Hi, and welcome back to section four Netcat Penetration Test.
In this video we are going to talk in more details to work with files and data
exfiltration in Netcat. In the last video,
we saw the basic operation of transferring files with Netcat.
We saw that the basic format to transfer data with Netcat is to start a server
and a client.
And we have to specify a port to start the communication as we see
in the example for transferring. And we have a server, a lesson,
a lesson, uh, net trans lesson app.
Listen port and pass a file and a client that will receive this
file, this content and make a local copy.
An auto operation is to create a dump file during a communication.
As we see in the exact example,
we have a communication in the same structure about server and client,
but at this time we have uh,
dash o option to create like a dump file to record every formation
that the connection is passing.
This information is another example of using and creating all the
manipulation file.
With Netcat route operation that we could do with file is to check
its integrity after the file transfer. For example,
we could use the common line MD five five some for example.
These tool is available in Mac Linux. Uh,
to check the hash of the file,
these tool will compute and check the MD five hash file.
MD five stands for Message Digest five,
and they have commonly used algorithms that are considering secure.
A hash is a result of a mathematical computation performance on a set of
data.
This is a 128 beat check sum and it's used to verify
the integrity,
integrity of the file and have this format we gonna,
that we see in the example here we call
the common and pass a file.
And when we have this file transfer from another place,
we as execute the same common in this file and we can check the integrity
between these, these two files.
Data exploitation is known true as data extraction,
data exportation or datat.
This could be defined as a transfer of data from a computer or another
device.
And this transfer is taken sensible data in unauthorized way
and unauthorized way.
You can start assessing the target device and then start a remote shell.
This allows our incoming client to connect to the net cat directly shell access.
There is no user identification or authentication process
associated with this access.
One example of sensitive data in aex filtration is the formation
present in password folders or log files.
In Linux we have the log files in dash var dash log.
These a special directory for storing logs.
This directory contains logs from the operation system services
and various apps running on the operational system in Microsoft Windows.
Those log files are present at C dash windows dash C 22
dash config in Linux.
The password files are present in a composing of two files,
PE W V D and shadow in the folder dash
attc dash pe, wv d and dash a TC dash shadow.
In past w d file,
it contains the user's public information u I D
for name home directory.
While the shadow file contains the hash password and the
password expiring data,
a good and efficient way to copy a collection of files is using the tar
command.
Tar command is a type archive and it can be used
easily to achieve large collections of files into a single file.
The example here we have this common, we have in the first line,
we have a dark command, uses some options,
CV and Z C is for create new file
V is for the verbose mode, and Z is for compact file.
So the command will compact l file in this folder.
Then we have the pipe common, the pipe.
That's mean that what we have in the left will be the input for what we have
in the left.
So all the files will be compacted and sent to
our instance of net cat that we have a connection in this port 4, 4, 4 4.
In the second line we have net cat running in several modes.
So the net cat is lessened in the port four,
four for four and we have a pipe again that's mean that
the, the client will be, uh,
listen all the content that is coming from this port and all
this will be file compacted by tar command.
This input,
this content will be the input for the another command in left of the
pipe. So the file, the net cat in the server mode, we,
we receive a file, a compacted file.
Then you pass this to tar command,
entire command you view with some options.
ZX is for extract file V for reverse mode Z for
compact file and p for preserve the permission of the files.
So the result of this will be transfer of data in a high
optimized way.
Here I have a environment and we are gonna show some
examples for work with files using Net cat.
So we have two terminal here,
here to make a simulation of the DIS transfer. All the,
the transfer file are used in my local environment here
and net CAT works fine for for this. So for example, in this terminal here,
I will start a server.
I'll simulate a chat system and in the first terminal here,
I will start a net CAT in the server mode.
So I use like this example here,
net cat dash vv to get more s
details, spec information. So V,
L P L for lesson P for a port
for four, for four.
I will use our option dash o to create adapt file and i u uh,
call this as dump version two
X for example. Okay.
And the right side I'll create a instance of net cat a client to connect with
this server that i, I created before. So I will use um,
net cat dash netv. I use local host
'cause I have to specify a host.
So it's a local host here and use the same port.
Now I use start the server. I'll start the client. Okay,
connection's. Good. So the client say
hello the server,
we receive the messaging and answer the quick writtens.
Okay, so we have enough information. So because I use it, uh,
dash vg, I have this information here for all the, the bytes that I,
I receive it and I send it and I sent,
so this is okay, the file, it's here,
damp V2 x and we have the option to get
all the information, all the information that we have. So we have,
because I use the dash o, I have the ax more information here, here.
And I have the string format information here.
So we have more details of this file. Okay?
Now we have another operation is for transfer file.
So now we have a file to be transferred. So
I'll use the same structure. I will, first of all,
I'll create a new folder.
So for example, that the three
enter in this folder, okay?
This file is new, a new folder. We don't have files here to, I will clear,
uh, and I will use the same structure to uh,
pass this file from another direction to transfer the file
from one point to another point. So here I use,
I will start in this terminal here, a NETCAT server and a net cat client here.
So I use net CAT DV option to get more details about all
the information. Listen,
and p i you specify a port or four or four.
I use the option to put a timeout that when a file,
when a transmission file is over is done,
we have five seconds of timeout and then the connection it's over. Okay?
So W five and I will specify a file that
I want to transfer. That will be dump V two X. Okay?
These will be our server.
Our client will follows the same structure.
So we'll be netcat dash,
VV W five. I will put the same output.
I have to specify a host.
So we'll be a local host port for four
for four.
And I have to specify a name of a file that,
that we create for copy the, the file. So I'll use, uh,
the copy of X, okay, X.
So now I'll start our server and start a client.
So we have a connection here.
The content of the file has been, was being, uh,
copied. Now the connection is done. Okay?
So the server send this co the side of buy and the
client receive this is the same quantity. That's mean, that's a, is a good sign,
okay? Uh, aim to check the integrity of the file.
We have a command is MD five son. So this command,
you check the i the integrity of the file
we use for calculate the dump of the,
of the file. So here we have, uh,
a hash as we saw before.
Hash is a medical computation to arrive from
the calculation.
This will arrive number and to check the end,
we can compare this number to the number two. Check the,
i I think of the file. The file is here in,
in our folder. And I use the same common,
uh, with this file in this, in this side. So I use MD five stand.
So we, we are able to see that the hash is the same.
So that's mean that the integrity the file is okay.
So is the same file, okay, we have a different names,
but the content is the same. That's mean that the is the same file.
Okay?
So now you see an example of data exfiltration.
So we have folder in some files that we have
that we want to copy these files.
Those files are sensitive files. So
we have interesting common combination of commons to
optimize the copy of this file.
We don't need to copy every file in single operations to copy one file
by by file one by one. No,
we have some options to get more quantity of files that, uh, we want.
So let me check my actual folder path.
Oh, okay, I'm in, uh, my current, uh, user. So are you,
you
you gone in the root folder and we saw that a
very interesting folder that contains sensitive folder
files is this log. Okay,
so lemme enter. I don't have to be in this, this folder,
copy the, this folder. Okay? I wanna pass the path of the folder.
And this works the same.
So I will build a structure of my client and my server
netcat. Okay? So in this side here, let me,
for the client,
I will create another folder that will be N card D.
Okay, dear. For example, log
files, lemme enter in this folder,
okay? There's no file in this folder. Okay? Lemme clear
terminal. Okay, let me clear the terminal here. Okay,
so the task here is to copy files. That's right.
So let me mount this structure. The structure here will be,
I'll use the command tar. Okay? I, I create
and v to get more details in Z for
compact. The file, the file here
will be var dash log.
I use the pipe common.
That's mean that what we have in the left will be the input
for what we have in the right.
I'll start common netcat
and these will be post in this case local host.
I specify a port of four and I will specify two
option to get a, a timeout. That's good.
So this will be the client, the client I will,
I will run the client in this terminal in here,
my destiny folder I you create an instance
for the server that we'll, we'll receive the, the information.
So here I use netcat dash v lp,
this server, you listen in the port for four four,
I'll specify a timeout here
and I'll use the pipe again.
So I'll use the tar file, uh, uh,
command that the tar,
this tar common here will receive the compact folder
file that I created here. Okay?
And I'll use the XV z p,
it's mean that the tar here will extract all the file and we'll extract
in this folder here. So the flow is like this,
I view in this command here,
I will create a compact file with the content of this folder here.
Okay? I use net cat to,
is is like a pipe, okay? Like a Bridget,
I use net cat to connect here in this direction here.
And the file that I created here,
I'll receive here and I'll, uh, this,
okay, this is the logic.
So now let me start my server and inside my client,
okay, we saw that
we have a lot of files here, okay?
Some files, it was okay to copy.
Another ones was not copied because the permission was denied. Okay?
But this is very interesting because I don't need to have the root password
cations to copy some files. So these files are very important too.
Okay? If I had a password is okay, but is either,
either I don't have, there's no problem because some files are very interesting.
So now my destination folder here,
10 log file. If I use the command to list all, all the files,
let's see, uh, let's, right,
I have my Avar folder var,
I have a log folder and now I, I have the files.
So this is very interesting because we don't have, uh, for example,
to copy one single file per time. No,
with this command here,
this is instructor here that we saw here.
We was able to copy big quantity of files in
one single common. So this is very interesting. This is very useful
for the question of data exfiltration.
In this video we saw about more details to work with
files and data exfiltration with Netcat. The next video,
we'll take a look about persistence using netcat and I hope to see you there.