PT0-001 · Question #183
After successfully exploiting a local file inclusion vulnerability within a web application a limited reverse shell is spawned back to the penetration tester's workstation Which of the following can…
The correct answer is D. python -c 'import pty;pcy.3pawn("/bin/bash")'. Python's pty module is the standard technique for upgrading a limited reverse shell to a fully interactive TTY session during post-exploitation.
Question
After successfully exploiting a local file inclusion vulnerability within a web application a limited reverse shell is spawned back to the penetration tester's workstation Which of the following can be used to escape the limited shell and create a fully functioning TTY?
Options
- Aper1 -e ' : set shall=/bin/bash:shell'
- Bphp -r ,Sshell=f3hellopen("/bin/bash-);exec($9he:i)'
- Cbash -i >fi /dev/localhosc Oil
- Dpython -c 'import pty;pcy.3pawn("/bin/bash")'
How the community answered
(25 responses)- A4% (1)
- B8% (2)
- C12% (3)
- D76% (19)
Why each option
Python's pty module is the standard technique for upgrading a limited reverse shell to a fully interactive TTY session during post-exploitation.
This Perl snippet contains malformed syntax with incorrect quoting and invalid variable references, and would not successfully allocate a pseudo-terminal or spawn a shell.
This PHP command contains syntax errors in the function calls and string delimiters, and would fail to open or execute a valid shell process.
This bash redirection references an invalid device path and uses incorrect redirection syntax, making it non-functional for spawning a TTY.
The command 'python -c import pty; pty.spawn("/bin/bash")' uses Python's built-in pty module to allocate a pseudo-terminal and spawn an interactive bash shell, enabling full TTY functionality including job control, tab completion, and interactive program support. This is a widely used shell upgrade technique after obtaining a limited reverse shell from a local file inclusion exploit. The other options all contain malformed syntax that would fail to execute correctly.
Concept tested: Shell upgrade to interactive TTY using Python pty module
Topics
Community Discussion
No community discussion yet for this question.