What problem does it solve?
During authorized penetration tests, landing in a restricted shell (rbash, rksh, lshell), a chroot jail, or a filtered command-injection point often stalls the assessment. This Skill provides a systematic escape matrix so testers can determine whether the confinement actually holds or can be broken to obtain arbitrary command execution.
Core Features & Use Cases
- GTFOBins Shell-Outs: Abuse allowed binaries (vi, less, awk, find, perl, python) that expose shell functions to spawn /bin/sh from inside a restricted shell.
- Chroot and Sandbox Escapes: Break out of chroot jails when root inside the jail (double-chroot technique, break_chroot.c) and escape Lua/Python language sandboxes via load(string.char(...)) or debug.debug().
- Filter and Bad-Character Bypasses: Defeat space/keyword filters using ${IFS}, brace expansion, quote insertion, wildcards, and base64/hex/tr/rev encoding.
- Use Case: A tester lands in rbash on a jump host where vi is permitted; using
:set shell=/bin/sh then :shell, they obtain an unrestricted shell and document the finding with proof and remediation advice.
Quick Start
Use the bypassing-restricted-shells skill to enumerate my current rbash session and identify viable escape techniques with confirmation commands.
