LAB: netcat and some of its friends
Remember nc time-server 13 from the wireshark assignment?
We're going to play a little more with nc. It's fun, and some comfort with nc
will come in very handy during the next couple weeks.
Setup
You're going to want two terminals, preferably but not necessarily on separate hosts. For example:
- A Kali terminal in a VM and a Terminal on macOS
- A Kali terminal in a VM and a WSL terminal on Windows
- Two Kali terminals in the same VM :(
- Two macOS Terminals :(
- Two WSL Terminals :(
- ...
Make sure both terminals have nc installed.
Make sure at least one terminal has python3 installed.
Make sure one of your hosts has Wireshark installed
A simple chat
For the rest of this document, I'm going to call one of your terminals "host1", and the other "host2". For my personal setup, host1 will be Kali in a VMWare VM, and host2 will be my macOS machine, but your setup will be whatever you choose.
- Determine the IP addresses of host1 and host2
- Run
ncin listening mode on host1:nc -l -p 5000(if you're listening on a macOS terminal, usenc -l 5000) - On host2, make a connection with
nc HOST1_IP 5000from host2 to host1 - Type some text on host1; type some text on host2; take a look at both
- Ctrl-C on host2. What happens on host2? What happens on host1?
- Repeat the process, but Ctrl-C on host1.
- Fire up Wireshark on host1, set its collection filter to "host HOST2_IP". Take a look at the traffic.
Variations with nc
- Transfer a file from host1 to host2 by doing
nc -l -p 5000 > destination_filenameon host2 andcat filename | nc HOST2_IP 5000on host1 - Transfer a file from host2 to host1
- Set up the host2 listener to send specific text back to host1 as soon as the host1 client connects to the listener
- Set up the host1 connector to send specific text to the listener on host2, and then quit when connecting
Easy web server with python
- On host1, cd to some working directory with a random file or two in it.
- Run python3 -m http.server 8888
- On host2, run curl http://HOST1_IP:8888/
- Same thing, but with curl -v http://HOST1_IP:8888
- Can you download a file from host1 to host2?
- Can you download a file from host1 that's not in the working directory of the python3 command?