Printable View
Is there a way to get netcat to load and listen on a port at startuo in winxp pro?
I've been googling but can't come up with an answer so I thought I'd ask here.
I can manualy start it, but I want it to start everytime I boot with a set of commands to listen on a specific port.
Could I add an entry to the autoexec.bat file? or autoexec.nt?
any ideas would be great.
First hit on a Google for "netcat help"
Netcat
'Netcat' is a reliable "back-end" tool that can be used directly or easily driven by other programs and scripts. ... Help List, <[email protected]> ...
directory.fsf.org/netcat.html
First hit on a Google for "winxp startup folder"
Advanced Windows XP User Features > Modifying the Startup Folder
Think of the Startup folder as a means for automatically configuring ... Like everything else in Windows XP, you'll find the Startup folder in Explorer. ...
http://www.informit.com/articles/art...29744&seqNum=9
Application of the ideas presented in these links is left to the student for practical excercise.
yes netcat can be loaded.......but how can I load it on boot with a nc -L-p 60 -e cmd.exe -d command?
batch file?
Ok...here's the full story......I'll probably be neged or banned.
I was bored and wondering just how someone could get acces to an xp box, so I dug an old computer up from the basement and did a fresh install of xp pro with no updates, no firewall and no virus protector and hooked it up to my lan.
I downloaded a well known exploit program, exploited the box and got a command prompt.
Now I thought..........what can you do with a command prompt?...lots of stuff... :)
I fired up a tftp server and remotely uploaded netcat and set it to listen to port 60 with a cmd.exe execute.
now..........on reboot netcat no longer listens....so no backdoor....
so I was wondering how netcat can be set to start on boot to listen on the port I want it to.
I want to set it do do this remotly, this has to be done from a command line, or from editing a file that I can upload the the target box.
This is just a learning thing on my own lan with my own box because I'm bored.
I'll write a full tut if anyone wants, but I think Irongeek does a much better job with the videos.
ban me neg me ........whatever
Drop all the commands you need into a batch file..
Have it start either via the startup folder by moving the batchfile into that folder or you can start it using the hkey_local_machine\software\microsoft\windows\currentversion\run registrykey..
Not a lot to say here, your question seems to have been answered.
Close, no cigar. Try again ;)Quote:
ban me neg me ........whatever
I don't know if this would warrant a tut, but maybe if you included what you found as far as hiding it, what works, what doesn't, and then how to discover it on the system, then you may have something.Quote:
I'll write a full tut if anyone wants ...
( examples might be, maybe it was stealthy for a fresh original XP install, but did not work on a box with SP2 and the built in firewall enabled by default, or maybe an add-on firewall, what anti-virus software detected it, maybe even if something like spy-bot detected it. )
Just a suggestion.
But as for the command to run????
Wouldn't it be more like:
nc -l -p60 -d -e cmd.exe -L ???
You should be able to put the literal command string into
a registry key, but I'm not an expert. All the other
trojans do it that way to keep novice users from knowing
about it.
:cool:
IKnowNot "nc -l" would defeat the purpose of having it start up at boot for even a port scan would close it until the next boot. it needs to be "nc -L " for listen then listen again.
hey old man! you can make the registry entry from a cmd shell using reg.exe. see "reg add /?" for the correct usage. and a bat file can be made using ECHO e.g. "echo [command] >nc.bat", if you need to enter more than one command use ">>" for append otherwise all you'll have is the last entry. sorry if you know this already, just trying to be helpfull!
Batch file in the startup folder did the trick.
Not stealthy at all, but that wasn't the point anyway.
Thanks for the help. Now I'm going to start installing the windows updates to see at what point, if any, the backdoor get's closed. I'm also going to try avg, trend micro, avast, spybot, spyware doctor, zonealarm, and mabey a few others to see what programs detect nc and what ones don't.
Thanks again for the help.
NetCat is neither a trojan or a virus. these AV's shouldn't detect it. it has too many practical uses.
I think Tedob~ is probably right but I would certainly add A-Squared to your list.
http://www.emsisoft.com/en/software/free/
;)
You'd think so...Quote:
Originally posted here by Tedob1
NetCat is neither a trojan or a virus. these AV's shouldn't detect it. it has too many practical uses.
Let's just say that symantec is really dropping in popularity with me... I never liked them because their software is a resource hog... Then they ditched LC5 on us... and of course there's this
http://securityresponse.symantec.com...ol.netcat.html
Quote:
Type: Hack Tools
Name: NetCat
Version: n/a
Publisher: n/a
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
Risk Impact: Low
Quote:
Behavior
Hacktool.NetCat is a tool for transmitting data across network connections and may allow unauthorized access.
So... they shouldn't detect it.. but they do..Quote:
The following instructions pertain to all Symantec antivirus products that support security risk detection.
Update the definitions.
Run a full system scan.
Check out their list.. -- http://securityresponse.symantec.com...ex/indexH.html
How long since 7th Sphere was a commonly used IRC Script... yet the port scanner that came with it is there... yes it's just a port scanner... Super Scan is there... everyone knows that name... how about THCScan (a great little app)... and PWDUMP (which is just fun)... Symantec detects a lot of security software that shouldn't be detected...
Peace,
HT
Yes I certainly agree with the resource angle. It has become progressively more complex and demanding with each new release, almost forcing people to upgrade their kit.
I notice that this only applies if you have the security risk detection facility. In this respect it is probably correct as these legitimate tools could be used for malicious acts.
I suppose you would have to put all your tools in a separate partition or folder and instruct Norton not to scan it, much the same as you would do with a malware collection. Then, if it did find something, you would know that it was where it shouldn't be, and investigate.
The reason I mentioned A-Squared earlier is that it is supposed to detect security risks (it is an optional scan) and I wondered how it would react.
:)
HT i stand corrected! im glad your awake.
old man i'd be interested in seeing your findings. please post them when your done.
If I ran an AV scan one day and it picked up NetCat and it was not meant to be there, I think I would be quite glad!
You say that now... but think about it.... so netcat has a malicious use...Quote:
Originally posted here by Nokia
If I ran an AV scan one day and it picked up NetCat and it was not meant to be there, I think I would be quite glad!
So does sshd, telnetd, ftpd, hell even httpd... Would you like your AV to start removing any service found running on your computer? Because if they're running legitimately you're going to be quite upset..
Why stop there... Why not remove MP3s since Sony BMG would like to see them gone... or parses all images on your computer and remove anything that has flesh tones in it because they could be porn and then they could be child porn....
This is why some AV software is becoming so bloated... Why can't it just be AV... We know viruses are malicious... so remove viruses... we know worms are malicious so remove worms...
I've seen AV detect VNC... I've seen it detect NetCat... it shouldn't be detecting this stuff... sure it _COULD_ be malicious.. but too ****ing bad.. if I'm properly firewalled/nat'd it won't matter anyways...
I'd rather have AV that does what it's supposed to do than removes half my legit software... What if you worked in the Network Services department for a company and it came down from Management that you had to have 'security risk detection' enabled and auto-delete on and that was pushed from the global config.. and everything HAD to be scanned (less USB Drives.. unless they are connected at time of scan)... that makes your life that much harder... for no reason...
AV companies need to stick what they do... you say you're glad now until it gets to the point where half your stuff has disappeared...
Peace,
HT
No, it detects potential sercurity risks. If you found any of that stuff on a user's machine I can hardly imagine you would be best pleased. :DQuote:
Symantec detects a lot of security software that shouldn't be detected
Oh yes it would!...................you would want to know how it got there...............it could well be an indication of an internal security/discipline problem. ;)Quote:
sure it _COULD_ be malicious.. but too ****ing bad.. if I'm properly firewalled/nat'd it won't matter anyways
Actually it makes your life that much easier......................you go and get a proper job with a real company.Quote:
What if you worked in the Network Services department for a company and it came down from Management that you had to have 'security risk detection' enabled and auto-delete on and that was pushed from the global config.. and everything HAD to be scanned (less USB Drives.. unless they are connected at time of scan)... that makes your life that much harder... for no reason..
Hey, don't go blaming the software concept, when the problems you are describing relate to deployment.
:D
Then the question is why do your user have permission to be putting that stuff on their machines.... so it goes down to policies... The software is AV software.Quote:
Originally posted here by nihil
No, it detects potential sercurity risks. If you found any of that stuff on a user's machine I can hardly imagine you would be best pleased. :D
Perhaps in a Corporate environment... but in that case I was talking about my home systems... no internal security problems here.... AV Should stick to AV plain and simple..Quote:
Oh yes it would!...................you would want to know how it got there...............it could well be an indication of an internal security/discipline problem. ;)
That doesn't make life simpler.. that leads to the job hunt and maybe I like the position.. it's one stupid policy...Quote:
Actually it makes your life that much easier......................you go and get a proper job with a real company.
The problem is that the software concept is AntiVirus... they're expanding beyond the concept of the software.. so it's not a deployment problem.. it's a creeping problem... the software is creeping into other areas.. Stop labelling it AntiVirus and label it as a File System Security solution... it finds all viruses, trojans and worms... all malware and then anything that _COULD_ be used in a malicious manner.. but as I said.. 1000s of pieces of software _COULD_ be used maliciously... why has Symantec decided to only pick a few of them.... Why not all of them... That's worse than no coverage because it's a false sense of security.Quote:
Hey, don't go blaming the software concept, when the problems you are describing relate to deployment.
Peace,
HT
I'm with HT here....
AV is _AV_.... Stick to it and do it properly... They are getting so diversified now that they lose the war against the virus writers that watch their sig files and immediately send out variants... Find the damn viruses... Let someone else look for spyware, rootkits etc... or stop calling yourself Anti-virus... Call yourself "Looking for everything but no frigging good at finding anything"... That, at least, is honest!!!!
Hey Tiger~ that is just wishful thinking, and you know it.
Norton and McAfee have been following this route for some time and pulling a few of the others with them. That is the way it will go and they won't turn back.
Can't say I would even consider them for home use these days.
Still, the issue of identifying security risks is interesting, as it is bound to produce false positives unless you are careful where you keep them and don't scan there.
As for automatic deletion, I am always wary of that. You are destroying the "evidence" as well as any "false positives"
As for what gets detected or not, that really is a no-brainer. Stuff that is free is in, stuff that costs a lot of money is out? :D .....................not that I am cynical or anything?
;)