SSH has a LocalCommand option that will run a given command on the client machine after a successful connection. It is generally disabled, but can be enabled on the command line with "-oPermitLocalCommand=yes". This is useful for bypassing restricted shells.
Co-authored-by: Andrea Cardaci <cyrus.and@gmail.com>
Here the trick is to restore those file descriptors (0, 1, 2) that have been
redirected (`dup2`) by the parent process.
First we need to determine which one has been redirected, for example by looking
at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0,
1 or 2 respectively, where `x` is any file descriptor number that points to the
TTY.
It may happen that no file descriptor is unchanged, in that case we can use
`tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty)