Establish communication, transfer files and remote access between two computers.
You have probably been asked by your workmate or colleague who is sited on the next floor or on the other side of the office, to help him/her do some configuration on their PC.
Walking all the way just to help them do simple stuff is tiring and time-consuming, right?
In this tutorial, we will discuss how to establish secure communication between the two PCs, transfer files and get remote administrative access.
Prerequisites
- Two or more computers running on an operating system (either physically or virtually)
Check how to install Windows, Linux, Mac OS on Virtual machines
If you are using Virtual Box as your hypervisor, use the bridged adapter for the network adapter.
Settings > Network> Network Adapter> Bridged Adapter
2. Download and install Nmap for both your Operating Systems
- Go to https://nmap.org/download.html and click on your host operating system to download the Latest stable release self-installer. At the time of writing this article, Nmap-7.92 was the latest stable release.
- You can check if you have successfully installed Nmap on your machines by typing nmap -V on your command prompt or terminal
What Is Netcat?
Netcat has been dubbed the Hackers’ Swiss Army Knife and exists as both Linux and Windows binaries. The first version of Netcat appeared in 1995, and since then, it has undergone multiple incremental modifications.
To control and monitor network traffic, Netcat is a versatile software that supports a broad variety of command options. Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) are the two basic pillars of modern computer networks.
This implies that there are two modes of operation for Netcat, client and server.
Ncat, the latest iteration of Netcat, “reads and publishes data via networks from the command line with a rich set of features.” The Ncat software was developed to replace Netcat inside the Nmap project in an effort to increase productivity. Netcat’s inability to validate or encrypt incoming or outgoing connections is a major weakness from the standpoint of a penetration tester. These kinds of safeguards are especially important when using such tools for penetration testing. By requiring authentication for these tools, compromised systems won’t be made available to unapproved IP addresses, and encrypting the bind or reverse shell allows penetration testers to mask their activities from intrusion detection systems.
Ncat provides accessibility to all of these features. The alternatives to Netcat are Ncat and Sbd (a Netcat clone).
There are many situations where it would be helpful to connect to a TCP/UDP port, such as:
- To determine whether or not a port is open.
- Read a sign posted in the harbor.
- To manually establish a connection to a network service.
Establishing a communication channel
Check the IPv4 address in Windows machine
Run the Windows command prompt and type ipconfig to get Host IP address (IP address of your computer):
C:\Users\Lenovo> ipconfig
- For PC connected via Ethernet, select LAN Ethernet adapter>get IPv4 address as <Host IP address>
- For Laptop, select Wireless LAN Ethernet adapter>get IPv4 address as <Host IP address>
Check IPv4 address in Linux machine
Login to the linux terminal
- Go to Applications>Terminal or use shortcut (Ctrl+Alt+T)
root@kali:~# ifconfig
In this tutorial, we will frequently use the IPv4 addresses obtained above and it is important that you have a stable network if your address configuration is dynamic otherwise static IP address configuration is good to go.
Establishing a chat using ncat
Network debugging client programs or receiving a TCP/UDP network connection are both facilitated by Ncat’s ability to listen on a TCP/UDP port. Implementing a simple chat between two machines is as easy as setting up Ncat to act as both a client and a server by issuing the command ncat -nlvp 6667 on one of the machines.
It’s important to remember that you may make a connection over any closed or open TCP port.
I am using linux to listen for incoming connections
On the linux terminal:
root@kali:~# ncat -nlvp 6667
Linux will start listening for incoming connections via port 6667.
Once port 6667 have been bound on the Linux machine to Ncat, connection can be made to the port from the windows machine to interact with it using the command ncat -nv <Remote IP address> 6667
Get Francis Ndaruga’s stories in your inbox
Join Medium for free to get updates from this writer.
On my windows machine:
C:\Users\Lenovo> ncat -nv <Remote (Linux) IP address> 6667
Once the connection is successful, you can send a message over the command prompt and terminal as shown below
Question.
Is this method of establishing a chat really secure?
Stepping back a little, computer A that is “listening” on port X on the network may receive a connection from computer B. What this implies is that any computer C may make a connection request to computer A, and then listen in on any activity A is having with B.
To remedy this, we may utilize Ncat in the following method to simulate a safer conversation between Windows and Linux. Using Ncat, Windows would establish an SSL-encrypted connection on port 6667, allowing only Linux computer to access to it or vice versa.
C:\Users\Lenovo>ncat -nlvp 6667 -–ssl
Linux, in turn, would connect to Windows IP address with SSL encryption enabled, preventing eavesdropping, and possibly even do an Intrusion detection.
root@kali:~# ncat -nv <Remote (windows) IP address> 6667 -–ssl
For this tutorial we will not use the secure shell just to keep things simple. However, you can add the — ssl command every time after specifying the port number.
Transferring files with Ncat.
By utilizing Ncat, you may send both text and binary files across computers. If you need to move a file from the Linux computer to the Windows PC, you may do it by initiating a setup that is similar to the one shown in the prior discussion example, with some modifications. If you want to receive a file on a Windows machine or an operating system of your choice, you need to install a Netcat listener and tell it to send it to the incoming.<extension name> file.
Always be on the lookout for incoming connections from the computer of your choice.
C:\Users\username>ncat -nlvp 6667 > incoming_File_Name.png
listening on [any] 6667 ...
To send a file to another machine, append the file path and file name to the command ncat ‐nv <Remote IP address> 6667 < /path/to/your/file.png
root@kali:~# ncat ‐nv <IP address> 6667 < /path/to/your/file.png
To verify that the image has been received to my remote machine, we check the file explorer on windows, and sure enough its there.
Notice: The file is saved with the name specified on the remote machine while initializing a listening session.
Remote Administration with Ncat
One of the most useful features of Ncat is its ability to do command redirection. Ncat can take an executable file and redirect the input, output, and error messages to a TCP/UDP port rather than the default console.
Consider the cmd.exe executable, by redirecting the stdin, stdout, and stderr to the network, cmd.exe can be bound to a local port. Anyone connecting to this port will be presented with a command prompt belonging to this computer. To further explain, consider the following scenarios, involving Windows and Linux.
Ncat Bind Shell
In this scenario, we want to access Windows PC over the command prompt from Linux and issue commands remotely. If Windows has a public IP address, and is directly connected to the Internet, and whether linux is a virtual machine behind a NAT connection with an internal IP address or a physical machine with a public IP address, then to complete bind shell, Windows needs to bind cmd.exe to a TCP port on its public IP address. Linux machine should then connect to this particular IP and port.
Windows will proceed to issue the following command with Ncat.
C:\Users\Lenovo>ncat -nlvp 6667 -e cmd.exe
listening on [any] 6667 …
Ncat has bound TCP port 6667 to cmd.exe and will redirect any input, output, or error messages from cmd.exe to the network. Anyone connecting to TCP port 6667 on Windows’s machine, will be presented with Windows’s command prompt.
root@kali:~# ncat -nv <IP address> 6667
Microsoft Windows [Version 10.0.19043.1826]
Copyright © Microsoft Corporation. All rights reserved.
C:\Users\Lenovo>ipconfig
Reverse Shell
Ncat has the ability to send a command shell to a listening host. In reverse shell, although Linux cannot bind a port to /bin/bash locally and expect Windows to connect, it can send control of its command prompt to Windows machine instead. To get this working, Windows needs to set up Ncat to listen for an incoming shell:
C:\Users\Lenovo>ncat -nlvp 6667
listening on [any] 6667 …
Now, Linux can send a reverse shell to Windows:
root@kali:~# ncat -nv <IP address>1 6667 -e /bin/bash
Once connection is established, Linux’s Ncat will have redirected input, output, and error from /bin/bash, to Windows’s machine, on port 6667.
It is important to realize that outgoing traffic can be just as harmful as incoming traffic.
