Welcome back to our live environment.
So now that we have pwncat installed and working properly,
let's take a look on how to get a connection to our victim computer.
If you read the pwncat manual,
you see that there are several ways of starting a session,
you can use SSH, you can connect to a bind shell,
or the most common way, you can receive a reverse shell from the victim computer.
So, let's see how that's done.
On my attacker computer, I will open a listener with pwncat.
I'll use pwncat ‑lp, which means listening port,
and then the port that I want to listen.
In my case, I'll use the port 5656.
Now once I press Enter, pwncat will be listening for a connection.
All we have to do now is go to our victim computer and
send that shell to our attacker machine.
And there are several ways of doing that.
For example,
you could exploit a vulnerability on a website and create a reverse shell.
But in here, just for the sake of this demo,
I will simply go to the victim computer and then use netcat to
forward the bash shell to my attacker machine.
So it looks like this, nc, then ‑e to specify the executable that I want for it,
which is my bash binary,
and then the IP of my attacker machine and the port that I have open.
And that's it.
Once I press Enter, I will have a connection at the pwncat.
Take a look,
it says here that it will receive the connection from our victim computer.
Pretty cool, right?
But note here on the terminal that it says local.
And this means that this terminal is for the pwncat too.
But, if you want to have a shell with my victim computer,
I can simply press Ctrl+D,
and then now we'll have a full shell with the victim computer.
And this is pretty neat because I can go back and forth
between my local shell and the victim computer.
And again, in the remote shell, we can use any command that we want.
It's like having a full TTY shell with the victim.
Also, when I'm using the local shell,
I can use the command sessions to check if my session is still open.
As you can see here, we're still connected to the victim computer.
The neat thing about pwncat is that it comes with
several out‑of‑the‑box features.
In this course, we'll focus on the persistence ones,
but just as an example, let me show you some of the enumeration features.
Like if you want to enumerate all the users in this machine,
we can simply use run, then the module that I want to use,
which is enumerate, and then., and the feature that I want to use,
which is user.
And that's it.
When I press Enter,
pwncat will retrieve from my victim computer all of the users in there.
Really cool, right?
And at any point when we are done,
we can just exit pwncat and close the active sessions.