Maintaining Access
pwncat is an advanced, automated shell handler that extends the capabilities of traditional reverse or bind shells, offering built-in features for automated enumeration, persistence injection, and privilege escalation tracking.
pip install pwncat-cs
pwncat-cs [options]
pwncat is a modern post-exploitation framework that replaces traditional reverse shell handlers with a powerful, feature-rich platform. It provides automated enumeration, privilege escalation detection, file transfer, and persistence management through a modular architecture.
Unlike bare Netcat listeners, pwncat automatically upgrades raw shell access into a capable post-exploitation environment. It tracks privilege levels, records commands, and provides built-in modules for common post-exploitation tasks without requiring additional tools on the target.
pwncat's modular plugin system allows it to generate, upload, and execute custom payloads, enumerate system configurations, escalate privileges, and establish persistence. It is designed for penetration testers who need efficient post-exploitation capabilities without juggling multiple separate scripts.
pwncat-cs -lp 4444Listen on port 4444 to catch a reverse shell (netcat-style syntax)pwncat-cs bind://0.0.0.0:4444Start a reverse-shell catcher using the explicit bind protocolpwncat-cs :4444Shorthand to listen on all interfaces on port 4444pwncat-cs connect://10.10.10.10:4444Connect out to a bind shell listening on the targetpwncat-cs 10.10.10.10 4444Netcat-style connect to a target's bind shellpwncat-cs -m windows -lp 4444Catch a reverse shell and treat the target as a Windows hostpwncat-cs --ssl -lp 4444Catch an SSL-wrapped reverse shell with a self-signed certificatepwncat-cs ssl-bind://0.0.0.0:4444?certfile=/path/to/cert.pem&keyfile=/path/to/key.pemSSL bind listener using a supplied certificate and keypwncat-cs ssh://root:r00t5P@ssw0rd@10.10.10.10Open a managed session over SSH with inline credentialspwncat-cs root@10.10.10.10Connect over SSH (protocol assumed) prompting for the passwordpwncat-cs -i ./id_rsa root@10.10.10.10Connect over SSH using an identity/private-key filepwncat-cs -p 2222 user@10.10.10.10Connect over SSH on a non-standard portpwncat-cs --listList installed persistent implants that support remote reconnectionpwncat-cs 999c434fe6bd7383f1a6cc10f877644dReconnect to a target by its stored host ID via a persistence implantpwncat-cs reconnect://user@10.10.10.10Reconnect to a host using an installed implant for that userAutomated reverse shell handler with intelligent session management and command logging.
Automatically enumerate OS, users, network, processes, and privilege escalation vectors.
Detect and exploit privilege escalation paths with automated modules.
Install and verify persistence through cron, SSH keys, systemd, and other mechanisms.
Upload and download files between attacker and target through the established channel.
Track privilege escalation steps and maintain an audit trail of access levels gained.
Maintaining Access
Basic TCP/IP swiss army knife for shells and port scanning.
Maintaining Access
Advanced bidirectional relay for shells, forwarding, and SSL tunnels.
Exploitation
Full exploitation framework with Meterpreter for post-exploitation.
Post Exploitation
Linux privilege escalation auditing script for finding privesc vectors.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.