Shells

Choose the connection direction

For a reverse shell, the target must reach the listener on your reachable interface:

nc -lvnp LPORT

Replace LPORT with a numeric listener port. Use the matching reverse/bind shell command for the target's shell and available runtime. A bind shell instead needs a route from you to its listening port. Across a pivot, check both directions explicitly.

Verify where execution landed

Linux:

hostname
id
pwd

Windows:

hostname
whoami /all
cd

No callback: verify execution independently, then listener, route and egress. An interactive executable is not automatically a valid Windows service executable. A web shell runs as the web worker identity and may have a restricted environment; inspect that context before choosing host escalation.

For an execution or callback failure, use the diagnostic order: delivery, parser/interpreter, OS/architecture/runtime, consumer, execution evidence, then connection path. Do not regenerate payloads repeatedly without new evidence. For a public PoC that needs changes, return to exploit adaptation.

Capture proof and retain reproduction steps

From the required interactive target shell, verify identity and display the objective file at its actual original location. Replace the paths below with that location; do not copy the proof into a convenient directory first.

Linux:

hostname
id
ip addr
cat /PATH/proof.txt

Windows:

hostname
whoami
ipconfig
type C:\PATH\proof.txt

The same original-location requirement applies to local.txt. Capture the required proof content and target IP in the screenshot, submit the proof in the control panel before the exam ends, and retain the commands/output needed to reproduce the access path. A web-shell read or a file copied to Kali is not the required interactive proof. Current OffSec requirements.

Use the existing evidence checkpoint, exploit evidence requirements and report reconstruction. Record the actual tested path, not only a flag or a successful command pasted without its prerequisites.