5 ms·
The /mysql/tmp/greetings.txt trick was cute but do kids these days not know about https://linux.die.net/man/1/wall https://linux.die.net/man/1/wall ?
by blasdel 6y ago
The /mysql/tmp/greetings.txt trick was cute
but do kids these days not know about https://linux.die.net/man/1/wall https://linux.die.net/man/1/wall ?
- Lammy 6y ago> wall (an abbreviation of write to all) I didn't know what it stood for, at least :)
- jeffbee 6y agoThese systems are stripped down to the bare minimum. There's no reason to believe that every "standard" program, and certainly not a setgid programs like wall or write, would be present.
- peterwwillis 6y agoAll you need is write access to the pty fd (or in the case of a reverse shell, just the fd of the tcp socket). The SREs could talk to the hackers and the hackers could just echo stuff in their terminal which the SREs could read. Writing a file to disk is less l33t, but more straightforward :) Edit: I think I was wrong; you can't manipulate network socket fds this way, you'd have to use ptrace() on the process. If it were a real shell with a pty I believe what I suggest could work, but reverse shells don't open ptys.
- marcan_42 6y agoDo adults these days not know that wall(1) doesn't work unless you have a proper login session and tty, which a reverse shell as OP used certainly does not do for you? :-)
- darkwater 6y agoI prefer https://linux.die.net/man/1/write https://linux.die.net/man/1/write to contact a specific user on a console (if they have `mesg y`). Learnt it and played a lot with it during high school days on an HP-9000 where terminals were actual dumb terminals. It was fun!