Reverse Shell Generator

A reverse shell has a target machine connect back to a listener you control, giving you an interactive shell across networks and NAT/firewalls that block inbound connections. It is a staple of authorized penetration testing and CTFs. Enter your listener's host (LHOST) and port (LPORT) and this tool fills them into one-liners for bash, netcat, python, perl, php, ruby, and PowerShell, plus the listener command to catch the connection.

How it works. First you start a listener — classically nc -lvnp <port> — on the host you control. Then you run one of the generated payloads on the target (through whatever command execution you have). The payload opens a TCP socket back to your LHOST:LPORT and wires the shell's stdin/stdout/stderr to it. Because the connection is outbound from the target, it often succeeds where a bind shell (listening on the target) would be blocked by ingress filtering.

Choosing a payload. Availability drives the choice: the bare bash -i >& /dev/tcp/... trick needs a bash built with /dev/tcp; nc -e needs the traditional netcat (many systems ship a version without -e, so the mkfifo variant is provided); python, perl, php, and ruby are common on servers; PowerShell suits Windows targets. Try several if the first is unavailable.

Practical notes. A raw reverse shell is often a "dumb" TTY — no job control, no tab completion, and Ctrl-C kills it. After landing, upgrade to a full PTY (the usual python -c 'import pty;pty.spawn("/bin/bash")' followed by stty raw -echo) for a stable session. If the shell dies instantly, the port may be filtered or the interpreter missing. Choosing the listener port strategically also matters: egress firewalls frequently allow outbound 443 or 53 while blocking arbitrary high ports, so a callback to 443 often succeeds where 4444 is dropped — though inspecting proxies may still reject non-TLS traffic on a TLS port. When nothing connects at all, confirm the listener is actually bound and reachable before assuming the payload failed.

Legal and defensive angle. Use this only on systems you own or are explicitly authorized to test — running a reverse shell on someone else's machine is a crime. From the defender's seat, the same knowledge is your detection map: alert on /dev/tcp usage, shells spawned by web-server or database processes, unexpected outbound connections to high ports, and interpreters (python/perl/php) making network sockets. Egress filtering, application allowlisting, and monitoring child processes of internet-facing services are what break this technique.