I know I can spawn the shell on server side using:

nc -l 1111 -e /bin/bash

But I want to spawn the shell on the client side.

I tried doing: nc 1111 | /bin/bash

It works but I can't see the output of the executed commands.

So the question is, is there any way to spawn the shell on the client side using netcat?

  • I found a solution : (nc 1111 | /bin/bash) | nc 2222 But in this, I had to open two ports (one for sending commands and one for receiving output commands). I'm still looking for a proper solution. – Rakesh Mane Apr 15 '17 at 10:23

Seems to work for me, though depends on the version of netcat. Debian has packaged two: "netcat-traditional" and "netcat-openbsd". The former supports -e in both client and server mode, the latter doesn't support it at all.

$ nc.traditional localhost 1234 -e /bin/bash

$ nc.openbsd localhost 1234 -e /bin/bash
nc.openbsd: invalid option -- 'e'

The one on my OSX doesn't support it either.

If you need to do this with a netcat that doesn't support -e, you may need something like this: How to make bidirectional pipe between two programs?

  • Rakeshs-MacBook-Air:~ rakesh$ nc -e /bin/bash 1111 nc: invalid option -- e Not working for me. I'm on OSX. – Rakesh Mane Apr 15 '17 at 10:38
  • Not working for me in Linux as well. Which version of netcat are you using? – Rakesh Mane Apr 15 '17 at 10:44
  • @RakeshMane, ah right, there are different versions of netcat, even two packaged in Debian. – ilkkachu Apr 15 '17 at 10:53
  • 1
    There is also socat, very powerful netcat replacement. blog.stalkr.net/2015/12/… – rudimeier Apr 15 '17 at 11:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.