How to have a value different from 0 in netstat's Send-Q column for a socket in the LISTEN state?
I am currently trying to solve a Capture The Flag challenge that involves trying to escalate privileges by taking advantage of an exploit in a bash script.
The script first does the following to get all sockets with TCP protocol in the LISTEN state:
output=$($_netstat -ntpl 2> /dev/null | $_egrep '^t')
and then it parses the output line by line. One of the things it does for each line is this:
if [[ "$cur_syn" == "0" || "$max_syn" != "$cur_syn" ]]
then continue
fi
$cur_syn is the value of the Recv-Q column as returned by netstat, and $max_syn is the value of the Send-Q column.
So, only a socket that is in the LISTEN state and with Recv-Q != 0 and Recv-Q==Send-Q will pass these checks.
netstat's man states that:
Recv-Q
Established: The count of bytes not copied by the user program connected to this socket. Listening: Since Kernel 2.6.18 this column contains the current syn backlog.
and
Send-Q
Established: The count of bytes not acknowledged by the remote host. Listening: Since Kernel 2.6.18 this column contains the maximum size of the syn backlog.
The thing is, I seem not to be able to create a socket that has a Send-Q different from 0.
If my interpretation is correct, the Send-Q value for a socket that is listening is the max size of the backlog, which is the backlog param in C's listen(2) function. But even when I create a listening server socket with a backlog of size 3, netstat still reports the Send-Q as being 0! What am I doing wrong?
FYI, I have managed to make the Recv-Q change by having multiple clients connect to a server socket that has received a SIGSTOP. Recv-Q goes up all the way to maximum size of the syn backlog + 1, and then all connections are refused. But alas,Send-Q remains unchanged.
linux networking bash sockets netstat
edited Jan 20 at 9:08
Scott
15.8k113990
asked Jan 20 at 8:33
Léo VitalLéo Vital
11
add a comment |
I am currently trying to solve a Capture The Flag challenge that involves trying to escalate privileges by taking advantage of an exploit in a bash script.
The script first does the following to get all sockets with TCP protocol in the LISTEN state:
output=$($_netstat -ntpl 2> /dev/null | $_egrep '^t')
and then it parses the output line by line. One of the things it does for each line is this:
if [[ "$cur_syn" == "0" || "$max_syn" != "$cur_syn" ]]
then continue
fi
$cur_syn is the value of the Recv-Q column as returned by netstat, and $max_syn is the value of the Send-Q column.
So, only a socket that is in the LISTEN state and with Recv-Q != 0 and Recv-Q==Send-Q will pass these checks.
netstat's man states that:
Recv-Q
Established: The count of bytes not copied by the user program connected to this socket. Listening: Since Kernel 2.6.18 this column contains the current syn backlog.
and
Send-Q
Established: The count of bytes not acknowledged by the remote host. Listening: Since Kernel 2.6.18 this column contains the maximum size of the syn backlog.
The thing is, I seem not to be able to create a socket that has a Send-Q different from 0.
If my interpretation is correct, the Send-Q value for a socket that is listening is the max size of the backlog, which is the backlog param in C's listen(2) function. But even when I create a listening server socket with a backlog of size 3, netstat still reports the Send-Q as being 0! What am I doing wrong?
FYI, I have managed to make the Recv-Q change by having multiple clients connect to a server socket that has received a SIGSTOP. Recv-Q goes up all the way to maximum size of the syn backlog + 1, and then all connections are refused. But alas,Send-Q remains unchanged.
linux networking bash sockets netstat
edited Jan 20 at 9:08
Scott
15.8k113990
asked Jan 20 at 8:33
Léo VitalLéo Vital
11
add a comment |
I am currently trying to solve a Capture The Flag challenge that involves trying to escalate privileges by taking advantage of an exploit in a bash script.
The script first does the following to get all sockets with TCP protocol in the LISTEN state:
output=$($_netstat -ntpl 2> /dev/null | $_egrep '^t')
and then it parses the output line by line. One of the things it does for each line is this:
if [[ "$cur_syn" == "0" || "$max_syn" != "$cur_syn" ]]
then continue
fi
$cur_syn is the value of the Recv-Q column as returned by netstat, and $max_syn is the value of the Send-Q column.
So, only a socket that is in the LISTEN state and with Recv-Q != 0 and Recv-Q==Send-Q will pass these checks.
netstat's man states that:
Recv-Q
Established: The count of bytes not copied by the user program connected to this socket. Listening: Since Kernel 2.6.18 this column contains the current syn backlog.
and
Send-Q
Established: The count of bytes not acknowledged by the remote host. Listening: Since Kernel 2.6.18 this column contains the maximum size of the syn backlog.
The thing is, I seem not to be able to create a socket that has a Send-Q different from 0.
If my interpretation is correct, the Send-Q value for a socket that is listening is the max size of the backlog, which is the backlog param in C's listen(2) function. But even when I create a listening server socket with a backlog of size 3, netstat still reports the Send-Q as being 0! What am I doing wrong?
FYI, I have managed to make the Recv-Q change by having multiple clients connect to a server socket that has received a SIGSTOP. Recv-Q goes up all the way to maximum size of the syn backlog + 1, and then all connections are refused. But alas,Send-Q remains unchanged.
linux networking bash sockets netstat
edited Jan 20 at 9:08
Scott
15.8k113990
asked Jan 20 at 8:33
Léo VitalLéo Vital
11
I am currently trying to solve a Capture The Flag challenge that involves trying to escalate privileges by taking advantage of an exploit in a bash script.
The script first does the following to get all sockets with TCP protocol in the LISTEN state:
output=$($_netstat -ntpl 2> /dev/null | $_egrep '^t')
and then it parses the output line by line. One of the things it does for each line is this:
if [[ "$cur_syn" == "0" || "$max_syn" != "$cur_syn" ]]
then continue
fi
$cur_syn is the value of the Recv-Q column as returned by netstat, and $max_syn is the value of the Send-Q column.
So, only a socket that is in the LISTEN state and with Recv-Q != 0 and Recv-Q==Send-Q will pass these checks.
netstat's man states that:
Recv-Q
Established: The count of bytes not copied by the user program connected to this socket. Listening: Since Kernel 2.6.18 this column contains the current syn backlog.
and
Send-Q
Established: The count of bytes not acknowledged by the remote host. Listening: Since Kernel 2.6.18 this column contains the maximum size of the syn backlog.
The thing is, I seem not to be able to create a socket that has a Send-Q different from 0.
If my interpretation is correct, the Send-Q value for a socket that is listening is the max size of the backlog, which is the backlog param in C's listen(2) function. But even when I create a listening server socket with a backlog of size 3, netstat still reports the Send-Q as being 0! What am I doing wrong?
FYI, I have managed to make the Recv-Q change by having multiple clients connect to a server socket that has received a SIGSTOP. Recv-Q goes up all the way to maximum size of the syn backlog + 1, and then all connections are refused. But alas,Send-Q remains unchanged.
linux networking bash sockets netstat
linux networking bash sockets netstat
edited Jan 20 at 9:08
Scott
15.8k113990
asked Jan 20 at 8:33
Léo VitalLéo Vital
11
edited Jan 20 at 9:08
Scott
15.8k113990
asked Jan 20 at 8:33
Léo VitalLéo Vital
11
edited Jan 20 at 9:08
Scott
15.8k113990
edited Jan 20 at 9:08
Scott
15.8k113990
edited Jan 20 at 9:08
Scott
15.8k113990
15.8k113990
asked Jan 20 at 8:33
Léo VitalLéo Vital
11
asked Jan 20 at 8:33
Léo VitalLéo Vital
11
asked Jan 20 at 8:33
Léo VitalLéo Vital
11
11
add a comment |
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1396253%2fhow-to-have-a-value-different-from-0-in-netstats-send-q-column-for-a-socket-in%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1396253%2fhow-to-have-a-value-different-from-0-in-netstats-send-q-column-for-a-socket-in%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
