samyk / pwnat Goto Github PK

In that, 60 other people could be sharing the same public IP address? Assume it would...

I'd like to use this as an external library for some Racket code I'm writing. What license are you using so that I can be sure to comply?

Hello,
I'm trying to run pwnat on openbsd as client (the server is a linux machine) and I get this error:

"Failed to send ICMP packet: Invalid argument"

It compiled without errors.

Can anyone help?

Thanks

system：macbook

I am not experienced with C compiling on Linux, but I had to manually create the obj dir before I was able to compile.

Hello,

I have started a server with this command
./pwnat -s 192.168.1.3 (accessible with 2222 port)

Client A with
./pwnat -c 172.16.16.2 3333 41.41.41.41 2222 (41.41.41.41 is the public ip of the server)

Another client B with
./pwnat -c 127.0.0.1 2222 41.41.41.41 2222 172.16.16.2 23
I have tried also in client B
./pwnat -c 127.0.0.1 2222 41.41.41.41 2222 42.42.42.42 23 (where 42.42.42.42 is the public IP of client A)

Client B want to telnet client A :
telnet 12.0.0.1 2222
but it is not working !

Any help please

Hi,

I am doing my master thesis on NAT traversal and wanted to try your tool pwnat.

I wanted to test two linphone clients.
On one of the clients the server side is running (192.168.0.121):
sudo ./pwnat -s -v 3333 &

The other one has the client side running (192.168.188.70):
sudo ./pwnat -v -c 5060 192.168.0.121 3333 192.168.0.121 5060 &

It is not working so far. The client displays, that it is listening to a tcp connection,
while the server side is listening to a udp connection.

Is there something wrong with my program calls?

EDIT: The first address of the client command has to match the WAN IP of the server:
sudo ./pwnat -v -c 5060 192.168.188.2 3333 192.168.0.121 5060 &

BR,
Chris

Hi,

just wondering If anyone has already built a binary or found out a relative easy way to compile PWNAT for embedded linux archs.
I was looking at buildroot but I didn't get how to add the repository for successful compiling.

Cheers

Hi,

I have a web server accessed with port 80 behind NAT and there is no way to port forwarding since the ISP itself block the port. So I hope this will help to to solve the problem.

I started "pwnat -s" on the webserver machine. Then on a client want to connect to the server I run "pwnat -c 8500 202.62.16.132 127.0.0.1 80". 202.62.16.132 is the public ip address of the web server.

Then I open browser and navigate to localhost:8500. But it failed with error "Bind failed". What does it mean?

Thank you so much.

I had to change cross-compile-mingw.sh to use src paths:

i686-w64-mingw32-gcc -o pwnat.exe -O3 -DWIN32 src/socket.c src/message.c src/strlcpy.c src/client.c src/packet.c src/list.c src/udpserver.c src/udpclient.c src/pwnat.c src/destination.c -lws2_32

But now I'm getting the following output:

In file included from src/socket.h:34,
                 from src/socket.c:35:
src/common.h:31:72: warning: parameter 2 (‘src’) has void type
   31 |     WINSOCK_API_LINKAGE const char WSAAPI inet_ntop(int af, const void src, char *dst, socklen_t size);
      |                                                             ~~~~~~~~~~~^~~
src/socket.c: In function ‘sock_connect’:
src/socket.c:154:52: warning: passing argument 4 of ‘setsockopt’ from incompatible pointer type [-Wincompatible-pointer-types]
  154 |     setsockopt(sock->fd, SOL_SOCKET, SO_REUSEADDR, &reuseaddr, sizeof(int));
      |                                                    ^~~~~~~~~~
      |                                                    |
      |                                                    int *
In file included from src/socket.h:30,
                 from src/socket.c:35:
/usr/share/mingw-w64/include/winsock2.h:1029:88: note: expected ‘const char *’ but argument is of type ‘int *’
 1029 |   WINSOCK_API_LINKAGE int WSAAPI setsockopt(SOCKET s,int level,int optname,const char *optval,int optlen);
      |                                                                            ~~~~~~~~~~~~^~~~~~
src/socket.c:155:38: error: ‘SO_REUSEPORT’ undeclared (first use in this function); did you mean ‘PO_REN_PORT’?
  155 |     setsockopt(sock->fd, SOL_SOCKET, SO_REUSEPORT, &reuseport, sizeof(int));
      |                                      ^~~~~~~~~~~~
      |                                      PO_REN_PORT
src/socket.c:155:38: note: each undeclared identifier is reported only once for each function it appears in
src/socket.c:155:52: warning: passing argument 4 of ‘setsockopt’ from incompatible pointer type [-Wincompatible-pointer-types]
  155 |     setsockopt(sock->fd, SOL_SOCKET, SO_REUSEPORT, &reuseport, sizeof(int));
      |                                                    ^~~~~~~~~~
      |                                                    |
      |                                                    int *
In file included from src/socket.h:30,
                 from src/socket.c:35:
/usr/share/mingw-w64/include/winsock2.h:1029:88: note: expected ‘const char *’ but argument is of type ‘int *’
 1029 |   WINSOCK_API_LINKAGE int WSAAPI setsockopt(SOCKET s,int level,int optname,const char *optval,int optlen);
      |                                                                            ~~~~~~~~~~~~^~~~~~
In file included from src/message.c:30:
src/common.h:31:72: warning: parameter 2 (‘src’) has void type
   31 |     WINSOCK_API_LINKAGE const char WSAAPI inet_ntop(int af, const void src, char *dst, socklen_t size);
      |                                                             ~~~~~~~~~~~^~~
In file included from src/client.c:29:
src/common.h:31:72: warning: parameter 2 (‘src’) has void type
   31 |     WINSOCK_API_LINKAGE const char WSAAPI inet_ntop(int af, const void src, char *dst, socklen_t size);
      |                                                             ~~~~~~~~~~~^~~
src/client.c: In function ‘client_send_udp_data’:
src/client.c:312:5: warning: implicit declaration of function ‘gettimeofday’ [-Wimplicit-function-declaration]
  312 |     gettimeofday(&client->tcp2udp_timeout, NULL);
      |     ^~~~~~~~~~~~
In file included from src/packet.c:22:
src/common.h:31:72: warning: parameter 2 (‘src’) has void type
   31 |     WINSOCK_API_LINKAGE const char WSAAPI inet_ntop(int af, const void src, char *dst, socklen_t size);
      |                                                             ~~~~~~~~~~~^~~
In file included from src/list.h:25,
                 from src/list.c:24:
src/common.h:31:72: warning: parameter 2 (‘src’) has void type
   31 |     WINSOCK_API_LINKAGE const char WSAAPI inet_ntop(int af, const void src, char *dst, socklen_t size);
      |                                                             ~~~~~~~~~~~^~~
In file included from src/udpserver.c:35:
src/common.h:31:72: warning: parameter 2 (‘src’) has void type
   31 |     WINSOCK_API_LINKAGE const char WSAAPI inet_ntop(int af, const void src, char *dst, socklen_t size);
      |                                                             ~~~~~~~~~~~^~~
In file included from src/udpclient.c:43:
src/common.h:31:72: warning: parameter 2 (‘src’) has void type
   31 |     WINSOCK_API_LINKAGE const char WSAAPI inet_ntop(int af, const void src, char *dst, socklen_t size);
      |                                                             ~~~~~~~~~~~^~~
src/udpclient.c: In function ‘udpclient’:
src/udpclient.c:143:70: warning: implicit declaration of function ‘hstrerror’; did you mean ‘strerror’? [-Wimplicit-function-declaration]
  143 |         printf("Couldn't resolve server address: '%s': %s\n", phost, hstrerror(h_errno));
      |                                                                      ^~~~~~~~~
      |                                                                      strerror
In file included from src/pwnat.c:33:
src/common.h:31:72: warning: parameter 2 (‘src’) has void type
   31 |     WINSOCK_API_LINKAGE const char WSAAPI inet_ntop(int af, const void src, char *dst, socklen_t size);
      |        

Hi,

I get this error

$ ./pwnat -s
Listening on UDP 0.0.0.0:2222
Couldn't create privileged icmp socket: Operation not permitted
Couldn't create privileged raw socket: Operation not permitted
Failed to send ICMP packet: Socket operation on non-socket
^Cselect: Interrupted system call
Cleaning up...
Goodbye.

I'm using Linux version 3.10.0-862.14.4.el7.x86_64 ([email protected]) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-28) (GCC) ) #1 SMP Wed Sep 26 15:12:11 UTC 2018

can this method be adapted to run on iOS, and work iPhone to iPhone over a carrier network?

Curious if anyone has tried this or is thinking the same. The main downside to Wireguard is you have to forward a port unless you either use an overlay solution like Netbird/Tailscale, Cloudflare (Argo) tunnel, or set up a VPS/proxy.

I haven't had a chance to test this but if this can work, it would basically eliminate the need for overlay solution or port forwarding.

Using gcc 4.7.3 on FreeBSD 10.0-RELEASE x86-64:

root@Ramiel:~/pwnat/pwnat-master # uname -a
FreeBSD Ramiel 10.0-RELEASE FreeBSD 10.0-RELEASE #0 r260789: Thu Jan 16 22:34:59 UTC 2014     [email protected]:/usr/obj/usr/src/sys/GENERIC  amd64
root@Ramiel:~/pwnat/pwnat-master # gcc47 --version
gcc47 (FreeBSD Ports Collection) 4.7.3
Copyright (C) 2012 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

root@Ramiel:~/pwnat/pwnat-master # ls
.gitignore              Makefile.Win32          client.h                gettimeofday.c          message.c               pwnat.c                 strlcpy.c               xgetopt.h
COPYING-pingtunnel      README                  common.h                gettimeofday.h          message.h               pwnat.core              udpclient.c
Changes                 README-udptunnel        destination.c           list.c                  packet.c                socket.c                udpserver.c
Makefile                client.c                destination.h           list.h                  packet.h                socket.h                xgetopt.c
root@Ramiel:~/pwnat/pwnat-master # head -27 Makefile | tail -7
# Uncomment appropriate one for the system this is compiling for
OS=LINUX
#OS=SOLARIS
#OS=CYGWIN

CC=gcc47
CFLAGS=-Wall -Wshadow -Wpointer-arith -Wwrite-strings -D ${OS}
root@Ramiel:~/pwnat/pwnat-master # gmake
gcc47 -Wall -Wshadow -Wpointer-arith -Wwrite-strings -D LINUX   -c -o socket.o socket.c
gcc47 -Wall -Wshadow -Wpointer-arith -Wwrite-strings -D LINUX   -c -o message.o message.c
gcc47 -Wall -Wshadow -Wpointer-arith -Wwrite-strings -D LINUX   -c -o strlcpy.o strlcpy.c
gcc47 -Wall -Wshadow -Wpointer-arith -Wwrite-strings -D LINUX   -c -o client.o client.c
gcc47 -Wall -Wshadow -Wpointer-arith -Wwrite-strings -D LINUX   -c -o packet.o packet.c
gcc47 -Wall -Wshadow -Wpointer-arith -Wwrite-strings -D LINUX   -c -o list.o list.c
gcc47 -Wall -Wshadow -Wpointer-arith -Wwrite-strings -D LINUX   -c -o destination.o destination.c
gcc47 -Wall -Wshadow -Wpointer-arith -Wwrite-strings -D LINUX   -c -o udpserver.o udpserver.c
gcc47 -Wall -Wshadow -Wpointer-arith -Wwrite-strings -D LINUX   -c -o udpclient.o udpclient.c
gcc47 -Wall -Wshadow -Wpointer-arith -Wwrite-strings -D LINUX -o pwnat pwnat.c socket.o message.o strlcpy.o client.o packet.o list.o destination.o udpserver.o udpclient.o
root@Ramiel:~/pwnat/pwnat-master # ./pwnat
usage: ./pwnat <-s | -c> <args>
  -c    client mode (default)
        <args>: [local ip] <local port> <proxy host> [proxy port (def:2222)] <remote host> <remote port>
  -s    server mode
        <args>: [local ip] [proxy port (def:2222)] [[allowed host]:[allowed port] ...]
  -6    use IPv6
  -v    show debug output (up to 2)
  -h    show this help and exit
root@Ramiel:~/pwnat/pwnat-master # ./pwnat -s
Segmentation fault (core dumped)
root@Ramiel:~/pwnat/pwnat-master #

Compiles and runs successfully on Debian 7 x86-64 using gcc 4.7.2.

Does this still work reliably between two home networks?

Hi,

1. May I ask what is the success rate of pwnat's hole punching under large-scale and various NAT machines In the case of stun only( not turn server)?
2. In addition, is there any way to increase the success rate of hole punching to 99% In the case of stun only(not turn server)?

Note: pwnat defaults source and destination ports to 2222.

Most NAT would change source port to another number, while by monitoring data out NAT we can watch that. So to get the real source port out NAT, we need a third server to monitor that, maybe like N2N does.

Hi, I have two questions

1. is pwnat applicable for symmetric NAT? how about two symmetric NATs?
2. can ICMP Time Exceeded message payload be used to transport data?

I encountered a enterprise NAT, which does the following:

1. host A, inside the NAT, binds a UDP socket to a local address, say 10.0.0.1:8888
2. A sends a packet to another public host B 101.0.0.1:9000, B sees A as 110.0.0.1:8888
3. A sends a packet to host B 101.0.0.1:9001 using the same socket, B now sees A as 110.0.0.2:8888
4. host C is behind another NAT. host A and C both drop packets from unknown origin

I would like to build a tunnel between A and C, traditional p2p hole punching method won't work, because when A tries to connect C, it's using a different public address than B sees. I don't think the original pwnat is designed to solve these kind of problems, it seems that pwnat focused on removing dependency on host B? https://samy.pl/pwnat/ says that "This will work behind many NATs and firewalls, but not all.", does that intended to mean symmetric NAT is not supported? in this case, the problem lies exactly that C don't know what the public address of A is.

I intercepted some ICMP Time Exceeded messages for ICMP ping requests, the original ping body was included in the Time Exceeded reply. can we modify the reply, use that part to encode some data? will the modified packet be accepted and routed correctly by NATs?

I'm trying to build a prototype that can penetrate symmetric NATs. I'm new to the field, succeeded in getting ICMP Time Exceeded replies by modifying TTL, but still learning about how to read ICMP Time Exceeded replies from OS.

Is it possible rewrite the code in C# and implement in unity?
Further more, is this theory work in andriod?

Hello,

This tool looks very cool, however I'm not sure I understand how to use it. Is it possible to ask for a full guide to establish an ssh tunnel between two machines behind an NAT and firewall?

Here are things I did not manage to figure out from the README:

Client wanting to connect to google.com:80:

./pwnat -c 8000 pwnat.server.com google.com 80

Why is this the first example given? Who would want to use such a tool to connect to google.com via a proxy? (Besides the chinese of course).

And more: What does pwnat.server.com mean? If I am behind a firewall and a network that doesn't have such a public domain - what should I use? Perhaps should it be the public IP address of the server?

Thanks for sharing this tool, and all other information... Help will be appreciated 🙏 .

I'm considering using pwnat to punch hole between two symmetric NATs, but it seems that udp packets are not being delivered successfully. I was thinking that since we can send icmp response packets disguised as a hop to a device behind another NAT, could we deliver some data (like a text message) in this response packet?

When triying to run the example in Ubuntu 12.04

As usual great work!!!!

I am facing an issue when trying to run pwnat..

When trying this command
sudo ./pwnat -c 4444 192.168.1.29 adobe.com 80 and trying to access the local port in the browser, browser shows connection reset. And pwnat outputs as below:
Client 48276 disconnected.
Client 48277 disconnected.
Client 48278 disconnected.

Thanks in advance..

anyone can tell me how to use this source in Windows ?

There are more lots of protocol like TCP, UDP. The one I am interested in is RFB and SSH as most no third-parties VNC/SSH softwares only work on Local Area Network (if no port forwarding is applied). I know that SSH works but how about RFB. I am looking forward to creating a script that automatically run VNC server or client instances with TightVNC and pwnat. I would also like to see other supported protocols.

Hi!
Given Debian's packaging policy: any binary that doesn't have a manpage, you had to.

Therefore, a manpage is attached, which can be incorporated in the next release, if desired.

thank you!
manpage_pwnat.txt

it does not work on different networks.

only work if client and server are on the same network.

NAT does not work behind firewall