Escape from rbash to bash shell

rbash-escape.md

Change rbash to bash

psj@ubuntu:~$ ssh psj@server_name-t "bash --noprofile"

List available commands:

$ compgen -c 

Essentially you need to do the following:

a) start bash without source'ing either ~/.bashrc or ~/.bash_profile 
b) since such a shell wouldn't be a full login shell / have no tty attached, force ssh to attach a tty:

Good presentation on rbash escape

• https://speakerdeck.com/knaps/escape-from-shellcatraz-breaking-out-of-restricted-unix-shells?slide=9

Other interesting links for Rbash hardening

• https://www.exploit-db.com/docs/english/44592-linux-restricted-shell-bypass-guide.pdf
• https://giovannino.net/wp/wiki/restrict-access-rbash/
• http://blog.bodhizazen.com/linux/how-to-restrict-access-with-rbash/
• https://www.interceptzero.com/blog/rbash-shell-escape/

Very helpful! The first line should have a space before t, or else ssh will not be able to resolve the remote host.
It should be psj@ubuntu:~$ ssh psj@server_name -t "bash --noprofile"

Forgive me for being the "well actually..." guy.