[blasdel]

The /mysql/tmp/greetings.txt trick was cute

but do kids these days not know about https://linux.die.net/man/1/wall ?

[marcan_42]

Do adults these days not know that wall(1) doesn't work unless you have a proper login session and tty, which a reverse shell as OP used certainly does not do for you? :-)

[jeffbee]

These systems are stripped down to the bare minimum. There's no reason to believe that every "standard" program, and certainly not a setgid programs like wall or write, would be present.

[peterwwillis]

All you need is write access to the pty fd (or in the case of a reverse shell, just the fd of the tcp socket). The SREs could talk to the hackers and the hackers could just echo stuff in their terminal which the SREs could read. Writing a file to disk is less l33t, but more straightforward :)

Edit: I think I was wrong; you can't manipulate network socket fds this way, you'd have to use ptrace() on the process. If it were a real shell with a pty I believe what I suggest could work, but reverse shells don't open ptys.

[mkj]

The "# cat greetings.txt" has a # suggesting they sorted out a real pty somehow. Or it was faked later :)

[marcan_42]

The usual trick to get a pty is `script /dev/null` by the way, if that command is available

[darkwater]

I prefer https://linux.die.net/man/1/write to contact a specific user on a console (if they have `mesg y`). Learnt it and played a lot with it during high school days on an HP-9000 where terminals were actual dumb terminals. It was fun!

[Lammy]

> wall (an abbreviation of write to all)

I didn't know what it stood for, at least :)

[judge2020]

`man wall` - always a good introduction!

[gerdesj]

WALL(1)

NAME wall - write a message to all users