LogoLogo
DocumentationPayloadsCommunitySupport
  • Packet Squirrel Mark II by Hak5
  • Setup
    • Connecting the Packet Squirrel
    • Setting up the Packet Squirrel
  • Getting Started
    • Changes & New features
    • Packet Squirrel Basics
    • Accessing the Packet Squirrel
    • Web UI
    • Getting the Packet Squirrel online
    • Status LED
    • Cloud C²
    • USB storage support
    • Selecting and editing payloads
    • Configuring payloads
    • Running payloads
    • Networking and modes
  • Networking Tutorial
    • Glossary
    • OSI layers
    • Private IP ranges
    • Network masks
    • Packet injection
    • Translation and redirection
    • Packet capture
  • Payload Development
    • Payload development basics
    • DuckyScript for Packet Squirrel
      • BUTTON
      • C2EXFIL
      • C2NOTIFY
      • C2WATCHDIR
      • DYNAMICPROXY
      • KILLPORT
      • KILLSTREAM
      • LED
      • MATCHPORT
      • MATCHSTREAM
      • NETMODE
      • SELFDESTRUCT
      • SSH_START
      • SSH_STOP
      • SPOOFDNS
      • SWITCH
      • UI_START
      • UI_STOP
      • USB_FREE
      • USB_STORAGE
      • USB_WAIT
  • Advanced payloads
    • Quotes and expansions
    • Flow control
    • Redirecting output
    • Payload configuration
    • Return codes & success
    • Background commands
    • Command groups
    • Processing JSON
    • USB encryption
    • VPN configuration
    • Network manipulation
    • Tips, tricks, & pitfalls
    • Python
  • Payload repository
  • Troubleshooting
    • Troubleshooting networking
    • Troubleshooting payloads
    • Factory reset
  • Software Updates
    • Upgrading firmware
Powered by GitBook
On this page
  • Options
  • Interface
  • Protocol
  • Connection type
  • Ports
  • Return values
  • Experimenting
  • Examples

Was this helpful?

  1. Payload Development
  2. DuckyScript for Packet Squirrel

MATCHPORT

The MATCHPORT command inspects network traffic for activity on the specified ports. The payload will be paused until matching traffic is found.

Options

The MATCHPORT command expects several options:

MATCHPORT [interface] [protocol] [connection type] [port] ... [portN]

Interface

MATCHPORT requires a network interface. Typically on the Packet Squirrel this is br-lan, the virtual interface which connects the Ethernet ports.

Protocol

MATCHPORT requires a protocol to match: TCP and UDP match only connections on those protocols, while ANY matches both.

Connection type

A connection type of NEW causes MATCHPORT to only find connections which have started while it has been running. A connection type of ANY will match connections already in progress.

Ports

MATCHPORT can match any number of ports.

Return values

MATCHPORT will exit when a packet is seen on the monitored ports.

MATCHPORT will print the port pairs which caused the match (source and destination of the packet).

Experimenting

You can experiment using the MATCHPORT command live, either in the Web Shell in the web UI, or via ssh!

Examples

The most basic use of the MATCHPORT command is to halt execution of a payload until traffic is seen. This demonstration payload will disconnect the Target device if it is seen to connect to a specific port.

#!/bin/bash 

# Title: Matchport example
#
# Description: Disconnect the Target device if there is traffic to the meterpreter default port

# Set bridge mode
NETMODE BRIDGE

# Wait for any connections on port 4444
MATCHPORT br-lan TCP ANY 4444

# Jail the target
NETMODE JAIL

# Set the LED
LED R VERYFAST

Last updated 2 years ago

Was this helpful?

Demonstration of the MATCHPORT command