rlwrap — OSCP Notes

Modern alternative: Penelope — auto PTY, upload/download, LinPEAS modules, multi-session. Use penelope -O on OSCP.

What is rlwrap?

rlwrap wraps a command with GNU readline — giving you arrow keys, command history, and Ctrl+R search in programs that don’t support them natively (like bare nc listeners).

OSCP use: Wrap your Netcat listener so reverse shells feel usable. Without it, backspace and up-arrow break constantly.


Basic Usage

# Standard reverse shell listener WITH rlwrap
rlwrap nc -lvnp 4444
 
# Specific bind address
rlwrap nc -lvnp 4444 -s 0.0.0.0

Compare:

nc -lvnp 4444          # No arrow keys, painful
rlwrap nc -lvnp 4444   # Usable history + navigation

Full Shell Stabilization Chain

After catching a shell, stabilize further:

Linux reverse shell

# 1. Listener (attacker)
rlwrap nc -lvnp 4444
 
# 2. On target shell (after connect)
python3 -c 'import pty;pty.spawn("/bin/bash")'
# OR
python -c 'import pty;pty.spawn("/bin/bash")'
 
# 3. Background shell briefly: Ctrl+Z
 
# 4. Attacker terminal
stty raw -echo; fg
export TERM=xterm
stty rows 38 columns 116

Windows cmd reverse shell

rlwrap nc -lvnp 4444
# Limited — prefer PowerShell shell or evil-winrm for Windows admin work

See Shells, Netcat, evil-winrm.


Other rlwrap Uses

# Wrap impacket semi-interactive shells
rlwrap impacket-wmiexec domain/user:pass@TARGET
 
# Wrap telnet
rlwrap telnet TARGET 23
 
# Wrap socat listener
rlwrap socat file:`tty`,raw,echo=0 tcp-listen:4444

Install

# Kali — pre-installed
which rlwrap
 
# Debian/Ubuntu
sudo apt install rlwrap

📌 Quick Cheat Sheet

rlwrap nc -lvnp 4444
# → catch shell → python3 -c 'import pty;pty.spawn("/bin/bash")'
# → Ctrl+Z → stty raw -echo; fg → export TERM=xterm