Obtaining a Fully Interactive Shell

@hkh4cks it might be down to ohmyzsh I think

Great find @sajkox ! :smiley:
That was the issue…
Thank you guys for looking into it :slight_smile:

@hkh4cks try pressing enter a couple times after foregrounding the process

Nice thread guys… My 2 coins…

stty rows 50 cols 200

To fix your rows/cols in your terminal. Especially useful when you do ps so you can see the full length of the process command.

You can play also with the TERM env variable if not set already eg. export TERM=xterm

@PinkPanther it worked when I switched to bash from zsh.
Nice tip @SuRGeoNix

What about -e /bin/bash?

hi all

you can have TTY in http shell or web based shell by providing credentials. that is usefull in case of server in droping requests on other ports etc

Bump, as several people have been asking about this topic recently

Hi @hkh4cks
how did you fix the ohmyzsh error with the netcat shell after doing fg.
cant find anything to fix that

I came across this while trying to solve similar issues, might help others. There are few additional commands to what is listed in first post.

• On the remote machine, run python -c ‘import pty; pty.spawn(“bash”)’ and press CTRL-z to put the SSH session to the background.
• Then run stty -a to print out information about your shell. Note the rows and columns (say they are 40 and 160 respectively).
• Now run stty raw -echo to put your shell into raw mode, then fg to get back into the SSH session, and finally reset to reset the shell. It you get asked for the type of the terminal, use xterm-256color.
• After that, run stty rows 40 columns 160 to specify the correct size. You should now have a fully working shell, in particular vi should work.

That’s a great thing to share, so here are my two cents:

  • Spawning bash with python:
$ python -c 'import pty; pty.spawn("/bin/bash")'
  • Background’ing the remote shell with CTRL-Z:
user@remote:~$ ^Z
  • Getting ROWS and COLS within current terminal window:
user@local:~$ stty -a | head -n1 | cut -d ';' -f 2-3 | cut -b2- | sed 's/; /\n/'
  • Ignoring hotkeys in the local shell and getting back to the remote:
user@local:~$ stty raw -echo; fg
  • Setting correct size for the remote shell (where ROWS and COLS are the values from the 3rd bullet):
user@remote:~$ stty rows ROWS cols COLS
  • Adding some colors:
user@remote:~$ export TERM=xterm-256color
  • Reloading bash to apply the TERM variable:
user@remote:~$ exec /bin/bash

:triumph:

2 Likes

Great thread. Sexytime

You can also write a c program that spawns a child which is controlled by a pty. In this article you find information on how to do that:
http://rachid.koucha.free.fr/tech_corner/pty_pdip.html

If you want to read about what tty/pty are, take a look at this article:
http://www.linusakesson.net/programming/tty/

something handy for me is setting this up in the custom commands plugin for terminator.
i have 3 commands, one to pty.spawn bash, one to print and set stty info locally, and one to set stty on the actual rev shell. they are quick and dirty one liners but it works pretty well here are my commands:

Terminator Custom Commands

name: Upgrade TTY Python
Command: python -c “import pty;pty.spawn(‘/bin/bash’)”

name: Fix TTY 1
command: printf "\n\n(Rows,Cols)\n ";printf ‘\e[1;91m%-6s\e[m’ $(stty size);printf “\n\nTerm= \e[91m$TERM\e[0m\n\n”;stty raw -echo;fg;

name: Fix TTY 2
command: export SHELL=bash;export TERM=xterm-256color;stty rows 20 columns 100;\echo ;echo ;read -p “Enter Rows:” ROWS;read -p “Enter Cols:” COLS;stty rows $ROWS columns $COLS && clear

once you get a reverse shell

  1. right click > custom commands > Upgrade TTY Python
  2. Press Ctrl+z to background
  3. right click > custom commands > Fix TTY 1
  4. right click > custom commands > Fix TTY 2
  5. enter the row and col values when prompted (should still be on screen from step 2, so long as no reset is used).

For the people (@hkh4cks) who’s gettin the ^M and ^? instead of ENTER and BACKSPACE after running the fg command here’s the problem explanation and solution.

Probably you’re using zsh as your terminal and/or MacOS. The main problem here is that zsh doesn’t handle the stty command the same way bash or sh does. So if you read stty manual and check what the command stty raw -echo was intended to do, you’ll see that after running it, your output wasn’t supposed to be echoed back to your screen anymore. So if you run stty -echo and still are able to see what you’re typing next, your terminal are not respecting the -echo. Reading this zsh mailing list thread (Re: stty not working) we can see that zsh, specifically, only respect the -echo until the next prompt. That means that you need to type your next command all in one line, just line like @snovvcrash showed in his comment:

user@local:~$ stty raw -echo; fg

If you try to execute this as two separated commands, as soon as the prompt appear for you to execute the fg command, your -echo command already lost its effect. This is not a zsh limitation however, au contraire, this is an intended behavior for your own safety. Zsh behave like this to prevent you from getting stuck blinded at a terminal. For you to understand what it mean, just run bash and then stty -echo. Now you have no ideia what you’re typing anymore. You’re blind Jost hoping you correctly type reset to get your echo back.

Hope this help. Cheers!

Type your comment> @salamander said:

For the people (@hkh4cks) who’s gettin the ^M and ^? instead of ENTER and BACKSPACE after running the fg command here’s the problem explanation and solution.

Probably you’re using zsh as your terminal and/or MacOS. The main problem here is that zsh doesn’t handle the stty command the same way bash or sh does. So if you read stty manual and check what the command stty raw -echo was intended to do, you’ll see that after running it, your output wasn’t supposed to be echoed back to your screen anymore. So if you run stty -echo and still are able to see what you’re typing next, your terminal are not respecting the -echo. Reading this zsh mailing list thread (Re: stty not working) we can see that zsh, specifically, only respect the -echo until the next prompt. That means that you need to type your next command all in one line, just line like @snovvcrash showed in his comment:

user@local:~$ stty raw -echo; fg

If you try to execute this as two separated commands, as soon as the prompt appear for you to execute the fg command, your -echo command already lost its effect. This is not a zsh limitation however, au contraire, this is an intended behavior for your own safety. Zsh behave like this to prevent you from getting stuck blinded at a terminal. For you to understand what it mean, just run bash and then stty -echo. Now you have no ideia what you’re typing anymore. You’re blind Jost hoping you correctly type reset to get your echo back.

Hope this help. Cheers!

Big man coming in clutch with this. Props.

After fg, ctrl+z cannot background the shell ?

Type your comment> @BaiduFu said:

After fg, ctrl+z cannot background the shell ?

You did it backwards. fg stands for “foreground”, meaning you’ll be foregrounding the job you just “backgrounded” with CTRL+Z.

After getting a terminal:

python -c ‘import pty; pty.spawn(“/bin/bash”)’
CTRL-z
bg
stty raw -echo
fg
reset
(In case of unknown terminal type try: linux)

Optional:
export SHELL=/bin/bash
export TERM=xterm-color
export HOME=

Then fix up the rows and columns. Open another terminal
stty -a

Get the rows and columns.

Back on your reverse shell:
stty rows <> columns <>

Rarely does the python part not work… when it doesn’t I simply find a work around or just deal with what I have.

For the sake of variety; instead of doing the python -c ... thing, thus relying on python being available on the box, you could also do:

script /dev/null, this will give you a pty (as tty will tell you), so su and passwd should work. I usually do a bash -i first. Do note that the environment will still need some fixing up (CTRL+z ... etc and export TERM=linux, export HOME=/tmp or something similar).

HTH!