rlwrap — OSCP Notes
Modern alternative: Penelope — auto PTY, upload/download, LinPEAS modules, multi-session. Use
penelope -Oon OSCP.
What is rlwrap?
rlwrap wraps a command with GNU readline — giving you arrow keys, command history, and Ctrl+R search in programs that don’t support them natively (like bare nc listeners).
OSCP use: Wrap your Netcat listener so reverse shells feel usable. Without it, backspace and up-arrow break constantly.
Basic Usage
# Standard reverse shell listener WITH rlwrap
rlwrap nc -lvnp 4444
# Specific bind address
rlwrap nc -lvnp 4444 -s 0.0.0.0Compare:
nc -lvnp 4444 # No arrow keys, painful
rlwrap nc -lvnp 4444 # Usable history + navigationFull Shell Stabilization Chain
After catching a shell, stabilize further:
Linux reverse shell
# 1. Listener (attacker)
rlwrap nc -lvnp 4444
# 2. On target shell (after connect)
python3 -c 'import pty;pty.spawn("/bin/bash")'
# OR
python -c 'import pty;pty.spawn("/bin/bash")'
# 3. Background shell briefly: Ctrl+Z
# 4. Attacker terminal
stty raw -echo; fg
export TERM=xterm
stty rows 38 columns 116Windows cmd reverse shell
rlwrap nc -lvnp 4444
# Limited — prefer PowerShell shell or evil-winrm for Windows admin workSee Shells, Netcat, evil-winrm.
Other rlwrap Uses
# Wrap impacket semi-interactive shells
rlwrap impacket-wmiexec domain/user:pass@TARGET
# Wrap telnet
rlwrap telnet TARGET 23
# Wrap socat listener
rlwrap socat file:`tty`,raw,echo=0 tcp-listen:4444Install
# Kali — pre-installed
which rlwrap
# Debian/Ubuntu
sudo apt install rlwrap📌 Quick Cheat Sheet
rlwrap nc -lvnp 4444
# → catch shell → python3 -c 'import pty;pty.spawn("/bin/bash")'
# → Ctrl+Z → stty raw -echo; fg → export TERM=xterm