[MUSIC PLAYING]
Netcat fundamentals-- welcome to the bind and reverse shells
section of this course.
And within this section, we're going
to be taking a look at how to set up bind shells
and reverse shells.
However, before we do that, we need
to get an understanding of a very, very important tool that
will essentially be pivotal within this process
of establishing either a bind shell
or reverse shell, and that, of course, is Netcat.
All right, so this is pretty much
where things start getting interesting.
And from a penetration testers point of view,
Netcat is seen as an absolute must-have in regards
to your arsenal of tools that you'll typically
be utilizing on a day-to-day basis as a penetration tester.
So let's get an understanding of how to utilize Netcat.
Now, before we do that, let's get an understanding
of how or what Netcat is and how it can be used
or what it can be used to do.
All right, so Netcat, also known as the TCP/IP Swiss Army knife,
is a networking utility that's used
to read and write data to network connections
using TCP or UDP.
The great thing about Netcat is it's available for both NIX
and Windows operating systems.
And by NIX I mean Unix, Linux, et cetera.
And this essentially makes it extremely
useful for cross-platform engagement.
So, again, it is completely platform agnostic,
which means you can essentially obtain a reverse shell
on a Windows system, even if you are running a Linux system
and vise versa.
Now, in order to understand how Netcat
works and its relationship to setting up or facilitating
reverse shells or bind shells, we
need to get an understanding of its communication model,
all right?
So Netcat utilizes a client-server communication
architecture or model with two modes--
that is your client mode and your server mode, all right?
So in the client mode, Netcat can
be used to connect to any TCP or UDP
port as well as a Netcat listener, also known
as the server.
So what is the server mode?
Netcat can be used to listen for connections from clients
on a specific port.
Now, this really will not make much sense to you
right now until we move on into the practical demonstration
and once we start exploring bind shells and reverse shells.
What this means is that in client mode,
you use that mode to connect to ports--
any TCP or UDP port-- or, more specifically, you
can use it to connect to a Netcat listener,
also known as the Netcat server mode.
Now, the server mode allows you to listen
for connections on a specific port on your system.
So with that, you're essentially setting up a listener,
and then other clients can connect to you.
So you're starting to get an understanding
of how powerful Netcat is.
So in terms of what Netcat can be used to do from the context
or from the point of view of a penetration tester,
as we've already explored previously in this course,
we can perform banner grabbing with Netcat.
We can also perform port scanning, transferring
of files, and, of course, the facilitation or the setup
of bind and reverse shells.
Right, so now that we have an understanding of what Netcat
is, let's actually get started with the practical section,
and we will be able to get an understanding of how
this can all be done.
So this video has a lab environment attached to it.
And all you need to do is just fire it up,
and you can follow along with the demonstrations
that I will be performing.
So I'll switch over to my lab environment,
and I'll see you there.
All right, so I'm back within the lab environment.
Within this lab environment, you'll
be provided with a unique target IP address in a notepad or text
file.
Do keep this open as it is quite important.
If you do end up closing it, you can access it
by opening the target file on your desktop.
It will contain the target IP address.
And one additional feature that you
have been provided with in this lab
is access to the target system that is running Windows.
Now, for the purpose of this video
and other videos within this section,
I want you to disregard the service that's
running on the target system as the only reason why you have
access to the Windows system is to demonstrate how Netcat
can be used on both platforms-- so both Linux and Windows.
So I'll just switch over to my Kali Linux system.
So again, the tabs are named in a way for you
that you can actually understand.
You have attack machine and target machine.
The target is running Windows.
The target is running Windows Server 2012.
So again, it's fairly modern, and it'll
be very, very helpful in demonstrating
how Netcat can be used.
So let's get an understanding of what Netcat is
and how it can be used by opening up our terminal.
And I'm just going to zoom in so you
can see what's going on here.
And in order to use Netcat on Kali Linux, all you need to do
is type in NC for Netcat.
And we've used this in the past before.
The great thing with Kali Linux is Netcat already
comes preinstalled, so we can just type in Netcat
and open up the Help menu.
And I'll just say minus minus help.
And this is all the documentation afforded to you.
So again, I would recommend going through this
to get an understanding of what the various options are.
I'll be going through some of the most important ones.
If you want in-depth documentation or a guide
on how to use Netcat, you can open up the man pages
for the Netcat tool.
So that can be done by typing in man and NC.
And the man pages are extremely useful.
In this case, it'll give you a description of the tool
and highlight the various modes that Netcat can operate in.
And in terms of the official nomenclature,
you can see that you have the Connect
mode, which is the client mode as we
highlighted in the slides.
And then, you have your listen mode, which is the server mode,
right?
So again, this is fairly simple to understand.
Now, before we get started with using Netcat
to connect to a particular port or to set up a listener,
let's explore a few important options
that you need to be aware of.
So I'll open up the Help menu again here.
And let's get started, firstly, with the V option, which
is for verbose output.
So that is used to provide you with additional information
whenever you connect to a particular port
or whenever you've set up a listener.
And you can see right over here, set the verbosity level can
be used several times to increase
the level of verbosity.
So I can say minus VV for double verbosity,
et cetera, et cetera.
The other option here is the UDP option.
Now by default, Netcat will essentially
connect to a TCP port, right?
Now, if you ever want to connect to a UDP port
or set up a listener on UDP, then you
can utilize the U option to explicitly
have Netcat connect to a UDP port
or to set up a listener on a UDP port of your choice.
And we then have the L option, which
is used to set up a listener.
So you can see bind and listen for incoming connections.
This may not make much sense right now,
but it will in a couple of minutes.
You then have your no DNS option that
is denoted by the N or hyphen N. And that will essentially
disable the actual DNS resolution of IPs
into host names and vise versa.
That's something that can be quite helpful when you're
trying to connect to an IP and you
want to prevent it from automatically resolving the IP
address to a host name or to a domain name via DNS.
So that's an option that we'll also be using quite a bit.
All right, so those are the three or four primary options
that are very, very important.
One additional important option that we
will be exploring in the next videos
is the E option, which allows you
to execute a specific command.
And again, you really don't need to understand this right now,
but it'll be very, very useful when we'll be setting up
a bind shell or reverse shell.
OK, so now that we have an understanding of how
all of this works, we can get started
with the first technique or the first piece of functionality
that we can perform with Netcat.
And that is the ability to connect to ports.
So we've already explored this during the banner grabbing
section.
And the reason we were using Netcat
is, again, it allows us to connect to a specific TCP
or UDP port on a target.
And the output of that connection
might be a service banner.
And that service banner can be very
helpful in identifying vulnerabilities that affect
that specific service, right?
So again, in order to connect to a particular port,
we can say Netcat and then the target IP.
So let's run a test with the target system here.
So we can say Netcat, target IP, and the port
that we would like to connect to.
So for example, we can connect to port 80, which
is running a web server who is used to essentially run or host
web service.
In this case, we'll hit Enter.
And we'll give this a couple of seconds.
You can see that we don't get any output.
Now, why is that?
We don't get the service banner, and we really
don't get any output.
So this is where the options that I mentioned
come into play.
So in order to specify an option,
we need to use the hyphen option.
And we can say, in this case, let us perform
or disable DNS resolution.
So we can use the N option.
And if we want additional information regarding what's
going on with the connection we can use the verbose option
to display additional information.
Now this is the typical way you can list out the options
that you'd like to specify or use with a Netcat command
or when running Netcat.
However, it is also recommended to, essentially, combine
all the options that you'd like to use when running Netcat
into one so you don't have to specify the hyphen every time
or for each single option.
So I can say, for example, in this case,
I can say Netcat and then hyphen N and V for no DNS resolution
and verbose output.
So I can hit Enter, and you'll see the difference.
So you can see in this case, it displays the Netcat version
being used.
And indeed, the important piece of information
that it provides us here is the actual connection status.
So you can see it says, connected to the target
on port 80.
Whereas, previously, we didn't know what was happening.
Now, again, it doesn't always have
to provide you with a banner.
As I said, that's just one of the great features of Netcat
is that it can be used for banner grabbing.
This particular feature or functionality
will come into play when we'll be setting up an actual Netcat
listener, right?
So you can connect to a particular port this way.
And of course, you can connect to any port that you want.
So for example, if we try and target port--
let's see if we have an FTP server running on the target.
You can see connection refused.
That tells us that that port is closed.
And this is one of the ways Netcat can be
used to perform port scanning.
And again, the results are quite conclusive.
So for example, if we wanted to check
whether SSH was installed on the target,
we can change it to port 22.
You can see connection refused.
Now, that may not indicate that a service may not
be running on that port.
There could be a firewall in place
that's proxying or filtering the actual request.
So do take that into consideration.
If we want to connect to a UDP port,
we can essentially say or add that option
to our already existing list of options, which is NVU for UDP.
And we can connect to a UDP port.
Maybe let's try and connect to, for example,
139, for example there.
And you can see that connects.
If we try and connect to port 445, you can see connected.
We can try and connect to, maybe, 161.
Connected, and so on and so forth, right?
So that is how to connect to both TCP and UDP ports.
And as I said, this is currently operating in the client mode.
Remember, we are connecting to other ports.
And in this particular scenario, we
have essentially been operating in the client mode.
So that is how to connect to ports.
As I said, you can connect to both TCP and UDP ports.
Now let's move on to the next technique
that I wanted to highlight here.
And that is the ability to listen or to set up
a listener on a specific TCP or UDP port.
Now, in order to showcase this, we
are going to need a client system and a service system.
So again, that's why we have two systems here.
And we are going to be utilizing both of them.
So what I need to do firstly is transfer the Netcat executable
file onto the Windows system because Windows
doesn't come preinstalled--
or Netcat doesn't come preinstalled
on a Windows system.
So again, you might be asking yourself,
the lab environment doesn't have any internet access.
Where can I get the Netcat executable for Windows?
Well, this is the great thing about Kali Linux
is it's already available in a folder under user share Windows
binaries.
And if I list all the contents of this directory,
you can see we have Netcat.exe.
Fantastic.
So you might be asking yourself again,
how do we transfer this executable onto the target?
Well, there's two ways.
We can set up a web server to host this particular executable
and then download it on the target system via the browser,
or we can set up a web server to host this executable
and then download it via the command prompt.
So I'll actually take you through that process right now.
So what I'll do is I'll just navigate to this directory
here.
And I'll just say CD.
There we are.
And I'll set up a web server to host all the files
within this directory.
And in order to do that, I'm going
to be using a Python module called
simple HTTP server, which we used in the previous section--
so simple HTTP server.
And we'll say we want to host it on port 80.
So all it Enter.
It's now going to serve all the files within user share Windows
binaries on port 80 on the Kali Linux IP address, right?
So we've set up a web server.
We can now. download it onto the target system.
But before we do that, we need our Kali Linux IP.
So I can say ifconfig.
And my IP address is on the interface ethernet 1.
And of course, in your case, it's going to be different.
Just copy the value associated to the Inet option there.
Let's head over to the target system.
As I said, there are two techniques.
We can open up Firefox here and then
navigate to the Kali Linux IP address
where the web server is being hosted.
And we can then download the file directly
through the browser.
So I'll just wait for Firefox to open up.
As I said, this is running in a VM,
so it may take a couple of seconds.
Alternatively, what we could do is open up a command
prompt session.
So I'll just type in CMD.
And I'll just open this up here.
And it looks like Firefox is open,
so we'll take a look at how to do it with Firefox first.
But it doesn't look like the window has actually
been scaled correctly, so we'll just close that up.
And we'll utilize the command prompt technique.
So we'll click on Properties here
because I want you to be able to see what's going on.
So I'll increase the size here to,
maybe, something-- the highest size there.
And we can then change the font to console us.
And in terms of the layout and the actual color,
I'll change that to-- the screen background,
I'll change it to white so you can see what's going on.
And the screen text, I'll change that to black.
OK, and it doesn't look like the font size has been changed.
So font-- there we are.
And we can click on that there.
Fantastic.
So you should be able to see what's going on now.
And we have the command prompt session.
So how do I download a file from the Kali Linux system
through command prompt?
Well, I navigate to the directory
where I would like to save the file.
I'll do this on my desktop.
I can utilize a tool that comes prepackaged
with pretty much all versions of Windows and that is cert util.
And we'll say we want to use the URL cache option and the file
option.
We then specify the address of the web server--
so HTTP and then we paste in the target IP address like so.
And we are downloading the file called NC.exe.
And then, we are going to save it as NC.exe on the desktop.
So I'll hit Enter.
And you can see, it'll say right over here,
cert util URL cache command completed successfully.
And Netcat has been downloaded onto our desktop
as we can see right over here.
So we can test it out we can say Netcat.exe and help.
And you can see Netcat has been set up.
Fantastic.
All right, so now that we have Netcat set up
on the Windows system, what we need to do
is let's actually terminate the web server there.
And I'll navigate to the desktop on Kali Linux.
And we can get started with setting up a listener.
So we can set up a listener on both systems.
It doesn't really matter what system
you set up a listener on.
So let's start off with our first example.
We can set up the listener on Kali Linux.
So I'll say Netcat.
And the option that we want to use
is NV-- so no DNS resolution, verbose output.
We want to listen on port 1234, for example, right?
And the L option, as I said, is for listening.
And the P option allows you to specify the port
that you'd like to listen on the Kali Linux system.
So I'll hit Enter.
And you can see right over here, it's
going to say Netcat is listening on port 1234.
So that means we can now utilize Netcat on the Windows system
to connect to the actual listener on the Kali Linux
system.
So again, all I need really is the actual Kali Linux IP.
So I'll head over back to Windows,
and I'll just clear out the command prompt here.
So we'll say Netcat.exe.
And in order to connect to a listener as we've already done
or to any port for that matter, we use NV.
We then specify the target IP, which I'll paste in there--
this is the Kali Linux IP--
And then the port that we would like to connect to,
which in this case is 1234.
Hit Enter.
And it's going to say unknown here.
However, if we take a look at the Kali Linux system,
you can see that we get a connection from the Windows
system.
And that is how to set up a listener
and how clients can connect to a listener.
Now, you might be asking yourself, well,
why is this important?
You know, I don't really see what the point of this is.
What are we doing here?
Are we just connecting two systems together?
Well, this will make much more sense
when we'll actually be exploring the process of how
to use Netcat to obtain a bind shell or a reverse shell.
Now, what you can do to test that this connection is active
is we can perform a really, really fun exercise here.
When you have connected a listener--
when you've connected the Netcat client to a Netcat listener,
you can essentially send messages across the connection.
So for example, I can say, hello.
And if I go to the target system,
you can see hello has been transferred-- really, really
cool.
So I can also do this from the window side.
So I can say--
we can say, for example, Netcat is awesome.
Hit Enter, and you can see that information is transferred.
So you might be getting an idea of how useful Netcat is
and how useful the Netcat listener
mode is in terms of transferring files, transferring
messages, establishing remote access to a target system, et
cetera, et cetera.
All right, so again, I'm just going
to go through this now and set up
the listener on the actual Windows system.
So I'll terminate that Netcat listener
on the Kali Linux system.
And you can see it's already been terminated on the Windows
system.
So again, just repeat the process.
We can say net Netcat.exe NVLP 1234.
That'll set up the listener on the Windows system.
So I'll hit Enter.
As you can see, listening on port 1234.
And then I can connect to the target system with Netcat.
So I'll just copy the target IP.
I can then say NV target IP and the port 1234.
Hit Enter.
As you can see, connected.
And on the Windows system, it gets a connection
from the Kali Linux system.
So again, I can type in a simple message.
Hello, how are you?
And there we are.
So that is really, really cool.
So again, as you can see, it doesn't really
matter what operating system you're working on.
Netcat works exactly the same, which is very, very important.
So now that we've taken a look at how to set up a listener,
we can move on to the next example.
However, I also want to cover one little caveat.
As I said, if you want to set up a Netcat listener on a UDP
port, you can do that as well.
So let's take a look at a simple example here.
So if we wanted to set up a Netcat listener on a UDP port,
the process is exactly the same.
The only option you're specifying is the U option.
So if we wanted to set up a listener on the Kali Linux
system, we can say Netcat NVL UP.
Make sure that the U option is specified
before the port option as that is
where we specify the actual port that we
would like to listen on.
So in this case, I'm saying, Netcat, I
want you to set up a listener on UDP port 1234.
I hit Enter, and that has set it up on port 1234.
Now, if we head over to the Windows system--
and let's try and connect to that particular port on TCP
to show you that it doesn't work.
So Netcat.exe NV, and let's get the Kali Linux IP here.
So let me just open up a terminal really quickly.
Ifconfig, and I'll copy that there,
and we can head back over in here, paste that in there,
and 1234.
So remember, I've not specified that we are connecting to a UDP
port, and Netcat is going to assume that I
want to connect to a TCP port.
So I'll it Enter, and you can see connection refused.
And that, again, shows you that Netcat does indeed
follow your instructions.
So we can connect to the UDP port
by saying Netcat NVU, hit Enter, and we are now
able to connect to the actual Netcat listener on the UDP port
that it is currently listening on.
And again, the process is exactly the same.
If I can actually type that in there,
you can see that indeed does work.
So we head over to the target system.
We may not receive information.
And that comes down to the fact--
or this really comes down to the fact to how UDP works.
So again, that's just in case you ever
wanted to set up a listener on a UDP port.
So that is how to set up a listener with Netcat
on both TCP and UDP.
And we've already taken a look at how to transfer messages.
Let's end the practical demonstration
by taking a look at a very, very important feature
or a piece of functionality that Netcat allows you to do.
And that will involves setting up a listener
and then connecting to that listener.
And that, of course, is how to transfer files with Netcat.
Now, in order to transfer files with Netcat,
you will need to use your redirection symbols, which
are the greater than and less than symbols.
I'm sure you're aware of them, right?
And in order to transfer a file from one system to the other,
you need to have a listener that is going
to receive the actual file.
So remember, the system that you want
to transfer the file to needs to have
the Netcat listener set up.
And the system that is sending the file
will be connecting to that Netcat listener.
So let's say I wanted to transfer a file from the Kali
Linux system onto the Windows system, how would I do that?
Well, first let's create the file.
So I'll create a text file with Vim.
So I'll say vimtest.txt.
And I'll say, hello, this was sent over
with Netcat, all right?
Wrtie in quit.
There we are.
So if I wanted to send it, I would
need to set up the actual listener on Windows first
to receive it.
So I'm currently on my desktop.
In order to do this, I'll say Netcat.exe, right?
And I would then specify the port
that I would like to listen on-- so NVLP 1234.
I then use my redirection symbols.
And in this case, because this is the system that's
receiving the file, we are saving
anything that is sent by a client into a file.
And in this case, we'll just call the file--
or we'll just give the file name the same that we did
on the Kali system--
so test.txt-- and we hit Enter.
So it's going to listen.
And now, in order to send the contents of test.txt
onto the Windows system, we need to connect to that listener.
So we say Netcat NV, and then we need the actual Windows IP--
so I'll copy that there--
and the port.
Now, one thing remains, and that is the file
that we would like to send over.
In order to specify the file, we use the actual less than
symbol, and we then say test.txt--
that's the file we created.
Hit Enter, and you can see right over here,
it connects, and it'll say 38 bytes sent.
And if we take a look at the target system,
it does not give us any information regarding
whether or not a file was actually saved
or data was transferred.
But if we take a look at the desktop, we'll have test.txt,
and the information was transferred over.
Now, this is not just useful for transferring text files.
It can also be used to transfer executables.
And again, you can essentially just replicate the process.
And it works vise versa.
If I wanted to transfer a file from the Windows system
to the Linux system, I would set up
the listener on the Kali Linux system
and then specify the output file where
I would like that data stored.
And then on the Windows system, I
would connect to the listener on the Kali Linux system
and specify the file that I would like to transfer over,
all right?
So that is really how to use Netcat
to perform a plethora of functionality that
is very, very important.
Now that we have an understanding of how Netcat
works in depth and we understand the two modes--
the client mode and the listen mode--
we can now move on to the next step,
which is getting started with bind and reverse shells.
So that is going to conclude the practical demonstration
side of this video.
All right, so now that we have an understanding of how Netcat
works, we can get started with reverse shells or, more
specifically, bind shields first,
because bind shells are very important to understand
in the context of shells in general
and obtaining remote access to a target system.
And you'll be able to see the differences between the two.
So in the next video, we'll get started with bind shells.