how to get remote access to your hacking targets // reverse shells with netcat (Windows and Linux!!)

About this video

NetworkChuck teaches reverse shells with Netcat, which he calls the network Swiss Army knife. He explains the core idea: home and enterprise firewalls usually block inbound connections but allow outbound ones, so instead of connecting to a target, the target connects back to the attacker. Using a cloud machine he sets up on Linode as the attacker, he starts a listener with nc -lnvp on port 87, then on a Kali Linux target he runs Netcat with the -e option to offer /bin/bash to the attacker’s address and port, after which he demonstrates running commands such as whoami and ls through the resulting shell. For a Windows target he uses a PowerShell reverse-shell script he takes from the PayloadsAllTheThings repository, piping it into a Netcat listener on the server side, and demonstrates directory access on the Windows machine. He explains such commands are typically delivered as payloads, for example via phishing, as a basic form of a remote administration tool, and finishes by plugging a Hak5 LAN Turtle into a network to show it repeatedly connecting out to his server so he can run scans such as Nmap from the hidden device. The video is framed as education for his own network, CTFs and ethical hacking practice only.

Key takeaways

• A reverse shell works because firewalls typically block inbound connections but allow outbound ones, so the target connects to the attacker
• Attacker listener he uses: nc -lnvp with a chosen port (87 in the demo) and -s for the source address on his cloud box
• Linux target command he uses relies on Netcat’s traditional -e option to offer /bin/bash, which he notes is absent on many distros
• Windows target is reached with a PowerShell script from PayloadsAllTheThings rather than installing Netcat
• A LAN Turtle planted on a network can connect out through the firewall and give the attacker a foothold for tools like Nmap

Episode details: published July 8, 2021 · 20:08 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: You need a NAS RIGHT NOW!! (How I run my Hybrid-Cloud YouTube business) · Next: DDNS on a Raspberry Pi using the Cloudflare API (Dynamic DNS) →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube