Remote port forwarding¶
Port forwarding is a pivoting feature of pwncat and works without the need of SSH.
How does it work?¶
Remote port forwarding is a double client proxie or double reverse connection. It works by connecting to the target machine/port and also connects to your listener and then bridging the connection.
Scenario:
- Alice cannot be reached from the Outside
- Alice is allowed to connect to the Outside (TCP/UDP)
- Bob can only be reached from Alice’s machine
- pwncat then connects to Bob (on Alice’s machine) and also to your listerner
| |
Outside | DMZ | private subnet
| |
| |
+-----------------+ TCP +-----------------+ TCP +-----------------+
| The cat | <----|----- | Alice | -----|----> | Bob |
| | | | pwncat | | | MySQL |
| 56.0.0.1 | | | 72.0.0.1:3306 | | | 10.0.0.1:3306 |
+-----------------+ | +-----------------+ | +-----------------+
pwncat -l 4444 | pwncat --reconn \ |
| -R 56.0.0.1:4444 \ |
| 10.0.0.1 3306 |
Examples¶
TCP remote port forwarding¶
The following example connects to a remote MySQL server (remote port 3306
) and then connects to another
pwncat/netcat server on 10.0.0.1:4444 and bridges the traffic.
pwncat -R 10.0.0.1:4444 everythingcli.org 3306
UDP remote port forwarding¶
Same as the TCP example, but convert traffic on your end to UDP
pwncat -R 10.0.0.1:4444 everythingcli.org 3306 -u