|
The reverse shell payload from msf use a new port to connect back to the attacker, therefore if the target server has outgoing filters, attack would fail. i.e established server:ftp <-> attacker:12345 After exploit server: 23456 <-> attacker:4444 // why not try to connect the 12345 port? But why would it use a new port, why not REUSE the existing channel? |
|||
|
|
|
Reusing the existing channel requires additional complexity, its also important to note that not every metasploit module uses a socket to exploit the host. The shellcode would have to search memory (egghunt...) and find the socket and then use it. Shellcode is all about being small and simple. That being said there are other methods of influencing a host behind an exotic firewall. download+exec shellcode is one method. |
|||
|
|
|
It uses a new port because the existing channel is in one direction and from a separate process .... A reverse shell starts a new process with new connections in the outgoing direction. Firewalls make a distinction between new connections in one direction and existing connections. What a MSF revshell is doing is making a new network connection to the attacker's box. You can either guess what port might be free, or use the 'allports' reverse shell to run through all ports looking for a free port to communicate on. |
|||
|
|
