- In this video, I'm going to show you how to use Netcat
to run a reverse shell attack against a Windows 11 computer.
(rock music)
Now, before we continue,
if you enjoy these types of ethical hacking videos,
consider subscribing to my YouTube channel,
I upload a whole bunch of ethical hacking content
to my YouTube channel.
Please like this video if you enjoy it
and click on the bell to get notifications.
Okay, without further ado, let me show you
how to set this up so that you can run a reverse shell
on a Windows 11 computer
and connect to a server on the internet
and control that Windows 11 computer
from a server on the internet.
What I'm showing you here is for educational purposes only.
Do not use what I'm showing you here to attack other devices
that you don't own or have permission to attack.
Only use the information here to attack devices
that you own or devices that you have permission to attack.
In this example, I've got Windows 11 connected to my screen,
as well as a Mac M1 Mini.
This is a virtual machine hosted by Linode.
Has a public IP address of that.
I am SSHing to that server.
So in my example, I've got a Windows 11 computer
connected via WiFi to my home router.
Home routers or enterprise routers typically run firewalls
and will typically not allow connections from the outside.
In other words, they will not allow
a Netcat attacking device to access an internal machine
or internal computer on your home network.
So what we want to do here is bypass that.
Firewalls will typically allow connections from the inside
of your network to the outside.
In other words, they will allow connections
from your home network to the internet,
but will not allow connections from the internet
to your home network unless they are initiated
or started by the inside device, in this case, Windows 11.
So what I'm going to do is run Netcat on an internet server
hosted in the cloud.
Once again, this is on a Linode,
who I want to thank for sponsoring this video.
You can get a hundred dollars credit using the link below
or using the code davidbombal.
Hosts, such as the one I'm using, don't cost very much.
In this example, I'm using Ubuntu 20.04 LTS,
and I'm running the device in the UK,
but you could host the device around the world.
I don't need a lot of CPU power and a lot of RAM,
so to create a host like this,
I'm going to use a one gig host.
Costs $5 a month, and once again,
you can get a hundred dollar credit.
So you can basically run a device such as this for free.
So I'll just create another device here,
such as "ubuntu2" and click create and that host is created.
And I'll be able to access it remotely
as soon as it's provisioned.
But in my example, I've already got a host configured
and running called "netcat_attack_vm".
It's got this IP address.
So what we wanted the Windows 11 computer to do
is initiate a connection to that device
with IP address 139.162.246.75.
That's this device, once again.
I've SSHed from my Mac to that device.
Command IP address shows me the IP address
of that virtual machine.
So to run an attack such as this,
you need an attacking device.
Next thing we need to do is run some code
on this Linode host.
I've created a PDF to help you do this.
(rock music)
This method, which is an easy method,
is to run this command on your Linux server in the cloud.
So what I'll do is paste that command onto the Linode host.
I'm using a port number here of 81.
You may want to use another port number.
Generally well-known ports are below 1024.
So you probably want to use a port number in that range
because that will be permitted by firewalls.
Don't worry too much about these commands.
Basically what we're doing here is setting up Netcat
to listen on port 81.
Step one, we've got a host. We've done that.
Step two, we're running Netcat on the host.
Third step now is somehow we need to initiate
the connection, we have to get to the client
to initiate a connection to the internet, to that server.
One of the ways to do that is to send them a phishing email,
send them an email where they open up a file
and that initiates the connection.
This is why you need to be really careful
opening up attachments on emails.
Don't just open up an executable.
Don't just open up a PDF.
Make sure that you warn people who are not tech savvy
why they shouldn't just open up files on emails
or download files from the internet.
You want to be really careful doing that
because of stuff like this.
Now, in my example, what I've done is I've planted
an OMG cable in this network.
These cables look just like traditional USB cables.
This is USB-A to USB-C.
But can you see where the problem is over here
in my home network?
Where is my cable hidden?
So actually what I've done is I've connected the OMG cable
to this wireless keyboard.
I'm now sending keystrokes through the wire connection
rather than the wireless keyboard.
Why would you do that?
Because you may need to charge your Bluetooth keyboard,
which I'm doing here.
Now, before I continue, some people might say
why are you using a Apple keyboard
with a Microsoft operating system?
That's just because I've got a specific OMG cable here.
But you could use other keyboards.
So there's an OMG cable for a keyboard such as this.
I'm just using an Apple keyboard for this demonstration,
but you don't have to,
it does work with other keyboards as well.
And in previous videos,
when I've demonstrated the OMG cable,
people have left comments and saying,
"David, you're connecting to the OMG cable
from the same room," but just be aware that you can connect
to an OMG cable, it runs a WiFi access point within it
from up to a mile away.
That's how far away it's being tested.
So in my example, I'm using this iPhone to connect
to the WiFi access point within this cable
to initiate the session from the Windows computer
to my attacking device.
What I'm going to do here is a load a script.
So I've pre-created scripts and saved them in the OMG cable.
Now you don't have to do that.
If you connect wirelessly, you could paste code
onto the OMG cable and then run the attack.
But what I'll do now is I'll press run,
and hopefully what you'll see on the Windows computer
is something happens.
It runs a PowerShell command.
And what you'll see now is on the attacking device,
hosted in Linode, we've got a connection
and a Windows PowerShell connection has been opened.
I could type a command such as "dir",
and that gives me all the files on that computer.
So as an example, if I go to route, type "dir",
there are the directories on the Windows computer.
I have got this Windows computer to initiate a session
to Netcat in the cloud, and now I can do things.
In the document which I've shared with you,
I've got some commands that you could try.
So I can now paste commands on the Linode server
to get things to happen over here.
So I'll just move the keyboard away,
I'm not going to touch the Windows computer,
and let's do something which you have to do
as part of the fun.
(rickrolling)
(rock music)
In this example, what I'm going to do is start Netcat
on the server using port 81.
You could use a different port if you wanted to.
Another thing you need to do with this method
is set up a web server.
So I'm going to SSH back to the new server
that I've created.
And what I'll do is start a little Python web server
on port 80.
So I need to run two steps, basically, on the server.
I have to run a web server and I have to start Netcat.
So basically going back to our topology,
I've done two steps on the Linode server.
Set up a web server and I've started Netcat,
now I need to do something on the client
and I need to get it to initiate the connection
to the server.
Now, one of the great things about Windows 11
is the antivirus has got a lot better.
So real-time protection has got a lot better.
In my tests, I've found that if you don't disable
real-time protection, this reverse shell is blocked.
So to stop or mitigate this kind of nonsense,
one of the things that you're going to make sure that
you don't turn off is real-time protection.
Real-time protection blocks the reverse shell.
So it's great that Microsoft real-time protection
has got this good that it blocks reverse shells.
I've had to manually disable that.
And then what we need to do is run the script.
Now, in this example, the client or victim
is going to connect to the attacking server
and run the script, is going to connect to the web server
and run the script.
So we need to have the script on the attacking server
and you need to change this domain name
to the correct domain name.
So in this example, "shell.theboss.lol" needs to be changed
to the IP address of the attacking server.
I'm using a different server in this example.
So the IP address of this server is this server is this.
So when I create the script
and the script I'm going to create is called "payload.ps1".
So payload.ps1,
I need to edit this IP address or domain name
to the correct IP address of the server.
This method allows you to use a domain name.
In my example, I have got the domain name,
shell.theboss.lol resolving to this IP address.
But now that I'm creating a new server,
I need to edit the script to point to the new server.
So, as an example, if I do an NS lookup for
shell.theboss.lol that resolves to this IP address
of my first Linode attacking device,
the one that I've previously demonstrated.
But now that I'm using this IP address,
I need to change my script to use that new IP address.
And I need to specify the right port,
which in this example will be 81.
So that's fine. So I'll save the script.
So we need to do three things on the Netcat
or attacking server for this example.
We need to have a web server, we need to run Netcat,
and we need to have a script
that's going to be run by the client.
So I've got Netcat running, I've got my script here.
So if I cat to look at the script, there it is.
Script is running. So I need to run my web server now.
And I need to specify the port,
which in this example is going to be port 80.
So last step now is to run the malicious code on the client.
And the code we need to run is this.
Notice, once again, it's pointing to theboss.lol,
so I'm going to have to change that
to point to the correct server name.
So on the client now, I need to edit this domain name
to point to the IP address of my attacking server,
which is going to be 85.159.213.165.
So again, this code needs to be run in PowerShell
on the victim computer.
So what I'll do here is run PowerShell.
So I'll paste that code in on our attacking server now.
Netcat is listening on port 81.
We've got the web server running,
so hopefully we'll see a connection.
And as you can see there, something happened.
We had a connection from the client to the server
and we've got an HTTP 200, that means success.
And now on Netcat, I can type commands such as dir,
and that shows me Windows information such as
the desktop, documents, downloads, et cetera.
Okay, I hope you enjoyed this video.
If you did, please like it.
Please consider subscribing to my YouTube channel
and clicking on the bell to get notifications.
I'm David Bombal, and I want to wish you all the very best.
(rock music)