17 ms·

Sockets in Your Shell

233 points by signa11 6y ago

gbrown_ 6y ago
Does anyone know the motivation for this in bash? A quick glance at the git history shows this goes all the way back to bash-2.04. As a grumpy old *nix person I can't really I like seeing extra "features" like this.
- ConSeannery 6y ago
  this is useful for network connectivity troubleshooting in any environment (container, embedded device, and so on) where curl, nc, telnet, etc. are not installed
brinox 6y ago
I think this would be nice to wait for a socket to be available instead of doing `sleep n`.
0x0 6y ago
Pretty sure this is disabled at compilation time for debian based distros, at least.
- oefrha 6y ago
  It was disabled at one point, but definitely enabled at the moment in buster at least (try docker run -it debian:buster-slim /bin/bash if you don’t have Debian at hand). Looking at https://sources.debian.org/src/bash/5.0-4/debian/changelog/#L611-L619 https://sources.debian.org/src/bash/5.0-4/debian/changelog/#..., bash (4.0-5) unstable; urgency=low * Re-add dependency on dash, lost with the upload of 4.0. * Don't configure with --disable-net-redirections. * Fix name of system wide bash_logout in bash(1). Closes: #546200. * Stop shipping the sh and sh(1) symlinks. Closes: #545103. * Apply upstream patches 029 - 033. -- Matthias Klose <doko@debian.org> Sun, 13 Sep 2009 12:55:54 +0200 it seems net-redirections has been reenabled more than a decade ago.
- TheGrassyKnoll 6y ago
  Using Debian 9.0 "Stretch" derived Bunsen Helium. Its enabled.
gigatexal 6y ago
I had no idea this was possible. The *nix userland just keeps getting cooler the more I learn about it.
rkachowski 6y ago
this is pretty common in pentesting to get a reverse shell from a system with minimal capabilities https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#bash-tcp https://github.com/swisskyrepo/PayloadsAllTheThings/blob/mas...
- hsbauauvhabzb 6y ago
  While I generally don’t condone them normally, I’ve used them to debug devops pipelines which didn’t have any other mechanism for access :P
jagged-chisel 6y ago
> echo "text!" > /dev/$PROTO/$HOST/$PORT This being a bash-ism is really misleading. This looks as if my computer has device nodes for $PROTO, and I suppose that's not the case. I think it would make more sense as (optional) /dev nodes giving all programs access to it.
- deleted 6y ago
  [deleted]
- dx87 6y ago
  The man page for bash says that /dev/tcp and /dev/udp actually can be real files that any program can use, but that if they're absent, it emulates the behavior on its own.
  - duskwuff 6y ago
    > The man page for bash says that /dev/tcp and /dev/udp actually can be real files that any program can use But that's really just a bit of wishful thinking -- those files/directories don't exist on any mainstream UNIX OS I'm aware of.
    - who23 6y ago
      Hey I'm the author. Yes, as far as I know it's just sugar for opening a socket, and there's almost never a file that exists. To treat it as a file, you need to assign a file descriptor to it, which you can then read and write from.
- _ZeD_ 6y ago
  how is this a bash-ism? you mean it's related to linux /dev tree?
  - bitwize 6y ago
    No, it's not related to the actual /dev tree. Bash handles redirects to /dev/tcp/* and /dev/udp/* specially if there are no files at those locations.
ttsda 6y ago
A few years ago I made a modular IRC bot using ztcp. Probably comes with a bunch of security holes: https://github.com/tiagoad/zshbot/ https://github.com/tiagoad/zshbot/
c2xlZXB5Cg 6y ago
Nice! One more thing to disable. https://blog.sleeplessbeastie.eu/2020/05/27/how-to-disable-network-redirections/ https://blog.sleeplessbeastie.eu/2020/05/27/how-to-disable-n...
- ktpsns 6y ago
  This won't enhance security, if your shell allows arbitrary commands. A firewall helps.
  - augusto-moura 6y ago
    Yes! Having netcat or telnet on the system already invalidates the disable
  - jagged-chisel 6y ago
    A reduction in malicious avenues is always welcome.
    - tyingq 6y ago
      A lot of things to chase though. Lots of installed-by-default stuff like Perl and Gawk do sockets.
unmole 6y ago
I stumbled upon Bash network redirections last year and spent some trying to figure out how echoing to /dev/$PROTO/$HOST/$PORT works: https://www.anmolsarma.in/post/bash-net-redirections/ https://www.anmolsarma.in/post/bash-net-redirections/
- deleted 6y ago
  [deleted]
wumms 6y ago
Thx for sharing! Tiny typo: > For example, if a local build of a web app runs on port 8000 [...] 8000 --> 4000
supahfly_remix 6y ago
More generally, does this mean we can open a socket like a file? For example, in Python, can we do: with open('/dev/tcp/127.0.0.1/8000') as f: d = f.read() ...
- patrec 6y ago
  No this is a special hack in bash itself, not one of the dumbed-down-plan-9 style abstractions in the linux filesystem.
izabera 6y ago
if [ exec 1>/dev/null 2>/dev/null 3>/dev/tcp/localhost/4000 ] ; then This code runs `[ exec ]` (which tests if "exec" is a non-empty string, thus it returns true) and redirects its output and error to /dev/null, and fd 3 to /dev/tcp/whatever. If the socket opening fails, `[ exec ]` is not even executed, and the overall command returns nonzero. Completely equivalent to `: 3>/dev/tcp/localhost/4000`, which also returns nonzero if the socket can't be opened. It happens to work for the intended purpose, but not for the reasons the author intended.
- kzrdude 6y ago
  A testament to the brokenness of making `[` a command
  - dundarious 6y ago
    I prefer to always use the `test` command instead (it’s the exact equivalent of `[`), and never use `[[` bashisms (well, almost never).
    - xyzzy_plugh 6y ago
      And here I thought I was the only one!
      - kzrdude 6y ago
        I also do this.
- yrro 6y ago
  shellcheck has this to say: In exec.sh line 1: if [ exec 1>/dev/null 2>/dev/null 3>/dev/tcp/localhost/4000 ] ; then ^-- SC1009: The mentioned syntax error was in this if expression. ^-- SC1073: Couldn't parse this test expression. Fix to allow more checks. ^-- SC1014: Use 'if cmd; then ..' to check exit code, or 'if [[ $(cmd) == .. ]]' to check output. ^-- SC1072: Expected test to end here (don't wrap commands in []/[[]]). Fix any mentioned problems and try again. For more information: https://www.shellcheck.net/wiki/SC1014 -- Use 'if cmd; then ..' to check ex... https://www.shellcheck.net/wiki/SC1072 -- Expected test to end here (don't ... https://www.shellcheck.net/wiki/SC1073 -- Couldn't parse this test expressi...
MayeulC 6y ago
Note that this is a bashism, netcat is (a bit, due to BSD vs GNU) more portable. I think Hurd can provide similar functionality at the filesystem level thanks to its translators. Plan 9 likely can, too, and it would be possible to cook something together with FUSE. I leveraged this some time ago to sent WOL packets. I think it went something like: echo -e [16 times the target MAC written as \xFF] > /dev/udp/255.255.255.255/9 BTW, I'm not entirely sure how broadcast IPv4 addresses work. I think they are set by the DHCP server, and the computer sends packets to these addresses as MAC broadcasts? (leaving the dest IP as the configured broadcast one).
- zamadatix 6y ago
  The broadcast address of a given subnet is "!netmask | hostIp" e.g. if the host IP is 192.168.1.12/24 then it's 192.168.1.12 | 0.0.0.255 = 192.168.1.255. The "human" way of thinking about it is it's the last address in the subnet. The IP4 broadcast address for the current network (even if the client doesn't known what it is) is 255.255.255.255. Once the packet arrives at the destination subnet (which can be immediately or several routing hops away) it will (in the case of Ethernet) you're right that's to the FF:FF:FF:FF:FF:FF destination MAC. In the case of DHCP client <-> server on different subnets there is a special "DHCP relay" role configured in the network and that relay is what handles broadcast to unicast conversions https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol#Relaying https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Pro...
- LukeShu 6y ago
  > netcat is (a bit, due to BSD vs GNU) more portable Note that GNU doesn't have a netcat implementation. There's a netcat implementation that calls itself "GNU netcat", but it isn't actually associated with GNU, and the authors are jerks for naming it that. But also, there are more netcat implementations than just 2! - OpenBSD netcat - "GNU" Netcat (http://netcat.sourceforge.net http://netcat.sourceforge.net) - BusyBox netcat - Nmap's `ncat` - Netcat6 (http://www.deepspace6.net/projects/netcat6.html http://www.deepspace6.net/projects/netcat6.html) And all of them are just different enough from eachother...
  - 6y ago
enriquto 6y ago
Nice. Now what I want are higher level protocols than tcp: cat /dev/https/news.ycombinator.com | grep -i shell
- iod 6y ago
  You might be interested in looking into a fuse based filesystem like httpfs2¹ if you are looking for this sort of capability. The would allows you to mount http/https locations as a filesystem. ¹ http://manpages.ubuntu.com/manpages/latest/en/man1/httpfs2.1.html http://manpages.ubuntu.com/manpages/latest/en/man1/httpfs2.1...
jolmg 6y ago
The post shows use of ztcp, but zsh also has zsocket: http://zsh.sourceforge.net/Doc/Release/Zsh-Modules.html#The-zsh_002fnet_002fsocket-Module http://zsh.sourceforge.net/Doc/Release/Zsh-Modules.html#The-... The difference seems to be that zsocket works with Unix domain sockets and, only for incoming connections, sockets already opened and with a file descriptor. I suppose this latter one can be used for any kind of socket if opened before exec'ing zsh.
- who23 6y ago
  Hey I'm the author. Yeah, I stumbled on this while doing a little research into zsh socket capabilities, but I decided to exclude it because the post was more about network sockets than Unix domain sockets.
  - jolmg 6y ago
    Yeah, when I originally wrote the comment I thought that it was more generic. It was only later that I saw it was more aimed at domain sockets, and edited that in.
tombert 6y ago
I know I'm preaching to the choir for this, but it's stuff like this that makes me absolutely adore Unix and its entire design. The fact that virtually everything has a file abstraction greatly simplifies a lot of work.

233 points by signa11 6y ago

Does anyone know the motivation for this in bash? A quick glance at the git history shows this goes all the way back to bash-2.04. As a grumpy old *nix person I can't really I like seeing extra "features" like this.

ConSeannery 6y ago
this is useful for network connectivity troubleshooting in any environment (container, embedded device, and so on) where curl, nc, telnet, etc. are not installed

brinox 6y ago

I think this would be nice to wait for a socket to be available instead of doing `sleep n`.

0x0 6y ago

Pretty sure this is disabled at compilation time for debian based distros, at least.

oefrha 6y ago
It was disabled at one point, but definitely enabled at the moment in buster at least (try docker run -it debian:buster-slim /bin/bash if you don’t have Debian at hand). Looking at https://sources.debian.org/src/bash/5.0-4/debian/changelog/#L611-L619 https://sources.debian.org/src/bash/5.0-4/debian/changelog/#..., bash (4.0-5) unstable; urgency=low * Re-add dependency on dash, lost with the upload of 4.0. * Don't configure with --disable-net-redirections. * Fix name of system wide bash_logout in bash(1). Closes: #546200. * Stop shipping the sh and sh(1) symlinks. Closes: #545103. * Apply upstream patches 029 - 033. -- Matthias Klose <doko@debian.org> Sun, 13 Sep 2009 12:55:54 +0200 it seems net-redirections has been reenabled more than a decade ago.
TheGrassyKnoll 6y ago
Using Debian 9.0 "Stretch" derived Bunsen Helium. Its enabled.

gigatexal 6y ago

I had no idea this was possible. The *nix userland just keeps getting cooler the more I learn about it.

rkachowski 6y ago

this is pretty common in pentesting to get a reverse shell from a system with minimal capabilities https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#bash-tcp https://github.com/swisskyrepo/PayloadsAllTheThings/blob/mas...

hsbauauvhabzb 6y ago
While I generally don’t condone them normally, I’ve used them to debug devops pipelines which didn’t have any other mechanism for access :P

jagged-chisel 6y ago

> echo "text!" > /dev/$PROTO/$HOST/$PORT This being a bash-ism is really misleading. This looks as if my computer has device nodes for $PROTO, and I suppose that's not the case. I think it would make more sense as (optional) /dev nodes giving all programs access to it.

deleted 6y ago
[deleted]
dx87 6y ago
The man page for bash says that /dev/tcp and /dev/udp actually can be real files that any program can use, but that if they're absent, it emulates the behavior on its own.
- duskwuff 6y ago
  > The man page for bash says that /dev/tcp and /dev/udp actually can be real files that any program can use But that's really just a bit of wishful thinking -- those files/directories don't exist on any mainstream UNIX OS I'm aware of.
  - who23 6y ago
    Hey I'm the author. Yes, as far as I know it's just sugar for opening a socket, and there's almost never a file that exists. To treat it as a file, you need to assign a file descriptor to it, which you can then read and write from.
_ZeD_ 6y ago
how is this a bash-ism? you mean it's related to linux /dev tree?
- bitwize 6y ago
  No, it's not related to the actual /dev tree. Bash handles redirects to /dev/tcp/* and /dev/udp/* specially if there are no files at those locations.

ttsda 6y ago

A few years ago I made a modular IRC bot using ztcp. Probably comes with a bunch of security holes: https://github.com/tiagoad/zshbot/ https://github.com/tiagoad/zshbot/

c2xlZXB5Cg 6y ago

Nice! One more thing to disable. https://blog.sleeplessbeastie.eu/2020/05/27/how-to-disable-network-redirections/ https://blog.sleeplessbeastie.eu/2020/05/27/how-to-disable-n...

ktpsns 6y ago
This won't enhance security, if your shell allows arbitrary commands. A firewall helps.
- augusto-moura 6y ago
  Yes! Having netcat or telnet on the system already invalidates the disable
- jagged-chisel 6y ago
  A reduction in malicious avenues is always welcome.
  - tyingq 6y ago
    A lot of things to chase though. Lots of installed-by-default stuff like Perl and Gawk do sockets.

unmole 6y ago

I stumbled upon Bash network redirections last year and spent some trying to figure out how echoing to /dev/$PROTO/$HOST/$PORT works: https://www.anmolsarma.in/post/bash-net-redirections/ https://www.anmolsarma.in/post/bash-net-redirections/

deleted 6y ago
[deleted]

wumms 6y ago

Thx for sharing! Tiny typo: > For example, if a local build of a web app runs on port 8000 [...] 8000 --> 4000

supahfly_remix 6y ago

More generally, does this mean we can open a socket like a file? For example, in Python, can we do: with open('/dev/tcp/127.0.0.1/8000') as f: d = f.read() ...

patrec 6y ago
No this is a special hack in bash itself, not one of the dumbed-down-plan-9 style abstractions in the linux filesystem.

izabera 6y ago

if [ exec 1>/dev/null 2>/dev/null 3>/dev/tcp/localhost/4000 ] ; then This code runs `[ exec ]` (which tests if "exec" is a non-empty string, thus it returns true) and redirects its output and error to /dev/null, and fd 3 to /dev/tcp/whatever. If the socket opening fails, `[ exec ]` is not even executed, and the overall command returns nonzero. Completely equivalent to `: 3>/dev/tcp/localhost/4000`, which also returns nonzero if the socket can't be opened. It happens to work for the intended purpose, but not for the reasons the author intended.

kzrdude 6y ago
A testament to the brokenness of making `[` a command
- dundarious 6y ago
  I prefer to always use the `test` command instead (it’s the exact equivalent of `[`), and never use `[[` bashisms (well, almost never).
  - xyzzy_plugh 6y ago
    And here I thought I was the only one!
    - kzrdude 6y ago
      I also do this.
yrro 6y ago
shellcheck has this to say: In exec.sh line 1: if [ exec 1>/dev/null 2>/dev/null 3>/dev/tcp/localhost/4000 ] ; then ^-- SC1009: The mentioned syntax error was in this if expression. ^-- SC1073: Couldn't parse this test expression. Fix to allow more checks. ^-- SC1014: Use 'if cmd; then ..' to check exit code, or 'if [[ $(cmd) == .. ]]' to check output. ^-- SC1072: Expected test to end here (don't wrap commands in []/[[]]). Fix any mentioned problems and try again. For more information: https://www.shellcheck.net/wiki/SC1014 -- Use 'if cmd; then ..' to check ex... https://www.shellcheck.net/wiki/SC1072 -- Expected test to end here (don't ... https://www.shellcheck.net/wiki/SC1073 -- Couldn't parse this test expressi...

MayeulC 6y ago

Note that this is a bashism, netcat is (a bit, due to BSD vs GNU) more portable. I think Hurd can provide similar functionality at the filesystem level thanks to its translators. Plan 9 likely can, too, and it would be possible to cook something together with FUSE. I leveraged this some time ago to sent WOL packets. I think it went something like: echo -e [16 times the target MAC written as \xFF] > /dev/udp/255.255.255.255/9 BTW, I'm not entirely sure how broadcast IPv4 addresses work. I think they are set by the DHCP server, and the computer sends packets to these addresses as MAC broadcasts? (leaving the dest IP as the configured broadcast one).

zamadatix 6y ago
The broadcast address of a given subnet is "!netmask | hostIp" e.g. if the host IP is 192.168.1.12/24 then it's 192.168.1.12 | 0.0.0.255 = 192.168.1.255. The "human" way of thinking about it is it's the last address in the subnet. The IP4 broadcast address for the current network (even if the client doesn't known what it is) is 255.255.255.255. Once the packet arrives at the destination subnet (which can be immediately or several routing hops away) it will (in the case of Ethernet) you're right that's to the FF:FF:FF:FF:FF:FF destination MAC. In the case of DHCP client <-> server on different subnets there is a special "DHCP relay" role configured in the network and that relay is what handles broadcast to unicast conversions https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol#Relaying https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Pro...
LukeShu 6y ago
> netcat is (a bit, due to BSD vs GNU) more portable Note that GNU doesn't have a netcat implementation. There's a netcat implementation that calls itself "GNU netcat", but it isn't actually associated with GNU, and the authors are jerks for naming it that. But also, there are more netcat implementations than just 2! - OpenBSD netcat - "GNU" Netcat (http://netcat.sourceforge.net http://netcat.sourceforge.net) - BusyBox netcat - Nmap's `ncat` - Netcat6 (http://www.deepspace6.net/projects/netcat6.html http://www.deepspace6.net/projects/netcat6.html) And all of them are just different enough from eachother...
- 6y ago

enriquto 6y ago

Nice. Now what I want are higher level protocols than tcp: cat /dev/https/news.ycombinator.com | grep -i shell

iod 6y ago
You might be interested in looking into a fuse based filesystem like httpfs2¹ if you are looking for this sort of capability. The would allows you to mount http/https locations as a filesystem. ¹ http://manpages.ubuntu.com/manpages/latest/en/man1/httpfs2.1.html http://manpages.ubuntu.com/manpages/latest/en/man1/httpfs2.1...

jolmg 6y ago

The post shows use of ztcp, but zsh also has zsocket: http://zsh.sourceforge.net/Doc/Release/Zsh-Modules.html#The-zsh_002fnet_002fsocket-Module http://zsh.sourceforge.net/Doc/Release/Zsh-Modules.html#The-... The difference seems to be that zsocket works with Unix domain sockets and, only for incoming connections, sockets already opened and with a file descriptor. I suppose this latter one can be used for any kind of socket if opened before exec'ing zsh.

who23 6y ago
Hey I'm the author. Yeah, I stumbled on this while doing a little research into zsh socket capabilities, but I decided to exclude it because the post was more about network sockets than Unix domain sockets.
- jolmg 6y ago
  Yeah, when I originally wrote the comment I thought that it was more generic. It was only later that I saw it was more aimed at domain sockets, and edited that in.

tombert 6y ago

I know I'm preaching to the choir for this, but it's stuff like this that makes me absolutely adore Unix and its entire design. The fact that virtually everything has a file abstraction greatly simplifies a lot of work.