[peterwwillis]

All you need is write access to the pty fd (or in the case of a reverse shell, just the fd of the tcp socket). The SREs could talk to the hackers and the hackers could just echo stuff in their terminal which the SREs could read. Writing a file to disk is less l33t, but more straightforward :)

Edit: I think I was wrong; you can't manipulate network socket fds this way, you'd have to use ptrace() on the process. If it were a real shell with a pty I believe what I suggest could work, but reverse shells don't open ptys.

[mkj]

The "# cat greetings.txt" has a # suggesting they sorted out a real pty somehow. Or it was faked later :)

[marcan_42]

The usual trick to get a pty is `script /dev/null` by the way, if that command is available