3 ms·
-c and -e. They're not security holes, they're useful features which like most powerful tools can be misused or abused.
by jfrunyon 5y ago
-c and -e. They're not security holes, they're useful features which like most powerful tools can be misused or abused.
- GekkePrutser 5y agoAh yeah it was the security hole description that threw me off. I was expecting something more along the lines of a buffer overflow.
- mct 5y agoThe post does a poor job explaining it, but the term "gaping security hole" comes from traditional netcat's source code. In order to enable the "-e" (exec) flag, it must be compiled with "-DGAPING_SECURITY_HOLE".
- hddqsb 5y agoI believe the reason they are called "gaping security holes" is that if nc is installed as setuid root, they allow local privilege escalation (see https://serverfault.com/questions/237584/netcat-e-the-gaping-security-hole https://serverfault.com/questions/237584/netcat-e-the-gaping..., https://nc110.sourceforge.io/ https://nc110.sourceforge.io/). Another explanation is that they make it trivial to create reverse shells etc. (though it is still possible to create reverse shells without -e/-c, for example using named pipes).