Root Access

@JourneymanGeek Wait, so. If say my device has an IP(v6) x. I can connect to x from anywhere on the web on any port without having to open anything up on my router?

Journeyman Geek

2:20 PM

@rahuldottech that is correct

rahuldottech

@JourneymanGeek tbh doesn't seem like a great idea, right?

Journeyman Geek

@rahuldottech repeat after me

nat isn't security

the idea is systems on the IPV6 internet should have proper, ipv6 aware firewalls.

(firewalld is a little too enthusiastic about this - which I almost like)

on the other hand

rahuldottech

@JourneymanGeek But that's ridiculous, you know that. I'm a hundred percent sure my CCTV DVR has all sorts of open ports for telnet and stuff with default usernames and passwords. I can change that. Most unaware folks won't. And that'll leave the device open on the internet for anyone to access?

Journeyman Geek

@rahuldottech ideally you would firewall that off on your router or firewall box

rahuldottech

@JourneymanGeek like I said. Most people won't know to do so.

Journeyman Geek

2:24 PM

@rahuldottech you explicitly need to set up ipv6

rahuldottech

@JourneymanGeek ah

Journeyman Geek

most routers don't have it enabled

and there's actually a few methods to do it

rahuldottech

Got it, thanks

I'll understand this even better once I get to play around and experiment with this, as is the case with most things with me.

Journeyman Geek

my ISP supports it using IPv6 PD on fibre and IPv6 RD on cable

in your case, you probably want to play with a tunnel

also of the local ISPs I think only mine does ipv6

and IDK why, they're strange

rahuldottech

I'mma try and get ipv6

Journeyman Geek

2:28 PM

I'd suggest starting here tunnelbroker.net

ugh. I think I got locked out of my office laptop

crap crap crap

nvm it just worked

its probably a good/great idea to have a router that supports it

rahuldottech

OOOOOOOOOOOOOH IT HNQ'D

YEASSS

djsmiley2k

@JourneymanGeek not really

the idea is you have a ipv6 aware firewall, i.e. it knows the IPv6 address is behind it, and has rules specifically for that address

there's no translation going on.

Having IPv6 doesn't instantly mean everything is accessible

@rahuldottech no no no

/me sighs

Firewall != nat

bertieb

> Introducing Slack + Stack Overflow for Teams

rahuldottech

hmhmhmhmhmhmhm

bertieb

Okay, SO...

djsmiley2k

2:41 PM

Just happens that the NAT'ing is often done on a firewal.

rahuldottech

@bertieb what

@djsmiley2k i need to play around with this stuff tbh

djsmiley2k

Snack? Smack? Whack?

bertieb

> Today, we’re excited to announce that we’re partnering with Slack to create the ultimate knowledge-sharing experience.

> With the new integration, you can start questions directly from Slack, search for answers in Slack and get customized notifications pushed directly to your Slack channels.

Can you feel the excitement?

djsmiley2k

@rahuldottech yah, it's confusing until you stop thinking of NAT and just think pure firewall

Journeyman Geek

@djsmiley2k my current router does. Apparently.

rahuldottech

2:41 PM

@bertieb no. seems pointless to me

Journeyman Geek

My old one did not have an ipv6 firewall

bertieb

But-but-but the partnership!!

djsmiley2k

@JourneymanGeek whaaaaaaaaaaaaa

bertieb

It's new and therefore exciting

djsmiley2k

That's what happens when someone slaps IPv6 support on something.

rahuldottech

2:42 PM

@bertieb the names are similar, that's cool, I guess

Journeyman Geek

@djsmiley2k neither of them did

the new one... er... does?

djsmiley2k

Ok, that's not how it should be done >_<

Journeyman Geek

but it also has some default firewall rules I can't find that block ping6 lol

djsmiley2k

That is litterally being a IPv6 tunnel.

bertieb

Ya ~~gotsta sass it~~ gotta feel the excitement

Journeyman Geek

2:43 PM

@djsmiley2k one is an asus. The other is a dlink

djsmiley2k

their both crap?

rahuldottech

@bertieb eugh

Journeyman Geek

I just turned off ipv6 if not needed

bertieb

whispers exciiiiiteeeeemeeeent

Journeyman Geek

@djsmiley2k the asus was ok

djsmiley2k

2:44 PM

@JourneymanGeek honestly sounds like they do IPv6 tunneling, and the answer to the fact they have a built in firewall is 'go around it for the tunnel'

Journeyman Geek

the dlink was garbage

bertieb

@djsmiley2k STARES IN AC68U

Journeyman Geek

@djsmiley2k no no

djsmiley2k

Where as the firewall should be applied to the tunnel too.

Journeyman Geek

they do ipv6 PD

and RD

and native Ipv6 of all sorts

djsmiley2k

2:44 PM

Then that's just pure retarded failure.

No wonder people don't have a fackin clue.

Journeyman Geek

so I assumed it was normal

rahuldottech

@djsmiley2k bad word. bad dj.

Journeyman Geek

;p

djsmiley2k

It's like saying 'My car is secure, unless your a dolphin, then you can get in without a key!'

bertieb

Wait what?

How many dolphins get in cars?

I'm not sure if a dophin-weak car would be a good thing or a bad thing

djsmiley2k

2:45 PM

/me watches as dolphin gets into car, drives off into the sunset shouting so long and thanks for all the fish.

@bertieb swap dolphin for anything which isn't adult human holding the key.

bertieb

@djsmiley2k Ah, okay

djsmiley2k

You're not IPv4? Why, go right ahead sir.

This is not how you firewall >_<

bertieb

I thought you were making a point about securing from meaningless threats :P

Journeyman Geek

@djsmiley2k I've not come across a router that does that

djsmiley2k

but you said anything with a IPv6 was accessible from the web!

Journeyman Geek

2:47 PM

@djsmiley2k from the internet

ya

djsmiley2k

only if allowed by the firewall

Journeyman Geek

I assumed that the client machine would have a firewall

djsmiley2k

You can have ALL THE FIREWALLS

As many as you want

My toaster doesn't get a firewall.

Once you're no longer natting, you can have as many firewalls as you like

bertieb

~~Dockerise~~ firewall all the things!

rahuldottech

3:24 PM

If any of you has nothing better to do, listen to 1 and 2 and give me some feedback plz

rahuldottech

4:10 PM

You guys know what I love? Great tits. Truly delightful.

2

hides

bertieb

rahuldottech

4:23 PM

@HornOKPlease macOS runs bash or some other thingy for terminal scripting?

bertieb

By default, aye

At least mine does

(feel free to ask general stuff of the entire channel, not just specific people ;-P)

rahuldottech

4:41 PM

@bertieb didn't know you're a mac dude

uh, how tough would it be to port this?

bertieb

@rahuldottech Bertie MacB

rahuldottech

github.com/rahuldottech/ncRemRun/blob/master/ncRemRun.cmd

bertieb

Ohh, that Mac... ;-P

Ya, I have one that I seldom use for cross-platform dev stuff

rahuldottech

@bertieb wait what mac did you think

bertieb

@rahuldottech The Gaelic prefix meaning "son of"..? (facetiously)

rahuldottech

4:44 PM

@bertieb lol

ok but who does terminal thingies here

bertieb

Plenty of folks, myself included

I don't speak cmd tho

So I'm reading through what you've done

I don't see any reason that you couldn't

Probably wanna change default port as many won't let you listen with netcat on 80 unprivileged

change the powershell bit to fetch the request to curl

djsmiley2k

When ur life is full of nope

> <mss 1300,nop,nop,sackOK,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop>

@rahuldottech Why, when ssh?

but sure

nc -l 80 | /bin/bash $1

bertieb

Post it as a code-golf challenge on PPCG and you'd probably have it ported to a 7-char esolang answer

djsmiley2k

:D

rahuldottech

@djsmiley2k that's different

djsmiley2k

4:49 PM

|Oh?

I solved the problem \o/

/me shrugs

Prob wouldn't actually work too, but who knows.

try it :D

rahuldottech

Okay, so I came up with something

0

A: Use netcat to tell a remote Mac to run/open a file

You can create a reverse shell on MacOS (on computer 1) like this: bash -i >& /dev/tcp/ip-address-of-computer-2/1337 0>&1 And then connect to it from another computer (computer 2) using one of these netcat commands (depends on the implementation): nc -l -p 1337 or nc -l 1337 Now you can ...

Dunno if it'll actually work tho, since I haven't used a mac in over half a decade but let's see

bertieb

G'wha

> ultimately I want to send commands from a home automation app that I am making

The application cannot connect using SSH. I've been advised by the software maker to use netcat / telnet etc. Yes I think it can only communicate over a port — manaman 1 hour ago

But you're making the app?

rahuldottech

5:06 PM

@bertieb this is very similar to why I made github.com/rahuldottech/ncRemRun/blob/master/ncRemRun.cmd in the first place

I made a renderfarm

And had this one computer acting as the controller and it had to send commands to al these other PCs over lan

So I made this listener and just sent commands as GET requests

bertieb

y u no psexec?

rahuldottech

@bertieb 1. I didn't know about it at the time, and 2. I like hacking around with non-critical projects

bertieb

Ya, it's not criticism

Just wondering why people do the things they do

There's a lot of folks who post stuff on the internet along the lines of "here's how I did X"

And so other folks who want to do X (or thereabouts) do that

Without understanding why

(myself included)

Sometimes, you just want to Do The Thing™ and not worry about what goes on to make it so

That said, sometimes - on QA sites - it can be helpful to avoid folks unnecessarily reinventing the wheel, for want of knowing the wheel exists

Transcript for