+-------------------+ +-------------------+ | Attacker Machine | | Target Server | | (Listening Mode) | | (Running PHP) | +---------+---------+ +---------+---------+ | | | 1. Starts listener on port 4444 | | (e.g., nc -lvnp 4444) | | | | 2. Triggers execution of PHP script ----> | | | 3. Connects back via TCP on port 4444 | <------------------------------------------+ | | | 4. Establishes interactive shell | V V
The proc_open() function provides more granular control over process execution and is widely used in more robust reverse shell implementations:
Because outgoing connections are less likely to be blocked by firewalls than incoming connections, reverse shells are highly effective at bypassing network restrictions. PHP is one of the most common vectors for implementing a reverse shell due to its ubiquity in web hosting environments. How a PHP Reverse Shell Works Reverse Shell Php
The administrator or penetration tester sets up a local port to listen for incoming connections.
Configure your web server (Apache, Nginx) to drop execution permissions entirely on files stored within upload directories. Connects back via TCP on port 4444 |
( -l = listen, -v = verbose, -n = no DNS, -p = port)
In a traditional bind shell, the attacker attempts to connect directly to a specific port on the target server. However, modern firewalls and Network Address Translation (NAT) routers usually block unsolicited inbound traffic. A reverse shell flips this dynamic: Configure your web server (Apache, Nginx) to drop
Some networks block arbitrary TCP ports but allow ICMP (ping). An advanced reverse shell can encode commands in ICMP packets using tools like icmpsh or custom PHP scripts.
Before triggering the reverse shell, the attacker's machine must be prepared to receive the incoming connection. The most common tool for this purpose is :
This compact version uses fsockopen() to create a socket connection and exec() to launch an interactive shell, redirecting the shell's input, output, and error streams through the socket using file descriptor manipulation.
Save uploaded documents to a directory that cannot be directly accessed via a URL. Implement the Principle of Least Privilege