Show Posts
1
Tutorials / Re: backdoors with netcat
« on: August 04, 2013, 07:05:29 am »
If you're on Linux with netcat there's a tool "miniupnpc" for setting up UPnP. I'm using it on a product and it's pretty handy. I'm not sure if there are binaries available (I just get it from the package manager", and you might be able to find a ghetto-built Windows binary that isn't in MinGW. There are also newer builds with more options but for some reason I have old binaries.
Anywho, the basic command is
Most home routers have UPnP enabled so there's no problem. Specify TCP or UDP depending on your connection.
There are two things that are really handy about this tool:
-First is specifying the IP. You can set up UPnP for a different computer. Suppose you're on a local network with an unprivileged user- you can sorta do stuff but it'll take too long to a get working upnpc binary on the computer. Just set the UPnP from your computer.
-Second is using different internal and external ports. You can easily disguise your shell as a mundane service by picking a different external port. If I had multiple programs/scripts I'd probably strewn them about ports 54000-62000 where torrents often go and out of quick scan ranges.
The default IGD lease duration is 0, which should be an infinite lease but might be different if the router has crappy UPnP implementation. Newer builds of upnpc can specify lease duration. You might want to limit it to a couple days so you don't leave an obvious footprint. You could also use the "-d" to the delete the lease, put it on cron or just do it manually once you've established a proper backdoor.
Also I would not use netcat as a personal backdoor. SSH only, then use that to access local tools if you want more (configure them to only run on localhost).
Anywho, the basic command is
Code: [Select]
upnpc -a ip port external_port TCP
upnpc -a 192.168.1.5 22 22 TCPhttp://manpages.ubuntu.com/manpages/precise/man1/upnpc.1.htmlMost home routers have UPnP enabled so there's no problem. Specify TCP or UDP depending on your connection.
There are two things that are really handy about this tool:
-First is specifying the IP. You can set up UPnP for a different computer. Suppose you're on a local network with an unprivileged user- you can sorta do stuff but it'll take too long to a get working upnpc binary on the computer. Just set the UPnP from your computer.
-Second is using different internal and external ports. You can easily disguise your shell as a mundane service by picking a different external port. If I had multiple programs/scripts I'd probably strewn them about ports 54000-62000 where torrents often go and out of quick scan ranges.
The default IGD lease duration is 0, which should be an infinite lease but might be different if the router has crappy UPnP implementation. Newer builds of upnpc can specify lease duration. You might want to limit it to a couple days so you don't leave an obvious footprint. You could also use the "-d" to the delete the lease, put it on cron or just do it manually once you've established a proper backdoor.
Also I would not use netcat as a personal backdoor. SSH only, then use that to access local tools if you want more (configure them to only run on localhost).