1

I'm trying to use ncat to connect between virtual windows7 and linux machines.

On linux:

ncat -vnl 4444 --ssl

On windows:

ncat -v 10.10.14.2 4444 --ssl

And when I try to connect from the client I get this error:

Ncat: Failed SSL connection from 10.10.14.2: error:1417D102:SSL routines:
tls_process_client_hello:unsupported protocol

Things I tried that did not work:

  • Adding extra parameters --ssl-cert test-cert.pem --ssl-key test-key.pem

  • Trying the other way around(linux client, windows server) Then I get this error:

    Failed SSL connection...routines:ssl3_get_record wrong version number

EDIT:

I noticed it works if in client I use 

openssl s_client -connect

instead of ncat -v --ssl.

How I can I get it working by ncat in this case?

Spring
  • 111
  • 1
  • 4
  • have you added a certificate of authority / confirmed that it's the same pairing between Windows and linux, and in turn, confirmed on the linux box that the ssl config supports/has enabled the port for the connection? – Anson W Han Dec 08 '17 at 17:12
  • @AnsonWHan tnx how can i check if ssl config on linux box supports/has enabled the port for the connection? And no I didnt add any authority or anything – Spring Dec 08 '17 at 17:22
  • NCAT over Port 443 (the default ssl port for web connections) won't try to verify certificates, but it looks like port 4444 does force verification. See the section just above Example 2 on https://nmap.org/ncat/guide/ncat-ssl.html; it talks about how to set up a self-signed certificate. Then in your Apache config files, make sure you have an ssl virtual host declaration for port 4444 with paths to the ssl cert. – Anson W Han Dec 09 '17 at 03:37
  • 1
    TLS/SSL ClientHello is the first message that's sent from the client to the server after the TCP connection is established, and happens before the certificate stuff, so we can safely set aside the certificate verification stuff for now. Googling the "1417D102" error code makes me suspect your Windows ncat is old and only supports SSL 3 (which is old), and your Linux server's ncat is linked against something much more recent and rejects the old protocol. – Drew Bloechl Dec 09 '17 at 08:51
  • @Drew Bloechl tnx, indeed that is the problem. And i guess there is no solution other than matching ncat versions, right? – Spring Dec 09 '17 at 14:08
  • They don't have to match. Any version supporting TLS 1.2 should be fine -- I think what you want to look for is one linked against openssl 1.0.2 or later. – Drew Bloechl Dec 14 '17 at 06:15

3 Answers3

1

ncat7.60 doesn't support tls 1.2 anymore. 7.50 does.

MakeWakandaGreatAgain
  • 11
  • 1
0

Had a VERY similar problem. this how I found the answer: so the comment regarding: ncat7.60 doesn't support tls 1.2 anymore. 7.50 does. pointed me in the right direction , all that is needed now is to find the 7.50 ncat version. can be found here: https://nmap.org/dist/ but it is an RPM , I worked on debian based OS , so I installed alien, to work on the rpm package, alien installation process: https://superuser.com/questions/776833/install-rpm-package-on-kali-linux after that I was able to use the extracted NCAT.

Wakanda WILL be great again
  • 1
0

It worked for me when I downloaded nmap7.70 and installed it on Windows 7. The ncat that comes bundled in it is perfectly compatible with the Linux version of 7.60

Note: My windows 7 was inside my Kali and did not have an internet connection, so I downloaded it on Kali and netcat-ed it into the windows machine.

Linux client : nc -nv IP port < nmap-7.70-setup.exe

Windows : nc -nlvp port > nmapsetup.exe

Rania Ash
  • 1
  • 1