0

I would be very grateful for some help: This is with regards to a Netcat based script running on a Debian based distribution, specifically the Proxmox hypervisor (see here if unknown https://en.wikipedia.org/wiki/Proxmox_Virtual_Environment)

I would need to run a script to perform a non-critical action (starting a Virtual Machine) when netcat receives the transmission "temp". The script is as follows:

nc -v -l -w 60 -i 5 -p 21212 | while read ; do MAC=${REPLY}; echo Received: $MAC if [ "$MAC" == "1" ] then echo STARTING VM1! echo Wait 5 Sec sleep 5

elif [ "$MAC" == "temp" ] then echo STRATE VM2! /usr/sbin/qm start 1022 fi

Could the Debian running above script be exploited, as Netcat listens on Port 21212 (it could of course listen to another port as well if I change that)? Naturally, anyone in the network could start a VM, but is there another risk?

0

There's always risks of exploits when you don't sanitize your inputs or do some state checking.

Yes, the UDP packet should look like "0cd29248689b" ... but what happens when it is short? i.e: "0c", or long? i.e: 0cd29248689b1234) or when you get a fragmented packet? i.e. packet 1 has "0cd292" and packet 2 has "48689b".

What happens if the VM is already started, or in a "in-between" state (booting/shutting down)... you can end up with many potential failure points.

Why not include some additional filtering on IP, or some built-in authentication of some sort? (password hashed with timestamp or something?) Why are you using UDP instead of TCP? Is this just for "home-use" or are you planning on trying to make this a publicly shared thing for everyone to use?

There's also many additional questions... like why not use the VM name instead of the mac-address?

| improve this answer | |
  • but what happens when it is short? i.e: "0c", or long? i.e: 0cd29248689b1234) or when you get a fragmented packet? -> Then nothing happens based on the script. Why are you using UDP instead of TCP? I can use TCP instead. why not use the VM name instead Thats fine as well. – Bob Hart Dec 6 '19 at 14:08
  • The essential question is: Can the listening Netcat be exploited? – Bob Hart Dec 6 '19 at 14:12
  • I fail to understand the question entirely. Netcat itself doesn't process the packets, and is not really susceptible to attacks. It works on a garbage-in/garbage-out model. It's what you attach to it that can become susceptible, and how it is attached. – TheCompWiz Dec 9 '19 at 23:12
  • Dear TheCompWiz. I changed the original posting to be more understandable. I agree with you that " It's what you attach to it that can become susceptible". The "attched action " is non-critical. The question is : Could Netcat be exploited in another way? – Bob Hart Dec 22 '19 at 20:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.