calebstewart/pwncat/ # get pwncat cd pwncat $ sudo apt-get install python3-devel # install dependencies $ python3 -m venv .venv $ . .venv/bin/activate $ pip install -r requirements.txt $ python setup.py install ## Usage ```bash # start a reverse shell listener on port 9999 python -m pwncat -r -p 9999 ``` ```bash # access a bind shell on a given host and port python -m pwncat -b -H 127.0.0.1 -p 9999 ``` ## Features and Functionality **pwncat** allows you to local command interpreter at any time by getting to a blank line and pressing the sequence `~C` (that's ``Shift+` `` then `Shift+c`). This new prompt provides some basic interaction between your local host and the remote host. When at this prompt, you can return to your shell at any time with `C-d` or the "back" command. To get a list of available commands, you can use `help`. At the time of writing the following commands are supported: ``` (local) pwncat$ help back Exit command mode download Download a file from the remote host help View help for local commands privesc Attempt privilege escalation reset Reset the remote terminal (calls sync, reset, and sets PS1) set Set or view the currently assigned variables sync Synchronize the remote PTY with the local terminal settings upload Upload a file to the remote host ``` ### Transfering Files Within the local prompt, you have the capability to `upload` and `download` files to and from the target. **pwncat** will attempt to determine a `lhost` IP address to refer to your attacker machine, but if you need to change this, you can modify the variable like so: ```bash # change local host IP address if you need to (local) pwncat$ set lhost "8.8.8.8" ``` The logic to transfer files is defined in `pwncat/uploaders` and `pwncat/downloaders` respectively. **pwncat** will smartly determine a usable method to transfer files, but you can choose a specific one with the `--method` option. ```bash usage: upload [-h] [--method {nc,curl,shell,bashtcp,wget}] [--output OUTPUT] path positional arguments: path path to the file to upload optional arguments: -h, --help show this help message and exit --method, -m {nc,curl,shell,bashtcp,wget} set the download method (default: auto) --output OUTPUT, -o OUTPUT path to the output file (default: basename of input) ``` ```bash usage: download [-h] [--method {nc,curl,shell,bashtcp,raw}] [--output OUTPUT] path positional arguments: path path to the file to download optional arguments: -h, --help show this help message and exit --method, -m {nc,curl,shell,bashtcp,raw} set the download method (default: auto) --output OUTPUT, -o OUTPUT path to the output file (default: basename of input) ``` The methods that **pwncat** can transfer files with are as follows: ``` Both: nc netcat socket with random port -- requires port to be accessible curl HTTP request with port 80 -- requires curl on the target shell send echo and base64 -- no requirements, but can be slow bashtcp reuse the current socket -- no requirements Upload specific: wget HTTP request with port 80 -- requires wget on the target Download specific: raw read file contents and save to attacker -- no requirements ``` ### Privilege Escalation **pwncat** can attempt to perform privilege escalation with known techniques. It will look for binaries on the target system that have known GTFOBins capabilities, and perform different methods to try and reach new users and ultimately root. ```bash usage: privesc [-h] [--list] [--all] [--user {root,caleb,john,sean,etc}] [--max-depth MAX_DEPTH] [--read READ] [--write WRITE] [--data DATA] [--text] optional arguments: -h, --help show this help message and exit --list, -l do not perform escalation. list potential escalation methods --all, -a when listing methods, list for all users. when escalating, escalate to root. --user {root,caleb,john,sean,etc} the target user --max-depth MAX_DEPTH, -m MAX_DEPTH Maximum depth for the privesc search (default: no maximum) --read READ, -r READ remote filename to try and read --write WRITE, -w WRITE attempt to write to a remote file as the specified user --data DATA, -d DATA the data to write a file. ignored if not write mode --text, -t whether to use safe readers/writers ``` **pwncat** will try and run all known privilege escalation techniques. The current methods that are supported by `privesc` are: ``` sudo Run available sudo commands with GTFOBins techniques setuid Run available setuid binaries with GTFOBins techniques screen Abuse screen-4.5.0 (CVE-2017-5618) dirtycow Run DirtyCow exploit (CVE-2016-5195) ``` ### BusyBox If the target system does not have many useful "live-off-the-land" binaries, **pwncat** can upload an appropriate copy of `busybox` in order to access more commands. ## Planned Features **pwncat** would like to be come a red team swiss army knife. Hopefully soon, more features will be added. * More privilege escalation methods (sudo -u#-1 CVE, LXD containers, etc.) * More transfer file methods (FTP, SMB, DNS, ICMP, etc. ) * Persistence methods (bind shell, cronjobs, SSH access, PAM abuse, etc.) * Aggression methods (spam randomness to terminals, flush firewall, etc.) * Meme methods (terminal-parrot, cowsay, wall, etc.) * Network methods (port forward, internet access through host, etc.) [Read the Docs]: https://pwncat.readthedocs.io/en/latest