Oct 23, 2013 02:16 PM
(This post was last modified: Oct 24, 2013 05:07 AM by cheatson.)
![[Image: KYt0Osx.jpg]](https://i.imgur.com/KYt0Osx.jpg)
[+] Outline:
A simple utility [*nix compatible] for making life easier when back-connecting from a foreign host where firewall rules are not known. Run a copy locally specifying a port range to listen on (optionally specify another program to handle the connection). And on the server run a copy specifying the port destination range to try and 'brute-force' (optionally specify a local port range to bind to instead of taking the first available / and optionally specify a program to pass the connection to, e.g. "/bin/sh -i").
It's for the issue of firewall rules blocking outgoing requests to certain port ranges (e.g. anything but designated web-server ports). You can run a listener on the protected range for example and then brute-force a back-connect from the server on that range. If you listened on range 1-1000 and the server only allowed 443 for example, you would get a connection in a second or two on that port with a shell.
[+] Notes:
Port range limited to 1024 per process due to using select() instead of poll(). Reason is because debugging poll on older distros gives me a headache!
Things to make sure of before using: Your ports are forwarded correctly for the listening range, and if you are binding to ports <1024 you must be root/sudoer!
See --help for usage examples.
[+] C source: http://hackers2devnull.blogspot.co.uk/20...y-nix.html
[img]http://img24.imageshack.us/img24/1800/5o9x.png[/img]
