Scenario is as follows:

In a vulnhub lab, I got limited shell. By means of

attacker> nc -lvp 1234

victim> nc _attacker_ip 1234

I found out that ubuntu's ufw is limiting outgoing traffic.

Since I'm no root, I can't list ufw rules. Is there any software that can detect outgoing rules? I guess it wouldn't be that hard to set a server on the attacker machine to listen in ALL ports, and a client in the victim machine that would "tcp-ping" every port, so it can detect outgoing rules.

Is there any similar software out there? If not, I would maybe roll my own.

  • 1
    Are you allowed to run commands like netstat -antup (add the c option for continuous output) ? That would show current activity, although there must lots of RELATED traffic that is allowed thru, being initiated by the Ubuntu machine. I am not familiar with UFW but the documentation says it is basically a front-end for iptables, then maybe you could query iptables like this: iptables -nL. – Anonymous Mar 14 '20 at 14:13

A generic way to test available outbound ports, independent of the location of the port filter (e.g. local host-based firewall, perimeter firewall), is exactly what you proposed - trying to connect to an external system, that is listening on all available ports.

You do not have to re-invent a mechanism for the target system of the connection attempts, because such a system is readily available: PortQuiz

If you do already have limited shell access, you can write a short bash-script (or whatever scripting language you have available), that tries to connect to PortQuiz and outputs all successful attempts.

You can also try more complex approaches like DNS tunneling to setup your communication channel, but I wouldn't consider this in scope of your question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.