Package: pwncat-cs
pwncatpwncat is a post-exploitation platformfor Linux targets. It started out as a
wrapper around basic bind and reverse shells and has grown from there. It
streamlines common red team operations while staging code from your attacker
machine, not the target.pwncat used to only support Linux, but there has been a lot of work recently
to support multiple platforms. Currently, there is alpha support for Windows
targets. Please see the latestdocumentationfor details on how to use
pwncat with a Windows target.pwncat intercepts the raw communication with a remote shell and allows the
user to perform automated actions on the remote host including enumeration,
implant installation and even privilege escalation.After receiving a connection, pwncat will setup some common configurations
for working with remote shells.Disable history in the remote shellNormalize shell promptLocate useful binaries (usingwhich)Attempt to spawn a pseudo-terminal (pty) for a full interactive sessionpwncatknows how to spawn pty's with a few different methods and will
cross-reference the methods with the executables previously enumerated. After
spawning a pty, it will setup the controlling terminal in raw mode, so you can
interact in a similar fashion tossh.pwncatwill also synchronize the remote pty settings (such as rows, columns,TERMenvironment variable) with your local settings to ensure the shell
behaves correctly with interactive applications such asvimornano.John Hammond and I presentedpwncatat GRIMMCon. Our presentation, which
can be found on YouTubehere.
This video demonstrates an early version of the API and interface. Please
refer to the documentation for up to date usage and API documentation!pwncatdocumentationis being built out on Read the Docs. Head there for
the latest usage and development documentation!pwncat requires Python 3.9+ on LinuxInstallationpwncatonly depends on a working Python development environment running on Linux.
In order to install some of the packages required withpip, you will likely need
your distribution's "Python Development" package. On Debian based systems,
this ispython-dev. For Arch, the development files are shipped with the
main Python repository. For Enterprise Linux, the package is namedpython-devel.pwncatis pushed to PyPI under the namepwncat-cs, and can be installed withpiplike so:pipinstallpwncat-csHowever, it is recommended to install pwncat from a virtual environment.python3-mvenvpwncat-envsourcepwncat-env/bin/activate
pipinstallpwncat-csFor a development environment,pwncatusage Python Poetry. You can clone the
repository locally and use poetry to setup a development environment.# Setup pwncat inside a poetry-managed virtual environmentgitclonegit@github.com:calebstewart/pwncat.gitcdpwncat
poetryinstall# Enter the virtual environmentpoetryshellNaming ChangesDue to the naming conflict withCytopia's pwncat, I have
decided to rename the package topwncat-cs. This includes renaming the
entrypoint so that there are no direct conflicts with Cytopia's project. If you
are updating fromv0.4.*, the command name will now have changed, and thepcatandpcvarianst have been removed. See the most recent release notes for more
details.The added benefit of this move is that the project is now pushed to PyPI for
easier installation/updating in the future.Windows Supportpwncatnow supports connections from Windows targets starting atv0.4.0a1. The Windows
platform utilizes a .Net-based C2 library which is loaded automatically. Windows
targets should connect with either acmd.exeorpowershell.exeshell, and
pwncat will take care of the rest.The libraries implementing the C2 are implemented atpwncat-windows-c2.
The DLLs for the C2 will be automatically downloaded from the targeted release
for you. If you do not have internet connectivity on your target machine,
you can tell pwncat to pre-stage the DLLs using the--download-pluginsargument. If you are running a release version of pwncat, you can also download
a tarball of all built-in plugins from the releases page.The plugins are stored by default in~/.local/share/pwncat, however this is
configurable with theplugin_pathconfiguration. If you download the packaged
set of plugins from the releases page, you should extract it to the path pointed
to byplugin_path.Aside from the main C2 DLLs, other plugins may also be available. Currently,
the only provided default plugins are the C2 and an implementation ofBadPotato.
pwncat can reflectively load .Net binaries to be used a plugins for the C2.
For more information on Windows C2 plugins, please see thedocumentation.ModulesRecently, the architecture of the pwncat framework was redesigned to
incorporate a generic "module" structure. All functionality is now
implemented as modules. This includes enumeration, persistence and
privilege escalation. Interacting with modules is similar to most other
post-exploitation platforms. You can utilize the familiarrun,searchandinfocommands and enter module contexts with theusecommand.
Refer to the documentation for more information.BlackArch PackagingInstallation on BlackArch is as simple as:pacman-Syupwncat-calebConnecting to a VictimThe command line parameters for pwncat attempt to be flexible and accept
a variety of common connection syntax. Specifically, it will try to accept
common netcat and ssh like syntax. The following are all valid:# Connect to a bind shellpwncat-csconnect://10.10.10.10:4444
pwncat-cs10.10.10.10:4444
pwncat-cs10.10.10.104444# Listen for reverse shellpwncat-csbind://0.0.0.0:4444
pwncat-cs0.0.0.0:4444
pwncat-cs:4444
pwncat-cs-lp4444# Connect via sshpwncat-csssh://user:password@10.10.10.10
pwncat-csuser@10.10.10.10
pwncat-csuser:password@10.10.10.10
pwncat-cs-iid_rsauser@10.10.10.10# SSH w/ non-standard portpwncat-cs-p2222user@10.10.10.10
pwncat-csuser@10.10.10.10:2222# Reconnect utilizing installed persistence#   If reconnection fails and no protocol is specified,#   SSH is used as a fallback.pwncat-csreconnect://user@10.10.10.10
pwncat-csreconnect://user@c228fc49e515628a0c13bdc4759a12bf
pwncat-csuser@10.10.10.10
pwncat-csc228fc49e515628a0c13bdc4759a12bf
pwncat-cs10.10.10.10By default, pwncatassumes the target platform is Linux. In order to
connect to a Windows reverse or bind shell, you must pass the--platform/-margument:pwncat-cs-mwindows10.10.10.104444pwncat-cs-mwindows-lp4444For more information on the syntax and argument handling, see the
help information withpwncat-cs --helpor visit thedocumentation.Docker ImageThe recommended installation method is a Python virtual environment. This
provides the easiest day-to-day usage ofpwncat. However, there has been
interest in usingpwncatfrom a docker image, so I have provided a
Dockerfile which provides a workingpwncatinstallation. To build the image
use:dockerbuild-tpwncat.This will build thepwncatdocker image with the tag "pwncat". The working
directory within the container is/work. The entrypoint for the container
is thepwncatbinary. It can be used like so:# Connect to a bind shell at 10.0.0.1:4444dockerrun-v"/some/directory":/work-tpwncat10.0.0.14444In this example, only the files in/some/directoryare exposed to the container.
Obviously, for upload/download, the container will only be able to see the files
exposed through any mounted directories.Features and Functionalitypwncatprovides two main features. At it's core, it's goal is to automatically
setup a remote PseudoTerminal (pty) which allows interaction with the remote
host much like a full SSH session. When operating in a pty, you can use common
features of your remote shell such as history, line editing, and graphical
terminal applications.The other half ofpwncatis a framework which utilizes your remote shell to
perform automated enumeration, persistence and privilege escalation tasks. The
localpwncatprompt provides a number of useful features for standard
penetration tests including:File upload and downloadAutomated privilege escalation enumerationAutomated privilege escalation executionAutomated persistence installation/removalAutomated tracking of modified/created filespwncatalso offers the ability to revert these remote "tampers" automaticallyThe underlying framework for interacting with the remote host aims to abstract
away the underlying shell and connection method as much as possible, allowing
commands and plugins to interact seamlessly with the remote host.You can learn more about interacting withpwncatand about the underlying framework
in thedocumentation. If you have an idea for a new privilege escalation method
or persistence method, please take a look at the API documentation specifically.
Pull requests are welcome!Planned Featurespwncatwould like to be come a red team swiss army knife. Hopefully soon,
more features will be added.More privilege escalation methods (sudo -u#-1 CVE, LXD containers, etc.)Persistence methods (bind shell, cronjobs, SSH access, PAM abuse, etc.)Aggression methods (spam randomness to terminals, flush firewall, etc.)Meme methods (terminal-parrot, cowsay, wall, etc.)Network methods (port forward, internet access through host, etc.)Known IssuesBecausepwncatis trying to abstractly interact with any shell with minimal remote system
dependencies, there are some edge cases we have found. Where we find them, we do
everything we can to account for them and hide them from the user. However, some have
slipped through the cracks and been observed in the wild. When this happens,pwncatwill do whatever it can to preserve your terminal, but you may be greeted with some
peculiar output or command failures.BSD SupportWhile BSD is a Unix-based kernel, in practice it's userland tools are noticeably
different from their Linux counterparts. Due to this, many of the automated
features ofpwncatwill not work or outright fail when running against a BSD
based target. I have tried to catch all errors or edge cases, however there are
likely some hiccups which haven't been fully tested against BSD. In any case,
the stabilized shell should function within a BSD environment, but I don't
provide any guarantees.If I find some time later down the road, I may try to stabilizepwncaton BSD,
but for now my focus is on Linux-based distributions. If you'd like to
contribute to makingpwncatbehave better on BSD, you are more then welcome to
reach out or just fork the repo. As always, pull requests are welcome!