search
📜 Medium🛒 My Shop👾 Github📩 Telegram 📺 YouTube✖ Twitter

Bypassing Bash Restrictions - Rbash

In many penetration testing scenarios, attackers encounter systems with restricted shell environments, such as restricted Bash (rbash). These restrictions prevent the use of certain commands, changing directories, or accessing specific binaries, significantly limiting what a pentester can do. However, these restrictions can often be bypassed using clever techniques. This article explores practical methods for bypassing Bash restrictions, focusing on techniques commonly used by pentesters. We’ll discuss why each technique works, how it is useful, and provide commands to try in your pentesting efforts.

hashtag
1. Escape from Restricted Shells

Some environments impose restricted shells (rbash, bash --restricted) where commands like changing directories or executing certain binaries are blocked.

Steps to Escape:

  • Method 1: Using bash command.

    bash

    Sometimes, restricted shells only block certain commands but don’t block launching a regular shell like bash.

  • Method 2: Using sh.

    /bin/sh

    On some systems, the sh command might not be restricted even if bash is.

  • Method 3: Using vi or vim. In restricted environments, text editors like vi or vim may still be accessible. You can launch a shell from within vim:

    Open vim:

    vi

    Press : to open the command prompt in vim, then type:

    :!bash

    This will execute bash and give you an unrestricted shell.

  • Method 4: Using python. Many environments restrict shell commands but allow certain scripting languages:

    python -c 'import pty; pty.spawn("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'

    This will spawn an unrestricted bash shell using Python.

  • Method 5: Using script. The script command is generally used to record terminal sessions, but it can be exploited to spawn an unrestricted shell. This is useful in environments where certain commands are restricted or where shell capabilities are limited: 

    /usr/bin/script -qc /bin/bash /dev/null

hashtag
2. Bypassing Path Restrictions with Binary Substitution

What it does: Some restricted shells may limit which commands can be run by controlling access to binaries. However, you can bypass these restrictions by substituting characters in binary names or using wildcards.

Techniques:

  • Question Mark Substitution: Replace one character in the binary name with a ?.

  • Wildcard Substitution: Use * in place of one or more characters.

  • [Character Substitution]: Use [chars] to bypass restrictions by specifying multiple possibilities.

Why it’s useful: This trick is simple and often works because restricted shells don't always sanitize the input or enforce binary restrictions effectively. For a pentester, this can be an easy win for executing basic commands.

hashtag
3. Reverse Shells and Encoding

What it does: Reverse shells allow attackers to gain control of a remote machine by sending a shell back to their own system. One effective method to bypass restrictions or detection is by using encoding techniques, like base64 or hexadecimal encoding.

Techniques:

  • Double Base64 Encoding: Useful to evade bad character filtering.

  • Short Reverse Shell (Trick from Dikline):

Why it’s useful: These methods can often bypass network defenses, particularly when restrictions on characters or commands are present. Encoding techniques are powerful for evading firewalls and intrusion detection systems, making them crucial for pentesters.

hashtag
4. IFS (Internal Field Separator) Exploitation

What it does: The IFS variable determines how Bash interprets spaces and other delimiters. By changing its value, you can bypass restrictions that rely on space separation.

Techniques:

  • Simple IFS Bypass: Replace spaces with $IFS.

  • More Complex IFS Substitution:

Why it’s useful: Altering IFS allows pentesters to manipulate how commands are interpreted, bypassing typical command restrictions in environments that prevent the use of spaces or special characters.

hashtag
5. Uninitialized Variables and String Concatenation

What it does: Uninitialized variables in Bash default to null, allowing clever concatenation of strings to bypass command restrictions.

Techniques:

  • Uninitialized Variables:

  • String Concatenation with History:

Why it’s useful: This technique is a great way to build valid commands without directly typing them, which can help evade basic command restrictions.

hashtag
6. Bypassing Forbidden Spaces

What it does: Some environments restrict the use of spaces, preventing typical command execution. You can bypass this by using alternative methods of splitting or concatenating arguments.

Techniques:

  • Using Form Substitution:

  • Using Tabs Instead of Spaces:

Why it’s useful: This method helps in systems that prevent space characters, which could otherwise render typical shell commands unusable.

hashtag
7. Hexadecimal Encoding

What it does: Encoding commands in hexadecimal allows them to be obfuscated, bypassing filters and restrictions on certain keywords.

Techniques:

  • Hexadecimal Encoded Command:

  • Assigning Hex to Variables:

Why it’s useful: This technique is powerful when pentesters face systems that filter or block common command names. It provides a way to obscure commands in a way that bypasses detection.

hashtag
8. Bypassing Regex-Based Restrictions

What it does: Some environments enforce regular expressions to block or filter commands. However, these can often be bypassed by inserting unexpected characters like newline or escape sequences.

Techniques:

  • Injecting New Line Characters:

Why it’s useful: Regular expression filters are often incomplete, and adding newline characters or other escape sequences can easily fool the filters.

hashtag
9. Using Builtins for Command Execution

What it does: Even in highly restricted environments, some built-in shell functions may still be available. Pentesters can leverage these to execute commands when external binaries are blocked.

Techniques:

  • List Shell Builtins:

  • Executing Commands with Builtins:

Why it’s useful: Many restricted shells still allow some built-in functions, making this a good last-resort method when external binaries are blocked.

hashtag
10. Time-Based Data Exfiltration

What it does: When unable to directly execute commands or communicate, you can exfiltrate data based on timing responses. For example, adjusting response times based on the data you want to leak.

Techniques:

  • Time-Based Data Leak:

Why it’s useful: This technique helps in scenarios where direct data exfiltration is not possible but timing variations can be used to infer data.

hashtag
Bypass Linux Restrictions

hashtag
Reverse Shell

hashtag
Short Rev shell

hashtag
Bypass Paths and forbidden words

hashtag
Bypass forbidden spaces

hashtag
Bypass backslash and slash

hashtag
Bypass pipes

hashtag
Bypass with hex encoding

hashtag
Bypass IPs

hashtag
Time based data exfiltration

hashtag
Getting chars from Env Variables

hashtag
DNS data exfiltration

You could use burpcollab or pingbarrow-up-right for example.

hashtag
Builtins

In case you cannot execute external functions and only have access to a limited set of builtins to obtain RCE, there are some handy tricks to do it. Usually you won't be able to use all of the builtins, so you should know all your options to try to bypass the jail. Idea from devploitarrow-up-right. First of all check all the shell builtinsarrow-up-right. Then here you have some recommendations:

hashtag
Polyglot command injection

hashtag
Bypass potential regexes

hashtag
Bashfuscator

hashtag
RCE with 5 chars

hashtag
RCE with 4 chars

PreviousPractical Linux CommandsNextPrivilege escalation - Linux

Last updated

Was this helpful?