ࡱ > b d a ' bjbj 2X 3 3 3 3 3 G G G G < G 1 % % % ;1 =1 =1 =1 =1 =1 =1 $ z3 6 a1 3 a1 3 3 % v1 >) >) >) 3 % 3 ;1 >) ;1 >) >) V 0 @ 0 % W G % J _0 '1 1 0 1 k0 x 6 ' l 6 0 6 3 0 D >) a1 a1 >) 1 6 : Netcat
As an alternative to relatively limited TELNET scripts for network hacking, Netcat (quite literally UNIX cat command over a network) is a simple Linux/Unix/Windows utility which reads and writes data across TCP/UDP/IP port network connections, using TCP or UDP protocol. It is designed to be a reliable "back-end" tool that can be used directly or is easily driven by other programs and scripts. At the same time, it is a feature-rich network debugging and exploration tool, since it can create almost any kind of connection you would need and has several interesting built-in capabilities. nc" as the actual command line for Netcat. LINUX and Windows also has a GUI frontend to the netcat command line application. Netcats homepage is: HYPERLINK "http://netcat.sourceforge.net/" http://netcat.sourceforge.net/
Netcat Syntax
Client mode - connect to a port outbound to somewhere: nc [-options] hostname port[s] [ports] ...
Server mode - listen (-l flag) on a port for inbound connections from somewhere: nc -l -p port [-options] [hostname] [port]
Note: Most UNIX/LINUX systems require ROOT authority to listen on a port less than 1024.
nc -h
nc options:
-e prog program to exec after connect [dangerous!!]
-b allow broadcasts
-g gateway source-routing hop point[s], up to 8
-G num source-routing pointer: 4, 8, 12, ...
-h this list
-i secs delay interval for lines sent, ports scanned
-l listen mode, for inbound connects
-n numeric-only IP addresses, no DNS
-o file hex dump of traffic
-p port local port number
-r randomize local and remote ports
-q secs quit after EOF on stdin and delay of secs
-s addr local source address
-t answer TELNET negotiation
-u UDP mode
-v verbose [use twice to be more verbose]
-w secs timeout for connects and final net reads
-z zero-I/O mode [used for scanning]
port numbers can be individual or ranges: lo-hi [inclusive]
Netcat command examples:
Simple File Transfer
Start two copies of netcat on the same machine locally:
nc -l 1111
Here, using the l switch, we are able to specify that netcat should go into listen mode i.e. to listen on the specified port. Using p 1111 we are able to specify that we are using port 1111. To summarize, netcat will sit and listen for TCP connections on port 1111 and print any data it receives out to the screen. In another window we start netcat as:
nc 127.0.0.1 1111
This will connect to host 127.0.0.1 (Locally) on port 1111. Window 1:
netcat -l -p 1111
This message was typed in WINDOW1
This message was typed in WINDOW2
Now end communication with ^C (Ctrl-C)
Window 2:
nc 127.0.0.1 1111
This message was typed in WINDOW1
This message was typed in WINDOW2
Now I'm going to end communication with ^C (Ctrl-C)
This is the most basic use of netcat - using a BASH shell and pipe | data to and from netcat, as well as using the redirection (>, >>, <, <<) to allow netcat to integrate into the shell environment. Examples using netcat with redirection operators. Transmit a plaintext file. In one window, we will start netcat as:
nc -l 1111 > outputfile
This will run netcat with the same parameters specified above, except it will redirect all text received into outputfile.
infile
This is a test file.
I am going to attempt to transmit this.
Using Netcat.
Here, we have created some text in a file, and this is the file we are going to attempt to transmit:
cat infile | nc 127.0.0.1 1111 q 10
Hopefully this has now been transmitted to the otherside:
cat outputfile
This is a test file.
I am going to attempt to transmit this.
Using Netcat.
The q 10 in the command line will quit after EOF (Otherwise netcat will hang waiting for more input for cat and we will have to terminate it manually). The parameter 10 causes it to quit after 10 seconds anyway.
Tar
Integrate tar and netcat together, and use this to transmit a directory across a netcat socket:
On one side: tar zcfp - /path/to/directory | nc -w 3 127.0.0.1 1234
The tar statement before the pipe tars and compresses (using gzip) every file within that directory, before printing its output to stdout (The screen). It is then caught by the pipe, and piped to nc which in this example, connects to 127.0.0.1 on port 1234 and sends it the data which would normally hit the screen. The w 3 switch causes nc to allow for a 3 second timeout (In the event of a temporary disconnection or similar).
On the other side: nc -l -1234 | tar xvfpz
This will listen on port 1234 for a connection, and will pass any data received to tar.
UDP
Netcat also supports the UDP/IP protocol, this feature can be invoked with the u switch.
Simple Socket Reply
To get netcat to listen in on a socket, and send any data we wish when it receives a connection.
echo Leave me alone | nc l 1234 w 10
This nc command is listening in on port 1234 with a wait time of 10 seconds. If/when we receive a connection, pipe the results of echo Leave me alone to netcat. The w 10 is necessary, as otherwise any connection made in will remain open forever. We can also optionally add a v in to the netcat command line which will give us verbose information, i.e. who is connecting. Every time a connection times out (either with the w 10 command line switch, or because a connection has been made and then closed), netcat will exit.
Program Execution
nc e
Netcat has a e switch which we can use to execute a program on connection i.e. running as nc e v called by the inetd wrapper, which can be used to view traffic and information on users connecting to wrapped daemons.
The most common use is using it to redirect to and from /bin/bash or similar shell.
nc -v -e '/bin/bash' -l -p 1234 -t
listening on [any] 1234 ...
connect to [127.0.0.1] from localhost [127.0.0.1] 51210
In one window, and a simple telnet localhost 1234 in another window:
telnet 127.0.0.1 1234
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
echo Test
Test
^]
telnet>
Port Scanning
The scanning features of netcat can be used against a network to get useful information about which hosts have certain ports open. You can also send a precompiled data file to each.
A TCP port scanning example (with connection):
echo EXIT | nc -w 1 127.0.0.1 20-250 500-600 5990-7000
Will scan 127.0.0.1 on ports 20-250, 500-600 and 5990-7000. Every port that it finds is open, it will pipe the output of echo EXIT being the word EXIT to that port.
A UDP port scanning example (no connection):
nc -v -z u 127.0.0.1 20-250 500-600 5990-7000
-v was to put netcat into verbose mode, and u was telling netcat to fall into UDP mode.
Simple Web Client
echo -e "GET http://www.google.com HTTP/1.0\n\n" | nc w 5 www.google.com 80
Make a connection to google.com on port 80 (Web server port), and put in an HTTP request for http://www.google.com. At this point, we are presented with the uninterpreted HTML sent by the web server and locally to STDOUT.
Simple Web Server
Cat webfrontend:
Test Page!
Welcome to my webpage!
cat webfrontend | nc v l p 80
In this example, an HTML file webfrontend is piped any incoming connection to netcat on port 80. A pseudo webserver.
NetCat Command Cheat Sheet
nc l p [port]will create a simple listening tcp port. Add u to put into UDP mode.nc e [program]To redirect stdin/stdout from program.nc w [timeout]To set a timeout before netcat automatically quits. (Used within a loop usually)program | ncTo pipe output of program to netcatnc | programTo pipe output of netcat to programnc hHelp sheetnc vTo put into verbose mode, or use v v to put into ultra-verbose mode!nc g or nc GSource routing flagsnc tUse telnet negotiation (If connecting to a telnetd or acting as a telnetd for telnet clients).nc o [file]Hex dump traffic to filenc zNo I/O (Used for scanning ports)
U g j Z
^
u
z
! ? @ B P ` h r {
7 ݼݼݢ{ݼmݼm hni h# 5OJ QJ ^J h# h# 0J CJ OJ QJ ^J (j h# B*OJ QJ U^J aJ ph333 h# B*OJ QJ ^J aJ ph333 hnJ OJ QJ ^J h38w OJ QJ ^J h# 5OJ QJ \^J hni OJ QJ ^J h# OJ QJ ^J h` OJ QJ ^J h# B*OJ QJ ^J ph333 ) B P 8 9
=
s
& K n $ gd38w
& F gdni %d -D M
O 7 8
z {
0 1 F G - B y z { } ƼtgZg h/! 5OJ QJ \^J h# 5OJ QJ \^J #h# B*CJ OJ QJ ^J aJ ph333 h# >*B*OJ QJ ^J ph333 h# h38w hnJ OJ QJ ^J hni OJ QJ ^J h# OJ QJ ^J h38w OJ QJ ^J hni h38w 5OJ QJ ^J hX2m h38w 5h38w 5OJ QJ ^J h38w h38w OJ QJ ^J h# 5OJ QJ ^J #$ : n - B z I [ \ ~ * [$ \$ d %d -D M
O d %d -D M
O I _ 0 9 c } ? @ G Z j ŵ~i~] h# CJ OJ QJ ^J )h# 5B*CJ OJ QJ \^J aJ ph h# >*OJ QJ ^J h# 5>*CJ \aJ h| B*OJ QJ ^J aJ ph333 hX2m B*OJ QJ ^J aJ ph333 h# B*OJ QJ ^J aJ ph333 h# OJ QJ ^J h# h/! 5OJ QJ \^J h# 5OJ QJ \^J #h# B*CJ OJ QJ ^J aJ ph333 $ * ^ _ ? @ G \ Z [ j [$ \$ d %d -D M
O 7 8 p t D m n ~ s u * d %d -D M
O [$ \$ * d %d -D M
O ) 6 7 p t D ` a m n ~ ~ # & ) * r s u C ն줠Փsoksh| hni h# B*OJ QJ ^J aJ ph333 h| B*OJ QJ ^J aJ ph333 h~ 5OJ QJ \^J hX2m h# B*OJ QJ ^J ph333 hnJ h 5OJ QJ \^J #h# B*CJ OJ QJ ^J aJ ph333 h# 5OJ QJ \^J h# OJ QJ ^J h# h# >*B*OJ QJ ^J ph333 *
B C 0! 1! ! " * d %d -D M
O d %d -D M
O ) C /! 0! 1! ! ! " " " " " " " 8" " " " 溧~kXkXkH h# B*CJ OJ QJ aJ ph %h| 5B*OJ QJ \^J aJ ph333 %h# 5B*OJ QJ \^J aJ ph333 h| h# B*OJ QJ ^J aJ ph333 )h# 5B*CJ OJ QJ \^J aJ ph333 %h# 5B*CJ OJ QJ \aJ ph #h# B*CJ OJ QJ ^J aJ ph333 h| OJ QJ ^J h# >*B*OJ QJ ^J ph333 h# OJ QJ ^J h# h# CJ OJ QJ ^J " " 8" 9" " " " # # # !$ U$ ^$ $ $ $ % $% j% $If p^p` * d %d -D M
O d %d -D M
O d %d -D M
O " " " " " " " # # # # # # # ;$ <$ U$ ^$ $ $ $ $ $ $ $ % j% ѿ{k{gR{k{k{g )h# 5B*CJ OJ QJ \^J aJ ph333 h# h| B*OJ QJ ^J aJ ph333 h# B*OJ QJ ^J aJ ph333 h# >*B*OJ QJ ^J ph333 #hX2m B*CJ OJ QJ ^J aJ ph333 #h# B*CJ OJ QJ ^J aJ ph333 #h| B*CJ OJ QJ ^J aJ ph333 h# B*OJ QJ ^J ph333 h# B*CJ OJ QJ aJ ph h| B*CJ OJ QJ aJ ph j% k% {% % $If x kd $$If K 0
#" 0
6 3 4 K a_
b j% k% % % & & 6& 7& h& i& z& {& & & & & S' T' z' {' ' ' ' h# #h# B*CJ OJ QJ ^J aJ ph333 h# CJ OJ PJ QJ ^J aJ % % % & $If x kd $$If K 0
#" 0
6 3 4 K a_
b & & & 6& $If x kd^ $$If K 0
#" 0
6 3 4 K a_
b 6& 7& D& h& $If x kd
$$If K 0
#" 0
6 3 4 K a_
b h& i& o& z& $If x kd $$If K 0
#" 0
6 3 4 K a_
b z& {& & & $If x kdk $$If K 0
#" 0
6 3 4 K a_
b & & & & $If x kd $$If K 0
#" 0
6 3 4 K a_
b & & & S' $If x kd $$If K 0
#" 0
6 3 4 K a_
b S' T' a' z' $If x kdx $$If K 0
#" 0
6 3 4 K a_
b z' {' ' ' $If x kd' $$If K 0
#" 0
6 3 4 K a_
b ' ' ' r %d -D M
O x kd $$If K 0
#" 0
6 3 4 K a_
b 0 1h/R / =!"#$% $$If P
!v h5 55#v #v5:V K 0
6 , 5 / 3 4 K a_
$$If P
!v h5 55#v #v5:V K 0
6 , 5 / 3 4 K a_
$$If P
!v h5 55#v #v5:V K 0
6 , 5 / 3 4 K a_
$$If P
!v h5 55#v #v5:V K 0
6 , 5 / 3 4 K a_
$$If P
!v h5 55#v #v5:V K 0
6 , 5 / 3 4 K a_
$$If P
!v h5 55#v #v5:V K 0
6 , 5 / 3 4 K a_
$$If P
!v h5 55#v #v5:V K 0
6 , 5 / 3 4 K a_
$$If P
!v h5 55#v #v5:V K 0
6 , 5 / 3 4 K a_
$$If P
!v h5 55#v #v5:V K 0
6 , 5 / 3 4 K a_
$$If P
!v h5 55#v #v5:V K 0
6 , 5 / 3 4 K a_
$$If P
!v h5 55#v #v5:V K 0
6 , 5 / 3 4 K a_
^, 6 6 6 6 6 6 6 6 6 v v v v v v v v v 6 6 6 6 6 6 > 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 h H 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 2 0 @ P ` p 2 ( 0 @ P ` p 0 @ P ` p 0 @ P ` p 0 @ P ` p 0 @ P ` p 0 @ P ` p 8 X V ~ _HmH nH sH tH P ` P N o r m a l ( CJ OJ PJ QJ ^J _HaJ mH sH tH b b H e a d i n g 1 dh d d @& [$\$ 5B*CJ! KH$ \aJ! ph333 N @ " N H e a d i n g 2 d d @&[$\$ 5CJ \aJ N @ 2 N H e a d i n g 3 d d @&[$\$ 5CJ \aJ D A` D D e f a u l t P a r a g r a p h F o n t V i@ V
0 T a b l e N o r m a l :V 4 4
l a ( k (
0 N o L i s t > U@ > H y p e r l i n k >*B*CJ aJ ph 3f N V N F o l l o w e d H y p e r l i n k >*B* CJ aJ ph 3f B b B H T M L C o d e CJ OJ PJ QJ ^J aJ | e "| H T M L P r e f o r m a t t e d 7
2 (
Px 4 #\'*.25@9 CJ aJ 8 O 28 p a d d i n g d d [$\$ \ B\
t o p n a v b a r l i n k d d [$\$ 5B*CJ \aJ ph : R: m e n u l i n k d d [$\$ L bL
m a i n t o p c a t d d [$\$ 5CJ \aJ Z rZ d i s p l a y l i n k s t i t l e d d [$\$ 5CJ \aJ L L
p a p e r t i t l e d d [$\$ 5CJ \aJ H H b o x l a b e l $d d [$\$a$ CJ aJ J J m e n u l a b e l d d [$\$ 5CJ \aJ x x i m a g e T d d $d %d &d 'd N O P Q [$\$ T T p a p e r i c o n d d [$\$ 5B*CJ \aJ ph a r t i c l e s e c t i o n e d d $d%d&d'd-D M
N O P Q [$\$ 5B*CJ \aJ ph333 F F a d t i t l e d d [$\$ 5CJ \aJ > > a d t e x t d d [$\$ CJ aJ L L m e n u _ l i n k d d [$\$ 5B*\ph 6 6 l i n e ! &d P " b o x e s _ " $d%d&d 'd-D M
N O P Q B*ph333 P 1P
H y p e r l i n k 1 # d 5<>*CJ \aJ ph 3f ` A` F o l l o w e d H y p e r l i n k 1 # d 5<>*CJ \aJ ph 3f f \ f
z - T o p o f F o r m % $&d P a$ <CJ OJ QJ ^J aJ l ] l z - B o t t o m o f F o r m & $$d N a$ <CJ OJ QJ ^J aJ * q* i m p o r t a n t C B o d y T e x t I n d e n t 6 ( @ d %d -D M
O ^@ B*CJ OJ QJ ^J aJ ph333 x B@ x B o d y T e x t . ) d %d -D M
O B*CJ OJ QJ ^J aJ ph333 t P@ t B o d y T e x t 2 * * d %d -D M
O B*OJ QJ ^J aJ ph333 R Q R B o d y T e x t 3 + 5B*CJ OJ QJ \aJ ph PK ! [Content_Types].xmlj0Eжr(Iw},-j4 wP-t#bΙ{UTU^hd}㨫)*1P' ^W0)T9<l#$yi} ;~@(Hu* Dנz/0ǰ $ X3aZ,D0j~3߶b~i>3\`?/[G\!-Rk.sԻ..a濭? PK ! ֧ 6 _rels/.relsj0 }Q%v/C/} (h"O
= C?hv=Ʌ%[xp{۵_Pѣ<1H0ORBdJE4b$q_ 6LR7`0̞O,En7Lib/Se е PK ! ky theme/theme/themeManager.xml M
@}w7c(Ebˮ CAǠҟ7՛K
Y,
e.|,H ,lxɴIsQ}#Ր ֵ+!,^$j=GW)E+&
8 PK ! P theme/theme/theme1.xmlYOo6w toc'vuر-Mn iP@I}úama[إ4:l ЯGRX^6؊>$ !)O^rC$y@ /yH*)UDb`}"qۋJחX^)I`nEp)liV[]1M<OP6r=zgbIguSe bORD۫qu gZo~ٺlAplxpT0+[}`j zA V2Fi@qv֬5\|ʜ̭NleXd sjcs7f
W+Ն7` g ȘJj|h(KD-
dXiJ؇(x$( :;˹! I_TS 1?E ??ZBΪmU/ ?~xY'y5g&/ɋ>GMGeD3Vq%'#q$8K )fw 9:ĵ
x}rxwr:\TZaG*y8IjbRc|XŻǿI
u3KGnD 1NIBs
RuK>V.E L+M2#'fi ~V vl{u8z H
* :( W ☕
~JTe\O*tHGHY }KNP*ݾ˦ TѼ9/#A7qZ $*c?qUnwN%Oi4 =3ڗP
1Pm \\9Mؓ2aD];Yt\[x]}Wr|]g-
eW
)6-rC Sj
id DЇAΜIqbJ#x꺃 6k#ASh&ʌt(Q% p%m&]caS l=X\P1Mh9MVdDAaVB[݈fJíP|8 քAV^f
Hn- "d>znNJ ة>b&2vKyϼD:,AGm\nziÙ .uχYC6OMf3or$5N HT[XF64T,ќM0E)`#5XY`פ ;%1U٥m;R>QD DcpU'&LE/pm%]8firS4d 7y\`JnίI R 3U~7+#m qBiDi*L69mY&iHE=(K&N!V.KeLDĕ{D vEꦚdeNƟe(MN9ߜR6&3(a/DUz<{ˊYȳV)9Z[4^n5!J?Q3eBoCM m<.vp IYfZY_p[=al-Y}Nc͙ŋ4vfavl'SA8|*u{-ߟ0%M07% < ҍ PK !
ѐ ' theme/theme/_rels/themeManager.xml.relsM
0wooӺ&݈Э5
6?$Q
,.aic21h:qm@RN;d`o7gK(M&$R(.1r'JЊT8V"AȻHu}|$b{ P8g/ ]QAsم(#L[ PK- ! [Content_Types].xmlPK- ! ֧ 6 + _rels/.relsPK- ! ky theme/theme/themeManager.xmlPK- ! P theme/theme/theme1.xmlPK- !
ѐ ' theme/theme/_rels/themeManager.xml.relsPK ]
X 7 C " j% ' ! $ " j% % & 6& h& z& & & S' z' ' ' " # $ % & ' ( ) * + ? X 8 @ 0 (
B
S ? U [ [ ] B H
y } V \ z | X ^ I
O
} ? E 1
;
@
F
N W _ i " v z t z \ ^ _ a s u l r
& / g p ) / G M t z b m p r C F k m / 5 7 9 V \ i k { } & 6 = T V { } [ ] m r w z | I
O
0 a @
F
[ ^ " D l s u
J Q 1 l D F ^ a $ ( 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 A A B B P P { }
] ] ^ ^ ` a b b # & ) * VzM28vF) ^`OJ PJ QJ ^J o( - ^`OJ QJ ^J o( h H o p^p`OJ QJ o( h H @ ^@ `OJ QJ o( h H ^`OJ QJ ^J o( h H o ^`OJ QJ o( h H ^`OJ QJ o( h H ^`OJ QJ ^J o( h H o P^P`OJ QJ o( h H ^` . ^` . p p^p` . @ @ ^@ ` . ^` . ^` . ^` . ^` . P P^P` . ^` . ^` . p p^p` . @ @ ^@ ` . ^` . ^` . ^` . ^` . P P^P` . 28 Vz |h :G܀왦FB|ipJ@N ^< 6xGZL (
tfd_^՚WՒ!
/! nJ X2m 38w ~ ` P ni # | @ a a ^ a a X @ U n k n o w n G * Ax T i m e s N e w R o m a n 5 S y m b o l 3. * Cx A r i a l ?= * Cx C o u r i e r N e w I. ? ? A r i a l U n i c o d e M S ; W i n g d i n g s A $ B C a m b r i a M a t h " q h ԆsD | 9 9 % 2p 3Q LP $P ni 2 ! x x ( S e c u r i t y D o c s : C o m m e n t o n N e t C a t T u t o r i a l I m a g e v 5 . 0 5 P R R D o n n e l l e y Oh +'0 4 @
` l
x , SecurityDocs: Comment on NetCat Tutorial Image v5.05P Normal.dotm RR Donnelley 9 Microsoft Office Word @ R @ 2@ W ՜. +,D ՜. +,` h p
RR Donnelley 9 ) SecurityDocs: Comment on NetCat Tutorial Title 8 @ _PID_HLINKS A x u j h t t p : / / n e t c a t . s o u r c e f o r g e . n e t /
! " # $ % & ' ( ) * + , . / 0 1 2 3 4 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P R S T U V W X Z [ \ ] ^ _ ` c R o o t E n t r y F pW e D a t a
- 1 T a b l e 5 6 W o r d D o c u m e n t 2X S u m m a r y I n f o r m a t i o n ( Q D o c u m e n t S u m m a r y I n f o r m a t i o n 8 Y C o m p O b j y
F' Microsoft Office Word 97-2003 Document
MSWordDoc Word.Document.8 9q