I am sending shellcode to a 64-bit binary running on a Windows machine. This binary, copies the shellcode to an executable region of memory and executes it.
I am generating the shellcode using msfvenom and I chose the payload: windows/x64/shell_reverse_tcp
On the local machine, I am listening on port 3004 with netcat.
When I send the shellcode, on the listener side, I get the command prompt momentarily and then connection is closed immediately as shown below:
listening on [any] 3004 ... connect to [192.168.2.10] from (UNKNOWN) [192.168.2.20] 42485 Microsoft Windows [Version 10.0.17134.112] (c) 2018 Microsoft Corporation. All rights reserved. C:\WINDOWS\system32> C:\Users\user\Documents\netcat-win32-1.11>
It closes the connection so quickly that I don't get a chance to type in a command.
Note: I do not have access to the server lab environment where the binary is running. All I know is that there is some security solution running on that machine which is preventing this. However, I know the details of the binary and that it takes a shellcode, allocates a new memory, copies it there and executes it.
So, what are my options for bypassing security solutions in this case?
There is port blocking issue here because I am able to get the reverse shell through any port. The issue is that the connection is closed immediately. And it's not a network issue, there is some security solution running on the server side. It's a lab environment and so I know it.
Is there a way to configure nmap to send a list of commands as soon as it receives response from the server?