Most users interact with computers through graphical interfaces.
Examples:
- Windows
- Dialogs
- Icons
- Menus
- Buttons
Linux systems can provide graphical environments, but operator workflows rely heavily on shells.
A shell allows users to interact directly with the operating system using commands.
Why This Matters
The shell is one of the most important interfaces available to an Operator.
Examples:
- File Management
- User Administration
- Service Management
- Networking
Many tools encountered throughout the course are operated primarily through a shell.
What Is A Shell?
A shell is a program that accepts commands and instructs the operating system to execute them.
Conceptually:
User
↓
Shell
↓
Operating System
The shell acts as an intermediary between the user and the operating system.
Without a shell, interacting with Linux would be significantly more difficult.
Common Linux Shells
Several shells exist.
Examples:
| Shell | Description |
|---|---|
| sh | Traditional Unix shell |
| bash | Bourne Again Shell |
| zsh | Z Shell |
| fish | Friendly Interactive Shell |
The most commonly encountered shell is:
bash
Many Linux systems use bash by default.
Shell Sessions
When a user logs into a Linux system, the operating system typically starts a shell.
Examples:
alice
↓
bash
root
↓
bash
The shell then waits for commands.
Conceptually:
Start Shell
↓
Receive Command
↓
Execute Command
↓
Wait For Next Command
Commands
A shell executes commands.
Examples:
pwd
Display current directory.
ls
List directory contents.
whoami
Display current user.
ip a
Display network interfaces.
systemctl status ssh
Inspect service status.
The purpose of this lesson is not to memorize commands.
The purpose is understanding the role of the shell.
Commands will be introduced naturally throughout OOTW.
Shells and Privileges
Commands execute within the security context of the current user.
Example:
alice
↓
bash
↓
Command Executes As alice
root
↓
bash
↓
Command Executes As root
The same command may produce different results depending on the user's privileges.
This is why privileges remain important even within a shell.
Shells and Automation
Shells are frequently used to automate tasks.
Examples:
- Backups
- Monitoring
- Administration
- Deployment
- Security tooling
A series of shell commands can be stored within a script.
Example:
backup.sh
The shell reads the script and executes the commands automatically.
Interactive vs Non-Interactive Shells
Not every shell is attached to a user sitting at a keyboard.
Examples:
| Type | Example |
|---|---|
| Interactive | User terminal |
| Non-Interactive | Script execution |
| Non-Interactive | Automated task |
| Non-Interactive | Service execution |
Understanding this distinction becomes important during investigations and security assessments.
Remote Shells
Shells do not need to be local.
Examples:
SSH
↓
Remote Shell
An Operator may control a system from another location while interacting with a shell.
Remote administration relies heavily on this concept.
Reverse Shells
A reverse shell occurs when a system initiates a connection and provides shell access to another system.
Conceptually:
Target
↓
Connects To
↓
Operator
↓
Shell Access
Reverse shells are commonly encountered in:
- Penetration Testing
- Red Teaming
- Malware
- Incident Response
The details will be explored later in OOTW. There are other types of operational shells such as "bind shells" and "web shells".
For now, it is sufficient to understand that a shell may be delivered across a network connection.
It is also a term you will encounter constantly.
Operator Perspective
When approaching an unfamiliar Linux system, Operators commonly ask:
Environment
- Which shell is being used?
- Which user owns the shell?
- What privileges exist?
Administration
- What commands are available?
- What scripts exist?
Investigations
- What commands were executed?
- What shell history exists? (it may be disabled possibly)
- Was remote shell access obtained?
Security
- Were reverse shells observed?
- Were unusual shell sessions created?
- Were scripts executed automatically?
Many investigations ultimately involve understanding shell activity.
Shell History
Many shells record previously executed commands.
Examples:
~/.bash_history
~/.zsh_history
Shell history can provide valuable evidence during investigations.
Examples:
- Commands executed
- Administrative actions
- Script execution
- User behavior
Shell history is frequently reviewed during incident response and forensic investigations.
Telemetry and Shells
Shell activity often generates telemetry.
Examples:
- Authentication logs
- SSH logs
- Service logs
- Shell history
- Audit logs
This allows Operators to reconstruct user activity and investigate incidents.
Key Takeaways
- A shell provides a command-line interface to the operating system.
- The shell acts as an intermediary between users and the operating system.
- Bash is the most commonly encountered Linux shell.
- Commands execute within the security context of the current user.
- Shells may be local or remote.
- Shells can be used interactively or non-interactively.
- Shell scripts allow automation.
- Reverse shells provide command-line access across a network.
- Shell history frequently provides valuable investigative evidence.
- Understanding shells is fundamental to administration, security operations, and offensive security.
The Linux curriculum concludes here. The concepts introduced throughout these lessons form the foundation required to understand how the Linux OS works on a surface level.