Socat Usage Series Here Also

As we know there are many tools that can help the user to transfer data.

Similarly, we are going to take advantage of another command i.e.

So, now we will take this benefit of socat in our mission of privilege Escalation.

Here we do not criticize any kind of misconfiguration that a network or system administrator does for providing higher permissions on any programsbinariesfiles etc.

The first thing you will notice with this tool is that it has a different syntax on what you are used to with netcat or other standard Unix tools.

Lets first start with the address, since the address is the keystone aspect of socat.

Entreating socat without any addresses results in a note as shown below.

Some of popular selections are TCP4, CREATE, EXEC, STDIN, STDOUT, PIPE, UDP4 etc, where the names are pretty self-understandable.

Similarly - is one such alias which is used to represent STDIO.

You can also use its man page to view lists of all other aliases.

Now, I will start to establish a connection between two machines and will transfer messages between both of them.

In below image we have done this for kali which is acting as a listener and ready to take all of the commands that are ordered by ubuntu as shown below by framing command.

Here in this tutorial, I wish to take the shell of ubuntu on kali terminal by EXEC type.

After running listener on ubuntu now we will use socat command on kali by specifying the IP and port of the machine (ubuntu) which will help us to take the shell of ubuntu on kali as per our request.

As in below image you can see, it has directed us as user raj which is a user of ubuntu.

Socat Usage Series Here Also

For this alike another command from Linux for pentester series here also first we need to set up our lab of socat command with administrative rights.

For this very first we must have sessions of a victims machine then only we can execute this task.

Then we look for sudo right for test user (if given) and found that user test can execute the socat command as root without a password.