Reverse connection: ICMP shell

[Nytro]

[h=1]Reverse connection: ICMP shell[/h]

Background

Sometimes, network administrators make the penetration tester's life harder. Some of them do use firewalls for what they are meant to, surprisingly!Allowing traffic only onto known machines, ports and services (ingress filtering) and setting strong egress access control lists is one of these cases. In such scenarios when you have owned a machine part of the internal network or the DMZ (e.g. in a Citrix breakout engagement or similar), it is not always trivial to get a reverse shell over TCP, not to consider a bind shell.

However, what about UDP (commonly a DNS tunnel) or ICMP as the channel to get a reverse shell? ICMP is the focus on this post.

Surfing the Net I found two handy tools to get a reverse shell over ICMP:

• soicmp - Developed in Python. Some useful features like the possibility to run soicmp daemon on multiple ethernet interfaces simultaneously handling multiple client connections. Unfortunately it uses RAW_SOCKETS on both client and server. You'll need the highest system privileges (root / administrator) to successfully run it on both endpoints. This means that you need root privileges onto the target system that you have owned, which might not always be the case. It is cross-platform. Also, it looks to me that it is unmaintained as of 2006-10-26.
  
• icmpshell - Developed in C. As per soicmp, it uses raw sockets on both the client and server side, therefore root privileges are required to use this program. It works on POSIX systems only, no support for Windows. Also, it looks to me that it is unmaintained as of 2002-02-06.
  

icmpsh

Last year a friend of mine coded a tool called icmpsh. It implements the reverse ICMP shell concept very well. The main advantage over the other open source tools is that it does not require administrative privileges to run onto the target machine.

I spent some time playing with the tool and was immediately impressed. It is clean, easy and portable. The slave (client) runs on the target machine, it is written in C and works on Windows only whereas the master (server) can run on any platform as it has been implemented in C and Perl by Nico. I ported it to Python too.

The reason for the Python port is that I wrapped it into sqlmap too. As of version 0.9 stable you can either establish the out-of-band connection via TCP with Metasploit or via ICMP with icmpsh - switch --os-pwn.

Features

• Open source software - primarily coded by Nico, forked by me.
  
• Client/server architecture.
  
• The master is portable across any platform that can run either C, Perl or Python code.
  
• The target system has to be Windows because the slave runs on that platform only for now.
  
• The user running the slave on the target system does not require administrative privileges.
  

Example

Running icmpsh slave on target system (192.168.136.129) by specifying the master IP 192.168.136.1

Running icmpsh master on attacker machine (192.168.136.1) and issuing two

OS commands onto the target system (192.168.136.129)

Response packet from icmpsh slave containing output of issued command whoami

The forked tool can be found on my GitHub at https://github.com/inquisb/icmpsh.

Feedback is always welcome!

Posted 15th April 2011 by Bernardo Damele

Sursa: Bernardo Damele A. G.: Reverse connection: ICMP shell