Dailydave mailing list archives
Re: Sending remote procedure calls through e-mail (RPC-Mail)
From: David Maynor <dmaynor () gmail com>
Date: Tue, 19 Oct 2004 22:47:56 -0400
I read this email 3 times hoping that I missed the security part of your idea. Do you really want to be able to email rpc requests? You are building an awesome avenue to bypass current security tools like IPS. You can't really rely on the obscurity of the account name, it would not take long for somebody to find it. On Tue, 19 Oct 2004 22:27:38 -0400, Abe Usher <securitylist () sharp-ideas net> wrote:
Have you ever had the need to remotely send a command to a system, but you could not access it directly via ssh or telnet because the firewall is blocking all inbound connections? The practice of portknocking <http://www.portknocking.org/> provides an interesting network authentication mechanism for establishing a connection to a networked computer that has no open ports (as advertised on portknocking.org). While I find portknocking ingenious, it is somewhat cumbersome and overly complex for most users. I propose an alternative - send remote procedure calls via e-mail. I've coded an application that fits the bill: RPC-Mail. The premise of RPC-Mail is simple: (1) Construct an e-mail message that has a command that you want one of your remote PCs to execute. (2) Send the e-mail to a special account that is only used by RPC-Mail. (3) Have the remote PC set up with a scheduled task or cron job to periodically execute the application RPC-Mail.py. (4) When RPC-Mail.py executes, it parses all of the subject lines and message bodies of e-mail messages that it finds. If the message body contains a special passphrase, RPC-Mail executes the subject line as a command, and returns standard output as an e-mail message. For more information check out my full write up on: http://www.sharp-ideas.net/ Cheers, Abe Usher, CISSP _______________________________________________ Dailydave mailing list Dailydave () lists immunitysec com http://www.immunitysec.com/mailman/listinfo/dailydave
_______________________________________________ Dailydave mailing list Dailydave () lists immunitysec com http://www.immunitysec.com/mailman/listinfo/dailydave
Current thread:
- Sending remote procedure calls through e-mail (RPC-Mail) Abe Usher (Oct 19)
- Re: Sending remote procedure calls through e-mail (RPC-Mail) David Maynor (Oct 19)
- Message not available
- Fwd: Sending remote procedure calls through e-mail (RPC-Mail) Chris Kuethe (Oct 19)
- Re: Sending remote procedure calls through e-mail(RPC-Mail) Kurt Seifried (Oct 19)
- Fwd: Sending remote procedure calls through e-mail (RPC-Mail) Chris Kuethe (Oct 19)
- Re: Sending remote procedure calls through e-mail (RPC-Mail) Cristiano Lincoln Mattos (Oct 19)
- Re: Sending remote procedure calls through e-mail (RPC-Mail) Chris Kuethe (Oct 19)
- Re: Sending remote procedure calls through e-mail (RPC-Mail) Frank Knobbe (Oct 19)
- 'pr0jekt MAYHeM -- "~el8 team"' in full effect on the Daily Dave, etc =) robert (Oct 19)
- Re: Sending remote procedure calls through e-mail (RPC-Mail) Chris Kuethe (Oct 19)
- Re: Sending remote procedure calls through e-mail (RPC-Mail) Peter Busser (Oct 20)
- Re: Sending remote procedure calls through e-mail (RPC-Mail) John Bryson (Oct 20)
- Re: Sending remote procedure calls through e-mail (RPC-Mail) Paul Wouters (Oct 20)
- Re: Sending remote procedure calls through e-mail (RPC-Mail) John Bryson (Oct 20)
- Re: Sending remote procedure calls through e-mail (RPC-Mail) John Bryson (Oct 20)