如何在Linux反向Shell中处理rm与cp命令的输出异常问题

Hey Paul, great job getting your reverse shell up and running with basic commands! Let's figure out why you're seeing errors on the attacker side when running rm or cp—even though the target host executes them successfully.

Why This Happens #

The root of the problem boils down to two key points:

• Commands like rm/cp have no stdout by default: When these commands run successfully, they don't produce any standard output. Only when they fail (e.g., missing file, permission denied) do they send messages to stderr.
• Your shell is expecting output: If your code only reads from stdout and doesn't handle empty streams or stderr, it'll throw an error when there's nothing to read—even though the command worked perfectly on the target.

Step-by-Step Fixes #

1. Capture Both Stdout and Stderr

First, you need to redirect stderr to stdout so all output (success or failure) goes to the same stream. This way, you'll catch error messages when commands fail, and avoid empty-stream errors when they succeed.

For example, if your shell executes commands directly, append 2>&1 to every command. This tells the shell to send stderr (file descriptor 2) to the same place as stdout (file descriptor 1).

If you're using a language like Python, modify your command execution logic to combine streams:

import subprocess

def execute_command(command):
    # Combine stdout and stderr, run the command
    proc = subprocess.Popen(
        f"{command} 2>&1",
        shell=True,
        stdout=subprocess.PIPE,
        stderr=subprocess.STDOUT
    )
    # Read all output and wait for the command to finish
    output = proc.stdout.read()
    return_code = proc.wait()
    return (return_code, output)

2. Handle Empty Output Gracefully

Once you're capturing all streams, check if the output is empty and the command succeeded (return code 0). Instead of throwing an error, send a clear success message to the attacker side.

Extending the Python example:

def send_to_attacker(data):
    # Your existing code to send data over the network
    pass

command = "rm test.txt"
return_code, output = execute_command(command)

if return_code == 0:
    if not output:
        send_to_attacker(b"Command executed successfully (no output).\n")
    else:
        send_to_attacker(output + b"\n")
else:
    send_to_attacker(b"Command failed: " + output + b"\n")

3. Use Return Codes to Verify Success

Never rely solely on output to determine if a command worked. Always check the command's exit code:

• A return code of 0 means the command succeeded (even with no output).
• Non-zero return codes mean the command failed—use the captured stderr output to show the attacker what went wrong.

For C/C++ shells, you can use waitpid() to get the exit status, and use pipe redirection to capture both streams.

Final Notes #

• Test edge cases: Try rm on a non-existent file—you should see the error message on the attacker side instead of a generic "no output" error.
• Avoid assuming output exists: Always handle empty streams in your code to prevent crashes or false error messages.

内容的提问来源于stack exchange，提问作者Paul