> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/pentest/shells/tty-upgrade.md).

# TTY Upgrade

## Tools

### LazyRevShell

{% embed url="<https://github.com/aniqfakhrul/LazyShell>" %}

<figure><img src="/files/GWWLuiUGeSS4kR7GN8uo" alt=""><figcaption></figcaption></figure>

### pty4all

{% embed url="<https://github.com/laluka/pty4all?tab=readme-ov-file>" %}

## 4 different methods

```
# Attacker
nc -nlvp [PORT]
(...)
$ su admin
su: must be run from a terminal

# 1
/bin/bash

# 2
python -c "import pty; pty.spawn('/bin/bash')"

# 3 
$ /usr/bin/script -qc /bin/bash /dev/null
www-data@ubuntu:/var/www/Magic/images$

# 4
perl -e 'exec "/bin/bash";'
```

## Python

```shell-session
python -c 'import pty; pty.spawn("/bin/bash")'
```

```shell-session
python -c 'import pty; pty.spawn("/bin/sh")' 
```

## /bin/sh -i

```shell-session
/bin/sh -i
sh: no job control in this shell
sh-4.2$
```

## Perl

```shell-session
perl —e 'exec "/bin/sh";'
```

```shell-session
perl: exec "/bin/sh";
```

The command directly above should be run from a script.

## Ruby

```shell-session
ruby: exec "/bin/sh"
```

The command directly above should be run from a script.

## Lua

```shell-session
lua: os.execute('/bin/sh')
```

The command directly above should be run from a script.

## AWK

```shell-session
awk 'BEGIN {system("/bin/sh")}'
```

## Find

```shell-session
find / -name nameoffile -exec /bin/awk 'BEGIN {system("/bin/sh")}' \;
```

## VIM

```shell-session
vim -c ':!/bin/sh'
```

```shell-session
vim
:set shell=/bin/sh
:shell
```

## [Earn Free Crypto / BTC with Cointiply](https://cointiply.com/r/pkZxp)

[**Play Games Earn Cash Rewards**](https://cointiply.com/r/pkZxp)

<figure><img src="/files/a876wNYE568SJIfTZVxL" alt=""><figcaption></figcaption></figure>