Objective: To use netcat for relay, port scanning, etc.
Use netcat in the following ways:
-
Push a file (from client to listener/ server).
-
Pull a file (client initiates & receives).
-
As a port scanning tool. Compare with nmap.
-
Create a backdoor listener. (For the -e option, use the executable nc4 from student9@maclabcs9)
-
Create backdoor to shovel a shell.
-
As a backdoor channel using at least two computers as the intermediaries (relay). Describe the steps you followed and the results.
-
There is a process that is running on cs8 with high privileges.
In fact, this process is a listener that will grant root-level command-shell access
([root@cs8 ~]# ./nc4 -l -p 6666 -e /bin/zsh).
Interestingly, cs8 is protected behind a firewall that allows only outbound access.
That is, this firewall has an established filter that blocks all incoming packets (like SYNs),
but allows packets that have the ACK bit set.
However, you can run other commands on cs8 as "student" (with limited privileges, i.e. non-root).
Your challenge is to devise a command for student@cs8 that will
give access to that root-level shell from outside cs8.
Hint: If student@cs8 runs a regular netcat, anybody outside will have only limited (student) privileges.
Instead, you'll want to connect to the listener that already exists.
-
EXTRA CREDIT: Run netcat over an ssh tunnel.
One application is described here:
http://cg.scs.carleton.ca/~morin/misc/laptopmail/.
Another is here:
http://www.plenz.com/tunnel-everything.