RaccShells

Self-contained reverse shell generator · zero dependencies · single HTML file
_{For authorised penetration testing and CTF use only}

---

What is it?

RaccShells is a self-contained, single-file reverse shell reference tool. Open index.html — no server, no install, no internet required. Enter your IP and port, copy the shell, and go.

Built with a dark terminal aesthetic: scanline overlay, matrix green, monospace everything.

---

Feature Overview

Tab	Contents
Reverse Shells	72 shells across Bash, Python, Perl, PHP, Ruby, PowerShell, Java, Go, Lua, Awk, …
Bind Shells	14 bind-side listeners
MSFVenom	25 ready-to-paste msfvenom payloads
Shell Upgrade	TTY spawn, stty raw, socat fully interactive, escape binaries
Tools & Listeners	pwncat-cs, pwncat (cytopia), Chashell, HellShell, SSL-AES, FuegoShell, CHAOS RAT, tmate
Living off the Land	Windows (LOLBAS) + Linux + macOS — download, exec, persistence, tunnel

---

Traffic Flow Diagrams

Every shell shows an animated SVG diagram when expanded — no static images, generated inline.

flowchart LR
subgraph VICTIM
V["💻 :random"]
end
subgraph ATTACKER
A["🖥 :4444 LISTEN"]
end
V -- "① TCP connect-back" --> A
A -. "② commands" .-> V
V -. "③ output" .-> A

Loading

flowchart LR
subgraph ATTACKER
A["🖥 connects"]
end
subgraph VICTIM
V["💻 :4444 LISTEN"]
end
A -- "① connect to port" --> V
A -. "② commands" .-> V
V -. "③ output" .-> A

Loading

flowchart LR
subgraph VICTIM
V["💻 DNS client"]
end
subgraph DNS["DNS Nameserver\nyour domain NS"]
D[" "]
end
subgraph ATTACKER
A["🖥 NS record"]
end
V -- "① DNS query\n(XSalsa20 enc)" --> D
D -- "NS forward" --> A
A -. "② encoded response" .-> D
D -. "NS reply" .-> V

Loading

flowchart LR
subgraph VICTIM
V["💻 polling"]
end
subgraph ATTACKER
A["🖥 HTTP :80"]
end
V -- "① GET /token\npoll for cmd" --> A
A -. "② 200 encoded cmd" .-> V
V -- "③ POST /token\nencoded output" --> A

Loading

flowchart LR
subgraph VICTIM
V["💻 :random"]
end
subgraph ATTACKER
A["🖥 :443 LISTEN"]
end
V -- "① TLS handshake" --> A
A -- "② 🔒 encrypted cmd" --> V
V -- "③ 🔒 encrypted output" --> A
style A fill:#1a1200,stroke:#cc9900
style V fill:#1a0000,stroke:#ff4444

Loading

---

Shell Obfuscation

Each shell that contains an interpreter supports dynamic obfuscation — click ▶ obf to cycle modes without leaving the page.

stateDiagram-v2
[*] --> plain
plain --> base64 : click obf
base64 --> var_split : click obf
var_split --> hex_printf : click obf
hex_printf --> plain : click obf
state "bash base64" as base64
note right of base64
bash -c "$(echo '...'|base64 -d)"
end note
state "$var split" as var_split
note right of var_split
b='ba';s='sh'; eval $b$s${IFS}-i...
end note
state "hex printf" as hex_printf
note right of hex_printf
eval "$(printf '\x62\x61\x73\x68...')"
end note

Loading

Obfuscation modes per interpreter:

Interpreter	Modes
Bash / Zsh / Sh	base64 · $var split · hex printf
PowerShell	-EncodedCommand (UTF-16LE) · [char[]] IEX
Python	exec(base64.b64decode(...))
Perl	eval(pack('H*', hex))
PHP	eval(base64_decode(...))
Ruby	eval(Base64.decode64(...))

---

Encrypted Shells

Shells with encrypted transport are highlighted in gold and carry a 🔒 badge.

flowchart TD
subgraph Encrypted["🔒 Encrypted Transport"]
direction LR
E1["OpenSSL s_client"]
E2["PowerShell TLS #4"]
E3["Ncat --ssl"]
E4["HoaxShell HTTPS"]
E5["SSL-AES C++ Shell"]
E6["Chashell DNS (XSalsa20)"]
end

Loading

Use the 🔒 encrypted filter chip to show only these shells.

---

Living off the Land

Techniques organised by OS, each with its own filter view.

mindmap
root((LotL))
Windows
Download & Execute
certutil
bitsadmin
curl Win10+
PowerShell cradle
Code Execution
mshta HTA
regsvr32 Squiblydoo
rundll32 JS
MSBuild C#
InstallUtil
wmic
Persistence
Registry Run key
Scheduled Task
Startup folder
Linux
Download & Execute
curl pipe bash
wget pipe bash
python3 fetch
File Transfer
nc / socat
dd raw
base64 paste
Tunneling
SSH reverse tunnel
SSH SOCKS5
Chisel
Persistence
crontab
systemd user service
LD_PRELOAD
macOS
Download & Execute
curl pipe bash
osascript
Persistence
LaunchAgent plist
crontab

Loading

---

Tools & Listeners

Tool	Type	Platform
pwncat-cs	Post-exploitation platform	Linux
pwncat (cytopia)	Netcat on steroids	Linux / Mac / Win
Chashell	DNS reverse shell	All
HellShell	Shellcode obfuscator	Windows
SSL-AES Reverse Shell	TLS C++ shell	Windows
FuegoShell	SMB named-pipe shell	Windows
CHAOS RAT	Go RAT with web UI	Linux / Win
tmate	Terminal sharing via SSH	Linux / Mac

---

Usage

# Option 1 — open directly in browser (no server needed)
open index.html # macOS
start index.html # Windows
xdg-open index.html # Linux# Option 2 — serve locally
python3 -m http.server 8080
# → http://localhost:8080

1. Set LHOST / IP, PORT, and preferred shell binary
2. Pick a listener from the dropdown — the attacker-side command auto-updates
3. Use the filter chips to narrow by OS, encryption, or obfuscation support
4. Click a shell to expand — diagram animates, copy button is ready
5. Optionally click ▶ obf to cycle through obfuscation modes before copying

---

Listener Dropdown

flowchart LR
L["Listener Dropdown"] --> NC["nc -lvnp PORT"]
L --> NCAT["ncat -lvnp PORT"]
L --> SOCAT["socat file:tty,raw TCP-LISTEN:PORT"]
L --> RLWRAP["rlwrap nc -lvnp PORT (TTY)"]
L --> MSF["msf multi/handler"]
L --> PCS["pwncat-cs -lp PORT"]
L --> PCY["pwncat -l -p PORT"]

Loading