Something isnt making sense here. This is the output of the command:
% Total % Received % Xferd Average Speed Time Time Time Current
100 1056 0 1056 0 0 1056 0 --:–:-- --:–:-- --:–:-- 11234
It appears to have downloaded 1056 bytes from somewhere. But where from? Sure enough I can see an nc.exe file that has been created and its 1056 bytes.
If the nc.exe file is just the output of the curl how can it run? It must be getting the binary for nc.exe from somewhere?
The next step in the walkthrough is to execute this file as part of a scheduled service to receive a reverse shell.