I'm working on a research project, which involves remoting into a Windows machine from Linux via NetCat. The command to open up a listener is

nc.exe -Ldp PORT -e cmd.exe

And the command to connect from Linux is

nc -v IP PORT

When issuing the second command on Linux, I'm dropped into a cmd shell in whatever directory NetCat is in. And then from here I can issue DOS commands willy-nilly.

But alas, I can't seem to pass NetCat a DOS command to execute from my Linux machine. It would be really cool if I could just pipe my DOS commands into the command to connect to the NetCat listener. Then I don't have to worry about connecting via Linux, waiting to drop into a CMD shell, and then issue my DOS command. I could just string 'em all together.

How can I pipe DOS commands into NetCat in Linux such that it connects to the Windows machine and executes my commands?

  • Just a heads up, if there's an easy fix, don't just post a comment. I can't award bounties on comments. If it answers the question regardless of brevity, post it as an answer. The first person who posts a workable solution gets the loot. – Verbal Kint Sep 22 '16 at 18:21
  • What have you tried so far? Would printf 'whoami\r\n' | nc -v <ip> <port> work? – prateek61 Sep 22 '16 at 18:28
  • I tried conventional Linux piping, no dice. And I looked into the command switches on NetCat: sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf, but I can't find anything of interest there – Verbal Kint Sep 22 '16 at 18:29
  • Sorry -- see edit. – prateek61 Sep 22 '16 at 18:30
  • Also, some versions of netcat include a -C or a --crlf option. Does yours have that, and does that help? – prateek61 Sep 22 '16 at 18:34

Solution was to use cat and have it wait on stdin.

cat <( printf 'whoami\r\n' ) - | nc -v <host> <port>

  • I don't exactly remember where I got this from, however I will provide the link when I find it. – prateek61 Sep 22 '16 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.