Skip to content

Technical quirks

I have obtained a remote shell on a Linux target. I do not see any prompt. Why?

The reason you don't see a prompt is that you are connected to a non-interactive shell (often called a "blind" or "dumb" shell).

This happens when you have injected an exploit that:

  1. spawns a system shell (like /bin/sh or /bin/bash) (i.e., as a child process)
  2. redirects the standard input, output, and error (stdin, stdout, stderr) of that process over a raw network socket connection to your listener.

Because of this raw redirection:

  • No TTY (Teletypewriter): The target system does not associate your network connection with a terminal device. Without a TTY, the shell runs in non-interactive mode.
  • No Prompt Generation: In Linux, standard shell prompts (the PS1 environment variable) are only rendered when the shell detects it is running in an interactive terminal.
  • No Job Control: If you run a command like top or try to use nano, it will fail or break the connection because there is no terminal to handle the interface.

The shell changes its behavior based on the type of connection as follows.

The shell reads from File Descriptor 0 (stdin) and writes to 1 (stdout) and 2 (stderr), as any other process. The shell is programmed so that when it starts up, one of the very first things it does is query the OS to see what kind of files those descriptors point to . It does this using certain standard C library system calls.

  • If fd 0 is a TTY/PTY (like ssh or local terminal): The shell knows it is interactive. It prints the prompt.
  • If fd 0 is a network socket: tcgetattr fails with the error ENOTTY ("Not a typewriter"). The shell immediately realizes, "Ah, I am being piped data or fed commands from a non-terminal source." It disables the prompt and interactive features to avoid cluttering the output stream with terminal escape codes.