36.4 Netcat and Socat: The Network Swiss Army Knife
Netcat (nc) – "TCP/UDP cha Swiss army knife". Listen, connect, file transfer, simple banner grab – ekach binary. Socat – Netcat cha power-up: TLS, relays, forks, more address types.
Listen ani connect (lab):
# Terminal A on Metasploitable / any lab host – listen
nc -lvp 4444
# Terminal B on Kali – connect
nc 192.168.56.20 4444
# type messages both ways – chat over TCP
File transfer (lab):
# receiver
nc -lvp 9001 > received.txt
# sender
nc 192.168.56.10 9001 < notes.txt
Reverse / bind shell – CONCEPT (defensive): attacker victim la connect karun shell milavto (reverse: victim outbound Kali kade; bind: victim port open, Kali connect). Lab madhe samjun ghya, production madhe detect kara:
# On a lab host you own – see unexpected listeners
ss -tulnp
netstat -tulnp
# Look for odd ports (4444, 5555, 1234) listening or established
Socat basics:
sudo apt install -y socat
# simple relay: local 8080 -> lab web
socat TCP-LISTEN:8080,fork TCP:192.168.56.20:80
# TLS wrapper idea (own certs in lab)
# socat OPENSSL-LISTEN:8443,cert=lab.pem,verify=0 TCP:127.0.0.1:80
Defence: egress firewall (outbound odd ports band), host firewall, ss/netstat monitoring, EDR alerts on nc/socat spawning shells, least privilege. Bind shell sathi inbound unused ports band. Samjla ka?
Shells are real attack techniques
Reverse/bind shells IT Act khali unauthorized access madhe yetat. Fact lab VMs (192.168.56.10 / .20) ani written permission. Real network var try karu naka.
Ravindra Bagale's Tip
Students learn nc -e /bin/bash (exec shell) and think that is "hacking". In modern netcat builds -e is often not available – and it is the concept that matters, not the flag. In interviews: "How would you detect a reverse shell?" – ss, firewall egress, process ancestry. Detecting earns more marks than running the tool.
Ravindra Bagale's Tip – मराठी
Students nc -e /bin/bash (exec shell) शिकून थेट "hacking" समजतात. Modern netcat builds मध्ये -e बऱ्याचदा नसतो – आणि concept महत्त्वाचा आहे, flag नाही. Interview मध्ये: "How would you detect a reverse shell?" – ss, firewall egress, process ancestry. Tool चालवण्यापेक्षा detect करणे जास्त marks देते.
Ravindra Bagale's Tip – हिंदी
Students nc -e /bin/bash (exec shell) सीखकर सीधे उसे "hacking" समझ लेते हैं. Modern netcat builds में -e अक्सर नहीं होता – और concept ज़रूरी है, flag नहीं. Interview में: "How would you detect a reverse shell?" – ss, firewall egress, process ancestry. Tool चलाने से ज़्यादा detect करना marks दिलाता है.
Lab
Kali ani Metasploitable madhe Netcat chat set kara (port 4444). Mag ek chota text file transfer kara. Dono hosts var ss -tulnp | grep 4444 – listener disto ka te bagha. Lab session samplya var listener band kara. Socat ne ek simple TCP relay try kara (8080 -> .20:80) ani browser madhun http://127.0.0.1:8080 open kara.