Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The reverse shell payload from msf use a new port to connect back to the attacker, therefore if the target server has outgoing filters, attack would fail.

i.e established server:ftp <-> attacker:12345

After exploit

server: 23456 <-> attacker:4444 // why not try to connect the 12345 port?

But why would it use a new port, why not REUSE the existing channel?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Reusing the existing channel requires additional complexity, its also important to note that not every metasploit module uses a socket to exploit the host. The shellcode would have to search memory (egghunt...) and find the socket and then use it. Shellcode is all about being small and simple.

That being said there are other methods of influencing a host behind an exotic firewall. download+exec shellcode is one method.

share|improve this answer

It uses a new port because the existing channel is in one direction and from a separate process ....

A reverse shell starts a new process with new connections in the outgoing direction. Firewalls make a distinction between new connections in one direction and existing connections. What a MSF revshell is doing is making a new network connection to the attacker's box. You can either guess what port might be free, or use the 'allports' reverse shell to run through all ports looking for a free port to communicate on.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.