3

On the (few) penetration tests that I've done so far, I've typically created a reverse shell with Netcat to run commands on the target machine. Now, it looks like a lot of people like to use an SSH client to do this. I've been researching for more information and found that if anything, it looks like Netcat would be better to use. This is due to a lot of networks either not having SSH installed for security reasons, or firewalls preventing SSH communication.

So, what I'm wondering is when is it appropriate to use a reverse shell with Netcat vs an SSH client? What are the pro's and con's of each? Thank you.

  • 1
    It looks like you answered your own question: you use the tools that work in the environment you are testing. – schroeder Dec 29 '15 at 20:46
  • 1
    @schroeder That makes sense, thank you for your insight! I was wondering, if you're free to use whichever on a network, is there any benefit to using SSH over Netcat or does it just come down to preference at that point? – Henry F Dec 29 '15 at 20:50
3

The main difference is that the "SSH tunnel" is encrypted from client to server. The netcat is just unencrypted connection of what you write and read from it (or higher-level protocol).

If you do this in your trusted environment, netcat should be enough. Also it should be enough if the higher-level protocol has some kind of encryption. Otherwise there is SSH tunnel (aka TCP Forwarding) to keep your communiques secret.

And some people are more familiar with ssh commands so they rather use SSH, then to learn netcat syntax.

  • @Jakuke Thank you so much for your insight! That makes perfect sense. Now, Ncat was brought into the mix, which in my understanding is basically the encrypted version of netcat, would your tool of choice just depend on personal preference at that point? – Henry F Dec 29 '15 at 20:56
  • Personally, I am more ssh guy so I am still a bit confused between all the nc, ncat and netcat versions. I see Ncat has support for SSL encryption, but for it you would need another checks, keys, certificates and if there is already established the SSH infrastructure (even MS decided that it makes sense), establishing another secrets is for me waste of time and resources. – Jakuje Dec 29 '15 at 21:01
  • I see, that's really good to know. Thanks a lot for sharing your knowledge I appreciate it! – Henry F Dec 29 '15 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.