0

Is it possible to send a TCP payload to an open port that executes a specific arbitrary command on the target device using Metasploit or any other program? For example with Windows 10 Server OS?

I searched for any answers to my question, but i didn't find any (they where all reverse TCP handlers and yes they do work, but you need to make the target device execute the reverse TCP payload).

Improve this question
4
  • Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking.
    – Community Bot
    Sep 2 at 19:07
  • 2
    Windows does not allow by design code execution just by sending something to an open port. Such exploits need vulnerabilities to work. An exploit is thus only possible if the application listening on the specific port has a vulnerability or if there is a vulnerability at the OS level.
    – Steffen Ullrich
    Sep 2 at 19:08
  • So you can't just send a command like "download a specific file" without access? You need to exploit a vulnerability?
    – AndyCrypto
    Sep 2 at 21:44
  • 2
    If that was possible, we'd all be screwed... Every computer connected to the internet would be compromised, and everyone would shut them off. Why would you think that this would be a normal function of the Operating System?
    – schroeder ♦
    Sep 3 at 9:13

1 Answer 1

Reset to default
3

Short answer is no, long answer is depends.

Short answer: no, that's not how systems works. You need authorization to run commands on systems, and if you don't have authorization, you cannot run anything on them.

Long answer: depends on several issues, is a catastrophic failure, it's extremely rare to find one "in the wild," and it usually leads to total compromise and potential destruction of the system (or systems) affected.

If the system is part of a Windows Domain, you can send them commands to run if you are part of the domain, and you have proper privileges on the domain. There are some commands (like psexec) that allows you to send commands to any connected system on the domain.

If the system have vulnerable applications running, you could send a specially crafted packet to the port used by the application, trigger an error and execute code when it should not.

Other applications parse user input and execute procedures based on the input, and could be tricked into executing code instead.

Remote code execution pathways are a high priority issue on any organization and they are addressed very fast. Applications with remote code execution are usually taken offline or firewalled from external access until fixed. User logins that are compromised are locked out.

Usually a system that is vulnerable to a unauthenticated remote code execution over network will get infected with either ransomware, crypto mining software, or both.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .