Shells

Common Shells

Linux

Shell	Path	Notes
bash	/bin/bash	Default on most distros. Feature-rich, widely scripted against.
sh	/bin/sh	POSIX shell. Often a symlink to dash (Debian/Ubuntu) or bash. Minimal features.
zsh	/bin/zsh	Default on macOS. Superset of bash with better completion, theming, plugins.
dash	/bin/dash	Lightweight POSIX shell. Fast but no interactive features.
fish	/usr/bin/fish	User-friendly, auto-suggestions, not POSIX-compatible.
tmux/screen	—	Terminal multiplexers (not shells, but wrap shells).

Windows

Shell	Notes
cmd.exe	Legacy Windows command prompt. Limited scripting.
PowerShell	.ps1 scripts. Object-oriented pipeline. Default on modern Windows.
PowerShell Core (pwsh)	Cross-platform PowerShell (Linux/macOS/Windows).

---

Identify Your Current Shell

# Linux — several methods
echo $SHELL               # Default login shell (not necessarily current)
echo $0                   # Current shell process name
ps -p $$                  # Process info for current shell
cat /proc/$$/cmdline      # On Linux — exact binary path

# What shells are available?
cat /etc/shells

# What shell is a user configured to use?
grep "krav" /etc/passwd   # Last field is login shell

# Windows — PowerShell or cmd?
echo %COMSPEC%            # cmd.exe
$PSVersionTable           # PowerShell (this variable only exists in PS)
Get-Host                  # PowerShell version info

---

Changing Shells

# Change default login shell
chsh -s /bin/zsh

# Switch to a different shell temporarily
bash
zsh
sh

# Run a command in a specific shell
/bin/sh -c "echo running in sh"

---

Restricted and Limited Shells

Some shells are intentionally restricted:

Shell	Purpose
/bin/rbash	Restricted bash — no cd, no changing PATH, no redirections
/usr/bin/nologin	Denies login entirely (for service accounts)
/bin/false	Same — immediately exits with failure
lshell	Configurable restricted shell (if installed)

Check /etc/passwd for accounts using nologin or false — these are service accounts that shouldn’t have interactive access.

---

Upgrading a Limited Shell

After getting a reverse shell (e.g. from a web exploit), the shell is typically “dumb” — no tab completion, no arrow keys, no Ctrl+C handling, and clear doesn’t work.

Step 1: Spawn a proper TTY

# Python (most common method)
python3 -c 'import pty; pty.spawn("/bin/bash")'
python -c 'import pty; pty.spawn("/bin/bash")'

# Other methods if Python isn't available
script -qc /bin/bash /dev/null
echo os.system('/bin/bash') | perl
/bin/sh -i

Step 2: Full interactive shell

After spawning a TTY:

# Background the reverse shell
Ctrl+Z

# In your local terminal — configure raw mode
stty raw -echo; fg

# Back in the reverse shell — set terminal type
export TERM=xterm
export SHELL=/bin/bash

# Optional: match terminal size
# In local terminal, run: stty size → e.g. "50 200"
stty rows 50 columns 200

Now you have: arrow keys, tab completion, Ctrl+C (won’t kill your shell), command history, and clear.

Step 3: Verify

tty                     # Should show /dev/pts/X instead of "not a tty"
echo $TERM              # Should be xterm or similar
stty -a                 # Show terminal settings

---

/etc/passwd Shell Field

krav:x:1000:1000::/home/krav:/bin/bash
                                ╰───── login shell

# List all unique shells in use
awk -F: '{print $7}' /etc/passwd | sort -u

# Find users with actual login shells
grep -v "nologin\|false" /etc/passwd

---

Links

• Bash Reference Manual
• Zsh Documentation
• Upgrading Simple Shells — ropnop