The reverse shell payload from msf use a new port to connect back to the attacker, therefore if the target server has outgoing filters, attack would fail.

i.e established server:ftp <-> attacker:12345

After exploit

server: 23456 <-> attacker:4444 // why not try to connect the 12345 port?

But why would it use a new port, why not REUSE the existing channel?

2 Answers 2


Reusing the existing channel requires additional complexity, its also important to note that not every metasploit module uses a socket to exploit the host. The shellcode would have to search memory (egghunt...) and find the socket and then use it. Shellcode is all about being small and simple.

That being said there are other methods of influencing a host behind an exotic firewall. download+exec shellcode is one method.

  • 1
    There is a metasploit payload module called linux/x86/shell_find_port that does exactly what you're describing. It takes the client's source port as an option, which it then later uses to search memory for a sockaddr_in structure belonging to the client with the same port number. However, I've had more luck with this payload in the past: link. It uses a neat trick with the dup, dup2, and execve system calls to create a one-way shell. That's provided your target is linux, of course! May 31, 2015 at 21:41

It uses a new port because the existing channel is in one direction and from a separate process ....

A reverse shell starts a new process with new connections in the outgoing direction. Firewalls make a distinction between new connections in one direction and existing connections. What a MSF revshell is doing is making a new network connection to the attacker's box. You can either guess what port might be free, or use the 'allports' reverse shell to run through all ports looking for a free port to communicate on.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .