Shell-Eggs · Examples

Which shell mode?

Tell me what you want to do. Every card gives you the right SHELL_TYPE and the exact command to run on your side. The egg handles the rest.

🖥️

ssh (or ssh-hardened for keys-only)

ssh -p <PORT> alice@<host>

Server Shells family →

🔐

Passwordless, CA-signed SSH

ssh-cert

ssh -i mykey -o CertificateFile=mykey-cert.pub -p <PORT> alice@<host>

Server Shells family →

🔁

A persistent session that survives drops

tmux (or screen / zellij)

tmux attach -t shell-eggs

Multiplexers family →

🕳️

Reach another host through this container

ssh-local (-L), ssh-dynamic (-D SOCKS5)

ssh -p <PORT> -N -L 8080:target.host:80 alice@<host>

Tunnels family →

↩️

Expose a container port on my machine

ssh-remote (-R)

ssh -p <PORT> -N -R 9090:internal.host:80 alice@<host>

Tunnels family →

🎣

The container to call me back

python-pty (gold standard: socat)

SHELL_REVERSE_HOST=your.ip nc -lvnp 4444   # then pick python-pty

Reverse Shells family →

🛡️

Encrypted callback through TLS

openssl-rs / socat-tls / ncat-ssl

socat file:$(tty),raw,echo=0 OPENSSL-LISTEN:4444,cert=server.pem,verify=0

Secure / Covert family →

🕸️

A shell that looks like web traffic

wssh (websocket) or ttyd (browser)

browser → http://<host>:7681

Web Terminals family →

📡

Someone connects in to me

socat-bind (PTY) or openssl-bind (TLS)

nc <host> <PORT>

Bind Shells family →

🔬

Debug SSH auth or trace a session

ssh-debug, strace-shell, tcpdump-shell

ssh -p <PORT> -vvv alice@<host>   # while sshd -ddd streams to console

Debug Shells family →

Listener recipes

Before the egg's reverse/secure shells call you, your side must be listening. These are the gold-standard commands.

Plain TCP listener

nc -lvnp 4444

Interactive PTY listener

socat file:$(tty),raw,echo=0 TCP-L:4444

TLS listener (openssl)

openssl s_server -quiet -accept 4444 -cert server.pem -key server.pem

TLS listener (socat)

socat file:$(tty),raw,echo=0 OPENSSL-LISTEN:4444,cert=server.pem,verify=0

UDP listener

nc -luvnp 4444

Generate a TLS pair first

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out server.pem -days 365 -nodes

Every reverse-shell payload reconnects forever; the supervisor watches it. TLS listeners need a certificate pair (self-signed is fine for lab use - pin the fingerprint).

The complete reference with deep-dive explanations lives in SHELLs.md. Every boot prints the relevant guide next to the shell you chose.