2

This is related to a college assignment.

I have an Ubuntu server I am trying to do a penetration test on. The server is running a netcat server which when I contact it sends me a nice info message from the lecturer. The question is, can I exploit the fact that there is a netcat server listening. It is not running with a shell using -eoption. When I recreate the environment on my own machines, everything I type on the client appears on the screen on the server as is expected but obviously the command (e.g. ls) are not executed.

I can't tell what version of netcat is running so I don't know if it has known vulnerabilities however all other services are fully patched so I suspect this is also (I have access to the apt logs). It's listening on a UDP port if that is of significance.

This is the script running on the server.

#!/bin/sh
(echo "Hello World"; cat) | nc -ul 3456

All the searching I have done tells me how to set up shell access using netcat using -e.

1
  • 1
    Homework help is fine if you show work and that you understand the concepts. You have done both, which is great.
    – schroeder
    Apr 6, 2017 at 13:49

2 Answers 2

-1

I you look at: https://pen-testing.sans.org/blog/2013/05/06/netcat-without-e-no-problem you can see that there are possibilities, if you are unable to alter the execution, it may be harder.

Note that it requires root, since you need to make a named pipe for sending raw terminal input to the other machine.

1
  • 1
    Thanks, I had read this article. The problem is I don't have root access as yet. If I did, I could get the ssh in. I have (non root) FTP access and there is an SSH server running but only for the root user. I was just wondering what the function of the 'cat' is before being piped in to netcat. Could I use/abuse this in some way. I may be barking up the wrong tree here, there may be no way to used this open service. Mar 7, 2017 at 14:33
-2

I don't have a system to play around with, but my first guess would be to try to put the 'cat' into the background by sending ctrl+Z with a command appended.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .