Hey everybody welcome to the next video so we're gonna be talking about how to use Net cat now net cat
is a very useful tool.
It is a it is a pretty good US Swiss Army knife is out as you want to call it.
It allows you to do a lot of things at a lower level.
So for example you can connect to a Web port over TTP and you can interact with the Web site directly
with the protocol itself.
So it is a socket level tool.
So similar to how we worked with Python and we created sockets.
Think of that as what net cats doing just at a much much more advanced and stable level than what we
were doing.
Now net cat is commonly used for a few things.
The first thing is banner grabbing which we will go over in the next video.
However there's three interesting things you can do with this.
So the first one to show you is kind of a little fun.
So if we take a look here on the left side where it's using it's in the local directory.
Users share and map scripts.
That's going to be our server console.
So picture that being a target or us or the target that we're looking at.
And then on the right is our attacker machine right.
Our attacker machine I'm using this on the same machine for simplicity's sake.
However it wouldn't matter if it was on a different machine across the network as long as you could
run the commands from both sides.
Now let's say you targeted a machine and you wanted to let's say just have a quick chat with somebody
on a different on a different machine that is also in the engagement.
So on a server you can use C which is for net cat.
So if you do question Marco stash age 4 and four net cats you see it it provides a lot of options.
I do want you guys to go through these options and just take a look.
Take a look at what you want and what's available.
So there's a few options we want to look at with net cat.
So the first thing we want to look at is to listen.
So we want the server or the target to listen and have a socket open waiting for somebody to connect
to it.
Now this is no different than any other port that's open on the machine.
So that's what an El Now you can tag commands in that don't require for example.
El does not require anything but a port.
However there's a port parameter.
So if we did dash L and dash P that would mean we're going to be listening on port and then for 444.
Right.
But what we like to do is put a V.
Now that's just for verbose so it provides you a little bit more info.
So right now this is net cat dash L for listen V for verbose P for port and then we put the port in.
So this is going to listen locally on the system on port for four four four.
Right.
So we go over to our attacker machine and we do net cat.
And then the IP address in this case will do local host since it's on the same machine.
And then the port we go ahead make connection.
So you can see on the left side says connected to local from local hosts which is completely fine but
on the right hand side if we say
now you can see it appears on both sides.
And if you respond.
So so you can see that you can have a quick chat channel between two servers if you need it to.
Now that's just a quick use case that you could do.
It's not a very common one but we'll go ahead and stop the server and clear this up.
So let's look at a much more clear concept that you're going to definitely find yourself using.
Now it's not uncommon for machines on enterprise networks to have net cat installed.
It's a quick way for people to make connections to things and to check firewall access rules and it's
a very commonly used tool.
So you're going to you know you tend to find this on most enterprise systems.
However there's two things that you're going to end up using net cat four is file transfers and shells.
Now what I mean by shells is we want to be able to if we're if we're let's say we have our our attacker
machine over here and we have our server machine over here right now on our server machine we may want
to we may have initial access or maybe we have a web access that allows us to run a command but we want
to get a shell what we can do is we can actually tell if we inject the command into the Web site or
the web interface and get it to run we can actually tell it to open up a blind shell for so a blind
shell as when a server that you're targeting you send it at a command to open a port on its own and
attach the command line or the bin bash to that socket.
So that way anybody connecting to that specified port on that host gets immediate access to the command
line for free.
Now there's also something called a reverse show where you set up a listener or you you open a socket
to catch the shell on yours on your client side or your attacker side and you send a command to the
server side to tell it does connect to you the attacker on a specific port and then send the shell across.
So this will make more sense when I show you guys now.
So I'm gonna show you how to create a bind shell.
So let's say we got access to a web application on the server here.
So let me make this bigger I think we've got to clear this now.
Let's say we we're able to run on commands on the web server.
Right.
So we send it net cat and we want to listen for mostly on port four four four four.
Now try not to use for four four four because that's gonna be blocked by most web application firewalls
and regular firewalls.
Pick a different port.
And then we use a dash E which essentially says run this application.
Anytime somebody connects to the port.
Copy standard input output an error to the socket itself.
So it's a little bit going on there but just understand that essentially whatever client connects to
this on port for 444 they will be presented with whatever app whatever application that we specify would
dash E it will run and then try to copy the standard input output an error.
That's a simple test.
So if we do bin bash we go ahead launch it you see nothing really happens.
However if we come over here and we do and we do a net cat and then local host then port for four four
four.
So again we're just listening on port four for four like we did before for the chat one except instead
of having standard input output an error be related to just the socket we spawn bin bash and then have
it
attached to the port or the socket instead.
So if we go and run this we should get our show.
So we see our connection but we don't see anything over here which is perfectly fine because if we do
I.D. we then get are our particular shell.
So if you notice up here we're in our current working directory.
So we're not in the end map scripts directory but if we do P.W. D we can see that we're in the user
share and map scripts directory.
So this allows us to essentially create a shell so if we were to inject commands on the client side
or the target side over here which we did we were able to get this command to run we were able then
to just connect to the machine on port for four four four and get an actual show.
So if we go ahead and clear this guy over here and go it goes ahead and closes the port on both sides.
Now what happens if there's some issue where we want or we can't have it open a port but we can have
it send in connect out maybe there's some restrictions where only route users can open a port and that
might be fine.
And in that case we can do a reverse Shell's we're essentially doing the reverse opposite of that.
We're going to our attacking machine and setting net cash to listen on port four for four.
And then we send over to our target to run a command.
We want to send it essentially the the same command we were using over on the attacker side before just
with the dash.
So on this we're going to tell it what IP we want to target.
So we're doing look local host right on port for four for four.
Now right now all that's going to do is just make the same socket connection.
We just basically reverse the commands.
However if we connect to port four for four on the target on our on our attacking machine back to our
attacking machine from the client or the target then we can do a dash e and do bin bash.
So when that happens nothing happens here but over here we've see we've got a connection.
I mean if we do I.D. TWD we again see that we did get root access from the other machine or in this
case is the same one but the same concept still applies.
So it's important to understand how to use Net cat in some of these ways just so you just want these
commands to be off the top of your head you're going to want to be able to quickly spawn up a net cat
reverse shell or a buying shell whenever you may need it.
But keep in mind you can do this with python perl there's even bashfully you don't even actually need
that kind of long as somebody has bash running you can get in you can get a reverse shell or a bind
shell from just from bash alone just from the standard bin bash command line terminal.
So as long as you have command line access you can get a reverse shell.
However the difference being is how you are injecting those commands to getting it to run will determine
what options you have.
As an example if you have you don't have a lot of options and you can't put question marks and slashes
everywhere then you're going to be limiting yourself down to maybe Python or Perl instead because there's
going to be slashes and dashes and everything else in in the net cat commands and in the batch commands.
So I'll leave a link above the video to a site called penthouse test monkey that has a large amount
of reverse shells and buying shells in different outcomes.
So they've got stuff in Java python perl Ruby.
It's just a good list to have and it's always something you want to keep bookmarked just so you have
a quick access to a particular shell at any point in time.
So play around with net cat you can connect like I said to if you really wanted to you can do net Cat
let's see you know do 13 nation COM port 80 All right so if we make a web request get slash each team.
No I won't do that.
Get slash boy.
Sorry guys.
Get slash H TTP.
One dot one enter enter and we can see we've got our it sends a browser that you could not understand.
Which is perfectly fine but we can see here that we get are we get a web request so you can go ahead
and play around with this get familiar with it send shells back and forth either on two different machines
that you own on the same network or on the same machine.
Now this does work on Windows just instead of the dash e is still exactly the same you would just do
see d dot XY.
However there is a net cat binary p e file for Windows.
You'll have I'll leave the link above to go and download it or on your Cally machine you can do locate
and see let's see here and see when
there is so users share windows dash binaries slash NC Daddy X so you can go ahead and copy this from
your calling machine over to another Windows machine copy it to a flash drive whatever you want.
This is a good way for you to get a quick copy of this but I will leave a download link above to be
able to actually download this from a Web site instead just so it's a little bit more convenient for
you guys.