General security

An Introduction to tmux

In this introduction, we cover a basic set of features for tmux and a little hands-on using it in some specific use cases. The article was inspired by keeping w3af alive across ssh sessions questions on the w3af mailing list.

Features

• What is tmux?
• Resuming applications after disconnect
• Pane splitting
• Cheat sheet
• Conclusion

What is tmux?

Tmux is a terminal multiplexer which allows the user to interact with multiple terminals managed under a single tmux session. It can be used locally or remotely. The tmux session can persist beyond ssh logout. The name of the active session and available sessions are also easily readable. Window splitting with pane management is supported out of the box. So, let's get started.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

Simple term explanation to make it easier to understand:

Sessions hold panes which hold windows. That is, sessions are what you suspend and connect to with tmux. Panes are what organize your viewport. Windows are what hold each individual application instance.

Resuming applications after disconnect

So, you want to run some application on a remote machine and keep it running without being connected to the machine? Enter tmux. Although not it's the only purpose, tmux can be used to hold applications open on a remote machine even after disconnecting an ssh session.

In order use tmux for this purpose, ssh into the remote machine. Start the tmux client by entering the command "tmux". This will start the tmux server if required. You can specify a specific location for the file socket used to communicate between the client and server. By default, the socket file is in /tmp.

A simple example would be running w3af on a remote machine you spin up on a droplet from the digital ocean from another machine where you don't have access to many tools or to change the apparent source of a test. It seems to come up on the w3af mailing list from time to time, along with bugs where the GUI doesn't load properly on Mac OSX unless you're running in a docker container/in a VM/on a remote machine.

One last thing before we get started, Ctrl-B gets you to a "command mode" similar to the mode in vim where you yank and put lines of text as opposed to "insert mode" where you actually interact with the text directly. Similarly, to interact with panes individually, you have to select them from this command mode. Moreover, to disconnect and leave the ssh connection, you can bounce through command mode.

We ssh into the remote machine. In this example, we'll just be using a VM of Kali Linux.

Check to ensure your VM is using bridged networking:

That's select your VM in the left pane.

Settings in the toolbar.

Network in the new window's left pane.

In the dropdown in the right pane select Bridged.

Select OK.

Your VM should already be selected, so now just start it by clicking the play button in the toolbar. The bootsplash will offer several options; we'll just use Live. If you're using the base GUI image, you probably want to be running about 4GB of ram. If you're using something insanely low like 512MB, you'll get a failed to allocate memory error.

Next, on the Kali machine, we need to start sshd:

Open a terminal and enter "service ssh restart."

The reason we're using restart instead of start is so that if the service is started but not working, we bounce it anyway. It's just one of my habits.

Now on the host machine open a terminal and enter the following:

"ssh root@192.168.1.20"

Where out VM IP address is 192.168.1.20. This says connect to the remote host with the password root. It will prompt for a password. If you haven't changed it, it should be toor.

Next, we start the tmux client:

"tmux"

Now we can launch w3af-console

"w3af_console"

Name the session

"Ctrl-B" "$myw3af"

The $ should get you into the command bar at the bottom of the screen. When you enter myw3af it should look like this:

 

Suspend the connection to the tmux client and drop out of our ssh connection

"Ctrl-B" "d"

You should get the feedback [detached (from session myw3af)]

Disconnect from the ssh connection

"Ctrl d"

Now to reconnect we can ssh back in

"ssh root@192.168.0.103"

We can just use the up arrow to get the previously used command.

Find the session we want

"tmux list-session"

You should get feedback something like myw3af: 1 windows (created Wed Jan 18 17:14:24 2017) [80x23]

Attach to that session

"tmux attach -t myw3af"

You should find yourself reconnected to the w3af_console session.

Moreover, in practice, we would be connected back after we left a presumably long running task spinning on our droplet. Now we can go ahead and exit out of that application and end the session.

"Ctrl-B" "x"

It will ask for confirmation that you want to kill the current session. After confirmation (y) we can make sure the application actually exited with "ps -A | grep w3af" and tmux list-sessions. The ps shouldn't return anything, and the list-sessions should return

"no server running on /tmp/tmux-0/default"

Pane splitting

Screen splitting for running multiple applications in a single terminal can be really useful in several contexts. We could use it for seeing all of those aircrack-ng commands in a single aterm session with multiple panes in one terminal instance. Another would be if we were administering some machine and wanted a "top" instance above our terminal. To achieve this example, we could:

ssh into the remote server:

"ssh root@192.168.0.103"

Start tmux:

"tmux"

Start our top instance by running top in the new tmux instance:

"top"

Get in to command mode:

Ctrl-b

Split the screen:

"""

Your result would be something like this:

Your new pane will be whatever default shell your tmux config specifies. If you quit an application in a pane, the two sides of the split just merge and resize. We can simply rename this session as before:

"Ctrl b" "$topsplit"

Then drop out of the session:

"Ctrl b" "d"

When we resume, our pane configuration will be exactly as we left it.

There's a convenient cheat sheet [here](https://gist.github.com/MohamedAlaa/2961058)

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

Conclusion

So, what did we do? We covered getting a tmux session started, suspending it, reconnecting to it on a new SSH session, forwarded a GUI application, dealt with a little window splitting.