0

I have created a malicious .exe file with the use of msfvenom in my local environment. And I created a listener by using multi/handler in Metasploit

I send it to Windows 7, but when I run this test.exe malicious file in Windows 7, it shows me an error:

e:/test.exe
The NTVDM CPU has encountered an illegal instruction.
CS:0000 IP:0075 OP:f0 00 f0 37 05 Choose 'Close' to terminate the application.

with two options "Close" and "Ignore"

When I ignore it, it simply disappears but I didn't get any meterpreter shell in my listener.

What will be the problem? I tried to use -e shikata_ga_nai thinking that there may be some antivirus blocking it but it still shows me the same error.

  • 2
    Do you know what an illegal instruction is? – forest Dec 5 '18 at 11:28
  • Frankly, I don't know. @forest – janu agrawal Dec 7 '18 at 6:57
0

A CPU can only recognize certain instructions, so an instruction for one kind of CPU might not be recognized by another kind. When that happens, an illegal instruction exception is raised. It's the machine code equivalent of "unknown command". It means that something in the executable is not a proper instruction for the architecture it is executing on, either because you compiled it wrong, or because it got corrupted in transit. This could mean any of the following:

  • A mistake was made and the program was compiled for the wrong architecture.

  • Corruption occurred somewhere between creating the executable and running it.

  • You are trying to run the program on an unsupported CPU.

My suggestion would be to restart the system (to drop the filesystem cache) and generate the payload again. If it still fails to execute, try using a different encoder, or don't use any encoder at all. If this still doesn't work and the problem is repeatable, then you already have all the information you need in the error message. It tells you the offending instruction and where in the code the instruction is located. You can disassemble the executable and check this for yourself. Make sure that the instruction is legal for the architecture you are running on. You may need to read up a bit on x86 assembly to do this.

  • Wow! Great explain. Thanks, I will do as you said above. – janu agrawal Dec 7 '18 at 7:52
0

NTVDM is a virtual environment set up for executing 16-bit programs. This was probably compiled/created incorrectly, or screwed up during transfer.

  • Hi Nick, did you mean that during transfer the file test.exe to Windows 7, it was screwed up? – janu agrawal Dec 7 '18 at 6:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.