No reverse shell tutorial or chapter would be complete without mentioning Netcat.
Now Netcat is a very nifty tool to have on your USB stick to carry around.
It is practically been called a Swiss knife of reverse
shells because it pretty much offers any kind of connection that you might need.
Now the problem with Netcat as with most of the reverse shells is of course that it
is not installed on the remote system.
But if you need a quick code, if you can't be bothered to generate
something you can always download Netcat and that is a fantastic piece of code.
Although Netcat is a, only creates reverse connections.
Connects two points or more points into one and nothing else.
There's no, it doesn't by default
copy into the start up folder or anything of a kind.
It's just a reverse shell for the duration of the session.
Now, not to say that you cannot actually, you can actually copy it in
the startup folder, write small scripts for that, or something of a kind.
For this, you do need some programming experience.
This is a, we're already one foot into programming a way into programming.
However, you don't actually need to do that.
As I said, Netcat is simply a nifty tool to carry around.
You can also test connections with it.
And you can actually create reverse shells.
You could even create quick chat servers,
a quick chat service or something of a kind.
It's fantastic.
You can use it for a wide variety of purposes.
Now let's just take a look at Netcat's options.
So here on Kali it's ncat.
Somewhere it's nc.
Somewhere it's Netcat, I don't know.
Depends which Linux distribution you have.
It also runs on Windows, so keep that in mind.
You can download the version on more than one place on the net.
So no worries about that.
Ncat.
And I'm going to show you today how you can interconnect two Linux machines and
how you can command one from another with ncat, with Netcat, sorry.
So, -- help.
Let's have a look at what is offered here.
Just look at these options.
And Netcat does support SSL encryption.
So you could have your chat encrypted.
You could have an encrypted communication between two points.
It can establish a peer-to-peer connection.
Peer-to-peer, not connection, sorry,
but peer-to-peer encryption, which is very nice.
A very nifty tool to have if you want to keep your chat private or
something like that.
You can connect to multiple people and
then you can have a discussion or something of a kind.
Very nice way to communicate, but above all, It's a reverse shell.
I can show you briefly where you could have chat service.
So you just type in this --cat.
Sorry, not cat. Chat, and
that will start a simple Ncat chat server.
Say if you want to keep your conversation private,
you can communicate through IP addresses.
You can just, well not through IP addresses, but
you can just have each other's IP addresses, and
then you can have a very nice chat that nobody else can eavesdrop on.
Anyway, what we are looking today is this function, e, which is exec command.
Exec, not exec.
Whatever you pronounce this.
Basically, it executes a given command which is very nice.
And this one is, well this is for bash, I think?
Something of a kind.
But it doesn't really matter.
You will see soon enough that e is pretty much efficient and
you can use it pretty much anywhere you want.
Also support for IPv6 is fantastic as well.
As I said, you can establish pretty much any sort of a connection between two or
more points, which is very nice.
Today we're going to do a couple of things.
So I'll just go ahead and clear this.
Now this is my Kali machine and I have a command somewhere here.
So these are the commands that we're going to be using today.
So this is for verbose output, this is to tell netcat to listen,
and this is to tell it on which port to listen, and
then to forward pretty much anything given to it into /bin/bash.
Which is basically our terminal.
Anyway, let's just go ahead and type that in.
I am going to change the directory here.
Clear the screen and type in ncat.
Give me verbose.
Give me listen.
And give me port.
I don't know.
I am going to say port 888.
You can pretty much specify a wide variety of ports here.
It doesn't matter that much as long as the port's not used by something else and
is free.
You can determine if the port is actually taken
by just doing an end map of your own system and there you will be able
to see without any problems if the port is actually being used by something else.
Anyway so we have a port,
now we need /bin/bash, press enter.
Okay, so now it is listening, and you can also move these
things into foreground, into background actually.
Sorry.
There are, hold on, let me see if I can actually do that.
To go like this Nope, hold on.
Give me a moment.
Already in use.
Quitting.
Okay, so it is.
Nmap localhost.
Let's see what it is doing.
So we got http, https, sun-answerbook.
Okay, so it is running, no problems.
You saw how you could put it in the background.
Basically, just you can add this line at the end ampersand sign and that's it.
Let's see if it's gonna work or not.
Type in ifconfig.
Okay, what is the IP address?
Okay, 102 hasn't really changed.
Primarily because these machines have been running for quite a while.
Even my physical machine, I think it's been running for
seven days straight, something of that kind, not sure about that.
I might have placed it to sleep a couple of times but it doesn't really matter.
Clear, and you can see my things here.
CD clear
Okay, so it's the same, ncat.
And we want to type in 192.168.1.102, port 8888.
Okay.
So connection from 192.168.1.101, yep, there we go.
So let's type something in, like ls.
See, nothing is being typed in here, but.
Here on the other end, on my physical machine, I have pretty much full access.
So if I type in clear, it's gone, but
I still have the shell open, if I am not mistaken.
If I type in ls again, it is there.
I can do cd.
Desktop, but you can see it's crude.
It's rudimentary.
It doesnt really give you a lot of output.
It's horrible to look at.
I mean just typing in commands blindly like this to a very large extent is a bit
difficult and can be a bit tiring, but as I said, this is something that you would
use in a situation where you are forced to use it and where you actually
want to have some sort of a encrypted communication or
something of a kind with another person.
So let's have a look at how our communication works.
Oops, sorry.
6549, 549.
I don't want that, and I type in lsof -i :1234.
Basically, this command that I've just typed in, lsof -i : and
then the port, you can do an Nmap of your own system, see which ports are opened,
and then once you've figured that out, you can type in this command
to figure out which processes are using that particular port.
So clear.
So I got Bash and ncat which
are using this, so go ahead and
kill 6531 and 6540.
Terminated.
Excellent, so there is nothing now.
Let's do nmap localhost.
Excellent. So that port is no longer opened.
Please disregard the rest.
I have a lot of boards open, more than I should have on this machine,
but this is a testing machine, anyway, as it is a virtual machine.
So, let's go ahead and type in ncat --help.
Well, we don't actually.
Well, yes, we do.
ncat --help.
And what do we want to do?
ncat --chat.
No, yes, come on.
Chat on port 1234.
Ncat, you must specify a host to connect to.
Okay, -l on
port 1234.
There you go.
I am connected there.
I am listening.
Sorry, not connected, but rather, instead, listening.
I'm gonna go ahead and quit this.
Clear, and I need to, excellent.
So if I type in hello, it pops on the, you can see this popping on the other side.
How are you?
It's popping again.
No problems.
And if I do this and place it like here.
Okay.
You can see I have a lot of stuff in the background.
Let's put it like this.
Just minimize it.
It doesn't really matter.
I am fine.
You can see it's replying on the other end.
No problem.
So there is a two-way communication.
You just hit the keyboard here, and it is popping, no problem.
So you can communicate with somebody in this fashion as well.
Now let's go ahead and quit this.
If I type in something here,
no, nothing has happened because it's being transmitted to a closed port.
Anyway, let's see.
Let's go --ssl.
Is this gonna work?
Here --ssl.
Hey, how is it going?
Okay, we would obviously need to confirm this,
whether the traffic is actually encrypted or not.
Yeah, we can't actually confirm it like this because we don't have any sort of
snooping around for traffic here, but we can fire up Wireshark.
Sorry, we need a, where am I gonna do that?
Let's see if I actually have it here.
Information, well, I don't need to do that.
I can just so, Wireshark, please have it.
Yes, it is actually installed.
Error during loading, okay.
Are you still gonna work?
Yes, you will.
Amazing.
So go ahead and pick your interface that you are using.
Go ahead and start this.
I see that there shouldn't be a lot of things now.
Type in ip.addr equals 192.168.1 dot something.
That dot something will
be the IP address of my
Fedora physical machine.
So let's see.
What is the IP address there?
ifconfig.
I know it's small, but you don't actually need to see this here.
I can zoom it in if you want.
It's 192.101, 101.
Oh, right.
It can't actually put it out here.
I need a equals sign.
How brilliant of me.
Double equals sign.
Hey.
There we go. So, we have some sort of traffic here.
Let's see if we can make something out of it.
I don't know.
Let's just send a bit more of it.
Come on.
Don't do this to me. Don't do this to me.
Excellent.
So, here we see data, and guess what?
It's encrypted.
So you can't actually see anything here.
You won't be able to decipher the communication between two
people or perhaps more if, I don't know, depends how you do this.
So let's go ahead and kill that.
And let's go ahead on the other end.
Go ahead and kill it.
Start everything the same, but without --ssl.
I just wanna show the difference.
And, just need to remove the --ssl.
So lets type in something, I dunno, doesn't matter.
We're chatting with
random letters.
Okay, let's just pick the last one.
Nope, that's not the last one.
Okay, so it says data, Length 2.
Can we actually find what we have sent?
But see, it's 67 0a.
Okay, let's just Let's think of something meaningful that
we can actually track which is a far better idea than this.
So I can actually confirm that I have written the right stuff.
Hello.
How are you?
And on the other end, we're gonna type in, I am fine.
What about, what about you?
Okay, these things tend to remain in buffers if I'm not mistaken, so
you might have some extra letters from time to time.
So that can be a bit tricky.
But oh well, learn to live with it.
Okay, so it's not this one.
Not this one.
Let's see.
There we go, it's hello.
You can actually read through it no problem, so you can see what it is.
And here, that's not the one.
Again, you can see here how are you.
So you can see what's passing through.
One more time, I just wanna confirm that this is actually encrypted.
So you can see the difference because it looked awfully similar to me.
I wanna see if there is anything wrong with it.
I don't know, what am I gonna type in here?
Lamp is good.
Completely meaningless.
Wall is random.
I have such awesome sentences, it's amazing.
Okay, so if we take a look at the last one.
Nope.
There we go.
So, you can't actually read through this.
You see, as before we had text here that we could read.
But now, we can't actually read anything because of course it is encrypted and
protected from any snooping or anything of a kind, which is great.
Is there anything?
U, G, something.
I don't think that there is anything meaningful in here.
Anyway, as you have seen, you can use this as a reverse shell, in a glitch.
Or, you can use it as a secure chat server,
because this is only between two people or a couple of people.
You're not actually using any external servers.
Rather instead, one of you can be a server and then others connect to him,
then you can chat no problems.
If you wanted to have multiple people, you would just add in k here,
press enter, and then you would be able to,
I'm pretty sure, receive more than one person.
So let's just verify.
You can verify that quickly by typing nc 192.168.1.101 port 8888.
Connection refused.
Of course it was refused, cat.
Ncat 192.168.1.102 for crying out loud.
One, two, three, four, press enter.
There we go.
And this is not SSL, so --SSL.
There we go, it's communicating, and if I just go ahead and open up another browser.
Another one of these.
It's not browser but.
There you go.
So you can have two terminals are more something of a kind to connect.
In any case, I would like to bid you all farewell.