Have a look at ippsec’s video to see it in action: Joker
Note he did /bin/sh in pty.spawn. Should have been /bin/bash
/bin/sh
/bin/bash