Reverse Shell

Why it matters

Once an attacker gets code execution on a host, they want an interactive shell — and the direction of the connection is everything. A bind shell opens a listening port on the victim for the attacker to connect to, which almost always fails: inbound connections are what firewalls block. A reverse shell flips it: the victim connects out to the attacker's waiting listener. Outbound traffic, especially on 443, is usually allowed, so the reverse shell sails through the perimeter that stopped the bind shell. That single insight is why "reverse shell" is the near-universal post-exploitation payload.

For defenders it reframes the problem. You will not catch this at the inbound firewall — you catch it by noticing a server process that has no business making outbound connections suddenly dialling a strange host, and by controlling egress. Understanding the mechanism tells you where to look: the callback, not the break-in.

Listener, callback and encoding

There are two halves. The attacker starts a listener (classically nc -lvnp 443) and waits. The payload run on the victim opens a socket back to that listener and wires the host's shell (/bin/bash, cmd.exe, PowerShell) to it, so the attacker's keystrokes run on the victim and its output streams back.

• The payload is written in whatever the victim already has — bash, nc, python, php, perl, ruby, PowerShell, socat, openssl. Living off existing interpreters (see LOLBins) avoids dropping a new binary that an EDR would flag.
• Payloads are often encoded to survive the delivery channel and dodge naive signatures — URL-encoding to pass through a web parameter, Base64, or PowerShell's -EncodedCommand (UTF-16LE Base64, usually with -NoP -W Hidden).
• A raw reverse shell is fragile (no job control, no tab-completion); attackers "upgrade" it to a full pseudo-terminal, and a C2 framework replaces the raw nc listener entirely for encryption, session management and persistence.

It is a means to an end: the shell usually lands with the web/app service's privileges, and the next move is privilege escalation.

Common misreadings

• Blocking inbound does nothing here. The dangerous connection is outbound. Egress filtering and outbound-connection monitoring are the controls that matter.
• A shell is not domain admin. It typically runs as the exploited service account; treat it as the start of the intrusion, not the end — the real damage follows privilege escalation and lateral movement.
• Authorisation and scope are the whole game. Generating or running these against systems you are not explicitly permitted to test is a crime in most places, regardless of intent.

Related terms

• LOLBin — A LOLBin (Living Off the Land Binary) is a legitimate, pre-installed system tool — certutil, mshta, rundll32 — that an attacker repurposes to download, execute or hide malicious activity, so nothing "new" ever touches disk.
• Privilege Escalation — Privilege escalation is gaining higher-level access than an attacker started with — from a regular user to an administrator (vertical), or from one regular user's access to another's (horizontal).
• C2 — C2 (Command and Control) is the channel an attacker uses to remotely control compromised hosts — send commands, pull data, push new tools — after the initial compromise.
• MITRE ATT&CK — MITRE ATT&CK is a public, curated catalogue of the behaviours real attackers use, organised so defenders can say "we saw T1059.001" instead of "some PowerShell thing".