3

I'm trying to use ncat to connect between virtual windows7 and linux machines.

On linux:

ncat -vnl 4444 --ssl

On windows:

ncat -v 10.10.14.2 4444 --ssl

And when I try to connect from the client I get this error:

Ncat: Failed SSL connection from 10.10.14.2: error:1417D102:SSL routines:
tls_process_client_hello:unsupported protocol

Things I tried that did not work:

  • Adding extra parameters --ssl-cert test-cert.pem --ssl-key test-key.pem
  • Trying the other way around(linux client, windows server) I also googled a lot but, but I couldnt find a real solution, its all what might be wrong.

I can make this work using openssl s_client. But I need to use ncat, how can I solve this problem?

1
  • what version is the ncat on windows? try getting an ncat of the same version as the linux one.
    – ztk
    Dec 8, 2017 at 18:28

4 Answers 4

7

The problem is that the Linux ncat server will only use TLS1.2 for SSL connections. The Windows ncat is not using TLS1.2. This causes the unsupported protocol error.

I can replicate this issue using ncat version 7.60 on linux and connecting to it with openssl s_client using different protocol options. ncat 7.60 only uses tls1.2 for ssl connections.

To make this work using ncat, install the same version of ncat on both systems.

4
  • s_client is one option, changing ncat versions so that they match is another.
    – ztk
    Dec 8, 2017 at 18:40
  • changing versions is not possible
    – Spring
    Dec 8, 2017 at 18:49
  • @Spring Well, this answer explains that the versions are incompatible. If changing versions is not an option, you're out of luck. Is there a particular reason why you can't change the setup?
    – Arminius
    Dec 8, 2017 at 19:48
  • @Arminius that's pentest virtual lab environment, not recommended to update/downgrade any software
    – Spring
    Dec 8, 2017 at 21:28
3

Check in your /ect/ssl/openssl.conf if there is something that sets a minimum TLS version.

For example I found this at the bottom of my config:

[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=2

I think your problem is that MinProtocol is set to only accept TCP 1.2

This is a more secure config, but if you are doing PWK then you may want to comment out this section so that revers shells are possible with ncat.

0

As it seems that you are coming from PWK, check out Errata on their forum.

From their forum it seems that openssl s_client is acceptable, at least until this issue gets resolved on windows7 virtual machine.

In case you really need to use ncat, upgrade to up-to date version should help.

1
  • "I can make this work using openssl s_client. But I need to use ncat, how can I solve this problem?" Can you clarify how your answer addresses the question? It would help to flesh out the "how", and add a link for your reference.
    – fixer1234
    Jun 26, 2018 at 20:34
0

If you are using an updated version of Kali the file is located at /etc/ssl/openssl.cnf Go to the MinProtocol option and set it to TLSv1.0. a quick command to run would be

locate openssl.c

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .