Contents:

• Introduction
• General Tips
• Mapping of Netcat options to Ncat options
• New Ncat options
• SSL Support
• Proxy Support
• Netcat Relays
• Resources

Introduction:

Some of the new features in Ncat compared to the original Netcat are:

• IPv6 support
• SSL support
• Proxy support (both using a proxy and acting as one!)
• Ability to chain Ncat's together
• Ability to specify specific hosts to allow or deny access to in listen mode
• Connection brokering
• SCTP support

General Tips:

• As of Ncat 5.20, the "-p" option can now be used to specify the local port to listen on in listen mode, in order to be reverse-compatible with the original Netcat. This allows for Ncat to be used as a drop-in replacement for most Netcat examples out there! However, the "-s" option cannot be used to specify the local IP address to listen on. Instead, simply provide the IP address without preceding it with "-s".
• If a host to listen on isn't specified, Ncat listens on all local interfaces. If a port to listen on isn't specified, Ncat listens on port 31337 by default.
• By default, timing arguments are in milliseconds! Append "s", "m", or "h" to the value to specify seconds, minutes, or hours, respectively. Note that this is going to change to seconds in an upcoming version of Ncat (newer than 5.30BETA1).
• By default, Ncat accepts up to 100 simultaneous connections! Use "-m1" (that's a numeral one) to limit it to 1 like the original Netcat.
• When using "-e, --exec" to execute commands, it is necessary to specify the full path to any executables used. Using "-c, --sh-exec" executes via /bin/sh and takes advantage of the PATH enviornment variable.
• UDP mode does not support SSL or connection brokering, likely due to its stateless nature.
• Command execution (-e, --exec and -c, --sh-exec) cannot be used with connection brokering (--broker).
• As of Ncat 5.20, Ncat's command execution options can be used with SSL (--ssl) and Ncat's output options (-o and -x)!
• The original stable version of Ncat (5.00) did not properly set the return value based on whether the connection was successful or not. This has been fixed in Ncat 5.20.

Mapping of Netcat options to Ncat options:

New Ncat options:

SSL Support:

Ncat supports SSL, which is useful for many different scenarios, such as securely tranferring files or connecting to SSL-enabled services. For basic file transfer, just add the "--ssl" option to both the listener and the client. This will transparently generate a one-time certificate for the connection. To do manual fingerprint verification, use "-v, --verbose" to see the SHA-1 fingerprint, or use an already-generated certificate (such as one created with openssl) with the "--ssl-cert" and "--ssl-key" options.

Pushing a file from a listener to a client over SSL:

As of version 5.20, Ncat now supports acting as an SSL wrapper around a non-SSL service! One usage case for this feature is setting up an encrypted tunnel for VNC traffic. While there are tons of tutorials on how to set up SSH tunnels for VNC traffic, such a setup can be difficult on Windows systems due to the lack of easy-to-use, well-supported, open-source SSH servers for Windows. However, Ncat is just a simple executable! To set up SSL-enabled VNC, you have to use a listener-to-client relay on both the host running the VNC server and the client running the VNC client. However, there is a bug that prevents VNC from working over Ncat, which seems to be fixed in versions 5.30BETA1 and later.

See the SSL page of the official Ncat guide for more information and examples.

Proxy Support:

Ncat is able to connect through an HTTP or SOCKS proxy, and is able to act as an HTTP proxy in listen mode. While acting as an HTTP proxy, Ncat supports the access control options, as well as --proxy-auth to require username/password authentication. For example, here is how to implement a simple HTTP proxy on port 8080 that only accepts connections from a specific network (192.168.1.0/24), also requiring the username "ncatuser" and password "s3cr3tpass":

Netcat Relays:

While the following Netcat examples are for a Unix-like system, the Ncat examples will work on all supported platforms, including Windows!

Listener-to-Client Relay:

With the original Netcat, you could implement a listener-to-client relay that sends packets from a local port to a port on a remote system as follows:

With Ncat's ability to chain multiple Ncat's together, you could replace the above with:

Without the "-m1" the relay will stay open and allow multiple simultaenous connections! You could also use Ncat's access control functionality to only allow certain systems to access the relay.

Listener-to-Listener Relay:

With the original Netcat, you could implement a listener-to-listener relay that sends packets from any connection on one local port to another local port as follows:

With Ncat, you could use Connection Brokering to achieve the same goal:

With Connection Brokering, multiple clients can connect to a single listening port, and any data sent by any client is sent to all of the other clients. For the purposes of this relay it makes sense to limit Ncat to 2 connections (-m2), but this technique could also be used for broadcasting data from one-to-many. It might also make sense to use --send-only on the client that is sending data and --recv-only on the client that is receiving.

Client-to-Client Relay:

With the original Netcat, you could implement a client-to-client relay that sends packets from a connection to one local port to the connection on another local port as follows:

Using Ncat, the same relay can be implemented as follows:

This takes advantage of the ability to chain multiple Ncat's together, similar to the listener-to-client relay.

Resources:

• Ncat Users' Guide
• Ncat Man Page
• Netcat Cheat Sheet (by Ed Skoudis) (PDF)

The Netcat relay examples used on this page are based on examples by Ed Skoudis.