Reverse Shell

Reverse shell (connect-back). Same idea, opposite direction: the shellcode calls connect() outbound to an IP and port the attacker controls, duplicates that socket onto stdin/stdout/stderr, then execves /bin/sh. The attacker just needs a listener running beforehand (nc -lvp <port>), and the target calls them. This became the more popular of the two specifically because 90s network perimeters were usually configured to block unsolicited inbound connections to arbitrary ports (a bind shell on port 31337 would just get firewalled) while leaving outbound traffic largely unrestricted — a reverse shell walks straight through that asymmetry.