2

This is related to a college assignment.

I have an Ubuntu server I am trying to do a penetration test on. The server is running a netcat server which when I contact it sends me a nice info message from the lecturer. The question is, can I exploit the fact that there is a netcat server listening. It is not running with a shell using -eoption. When I recreate the environment on my own machines, everything I type on the client appears on the screen on the server as is expected but obviously the command (e.g. ls) are not executed.

I can't tell what version of netcat is running so I don't know if it has known vulnerabilities however all other services are fully patched so I suspect this is also (I have access to the apt logs). It's listening on a UDP port if that is of significance.

This is the script running on the server.

#!/bin/sh
(echo "Hello World"; cat) | nc -ul 3456

All the searching I have done tells me how to set up shell access using netcat using -e.

  • 1
    Homework help is fine if you show work and that you understand the concepts. You have done both, which is great. – schroeder Apr 6 '17 at 13:49
-1

I you look at: https://pen-testing.sans.org/blog/2013/05/06/netcat-without-e-no-problem you can see that there are possibilities, if you are unable to alter the execution, it may be harder.

Note that it requires root, since you need to make a named pipe for sending raw terminal input to the other machine.

| improve this answer | |
  • 1
    Thanks, I had read this article. The problem is I don't have root access as yet. If I did, I could get the ssh in. I have (non root) FTP access and there is an SSH server running but only for the root user. I was just wondering what the function of the 'cat' is before being piped in to netcat. Could I use/abuse this in some way. I may be barking up the wrong tree here, there may be no way to used this open service. – MyNameIsPersonal Mar 7 '17 at 14:33
-2

I don't have a system to play around with, but my first guess would be to try to put the 'cat' into the background by sending ctrl+Z with a command appended.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.