How do arbitrary payloads execute on the remote machine?

Question

I understand executing something like a reverse TCP bind via shell relies on resources being available on the victim machine... and in the case of running a, shall we say, Ruby script from the command line it will be interpreted down to machine code and executed...

My question is, when you drop machine code directly into the remote machine via exploit via Metasploit or such, what if the code doesn't match the CPU? How is it interpreted and executed? Or does it come down to the 'attacker' knowing what payload to use?

Please forgive the high-level question, I am relatively new to penetration testing.

Answer 1

Assuming you have located a buffer overrun (or equivalent), If the machine code doesn't match the language of the remote machine, then the expected result is that the application with the overrun will crash.

The overrun will operate as 'normal', trying to execute the code in your binary blob of a payload. The victim system will attempt to execute the instructions, but the instructions will not operate as expected for the target system - any given instruction will likely mean something different for the target system than the payload developer intended. The victim system will, nonetheless, attempt execution. Some operations may work perfectly fine. Some operations may be illegal instructions, potentially causing an exception or a crash. Eventually, it is likely that the combination of instructions will either corrupt the running application beyond recovery, or outright perform a valid instruction under an illegal context, and the process will crash.

Answer 2

As atk's answer states, providing wrong binary code will most likely result in a crash.

However, you may make reasonable assumptions about the CPU - basic x86 code is compatible with almost all desktop systems; and it's quite possible that your original exploit / overrun is in some particular software that runs only on x86 and not, say, the ARM processors used in many mobile devices.