Shell Stabilization

Shell stabilization is the process of upgrading a dumb, non-interactive reverse shell into a fully interactive TTY that supports job control, tab completion, arrow-key history, and interactive programs (e.g., vim, ssh, su).

A raw netcat reverse shell is little more than a socket connected to a shell’s stdin/stdout. It lacks a controlling terminal, so signals (Ctrl+C, Ctrl+Z), line editing, and terminal sizing don’t work. Stabilization allocates a pseudo-terminal (PTY) on the target and puts the attacker’s local terminal into raw mode so keystrokes pass through uninterpreted.

Method 1: Python PTY + stty

The classic approach uses Python’s pty module on the target:

# On the target (inside the dumb shell)
env TERM=xterm python -c 'import pty; pty.spawn("/bin/bash")'
 
# Suspend the shell locally
# Press Ctrl+Z
 
# On the attacker: raw mode, no echo, foreground the shell
stty raw -echo; fg

• env TERM=xterm ensures the target knows the terminal type.
• pty.spawn() allocates a PTY and attaches /bin/bash to it.
• stty raw -echo puts the attacker’s terminal in raw keycode mode and disables local echo so characters aren’t printed twice.
• fg brings the suspended reverse shell back to the foreground.

After exiting the shell, run reset locally to restore sane terminal settings (echo will be invisible while stty -echo is active).

Method 2: rlwrap

rlwrap (readline wrapper) handles most stabilization automatically by wrapping the netcat listener:

rlwrap -cAr nc -lvnp $PORT

Flags:

• -c — complete filenames
• -A — ANSI color aware
• -r — remember words for completion

Method 3: socat (fully automatic)

For a one-liner that handles PTY allocation, signal forwarding, and terminal sanity, see socat’s EXEC:"/bin/bash -li",pty,stderr,sigint,setsid,sane pattern — covered in detail on the socat page.

Terminal sizing

None of these methods propagate the attacker’s window size. After stabilizing, set rows and columns manually:

stty rows 50 cols 200

Or query the local terminal with stty -a before connecting and mirror the values.

Cross-links

• netcat — the tool most often stabilized
• powershell-reverse-shell — Windows reverse shells also need stabilization
• msfvenom — payloads often caught with netcat
• nodejs-reverse-shell, xterm-reverse-shell, perl-reverse-shell, ruby-reverse-shell, bash-reverse-shell — payload variants that all land as dumb shells needing this upgrade
• tmux — the local-side multiplexer that keeps long-running catch listeners organized

Sources

• OpenBSD — nc(1) manual page
• Python 3 — pty — Pseudo-terminal utilities
• Linux man page — rlwrap(1)