Man in the Terminal

This write-up presents a command-line interception technique for Unix-like systems that leverages PATH hijacking and shell rc file changes to place proxy middleware binaries ahead of legitimate tools (e.g., ssh), enabling transparent capture of stdin/stdout/stderr for pseudo-keylogging and session logging. It further explores broadening coverage by changing a user’s login shell to the middleware, highlighting practical implications for red teams while maintaining normal user workflows.