Local port forwarding¶

Port forwarding is a pivoting feature of pwncat and works without the need of SSH.

How does it work?¶

Scenario:

Alice can be reached from the Outside (TCP/UDP)
Bob can only be reached from Alice’s machine
pwncat makes Bob’s MySQL server available on Alice’s machine

                         |                               |
   Outside               |           DMZ                 |        private subnet
                         |                               |
                         |                               |
+-----------------+     TCP     +-----------------+     TCP     +-----------------+
| The cat         | -----|----> | Alice           | -----|----> | Bob             |
|                 |      |      | pwncat          |      |      | MySQL           |
| 56.0.0.1        |      |      | 72.0.0.1:3306   |      |      | 10.0.0.1:3306   |
+-----------------+      |      +-----------------+      |      +-----------------+
pwncat 72.0.0.1 3306     |      pwncat \                 |
                         |        -L 72.0.0.1:3306 \     |
                         |         10.0.0.1 3306         |

Examples¶

TCP remote port forwarding¶

The following examples makes a remote MySQL server (remote port 3306) available on current machine on every interface on port 5000

pwncat -L 0.0.0.0:5000 everythingcli.org 3306

UDP remote port forwarding¶

The following examples makes a remote MySQL server (remote port 3306) available on current machine on every interface on port 5000 and converts traffic on the pwncat listening side to UDP.

pwncat -L 0.0.0.0:5000 everythingcli.org 3306 -u