DIR <- Back
Using only bash to send raw tcp requests
========================================
About The Feature
-----------------
Bash has a builtin feature called "net-redirections" which enables you to use a pseudo
file /dev/tcp to open a filedescriptor which represents a tcp-socket.
Here are a couple of examples to illustrate what this can be used for:
1. you can speak gopher:
exec 99<>/dev/tcp/kroovy.de/70
echo "/" >&99
cat <&99
2. same thing as one-liner:
exec 99<>/dev/tcp/kroovy.de/70; echo '/' >&99; cat <&99
3. you can speak http:
exec 99<>/dev/tcp/kroovy.de/80
printf 'GET /gopherproxy/?q=kroovy.de HTTP/1.1\r\nHost: kroovy.de\r\nConnection: close\r\n\r\n' >&99
cat <&99
4. you can even stream media over this:
exec 99<>/dev/tcp/kroovy.de/70; echo '/meme/coffee-like-brad.webm' >&99; cat <&99 | mpv -
5. or stream media from behind a basic auth:
exec 99<>/dev/tcp/example.tld/80
printf "%s\r\n%s\r\n%s\r\nConnection: close\r\n\r\n" >&99 \
"GET /movies/jurassic_park.mp4 HTTP/1.1" \
"Host: example.tld" \
"Authorization: Basic $(printf 'username:password' | base64)"
sed '1,/^\r$/d' <&99 | mpv -
note: the sed is used to strip away the http header.
6. you can also prompt redis in case you have no redis-cli on your system:
exec 99<>/dev/tcp/127.0.0.1/6379
printf "INFO MEMORY\nQUIT\n" >&99
cat <&99
7. same thing as one-liner:
exec 99<>/dev/tcp/127.0.0.1/6379; printf "INFO MEMORY\nQUIT\n" >&99; cat <&99
The Security Perspective
------------------------
From a security standpoint you might not even want to have this feature enabled.
1. especially in order to connect to untrusted sources you want something that is more
hardened than this. for example curl(1).
2. an attacker that manages to run bash could use this to fetch his malicious toolkit
from his external server.
(in order to protect against this, you don't want to have curl or wget on you system
either)
If you compile bash from source this feature is enabled by default (which to me is a bit
counter-intuitive, since the switch is called --enable-net-redirections).
In order to deactivate the feature you have to use:
./configure --enable-net-redirections=no
If you didn't know about this feature before, you can see this as an example how bloated
bash actually is. If you run bash, you run a lot of code that you might not need, but is
a security risk.
To increase the difficulty for an attacker to succeed, reduce the number of unnecessary
features.
Maybe you even want to switch to a shell that is small, fast and POSIX-complient but less
feature-rich:
bash (compiled with reduced features and --posix mode)
dash
OpenBSD ksh
BusyBox ash
HTML dash
HTML ash
"All in all it's just raising the bar."
- Another Smash of the Stack (OpenBSD 6.0)
HTML Song
HTML Lyrics
Also props to Marek who initially shed light on this feature in his
HTML Blogpost
He used this feature as a clever survivaltool within a minimal container that didn't provide curl.