# Modern reverse shell handlers **URL:** \ **Category:** General\ **Tags:** redteam, tools\ **Created:** [September 19, 2026, 1:55pm UTC](https://taggartinstitute.org/t/modern-reverse-shell-handlers/840 "2026-09-19T13:55:55Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![mttaggart](https://taggartinstitute.org/user_avatar/taggartinstitute.org/mttaggart/32/10_2.png) [@mttaggart](https://taggartinstitute.org/u/mttaggart)\ **Post date:** [September 19, 2026, 1:55pm UTC](https://taggartinstitute.org/t/modern-reverse-shell-handlers/840/1 "2026-09-19T13:55:55Z")
What are y’all using to catch shells these days? Not talking about full C2, just something a cut above `nc`. I have a feeling folks have some favorite tools here, and I’ve recently had reason to need them. ---
**Author:** ![ath0](https://taggartinstitute.org/letter_avatar_proxy/v4/letter/a/e0b2c6/32.png) [@ath0](https://taggartinstitute.org/u/ath0)\ **Post date:** [September 22, 2026, 1:46am UTC](https://taggartinstitute.org/t/modern-reverse-shell-handlers/840/2 "2026-09-22T01:46:23Z")
From a red team standpoint, I haven’t done shells in the past couple of years. Too noisy and easily caught. Have license for Cobalt Strike, not using that this go around. Too easily caught when operating. That being said, I haven’t dug into the nooks and crannies of the latest version. Python. Look to python for really good fun and games for C2 and operations. It’s not as instrumented as cmd.exe or powershell. (At least w/the EDR we’re running, so ymmv.) ---
**Author:** ![mttaggart](https://taggartinstitute.org/user_avatar/taggartinstitute.org/mttaggart/32/10_2.png) [@mttaggart](https://taggartinstitute.org/u/mttaggart)\ **Post date:** [September 22, 2026, 1:59am UTC](https://taggartinstitute.org/t/modern-reverse-shell-handlers/840/3 "2026-09-22T01:59:29Z")
I’m very aware of Python, but that is not what I wanted! Sometimes you just want to catch a reverse shell from a web app RCE or HackTheBox challenge. And I want it auto-stabilized. If there’s a Python tool for that, rad. Recommendations welcome. ---
**Author:** ![ath0](https://taggartinstitute.org/letter_avatar_proxy/v4/letter/a/e0b2c6/32.png) [@ath0](https://taggartinstitute.org/u/ath0)\ **Post date:** [September 22, 2026, 2:06am UTC](https://taggartinstitute.org/t/modern-reverse-shell-handlers/840/4 "2026-09-22T02:06:00Z")
All good. I was anchored on the redteam tag. For ctfs, I’ve pretty much stuck to nc or a Metasploit listener. ---
**Author:** ![an00b](https://taggartinstitute.org/user_avatar/taggartinstitute.org/an00b/32/274_2.png) [@an00b](https://taggartinstitute.org/u/an00b)\ **Post date:** [September 24, 2026, 4:47pm UTC](https://taggartinstitute.org/t/modern-reverse-shell-handlers/840/5 "2026-09-24T16:47:51Z")
I quickly did some searches in the HTB discord and it looks like [Penelope](https://github.com/brightio/penelope) might be the new thing now that calebstewart officially archived pwncat? I haven’t used it at all because I either use nc or a C2, and on very rare occasions I’ll write something quick in Python if want a forward shell sort of thing going on ([example of what I’m talking about](https://0xdf.gitlab.io/2022/04/04/htb-inception.html#forward-shell)). ---
**Author:** ![Brumbo](https://taggartinstitute.org/user_avatar/taggartinstitute.org/brumbo/32/380_2.png) [@Brumbo](https://taggartinstitute.org/u/Brumbo)\ **Post date:** [September 27, 2026, 4:15am UTC](https://taggartinstitute.org/t/modern-reverse-shell-handlers/840/6 "2026-09-27T04:15:16Z")
been using penelope myself for a bit, it’s very nice ---
**Author:** ![mttaggart](https://taggartinstitute.org/user_avatar/taggartinstitute.org/mttaggart/32/10_2.png) [@mttaggart](https://taggartinstitute.org/u/mttaggart)\ **Post date:** [September 27, 2026, 4:21am UTC](https://taggartinstitute.org/t/modern-reverse-shell-handlers/840/7 "2026-09-27T04:21:10Z")
Thanks! I will give that a go on my next HTB foray.