I recently successfully uploaded an msfvenom binary payload into a Windows server 2008 VM.

My netcat listener displays the following message:

connect to [lhost ip] from (UNKNOWN) [rhost ip] 49155

which means it is connected.

But when I run commands such as dir it doesn't output anything. What do you think is the problem?

  • How will netcat be able to interact with msf payload?
    – yeah_well
    Mar 5 '20 at 20:02
  • 1
    I generated a reverse tcp stager not a meterpreter shell payload Mar 6 '20 at 8:24
  • And it worked before Mar 6 '20 at 8:24

I solved it by generating a different payload.

Payload that didn't work: /windows/x64/shell/reverse_tcp

Payload that worked: /windows/x64/shell_reverse_tcp (and adding some flags -e x64/xor -i 5)

  • 5
    If I remember correctly, they are 2 different kinds of payload in msf: staged and non-staged. Payload in the form shell/reverse_tcp are staged payloads and the one in the form shell_reverse_tcp are not. Staged payloads are smaller in size, but after the connection the second stage has to be sent to the victim. The non-staged payloads are bigger but "all in one". That would be why a staged payload isn't working with nc as a receiver: nc is not sending the second stage.
    – Scaum
    Mar 6 '20 at 15:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.