I do a lot of fuzzer creation for my job (sending random data to frequently "unknown" old protocols). Sometimes I have to "bit bang" this with a saleae analyzer with a python template that works for me. I'm trying to get some deeper knowledge though. I am comfortable in Bash and with what I do I'm very experienced with sending information directly over a TCP socket
echo "whatever" > /dev/tcp/[ip]/[port]
I've been playing with reverse shell calls and some of them seem to call a lower level socket function directly and I'm not sure how to utilize that. Here is my question:
How do I send binary data directly out of a NIC? Don't care if it is not in a format that is tcp/ip recognizable... I can handle that in scripts. How do I just dump binary straight out of the card? Anyone know?
Dumping binary in bash is a bit tricky and it's making my testing difficult. It is frequently "interpreted" so programs and the shell output itself handles all differently. I can hex dump ascii converted to text and the shell auto-converts back, which can be confusing when you're looking for 1/0 info. (echo "hex" |xxd -r -p) so closest I can get is:
To create hexdump of actual network traffic:
tcpdump -nni eth0 -e -xx -XX > newfile
This file has lots of "metadata", like a description preceding the hex, for example:
20:20:16.122740 80:2a:a8:8e:c4:56 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Request who-has 10.1.10.26 tell 10.1.10.1, length 46
Then a test of nic output with wireshark running:
cat newfile | xxd -r -p > /dev/tcp/22.214.171.124/53
but wireshark does strange things. Recognizes broadcast packet ASCII but not what I can see in the "cat newfile | xxd -r -p" data that bash auto converts...
I get this is a pretty big subject.
Any help is appreciated! For all clarity my question is "how can I dump hex data directly out of a nic. Preferably like when doing "echo [whatever] > /dev/tcp/"