0

I've created my own SSH reverse tunnel using libssh by following the tutorials at http://api.libssh.org/master/libssh_tutorial.html and piecing things together from various other samples. However, now, all I get is the client echoing back whatever is inputted via the tunnel connection. I'm trying to get to the point where I can execute commands through the reverse tunnel (ex: ls -al).

The reverse tunnel (initiated on the client side):

int reverse_loop(ssh_session session){
    ssh_channel channel;
    int rc; 
    int nbytes, nwritten;
    char buf[256];
    int port = 0;

    rc = ssh_channel_listen_forward(session, NULL, 43434, NULL); 

    if (rc != SSH_OK){
        fprintf(stderr, "Error opening remote port %s\n", ssh_get_error(session));
        return rc; 
    }   

    channel = ssh_channel_accept_forward(session, 60000, &port);
    if (channel == NULL){
        fprintf(stderr, "Error waiting for incoming connection: %s\n", ssh_get_error(session)); 
        return SSH_ERROR;
    }   

    while(1){
        printf("In loop\n");
        nbytes = ssh_channel_read(channel, buf, sizeof(buf), 0); 
        if (nbytes < 0){ 
            fprintf(stderr, "Error reading incoming data: %s\n", ssh_get_error(session));
            ssh_channel_send_eof(channel);
            ssh_channel_free(channel);
            return SSH_ERROR;
        }
        printf("read channel\n");



        if (nbytes > 0){ 
            nwritten = ssh_channel_write(channel, buf, nbytes);
            if (nwritten != nbytes){
                fprintf(stderr, "Error sending answer: %s\n", ssh_get_error(session));
                ssh_channel_send_eof(channel);
                ssh_channel_free(channel);                                                                            
                return SSH_ERROR;
            }
            printf("Wrote channel\n");
        }
        printf("sent answer!\n");
    }
    // close_channel
    ssh_channel_send_eof(channel);
    ssh_channel_free(channel);

    return SSH_OK;
}

Running this, the reverse session is initiated. So, from the SSH server, I can run:

> nc localhost 43434
ls (this is what I sent)
ls (this is what I receive)
pwd (this is what I sent)
pwd (this is what I receive)

Then on the client side, I see this output:

In loop
read channel
Wrote channel
sent answer!
In loop

What I'm looking for are the actual results of running ls or pwd (or whatever system command the user inputs, not the echo. Can anyone direct me on the step that I missed to do this?

Thanks!

Godzilla74
  • 2,358
  • 1
  • 31
  • 67
  • 1
    Don’t understand the question, just execute the commands instead of just echoing them back? – Fredrik Jan 22 '19 at 14:26
  • @Fredrik - I type in `ls` and and would expect to get a response back of the files in a directory, not the command I sent. – Godzilla74 Jan 22 '19 at 14:54
  • 1
    Why not just execute the commands when you recieve them and echo back the result? – Fredrik Jan 22 '19 at 14:59
  • @Fredrik I guess that's my question. How? `ssh_channel_request_exec(buf)` ? – Godzilla74 Jan 22 '19 at 15:08
  • https://stackoverflow.com/questions/19209141/how-do-i-execute-a-shell-built-in-command-with-a-c-function – Fredrik Jan 22 '19 at 15:18
  • @Fredrik I think I ran across this answer at some point. My issue is where the command being passed in is stored, which I can't seem to find (is it in `nbytes`, `buf`, etc.?). I also tried going this route (http://api.libssh.org/master/libssh_tutor_command.html), but run into the same problem of not being able to find the command being passed in any of the variables. – Godzilla74 Jan 22 '19 at 15:24
  • 1
    The command is stored in your buf variable. It gets placed there after you call ssh_channel_read – Fredrik Jan 22 '19 at 15:30

0 Answers0