4

What creative ways are there to break out of rbash? I don't have permissions to run vim, scp or cat.

restricted: cannot specify `/' in command names

How am I supposed to execute anything without putting '/' in the command line?

3

There is a reason you were given a restricted shell. If you were intended to be able to run all commands you would have been given a standard shell.

You should be able to run anything in the PATH you were given without starting the command with /. It is common to exclude commands which can be used to start an unrestricted shell from the path of users with a restricted shell.

EDIT: You have full access to any programs on your path. Some of theses may have commands which provide an unrestricted shell. Editors commonly have shell escape commands. Other commands may provide access to an unrestricted shell When creating a path for a restricted shell verify the capabilities of each command on the path. Giving people the ability to write any files on the path provides an obvious risk.

Restricted shells provide protection to both the system and the user. The system is protected because the user should not have much access to destructive commands. The user is protected damage done to the system using commands not on the path are likely not done by the user. The system manager should be responsible for ensuring the commands on the path do not provide unrestricted shell access.

5
  • 3
    Would upvote, but it's not particularly helpful. – tekknolagi Dec 3 '11 at 1:46
  • Even if his question is rather dastardly. – tekknolagi Dec 3 '11 at 1:46
  • I actually wanted to know because I was participating in an international capture the flag competition and one of the boxes I had remoted into had me stuck in a restricted shell. It's also good to know from a security point of view as I could better restrict my own bash in the future if I know what ways there are around it. – 에이바 Dec 5 '11 at 17:02
  • I have updated with a more appropriate answer for protecting systems. This include possible weaknesses of using restricted shells. – BillThor Dec 6 '11 at 0:31
  • I accepted your answer, but I didn't find it to be useful as I already showed in my question that I knew of those particular weaknesses. – 에이바 Dec 9 '11 at 15:08
0

Here is what worked for me when I faced rbash:

BASH_CMDS[a]=/bin/sh;a
export PATH=/bin:/sbin:/usr/bin:$PATH

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.