Building a Custom Netcat in Python: Achieving RCE and Remote File Uploads on Android 📱💻

python7427 ython — Sat, 18 Jul 2026 12:33:10 +0000

Introduction
Understanding how malicious actors gain Remote Code Execution (RCE) or exfiltrate data requires a solid grasp of low-level networking tools. While standard tools like netcat are readily available, rewriting them from scratch is one of the best ways to master socket programming and threat concepts.

In this project, I built a custom Python implementation of Netcat (netcat.py). Using nothing but my Android device running Termux, I successfully bound the script to the local wildcard address (0.0.0.0), simulated an RCE payload execution, and remotely pushed a file to the system. Here is how the tool works and how I tested it in a mobile lab environment.
How the Script Works
Instead of breaking down the code line by line, let’s look at the architectural design of this tool.
The core of the netcat.py script relies on Python’s standard socket, threading, and subprocess modules. It is built as a multi-functional networking utility governed by command-line arguments handled via argparse. The tool operates in two fundamental modes:
Client Mode (send): Connects directly to a targeted remote IP and port to transmit a data buffer or initiate an interactive session. Server Mode (listen): Binds to a local interface (like 0.0.0.0 to listen on all available network interfaces) and waits for incoming connections. To keep the server responsive, each incoming client connection is offloaded to a separate worker thread
Once a connection is established in server mode, the script executes one of three core workflows based on user flags:

Command Execution (-e): Runs a specific system command via the host OS shell using subprocess and returns the output to the client.
File Upload (-u): Continuous packets are read directly from the socket stream and compiled into a file buffer, which is then written locally to the target's disk. Interactive Shell (-c): Spawns a lightweight loop acting as a remote command shell, passing received strings directly to the underlying terminal execution environment and feeding the results back across the socket.
The Android Lab Setup & Proof of Concept
Testing offensive scripts on an unrooted Android device provides a highly contained sandbox environment. Here is how I validated the application's core functionality.

Simulating the Target Environment (Listener) First, I set up the script inside Termux to act as the target server. By binding it to 0.0.0.0, the script listens on all available interfaces, allowing connections locally or from the local network.

To simulate a scenario where we want to remotely drop a file onto the device, I initiated the listener with the upload flag:
python netcat.py -t 0.0.0.0 -p 5555 -l -u=dropped_file.txt

Executing the Remote File Upload (Client) From a separate terminal instance (or a separate device on the same local network), I acted as the operator. By piping the contents of a local file into our custom client, the network socket cleanly transferred the data payload: echo "This file was transferred via custom Python Netcat!" | python netcat.py -t 127.0.0.1 -p 5555 Upon receiving the stream, the listener on the Android environment successfully terminated the connection, closed the buffer, and saved dropped_file.txt to the file system exactly as intended. Using the shell execution (-c or -e) flags, this same architecture effortlessly grants standard Remote Code Execution (RCE) to issue commands within the application's user permissions. Takeaways & Defensive Considerations Replicating these utilities reinforces a few crucial security paradigms:

Permissions Matter: Even without root access on Android, a userland environment like Termux can host network services capable of executing arbitrary commands within its application sandbox.
Ingress Monitoring: Security systems must heavily monitor internal networks for unexpected listeners binding to wildcard addresses (0.0.0.0).
Building tools like this completely reframes how you look at network protocols. If you are interested in trying this out or studying the implementation further, the full source code is available in my repository!
If you are interested in trying this out, the full source code is available in my GitHub Repository!

How I Built a Network Scanner in Python Using Termux on an Unrooted Android Phone 📱🐍

python7427 ython — Sat, 18 Jul 2026 12:06:59 +0000

Introduction
In cybersecurity and networking, you don’t always need a high-end desktop setup to practice your skills. Sometimes, the best lab is the one right in your pocket.

In this post, I will share how I successfully wrote and executed a network port and DNS scanner using Python and Scapy, running entirely inside Termux on an unrooted Android device. If you've ever wanted to turn your phone into a portable network analysis tool, here is how you can do it.

Why Termux and Scapy?
Termux brings a powerful Linux environment to Android without requiring root access. By pairing it with Scapy—a powerful Python-based interactive packet manipulation program—we can craft custom packets to scan systems for open ports (SYN scans) and active DNS services.

Note: Because Scapy handles raw packet generation, running network scans on an unrooted phone can sometimes face socket restrictions. However, utilizing standard TCP/UDP scripting within Termux provides an incredible, lightweight learning lab.

The Code
Here is the Python script I used. It takes a target IP address, validates it using Python's native ipaddress module, and then performs a stealthy SYN scan alongside a DNS service check.

Python
from scapy.all import *
import ipaddress

Common ports to target

ports = [25, 80, 53, 443, 445, 8080, 8443]

def SynScan(host):
print(f"\nScanning for open ports at {host}...")
ans, unans = sr(
IP(dst=host)/
TCP(sport=33333, dport=ports, flags="S"),
timeout=2, verbose=0
)

for (s, r) in ans:
    # Check if the replying packet has the SYN-ACK (SA) flags
    if s[TCP].dport == r[TCP].sport and r[TCP].flags == "SA":
        print(f"[+] Port {s[TCP].dport} is OPEN")

def DNSScan(host):
ans, unans = sr(
IP(dst=host)/
UDP(dport=53)/
DNS(rd=1, qd=DNSQR(qname="google.com")),
timeout=2, verbose=0
)
if ans:
print(f"[+] DNS Server active at {host}")

Main execution

host = input("Enter Target IP Address: ")

try:
ipaddress.ip_address(host)
except ValueError:
print("[-] Invalid IP Address format.")
exit(-1)

SynScan(host)
DNSScan(host)
Breaking Down How It Works
IP Validation: The ipaddress library ensures the script doesn't crash or send malformed data if the user inputs an invalid string.

The SYN Scan (SynScan): We craft a custom TCP packet with the flags="S" (SYN) flag. If the target port is open, it replies with a SYN-ACK (SA) flag, which our script catches and prints.

The DNS Probe (DNSScan): It crafts a UDP packet bound for port 53 containing a standard DNS query for google.com. If a response comes back, we know a DNS server is up and listening.

Conclusion & Next Steps
Building tools like this on mobile proves that you don't need expensive infrastructure to learn networking fundamentals. Moving forward, I plan on adding multi-threading to speed up the scanning process and expanding the port list.

Have you ever used Termux for network testing? Let’s talk about your favorite mobile setups in the comments below!

DEV Community: python7427 ython

Building a Custom Netcat in Python: Achieving RCE and Remote File Uploads on Android 📱💻

How I Built a Network Scanner in Python Using Termux on an Unrooted Android Phone 📱🐍

Common ports to target

Main execution