Ncat and -e in Windows

[Adrian Crenshaw]

Hi all,
     I got ncat to compile in Windows, but when I run it with the -e
(execute option) I get the message:

Sorry, the -e option is unavailable on Windows due to lack of fork()

How do you shovel a shell without -e ?

Thanks,
Adrian

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org

[Kris Katterjohn-2]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Adrian Crenshaw wrote:
> Hi all,

Hi Adrian,

>      I got ncat to compile in Windows, but when I run it with the -e
> (execute option) I get the message:
>
> Sorry, the -e option is unavailable on Windows due to lack of fork()
>
> How do you shovel a shell without -e ?
>

(I have been the lead Ncat developer since the beginning of July or so, but I
am by no means a Windows programmer)

Windows obviously doesn't have the fork() system call, so a different method
of creating a process and running another program will have to be used.  I
know there are some CreateProcess() and related calls on Windows, but haven't
been able to look very in-depth at them, or at least not recently.

As you can see in the current Ncat ChangeLog:

o Ported to Windows on Visual C++ Express 2008.  Support isn't perfect because
  of the lack of a fork() call and because we had to implement a hack to get
  select()-like support for stdin on Windows, but most everything works fine.
  We hope to get around these issues in the future.

So unfortunately there is currently no way to use Ncat with the -e option on
Windows, but hopefully a good workaround will be implemented soon.

> Thanks,
> Adrian
>

Thanks,
Kris Katterjohn

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQIVAwUBSNwnX/9K37xXYl36AQJqeg/+NzHhZYhnjCuJtC2CCH6Z+8SmHMgCXZSp
DCw34d++8sW12IPw/qWI8H7r3KUcWQJy6hCnCZmQST3pdlaYvS1MwwviO9fpLUX8
s5U+gUjoZ/hE2OkoLLdQlNrObr1Rryg8EibaVi5uoyG2Pt+lAS+rg3UxmqljJm3n
5Dla7crx3oTmWvCm8nI9zFLjrxNa8fA2OghxkRmi7VcQhWrvozIXDdj2i2tYOaTS
Q+gKXHI0n19gUBbyLXNaZM9BgTMVRJvaZPEtK21nGTr8p+Bpr/t8kM5wrvAiYI95
BK5IBtIL5BT1YSWuGr0jk6bNQVeBDiultt49ev5BKoxiJ6TbRlaSHsfyMAQz5mtY
YLMDNfZnuv778DOS/Nsbp38YrqyAScJ+PxLtF3f8dJhuzEty2sj0xAbgPuatwdeS
8pXVXHf+qPJRoFMj0l1zsD617B3A70+lqTDchOBBtgOd2mSJXGj/oao4Z9uD6lTH
j+rIw+dh/W2tQw1aVs9UcMLw8kq3kAwJ94x6y0uSMg99xuvbt1plsPgBO/5jWTGH
NFxMdjf7lfkEHx3KrrRudAezIUnofTexNpYbXi4gNzy+tTcTwa6CEbiyn8lq2Vy5
9W3CuYRDbCKFLCdJRLo4zclr8FlhfwAzRGFp4/+iU10gvWxSRaZxtkV0R9LGCN8B
bR50kfPg6/4=
=w5hs
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org

[Ron (list)]

Adrian Crenshaw wrote:

> Hi all,
>      I got ncat to compile in Windows, but when I run it with the -e
> (execute option) I get the message:
>
> Sorry, the -e option is unavailable on Windows due to lack of fork()
>
> How do you shovel a shell without -e ?
>
> Thanks,
> Adrian

One way to do it without -e is to use two separate instances, one for
sending commands and one for receiving. Here's an example using netcat,
simply because I know it, this should be universal:

$ nc -l -p2222 | cmd | nc -l -p 3333

Then you'll want to connect on both 2222 and 3333. You can run commands
on port 2222, and you'll see the output on 3333.

(Note: untested, your mileage may vary :) )

Interestingly, you can do something similar with a pair of telnets
connecting outbound, completely bypassing the need to copy a file to the
Windows machine. Ed Skoudis taught me that one!

Ron

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org